]> git.ipfire.org Git - thirdparty/kernel/stable-queue.git/commitdiff
4.14-stable patches
authorGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Wed, 15 Jan 2020 23:08:49 +0000 (00:08 +0100)
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Wed, 15 Jan 2020 23:08:49 +0000 (00:08 +0100)
added patches:
asoc-stm32-spdifrx-fix-inconsistent-lock-state.patch
asoc-stm32-spdifrx-fix-race-condition-in-irq-handler.patch
cifs-adjust-indentation-in-smb2_open_file.patch
gpio-fix-error-message-on-out-of-range-gpio-in-lookup-table.patch
gpio-zynq-fix-for-bug-in-zynq_gpio_restore_context-api.patch
hsr-reset-network-header-when-supervision-frame-is-created.patch
iommu-remove-device-link-to-group-on-failure.patch
rdma-bnxt_re-fix-send-work-entry-state-check-while-polling-completions.patch
rtc-mt6397-fix-alarm-register-overwrite.patch

queue-4.14/asoc-stm32-spdifrx-fix-inconsistent-lock-state.patch [new file with mode: 0644]
queue-4.14/asoc-stm32-spdifrx-fix-race-condition-in-irq-handler.patch [new file with mode: 0644]
queue-4.14/cifs-adjust-indentation-in-smb2_open_file.patch [new file with mode: 0644]
queue-4.14/gpio-fix-error-message-on-out-of-range-gpio-in-lookup-table.patch [new file with mode: 0644]
queue-4.14/gpio-zynq-fix-for-bug-in-zynq_gpio_restore_context-api.patch [new file with mode: 0644]
queue-4.14/hsr-reset-network-header-when-supervision-frame-is-created.patch [new file with mode: 0644]
queue-4.14/iommu-remove-device-link-to-group-on-failure.patch [new file with mode: 0644]
queue-4.14/rdma-bnxt_re-fix-send-work-entry-state-check-while-polling-completions.patch [new file with mode: 0644]
queue-4.14/rtc-mt6397-fix-alarm-register-overwrite.patch [new file with mode: 0644]
queue-4.14/series

diff --git a/queue-4.14/asoc-stm32-spdifrx-fix-inconsistent-lock-state.patch b/queue-4.14/asoc-stm32-spdifrx-fix-inconsistent-lock-state.patch
new file mode 100644 (file)
index 0000000..d6e11a9
--- /dev/null
@@ -0,0 +1,90 @@
+From 2859b1784031b5709446af8f6039c467f136e67d Mon Sep 17 00:00:00 2001
+From: Olivier Moysan <olivier.moysan@st.com>
+Date: Wed, 4 Dec 2019 16:43:31 +0100
+Subject: ASoC: stm32: spdifrx: fix inconsistent lock state
+
+From: Olivier Moysan <olivier.moysan@st.com>
+
+commit 2859b1784031b5709446af8f6039c467f136e67d upstream.
+
+In current spdifrx driver locks may be requested as follows:
+- request lock on iec capture control, when starting synchronization.
+- request lock in interrupt context, when spdifrx stop is called
+from IRQ handler.
+
+Take lock with IRQs disabled, to avoid the possible deadlock.
+
+Lockdep report:
+[   74.278059] ================================
+[   74.282306] WARNING: inconsistent lock state
+[   74.290120] --------------------------------
+...
