--- /dev/null
+From 8973b8434e52c87cba1dcde173c677d387812248 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 24 Jul 2021 15:25:54 -0700
+Subject: ACPI: fix NULL pointer dereference
+
+From: Linus Torvalds <torvalds@linux-foundation.org>
+
+[ Upstream commit fc68f42aa737dc15e7665a4101d4168aadb8e4c4 ]
+
+Commit 71f642833284 ("ACPI: utils: Fix reference counting in
+for_each_acpi_dev_match()") started doing "acpi_dev_put()" on a pointer
+that was possibly NULL. That fails miserably, because that helper
+inline function is not set up to handle that case.
+
+Just make acpi_dev_put() silently accept a NULL pointer, rather than
+calling down to put_device() with an invalid offset off that NULL
+pointer.
+
+Link: https://lore.kernel.org/lkml/a607c149-6bf6-0fd0-0e31-100378504da2@kernel.dk/
+Reported-and-tested-by: Jens Axboe <axboe@kernel.dk>
+Tested-by: Daniel Scally <djrscally@gmail.com>
+Cc: Andy Shevchenko <andy.shevchenko@gmail.com>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/acpi/acpi_bus.h | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/include/acpi/acpi_bus.h b/include/acpi/acpi_bus.h
+index 37dac195adbb..6ad3b89a8a2e 100644
+--- a/include/acpi/acpi_bus.h
++++ b/include/acpi/acpi_bus.h
+@@ -689,7 +689,8 @@ acpi_dev_get_first_match_dev(const char *hid, const char *uid, s64 hrv);
+
+ static inline void acpi_dev_put(struct acpi_device *adev)
+ {
+- put_device(&adev->dev);
++ if (adev)
++ put_device(&adev->dev);
+ }
+ #else /* CONFIG_ACPI */
+
+--
+2.30.2
+
--- /dev/null
+From 2e92be28d10b2173c63763ff5bee671820a10261 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 16 Jul 2021 16:58:53 +0800
+Subject: ASoC: rt5682: Fix the issue of garbled recording after
+ powerd_dbus_suspend
+
+From: Oder Chiou <oder_chiou@realtek.com>
+
+[ Upstream commit 6a503e1c455316fd0bfd8188c0a62cce7c5525ca ]
+
+While using the DMIC recording, the garbled data will be captured by the
+DMIC. It is caused by the critical power of PLL closed in the jack detect
+function.
+
+Signed-off-by: Oder Chiou <oder_chiou@realtek.com>
+Link: https://lore.kernel.org/r/20210716085853.20170-1-oder_chiou@realtek.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/codecs/rt5682.c | 8 ++++++--
+ 1 file changed, 6 insertions(+), 2 deletions(-)
+
+diff --git a/sound/soc/codecs/rt5682.c b/sound/soc/codecs/rt5682.c
+index d9878173ff89..2e41b8c169e5 100644
+--- a/sound/soc/codecs/rt5682.c
++++ b/sound/soc/codecs/rt5682.c
+@@ -971,10 +971,14 @@ int rt5682_headset_detect(struct snd_soc_component *component, int jack_insert)
+ rt5682_enable_push_button_irq(component, false);
+ snd_soc_component_update_bits(component, RT5682_CBJ_CTRL_1,
+ RT5682_TRIG_JD_MASK, RT5682_TRIG_JD_LOW);
+- if (!snd_soc_dapm_get_pin_status(dapm, "MICBIAS"))
++ if (!snd_soc_dapm_get_pin_status(dapm, "MICBIAS") &&
++ !snd_soc_dapm_get_pin_status(dapm, "PLL1") &&
++ !snd_soc_dapm_get_pin_status(dapm, "PLL2B"))
+ snd_soc_component_update_bits(component,
+ RT5682_PWR_ANLG_1, RT5682_PWR_MB, 0);
+- if (!snd_soc_dapm_get_pin_status(dapm, "Vref2"))
++ if (!snd_soc_dapm_get_pin_status(dapm, "Vref2") &&
++ !snd_soc_dapm_get_pin_status(dapm, "PLL1") &&
++ !snd_soc_dapm_get_pin_status(dapm, "PLL2B"))
+ snd_soc_component_update_bits(component,
+ RT5682_PWR_ANLG_1, RT5682_PWR_VREF2, 0);
+ snd_soc_component_update_bits(component, RT5682_PWR_ANLG_3,
+--
+2.30.2
+
--- /dev/null
+From d78264bc3f79f62c5192404291c8b0dfb02d3700 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 17 Jul 2021 15:28:19 +0300
+Subject: ASoC: ti: j721e-evm: Check for not initialized parent_clk_id
+
+From: Peter Ujfalusi <peter.ujfalusi@gmail.com>
+
+[ Upstream commit 82d28b67f780910f816fe1cfb0f676fc38c4cbb3 ]
+
+During probe the parent_clk_id is set to -1 which should not be used to
+array index within hsdiv_rates[].
