From: Sasha Levin Date: Thu, 5 Aug 2021 01:38:15 +0000 (-0400) Subject: Fixes for 5.10 X-Git-Tag: v4.4.279~31 X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=d19b652c358e23f9a730fad5e1d4ec8310d75092;p=thirdparty%2Fkernel%2Fstable-queue.git Fixes for 5.10 Signed-off-by: Sasha Levin --- diff --git a/queue-5.10/acpi-fix-null-pointer-dereference.patch b/queue-5.10/acpi-fix-null-pointer-dereference.patch new file mode 100644 index 00000000000..925734435d3 --- /dev/null +++ b/queue-5.10/acpi-fix-null-pointer-dereference.patch @@ -0,0 +1,45 @@ +From 8973b8434e52c87cba1dcde173c677d387812248 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 24 Jul 2021 15:25:54 -0700 +Subject: ACPI: fix NULL pointer dereference + +From: Linus Torvalds + +[ Upstream commit fc68f42aa737dc15e7665a4101d4168aadb8e4c4 ] + +Commit 71f642833284 ("ACPI: utils: Fix reference counting in +for_each_acpi_dev_match()") started doing "acpi_dev_put()" on a pointer +that was possibly NULL. That fails miserably, because that helper +inline function is not set up to handle that case. + +Just make acpi_dev_put() silently accept a NULL pointer, rather than +calling down to put_device() with an invalid offset off that NULL +pointer. + +Link: https://lore.kernel.org/lkml/a607c149-6bf6-0fd0-0e31-100378504da2@kernel.dk/ +Reported-and-tested-by: Jens Axboe +Tested-by: Daniel Scally +Cc: Andy Shevchenko +Signed-off-by: Linus Torvalds +Signed-off-by: Sasha Levin +--- + include/acpi/acpi_bus.h | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/include/acpi/acpi_bus.h b/include/acpi/acpi_bus.h +index 37dac195adbb..6ad3b89a8a2e 100644 +--- a/include/acpi/acpi_bus.h ++++ b/include/acpi/acpi_bus.h +@@ -689,7 +689,8 @@ acpi_dev_get_first_match_dev(const char *hid, const char *uid, s64 hrv); + + static inline void acpi_dev_put(struct acpi_device *adev) + { +- put_device(&adev->dev); ++ if (adev) ++ put_device(&adev->dev); + } + #else /* CONFIG_ACPI */ + +-- +2.30.2 + diff --git a/queue-5.10/asoc-rt5682-fix-the-issue-of-garbled-recording-after.patch b/queue-5.10/asoc-rt5682-fix-the-issue-of-garbled-recording-after.patch new file mode 100644 index 00000000000..e7d18ce9d9c --- /dev/null +++ b/queue-5.10/asoc-rt5682-fix-the-issue-of-garbled-recording-after.patch @@ -0,0 +1,46 @@ +From 2e92be28d10b2173c63763ff5bee671820a10261 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 16 Jul 2021 16:58:53 +0800 +Subject: ASoC: rt5682: Fix the issue of garbled recording after + powerd_dbus_suspend + +From: Oder Chiou + +[ Upstream commit 6a503e1c455316fd0bfd8188c0a62cce7c5525ca ] + +While using the DMIC recording, the garbled data will be captured by the +DMIC. It is caused by the critical power of PLL closed in the jack detect +function. + +Signed-off-by: Oder Chiou +Link: https://lore.kernel.org/r/20210716085853.20170-1-oder_chiou@realtek.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/codecs/rt5682.c | 8 ++++++-- + 1 file changed, 6 insertions(+), 2 deletions(-) + +diff --git a/sound/soc/codecs/rt5682.c b/sound/soc/codecs/rt5682.c +index d9878173ff89..2e41b8c169e5 100644 +--- a/sound/soc/codecs/rt5682.c ++++ b/sound/soc/codecs/rt5682.c +@@ -971,10 +971,14 @@ int rt5682_headset_detect(struct snd_soc_component *component, int jack_insert) + rt5682_enable_push_button_irq(component, false); + snd_soc_component_update_bits(component, RT5682_CBJ_CTRL_1, + RT5682_TRIG_JD_MASK, RT5682_TRIG_JD_LOW); +- if (!snd_soc_dapm_get_pin_status(dapm, "MICBIAS")) ++ if (!snd_soc_dapm_get_pin_status(dapm, "MICBIAS") && ++ !snd_soc_dapm_get_pin_status(dapm, "PLL1") && ++ !snd_soc_dapm_get_pin_status(dapm, "PLL2B")) + snd_soc_component_update_bits(component, + RT5682_PWR_ANLG_1, RT5682_PWR_MB, 0); +- if (!snd_soc_dapm_get_pin_status(dapm, "Vref2")) ++ if (!snd_soc_dapm_get_pin_status(dapm, "Vref2") && ++ !snd_soc_dapm_get_pin_status(dapm, "PLL1") && ++ !snd_soc_dapm_get_pin_status(dapm, "PLL2B")) + snd_soc_component_update_bits(component, + RT5682_PWR_ANLG_1, RT5682_PWR_VREF2, 0); + snd_soc_component_update_bits(component, RT5682_PWR_ANLG_3, +-- +2.30.2 + diff --git a/queue-5.10/asoc-ti-j721e-evm-check-for-not-initialized-parent_c.patch b/queue-5.10/asoc-ti-j721e-evm-check-for-not-initialized-parent_c.patch new file mode 100644 index 