+[   74.314373]        CPU0
+[   74.314377]        ----
+[   74.314381]   lock(&(&spdifrx->lock)->rlock);
+[   74.314396]   <Interrupt>
+[   74.314400]     lock(&(&spdifrx->lock)->rlock);
+
+Fixes: 03e4d5d56fa5 ("ASoC: stm32: Add SPDIFRX support")
+
+Signed-off-by: Olivier Moysan <olivier.moysan@st.com>
+Link: https://lore.kernel.org/r/20191204154333.7152-2-olivier.moysan@st.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ sound/soc/stm/stm32_spdifrx.c |   12 +++++++-----
+ 1 file changed, 7 insertions(+), 5 deletions(-)
+
+--- a/sound/soc/stm/stm32_spdifrx.c
++++ b/sound/soc/stm/stm32_spdifrx.c
+@@ -313,6 +313,7 @@ static void stm32_spdifrx_dma_ctrl_stop(
+ static int stm32_spdifrx_start_sync(struct stm32_spdifrx_data *spdifrx)
+ {
+       int cr, cr_mask, imr, ret;
++      unsigned long flags;
+       /* Enable IRQs */
+       imr = SPDIFRX_IMR_IFEIE | SPDIFRX_IMR_SYNCDIE | SPDIFRX_IMR_PERRIE;
+@@ -320,7 +321,7 @@ static int stm32_spdifrx_start_sync(stru
+       if (ret)
+               return ret;
+-      spin_lock(&spdifrx->lock);
++      spin_lock_irqsave(&spdifrx->lock, flags);
+       spdifrx->refcount++;
+@@ -353,7 +354,7 @@ static int stm32_spdifrx_start_sync(stru
+                               "Failed to start synchronization\n");
+       }
+-      spin_unlock(&spdifrx->lock);
++      spin_unlock_irqrestore(&spdifrx->lock, flags);
+       return ret;
+ }
+@@ -361,11 +362,12 @@ static int stm32_spdifrx_start_sync(stru
+ static void stm32_spdifrx_stop(struct stm32_spdifrx_data *spdifrx)
+ {
+       int cr, cr_mask, reg;
++      unsigned long flags;
+-      spin_lock(&spdifrx->lock);
++      spin_lock_irqsave(&spdifrx->lock, flags);
+       if (--spdifrx->refcount) {
+-              spin_unlock(&spdifrx->lock);
++              spin_unlock_irqrestore(&spdifrx->lock, flags);
+               return;
+       }
+@@ -384,7 +386,7 @@ static void stm32_spdifrx_stop(struct st
+       regmap_read(spdifrx->regmap, STM32_SPDIFRX_DR, &reg);
+       regmap_read(spdifrx->regmap, STM32_SPDIFRX_CSR, &reg);
+-      spin_unlock(&spdifrx->lock);
++      spin_unlock_irqrestore(&spdifrx->lock, flags);
+ }
+ static int stm32_spdifrx_dma_ctrl_register(struct device *dev,
diff --git a/queue-4.14/asoc-stm32-spdifrx-fix-race-condition-in-irq-handler.patch b/queue-4.14/asoc-stm32-spdifrx-fix-race-condition-in-irq-handler.patch
new file mode 100644 (file)
index 0000000..7d3174e
--- /dev/null
@@ -0,0 +1,108 @@
+From 86e1956af4c863d653136fd6e5694adf2054dbaa Mon Sep 17 00:00:00 2001
+From: Olivier Moysan <olivier.moysan@st.com>
+Date: Wed, 4 Dec 2019 16:43:32 +0100
+Subject: ASoC: stm32: spdifrx: fix race condition in irq handler
+
+From: Olivier Moysan <olivier.moysan@st.com>
+
+commit 86e1956af4c863d653136fd6e5694adf2054dbaa upstream.
+
+When snd_pcm_stop() is called in interrupt routine,
+substream context may have already been released.
+Add protection on substream context.