+
+Signed-off-by: Peter Ujfalusi <peter.ujfalusi@gmail.com>
+Link: https://lore.kernel.org/r/20210717122820.1467-3-peter.ujfalusi@gmail.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/ti/j721e-evm.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/sound/soc/ti/j721e-evm.c b/sound/soc/ti/j721e-evm.c
+index 017c4ad11ca6..265bbc5a2f96 100644
+--- a/sound/soc/ti/j721e-evm.c
++++ b/sound/soc/ti/j721e-evm.c
+@@ -197,7 +197,7 @@ static int j721e_configure_refclk(struct j721e_priv *priv,
+ return ret;
+ }
+
+- if (priv->hsdiv_rates[domain->parent_clk_id] != scki) {
++ if (domain->parent_clk_id == -1 || priv->hsdiv_rates[domain->parent_clk_id] != scki) {
+ dev_dbg(priv->dev,
+ "%s configuration for %u Hz: %s, %dxFS (SCKI: %u Hz)\n",
+ audio_domain == J721E_AUDIO_DOMAIN_CPB ? "CPB" : "IVI",
+--
+2.30.2
+
--- /dev/null
+From f6a5665561a5094b311fff90f44ba1d559b80f09 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 17 Jul 2021 15:28:18 +0300
+Subject: ASoC: ti: j721e-evm: Fix unbalanced domain activity tracking during
+ startup
+
+From: Peter Ujfalusi <peter.ujfalusi@gmail.com>
+
+[ Upstream commit 78d2a05ef22e7b5863b01e073dd6a06b3979bb00 ]
+
+In case of an error within j721e_audio_startup() the domain->active must
+be decremented to avoid unbalanced counter.
+
+Signed-off-by: Peter Ujfalusi <peter.ujfalusi@gmail.com>
+Link: https://lore.kernel.org/r/20210717122820.1467-2-peter.ujfalusi@gmail.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/ti/j721e-evm.c | 16 +++++++++++-----
+ 1 file changed, 11 insertions(+), 5 deletions(-)
+
+diff --git a/sound/soc/ti/j721e-evm.c b/sound/soc/ti/j721e-evm.c
+index a7c0484d44ec..017c4ad11ca6 100644
+--- a/sound/soc/ti/j721e-evm.c
++++ b/sound/soc/ti/j721e-evm.c
+@@ -278,23 +278,29 @@ static int j721e_audio_startup(struct snd_pcm_substream *substream)
+ j721e_rule_rate, &priv->rate_range,
+ SNDRV_PCM_HW_PARAM_RATE, -1);
+
+- mutex_unlock(&priv->mutex);
+
+ if (ret)
+- return ret;
++ goto out;
+
+ /* Reset TDM slots to 32 */
+ ret = snd_soc_dai_set_tdm_slot(cpu_dai, 0x3, 0x3, 2, 32);
+ if (ret && ret != -ENOTSUPP)
+- return ret;
++ goto out;
+
+ for_each_rtd_codec_dais(rtd, i, codec_dai) {
+ ret = snd_soc_dai_set_tdm_slot(codec_dai, 0x3, 0x3, 2, 32);
+ if (ret && ret != -ENOTSUPP)
+- return ret;
++ goto out;
+ }
+
+- return 0;
++ if (ret == -ENOTSUPP)
++ ret = 0;
++out:
++ if (ret)
++ domain->active--;
++ mutex_unlock(&priv->mutex);
++
++ return ret;
+ }
+
+ static int j721e_audio_hw_params(struct snd_pcm_substream *substream,
+--
+2.30.2
+
--- /dev/null
+From 140c42da1466f7341a6609dbc9e40dbbf1a05208 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 21 Jun 2021 21:09:41 -0400
+Subject: ASoC: tlv320aic31xx: fix reversed bclk/wclk master bits
+
+From: Kyle Russell <bkylerussell@gmail.com>
+
+[ Upstream commit 9cf76a72af6ab81030dea6481b1d7bdd814fbdaf ]
+
+These are backwards from Table 7-71 of the TLV320AIC3100 spec [1].
+
+This was broken in 12eb4d66ba2e when BCLK_MASTER and WCLK_MASTER
+were converted from 0x08 and 0x04 to BIT(2) and BIT(3), respectively.
+
+-#define AIC31XX_BCLK_MASTER 0x08
+-#define AIC31XX_WCLK_MASTER 0x04
++#define AIC31XX_BCLK_MASTER BIT(2)
++#define AIC31XX_WCLK_MASTER BIT(3)
+
+Probably just a typo since the defines were not listed in bit order.
