From: Sasha Levin Date: Thu, 5 Aug 2021 01:38:16 +0000 (-0400) Subject: Fixes for 5.4 X-Git-Tag: v4.4.279~30 X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=f9816c05ba9561487c24340be2e640ef65ec4eab;p=thirdparty%2Fkernel%2Fstable-queue.git Fixes for 5.4 Signed-off-by: Sasha Levin --- diff --git a/queue-5.4/acpi-fix-null-pointer-dereference.patch b/queue-5.4/acpi-fix-null-pointer-dereference.patch new file mode 100644 index 00000000000..f2bd3ade316 --- /dev/null +++ b/queue-5.4/acpi-fix-null-pointer-dereference.patch @@ -0,0 +1,45 @@ +From 1b88184f8ed22c6af2d7d0140a45a3ee1d4726f8 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 24 Jul 2021 15:25:54 -0700 +Subject: ACPI: fix NULL pointer dereference + +From: Linus Torvalds + +[ Upstream commit fc68f42aa737dc15e7665a4101d4168aadb8e4c4 ] + +Commit 71f642833284 ("ACPI: utils: Fix reference counting in +for_each_acpi_dev_match()") started doing "acpi_dev_put()" on a pointer +that was possibly NULL. That fails miserably, because that helper +inline function is not set up to handle that case. + +Just make acpi_dev_put() silently accept a NULL pointer, rather than +calling down to put_device() with an invalid offset off that NULL +pointer. + +Link: https://lore.kernel.org/lkml/a607c149-6bf6-0fd0-0e31-100378504da2@kernel.dk/ +Reported-and-tested-by: Jens Axboe +Tested-by: Daniel Scally +Cc: Andy Shevchenko +Signed-off-by: Linus Torvalds +Signed-off-by: Sasha Levin +--- + include/acpi/acpi_bus.h | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/include/acpi/acpi_bus.h b/include/acpi/acpi_bus.h +index 4d67a67964fa..1e5ae3b01eb2 100644 +--- a/include/acpi/acpi_bus.h ++++ b/include/acpi/acpi_bus.h +@@ -681,7 +681,8 @@ acpi_dev_get_first_match_dev(const char *hid, const char *uid, s64 hrv); + + static inline void acpi_dev_put(struct acpi_device *adev) + { +- put_device(&adev->dev); ++ if (adev) ++ put_device(&adev->dev); + } + #else /* CONFIG_ACPI */ + +-- +2.30.2 + diff --git a/queue-5.4/asoc-tlv320aic31xx-fix-reversed-bclk-wclk-master-bit.patch b/queue-5.4/asoc-tlv320aic31xx-fix-reversed-bclk-wclk-master-bit.patch new file mode 100644 index 00000000000..65145cc68fd --- /dev/null +++ b/queue-5.4/asoc-tlv320aic31xx-fix-reversed-bclk-wclk-master-bit.patch @@ -0,0 +1,49 @@ +From cbd20cab1f9f73f9fcf32c0cfbd9513cddccba91 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 21 Jun 2021 21:09:41 -0400 +Subject: ASoC: tlv320aic31xx: fix reversed bclk/wclk master bits + +From: Kyle Russell + +[ Upstream commit 9cf76a72af6ab81030dea6481b1d7bdd814fbdaf ] + +These are backwards from Table 7-71 of the TLV320AIC3100 spec [1]. + +This was broken in 12eb4d66ba2e when BCLK_MASTER and WCLK_MASTER +were converted from 0x08 and 0x04 to BIT(2) and BIT(3), respectively. + +-#define AIC31XX_BCLK_MASTER 0x08 +-#define AIC31XX_WCLK_MASTER 0x04 ++#define AIC31XX_BCLK_MASTER BIT(2) ++#define AIC31XX_WCLK_MASTER BIT(3) + +Probably just a typo since the defines were not listed in bit order. + +[1] https://www.ti.com/lit/gpn/tlv320aic3100 + +Signed-off-by: Kyle Russell +Link: https://lore.kernel.org/r/20210622010941.241386-1-bkylerussell@gmail.