+
+Fixes: 03e4d5d56fa5 ("ASoC: stm32: Add SPDIFRX support")
+
+Signed-off-by: Olivier Moysan <olivier.moysan@st.com>
+Link: https://lore.kernel.org/r/20191204154333.7152-3-olivier.moysan@st.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ sound/soc/stm/stm32_spdifrx.c |   24 +++++++++++++++++++-----
+ 1 file changed, 19 insertions(+), 5 deletions(-)
+
+--- a/sound/soc/stm/stm32_spdifrx.c
++++ b/sound/soc/stm/stm32_spdifrx.c
+@@ -213,6 +213,7 @@
+  * @slave_config: dma slave channel runtime config pointer
+  * @phys_addr: SPDIFRX registers physical base address
+  * @lock: synchronization enabling lock
++ * @irq_lock: prevent race condition with IRQ on stream state
+  * @cs: channel status buffer
+  * @ub: user data buffer
+  * @irq: SPDIFRX interrupt line
+@@ -233,6 +234,7 @@ struct stm32_spdifrx_data {
+       struct dma_slave_config slave_config;
+       dma_addr_t phys_addr;
+       spinlock_t lock;  /* Sync enabling lock */
++      spinlock_t irq_lock; /* Prevent race condition on stream state */
+       unsigned char cs[SPDIFRX_CS_BYTES_NB];
+       unsigned char ub[SPDIFRX_UB_BYTES_NB];
+       int irq;
+@@ -646,7 +648,6 @@ static const struct regmap_config stm32_
+ static irqreturn_t stm32_spdifrx_isr(int irq, void *devid)
+ {
+       struct stm32_spdifrx_data *spdifrx = (struct stm32_spdifrx_data *)devid;
+-      struct snd_pcm_substream *substream = spdifrx->substream;
+       struct platform_device *pdev = spdifrx->pdev;
+       unsigned int cr, mask, sr, imr;
+       unsigned int flags;
+@@ -714,14 +715,19 @@ static irqreturn_t stm32_spdifrx_isr(int
+               regmap_update_bits(spdifrx->regmap, STM32_SPDIFRX_CR,
+                                  SPDIFRX_CR_SPDIFEN_MASK, cr);
+-              if (substream)
+-                      snd_pcm_stop(substream, SNDRV_PCM_STATE_DISCONNECTED);
++              spin_lock(&spdifrx->irq_lock);
++              if (spdifrx->substream)
++                      snd_pcm_stop(spdifrx->substream,
++                                   SNDRV_PCM_STATE_DISCONNECTED);
++              spin_unlock(&spdifrx->irq_lock);
+               return IRQ_HANDLED;
+       }
+-      if (err_xrun && substream)
+-              snd_pcm_stop_xrun(substream);
++      spin_lock(&spdifrx->irq_lock);
++      if (err_xrun && spdifrx->substream)
++              snd_pcm_stop_xrun(spdifrx->substream);
++      spin_unlock(&spdifrx->irq_lock);
+       return IRQ_HANDLED;
+ }
+@@ -730,9 +736,12 @@ static int stm32_spdifrx_startup(struct
+                                struct snd_soc_dai *cpu_dai)
+ {
+       struct stm32_spdifrx_data *spdifrx = snd_soc_dai_get_drvdata(cpu_dai);
++      unsigned long flags;
+       int ret;
++      spin_lock_irqsave(&spdifrx->irq_lock, flags);
+       spdifrx->substream = substream;
++      spin_unlock_irqrestore(&spdifrx->irq_lock, flags);
+       ret = clk_prepare_enable(spdifrx->kclk);
+       if (ret)
+@@ -804,8 +813,12 @@ static void stm32_spdifrx_shutdown(struc
+                                  struct snd_soc_dai *cpu_dai)
+ {
+       struct stm32_spdifrx_data *spdifrx = snd_soc_dai_get_drvdata(cpu_dai);
++      unsigned long flags;
++      spin_lock_irqsave(&spdifrx->irq_lock, flags);
+       spdifrx->substream = NULL;
++      spin_unlock_irqrestore(&spdifrx->irq_lock, flags);
++
+       clk_disable_unprepare(spdifrx->kclk);
+ }
+@@ -910,6 +923,7 @@ static int stm32_spdifrx_probe(struct pl
+       spdifrx->pdev = pdev;
+       init_completion(&spdifrx->cs_completion);
+       spin_lock_init(&spdifrx->lock);
++      spin_lock_init(&spdifrx->irq_lock);
+       platform_set_drvdata(pdev, spdifrx);
diff --git a/queue-4.14/cifs-adjust-indentation-in-smb2_open_file.patch b/queue-4.14/cifs-adjust-indentation-in-smb2_open_file.patch
new file mode 100644 (file)
index 0000000..0f0dd57
--- /dev/null
@@ -0,0 +1,45 @@
+From 7935799e041ae10d380d04ea23868240f082bd11 Mon Sep 17 00:00:00 2001
+From: Nathan Chancellor <natechancellor@gmail.com>
+Date: Tue, 17 Dec 2019 20:04:51 -0700
+Subject: cifs: Adjust indentation in smb2_open_file
+
+From: Nathan Chancellor <natechancellor@gmail.com>
+
+commit 7935799e041ae10d380d04ea23868240f082bd11 upstream.