+
+[1] https://www.ti.com/lit/gpn/tlv320aic3100
+
+Signed-off-by: Kyle Russell <bkylerussell@gmail.com>
+Link: https://lore.kernel.org/r/20210622010941.241386-1-bkylerussell@gmail.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/codecs/tlv320aic31xx.h | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/sound/soc/codecs/tlv320aic31xx.h b/sound/soc/codecs/tlv320aic31xx.h
+index 81952984613d..2513922a0292 100644
+--- a/sound/soc/codecs/tlv320aic31xx.h
++++ b/sound/soc/codecs/tlv320aic31xx.h
+@@ -151,8 +151,8 @@ struct aic31xx_pdata {
+ #define AIC31XX_WORD_LEN_24BITS 0x02
+ #define AIC31XX_WORD_LEN_32BITS 0x03
+ #define AIC31XX_IFACE1_MASTER_MASK GENMASK(3, 2)
+-#define AIC31XX_BCLK_MASTER BIT(2)
+-#define AIC31XX_WCLK_MASTER BIT(3)
++#define AIC31XX_BCLK_MASTER BIT(3)
++#define AIC31XX_WCLK_MASTER BIT(2)
+
+ /* AIC31XX_DATA_OFFSET */
+ #define AIC31XX_DATA_OFFSET_MASK GENMASK(7, 0)
+--
+2.30.2
+
--- /dev/null
+From 529fef8ee88debd5075caad93adb9f7875770a73 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 24 Jun 2021 11:05:42 -0400
+Subject: drm/amd/display: Fix comparison error in dcn21 DML
+
+From: Victor Lu <victorchengchi.lu@amd.com>
+
+[ Upstream commit ec3102dc6b36c692104c4a0546d4119de59a3bc1 ]
+
+[why]
+A comparison error made it possible to not iterate through all the
+specified prefetch modes.
+
+[how]
+Correct "<" to "<="
+
+Reviewed-by: Dmytro Laktyushkin <Dmytro.Laktyushkin@amd.com>
+Reviewed-by: Yongqiang Sun <Yongqiang.Sun@amd.com>
+Acked-by: Rodrigo Siqueira <Rodrigo.Siqueira@amd.com>
+Signed-off-by: Victor Lu <victorchengchi.lu@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/display/dc/dml/dcn21/display_mode_vba_21.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/gpu/drm/amd/display/dc/dml/dcn21/display_mode_vba_21.c b/drivers/gpu/drm/amd/display/dc/dml/dcn21/display_mode_vba_21.c
+index 367c82b5ab4c..c09bca335068 100644
+--- a/drivers/gpu/drm/amd/display/dc/dml/dcn21/display_mode_vba_21.c
++++ b/drivers/gpu/drm/amd/display/dc/dml/dcn21/display_mode_vba_21.c
+@@ -4888,7 +4888,7 @@ void dml21_ModeSupportAndSystemConfigurationFull(struct display_mode_lib *mode_l
+ }
+ } while ((locals->PrefetchSupported[i][j] != true || locals->VRatioInPrefetchSupported[i][j] != true)
+ && (mode_lib->vba.NextMaxVStartup != mode_lib->vba.MaxMaxVStartup[0][0]
+- || mode_lib->vba.NextPrefetchMode < mode_lib->vba.MaxPrefetchMode));
++ || mode_lib->vba.NextPrefetchMode <= mode_lib->vba.MaxPrefetchMode));
+
+ if (locals->PrefetchSupported[i][j] == true && locals->VRatioInPrefetchSupported[i][j] == true) {
+ mode_lib->vba.BandwidthAvailableForImmediateFlip = locals->ReturnBWPerState[i][0];
+--
+2.30.2
+
--- /dev/null
+From f25e76f02a3b94c9b80506c6345fd1d9f78ade3a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 7 Jul 2021 13:19:14 -0400
+Subject: drm/amd/display: Fix max vstartup calculation for modes with borders
+
+From: Nicholas Kazlauskas <nicholas.kazlauskas@amd.com>
+
+[ Upstream commit d7940911fc0754d99b208f0e3098762d39f403a0 ]
+
+[Why]
+Vertical and horizontal borders in timings are treated as increasing the
+active area - vblank and hblank actually shrink.
+
+Our input into DML does not include these borders so it incorrectly
+assumes it has more time than available for vstartup and tmdl
+calculations for some modes with borders.
+
+An example of such a timing would be 640x480@72Hz:
+
+h_total: 832
+h_border_left: 8
+h_addressable: 640
+h_border_right: 8
+h_front_porch: 16
+h_sync_width: 40
+v_total: 520
+v_border_top: 8
+v_addressable: 480
+v_border_bottom: 8
+v_front_porch: 1
+v_sync_width: 3
+pix_clk_100hz: 315000
+
+[How]
+Include borders as part of destination vactive/hactive.
+
+This change DCN20+ so it has wide impact, but the destination vactive
+and hactive are only really used for vstartup calculation anyway.
+
+Most modes do not have vertical or horizontal borders.