00000000000..ad20033c4a1 --- /dev/null +++ b/queue-5.10/asoc-ti-j721e-evm-check-for-not-initialized-parent_c.patch @@ -0,0 +1,36 @@ +From d78264bc3f79f62c5192404291c8b0dfb02d3700 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 17 Jul 2021 15:28:19 +0300 +Subject: ASoC: ti: j721e-evm: Check for not initialized parent_clk_id + +From: Peter Ujfalusi + +[ Upstream commit 82d28b67f780910f816fe1cfb0f676fc38c4cbb3 ] + +During probe the parent_clk_id is set to -1 which should not be used to +array index within hsdiv_rates[]. + +Signed-off-by: Peter Ujfalusi +Link: https://lore.kernel.org/r/20210717122820.1467-3-peter.ujfalusi@gmail.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/ti/j721e-evm.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/sound/soc/ti/j721e-evm.c b/sound/soc/ti/j721e-evm.c +index 017c4ad11ca6..265bbc5a2f96 100644 +--- a/sound/soc/ti/j721e-evm.c ++++ b/sound/soc/ti/j721e-evm.c +@@ -197,7 +197,7 @@ static int j721e_configure_refclk(struct j721e_priv *priv, + return ret; + } + +- if (priv->hsdiv_rates[domain->parent_clk_id] != scki) { ++ if (domain->parent_clk_id == -1 || priv->hsdiv_rates[domain->parent_clk_id] != scki) { + dev_dbg(priv->dev, + "%s configuration for %u Hz: %s, %dxFS (SCKI: %u Hz)\n", + audio_domain == J721E_AUDIO_DOMAIN_CPB ? "CPB" : "IVI", +-- +2.30.2 + diff --git a/queue-5.10/asoc-ti-j721e-evm-fix-unbalanced-domain-activity-tra.patch b/queue-5.10/asoc-ti-j721e-evm-fix-unbalanced-domain-activity-tra.patch new file mode 100644 index 00000000000..3ce5174ed63 --- /dev/null +++ b/queue-5.10/asoc-ti-j721e-evm-fix-unbalanced-domain-activity-tra.patch @@ -0,0 +1,63 @@ +From f6a5665561a5094b311fff90f44ba1d559b80f09 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 17 Jul 2021 15:28:18 +0300 +Subject: ASoC: ti: j721e-evm: Fix unbalanced domain activity tracking during + startup + +From: Peter Ujfalusi + +[ Upstream commit 78d2a05ef22e7b5863b01e073dd6a06b3979bb00 ] + +In case of an error within j721e_audio_startup() the domain->active must +be decremented to avoid unbalanced counter. + +Signed-off-by: Peter Ujfalusi +Link: https://lore.kernel.org/r/20210717122820.1467-2-peter.ujfalusi@gmail.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/ti/j721e-evm.c | 16 +++++++++++----- + 1 file changed, 11 insertions(+), 5 deletions(-) + +diff --git a/sound/soc/ti/j721e-evm.c b/sound/soc/ti/j721e-evm.c +index a7c0484d44ec..017c4ad11ca6 100644 +--- a/sound/soc/ti/j721e-evm.c ++++ b/sound/soc/ti/j721e-evm.c +@@ -278,23 +278,29 @@ static int j721e_audio_startup(struct snd_pcm_substream *substream) + j721e_rule_rate, &priv->rate_range, + SNDRV_PCM_HW_PARAM_RATE, -1); + +- mutex_unlock(&priv->mutex); + + if (ret) +- return ret; ++ goto out; + + /* Reset TDM slots to 32 */ + ret = snd_soc_dai_set_tdm_slot(cpu_dai, 0x3, 0x3, 2, 32); + if (ret && ret != -ENOTSUPP) +- return ret; ++ goto out; + + for_each_rtd_codec_dais(rtd, i, codec_dai) { + ret = snd_soc_dai_set_tdm_slot(codec_dai, 0x3, 0x3, 2, 32); + if (ret && ret != -ENOTSUPP) +- return ret; ++ goto out; + } + +- return 0; ++ if (ret == -ENOTSUPP) ++ ret = 0; ++out: ++ if (ret) ++ domain->active--; ++ mutex_unlock(&priv->mutex); ++ ++ return ret; + } + + static int j721e_audio_hw_params(struct snd_pcm_substream *substream, +-- +2.30.2 + diff --git a/queue-5.10/asoc-tlv320aic31xx-fix-reversed-bclk-wclk-master-bit.patch b/queue-5.10/asoc-tlv320aic31xx-fix-reversed-bclk-wclk-master-bit.patch new file mode 100644 index 00000000000..a5419e013b2 --- /dev/null +++ b/queue-5.10/asoc-tlv320aic31xx-fix-reversed-bclk-wclk-master-bit.patch @@ -0,0 +1,49 @@ +From 140c42da1466f7341a6609dbc9e40dbbf1a05208 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 21 Jun 2021 21:09:41 -0400 +Subject: ASoC: tlv320aic31xx: fix reversed bclk/wclk master bits + +From: Kyle Russell + +[ Upstream commit 9cf76a72af6ab81030dea6481b1d7bdd814fbdaf ] + +These are backwards from Table 7-71 of the TLV320AIC3100 spec [1]. + +This was broken in 12eb4d66ba2e when BCLK_MASTER and WCLK_MASTER +were converted from 0x08 and 0x04 to BIT(2) and BIT(3), respectively. + +-#define AIC31XX_BCLK_MASTER 0x08 +-#define AIC31XX_WCLK_MASTER 0x04 ++#define AIC31XX_BCLK_MASTER BIT(2) ++#define AIC31XX_WCLK_MASTER BIT(3) + +Probably just a typo since the defines were not listed in bit order. + +[1] https://www.ti.com/lit/gpn/tlv320aic3100 + +Signed-off-by: Kyle Russell +Link: https://lore.kernel.org/r/20210622010941.241386-1-bkylerussell@gmail.