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/codecs/tlv320aic31xx.h | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/sound/soc/codecs/tlv320aic31xx.h b/sound/soc/codecs/tlv320aic31xx.h +index cb024955c978..73c5f6c8ed69 100644 +--- a/sound/soc/codecs/tlv320aic31xx.h ++++ b/sound/soc/codecs/tlv320aic31xx.h +@@ -151,8 +151,8 @@ struct aic31xx_pdata { + #define AIC31XX_WORD_LEN_24BITS 0x02 + #define AIC31XX_WORD_LEN_32BITS 0x03 + #define AIC31XX_IFACE1_MASTER_MASK GENMASK(3, 2) +-#define AIC31XX_BCLK_MASTER BIT(2) +-#define AIC31XX_WCLK_MASTER BIT(3) ++#define AIC31XX_BCLK_MASTER BIT(3) ++#define AIC31XX_WCLK_MASTER BIT(2) + + /* AIC31XX_DATA_OFFSET */ + #define AIC31XX_DATA_OFFSET_MASK GENMASK(7, 0) +-- +2.30.2 + diff --git a/queue-5.4/net-fix-zero-copy-head-len-calculation.patch b/queue-5.4/net-fix-zero-copy-head-len-calculation.patch new file mode 100644 index 00000000000..9747113b4d6 --- /dev/null +++ b/queue-5.4/net-fix-zero-copy-head-len-calculation.patch @@ -0,0 +1,79 @@ +From 9a5d401540ec7643bfb16ae8118a7dd60670e9e7 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 15 Jul 2021 16:59:00 -0700 +Subject: net: Fix zero-copy head len calculation. + +From: Pravin B Shelar + +[ Upstream commit a17ad0961706244dce48ec941f7e476a38c0e727 ] + +In some cases skb head could be locked and entire header +data is pulled from skb. When skb_zerocopy() called in such cases, +following BUG is triggered. This patch fixes it by copying entire +skb in such cases. +This could be optimized incase this is performance bottleneck. + +---8<--- +kernel BUG at net/core/skbuff.c:2961! +invalid opcode: 0000 [#1] SMP PTI +CPU: 2 PID: 0 Comm: swapper/2 Tainted: G OE 5.4.0-77-generic #86-Ubuntu +Hardware name: OpenStack Foundation OpenStack Nova, BIOS 1.13.0-1ubuntu1.1 04/01/2014 +RIP: 0010:skb_zerocopy+0x37a/0x3a0 +RSP: 0018:ffffbcc70013ca38 EFLAGS: 00010246 +Call Trace: + + queue_userspace_packet+0x2af/0x5e0 [openvswitch] + ovs_dp_upcall+0x3d/0x60 [openvswitch] + ovs_dp_process_packet+0x125/0x150 [openvswitch] + ovs_vport_receive+0x77/0xd0 [openvswitch] + netdev_port_receive+0x87/0x130 [openvswitch] + netdev_frame_hook+0x4b/0x60 [openvswitch] + __netif_receive_skb_core+0x2b4/0xc90 + __netif_receive_skb_one_core+0x3f/0xa0 + __netif_receive_skb+0x18/0x60 + process_backlog+0xa9/0x160 + net_rx_action+0x142/0x390 + __do_softirq+0xe1/0x2d6 + irq_exit+0xae/0xb0 + do_IRQ+0x5a/0xf0 + common_interrupt+0xf/0xf + +Code that triggered BUG: +int +skb_zerocopy(struct sk_buff *to, struct sk_buff *from, int len, int hlen) +{ + int i, j = 0; + int plen = 0; /* length of skb->head fragment */ + int ret; + struct page *page; + unsigned int offset; + + BUG_ON(!from->head_frag && !hlen); + +Signed-off-by: Pravin B Shelar +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + net/core/skbuff.c | 5 ++++- + 1 file changed, 4 insertions(+), 1 deletion(-) + +diff --git a/net/core/skbuff.c b/net/core/skbuff.c +index 99d6f4d1297c..7dba091bc861 100644 +--- a/net/core/skbuff.c ++++ b/net/core/skbuff.c +@@ -2921,8 +2921,11 @@ skb_zerocopy_headlen(const struct sk_buff *from) + + if (!from->head_frag || + skb_headlen(from) < L1_CACHE_BYTES || +- skb_shinfo(from)->nr_frags >= MAX_SKB_FRAGS) ++ skb_shinfo(from)->nr_frags >= MAX_SKB_FRAGS) { + hlen = skb_headlen(from); ++ if (!hlen) ++ hlen = from->len; ++ } + + if (skb_has_frag_list(from)) + hlen = from->len; +-- +2.30.2 + diff --git a/queue-5.4/nvme-fix-nvme_setup_command-metadata-trace-event.patch b/queue-5.4/nvme-fix-nvme_setup_command-metadata-trace-event.patch new file mode 100644 index 00000000000..924bd8cbe30 --- /dev/null +++ b/queue-5.4/nvme-fix-nvme_setup_command-metadata-trace-event.patch @@ -0,0 +1,53 @@ +From 3c5101cf4cf8380cd2753dc3cf7d8e7a99418cbb Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 19 Jul 2021 09:44:39 -0700 +Subject: nvme: fix nvme_setup_command metadata trace event + +From: Keith Busch + +[ Upstream commit 234211b8dd161fa25f192c78d5a8d2dd6bf920a0 ] + +The metadata address is set after the trace event, so the trace is not +capturing anything useful. Rather than logging the memory address, it's +useful to know if the command carries a metadata payload, so change the +trace event to log that true/false state instead. + +Signed-off-by: Keith Busch +Signed-off-by: Christoph Hellwig +Signed-off-by: Sasha Levin +--- + drivers/nvme/host/trace.h | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +diff --git a/drivers/nvme/host/trace.h b/drivers/nvme/host/trace.h +index daaf700eae79..35bac7a25422 100644 +--- a/drivers/nvme/host/trace.h ++++ b/drivers/nvme/host/trace.h +@@ -56,7 +56,7 @@ TRACE_EVENT(nvme_setup_cmd, + __field(u8, fctype) + __field(u16, cid) + __field(u32, nsid) +- __field(u64, metadata) ++ __field(bool, metadata) + __array(u8, cdw10, 24) + ), + TP_fast_assign( +@@ -66,13 +66,13 @@ TRACE_EVENT(nvme_setup_cmd, + __entry->flags = cmd->common.flags; + __entry->cid = cmd->common.command_id; + __entry->nsid = le32_to_cpu(cmd->common.nsid); +- __entry->metadata = le64_to_cpu(cmd->common.metadata); ++ __entry->metadata = !!blk_integrity_rq(req); + __entry->fctype = cmd->fabrics.fctype; + __assign_disk_name(__entry->disk, req->rq_disk); + memcpy(__entry->cdw10, &cmd->common.cdw10, + sizeof(__entry->cdw10)); + ), +- TP_printk("nvme%d: %sqid=%d, cmdid=%u, nsid=%u, flags=0x%x, meta=0x%llx, cmd=(%s %s)", ++ TP_printk("nvme%d: %sqid=%d, cmdid=%u, nsid=%u, flags=0x%x, meta=0x%x, cmd=(%s %s)", + __entry->ctrl_id, __print_disk_name(__entry->disk), + __entry->qid, __entry->cid, __entry->nsid, + __entry->flags, __entry->metadata, +-- +2.30.2 + diff --git a/queue-5.4/qed-fix-possible-unpaired-spin_-un-lock_bh-in-_qed_m.patch b/queue-5.4/qed-fix-possible-unpaired-spin_-un-lock_bh-in-_qed_m.patch new file mode 100644 index 00000000000..0649a85c553 --- /dev/null +++ b/queue-5.4/qed-fix-possible-unpaired-spin_-un-lock_bh-in-_qed_m.patch @@ -0,0 +1,114 @@ +From 5110d4776d2b6fdbd5bcea32205e31b2dd6f82af Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 15 Jul 2021 16:08:21 +0800 +Subject: qed: fix possible unpaired spin_{un}lock_bh in + _qed_mcp_cmd_and_union() + +From: Jia He + +[ Upstream commit 6206b7981a36476f4695d661ae139f7db36a802d ] + +Liajian reported a bug_on hit on a ThunderX2 arm64 server with FastLinQ +QL41000 ethernet controller: + BUG: scheduling while atomic: kworker/0:4/531/0x00000200 + [qed_probe:488()]hw prepare failed + kernel BUG at