+
+Reviewed-by: Dmytro Laktyushkin <Dmytro.Laktyushkin@amd.com>
+Acked-by: Rodrigo Siqueira <Rodrigo.Siqueira@amd.com>
+Signed-off-by: Nicholas Kazlauskas <nicholas.kazlauskas@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/display/dc/dcn20/dcn20_resource.c | 6 ++++--
+ 1 file changed, 4 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/gpu/drm/amd/display/dc/dcn20/dcn20_resource.c b/drivers/gpu/drm/amd/display/dc/dcn20/dcn20_resource.c
+index 1812ec7ee11b..cfe85ba1018e 100644
+--- a/drivers/gpu/drm/amd/display/dc/dcn20/dcn20_resource.c
++++ b/drivers/gpu/drm/amd/display/dc/dcn20/dcn20_resource.c
+@@ -2077,8 +2077,10 @@ int dcn20_populate_dml_pipes_from_context(
+ - timing->v_border_bottom;
+ pipes[pipe_cnt].pipe.dest.htotal = timing->h_total;
+ pipes[pipe_cnt].pipe.dest.vtotal = v_total;
+- pipes[pipe_cnt].pipe.dest.hactive = timing->h_addressable;
+- pipes[pipe_cnt].pipe.dest.vactive = timing->v_addressable;
++ pipes[pipe_cnt].pipe.dest.hactive =
++ timing->h_addressable + timing->h_border_left + timing->h_border_right;
++ pipes[pipe_cnt].pipe.dest.vactive =
++ timing->v_addressable + timing->v_border_top + timing->v_border_bottom;
+ pipes[pipe_cnt].pipe.dest.interlaced = timing->flags.INTERLACE;
+ pipes[pipe_cnt].pipe.dest.pixel_rate_mhz = timing->pix_clk_100hz/10000.0;
+ if (timing->timing_3d_format == TIMING_3D_FORMAT_HW_FRAME_PACKING)
+--
+2.30.2
+
--- /dev/null
+From a2066f4470f1ddeada4dae972698498be2ce85ba Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 20 Jul 2021 09:28:09 +0200
+Subject: efi/mokvar: Reserve the table only if it is in boot services data
+
+From: Borislav Petkov <bp@suse.de>
+
+[ Upstream commit 47e1e233e9d822dfda068383fb9a616451bda703 ]
+
+One of the SUSE QA tests triggered:
+
+ localhost kernel: efi: Failed to lookup EFI memory descriptor for 0x000000003dcf8000
+
+which comes from x86's version of efi_arch_mem_reserve() trying to
+reserve a memory region. Usually, that function expects
+EFI_BOOT_SERVICES_DATA memory descriptors but the above case is for the
+MOKvar table which is allocated in the EFI shim as runtime services.
+
+That lead to a fix changing the allocation of that table to boot services.
+
+However, that fix broke booting SEV guests with that shim leading to
+this kernel fix
+
+ 8d651ee9c71b ("x86/ioremap: Map EFI-reserved memory as encrypted for SEV")
+
+which extended the ioremap hint to map reserved EFI boot services as
+decrypted too.
+
+However, all that wasn't needed, IMO, because that error message in
+efi_arch_mem_reserve() was innocuous in this case - if the MOKvar table
+is not in boot services, then it doesn't need to be reserved in the
+first place because it is, well, in runtime services which *should* be
+reserved anyway.
+
+So do that reservation for the MOKvar table only if it is allocated
+in boot services data. I couldn't find any requirement about where
+that table should be allocated in, unlike the ESRT which allocation is
+mandated to be done in boot services data by the UEFI spec.
+
+Signed-off-by: Borislav Petkov <bp@suse.de>
+Signed-off-by: Ard Biesheuvel <ardb@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/firmware/efi/mokvar-table.c | 5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/firmware/efi/mokvar-table.c b/drivers/firmware/efi/mokvar-table.c
+index d8bc01340686..38722d2009e2 100644
+--- a/drivers/firmware/efi/mokvar-table.c
++++ b/drivers/firmware/efi/mokvar-table.c
+@@ -180,7 +180,10 @@ void __init efi_mokvar_table_init(void)
+ pr_err("EFI MOKvar config table is not valid\n");
+ return;
+ }
+- efi_mem_reserve(efi.mokvar_table, map_size_needed);
++
++ if (md.type == EFI_BOOT_SERVICES_DATA)
++ efi_mem_reserve(efi.mokvar_table, map_size_needed);
++
+ efi_mokvar_table_size = map_size_needed;
+ }
+
+--
+2.30.2
+
--- /dev/null
+From a4f5f0d71b6ab07f534a257d10cb919bd4cf3717 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 15 Jul 2021 16:59:00 -0700
+Subject: net: Fix zero-copy head len calculation.
+
+From: Pravin B Shelar <pshelar@ovn.org>
+
+[ Upstream commit a17ad0961706244dce48ec941f7e476a38c0e727 ]
+
+In some cases skb head could be locked and entire header
+data is pulled from skb. When skb_zerocopy() called in such cases,
+following BUG is triggered. This patch fixes it by copying entire
+skb in such cases.
+This could be optimized incase this is performance bottleneck.
+
+---8<---
+kernel BUG at net/core/skbuff.c:2961!