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/codecs/tlv320aic31xx.h | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/sound/soc/codecs/tlv320aic31xx.h b/sound/soc/codecs/tlv320aic31xx.h +index 81952984613d..2513922a0292 100644 +--- a/sound/soc/codecs/tlv320aic31xx.h ++++ b/sound/soc/codecs/tlv320aic31xx.h +@@ -151,8 +151,8 @@ struct aic31xx_pdata { + #define AIC31XX_WORD_LEN_24BITS 0x02 + #define AIC31XX_WORD_LEN_32BITS 0x03 + #define AIC31XX_IFACE1_MASTER_MASK GENMASK(3, 2) +-#define AIC31XX_BCLK_MASTER BIT(2) +-#define AIC31XX_WCLK_MASTER BIT(3) ++#define AIC31XX_BCLK_MASTER BIT(3) ++#define AIC31XX_WCLK_MASTER BIT(2) + + /* AIC31XX_DATA_OFFSET */ + #define AIC31XX_DATA_OFFSET_MASK GENMASK(7, 0) +-- +2.30.2 + diff --git a/queue-5.10/drm-amd-display-fix-comparison-error-in-dcn21-dml.patch b/queue-5.10/drm-amd-display-fix-comparison-error-in-dcn21-dml.patch new file mode 100644 index 00000000000..7548a0906bf --- /dev/null +++ b/queue-5.10/drm-amd-display-fix-comparison-error-in-dcn21-dml.patch @@ -0,0 +1,42 @@ +From 529fef8ee88debd5075caad93adb9f7875770a73 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 24 Jun 2021 11:05:42 -0400 +Subject: drm/amd/display: Fix comparison error in dcn21 DML + +From: Victor Lu + +[ Upstream commit ec3102dc6b36c692104c4a0546d4119de59a3bc1 ] + +[why] +A comparison error made it possible to not iterate through all the +specified prefetch modes. + +[how] +Correct "<" to "<=" + +Reviewed-by: Dmytro Laktyushkin +Reviewed-by: Yongqiang Sun +Acked-by: Rodrigo Siqueira +Signed-off-by: Victor Lu +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/amd/display/dc/dml/dcn21/display_mode_vba_21.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/gpu/drm/amd/display/dc/dml/dcn21/display_mode_vba_21.c b/drivers/gpu/drm/amd/display/dc/dml/dcn21/display_mode_vba_21.c +index 367c82b5ab4c..c09bca335068 100644 +--- a/drivers/gpu/drm/amd/display/dc/dml/dcn21/display_mode_vba_21.c ++++ b/drivers/gpu/drm/amd/display/dc/dml/dcn21/display_mode_vba_21.c +@@ -4888,7 +4888,7 @@ void dml21_ModeSupportAndSystemConfigurationFull(struct display_mode_lib *mode_l + } + } while ((locals->PrefetchSupported[i][j] != true || locals->VRatioInPrefetchSupported[i][j] != true) + && (mode_lib->vba.NextMaxVStartup != mode_lib->vba.MaxMaxVStartup[0][0] +- || mode_lib->vba.NextPrefetchMode < mode_lib->vba.MaxPrefetchMode)); ++ || mode_lib->vba.NextPrefetchMode <= mode_lib->vba.MaxPrefetchMode)); + + if (locals->PrefetchSupported[i][j] == true && locals->VRatioInPrefetchSupported[i][j] == true) { + mode_lib->vba.BandwidthAvailableForImmediateFlip = locals->ReturnBWPerState[i][0]; +-- +2.30.2 + diff --git a/queue-5.10/drm-amd-display-fix-max-vstartup-calculation-for-mod.patch b/queue-5.10/drm-amd-display-fix-max-vstartup-calculation-for-mod.patch new file mode 100644 index 00000000000..50e17846d20 --- /dev/null +++ b/queue-5.10/drm-amd-display-fix-max-vstartup-calculation-for-mod.patch @@ -0,0 +1,70 @@ +From f25e76f02a3b94c9b80506c6345fd1d9f78ade3a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 7 Jul 2021 13:19:14 -0400 +Subject: drm/amd/display: Fix max vstartup calculation for modes with borders + +From: Nicholas Kazlauskas + +[ Upstream commit d7940911fc0754d99b208f0e3098762d39f403a0 ] + +[Why] +Vertical and horizontal borders in timings are treated as increasing the +active area - vblank and hblank actually shrink. + +Our input into DML does not include these borders so it incorrectly +assumes it has more time than available for vstartup and tmdl +calculations for some modes with borders. + +An example of such a timing would be 640x480@72Hz: + +h_total: 832 +h_border_left: 8 +h_addressable: 640 +h_border_right: 8 +h_front_porch: 16 +h_sync_width: 40 +v_total: 520 +v_border_top: 8 +v_addressable: 480 +v_border_bottom: 8 +v_front_porch: 1 +v_sync_width: 3 +pix_clk_100hz: 315000 + +[How] +Include borders as part of destination vactive/hactive. + +This change DCN20+ so it has wide impact, but the destination vactive +and hactive are only really