+
+Clang warns:
+
+../fs/cifs/smb2file.c:70:3: warning: misleading indentation; statement
+is not part of the previous 'if' [-Wmisleading-indentation]
+         if (oparms->tcon->use_resilient) {
+         ^
+../fs/cifs/smb2file.c:66:2: note: previous statement is here
+        if (rc)
+        ^
+1 warning generated.
+
+This warning occurs because there is a space after the tab on this line.
+Remove it so that the indentation is consistent with the Linux kernel
+coding style and clang no longer warns.
+
+Fixes: 592fafe644bf ("Add resilienthandles mount parm")
+Link: https://github.com/ClangBuiltLinux/linux/issues/826
+Signed-off-by: Nathan Chancellor <natechancellor@gmail.com>
+Signed-off-by: Steve French <stfrench@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ fs/cifs/smb2file.c |    2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/fs/cifs/smb2file.c
++++ b/fs/cifs/smb2file.c
+@@ -69,7 +69,7 @@ smb2_open_file(const unsigned int xid, s
+               goto out;
+-       if (oparms->tcon->use_resilient) {
++      if (oparms->tcon->use_resilient) {
+               nr_ioctl_req.Timeout = 0; /* use server default (120 seconds) */
+               nr_ioctl_req.Reserved = 0;
+               rc = SMB2_ioctl(xid, oparms->tcon, fid->persistent_fid,
diff --git a/queue-4.14/gpio-fix-error-message-on-out-of-range-gpio-in-lookup-table.patch b/queue-4.14/gpio-fix-error-message-on-out-of-range-gpio-in-lookup-table.patch
new file mode 100644 (file)
index 0000000..0e512d8
--- /dev/null
@@ -0,0 +1,46 @@
+From d935bd50dd14a7714cbdba9a76435dbb56edb1ae Mon Sep 17 00:00:00 2001
+From: Geert Uytterhoeven <geert+renesas@glider.be>
+Date: Wed, 27 Nov 2019 10:59:19 +0100
+Subject: gpio: Fix error message on out-of-range GPIO in lookup table
+
+From: Geert Uytterhoeven <geert+renesas@glider.be>
+
+commit d935bd50dd14a7714cbdba9a76435dbb56edb1ae upstream.
+
+When a GPIO offset in a lookup table is out-of-range, the printed error
+message (1) does not include the actual out-of-range value, and (2)
+contains an off-by-one error in the upper bound.
+
+Avoid user confusion by also printing the actual GPIO offset, and
+correcting the upper bound of the range.
+While at it, use "%u" for unsigned int.