+invalid opcode: 0000 [#1] SMP PTI
+CPU: 2 PID: 0 Comm: swapper/2 Tainted: G OE 5.4.0-77-generic #86-Ubuntu
+Hardware name: OpenStack Foundation OpenStack Nova, BIOS 1.13.0-1ubuntu1.1 04/01/2014
+RIP: 0010:skb_zerocopy+0x37a/0x3a0
+RSP: 0018:ffffbcc70013ca38 EFLAGS: 00010246
+Call Trace:
+ <IRQ>
+ queue_userspace_packet+0x2af/0x5e0 [openvswitch]
+ ovs_dp_upcall+0x3d/0x60 [openvswitch]
+ ovs_dp_process_packet+0x125/0x150 [openvswitch]
+ ovs_vport_receive+0x77/0xd0 [openvswitch]
+ netdev_port_receive+0x87/0x130 [openvswitch]
+ netdev_frame_hook+0x4b/0x60 [openvswitch]
+ __netif_receive_skb_core+0x2b4/0xc90
+ __netif_receive_skb_one_core+0x3f/0xa0
+ __netif_receive_skb+0x18/0x60
+ process_backlog+0xa9/0x160
+ net_rx_action+0x142/0x390
+ __do_softirq+0xe1/0x2d6
+ irq_exit+0xae/0xb0
+ do_IRQ+0x5a/0xf0
+ common_interrupt+0xf/0xf
+
+Code that triggered BUG:
+int
+skb_zerocopy(struct sk_buff *to, struct sk_buff *from, int len, int hlen)
+{
+ int i, j = 0;
+ int plen = 0; /* length of skb->head fragment */
+ int ret;
+ struct page *page;
+ unsigned int offset;
+
+ BUG_ON(!from->head_frag && !hlen);
+
+Signed-off-by: Pravin B Shelar <pshelar@ovn.org>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/core/skbuff.c | 5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+diff --git a/net/core/skbuff.c b/net/core/skbuff.c
+index 2d27aae6d36f..825e6b988003 100644
+--- a/net/core/skbuff.c
++++ b/net/core/skbuff.c
+@@ -2922,8 +2922,11 @@ skb_zerocopy_headlen(const struct sk_buff *from)
+
+ if (!from->head_frag ||
+ skb_headlen(from) < L1_CACHE_BYTES ||
+- skb_shinfo(from)->nr_frags >= MAX_SKB_FRAGS)
++ skb_shinfo(from)->nr_frags >= MAX_SKB_FRAGS) {
+ hlen = skb_headlen(from);
++ if (!hlen)
++ hlen = from->len;
++ }
+
+ if (skb_has_frag_list(from))
+ hlen = from->len;
+--
+2.30.2
+
--- /dev/null
+From 2bde672ec2b7035a9f6bb353199c78612b9ab47f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 19 Jul 2021 09:44:39 -0700
+Subject: nvme: fix nvme_setup_command metadata trace event
+
+From: Keith Busch <kbusch@kernel.org>
+
+[ Upstream commit 234211b8dd161fa25f192c78d5a8d2dd6bf920a0 ]
+
+The metadata address is set after the trace event, so the trace is not
+capturing anything useful. Rather than logging the memory address, it's
+useful to know if the command carries a metadata payload, so change the
+trace event to log that true/false state instead.
+
+Signed-off-by: Keith Busch <kbusch@kernel.org>
+Signed-off-by: Christoph Hellwig <hch@lst.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/nvme/host/trace.h | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/nvme/host/trace.h b/drivers/nvme/host/trace.h
+index daaf700eae79..35bac7a25422 100644
+--- a/drivers/nvme/host/trace.h
++++ b/drivers/nvme/host/trace.h
+@@ -56,7 +56,7 @@ TRACE_EVENT(nvme_setup_cmd,
+ __field(u8, fctype)
+ __field(u16, cid)
+ __field(u32, nsid)
+- __field(u64, metadata)
++ __field(bool, metadata)
+ __array(u8, cdw10, 24)
+ ),
+ TP_fast_assign(
+@@ -66,13 +66,13 @@ TRACE_EVENT(nvme_setup_cmd,
+ __entry->flags = cmd->common.flags;
+ __entry->cid = cmd->common.command_id;
+ __entry->nsid = le32_to_cpu(cmd->common.nsid);
+- __entry->metadata = le64_to_cpu(cmd->common.metadata);
++ __entry->metadata = !!blk_integrity_rq(req);
+ __entry->fctype = cmd->fabrics.fctype;
+ __assign_disk_name(__entry->disk, req->rq_disk);
+ memcpy(__entry->cdw10, &cmd->common.cdw10,
+ sizeof(__entry->cdw10));
+ ),
+- TP_printk("nvme%d: %sqid=%d, cmdid=%u, nsid=%u, flags=0x%x, meta=0x%llx, cmd=(%s %s)",
++ TP_printk("nvme%d: %sqid=%d, cmdid=%u, nsid=%u, flags=0x%x, meta=0x%x, cmd=(%s %s)",
+ __entry->ctrl_id, __print_disk_name(__entry->disk),
+ __entry->qid, __entry->cid, __entry->nsid,
+ __entry->flags, __entry->metadata,
+--
+2.30.2
+
--- /dev/null
+From d1e94ae1e46b2277c20e590efe578cca0e01a3cc Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 15 Jul 2021 16:08:21 +0800
+Subject: qed: fix possible unpaired spin_{un}lock_bh in
+ _qed_mcp_cmd_and_union()
+
+From: Jia He <justin.he@arm.com>
+
+[ Upstream commit 6206b7981a36476f4695d661ae139f7db36a802d ]
+
+Liajian reported a bug_on hit on a ThunderX2 arm64 server with FastLinQ
+QL41000 ethernet controller:
+ BUG: scheduling while atomic: kworker/0:4/531/0x00000200
+ [qed_probe:488()]hw prepare failed
+ kernel BUG at mm/vmalloc.c:2355!