used for vstartup calculation anyway. + +Most modes do not have vertical or horizontal borders. + +Reviewed-by: Dmytro Laktyushkin +Acked-by: Rodrigo Siqueira +Signed-off-by: Nicholas Kazlauskas +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/amd/display/dc/dcn20/dcn20_resource.c | 6 ++++-- + 1 file changed, 4 insertions(+), 2 deletions(-) + +diff --git a/drivers/gpu/drm/amd/display/dc/dcn20/dcn20_resource.c b/drivers/gpu/drm/amd/display/dc/dcn20/dcn20_resource.c +index 1812ec7ee11b..cfe85ba1018e 100644 +--- a/drivers/gpu/drm/amd/display/dc/dcn20/dcn20_resource.c ++++ b/drivers/gpu/drm/amd/display/dc/dcn20/dcn20_resource.c +@@ -2077,8 +2077,10 @@ int dcn20_populate_dml_pipes_from_context( + - timing->v_border_bottom; + pipes[pipe_cnt].pipe.dest.htotal = timing->h_total; + pipes[pipe_cnt].pipe.dest.vtotal = v_total; +- pipes[pipe_cnt].pipe.dest.hactive = timing->h_addressable; +- pipes[pipe_cnt].pipe.dest.vactive = timing->v_addressable; ++ pipes[pipe_cnt].pipe.dest.hactive = ++ timing->h_addressable + timing->h_border_left + timing->h_border_right; ++ pipes[pipe_cnt].pipe.dest.vactive = ++ timing->v_addressable + timing->v_border_top + timing->v_border_bottom; + pipes[pipe_cnt].pipe.dest.interlaced = timing->flags.INTERLACE; + pipes[pipe_cnt].pipe.dest.pixel_rate_mhz = timing->pix_clk_100hz/10000.0; + if (timing->timing_3d_format == TIMING_3D_FORMAT_HW_FRAME_PACKING) +-- +2.30.2 + diff --git a/queue-5.10/efi-mokvar-reserve-the-table-only-if-it-is-in-boot-s.patch b/queue-5.10/efi-mokvar-reserve-the-table-only-if-it-is-in-boot-s.patch new file mode 100644 index 00000000000..f19797270b9 --- /dev/null +++ b/queue-5.10/efi-mokvar-reserve-the-table-only-if-it-is-in-boot-s.patch @@ -0,0 +1,65 @@ +From a2066f4470f1ddeada4dae972698498be2ce85ba Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 20 Jul 2021 09:28:09 +0200 +Subject: efi/mokvar: Reserve the table only if it is in boot services data + +From: Borislav Petkov + +[ Upstream commit 47e1e233e9d822dfda068383fb9a616451bda703 ] + +One of the SUSE QA tests triggered: + + localhost kernel: efi: Failed to lookup EFI memory descriptor for 0x000000003dcf8000 + +which comes from x86's version of efi_arch_mem_reserve() trying to +reserve a memory region. Usually, that function expects +EFI_BOOT_SERVICES_DATA memory descriptors but the above case is for the +MOKvar table which is allocated in the EFI shim as runtime services. + +That lead to a fix changing the allocation of that table to boot services. + +However, that fix broke booting SEV guests with that shim leading to +this kernel fix + + 8d651ee9c71b ("x86/ioremap: Map EFI-reserved memory as encrypted for SEV") + +which extended the ioremap hint to map reserved EFI boot services as +decrypted too. + +However, all that wasn't needed, IMO, because that error message in +efi_arch_mem_reserve() was innocuous in this case - if the MOKvar table +is not in boot services, then it doesn't need to be reserved in the +first place because it is, well, in runtime services which *should* be +reserved anyway. + +So do that reservation for the MOKvar table only if it is allocated +in boot services data. I couldn't find any requirement about where +that table should be allocated in, unlike the ESRT which allocation is +mandated to be done in boot services data by the UEFI spec. + +Signed-off-by: Borislav Petkov +Signed-off-by: Ard Biesheuvel +Signed-off-by: Sasha Levin +--- + drivers/firmware/efi/mokvar-table.c | 5 ++++- + 1 file changed, 4 insertions(+), 1 deletion(-) + +diff --git a/drivers/firmware/efi/mokvar-table.c b/drivers/firmware/efi/mokvar-table.c +index d8bc01340686..38722d2009e2 100644 +--- a/drivers/firmware/efi/mokvar-table.c ++++ b/drivers/firmware/efi/mokvar-table.c +@@ -180,7 +180,10 @@ void __init efi_mokvar_table_init(void) + pr_err("EFI MOKvar config table is not valid\n"); + return; + } +- efi_mem_reserve(efi.mokvar_table, map_size_needed); ++ ++ if (md.type == EFI_BOOT_SERVICES_DATA) ++ efi_mem_reserve(efi.mokvar_table, map_size_needed); ++ + efi_mokvar_table_size = map_size_needed; + } + +-- +2.30.2 + diff --git a/queue-5.10/net-fix-zero-copy-head-len-calculation.patch b/queue-5.10/net-fix-zero-copy-head-len-calculation.patch new file mode 100644 index 