]> git.ipfire.org Git - thirdparty/kernel/stable-queue.git/commitdiff
5.10-stable patches
authorGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Sun, 15 Aug 2021 12:54:03 +0000 (14:54 +0200)
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Sun, 15 Aug 2021 12:54:03 +0000 (14:54 +0200)
added patches:
acpi-nfit-fix-support-for-virtual-spa-ranges.patch
arc-fp-set-fpu_status.fwe-to-enable-fpu_status-update-on-context-switch.patch
asoc-amd-fix-reference-to-pcm-buffer-address.patch
asoc-intel-atom-fix-reference-to-pcm-buffer-address.patch
asoc-tlv320aic31xx-fix-jack-detection-after-suspend.patch
asoc-uniphier-fix-reference-to-pcm-buffer-address.patch
asoc-xilinx-fix-reference-to-pcm-buffer-address.patch
ceph-reduce-contention-in-ceph_check_delayed_caps.patch
cifs-create-sd-context-must-be-a-multiple-of-8.patch
drm-amd-display-remove-invalid-assert-for-odm-mpc-case.patch
drm-amd-display-use-gfp_atomic-in-amdgpu_dm_irq_schedule_work.patch
drm-amdgpu-don-t-enable-baco-on-boco-platforms-in-runpm.patch
drm-i915-display-fix-the-12-bpc-bits-for-pipe_misc-reg.patch
i2c-dev-zero-out-array-used-for-i2c-reads-from-userspace.patch
iio-adc-fix-incorrect-exit-of-for-loop.patch
iio-adc-ti-ads7950-ensure-cs-is-deasserted-after-reading-channels.patch
iio-adis-set-gpio-reset-pin-direction.patch
iio-humidity-hdc100x-add-margin-to-the-conversion-time.patch
libnvdimm-region-fix-label-activation-vs-errors.patch
net-ethernet-ti-cpsw-fix-min-eth-packet-size-for-non-switch-use-cases.patch
scsi-lpfc-move-initialization-of-phba-poll_list-earlier-to-avoid-crash.patch
seccomp-fix-setting-loaded-filter-count-during-tsync.patch

23 files changed:
queue-5.10/acpi-nfit-fix-support-for-virtual-spa-ranges.patch [new file with mode: 0644]
queue-5.10/arc-fp-set-fpu_status.fwe-to-enable-fpu_status-update-on-context-switch.patch [new file with mode: 0644]
queue-5.10/asoc-amd-fix-reference-to-pcm-buffer-address.patch [new file with mode: 0644]
queue-5.10/asoc-intel-atom-fix-reference-to-pcm-buffer-address.patch [new file with mode: 0644]
queue-5.10/asoc-tlv320aic31xx-fix-jack-detection-after-suspend.patch [new file with mode: 0644]
queue-5.10/asoc-uniphier-fix-reference-to-pcm-buffer-address.patch [new file with mode: 0644]
queue-5.10/asoc-xilinx-fix-reference-to-pcm-buffer-address.patch [new file with mode: 0644]
queue-5.10/ceph-reduce-contention-in-ceph_check_delayed_caps.patch [new file with mode: 0644]
queue-5.10/cifs-create-sd-context-must-be-a-multiple-of-8.patch [new file with mode: 0644]
queue-5.10/drm-amd-display-remove-invalid-assert-for-odm-mpc-case.patch [new file with mode: 0644]
queue-5.10/drm-amd-display-use-gfp_atomic-in-amdgpu_dm_irq_schedule_work.patch [new file with mode: 0644]
queue-5.10/drm-amdgpu-don-t-enable-baco-on-boco-platforms-in-runpm.patch [new file with mode: 0644]
queue-5.10/drm-i915-display-fix-the-12-bpc-bits-for-pipe_misc-reg.patch [new file with mode: 0644]
queue-5.10/i2c-dev-zero-out-array-used-for-i2c-reads-from-userspace.patch [new file with mode: 0644]
queue-5.10/iio-adc-fix-incorrect-exit-of-for-loop.patch [new file with mode: 0644]
queue-5.10/iio-adc-ti-ads7950-ensure-cs-is-deasserted-after-reading-channels.patch [new file with mode: 0644]
queue-5.10/iio-adis-set-gpio-reset-pin-direction.patch [new file with mode: 0644]
queue-5.10/iio-humidity-hdc100x-add-margin-to-the-conversion-time.patch [new file with mode: 0644]
queue-5.10/libnvdimm-region-fix-label-activation-vs-errors.patch [new file with mode: 0644]
queue-5.10/net-ethernet-ti-cpsw-fix-min-eth-packet-size-for-non-switch-use-cases.patch [new file with mode: 0644]
queue-5.10/scsi-lpfc-move-initialization-of-phba-poll_list-earlier-to-avoid-crash.patch [new file with mode: 0644]
queue-5.10/seccomp-fix-setting-loaded-filter-count-during-tsync.patch [new file with mode: 0644]
queue-5.10/series [new file with mode: 0644]

diff --git a/queue-5.10/acpi-nfit-fix-support-for-virtual-spa-ranges.patch b/queue-5.10/acpi-nfit-fix-support-for-virtual-spa-ranges.patch
new file mode 100644 (file)
index 0000000..c748281
--- /dev/null
@@ -0,0 +1,59 @@
+From b93dfa6bda4d4e88e5386490f2b277a26958f9d3 Mon Sep 17 00:00:00 2001
+From: Dan Williams <dan.j.williams@intel.com>
+Date: Wed, 11 Aug 2021 11:53:37 -0700
+Subject: ACPI: NFIT: Fix support for virtual SPA ranges
+
+From: Dan Williams <dan.j.williams@intel.com>
+
+commit b93dfa6bda4d4e88e5386490f2b277a26958f9d3 upstream.
+
+Fix the NFIT parsing code to treat a 0 index in a SPA Range Structure as
+a special case and not match Region Mapping Structures that use 0 to
+indicate that they are not mapped. Without this fix some platform BIOS
+descriptions of "virtual disk" ranges do not result in the pmem driver
+attaching to the range.
+
+Details:
+In addition to typical persistent memory ranges, the ACPI NFIT may also
+convey "virtual" ranges. These ranges are indicated by a UUID in the SPA
+Range Structure of UUID_VOLATILE_VIRTUAL_DISK, UUID_VOLATILE_VIRTUAL_CD,
+UUID_PERSISTENT_VIRTUAL_DISK, or UUID_PERSISTENT_VIRTUAL_CD. The
+critical difference between virtual ranges and UUID_PERSISTENT_MEMORY,
+is that virtual do not support associations with Region Mapping
+Structures.  For this reason the "index" value of virtual SPA Range
+Structures is allowed to be 0. If a platform BIOS decides to represent
+NVDIMMs with disconnected "Region Mapping Structures" (range-index ==
+0), the kernel may falsely associate them with standalone ranges where
+the "SPA Range Structure Index" is also zero. When this happens the
+driver may falsely require labels where "virtual disks" are expected to
+be label-less. I.e. "label-less" is where the namespace-range ==
+region-range and the pmem driver attaches with no user action to create
+a namespace.
+
+Cc: Jacek Zloch <jacek.zloch@intel.com>
+Cc: Lukasz Sobieraj <lukasz.sobieraj@intel.com>
+Cc: "Lee, Chun-Yi" <jlee@suse.com>
+Cc: <stable@vger.kernel.org>
+Fixes: c2f32acdf848 ("acpi, nfit: treat virtual ramdisk SPA as pmem region")
+Reported-by: Krzysztof Rusocki <krzysztof.rusocki@intel.com>
+Reported-by: Damian Bassa <damian.bassa@intel.com>
+Reviewed-by: Jeff Moyer <jmoyer@redhat.com>
+Link: https://lore.kernel.org/r/162870796589.2521182.1240403310175570220.stgit@dwillia2-desk3.amr.corp.intel.com
+Signed-off-by: Dan Williams <dan.j.williams@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/acpi/nfit/core.c |    3 +++
+ 1 file changed, 3 insertions(+)
+
+--- a/drivers/acpi/nfit/core.c
++++ b/drivers/acpi/nfit/core.c
+@@ -3031,6 +3031,9 @@ static int acpi_nfit_register_region(str
+               struct acpi_nfit_memory_map *memdev = nfit_memdev->memdev;
+               struct nd_mapping_desc *mapping;
++              /* range index 0 == unmapped in SPA or invalid-SPA */
++              if (memdev->range_index == 0 || spa->range_index == 0)
++                      continue;
+               if (memdev->range_index != spa->range_index)
+                       continue;
+               if (count >= ND_MAX_MAPPINGS) {
diff --git a/queue-5.10/arc-fp-set-fpu_status.fwe-to-enable-fpu_status-update-on-context-switch.patch b/queue-5.10/arc-fp-set-fpu_status.fwe-to-enable-fpu_status-update-on-context-switch.patch
new file mode 100644 (file)
index 0000000..9035706
--- /dev/null
@@ -0,0 +1,72 @@
+From 3a715e80400f452b247caa55344f4f60250ffbcf Mon Sep 17 00:00:00 2001
+From: Vineet Gupta <vgupta@synopsys.com>
+Date: Thu, 8 Jul 2021 17:13:48 -0700
+Subject: ARC: fp: set FPU_STATUS.FWE to enable FPU_STATUS update on context switch
+
+From: Vineet Gupta <vgupta@synopsys.com>
+
+commit 3a715e80400f452b247caa55344f4f60250ffbcf upstream.
+
+FPU_STATUS register contains FP exception flags bits which are updated
+by core as side-effect of FP instructions but can also be manually
+wiggled such as by glibc C99 functions fe{raise,clear,test}except() etc.
+To effect the update, the programming model requires OR'ing FWE
+bit (31). This bit is write-only and RAZ, meaning it is effectively
+auto-cleared after write and thus needs to be set everytime: which
+is how glibc implements this.
+
+However there's another usecase of FPU_STATUS update, at the time of
+Linux task switch when incoming task value needs to be programmed into
+the register. This was added as part of f45ba2bd6da0dc ("ARCv2:
+fpu: preserve userspace fpu state") which missed OR'ing FWE bit,
+meaning the new value is effectively not being written at all.
+This patch remedies that.
+
+Interestingly, this snafu was not caught in interm glibc testing as the
+race window which relies on a specific exception bit to be set/clear is
+really small specially when it nvolves context switch.
+Fortunately this was caught by glibc's math/test-fenv-tls test which
+repeatedly set/clear exception flags in a big loop, concurrently in main
+program and also in a thread.