+ Internal error: Oops - BUG: 0 [#1] SMP
+ CPU: 0 PID: 531 Comm: kworker/0:4 Tainted: G W 5.4.0-77-generic #86-Ubuntu
+ pstate: 00400009 (nzcv daif +PAN -UAO)
+ Call trace:
+ vunmap+0x4c/0x50
+ iounmap+0x48/0x58
+ qed_free_pci+0x60/0x80 [qed]
+ qed_probe+0x35c/0x688 [qed]
+ __qede_probe+0x88/0x5c8 [qede]
+ qede_probe+0x60/0xe0 [qede]
+ local_pci_probe+0x48/0xa0
+ work_for_cpu_fn+0x24/0x38
+ process_one_work+0x1d0/0x468
+ worker_thread+0x238/0x4e0
+ kthread+0xf0/0x118
+ ret_from_fork+0x10/0x18
+
+In this case, qed_hw_prepare() returns error due to hw/fw error, but in
+theory work queue should be in process context instead of interrupt.
+
+The root cause might be the unpaired spin_{un}lock_bh() in
+_qed_mcp_cmd_and_union(), which causes botton half is disabled incorrectly.
+
+Reported-by: Lijian Zhang <Lijian.Zhang@arm.com>
+Signed-off-by: Jia He <justin.he@arm.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/qlogic/qed/qed_mcp.c | 23 +++++++++++++++++------
+ 1 file changed, 17 insertions(+), 6 deletions(-)
+
+diff --git a/drivers/net/ethernet/qlogic/qed/qed_mcp.c b/drivers/net/ethernet/qlogic/qed/qed_mcp.c
+index cd882c453394..caeef25c89bb 100644
+--- a/drivers/net/ethernet/qlogic/qed/qed_mcp.c
++++ b/drivers/net/ethernet/qlogic/qed/qed_mcp.c
+@@ -474,14 +474,18 @@ _qed_mcp_cmd_and_union(struct qed_hwfn *p_hwfn,
+
+ spin_lock_bh(&p_hwfn->mcp_info->cmd_lock);
+
+- if (!qed_mcp_has_pending_cmd(p_hwfn))
++ if (!qed_mcp_has_pending_cmd(p_hwfn)) {
++ spin_unlock_bh(&p_hwfn->mcp_info->cmd_lock);
+ break;
++ }
+
+ rc = qed_mcp_update_pending_cmd(p_hwfn, p_ptt);
+- if (!rc)
++ if (!rc) {
++ spin_unlock_bh(&p_hwfn->mcp_info->cmd_lock);
+ break;
+- else if (rc != -EAGAIN)
++ } else if (rc != -EAGAIN) {
+ goto err;
++ }
+
+ spin_unlock_bh(&p_hwfn->mcp_info->cmd_lock);
+
+@@ -498,6 +502,8 @@ _qed_mcp_cmd_and_union(struct qed_hwfn *p_hwfn,
+ return -EAGAIN;
+ }
+
++ spin_lock_bh(&p_hwfn->mcp_info->cmd_lock);
++
+ /* Send the mailbox command */
+ qed_mcp_reread_offsets(p_hwfn, p_ptt);
+ seq_num = ++p_hwfn->mcp_info->drv_mb_seq;
+@@ -524,14 +530,18 @@ _qed_mcp_cmd_and_union(struct qed_hwfn *p_hwfn,
+
+ spin_lock_bh(&p_hwfn->mcp_info->cmd_lock);
+
+- if (p_cmd_elem->b_is_completed)
++ if (p_cmd_elem->b_is_completed) {
++ spin_unlock_bh(&p_hwfn->mcp_info->cmd_lock);
+ break;
++ }
+
+ rc = qed_mcp_update_pending_cmd(p_hwfn, p_ptt);
+- if (!rc)
++ if (!rc) {
++ spin_unlock_bh(&p_hwfn->mcp_info->cmd_lock);
+ break;
+- else if (rc != -EAGAIN)
++ } else if (rc != -EAGAIN) {
+ goto err;
++ }
+
+ spin_unlock_bh(&p_hwfn->mcp_info->cmd_lock);
+ } while (++cnt < max_retries);
+@@ -554,6 +564,7 @@ _qed_mcp_cmd_and_union(struct qed_hwfn *p_hwfn,
+ return -EAGAIN;
+ }
+
++ spin_lock_bh(&p_hwfn->mcp_info->cmd_lock);
+ qed_mcp_cmd_del_elem(p_hwfn, p_cmd_elem);
+ spin_unlock_bh(&p_hwfn->mcp_info->cmd_lock);
+
+--
+2.30.2
+
--- /dev/null
+From bcff8b242e3bed165f599d5e31009f7a22c9563a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 14 Jul 2021 19:00:21 +0200
+Subject: r8152: Fix potential PM refcount imbalance
+
+From: Takashi Iwai <tiwai@suse.de>
+
+[ Upstream commit 9c23aa51477a37f8b56c3c40192248db0663c196 ]
+
+rtl8152_close() takes the refcount via usb_autopm_get_interface() but
+it doesn't release when RTL8152_UNPLUG test hits. This may lead to
+the imbalance of PM refcount. This patch addresses it.