00000000000..66d9a29ca69 --- /dev/null +++ b/queue-5.10/net-fix-zero-copy-head-len-calculation.patch @@ -0,0 +1,79 @@ +From a4f5f0d71b6ab07f534a257d10cb919bd4cf3717 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 15 Jul 2021 16:59:00 -0700 +Subject: net: Fix zero-copy head len calculation. + +From: Pravin B Shelar + +[ Upstream commit a17ad0961706244dce48ec941f7e476a38c0e727 ] + +In some cases skb head could be locked and entire header +data is pulled from skb. When skb_zerocopy() called in such cases, +following BUG is triggered. This patch fixes it by copying entire +skb in such cases. +This could be optimized incase this is performance bottleneck. + +---8<--- +kernel BUG at net/core/skbuff.c:2961! +invalid opcode: 0000 [#1] SMP PTI +CPU: 2 PID: 0 Comm: swapper/2 Tainted: G OE 5.4.0-77-generic #86-Ubuntu +Hardware name: OpenStack Foundation OpenStack Nova, BIOS 1.13.0-1ubuntu1.1 04/01/2014 +RIP: 0010:skb_zerocopy+0x37a/0x3a0 +RSP: 0018:ffffbcc70013ca38 EFLAGS: 00010246 +Call Trace: + + queue_userspace_packet+0x2af/0x5e0 [openvswitch] + ovs_dp_upcall+0x3d/0x60 [openvswitch] + ovs_dp_process_packet+0x125/0x150 [openvswitch] + ovs_vport_receive+0x77/0xd0 [openvswitch] + netdev_port_receive+0x87/0x130 [openvswitch] + netdev_frame_hook+0x4b/0x60 [openvswitch] + __netif_receive_skb_core+0x2b4/0xc90 + __netif_receive_skb_one_core+0x3f/0xa0 + __netif_receive_skb+0x18/0x60 + process_backlog+0xa9/0x160 + net_rx_action+0x142/0x390 + __do_softirq+0xe1/0x2d6 + irq_exit+0xae/0xb0 + do_IRQ+0x5a/0xf0 + common_interrupt+0xf/0xf + +Code that triggered BUG: +int +skb_zerocopy(struct sk_buff *to, struct sk_buff *from, int len, int hlen) +{ + int i, j = 0; + int plen = 0; /* length of skb->head fragment */ + int ret; + struct page *page; + unsigned int offset; + + BUG_ON(!from->head_frag && !hlen); + +Signed-off-by: Pravin B Shelar +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + net/core/skbuff.c | 5 ++++- + 1 file changed, 4 insertions(+), 1 deletion(-) + +diff --git a/net/core/skbuff.c b/net/core/skbuff.c +index 2d27aae6d36f..825e6b988003 100644 +--- a/net/core/skbuff.c ++++ b/net/core/skbuff.c +@@ -2922,8 +2922,11 @@ skb_zerocopy_headlen(const struct sk_buff *from) + + if (!from->head_frag || + skb_headlen(from) < L1_CACHE_BYTES || +- skb_shinfo(from)->nr_frags >= MAX_SKB_FRAGS) ++ skb_shinfo(from)->nr_frags >= MAX_SKB_FRAGS) { + hlen = skb_headlen(from); ++ if (!hlen) ++ hlen = from->len; ++ } + + if (skb_has_frag_list(from)) + hlen = from->len; +-- +2.30.2 + diff --git a/queue-5.10/nvme-fix-nvme_setup_command-metadata-trace-event.patch b/queue-5.10/nvme-fix-nvme_setup_command-metadata-trace-event.patch new file mode 100644 index 00000000000..1c03de8a736 --- /dev/null +++ b/queue-5.10/nvme-fix-nvme_setup_command-metadata-trace-event.patch @@ -0,0 +1,53 @@ +From 2bde672ec2b7035a9f6bb353199c78612b9ab47f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 19 Jul 2021 09:44:39 -0700 +Subject: nvme: fix nvme_setup_command metadata trace event + +From: Keith Busch + +[ Upstream commit 234211b8dd161fa25f192c78d5a8d2dd6bf920a0 ] + +The metadata address is set after the trace event, so the trace is not +capturing anything useful. Rather than logging the memory address, it's +useful to know if the command carries a metadata payload, so change the +trace event to log that true/false state instead. + +Signed-off-by: Keith Busch +Signed-off-by: Christoph Hellwig +Signed-off-by: Sasha Levin +--- + drivers/nvme/host/trace.h | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +diff --git a/drivers/nvme/host/trace.h b/drivers/nvme/host/trace.h +index daaf700eae79..35bac7a25422 100644 +--- a/drivers/nvme/host/trace.h ++++ b/drivers/nvme/host/trace.h +@@ -56,7 +56,7 @@ TRACE_EVENT(nvme_setup_cmd, + __field(u8, fctype) + __field(u16, cid) + __field(u32, nsid) +- __field(u64, metadata) ++ __field(bool, metadata) + __array(u8, cdw10, 24) + ), + TP_fast_assign( +@@ -66,13 +66,13 @@ TRACE_EVENT(nvme_setup_cmd, + __entry->flags = cmd->common.flags; + __entry->cid = cmd->common.command_id; + __entry->nsid = le32_to_cpu(cmd->common.nsid); +- __entry->metadata = le64_to_cpu(cmd->common.metadata); ++ __entry->metadata = !!blk_integrity_rq(req); + __entry->fctype = cmd->fabrics.fctype; + __assign_disk_name(__entry->disk, req->rq_disk); + memcpy(__entry->cdw10, &cmd->common.cdw10, + sizeof(__entry->cdw10)); + ), +- TP_printk("nvme%d: %sqid=%d, cmdid=%u, nsid=%u, flags=0x%x, meta=0x%llx, cmd=(%s %s)", ++ TP_printk("nvme%d: %sqid=%d, cmdid=%u, nsid=%u, flags=0x%x, meta=0x%x, cmd=(%s %s)", + __entry->ctrl_id, __print_disk_name(__entry->disk), + __entry->qid, __entry->cid, __entry->nsid, + __entry->flags, __entry->metadata, +-- +2.30.2 + diff --git a/queue-5.10/qed-fix-possible-unpaired-spin_-un-lock_bh-in-_qed_m.patch b/queue-5.10/qed-fix-possible-unpaired-spin_-un-lock_bh-in-_qed_m.patch new file mode 100644 index 00000000000..58bb51c7863 --- /dev/null +++ b/queue-5.10/qed-fix-possible-unpaired-spin_-un-lock_bh-in-_qed_m.patch @@ -0,0 +1,114 @@ +From d1e94ae1e46b2277c20e590efe578cca0e01a3cc Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 15 Jul 2021 16:08:21 +0800 +Subject: qed: fix possible unpaired spin_{un}lock_bh in + _qed_mcp_cmd_and_union() + +From: Jia He + +[ Upstream commit 6206b7981a36476f4695d661ae139f7db36a802d ] + +Liajian reported a bug_on hit on a ThunderX2 arm64 server with FastLinQ +QL41000 ethernet controller: + BUG: scheduling while atomic: kworker/0:4/531/0x00000200 + [qed_probe:488()]hw prepare failed + kernel BUG at mm/vmalloc.c:2355! + Internal error: Oops - BUG: 0 [#1] SMP + CPU: 0 PID: 531 Comm: kworker/0:4 Tainted: G W 5.4.0-77-generic #86-Ubuntu + pstate: 00400009 (nzcv daif +PAN -UAO) + Call trace: + vunmap+0x4c/0x50 + iounmap+0x48/0x58 + qed_free_pci+0x60/0x80 [qed] + qed_probe+0x35c/0x688 [qed] + __qede_probe+0x88/0x5c8 [qede] + qede_probe+0x60/0xe0 [qede] + local_pci_probe+0x48/0xa0 + work_for_cpu_fn+0x24/0x38 + process_one_work+0x1d0/0x468 + worker_thread+0x238/0x4e0 + kthread+0xf0/0x118 + ret_from_fork+0x10/0x18 + +In this case, qed_hw_prepare() returns error due to hw/fw error, but in +theory work queue should be in process context instead of interrupt. + +The root cause might be the unpaired spin_{un}lock_bh() in +_qed_mcp_cmd_and_union(), which causes botton half is disabled incorrectly. + +Reported-by: Lijian Zhang +Signed-off-by: Jia He +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/qlogic/qed/qed_mcp.c | 23 +++++++++++++++++------ + 1 file changed, 17 insertions(+), 6 deletions(-) + +diff --git a/drivers/net/ethernet/qlogic/qed/qed_mcp.c b/drivers/net/ethernet/qlogic/qed/qed_mcp.c +index cd882c453394..caeef25c89bb 100644 +--- a/drivers/net/ethernet/qlogic/qed/qed_mcp.c ++++ b/drivers/net/ethernet/qlogic/qed/qed_mcp.c +@@ -474,14 +474,18 @@ _qed_mcp_cmd_and_union(struct qed_hwfn *p_hwfn, + + spin_lock_bh(&p_hwfn->mcp_info->cmd_lock); + +- if (!qed_mcp_has_pending_cmd(p_hwfn)) ++ if (!qed_mcp_has_pending_cmd(p_hwfn)) { ++ spin_unlock_bh(&p_hwfn->mcp_info->cmd_lock); + break; ++ } + + rc = qed_mcp_update_pending_cmd(p_hwfn, p_ptt); +- if (!rc) ++ if (!rc) { ++ spin_unlock_bh(&p_hwfn->mcp_info->cmd_lock); + break; +- else if (rc != -EAGAIN) ++ } else if (rc != -EAGAIN) { + goto err; ++ } + + spin_unlock_bh(&p_hwfn->mcp_info->cmd_lock); + +@@ -498,6 +502,8 @@ _qed_mcp_cmd_and_union(struct qed_hwfn *p_hwfn, + return -EAGAIN; + } + ++ spin_lock_bh(&p_hwfn->mcp_info->cmd_lock); ++ + /* Send the mailbox command */ + qed_mcp_reread_offsets(p_hwfn, p_ptt); + seq_num = ++p_hwfn->mcp_info->drv_mb_seq; +@@ -524,14 +530,18 @@ _qed_mcp_cmd_and_union(struct qed_hwfn *p_hwfn, + + spin_lock_bh(&p_hwfn->mcp_info->cmd_lock); + +- if (p_cmd_elem->b_is_completed) ++ if (p_cmd_elem->b_is_completed) { ++ spin_unlock_bh(&p_hwfn->mcp_info->cmd_lock); + break; ++ } + + rc = qed_mcp_update_pending_cmd(p_hwfn, p_ptt); +- if (!rc) ++ if (!rc) { ++ spin_unlock_bh(&p_hwfn->mcp_info->cmd_lock); + break; +- else if (rc != -EAGAIN) ++ } else if (rc != -EAGAIN) { + goto err; ++ } + + spin_unlock_bh(&p_hwfn->mcp_info->cmd_lock); + } while (++cnt < max_retries); +@@ -554,6 +564,7 @@ _qed_mcp_cmd_and_union(struct qed_hwfn *p_hwfn, + return -EAGAIN; + } + ++ spin_lock_bh(&p_hwfn->mcp_info->cmd_lock); + qed_mcp_cmd_del_elem(p_hwfn, p_cmd_elem); + spin_unlock_bh(&p_hwfn->mcp_info->cmd_lock); + +-- +2.30.2 + diff --git a/queue-5.10/r8152-fix-potential-pm-refcount-imbalance.patch b/queue-5.10/r8152-fix-potential-pm-refcount-imbalance.patch