+
+Fixes: https://github.com/foss-for-synopsys-dwc-arc-processors/linux/issues/54
+Fixes: f45ba2bd6da0dc ("ARCv2: fpu: preserve userspace fpu state")
+Cc: stable@vger.kernel.org     #5.6+
+Signed-off-by: Vineet Gupta <vgupta@synopsys.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ arch/arc/kernel/fpu.c |    9 ++++++---
+ 1 file changed, 6 insertions(+), 3 deletions(-)
+
+--- a/arch/arc/kernel/fpu.c
++++ b/arch/arc/kernel/fpu.c
+@@ -57,23 +57,26 @@ void fpu_save_restore(struct task_struct
+ void fpu_init_task(struct pt_regs *regs)
+ {
++      const unsigned int fwe = 0x80000000;
++
+       /* default rounding mode */
+       write_aux_reg(ARC_REG_FPU_CTRL, 0x100);
+-      /* set "Write enable" to allow explicit write to exception flags */
+-      write_aux_reg(ARC_REG_FPU_STATUS, 0x80000000);
++      /* Initialize to zero: setting requires FWE be set */
++      write_aux_reg(ARC_REG_FPU_STATUS, fwe);
+ }
+ void fpu_save_restore(struct task_struct *prev, struct task_struct *next)
+ {
+       struct arc_fpu *save = &prev->thread.fpu;
+       struct arc_fpu *restore = &next->thread.fpu;
++      const unsigned int fwe = 0x80000000;
+       save->ctrl = read_aux_reg(ARC_REG_FPU_CTRL);
+       save->status = read_aux_reg(ARC_REG_FPU_STATUS);
+       write_aux_reg(ARC_REG_FPU_CTRL, restore->ctrl);
+-      write_aux_reg(ARC_REG_FPU_STATUS, restore->status);
++      write_aux_reg(ARC_REG_FPU_STATUS, (fwe | restore->status));
+ }
+ #endif
diff --git a/queue-5.10/asoc-amd-fix-reference-to-pcm-buffer-address.patch b/queue-5.10/asoc-amd-fix-reference-to-pcm-buffer-address.patch
new file mode 100644 (file)
index 0000000..c9e50a5
--- /dev/null
@@ -0,0 +1,59 @@
+From 8b5d95313b6d30f642e4ed0125891984c446604e Mon Sep 17 00:00:00 2001
+From: Takashi Iwai <tiwai@suse.de>
+Date: Sat, 31 Jul 2021 10:43:31 +0200
+Subject: ASoC: amd: Fix reference to PCM buffer address
+
+From: Takashi Iwai <tiwai@suse.de>
+
+commit 8b5d95313b6d30f642e4ed0125891984c446604e upstream.
+
+PCM buffers might be allocated dynamically when the buffer
+preallocation failed or a larger buffer is requested, and it's not
+guaranteed that substream->dma_buffer points to the actually used
+buffer.  The driver needs to refer to substream->runtime->dma_addr
+instead for the buffer address.
+
+Cc: <stable@vger.kernel.org>
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Link: https://lore.kernel.org/r/20210731084331.32225-1-tiwai@suse.de
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ sound/soc/amd/acp-pcm-dma.c          |    2 +-
+ sound/soc/amd/raven/acp3x-pcm-dma.c  |    2 +-
+ sound/soc/amd/renoir/acp3x-pdm-dma.c |    2 +-
+ 3 files changed, 3 insertions(+), 3 deletions(-)
+
+--- a/sound/soc/amd/acp-pcm-dma.c
++++ b/sound/soc/amd/acp-pcm-dma.c
+@@ -969,7 +969,7 @@ static int acp_dma_hw_params(struct snd_
+       acp_set_sram_bank_state(rtd->acp_mmio, 0, true);
+       /* Save for runtime private data */
+-      rtd->dma_addr = substream->dma_buffer.addr;
++      rtd->dma_addr = runtime->dma_addr;
+       rtd->order = get_order(size);
+       /* Fill the page table entries in ACP SRAM */
+--- a/sound/soc/amd/raven/acp3x-pcm-dma.c
++++ b/sound/soc/amd/raven/acp3x-pcm-dma.c
+@@ -288,7 +288,7 @@ static int acp3x_dma_hw_params(struct sn
+               pr_err("pinfo failed\n");
+       }
+       size = params_buffer_bytes(params);
+-      rtd->dma_addr = substream->dma_buffer.addr;
++      rtd->dma_addr = substream->runtime->dma_addr;
+       rtd->num_pages = (PAGE_ALIGN(size) >> PAGE_SHIFT);
+       config_acp3x_dma(rtd, substream->stream);
+       return 0;
+--- a/sound/soc/amd/renoir/acp3x-pdm-dma.c
++++ b/sound/soc/amd/renoir/acp3x-pdm-dma.c
+@@ -248,7 +248,7 @@ static int acp_pdm_dma_hw_params(struct
+               return -EINVAL;
+       size = params_buffer_bytes(params);
+       period_bytes = params_period_bytes(params);
+-      rtd->dma_addr = substream->dma_buffer.addr;
++      rtd->dma_addr = substream->runtime->dma_addr;
+       rtd->num_pages = (PAGE_ALIGN(size) >> PAGE_SHIFT);
+       config_acp_dma(rtd, substream->stream);
+       init_pdm_ring_buffer(MEM_WINDOW_START, size, period_bytes,
diff --git a/queue-5.10/asoc-intel-atom-fix-reference-to-pcm-buffer-address.patch b/queue-5.10/asoc-intel-atom-fix-reference-to-pcm-buffer-address.patch
new file mode 100644 (file)
index 0000000..7e11a3a
--- /dev/null
@@ -0,0 +1,48 @@
+From 2e6b836312a477d647a7920b56810a5a25f6c856 Mon Sep 17 00:00:00 2001
+From: Takashi Iwai <tiwai@suse.de>
+Date: Wed, 28 Jul 2021 13:23:50 +0200
+Subject: ASoC: intel: atom: Fix reference to PCM buffer address
+
+From: Takashi Iwai <tiwai@suse.de>
+
+commit 2e6b836312a477d647a7920b56810a5a25f6c856 upstream.
+
+PCM buffers might be allocated dynamically when the buffer
+preallocation failed or a larger buffer is requested, and it's not
+guaranteed that substream->dma_buffer points to the actually used
+buffer.  The address should be retrieved from runtime->dma_addr,
+instead of substream->dma_buffer (and shouldn't use virt_to_phys).
+
+Also, remove the line overriding runtime->dma_area superfluously,
+which was already set up at the PCM buffer allocation.
+
+Cc: Cezary Rojewski <cezary.rojewski@intel.com>
+Cc: Pierre-Louis Bossart <pierre-louis.bossart@linux.intel.com>
+Cc: <stable@vger.kernel.org>
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Link: https://lore.kernel.org/r/20210728112353.6675-3-tiwai@suse.de
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ sound/soc/intel/atom/sst-mfld-platform-pcm.c |    3 +--
+ 1 file changed, 1 insertion(+), 2 deletions(-)
+
+--- a/sound/soc/intel/atom/sst-mfld-platform-pcm.c
++++ b/sound/soc/intel/atom/sst-mfld-platform-pcm.c
+@@ -127,7 +127,7 @@ static void sst_fill_alloc_params(struct
+       snd_pcm_uframes_t period_size;
+       ssize_t periodbytes;
+       ssize_t buffer_bytes = snd_pcm_lib_buffer_bytes(substream);
+-      u32 buffer_addr = virt_to_phys(substream->dma_buffer.area);
++      u32 buffer_addr = substream->runtime->dma_addr;
+       channels = substream->runtime->channels;
+       period_size = substream->runtime->period_size;
+@@ -233,7 +233,6 @@ static int sst_platform_alloc_stream(str
+       /* set codec params and inform SST driver the same */
+       sst_fill_pcm_params(substream, &param);
+       sst_fill_alloc_params(substream, &alloc_params);
+-      substream->runtime->dma_area = substream->dma_buffer.area;
+       str_params.sparams = param;
+       str_params.aparams = alloc_params;
+       str_params.codec = SST_CODEC_TYPE_PCM;
diff --git a/queue-5.10/asoc-tlv320aic31xx-fix-jack-detection-after-suspend.patch b/queue-5.10/asoc-tlv320aic31xx-fix-jack-detection-after-suspend.patch
new file mode 100644 (file)
index 0000000..e7600c8
--- /dev/null
@@ -0,0 +1,58 @@
+From 2c39ca6885a2ec03e5c9e7c12a4da2aa8926605a Mon Sep 17 00:00:00 2001
+From: Mark Brown <broonie@kernel.org>
+Date: Fri, 23 Jul 2021 19:02:00 +0100
+Subject: ASoC: tlv320aic31xx: Fix jack detection after suspend
+
+From: Mark Brown <broonie@kernel.org>
+
+commit 2c39ca6885a2ec03e5c9e7c12a4da2aa8926605a upstream.
+
+The tlv320aic31xx driver relies on regcache_sync() to restore the register
+contents after going to _BIAS_OFF, for example during system suspend. This
+does not work for the jack detection configuration since that is configured
+via the same register that status is read back from so the register is
+volatile and not cached. This can also cause issues during init if the jack
+detection ends up getting set up before the CODEC is initially brought out
+of _BIAS_OFF, we will reset the CODEC and resync the cache as part of that
+process.
+
+Fix this by explicitly reapplying the jack detection configuration after
+resyncing the register cache during power on.
+
+This issue was found by an engineer working off-list on a product
+kernel, I just wrote up the upstream fix.
+
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Link: https://lore.kernel.org/r/20210723180200.25105-1-broonie@kernel.org
+Cc: stable@vger.kernel.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ sound/soc/codecs/tlv320aic31xx.c |   10 ++++++++++
+ 1 file changed, 10 insertions(+)
+
+--- a/sound/soc/codecs/tlv320aic31xx.c
++++ b/sound/soc/codecs/tlv320aic31xx.c
+@@ -35,6 +35,9 @@
+ #include "tlv320aic31xx.h"
++static int aic31xx_set_jack(struct snd_soc_component *component,
++                            struct snd_soc_jack *jack, void *data);
++
+ static const struct reg_default aic31xx_reg_defaults[] = {
+       { AIC31XX_CLKMUX, 0x00 },
+       { AIC31XX_PLLPR, 0x11 },
+@@ -1256,6 +1259,13 @@ static int aic31xx_power_on(struct snd_s
+               return ret;
+       }
++      /*
++       * The jack detection configuration is in the same register
++       * that is used to report jack detect status so is volatile
++       * and not covered by the cache sync, restore it separately.