mm/vmalloc.c:2355! + Internal error: Oops - BUG: 0 [#1] SMP + CPU: 0 PID: 531 Comm: kworker/0:4 Tainted: G W 5.4.0-77-generic #86-Ubuntu + pstate: 00400009 (nzcv daif +PAN -UAO) + Call trace: + vunmap+0x4c/0x50 + iounmap+0x48/0x58 + qed_free_pci+0x60/0x80 [qed] + qed_probe+0x35c/0x688 [qed] + __qede_probe+0x88/0x5c8 [qede] + qede_probe+0x60/0xe0 [qede] + local_pci_probe+0x48/0xa0 + work_for_cpu_fn+0x24/0x38 + process_one_work+0x1d0/0x468 + worker_thread+0x238/0x4e0 + kthread+0xf0/0x118 + ret_from_fork+0x10/0x18 + +In this case, qed_hw_prepare() returns error due to hw/fw error, but in +theory work queue should be in process context instead of interrupt. + +The root cause might be the unpaired spin_{un}lock_bh() in +_qed_mcp_cmd_and_union(), which causes botton half is disabled incorrectly. + +Reported-by: Lijian Zhang +Signed-off-by: Jia He +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/qlogic/qed/qed_mcp.c | 23 +++++++++++++++++------ + 1 file changed, 17 insertions(+), 6 deletions(-) + +diff --git a/drivers/net/ethernet/qlogic/qed/qed_mcp.c b/drivers/net/ethernet/qlogic/qed/qed_mcp.c +index 9401b49275f0..5d85ae59bc51 100644 +--- a/drivers/net/ethernet/qlogic/qed/qed_mcp.c ++++ b/drivers/net/ethernet/qlogic/qed/qed_mcp.c +@@ -498,14 +498,18 @@ _qed_mcp_cmd_and_union(struct qed_hwfn *p_hwfn, + + spin_lock_bh(&p_hwfn->mcp_info->cmd_lock); + +- if (!qed_mcp_has_pending_cmd(p_hwfn)) ++ if (!qed_mcp_has_pending_cmd(p_hwfn)) { ++ spin_unlock_bh(&p_hwfn->mcp_info->cmd_lock); + break; ++ } + + rc = qed_mcp_update_pending_cmd(p_hwfn, p_ptt); +- if (!rc) ++ if (!rc) { ++ spin_unlock_bh(&p_hwfn->mcp_info->cmd_lock); + break; +- else if (rc != -EAGAIN) ++ } else if (rc != -EAGAIN) { + goto err; ++ } + + spin_unlock_bh(&p_hwfn->mcp_info->cmd_lock); + +@@ -522,6 +526,8 @@ _qed_mcp_cmd_and_union(struct qed_hwfn *p_hwfn, + return -EAGAIN; + } + ++ spin_lock_bh(&p_hwfn->mcp_info->cmd_lock); ++ + /* Send the mailbox command */ + qed_mcp_reread_offsets(p_hwfn, p_ptt); + seq_num = ++p_hwfn->mcp_info->drv_mb_seq; +@@ -548,14 +554,18 @@ _qed_mcp_cmd_and_union(struct qed_hwfn *p_hwfn, + + spin_lock_bh(&p_hwfn->mcp_info->cmd_lock); + +- if (p_cmd_elem->b_is_completed) ++ if (p_cmd_elem->b_is_completed) { ++ spin_unlock_bh(&p_hwfn->mcp_info->cmd_lock); + break; ++ } + + rc = qed_mcp_update_pending_cmd(p_hwfn, p_ptt); +- if (!rc) ++ if (!rc) { ++ spin_unlock_bh(&p_hwfn->mcp_info->cmd_lock); + break; +- else if (rc != -EAGAIN) ++ } else if (rc != -EAGAIN) { + goto err; ++ } + + spin_unlock_bh(&p_hwfn->mcp_info->cmd_lock); + } while (++cnt < max_retries); +@@ -576,6 +586,7 @@ _qed_mcp_cmd_and_union(struct qed_hwfn *p_hwfn, + return -EAGAIN; + } + ++ spin_lock_bh(&p_hwfn->mcp_info->cmd_lock); + qed_mcp_cmd_del_elem(p_hwfn, p_cmd_elem); + spin_unlock_bh(&p_hwfn->mcp_info->cmd_lock); + +-- +2.30.2 + diff --git a/queue-5.4/r8152-fix-potential-pm-refcount-imbalance.patch b/queue-5.4/r8152-fix-potential-pm-refcount-imbalance.patch new file mode 100644 index 00000000000..d070f7fbc30 --- /dev/null +++ b/queue-5.4/r8152-fix-potential-pm-refcount-imbalance.patch @@ -0,0 +1,40 @@ +From 7a7146d5a7037754d532309851854da87ab623da Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 