+
+Link: https://bugzilla.suse.com/show_bug.cgi?id=1186194
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/usb/r8152.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/net/usb/r8152.c b/drivers/net/usb/r8152.c
+index 95e27fb7d2c1..105622e1defa 100644
+--- a/drivers/net/usb/r8152.c
++++ b/drivers/net/usb/r8152.c
+@@ -5282,9 +5282,10 @@ static int rtl8152_close(struct net_device *netdev)
+ tp->rtl_ops.down(tp);
+
+ mutex_unlock(&tp->control);
++ }
+
++ if (!res)
+ usb_autopm_put_interface(tp->intf);
+- }
+
+ free_all_mem(tp);
+
+--
+2.30.2
+
--- /dev/null
+From 37cd88cfb0c37046fc4772f0bdd3ebb11b7942c8 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 27 Jun 2021 16:04:18 +0800
+Subject: regulator: rt5033: Fix n_voltages settings for BUCK and LDO
+
+From: Axel Lin <axel.lin@ingics.com>
+
+[ Upstream commit 6549c46af8551b346bcc0b9043f93848319acd5c ]
+
+For linear regulators, the n_voltages should be (max - min) / step + 1.
+
+Buck voltage from 1v to 3V, per step 100mV, and vout mask is 0x1f.
+If value is from 20 to 31, the voltage will all be fixed to 3V.
+And LDO also, just vout range is different from 1.2v to 3v, step is the
+same. If value is from 18 to 31, the voltage will also be fixed to 3v.
+
+Signed-off-by: Axel Lin <axel.lin@ingics.com>
+Reviewed-by: ChiYuan Huang <cy_huang@richtek.com>
+Link: https://lore.kernel.org/r/20210627080418.1718127-1-axel.lin@ingics.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/linux/mfd/rt5033-private.h | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/include/linux/mfd/rt5033-private.h b/include/linux/mfd/rt5033-private.h
+index f812105c538c..f2271bfb3273 100644
+--- a/include/linux/mfd/rt5033-private.h
++++ b/include/linux/mfd/rt5033-private.h
+@@ -200,13 +200,13 @@ enum rt5033_reg {
+ #define RT5033_REGULATOR_BUCK_VOLTAGE_MIN 1000000U
+ #define RT5033_REGULATOR_BUCK_VOLTAGE_MAX 3000000U
+ #define RT5033_REGULATOR_BUCK_VOLTAGE_STEP 100000U
+-#define RT5033_REGULATOR_BUCK_VOLTAGE_STEP_NUM 32
++#define RT5033_REGULATOR_BUCK_VOLTAGE_STEP_NUM 21
+
+ /* RT5033 regulator LDO output voltage uV */
+ #define RT5033_REGULATOR_LDO_VOLTAGE_MIN 1200000U
+ #define RT5033_REGULATOR_LDO_VOLTAGE_MAX 3000000U
+ #define RT5033_REGULATOR_LDO_VOLTAGE_STEP 100000U
+-#define RT5033_REGULATOR_LDO_VOLTAGE_STEP_NUM 32
++#define RT5033_REGULATOR_LDO_VOLTAGE_STEP_NUM 19
+
+ /* RT5033 regulator SAFE LDO output voltage uV */
+ #define RT5033_REGULATOR_SAFE_LDO_VOLTAGE 4900000U
+--
+2.30.2
+
--- /dev/null
+From a6edd98184bda9d2751b1587e8af387c53ccabee Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 26 Jun 2021 23:58:32 +0800
+Subject: regulator: rtmv20: Fix wrong mask for strobe-polarity-high
+
+From: ChiYuan Huang <cy_huang@richtek.com>
+
+[ Upstream commit 2b6a761be079f9fa8abf3157b5679a6f38885db4 ]
+
+Fix wrong mask for strobe-polarity-high.