++       */
++      aic31xx_set_jack(component, aic31xx->jack, NULL);
++
+       return 0;
+ }
diff --git a/queue-5.10/asoc-uniphier-fix-reference-to-pcm-buffer-address.patch b/queue-5.10/asoc-uniphier-fix-reference-to-pcm-buffer-address.patch
new file mode 100644 (file)
index 0000000..0c46eb8
--- /dev/null
@@ -0,0 +1,39 @@
+From 827f3164aaa579eee6fd50c6654861d54f282a11 Mon Sep 17 00:00:00 2001
+From: Takashi Iwai <tiwai@suse.de>
+Date: Wed, 28 Jul 2021 13:23:52 +0200
+Subject: ASoC: uniphier: Fix reference to PCM buffer address
+
+From: Takashi Iwai <tiwai@suse.de>
+
+commit 827f3164aaa579eee6fd50c6654861d54f282a11 upstream.
+
+Along with the transition to the managed PCM buffers, the driver now
+accepts the dynamically allocated buffer, while it still kept the
+reference to the old preallocated buffer address.  This patch corrects
+to the right reference via runtime->dma_addr.
+
+(Although this might have been already buggy before the cleanup with
+the managed buffer, let's put Fixes tag to point that; it's a corner
+case, after all.)
+
+Fixes: d55894bc2763 ("ASoC: uniphier: Use managed buffer allocation")
+Cc: <stable@vger.kernel.org>
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Link: https://lore.kernel.org/r/20210728112353.6675-5-tiwai@suse.de
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ sound/soc/uniphier/aio-dma.c |    2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/sound/soc/uniphier/aio-dma.c
++++ b/sound/soc/uniphier/aio-dma.c
+@@ -198,7 +198,7 @@ static int uniphier_aiodma_mmap(struct s
+       vma->vm_page_prot = pgprot_writecombine(vma->vm_page_prot);
+       return remap_pfn_range(vma, vma->vm_start,
+-                             substream->dma_buffer.addr >> PAGE_SHIFT,
++                             substream->runtime->dma_addr >> PAGE_SHIFT,
+                              vma->vm_end - vma->vm_start, vma->vm_page_prot);
+ }
diff --git a/queue-5.10/asoc-xilinx-fix-reference-to-pcm-buffer-address.patch b/queue-5.10/asoc-xilinx-fix-reference-to-pcm-buffer-address.patch
new file mode 100644 (file)
index 0000000..e7d159d
--- /dev/null
@@ -0,0 +1,37 @@
+From 42bc62c9f1d3d4880bdc27acb5ab4784209bb0b0 Mon Sep 17 00:00:00 2001
+From: Takashi Iwai <tiwai@suse.de>
+Date: Wed, 28 Jul 2021 13:23:51 +0200
+Subject: ASoC: xilinx: Fix reference to PCM buffer address
+
+From: Takashi Iwai <tiwai@suse.de>
+
+commit 42bc62c9f1d3d4880bdc27acb5ab4784209bb0b0 upstream.
+
+PCM buffers might be allocated dynamically when the buffer
+preallocation failed or a larger buffer is requested, and it's not
+guaranteed that substream->dma_buffer points to the actually used
+buffer.  The driver needs to refer to substream->runtime->dma_addr
+instead for the buffer address.
+
+Cc: <stable@vger.kernel.org>
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Link: https://lore.kernel.org/r/20210728112353.6675-4-tiwai@suse.de
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ sound/soc/xilinx/xlnx_formatter_pcm.c |    4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/sound/soc/xilinx/xlnx_formatter_pcm.c
++++ b/sound/soc/xilinx/xlnx_formatter_pcm.c
+@@ -452,8 +452,8 @@ static int xlnx_formatter_pcm_hw_params(
+       stream_data->buffer_size = size;
+-      low = lower_32_bits(substream->dma_buffer.addr);
+-      high = upper_32_bits(substream->dma_buffer.addr);
++      low = lower_32_bits(runtime->dma_addr);
++      high = upper_32_bits(runtime->dma_addr);
+       writel(low, stream_data->mmio + XLNX_AUD_BUFF_ADDR_LSB);
+       writel(high, stream_data->mmio + XLNX_AUD_BUFF_ADDR_MSB);
diff --git a/queue-5.10/ceph-reduce-contention-in-ceph_check_delayed_caps.patch b/queue-5.10/ceph-reduce-contention-in-ceph_check_delayed_caps.patch
new file mode 100644 (file)
index 0000000..23d9486
--- /dev/null
@@ -0,0 +1,154 @@
+From bf2ba432213fade50dd39f2e348085b758c0726e Mon Sep 17 00:00:00 2001
+From: Luis Henriques <lhenriques@suse.de>
+Date: Tue, 6 Jul 2021 14:52:41 +0100
+Subject: ceph: reduce contention in ceph_check_delayed_caps()
+
+From: Luis Henriques <lhenriques@suse.de>
+
+commit bf2ba432213fade50dd39f2e348085b758c0726e upstream.
+
+Function ceph_check_delayed_caps() is called from the mdsc->delayed_work
+workqueue and it can be kept looping for quite some time if caps keep
+being added back to the mdsc->cap_delay_list.  This may result in the
+watchdog tainting the kernel with the softlockup flag.
+
+This patch breaks this loop if the caps have been recently (i.e. during
+the loop execution).  Any new caps added to the list will be handled in
+the next run.
+
+Also, allow schedule_delayed() callers to explicitly set the delay value
+instead of defaulting to 5s, so we can ensure that it runs soon
+afterward if it looks like there is more work.
+
+Cc: stable@vger.kernel.org
+URL: https://tracker.ceph.com/issues/46284
+Signed-off-by: Luis Henriques <lhenriques@suse.de>
+Reviewed-by: Jeff Layton <jlayton@kernel.org>
+Signed-off-by: Ilya Dryomov <idryomov@gmail.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ fs/ceph/caps.c       |   17 ++++++++++++++++-
+ fs/ceph/mds_client.c |   25 ++++++++++++++++---------
+ fs/ceph/super.h      |    2 +-
+ 3 files changed, 33 insertions(+), 11 deletions(-)
+
+--- a/fs/ceph/caps.c
++++ b/fs/ceph/caps.c
+@@ -4202,11 +4202,19 @@ bad:
+ /*
+  * Delayed work handler to process end of delayed cap release LRU list.
++ *
++ * If new caps are added to the list while processing it, these won't get
++ * processed in this run.  In this case, the ci->i_hold_caps_max will be
++ * returned so that the work can be scheduled accordingly.
+  */
+-void ceph_check_delayed_caps(struct ceph_mds_client *mdsc)
++unsigned long ceph_check_delayed_caps(struct ceph_mds_client *mdsc)
+ {
+       struct inode *inode;
+       struct ceph_inode_info *ci;
++      struct ceph_mount_options *opt = mdsc->fsc->mount_options;
++      unsigned long delay_max = opt->caps_wanted_delay_max * HZ;
++      unsigned long loop_start = jiffies;
++      unsigned long delay = 0;
+       dout("check_delayed_caps\n");
+       spin_lock(&mdsc->cap_delay_lock);
+@@ -4214,6 +4222,11 @@ void ceph_check_delayed_caps(struct ceph
+               ci = list_first_entry(&mdsc->cap_delay_list,
+                                     struct ceph_inode_info,
+                                     i_cap_delay_list);
++              if (time_before(loop_start, ci->i_hold_caps_max - delay_max)) {
++                      dout("%s caps added recently.  Exiting loop", __func__);
++                      delay = ci->i_hold_caps_max;
++                      break;
++              }
+               if ((ci->i_ceph_flags & CEPH_I_FLUSH) == 0 &&
+                   time_before(jiffies, ci->i_hold_caps_max))
+                       break;
+@@ -4230,6 +4243,8 @@ void ceph_check_delayed_caps(struct ceph
+               }
+       }
+       spin_unlock(&mdsc->cap_delay_lock);
++
++      return delay;
+ }
+ /*
+--- a/fs/ceph/mds_client.c
++++ b/fs/ceph/mds_client.c
+@@ -4435,22 +4435,29 @@ void inc_session_sequence(struct ceph_md
+ }
+ /*
+- * delayed work -- periodically trim expired leases, renew caps with mds
++ * delayed work -- periodically trim expired leases, renew caps with mds.  If
++ * the @delay parameter is set to 0 or if it's more than 5 secs, the default
++ * workqueue delay value of 5 secs will be used.
+  */
+-static void schedule_delayed(struct ceph_mds_client *mdsc)
++static void schedule_delayed(struct ceph_mds_client *mdsc, unsigned long delay)
+ {
+-      int delay = 5;
+-      unsigned hz = round_jiffies_relative(HZ * delay);
+-      schedule_delayed_work(&mdsc->delayed_work, hz);
++      unsigned long max_delay = HZ * 5;
++
++      /* 5 secs default delay */
++      if (!delay || (delay > max_delay))
++              delay = max_delay;
++      schedule_delayed_work(&mdsc->delayed_work,
++                            round_jiffies_relative(delay));
+ }
+ static void delayed_work(struct work_struct *work)
+ {
+-      int i;
+       struct ceph_mds_client *mdsc =
+               container_of(work, struct ceph_mds_client, delayed_work.work);
++      unsigned long delay;
+       int renew_interval;
+       int renew_caps;
++      int i;
+       dout("mdsc delayed_work\n");
+@@ -4490,7 +4497,7 @@ static void delayed_work(struct work_str
+       }
+       mutex_unlock(&mdsc->mutex);
+-      ceph_check_delayed_caps(mdsc);
++      delay = ceph_check_delayed_caps(mdsc);
+       ceph_queue_cap_reclaim_work(mdsc);
+@@ -4498,7 +4505,7 @@ static void delayed_work(struct work_str
+       maybe_recover_session(mdsc);
+-      schedule_delayed(mdsc);
++      schedule_delayed(mdsc, delay);
+ }
+ int ceph_mdsc_init(struct ceph_fs_client *fsc)
+@@ -4984,7 +4991,7 @@ void ceph_mdsc_handle_mdsmap(struct ceph
+                         mdsc->mdsmap->m_epoch);
+       mutex_unlock(&mdsc->mutex);
+-      schedule_delayed(mdsc);
++      schedule_delayed(mdsc, 0);
+       return;
+ bad_unlock:
+--- a/fs/ceph/super.h
++++ b/fs/ceph/super.h
+@@ -1138,7 +1138,7 @@ extern void ceph_flush_snaps(struct ceph
+ extern bool __ceph_should_report_size(struct ceph_inode_info *ci);
+ extern void ceph_check_caps(struct ceph_inode_info *ci, int flags,
+                           struct ceph_mds_session *session);
+-extern void ceph_check_delayed_caps(struct ceph_mds_client *mdsc);
++extern unsigned long ceph_check_delayed_caps(struct ceph_mds_client *mdsc);
+ extern void ceph_flush_dirty_caps(struct ceph_mds_client *mdsc);
+ extern int  ceph_drop_caps_for_unlink(struct inode *inode);
+ extern int ceph_encode_inode_release(void **p, struct inode *inode,
diff --git a/queue-5.10/cifs-create-sd-context-must-be-a-multiple-of-8.patch b/queue-5.10/cifs-create-sd-context-must-be-a-multiple-of-8.patch
new file mode 100644 (file)
index 0000000..45413f9
--- /dev/null
@@ -0,0 +1,34 @@
+From 7d3fc01796fc895e5fcce45c994c5a8db8120a8d Mon Sep 17 00:00:00 2001
+From: Shyam Prasad N <sprasad@microsoft.com>
+Date: Wed, 4 Aug 2021 18:37:22 +0000
+Subject: cifs: create sd context must be a multiple of 8
+
+From: Shyam Prasad N <sprasad@microsoft.com>
+
+commit 7d3fc01796fc895e5fcce45c994c5a8db8120a8d upstream.