14 Jul 2021 19:00:21 +0200 +Subject: r8152: Fix potential PM refcount imbalance + +From: Takashi Iwai + +[ Upstream commit 9c23aa51477a37f8b56c3c40192248db0663c196 ] + +rtl8152_close() takes the refcount via usb_autopm_get_interface() but +it doesn't release when RTL8152_UNPLUG test hits. This may lead to +the imbalance of PM refcount. This patch addresses it. + +Link: https://bugzilla.suse.com/show_bug.cgi?id=1186194 +Signed-off-by: Takashi Iwai +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/usb/r8152.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/drivers/net/usb/r8152.c b/drivers/net/usb/r8152.c +index 24d124633037..873f288e7cec 100644 +--- a/drivers/net/usb/r8152.c ++++ b/drivers/net/usb/r8152.c +@@ -4317,9 +4317,10 @@ static int rtl8152_close(struct net_device *netdev) + tp->rtl_ops.down(tp); + + mutex_unlock(&tp->control); ++ } + ++ if (!res) + usb_autopm_put_interface(tp->intf); +- } + + free_all_mem(tp); + +-- +2.30.2 + diff --git a/queue-5.4/regulator-rt5033-fix-n_voltages-settings-for-buck-an.patch b/queue-5.4/regulator-rt5033-fix-n_voltages-settings-for-buck-an.patch new file mode 100644 index 00000000000..3034db744da --- /dev/null +++ b/queue-5.4/regulator-rt5033-fix-n_voltages-settings-for-buck-an.patch @@ -0,0 +1,48 @@ +From 6c1617890ca7ab2106aa0a16b54fd2e2ef1720ec Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 27 Jun 2021 16:04:18 +0800 +Subject: regulator: rt5033: Fix n_voltages settings for BUCK and LDO + +From: Axel Lin + +[ Upstream commit 6549c46af8551b346bcc0b9043f93848319acd5c ] + +For linear regulators, the n_voltages should be (max - min) / step + 1. + +Buck voltage from 1v to 3V, per step 100mV, and vout mask is 0x1f. +If value is from 20 to 31, the voltage will all be fixed to 3V. +And LDO also, just vout range is different from 1.2v to 3v, step is the +same. If value is from 18 to 31, the voltage will also be fixed to 3v. + +Signed-off-by: Axel Lin +Reviewed-by: ChiYuan Huang +Link: https://lore.kernel.org/r/20210627080418.1718127-1-axel.lin@ingics.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + include/linux/mfd/rt5033-private.h | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/include/linux/mfd/rt5033-private.h b/include/linux/mfd/rt5033-private.h +index f812105c538c..f2271bfb3273 100644 +--- a/include/linux/mfd/rt5033-private.h ++++ b/include/linux/mfd/rt5033-private.h +@@ -200,13 +200,13 @@ enum rt5033_reg { + #define RT5033_REGULATOR_BUCK_VOLTAGE_MIN 1000000U + #define RT5033_REGULATOR_BUCK_VOLTAGE_MAX 3000000U + #define RT5033_REGULATOR_BUCK_VOLTAGE_STEP 100000U +-#define RT5033_REGULATOR_BUCK_VOLTAGE_STEP_NUM 32 ++#define RT5033_REGULATOR_BUCK_VOLTAGE_STEP_NUM 21 + + /* RT5033 regulator LDO output voltage uV */ + #define RT5033_REGULATOR_LDO_VOLTAGE_MIN 1200000U + #define RT5033_REGULATOR_LDO_VOLTAGE_MAX 3000000U + #define RT5033_REGULATOR_LDO_VOLTAGE_STEP 100000U +-#define RT5033_REGULATOR_LDO_VOLTAGE_STEP_NUM 32 ++#define RT5033_REGULATOR_LDO_VOLTAGE_STEP_NUM 19 + + /* RT5033 regulator SAFE LDO output voltage uV */ + #define RT5033_REGULATOR_SAFE_LDO_VOLTAGE 4900000U +-- +2.30.2 + diff --git a/queue-5.4/series b/queue-5.4/series index 