+
+Signed-off-by: ChiYuan Huang <cy_huang@richtek.com>
+In-reply-to: <CAFRkauB=0KwrJW19nJTTagdHhBR=V2R8YFWG3R3oVXt=rBRsqw@mail.gmail.com>
+Reviewed-by: Axel Lin <axel.lin@ingics.com>
+Link: https://lore.kernel.org/r/1624723112-26653-1-git-send-email-u0084500@gmail.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/regulator/rtmv20-regulator.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/regulator/rtmv20-regulator.c b/drivers/regulator/rtmv20-regulator.c
+index 4bca64de0f67..2ee334174e2b 100644
+--- a/drivers/regulator/rtmv20-regulator.c
++++ b/drivers/regulator/rtmv20-regulator.c
+@@ -37,7 +37,7 @@
+ #define RTMV20_WIDTH2_MASK GENMASK(7, 0)
+ #define RTMV20_LBPLVL_MASK GENMASK(3, 0)
+ #define RTMV20_LBPEN_MASK BIT(7)
+-#define RTMV20_STROBEPOL_MASK BIT(1)
++#define RTMV20_STROBEPOL_MASK BIT(0)
+ #define RTMV20_VSYNPOL_MASK BIT(1)
+ #define RTMV20_FSINEN_MASK BIT(7)
+ #define RTMV20_ESEN_MASK BIT(6)
+--
+2.30.2
+
revert-drm-i915-propagate-errors-on-awaiting-already.patch
btrfs-fix-race-causing-unnecessary-inode-logging-dur.patch
btrfs-fix-lost-inode-on-log-replay-after-mix-of-fsyn.patch
+regulator-rtmv20-fix-wrong-mask-for-strobe-polarity-.patch
+regulator-rt5033-fix-n_voltages-settings-for-buck-an.patch
+spi-stm32h7-fix-full-duplex-irq-handler-handling.patch
+asoc-tlv320aic31xx-fix-reversed-bclk-wclk-master-bit.patch
+r8152-fix-potential-pm-refcount-imbalance.patch
+qed-fix-possible-unpaired-spin_-un-lock_bh-in-_qed_m.patch
+asoc-rt5682-fix-the-issue-of-garbled-recording-after.patch
+net-fix-zero-copy-head-len-calculation.patch
+asoc-ti-j721e-evm-fix-unbalanced-domain-activity-tra.patch
+asoc-ti-j721e-evm-check-for-not-initialized-parent_c.patch
+efi-mokvar-reserve-the-table-only-if-it-is-in-boot-s.patch
+nvme-fix-nvme_setup_command-metadata-trace-event.patch
+drm-amd-display-fix-comparison-error-in-dcn21-dml.patch
+drm-amd-display-fix-max-vstartup-calculation-for-mod.patch
+acpi-fix-null-pointer-dereference.patch
--- /dev/null
+From ad6645f7244d7fe05f05dc1c468462ecc56796ed Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 30 Jun 2021 10:45:19 +0200
+Subject: spi: stm32h7: fix full duplex irq handler handling
+
+From: Alain Volmat <alain.volmat@foss.st.com>
+
+[ Upstream commit e4a5c19888a5f8a9390860ca493e643be58c8791 ]
+
+In case of Full-Duplex mode, DXP flag is set when RXP and TXP flags are
+set. But to avoid 2 different handlings, just add TXP and RXP flag in
+the mask instead of DXP, and then keep the initial handling of TXP and
+RXP events.
+Also rephrase comment about EOTIE which is one of the interrupt enable
+bits. It is not triggered by any event.
+
+Signed-off-by: Amelie Delaunay <amelie.delaunay@foss.st.com>
+Signed-off-by: Alain Volmat <alain.volmat@foss.st.com>
+Reviewed-by: Amelie Delaunay <amelie.delaunay@foss.st.com>
+Link: https://lore.kernel.org/r/1625042723-661-3-git-send-email-alain.volmat@foss.st.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/spi/spi-stm32.c | 15 +++++++++------
+ 1 file changed, 9 insertions(+), 6 deletions(-)
+
+diff --git a/drivers/spi/spi-stm32.c b/drivers/spi/spi-stm32.c
+index 8f91f8705eee..a6dfc8fef20c 100644
+--- a/drivers/spi/spi-stm32.c
++++ b/drivers/spi/spi-stm32.c
+@@ -917,15 +917,18 @@ static irqreturn_t stm32h7_spi_irq_thread(int irq, void *dev_id)
+ ier = readl_relaxed(spi->base + STM32H7_SPI_IER);
+
+ mask = ier;
+- /* EOTIE is triggered on EOT, SUSP and TXC events. */
++ /*
++ * EOTIE enables irq from EOT, SUSP and TXC events. We need to set
++ * SUSP to acknowledge it later. TXC is automatically cleared
++ */
++
+ mask |= STM32H7_SPI_SR_SUSP;
+ /*
+- * When TXTF is set, DXPIE and TXPIE are cleared. So in case of
+- * Full-Duplex, need to poll RXP event to know if there are remaining
+- * data, before disabling SPI.
++ * DXPIE is set in Full-Duplex, one IT will be raised if TXP and RXP
++ * are set. So in case of Full-Duplex, need to poll TXP and RXP event.
+ */
+- if (spi->rx_buf && !spi->cur_usedma)
+- mask |= STM32H7_SPI_SR_RXP;
++ if ((spi->cur_comm == SPI_FULL_DUPLEX) && !spi->cur_usedma)
++ mask |= STM32H7_SPI_SR_TXP | STM32H7_SPI_SR_RXP;
+
+ if (!(sr & mask)) {
+ dev_warn(spi->dev, "spurious IT (sr=0x%08x, ier=0x%08x)\n",
+--
+2.30.2
+
projects / thirdparty / kernel / stable-queue.git / commitdiff