+
+We used to follow the rule earlier that the create SD context
+always be a multiple of 8. However, with the change:
+cifs: refactor create_sd_buf() and and avoid corrupting the buffer
+...we recompute the length, and we failed that rule.
+Fixing that with this change.
+
+Cc: <stable@vger.kernel.org> # v5.10+
+Signed-off-by: Shyam Prasad N <sprasad@microsoft.com>
+Signed-off-by: Steve French <stfrench@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ fs/cifs/smb2pdu.c |    2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/fs/cifs/smb2pdu.c
++++ b/fs/cifs/smb2pdu.c
+@@ -2367,7 +2367,7 @@ create_sd_buf(umode_t mode, bool set_own
+       memcpy(aclptr, &acl, sizeof(struct cifs_acl));
+       buf->ccontext.DataLength = cpu_to_le32(ptr - (__u8 *)&buf->sd);
+-      *len = ptr - (__u8 *)buf;
++      *len = roundup(ptr - (__u8 *)buf, 8);
+       return buf;
+ }
diff --git a/queue-5.10/drm-amd-display-remove-invalid-assert-for-odm-mpc-case.patch b/queue-5.10/drm-amd-display-remove-invalid-assert-for-odm-mpc-case.patch
new file mode 100644 (file)
index 0000000..ad79dac
--- /dev/null
@@ -0,0 +1,30 @@
+From c90f6263f58a28c3d97b83679d6fd693b33dfd4e Mon Sep 17 00:00:00 2001
+From: Eric Bernstein <eric.bernstein@amd.com>
+Date: Mon, 26 Jul 2021 15:53:18 -0400
+Subject: drm/amd/display: Remove invalid assert for ODM + MPC case
+
+From: Eric Bernstein <eric.bernstein@amd.com>
+
+commit c90f6263f58a28c3d97b83679d6fd693b33dfd4e upstream.
+
+Reviewed-by: Dmytro Laktyushkin <Dmytro.Laktyushkin@amd.com>
+Acked-by: Anson Jacob <Anson.Jacob@amd.com>
+Signed-off-by: Eric Bernstein <eric.bernstein@amd.com>
+Cc: stable@vger.kernel.org
+Tested-by: Daniel Wheeler <daniel.wheeler@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/amd/display/dc/dcn30/dcn30_resource.c |    1 -
+ 1 file changed, 1 deletion(-)
+
+--- a/drivers/gpu/drm/amd/display/dc/dcn30/dcn30_resource.c
++++ b/drivers/gpu/drm/amd/display/dc/dcn30/dcn30_resource.c
+@@ -1875,7 +1875,6 @@ static bool dcn30_split_stream_for_mpc_o
+               }
+               pri_pipe->next_odm_pipe = sec_pipe;
+               sec_pipe->prev_odm_pipe = pri_pipe;
+-              ASSERT(sec_pipe->top_pipe == NULL);
+               sec_pipe->stream_res.opp = pool->opps[pipe_idx];
+               if (sec_pipe->stream->timing.flags.DSC == 1) {
diff --git a/queue-5.10/drm-amd-display-use-gfp_atomic-in-amdgpu_dm_irq_schedule_work.patch b/queue-5.10/drm-amd-display-use-gfp_atomic-in-amdgpu_dm_irq_schedule_work.patch
new file mode 100644 (file)
index 0000000..6cf0dd6
--- /dev/null
@@ -0,0 +1,92 @@
+From 0cde63a8fc4d9f9f580c297211fd05f91c0fd66d Mon Sep 17 00:00:00 2001
+From: Anson Jacob <Anson.Jacob@amd.com>
+Date: Fri, 30 Jul 2021 19:46:20 -0400
+Subject: drm/amd/display: use GFP_ATOMIC in amdgpu_dm_irq_schedule_work
+
+From: Anson Jacob <Anson.Jacob@amd.com>
+
+commit 0cde63a8fc4d9f9f580c297211fd05f91c0fd66d upstream.
+
+Replace GFP_KERNEL with GFP_ATOMIC as amdgpu_dm_irq_schedule_work
+can't sleep.
+
+BUG: sleeping function called from invalid context at include/linux/sched/mm.h:196
+in_atomic(): 1, irqs_disabled(): 1, non_block: 0, pid: 253, name: kworker/6:1H
+CPU: 6 PID: 253 Comm: kworker/6:1H Tainted: G        W  OE     5.11.0-promotion_2021_06_07-18_36_28_prelim_revert_retrain #8
+Hardware name: System manufacturer System Product Name/PRIME X570-PRO, BIOS 3405 02/01/2021
+Workqueue: events_highpri dm_irq_work_func [amdgpu]
+Call Trace:
+ <IRQ>
+ dump_stack+0x5e/0x74
+ ___might_sleep.cold+0x87/0x98
+ __might_sleep+0x4b/0x80
+ kmem_cache_alloc_trace+0x390/0x4f0
+ amdgpu_dm_irq_handler+0x171/0x230 [amdgpu]
+ amdgpu_irq_dispatch+0xc0/0x1e0 [amdgpu]
+ amdgpu_ih_process+0x81/0x100 [amdgpu]
+ amdgpu_irq_handler+0x26/0xa0 [amdgpu]
+ __handle_irq_event_percpu+0x49/0x190
+ ? __hrtimer_get_next_event+0x4d/0x80
+ handle_irq_event_percpu+0x33/0x80
+ handle_irq_event+0x33/0x60
+ handle_edge_irq+0x82/0x190
+ asm_call_irq_on_stack+0x12/0x20
+ </IRQ>
+ common_interrupt+0xbb/0x140
+ asm_common_interrupt+0x1e/0x40
+RIP: 0010:amdgpu_device_rreg.part.0+0x44/0xf0 [amdgpu]
+Code: 53 48 89 fb 4c 3b af c8 08 00 00 73 6d 83 e2 02 75 0d f6 87 40 62 01 00 10 0f 85 83 00 00 00 4c 03 ab d0 08 00 00 45 8b 6d 00 <8b> 05 3e b6 52 00 85 c0 7e 62 48 8b 43 08 0f b7 70 3e 65 8b 05 e3
+RSP: 0018:ffffae7740fff9e8 EFLAGS: 00000286
+RAX: ffffffffc05ee610 RBX: ffff8aaf8f620000 RCX: 0000000000000006
+RDX: 0000000000000000 RSI: 0000000000005430 RDI: ffff8aaf8f620000
+RBP: ffffae7740fffa08 R08: 0000000000000001 R09: 000000000000000a
+R10: 0000000000000001 R11: 0000000000000001 R12: 0000000000005430
+R13: 0000000071000000 R14: 0000000000000001 R15: 0000000000005430
+ ? amdgpu_cgs_write_register+0x20/0x20 [amdgpu]
+ amdgpu_device_rreg+0x17/0x20 [amdgpu]
+ amdgpu_cgs_read_register+0x14/0x20 [amdgpu]
+ dm_read_reg_func+0x38/0xb0 [amdgpu]
+ generic_reg_wait+0x80/0x160 [amdgpu]
+ dce_aux_transfer_raw+0x324/0x7c0 [amdgpu]
+ dc_link_aux_transfer_raw+0x43/0x50 [amdgpu]
+ dm_dp_aux_transfer+0x87/0x110 [amdgpu]
+ drm_dp_dpcd_access+0x72/0x110 [drm_kms_helper]
+ drm_dp_dpcd_read+0xb7/0xf0 [drm_kms_helper]
+ drm_dp_get_one_sb_msg+0x349/0x480 [drm_kms_helper]
+ drm_dp_mst_hpd_irq+0xc5/0xe40 [drm_kms_helper]
+ ? drm_dp_mst_hpd_irq+0xc5/0xe40 [drm_kms_helper]
+ dm_handle_hpd_rx_irq+0x184/0x1a0 [amdgpu]
+ ? dm_handle_hpd_rx_irq+0x184/0x1a0 [amdgpu]
+ handle_hpd_rx_irq+0x195/0x240 [amdgpu]
+ ? __switch_to_asm+0x42/0x70
+ ? __switch_to+0x131/0x450
+ dm_irq_work_func+0x19/0x20 [amdgpu]
+ process_one_work+0x209/0x400
+ worker_thread+0x4d/0x3e0
+ ? cancel_delayed_work+0xa0/0xa0
+ kthread+0x124/0x160
+ ? kthread_park+0x90/0x90
+ ret_from_fork+0x22/0x30
+
+Reviewed-by: Aurabindo Jayamohanan Pillai <Aurabindo.Pillai@amd.com>
+Acked-by: Anson Jacob <Anson.Jacob@amd.com>
+Signed-off-by: Anson Jacob <Anson.Jacob@amd.com>
+Cc: stable@vger.kernel.org
+Tested-by: Daniel Wheeler <daniel.wheeler@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_irq.c |    2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_irq.c
++++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_irq.c
+@@ -531,7 +531,7 @@ static void amdgpu_dm_irq_schedule_work(
+               handler_data = container_of(handler_list->next, struct amdgpu_dm_irq_handler_data, list);
+               /*allocate a new amdgpu_dm_irq_handler_data*/
+-              handler_data_add = kzalloc(sizeof(*handler_data), GFP_KERNEL);
++              handler_data_add = kzalloc(sizeof(*handler_data), GFP_ATOMIC);
+               if (!handler_data_add) {
+                       DRM_ERROR("DM_IRQ: failed to allocate irq handler!\n");
+                       return;
diff --git a/queue-5.10/drm-amdgpu-don-t-enable-baco-on-boco-platforms-in-runpm.patch b/queue-5.10/drm-amdgpu-don-t-enable-baco-on-boco-platforms-in-runpm.patch
new file mode 100644 (file)
index 0000000..6ddd76a
--- /dev/null
@@ -0,0 +1,33 @@
+From 202ead5a3c589b0594a75cb99f080174f6851fed Mon Sep 17 00:00:00 2001
+From: Alex Deucher <alexander.deucher@amd.com>
+Date: Mon, 2 Aug 2021 10:03:30 -0400
+Subject: drm/amdgpu: don't enable baco on boco platforms in runpm
+
+From: Alex Deucher <alexander.deucher@amd.com>
+
+commit 202ead5a3c589b0594a75cb99f080174f6851fed upstream.