+
+Sample impact:
+
+    -requested GPIO 0 is out of range [0..32] for chip e6052000.gpio
+    +requested GPIO 0 (45) is out of range [0..31] for chip e6052000.gpio
+
+Fixes: 2a3cf6a3599e9015 ("gpiolib: return -ENOENT if no GPIO mapping exists")
+Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
+Link: https://lore.kernel.org/r/20191127095919.4214-1-geert+renesas@glider.be
+Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/gpio/gpiolib.c |    5 +++--
+ 1 file changed, 3 insertions(+), 2 deletions(-)
+
+--- a/drivers/gpio/gpiolib.c
++++ b/drivers/gpio/gpiolib.c
+@@ -3167,8 +3167,9 @@ static struct gpio_desc *gpiod_find(stru
+               if (chip->ngpio <= p->chip_hwnum) {
+                       dev_err(dev,
+-                              "requested GPIO %d is out of range [0..%d] for chip %s\n",
+-                              idx, chip->ngpio, chip->label);
++                              "requested GPIO %u (%u) is out of range [0..%u] for chip %s\n",
++                              idx, p->chip_hwnum, chip->ngpio - 1,
++                              chip->label);
+                       return ERR_PTR(-EINVAL);
+               }
diff --git a/queue-4.14/gpio-zynq-fix-for-bug-in-zynq_gpio_restore_context-api.patch b/queue-4.14/gpio-zynq-fix-for-bug-in-zynq_gpio_restore_context-api.patch
new file mode 100644 (file)
index 0000000..e892540
--- /dev/null
@@ -0,0 +1,56 @@
+From 36f2e7207f21a83ca0054116191f119ac64583ab Mon Sep 17 00:00:00 2001
+From: Swapna Manupati <swapna.manupati@xilinx.com>
+Date: Thu, 26 Dec 2019 17:42:11 +0530
+Subject: gpio: zynq: Fix for bug in zynq_gpio_restore_context API
+
+From: Swapna Manupati <swapna.manupati@xilinx.com>
+
+commit 36f2e7207f21a83ca0054116191f119ac64583ab upstream.
+
+This patch writes the inverse value of Interrupt Mask Status
+register into the Interrupt Enable register in
+zynq_gpio_restore_context API to fix the bug.
+
+Fixes: e11de4de28c0 ("gpio: zynq: Add support for suspend resume")
+Signed-off-by: Swapna Manupati <swapna.manupati@xilinx.com>
+Signed-off-by: Michal Simek <michal.simek@xilinx.com>
+Signed-off-by: Srinivas Neeli <srinivas.neeli@xilinx.com>
+Link: https://lore.kernel.org/r/1577362338-28744-2-git-send-email-srinivas.neeli@xilinx.com
+Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/gpio/gpio-zynq.c |    8 +++++---
+ 1 file changed, 5 insertions(+), 3 deletions(-)
+
+--- a/drivers/gpio/gpio-zynq.c
++++ b/drivers/gpio/gpio-zynq.c
+@@ -639,6 +639,8 @@ static void zynq_gpio_restore_context(st
+       unsigned int bank_num;
+       for (bank_num = 0; bank_num < gpio->p_data->max_bank; bank_num++) {
++              writel_relaxed(ZYNQ_GPIO_IXR_DISABLE_ALL, gpio->base_addr +
++                              ZYNQ_GPIO_INTDIS_OFFSET(bank_num));
+               writel_relaxed(gpio->context.datalsw[bank_num],
+                              gpio->base_addr +
+                              ZYNQ_GPIO_DATA_LSW_OFFSET(bank_num));
+@@ -648,9 +650,6 @@ static void zynq_gpio_restore_context(st
+               writel_relaxed(gpio->context.dirm[bank_num],
+                              gpio->base_addr +
+                              ZYNQ_GPIO_DIRM_OFFSET(bank_num));
+-              writel_relaxed(gpio->context.int_en[bank_num],
+-                             gpio->base_addr +
+-                             ZYNQ_GPIO_INTEN_OFFSET(bank_num));
+               writel_relaxed(gpio->context.int_type[bank_num],
+                              gpio->base_addr +
+                              ZYNQ_GPIO_INTTYPE_OFFSET(bank_num));
+@@ -660,6 +659,9 @@ static void zynq_gpio_restore_context(st
+               writel_relaxed(gpio->context.int_any[bank_num],
+                              gpio->base_addr +
+                              ZYNQ_GPIO_INTANY_OFFSET(bank_num));
++              writel_relaxed(~(gpio->context.int_en[bank_num]),
++                             gpio->base_addr +
++                             ZYNQ_GPIO_INTEN_OFFSET(bank_num));
+       }
+ }
diff --git a/queue-4.14/hsr-reset-network-header-when-supervision-frame-is-created.patch b/queue-4.14/hsr-reset-network-header-when-supervision-frame-is-created.patch
new file mode 100644 (file)
index 0000000..dc4c72e
--- /dev/null
@@ -0,0 +1,58 @@
+From 3ed0a1d563903bdb4b4c36c58c4d9c1bcb23a6e6 Mon Sep 17 00:00:00 2001
+From: Taehee Yoo <ap420073@gmail.com>
+Date: Sun, 22 Dec 2019 11:27:08 +0000
+Subject: hsr: reset network header when supervision frame is created
+
+From: Taehee Yoo <ap420073@gmail.com>
+
+commit 3ed0a1d563903bdb4b4c36c58c4d9c1bcb23a6e6 upstream.