new file mode 100644 index 00000000000..56d68c93ce3 --- /dev/null +++ b/queue-5.10/r8152-fix-potential-pm-refcount-imbalance.patch @@ -0,0 +1,40 @@ +From bcff8b242e3bed165f599d5e31009f7a22c9563a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 14 Jul 2021 19:00:21 +0200 +Subject: r8152: Fix potential PM refcount imbalance + +From: Takashi Iwai + +[ Upstream commit 9c23aa51477a37f8b56c3c40192248db0663c196 ] + +rtl8152_close() takes the refcount via usb_autopm_get_interface() but +it doesn't release when RTL8152_UNPLUG test hits. This may lead to +the imbalance of PM refcount. This patch addresses it. + +Link: https://bugzilla.suse.com/show_bug.cgi?id=1186194 +Signed-off-by: Takashi Iwai +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/usb/r8152.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/drivers/net/usb/r8152.c b/drivers/net/usb/r8152.c +index 95e27fb7d2c1..105622e1defa 100644 +--- a/drivers/net/usb/r8152.c ++++ b/drivers/net/usb/r8152.c +@@ -5282,9 +5282,10 @@ static int rtl8152_close(struct net_device *netdev) + tp->rtl_ops.down(tp); + + mutex_unlock(&tp->control); ++ } + ++ if (!res) + usb_autopm_put_interface(tp->intf); +- } + + free_all_mem(tp); + +-- +2.30.2 + diff --git a/queue-5.10/regulator-rt5033-fix-n_voltages-settings-for-buck-an.patch b/queue-5.10/regulator-rt5033-fix-n_voltages-settings-for-buck-an.patch new file mode 100644 index 00000000000..5a89971d115 --- /dev/null +++ b/queue-5.10/regulator-rt5033-fix-n_voltages-settings-for-buck-an.patch @@ -0,0 +1,48 @@ +From 37cd88cfb0c37046fc4772f0bdd3ebb11b7942c8 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 27 Jun 2021 16:04:18 +0800 +Subject: regulator: rt5033: Fix n_voltages settings for BUCK and LDO + +From: Axel Lin + +[ Upstream commit 6549c46af8551b346bcc0b9043f93848319acd5c ] + +For linear regulators, the n_voltages should be (max - min) / step + 1. + +Buck voltage from 1v to 3V, per step 100mV, and vout mask is 0x1f. +If value is from 20 to 31, the voltage will all be fixed to 3V. +And LDO also, just vout range is different from 1.2v to 3v, step is the +same. If value is from 18 to 31, the voltage will also be fixed to 3v. + +Signed-off-by: Axel Lin +Reviewed-by: ChiYuan Huang +Link: https://lore.kernel.org/r/20210627080418.1718127-1-axel.lin@ingics.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + include/linux/mfd/rt5033-private.h | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/include/linux/mfd/rt5033-private.h b/include/linux/mfd/rt5033-private.h +index f812105c538c..f2271bfb3273 100644 +--- a/include/linux/mfd/rt5033-private.h ++++ b/include/linux/mfd/rt5033-private.h +@@ -200,13 +200,13 @@ enum rt5033_reg { + #define RT5033_REGULATOR_BUCK_VOLTAGE_MIN 1000000U + #define RT5033_REGULATOR_BUCK_VOLTAGE_MAX 3000000U + #define RT5033_REGULATOR_BUCK_VOLTAGE_STEP 100000U +-#define RT5033_REGULATOR_BUCK_VOLTAGE_STEP_NUM 32 ++#define RT5033_REGULATOR_BUCK_VOLTAGE_STEP_NUM 21 + + /* RT5033 regulator LDO output voltage uV */ + #define RT5033_REGULATOR_LDO_VOLTAGE_MIN 1200000U + #define RT5033_REGULATOR_LDO_VOLTAGE_MAX 3000000U + #define RT5033_REGULATOR_LDO_VOLTAGE_STEP 100000U +-#define RT5033_REGULATOR_LDO_VOLTAGE_STEP_NUM 32 ++#define RT5033_REGULATOR_LDO_VOLTAGE_STEP_NUM 19 + + /* RT5033 regulator SAFE LDO output voltage uV */ + #define RT5033_REGULATOR_SAFE_LDO_VOLTAGE 4900000U +-- +2.30.2 + diff --git a/queue-5.10/regulator-rtmv20-fix-wrong-mask-for-strobe-polarity-.patch b/queue-5.10/regulator-rtmv20-fix-wrong-mask-for-strobe-polarity-.patch new file mode 100644 index 00000000000..0103cb6f457 --- /dev/null +++ b/queue-5.10/regulator-rtmv20-fix-wrong-mask-for-strobe-polarity-.patch @@ -0,0 +1,37 @@ +From a6edd98184bda9d2751b1587e8af387c53ccabee Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 26 Jun 2021 23:58:32 +0800 +Subject: regulator: rtmv20: Fix wrong mask for strobe-polarity-high + +From: ChiYuan Huang + +[ Upstream commit 2b6a761be079f9fa8abf3157b5679a6f38885db4 ] + +Fix wrong mask for strobe-polarity-high. + +Signed-off-by: ChiYuan Huang +In-reply-to: +Reviewed-by: Axel Lin +Link: https://lore.kernel.org/r/1624723112-26653-1-git-send-email-u0084500@gmail.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + drivers/regulator/rtmv20-regulator.