+
+If the platform uses BOCO, don't use BACO in runtime suspend.
+We could end up executing the BACO path if the platform supports
+both.
+
+Bug: https://gitlab.freedesktop.org/drm/amd/-/issues/1669
+Reviewed-by: Evan Quan <evan.quan@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Cc: stable@vger.kernel.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/amd/amdgpu/amdgpu_drv.c |    2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_drv.c
++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_drv.c
+@@ -1344,6 +1344,8 @@ static int amdgpu_pmops_runtime_suspend(
+                       pci_set_power_state(pdev, PCI_D3cold);
+               }
+               drm_dev->switch_power_state = DRM_SWITCH_POWER_DYNAMIC_OFF;
++      } else if (amdgpu_device_supports_boco(drm_dev)) {
++              /* nothing to do */
+       } else if (amdgpu_device_supports_baco(drm_dev)) {
+               amdgpu_device_baco_enter(drm_dev);
+       }
diff --git a/queue-5.10/drm-i915-display-fix-the-12-bpc-bits-for-pipe_misc-reg.patch b/queue-5.10/drm-i915-display-fix-the-12-bpc-bits-for-pipe_misc-reg.patch
new file mode 100644 (file)
index 0000000..a08a925
--- /dev/null
@@ -0,0 +1,134 @@
+From abd9d66a055722393d33685214c08386694871d7 Mon Sep 17 00:00:00 2001
+From: Ankit Nautiyal <ankit.k.nautiyal@intel.com>
+Date: Wed, 11 Aug 2021 10:48:57 +0530
+Subject: drm/i915/display: Fix the 12 BPC bits for PIPE_MISC reg
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Ankit Nautiyal <ankit.k.nautiyal@intel.com>
+
+commit abd9d66a055722393d33685214c08386694871d7 upstream.
+
+Till DISPLAY12 the PIPE_MISC bits 5-7 are used to set the
+Dithering BPC, with valid values of 6, 8, 10 BPC.
+For ADLP+ these bits are used to set the PORT OUTPUT BPC, with valid
+values of: 6, 8, 10, 12 BPC, and need to be programmed whether
+dithering is enabled or not.
+
+This patch:
+-corrects the bits 5-7 for PIPE MISC register for 12 BPC.
+-renames the bits and mask to have generic names for these bits for
+dithering bpc and port output bpc.
+
+v3: Added a note for MIPI DSI which uses the PIPE_MISC for readout
+for pipe_bpp. (Uma Shankar)
+
+v2: Added 'display' to the subject and fixes tag. (Uma Shankar)
+
+Fixes: 756f85cffef2 ("drm/i915/bdw: Broadwell has PIPEMISC")
+Cc: Paulo Zanoni <paulo.r.zanoni@intel.com> (v1)
+Cc: Ville Syrjälä <ville.syrjala@linux.intel.com>
+Cc: Daniel Vetter <daniel.vetter@ffwll.ch>
+Cc: Jani Nikula <jani.nikula@linux.intel.com>
+Cc: Joonas Lahtinen <joonas.lahtinen@linux.intel.com>
+Cc: Rodrigo Vivi <rodrigo.vivi@intel.com>
+Cc: intel-gfx@lists.freedesktop.org
+Cc: <stable@vger.kernel.org> # v3.13+
+
+Signed-off-by: Ankit Nautiyal <ankit.k.nautiyal@intel.com>
+Reviewed-by: Uma Shankar <uma.shankar@intel.com>
+Signed-off-by: Uma Shankar <uma.shankar@intel.com>
+Link: https://patchwork.freedesktop.org/patch/msgid/20210811051857.109723-1-ankit.k.nautiyal@intel.com
+(cherry picked from commit 70418a68713c13da3f36c388087d0220b456a430)
+Signed-off-by: Rodrigo Vivi <rodrigo.vivi@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/i915/display/intel_display.c |   34 +++++++++++++++++++--------
+ drivers/gpu/drm/i915/i915_reg.h              |   16 ++++++++----
+ 2 files changed, 35 insertions(+), 15 deletions(-)
+
+--- a/drivers/gpu/drm/i915/display/intel_display.c
++++ b/drivers/gpu/drm/i915/display/intel_display.c
+@@ -10173,16 +10173,18 @@ static void bdw_set_pipemisc(const struc
+       switch (crtc_state->pipe_bpp) {
+       case 18:
+-              val |= PIPEMISC_DITHER_6_BPC;
++              val |= PIPEMISC_6_BPC;
+               break;
+       case 24:
+-              val |= PIPEMISC_DITHER_8_BPC;
++              val |= PIPEMISC_8_BPC;
+               break;
+       case 30:
+-              val |= PIPEMISC_DITHER_10_BPC;
++              val |= PIPEMISC_10_BPC;
+               break;
+       case 36:
+-              val |= PIPEMISC_DITHER_12_BPC;
++              /* Port output 12BPC defined for ADLP+ */
++              if (DISPLAY_VER(dev_priv) > 12)
++                      val |= PIPEMISC_12_BPC_ADLP;
+               break;
+       default:
+               MISSING_CASE(crtc_state->pipe_bpp);
+@@ -10218,15 +10220,27 @@ int bdw_get_pipemisc_bpp(struct intel_cr
+       tmp = intel_de_read(dev_priv, PIPEMISC(crtc->pipe));
+-      switch (tmp & PIPEMISC_DITHER_BPC_MASK) {
+-      case PIPEMISC_DITHER_6_BPC:
++      switch (tmp & PIPEMISC_BPC_MASK) {
++      case PIPEMISC_6_BPC:
+               return 18;
+-      case PIPEMISC_DITHER_8_BPC:
++      case PIPEMISC_8_BPC:
+               return 24;
+-      case PIPEMISC_DITHER_10_BPC:
++      case PIPEMISC_10_BPC:
+               return 30;
+-      case PIPEMISC_DITHER_12_BPC:
+-              return 36;
++      /*
++       * PORT OUTPUT 12 BPC defined for ADLP+.
++       *
++       * TODO:
++       * For previous platforms with DSI interface, bits 5:7
++       * are used for storing pipe_bpp irrespective of dithering.
++       * Since the value of 12 BPC is not defined for these bits
++       * on older platforms, need to find a workaround for 12 BPC
++       * MIPI DSI HW readout.
++       */
++      case PIPEMISC_12_BPC_ADLP:
++              if (DISPLAY_VER(dev_priv) > 12)
++                      return 36;
++              fallthrough;
+       default:
+               MISSING_CASE(tmp);
+               return 0;
+--- a/drivers/gpu/drm/i915/i915_reg.h
++++ b/drivers/gpu/drm/i915/i915_reg.h
+@@ -6011,11 +6011,17 @@ enum {
+ #define   PIPEMISC_HDR_MODE_PRECISION (1 << 23) /* icl+ */
+ #define   PIPEMISC_OUTPUT_COLORSPACE_YUV  (1 << 11)
+ #define   PIPEMISC_PIXEL_ROUNDING_TRUNC       REG_BIT(8) /* tgl+ */
+-#define   PIPEMISC_DITHER_BPC_MASK    (7 << 5)
+-#define   PIPEMISC_DITHER_8_BPC               (0 << 5)
+-#define   PIPEMISC_DITHER_10_BPC      (1 << 5)
+-#define   PIPEMISC_DITHER_6_BPC               (2 << 5)
+-#define   PIPEMISC_DITHER_12_BPC      (3 << 5)
++/*
++ * For Display < 13, Bits 5-7 of PIPE MISC represent DITHER BPC with
++ * valid values of: 6, 8, 10 BPC.
++ * ADLP+, the bits 5-7 represent PORT OUTPUT BPC with valid values of:
++ * 6, 8, 10, 12 BPC.
++ */
++#define   PIPEMISC_BPC_MASK           (7 << 5)
++#define   PIPEMISC_8_BPC              (0 << 5)
++#define   PIPEMISC_10_BPC             (1 << 5)
++#define   PIPEMISC_6_BPC              (2 << 5)
++#define   PIPEMISC_12_BPC_ADLP                (4 << 5) /* adlp+ */
+ #define   PIPEMISC_DITHER_ENABLE      (1 << 4)
+ #define   PIPEMISC_DITHER_TYPE_MASK   (3 << 2)
+ #define   PIPEMISC_DITHER_TYPE_SP     (0 << 2)
diff --git a/queue-5.10/i2c-dev-zero-out-array-used-for-i2c-reads-from-userspace.patch b/queue-5.10/i2c-dev-zero-out-array-used-for-i2c-reads-from-userspace.patch
new file mode 100644 (file)
index 0000000..011ffaf
--- /dev/null
@@ -0,0 +1,48 @@
+From 86ff25ed6cd8240d18df58930bd8848b19fce308 Mon Sep 17 00:00:00 2001
+From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Date: Thu, 29 Jul 2021 16:35:32 +0200
+Subject: i2c: dev: zero out array used for i2c reads from userspace
+
+From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+commit 86ff25ed6cd8240d18df58930bd8848b19fce308 upstream.