853696e73e3..83fa2ad27e5 100644 --- a/queue-5.4/series +++ b/queue-5.4/series @@ -2,3 +2,11 @@ btrfs-delete-duplicated-words-other-fixes-in-comment.patch btrfs-do-not-commit-logs-and-transactions-during-lin.patch btrfs-fix-race-causing-unnecessary-inode-logging-dur.patch btrfs-fix-lost-inode-on-log-replay-after-mix-of-fsyn.patch +regulator-rt5033-fix-n_voltages-settings-for-buck-an.patch +spi-stm32h7-fix-full-duplex-irq-handler-handling.patch +asoc-tlv320aic31xx-fix-reversed-bclk-wclk-master-bit.patch +r8152-fix-potential-pm-refcount-imbalance.patch +qed-fix-possible-unpaired-spin_-un-lock_bh-in-_qed_m.patch +net-fix-zero-copy-head-len-calculation.patch +nvme-fix-nvme_setup_command-metadata-trace-event.patch +acpi-fix-null-pointer-dereference.patch diff --git a/queue-5.4/spi-stm32h7-fix-full-duplex-irq-handler-handling.patch b/queue-5.4/spi-stm32h7-fix-full-duplex-irq-handler-handling.patch new file mode 100644 index 00000000000..1dcf6803fdc --- /dev/null +++ b/queue-5.4/spi-stm32h7-fix-full-duplex-irq-handler-handling.patch @@ -0,0 +1,58 @@ +From 79a93fbccbfd87331af6313662601e3ebcd9cb31 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 30 Jun 2021 10:45:19 +0200 +Subject: spi: stm32h7: fix full duplex irq handler handling + +From: Alain Volmat + +[ Upstream commit e4a5c19888a5f8a9390860ca493e643be58c8791 ] + +In case of Full-Duplex mode, DXP flag is set when RXP and TXP flags are +set. But to avoid 2 different handlings, just add TXP and RXP flag in +the mask instead of DXP, and then keep the initial handling of TXP and +RXP events. +Also rephrase comment about EOTIE which is one of the interrupt enable +bits. It is not triggered by any event. + +Signed-off-by: Amelie Delaunay +Signed-off-by: Alain Volmat +Reviewed-by: Amelie Delaunay +Link: https://lore.kernel.org/r/1625042723-661-3-git-send-email-alain.volmat@foss.st.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + drivers/spi/spi-stm32.c | 15 +++++++++------ + 1 file changed, 9 insertions(+), 6 deletions(-) + +diff --git a/drivers/spi/spi-stm32.c b/drivers/spi/spi-stm32.c +index e9d48e94f5ed..9ae16092206d 100644 +--- a/drivers/spi/spi-stm32.c ++++ b/drivers/spi/spi-stm32.c +@@ -913,15 +913,18 @@ static irqreturn_t stm32h7_spi_irq_thread(int irq, void *dev_id) + ier = readl_relaxed(spi->base + STM32H7_SPI_IER); + + mask = ier; +- /* EOTIE is triggered on EOT, SUSP and TXC events. */ ++ /* ++ * EOTIE enables irq from EOT, SUSP and TXC events. We need to set ++ * SUSP to acknowledge it later. TXC is automatically cleared ++ */ ++ + mask |= STM32H7_SPI_SR_SUSP; + /* +- * When TXTF is set, DXPIE and TXPIE are cleared. So in case of +- * Full-Duplex, need to poll RXP event to know if there are remaining +- * data, before disabling SPI. ++ * DXPIE is set in Full-Duplex, one IT will be raised if TXP and RXP ++ * are set. So in case of Full-Duplex, need to poll TXP and RXP event. + */ +- if (spi->rx_buf && !spi->cur_usedma) +- mask |= STM32H7_SPI_SR_RXP; ++ if ((spi->cur_comm == SPI_FULL_DUPLEX) && !spi->cur_usedma) ++ mask |= STM32H7_SPI_SR_TXP | STM32H7_SPI_SR_RXP; + + if (!(sr & mask)) { + dev_warn(spi->dev, "spurious IT (sr=0x%08x, ier=0x%08x)\n", +-- +2.30.2 +