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/regulator/rtmv20-regulator.c b/drivers/regulator/rtmv20-regulator.c +index 4bca64de0f67..2ee334174e2b 100644 +--- a/drivers/regulator/rtmv20-regulator.c ++++ b/drivers/regulator/rtmv20-regulator.c +@@ -37,7 +37,7 @@ + #define RTMV20_WIDTH2_MASK GENMASK(7, 0) + #define RTMV20_LBPLVL_MASK GENMASK(3, 0) + #define RTMV20_LBPEN_MASK BIT(7) +-#define RTMV20_STROBEPOL_MASK BIT(1) ++#define RTMV20_STROBEPOL_MASK BIT(0) + #define RTMV20_VSYNPOL_MASK BIT(1) + #define RTMV20_FSINEN_MASK BIT(7) + #define RTMV20_ESEN_MASK BIT(6) +-- +2.30.2 + diff --git a/queue-5.10/series b/queue-5.10/series index 18be39cedd7..296f56e1807 100644 --- a/queue-5.10/series +++ b/queue-5.10/series @@ -2,3 +2,18 @@ drm-i915-revert-drm-i915-gem-asynchronous-cmdparser.patch revert-drm-i915-propagate-errors-on-awaiting-already.patch btrfs-fix-race-causing-unnecessary-inode-logging-dur.patch btrfs-fix-lost-inode-on-log-replay-after-mix-of-fsyn.patch +regulator-rtmv20-fix-wrong-mask-for-strobe-polarity-.patch +regulator-rt5033-fix-n_voltages-settings-for-buck-an.patch +spi-stm32h7-fix-full-duplex-irq-handler-handling.patch +asoc-tlv320aic31xx-fix-reversed-bclk-wclk-master-bit.patch +r8152-fix-potential-pm-refcount-imbalance.patch +qed-fix-possible-unpaired-spin_-un-lock_bh-in-_qed_m.patch +asoc-rt5682-fix-the-issue-of-garbled-recording-after.patch +net-fix-zero-copy-head-len-calculation.patch +asoc-ti-j721e-evm-fix-unbalanced-domain-activity-tra.patch +asoc-ti-j721e-evm-check-for-not-initialized-parent_c.patch +efi-mokvar-reserve-the-table-only-if-it-is-in-boot-s.patch +nvme-fix-nvme_setup_command-metadata-trace-event.patch +drm-amd-display-fix-comparison-error-in-dcn21-dml.patch +drm-amd-display-fix-max-vstartup-calculation-for-mod.patch +acpi-fix-null-pointer-dereference.patch diff --git a/queue-5.10/spi-stm32h7-fix-full-duplex-irq-handler-handling.patch b/queue-5.10/spi-stm32h7-fix-full-duplex-irq-handler-handling.patch new file mode 100644 index 00000000000..8ae0025e96a --- /dev/null +++ b/queue-5.10/spi-stm32h7-fix-full-duplex-irq-handler-handling.patch @@ -0,0 +1,58 @@ +From ad6645f7244d7fe05f05dc1c468462ecc56796ed Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 30 Jun 2021 10:45:19 +0200 +Subject: spi: stm32h7: fix full duplex irq handler handling + +From: Alain Volmat + +[ Upstream commit e4a5c19888a5f8a9390860ca493e643be58c8791 ] + +In case of Full-Duplex mode, DXP flag is set when RXP and TXP flags are +set. But to avoid 2 different handlings, just add TXP and RXP flag in +the mask instead of DXP, and then keep the initial handling of TXP and +RXP events. +Also rephrase comment about EOTIE which is one of the interrupt enable +bits. It is not triggered by any event. + +Signed-off-by: Amelie Delaunay +Signed-off-by: Alain Volmat +Reviewed-by: Amelie Delaunay +Link: https://lore.kernel.org/r/1625042723-661-3-git-send-email-alain.volmat@foss.st.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + drivers/spi/spi-stm32.c | 15 +++++++++------ + 1 file changed, 9 insertions(+), 6 deletions(-) + +diff --git a/drivers/spi/spi-stm32.c b/drivers/spi/spi-stm32.c +index 8f91f8705eee..a6dfc8fef20c 100644 +--- a/drivers/spi/spi-stm32.c ++++ b/drivers/spi/spi-stm32.c +@@ -917,15 +917,18 @@ static irqreturn_t stm32h7_spi_irq_thread(int irq, void *dev_id) + ier = readl_relaxed(spi->base + STM32H7_SPI_IER); + + mask = ier; +- /* EOTIE is triggered on EOT, SUSP and TXC events. */ ++ /* ++ * EOTIE enables irq from EOT, SUSP and TXC events. We need to set ++ * SUSP to acknowledge it later. TXC is automatically cleared ++ */ ++ + mask |= STM32H7_SPI_SR_SUSP; + /* +- * When TXTF is set, DXPIE and TXPIE are cleared. So in case of +- * Full-Duplex, need to poll RXP event to know if there are remaining +- * data, before disabling SPI. ++ * DXPIE is set in Full-Duplex, one IT will be raised if TXP and RXP ++ * are set. So in case of Full-Duplex, need to poll TXP and RXP event. + */ +- if (spi->rx_buf && !spi->cur_usedma) +- mask |= STM32H7_SPI_SR_RXP; ++ if ((spi->cur_comm == SPI_FULL_DUPLEX) && !spi->cur_usedma) ++ mask |= STM32H7_SPI_SR_TXP | STM32H7_SPI_SR_RXP; + + if (!(sr & mask)) { + dev_warn(spi->dev, "spurious IT (sr=0x%08x, ier=0x%08x)\n", +-- +2.30.2 +