+
+If an i2c driver happens to not provide the full amount of data that a
+user asks for, it is possible that some uninitialized data could be sent
+to userspace.  While all in-kernel drivers look to be safe, just be sure
+by initializing the buffer to zero before it is passed to the i2c driver
+so that any future drivers will not have this issue.
+
+Also properly copy the amount of data recvieved to the userspace buffer,
+as pointed out by Dan Carpenter.
+
+Reported-by: Eric Dumazet <edumazet@google.com>
+Cc: stable@vger.kernel.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Wolfram Sang <wsa@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/i2c/i2c-dev.c |    5 +++--
+ 1 file changed, 3 insertions(+), 2 deletions(-)
+
+--- a/drivers/i2c/i2c-dev.c
++++ b/drivers/i2c/i2c-dev.c
+@@ -141,7 +141,7 @@ static ssize_t i2cdev_read(struct file *
+       if (count > 8192)
+               count = 8192;
+-      tmp = kmalloc(count, GFP_KERNEL);
++      tmp = kzalloc(count, GFP_KERNEL);
+       if (tmp == NULL)
+               return -ENOMEM;
+@@ -150,7 +150,8 @@ static ssize_t i2cdev_read(struct file *
+       ret = i2c_master_recv(client, tmp, count);
+       if (ret >= 0)
+-              ret = copy_to_user(buf, tmp, count) ? -EFAULT : ret;
++              if (copy_to_user(buf, tmp, ret))
++                      ret = -EFAULT;
+       kfree(tmp);
+       return ret;
+ }
diff --git a/queue-5.10/iio-adc-fix-incorrect-exit-of-for-loop.patch b/queue-5.10/iio-adc-fix-incorrect-exit-of-for-loop.patch
new file mode 100644 (file)
index 0000000..4c3fded
--- /dev/null
@@ -0,0 +1,39 @@
+From 5afc1540f13804a31bb704b763308e17688369c5 Mon Sep 17 00:00:00 2001
+From: Colin Ian King <colin.king@canonical.com>
+Date: Fri, 30 Jul 2021 08:16:51 +0100
+Subject: iio: adc: Fix incorrect exit of for-loop
+
+From: Colin Ian King <colin.king@canonical.com>
+
+commit 5afc1540f13804a31bb704b763308e17688369c5 upstream.
+
+Currently the for-loop that scans for the optimial adc_period iterates
+through all the possible adc_period levels because the exit logic in
+the loop is inverted. I believe the comparison should be swapped and
+the continue replaced with a break to exit the loop at the correct
+point.
+
+Addresses-Coverity: ("Continue has no effect")
+Fixes: e08e19c331fb ("iio:adc: add iio driver for Palmas (twl6035/7) gpadc")
+Signed-off-by: Colin Ian King <colin.king@canonical.com>
+Link: https://lore.kernel.org/r/20210730071651.17394-1-colin.king@canonical.com
+Cc: <stable@vger.kernel.org>
+Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/iio/adc/palmas_gpadc.c |    4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/drivers/iio/adc/palmas_gpadc.c
++++ b/drivers/iio/adc/palmas_gpadc.c
+@@ -654,8 +654,8 @@ static int palmas_adc_wakeup_configure(s
+       adc_period = adc->auto_conversion_period;
+       for (i = 0; i < 16; ++i) {
+-              if (((1000 * (1 << i)) / 32) < adc_period)
+-                      continue;
++              if (((1000 * (1 << i)) / 32) >= adc_period)
++                      break;
+       }
+       if (i > 0)
+               i--;
diff --git a/queue-5.10/iio-adc-ti-ads7950-ensure-cs-is-deasserted-after-reading-channels.patch b/queue-5.10/iio-adc-ti-ads7950-ensure-cs-is-deasserted-after-reading-channels.patch
new file mode 100644 (file)
index 0000000..594f3d4
--- /dev/null
@@ -0,0 +1,43 @@
+From 9898cb24e454602beb6e17bacf9f97b26c85c955 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Uwe=20Kleine-K=C3=B6nig?= <u.kleine-koenig@pengutronix.de>
+Date: Fri, 9 Jul 2021 12:11:10 +0200
+Subject: iio: adc: ti-ads7950: Ensure CS is deasserted after reading channels
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Uwe Kleine-König <u.kleine-koenig@pengutronix.de>
+
+commit 9898cb24e454602beb6e17bacf9f97b26c85c955 upstream.
+
+The ADS7950 requires that CS is deasserted after each SPI word. Before
+commit e2540da86ef8 ("iio: adc: ti-ads7950: use SPI_CS_WORD to reduce
+CPU usage") the driver used a message with one spi transfer per channel
+where each but the last one had .cs_change set to enforce a CS toggle.
+This was wrongly translated into a message with a single transfer and
+.cs_change set which results in a CS toggle after each word but the
+last which corrupts the first adc conversion of all readouts after the
+first readout.
+
+Fixes: e2540da86ef8 ("iio: adc: ti-ads7950: use SPI_CS_WORD to reduce CPU usage")
+Signed-off-by: Uwe Kleine-König <u.kleine-koenig@pengutronix.de>
+Reviewed-by: David Lechner <david@lechnology.com>
+Tested-by: David Lechner <david@lechnology.com>
+Cc: <Stable@vger.kernel.org>
+Link: https://lore.kernel.org/r/20210709101110.1814294-1-u.kleine-koenig@pengutronix.de
+Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/iio/adc/ti-ads7950.c |    1 -
+ 1 file changed, 1 deletion(-)
+
+--- a/drivers/iio/adc/ti-ads7950.c
++++ b/drivers/iio/adc/ti-ads7950.c
+@@ -568,7 +568,6 @@ static int ti_ads7950_probe(struct spi_d
+       st->ring_xfer.tx_buf = &st->tx_buf[0];
+       st->ring_xfer.rx_buf = &st->rx_buf[0];
+       /* len will be set later */
+-      st->ring_xfer.cs_change = true;
+       spi_message_add_tail(&st->ring_xfer, &st->ring_msg);
diff --git a/queue-5.10/iio-adis-set-gpio-reset-pin-direction.patch b/queue-5.10/iio-adis-set-gpio-reset-pin-direction.patch
new file mode 100644 (file)
index 0000000..8577b5c
--- /dev/null
@@ -0,0 +1,44 @@
+From 7e77ef8b8d600cf8448a2bbd32f682c28884551f Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Antti=20Ker=C3=A4nen?= <detegr@rbx.email>
+Date: Thu, 8 Jul 2021 12:54:29 +0300
+Subject: iio: adis: set GPIO reset pin direction
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Antti Keränen <detegr@rbx.email>
+
+commit 7e77ef8b8d600cf8448a2bbd32f682c28884551f upstream.
+
+Set reset pin direction to output as the reset pin needs to be an active
+low output pin.
+
+Co-developed-by: Hannu Hartikainen <hannu@hrtk.in>
+Signed-off-by: Hannu Hartikainen <hannu@hrtk.in>
+Signed-off-by: Antti Keränen <detegr@rbx.email>
+Reviewed-by: Nuno Sá <nuno.sa@analog.com>
+Fixes: ecb010d44108 ("iio: imu: adis: Refactor adis_initial_startup")
+Link: https://lore.kernel.org/r/20210708095425.13295-1-detegr@rbx.email
+Cc: <Stable@vger.kernel.org>
+Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/iio/imu/adis.c |    3 +--
+ 1 file changed, 1 insertion(+), 2 deletions(-)
+
+--- a/drivers/iio/imu/adis.c
++++ b/drivers/iio/imu/adis.c
+@@ -415,12 +415,11 @@ int __adis_initial_startup(struct adis *
+       int ret;
+       /* check if the device has rst pin low */
+-      gpio = devm_gpiod_get_optional(&adis->spi->dev, "reset", GPIOD_ASIS);
++      gpio = devm_gpiod_get_optional(&adis->spi->dev, "reset", GPIOD_OUT_HIGH);
+       if (IS_ERR(gpio))
+               return PTR_ERR(gpio);
+       if (gpio) {
+-              gpiod_set_value_cansleep(gpio, 1);
+               msleep(10);
+               /* bring device out of reset */
+               gpiod_set_value_cansleep(gpio, 0);
diff --git a/queue-5.10/iio-humidity-hdc100x-add-margin-to-the-conversion-time.patch b/queue-5.10/iio-humidity-hdc100x-add-margin-to-the-conversion-time.patch
new file mode 100644 (file)
index 0000000..c36eb31
--- /dev/null
@@ -0,0 +1,59 @@
+From 84edec86f449adea9ee0b4912a79ab8d9d65abb7 Mon Sep 17 00:00:00 2001
+From: Chris Lesiak <chris.lesiak@licor.com>
+Date: Mon, 14 Jun 2021 09:18:20 -0500
+Subject: iio: humidity: hdc100x: Add margin to the conversion time
+
+From: Chris Lesiak <chris.lesiak@licor.com>
+
+commit 84edec86f449adea9ee0b4912a79ab8d9d65abb7 upstream.
+
+The datasheets have the following note for the conversion time
+specification: "This parameter is specified by design and/or
+characterization and it is not tested in production."
+
+Parts have been seen that require more time to do 14-bit conversions for
+the relative humidity channel.  The result is ENXIO due to the address
+phase of a transfer not getting an ACK.
+
+Delay an additional 1 ms per conversion to allow for additional margin.
+
+Fixes: 4839367d99e3 ("iio: humidity: add HDC100x support")
+Signed-off-by: Chris Lesiak <chris.lesiak@licor.com>
+Acked-by: Matt Ranostay <matt.ranostay@konsulko.com>
+Link: https://lore.kernel.org/r/20210614141820.2034827-1-chris.lesiak@licor.com
+Cc: <Stable@vger.kernel.org>
+Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/iio/humidity/hdc100x.c |    6 ++++--
+ 1 file changed, 4 insertions(+), 2 deletions(-)
+
+--- a/drivers/iio/humidity/hdc100x.c
++++ b/drivers/iio/humidity/hdc100x.c
+@@ -25,6 +25,8 @@
+ #include <linux/iio/trigger_consumer.h>
+ #include <linux/iio/triggered_buffer.h>
++#include <linux/time.h>
++
+ #define HDC100X_REG_TEMP                      0x00
+ #define HDC100X_REG_HUMIDITY                  0x01
+@@ -166,7 +168,7 @@ static int hdc100x_get_measurement(struc
+                                  struct iio_chan_spec const *chan)
+ {
+       struct i2c_client *client = data->client;
+-      int delay = data->adc_int_us[chan->address];
++      int delay = data->adc_int_us[chan->address] + 1*USEC_PER_MSEC;
+       int ret;
+       __be16 val;
+@@ -316,7 +318,7 @@ static irqreturn_t hdc100x_trigger_handl
+       struct iio_dev *indio_dev = pf->indio_dev;
+       struct hdc100x_data *data = iio_priv(indio_dev);
+       struct i2c_client *client = data->client;
+-      int delay = data->adc_int_us[0] + data->adc_int_us[1];
++      int delay = data->adc_int_us[0] + data->adc_int_us[1] + 2*USEC_PER_MSEC;
+       int ret;
+       /* dual read starts at temp register */
diff --git a/queue-5.10/libnvdimm-region-fix-label-activation-vs-errors.patch b/queue-5.10/libnvdimm-region-fix-label-activation-vs-errors.patch
new file mode 100644 (file)
index 0000000..b0d026a
--- /dev/null
@@ -0,0 +1,76 @@
+From d9cee9f85b22fab88d2b76d2e92b18e3d0e6aa8c Mon Sep 17 00:00:00 2001
+From: Dan Williams <dan.j.williams@intel.com>
+Date: Fri, 30 Jul 2021 09:46:04 -0700
+Subject: libnvdimm/region: Fix label activation vs errors
+
+From: Dan Williams <dan.j.williams@intel.com>
+
+commit d9cee9f85b22fab88d2b76d2e92b18e3d0e6aa8c upstream.
+
+There are a few scenarios where init_active_labels() can return without
+registering deactivate_labels() to run when the region is disabled. In
+particular label error injection creates scenarios where a DIMM is
+disabled, but labels on other DIMMs in the region become activated.
+
+Arrange for init_active_labels() to always register deactivate_labels().
+
+Reported-by: Krzysztof Kensicki <krzysztof.kensicki@intel.com>
+Cc: <stable@vger.kernel.org>
+Fixes: bf9bccc14c05 ("libnvdimm: pmem label sets and namespace instantiation.")
+Reviewed-by: Jeff Moyer <jmoyer@redhat.com>
+Link: https://lore.kernel.org/r/162766356450.3223041.1183118139023841447.stgit@dwillia2-desk3.amr.corp.intel.com
+Signed-off-by: Dan Williams <dan.j.williams@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/nvdimm/namespace_devs.c |   17 +++++++++++------
+ 1 file changed, 11 insertions(+), 6 deletions(-)
+
+--- a/drivers/nvdimm/namespace_devs.c
++++ b/drivers/nvdimm/namespace_devs.c
+@@ -2527,7 +2527,7 @@ static void deactivate_labels(void *regi
+ static int init_active_labels(struct nd_region *nd_region)
+ {
+-      int i;
++      int i, rc = 0;
+       for (i = 0; i < nd_region->ndr_mappings; i++) {
+               struct nd_mapping *nd_mapping = &nd_region->mapping[i];
+@@ -2546,13 +2546,14 @@ static int init_active_labels(struct nd_
+                       else if (test_bit(NDD_LABELING, &nvdimm->flags))
+                               /* fail, labels needed to disambiguate dpa */;
+                       else
+-                              return 0;
++                              continue;
+                       dev_err(&nd_region->dev, "%s: is %s, failing probe\n",
+                                       dev_name(&nd_mapping->nvdimm->dev),
+                                       test_bit(NDD_LOCKED, &nvdimm->flags)
+                                       ? "locked" : "disabled");
+-                      return -ENXIO;
++                      rc = -ENXIO;
++                      goto out;
+               }
+               nd_mapping->ndd = ndd;
+               atomic_inc(&nvdimm->busy);
+@@ -2586,13 +2587,17 @@ static int init_active_labels(struct nd_
+                       break;
+       }
+-      if (i < nd_region->ndr_mappings) {
++      if (i < nd_region->ndr_mappings)
++              rc = -ENOMEM;
++
++out:
++      if (rc) {
+               deactivate_labels(nd_region);
+-              return -ENOMEM;
++              return rc;
+       }
+       return devm_add_action_or_reset(&nd_region->dev, deactivate_labels,
+-                      nd_region);
++                                      nd_region);
+ }
+ int nd_region_register_namespaces(struct nd_region *nd_region, int *err)
diff --git a/queue-5.10/net-ethernet-ti-cpsw-fix-min-eth-packet-size-for-non-switch-use-cases.patch b/queue-5.10/net-ethernet-ti-cpsw-fix-min-eth-packet-size-for-non-switch-use-cases.patch
new file mode 100644 (file)
index 0000000..e6e8d31
--- /dev/null
@@ -0,0 +1,104 @@
+From acc68b8d2a1196c4db806947606f162dbeed2274 Mon Sep 17 00:00:00 2001
+From: Grygorii Strashko <grygorii.strashko@ti.com>
+Date: Thu, 5 Aug 2021 17:55:11 +0300
+Subject: net: ethernet: ti: cpsw: fix min eth packet size for non-switch use-cases
+
+From: Grygorii Strashko <grygorii.strashko@ti.com>
+
+commit acc68b8d2a1196c4db806947606f162dbeed2274 upstream.
+
+The CPSW switchdev driver inherited fix from commit 9421c9015047 ("net:
+ethernet: ti: cpsw: fix min eth packet size") which changes min TX packet
+size to 64bytes (VLAN_ETH_ZLEN, excluding ETH_FCS). It was done to fix HW
+packed drop issue when packets are sent from Host to the port with PVID and
+un-tagging enabled. Unfortunately this breaks some other non-switch
+specific use-cases, like:
+- [1] CPSW port as DSA CPU port with DSA-tag applied at the end of the
+packet
+- [2] Some industrial protocols, which expects min TX packet size 60Bytes
+(excluding FCS).
+
+Fix it by configuring min TX packet size depending on driver mode
+ - 60Bytes (ETH_ZLEN) for multi mac (dual-mac) mode
+ - 64Bytes (VLAN_ETH_ZLEN) for switch mode
+and update it during driver mode change and annotate with
+READ_ONCE()/WRITE_ONCE() as it can be read by napi while writing.
+
+[1] https://lore.kernel.org/netdev/20210531124051.GA15218@cephalopod/
+[2] https://e2e.ti.com/support/arm/sitara_arm/f/791/t/701669
+
+Cc: stable@vger.kernel.org
+Fixes: ed3525eda4c4 ("net: ethernet: ti: introduce cpsw switchdev based driver part 1 - dual-emac")
+Reported-by: Ben Hutchings <ben.hutchings@essensium.com>
+Signed-off-by: Grygorii Strashko <grygorii.strashko@ti.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/ethernet/ti/cpsw_new.c  |    7 +++++--
+ drivers/net/ethernet/ti/cpsw_priv.h |    4 +++-
+ 2 files changed, 8 insertions(+), 3 deletions(-)
+
+--- a/drivers/net/ethernet/ti/cpsw_new.c
++++ b/drivers/net/ethernet/ti/cpsw_new.c
+@@ -928,7 +928,7 @@ static netdev_tx_t cpsw_ndo_start_xmit(s
+       struct cpdma_chan *txch;
+       int ret, q_idx;
+-      if (skb_padto(skb, CPSW_MIN_PACKET_SIZE)) {
++      if (skb_put_padto(skb, READ_ONCE(priv->tx_packet_min))) {
+               cpsw_err(priv, tx_err, "packet pad failed\n");
+               ndev->stats.tx_dropped++;
+               return NET_XMIT_DROP;
+@@ -1108,7 +1108,7 @@ static int cpsw_ndo_xdp_xmit(struct net_
+       for (i = 0; i < n; i++) {
+               xdpf = frames[i];
+-              if (xdpf->len < CPSW_MIN_PACKET_SIZE) {
++              if (xdpf->len < READ_ONCE(priv->tx_packet_min)) {
+                       xdp_return_frame_rx_napi(xdpf);
+                       drops++;
+                       continue;
+@@ -1402,6 +1402,7 @@ static int cpsw_create_ports(struct cpsw
+               priv->dev  = dev;
+               priv->msg_enable = netif_msg_init(debug_level, CPSW_DEBUG);
+               priv->emac_port = i + 1;
++              priv->tx_packet_min = CPSW_MIN_PACKET_SIZE;
+               if (is_valid_ether_addr(slave_data->mac_addr)) {
+                       ether_addr_copy(priv->mac_addr, slave_data->mac_addr);
+@@ -1699,6 +1700,7 @@ static int cpsw_dl_switch_mode_set(struc
+                       priv = netdev_priv(sl_ndev);
+                       slave->port_vlan = vlan;
++                      WRITE_ONCE(priv->tx_packet_min, CPSW_MIN_PACKET_SIZE_VLAN);
+                       if (netif_running(sl_ndev))
+                               cpsw_port_add_switch_def_ale_entries(priv,
+                                                                    slave);
+@@ -1727,6 +1729,7 @@ static int cpsw_dl_switch_mode_set(struc
+                       priv = netdev_priv(slave->ndev);
+                       slave->port_vlan = slave->data->dual_emac_res_vlan;
++                      WRITE_ONCE(priv->tx_packet_min, CPSW_MIN_PACKET_SIZE);
+                       cpsw_port_add_dual_emac_def_ale_entries(priv, slave);
+               }
+--- a/drivers/net/ethernet/ti/cpsw_priv.h
++++ b/drivers/net/ethernet/ti/cpsw_priv.h
+@@ -89,7 +89,8 @@ do {                                                         \
+ #define CPSW_POLL_WEIGHT      64
+ #define CPSW_RX_VLAN_ENCAP_HDR_SIZE           4
+-#define CPSW_MIN_PACKET_SIZE  (VLAN_ETH_ZLEN)
++#define CPSW_MIN_PACKET_SIZE_VLAN     (VLAN_ETH_ZLEN)
++#define CPSW_MIN_PACKET_SIZE  (ETH_ZLEN)
+ #define CPSW_MAX_PACKET_SIZE  (VLAN_ETH_FRAME_LEN +\
+                                ETH_FCS_LEN +\
+                                CPSW_RX_VLAN_ENCAP_HDR_SIZE)
+@@ -380,6 +381,7 @@ struct cpsw_priv {
+       u32 emac_port;
+       struct cpsw_common *cpsw;
+       int offload_fwd_mark;
++      u32 tx_packet_min;
+ };
+ #define ndev_to_cpsw(ndev) (((struct cpsw_priv *)netdev_priv(ndev))->cpsw)
diff --git a/queue-5.10/scsi-lpfc-move-initialization-of-phba-poll_list-earlier-to-avoid-crash.patch b/queue-5.10/scsi-lpfc-move-initialization-of-phba-poll_list-earlier-to-avoid-crash.patch
new file mode 100644 (file)
index 0000000..2ed8665
--- /dev/null
@@ -0,0 +1,85 @@
+From 9977d880f7a3c233db9165a75a3a14defc2a4aee Mon Sep 17 00:00:00 2001
+From: "Ewan D. Milne" <emilne@redhat.com>
+Date: Mon, 9 Aug 2021 11:09:47 -0400
+Subject: scsi: lpfc: Move initialization of phba->poll_list earlier to avoid crash
+
+From: Ewan D. Milne <emilne@redhat.com>
+
+commit 9977d880f7a3c233db9165a75a3a14defc2a4aee upstream.
+
+The phba->poll_list is traversed in case of an error in
+lpfc_sli4_hba_setup(), so it must be initialized earlier in case the error
+path is taken.
+
+[  490.030738] lpfc 0000:65:00.0: 0:1413 Failed to init iocb list.
+[  490.036661] BUG: unable to handle kernel NULL pointer dereference at 0000000000000000
+[  490.044485] PGD 0 P4D 0
+[  490.047027] Oops: 0000 [#1] SMP PTI
+[  490.050518] CPU: 0 PID: 7 Comm: kworker/0:1 Kdump: loaded Tainted: G          I      --------- -  - 4.18.
+[  490.060511] Hardware name: Dell Inc. PowerEdge R440/0WKGTH, BIOS 1.4.8 05/22/2018
+[  490.067994] Workqueue: events work_for_cpu_fn
+[  490.072371] RIP: 0010:lpfc_sli4_cleanup_poll_list+0x20/0xb0 [lpfc]
+[  490.078546] Code: cf e9 04 f7 fe ff 0f 1f 40 00 0f 1f 44 00 00 41 57 49 89 ff 41 56 41 55 41 54 4d 8d a79
+[  490.097291] RSP: 0018:ffffbd1a463dbcc8 EFLAGS: 00010246
+[  490.102518] RAX: 0000000000008200 RBX: ffff945cdb8c0000 RCX: 0000000000000000
+[  490.109649] RDX: 0000000000018200 RSI: ffff9468d0e16818 RDI: 0000000000000000
+[  490.116783] RBP: ffff945cdb8c1740 R08: 00000000000015c5 R09: 0000000000000042
+[  490.123915] R10: 0000000000000000 R11: ffffbd1a463dbab0 R12: ffff945cdb8c25c0
+[  490.131049] R13: 00000000fffffff4 R14: 0000000000001800 R15: ffff945cdb8c0000
+[  490.138182] FS:  0000000000000000(0000) GS:ffff9468d0e00000(0000) knlGS:0000000000000000
+[  490.146267] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
+[  490.152013] CR2: 0000000000000000 CR3: 000000042ca10002 CR4: 00000000007706f0
+[  490.159146] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
+[  490.166277] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
+[  490.173409] PKRU: 55555554
+[  490.176123] Call Trace:
+[  490.178598]  lpfc_sli4_queue_destroy+0x7f/0x3c0 [lpfc]
+[  490.183745]  lpfc_sli4_hba_setup+0x1bc7/0x23e0 [lpfc]
+[  490.188797]  ? kernfs_activate+0x63/0x80
+[  490.192721]  ? kernfs_add_one+0xe7/0x130
+[  490.196647]  ? __kernfs_create_file+0x80/0xb0
+[  490.201020]  ? lpfc_pci_probe_one_s4.isra.48+0x46f/0x9e0 [lpfc]
+[  490.206944]  lpfc_pci_probe_one_s4.isra.48+0x46f/0x9e0 [lpfc]
+[  490.212697]  lpfc_pci_probe_one+0x179/0xb70 [lpfc]
+[  490.217492]  local_pci_probe+0x41/0x90
+[  490.221246]  work_for_cpu_fn+0x16/0x20
+[  490.224994]  process_one_work+0x1a7/0x360
+[  490.229009]  ? create_worker+0x1a0/0x1a0
+[  490.232933]  worker_thread+0x1cf/0x390
+[  490.236687]  ? create_worker+0x1a0/0x1a0
+[  490.240612]  kthread+0x116/0x130
+[  490.243846]  ? kthread_flush_work_fn+0x10/0x10
+[  490.248293]  ret_from_fork+0x35/0x40
+[  490.251869] Modules linked in: lpfc(+) xt_CHECKSUM ipt_MASQUERADE xt_conntrack ipt_REJECT nf_reject_ipv4i
+[  490.332609] CR2: 0000000000000000
+
+Link: https://lore.kernel.org/r/20210809150947.18104-1-emilne@redhat.com
+Fixes: 93a4d6f40198 ("scsi: lpfc: Add registration for CPU Offline/Online events")
+Cc: stable@vger.kernel.org
+Reviewed-by: James Smart <jsmart2021@gmail.com>
+Signed-off-by: Ewan D. Milne <emilne@redhat.com>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/scsi/lpfc/lpfc_init.c |    3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+--- a/drivers/scsi/lpfc/lpfc_init.c
++++ b/drivers/scsi/lpfc/lpfc_init.c
+@@ -13080,6 +13080,8 @@ lpfc_pci_probe_one_s4(struct pci_dev *pd
+       if (!phba)
+               return -ENOMEM;
++      INIT_LIST_HEAD(&phba->poll_list);
++
+       /* Perform generic PCI device enabling operation */
+       error = lpfc_enable_pci_dev(phba);
+       if (error)
+@@ -13214,7 +13216,6 @@ lpfc_pci_probe_one_s4(struct pci_dev *pd
+       /* Enable RAS FW log support */
+       lpfc_sli4_ras_setup(phba);
+-      INIT_LIST_HEAD(&phba->poll_list);
+       timer_setup(&phba->cpuhp_poll_timer, lpfc_sli4_poll_hbtimer, 0);
+       cpuhp_state_add_instance_nocalls(lpfc_cpuhp_state, &phba->cpuhp);
diff --git a/queue-5.10/seccomp-fix-setting-loaded-filter-count-during-tsync.patch b/queue-5.10/seccomp-fix-setting-loaded-filter-count-during-tsync.patch
new file mode 100644 (file)
index 0000000..96d63c9
--- /dev/null
@@ -0,0 +1,37 @@
+From b4d8a58f8dcfcc890f296696cadb76e77be44b5f Mon Sep 17 00:00:00 2001
+From: Hsuan-Chi Kuo <hsuanchikuo@gmail.com>
+Date: Thu, 4 Mar 2021 17:37:08 -0600
+Subject: seccomp: Fix setting loaded filter count during TSYNC
+
+From: Hsuan-Chi Kuo <hsuanchikuo@gmail.com>
+
+commit b4d8a58f8dcfcc890f296696cadb76e77be44b5f upstream.
+
+The desired behavior is to set the caller's filter count to thread's.
+This value is reported via /proc, so this fixes the inaccurate count
+exposed to userspace; it is not used for reference counting, etc.
+
+Signed-off-by: Hsuan-Chi Kuo <hsuanchikuo@gmail.com>
+Link: https://lore.kernel.org/r/20210304233708.420597-1-hsuanchikuo@gmail.com
+Co-developed-by: Wiktor Garbacz <wiktorg@google.com>
+Signed-off-by: Wiktor Garbacz <wiktorg@google.com>
+Link: https://lore.kernel.org/lkml/20210810125158.329849-1-wiktorg@google.com
+Signed-off-by: Kees Cook <keescook@chromium.org>
+Cc: stable@vger.kernel.org
+Fixes: c818c03b661c ("seccomp: Report number of loaded filters in /proc/$pid/status")
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ kernel/seccomp.c |    2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/kernel/seccomp.c
++++ b/kernel/seccomp.c
+@@ -511,7 +511,7 @@ static inline void seccomp_sync_threads(
+               smp_store_release(&thread->seccomp.filter,
+                                 caller->seccomp.filter);
+               atomic_set(&thread->seccomp.filter_count,
+-                         atomic_read(&thread->seccomp.filter_count));
++                         atomic_read(&caller->seccomp.filter_count));
+               /*
+                * Don't let an unprivileged task work around
diff --git a/queue-5.10/series b/queue-5.10/series
new file mode 100644 (file)
index 0000000..6aa9bab
--- /dev/null
@@ -0,0 +1,22 @@
+iio-adc-ti-ads7950-ensure-cs-is-deasserted-after-reading-channels.patch
+iio-adis-set-gpio-reset-pin-direction.patch
+iio-humidity-hdc100x-add-margin-to-the-conversion-time.patch
+iio-adc-fix-incorrect-exit-of-for-loop.patch
+asoc-amd-fix-reference-to-pcm-buffer-address.patch
+asoc-xilinx-fix-reference-to-pcm-buffer-address.patch
+asoc-uniphier-fix-reference-to-pcm-buffer-address.patch
+asoc-tlv320aic31xx-fix-jack-detection-after-suspend.patch
+asoc-intel-atom-fix-reference-to-pcm-buffer-address.patch
+i2c-dev-zero-out-array-used-for-i2c-reads-from-userspace.patch
+cifs-create-sd-context-must-be-a-multiple-of-8.patch
+scsi-lpfc-move-initialization-of-phba-poll_list-earlier-to-avoid-crash.patch
+seccomp-fix-setting-loaded-filter-count-during-tsync.patch
+net-ethernet-ti-cpsw-fix-min-eth-packet-size-for-non-switch-use-cases.patch
+arc-fp-set-fpu_status.fwe-to-enable-fpu_status-update-on-context-switch.patch
+ceph-reduce-contention-in-ceph_check_delayed_caps.patch
+acpi-nfit-fix-support-for-virtual-spa-ranges.patch
+libnvdimm-region-fix-label-activation-vs-errors.patch
+drm-i915-display-fix-the-12-bpc-bits-for-pipe_misc-reg.patch
+drm-amd-display-remove-invalid-assert-for-odm-mpc-case.patch
+drm-amd-display-use-gfp_atomic-in-amdgpu_dm_irq_schedule_work.patch
+drm-amdgpu-don-t-enable-baco-on-boco-platforms-in-runpm.patch