+
+The supervision frame is L2 frame.
+When supervision frame is created, hsr module doesn't set network header.
+If tap routine is enabled, dev_queue_xmit_nit() is called and it checks
+network_header. If network_header pointer wasn't set(or invalid),
+it resets network_header and warns.
+In order to avoid unnecessary warning message, resetting network_header
+is needed.
+
+Test commands:
+    ip netns add nst
+    ip link add veth0 type veth peer name veth1
+    ip link add veth2 type veth peer name veth3
+    ip link set veth1 netns nst
+    ip link set veth3 netns nst
+    ip link set veth0 up
+    ip link set veth2 up
+    ip link add hsr0 type hsr slave1 veth0 slave2 veth2
+    ip a a 192.168.100.1/24 dev hsr0
+    ip link set hsr0 up
+    ip netns exec nst ip link set veth1 up
+    ip netns exec nst ip link set veth3 up
+    ip netns exec nst ip link add hsr1 type hsr slave1 veth1 slave2 veth3
+    ip netns exec nst ip a a 192.168.100.2/24 dev hsr1
+    ip netns exec nst ip link set hsr1 up
+    tcpdump -nei veth0
+
+Splat looks like:
+[  175.852292][    C3] protocol 88fb is buggy, dev veth0
+
+Fixes: f421436a591d ("net/hsr: Add support for the High-availability Seamless Redundancy protocol (HSRv0)")
+Signed-off-by: Taehee Yoo <ap420073@gmail.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ net/hsr/hsr_device.c |    2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/net/hsr/hsr_device.c
++++ b/net/hsr/hsr_device.c
+@@ -281,6 +281,8 @@ static void send_hsr_supervision_frame(s
+                           skb->dev->dev_addr, skb->len) <= 0)
+               goto out;
+       skb_reset_mac_header(skb);
++      skb_reset_network_header(skb);
++      skb_reset_transport_header(skb);
+       if (hsrVer > 0) {
+               hsr_tag = skb_put(skb, sizeof(struct hsr_tag));
diff --git a/queue-4.14/iommu-remove-device-link-to-group-on-failure.patch b/queue-4.14/iommu-remove-device-link-to-group-on-failure.patch
new file mode 100644 (file)
index 0000000..d0fdd59
--- /dev/null
@@ -0,0 +1,32 @@
+From 7d4e6ccd1fb09dbfbc49746ca82bd5c25ad4bfe4 Mon Sep 17 00:00:00 2001
+From: Jon Derrick <jonathan.derrick@intel.com>
+Date: Tue, 31 Dec 2019 13:24:19 -0700
+Subject: iommu: Remove device link to group on failure
+
+From: Jon Derrick <jonathan.derrick@intel.com>
+
+commit 7d4e6ccd1fb09dbfbc49746ca82bd5c25ad4bfe4 upstream.
+
+This adds the missing teardown step that removes the device link from
+the group when the device addition fails.
+
+Signed-off-by: Jon Derrick <jonathan.derrick@intel.com>
+Fixes: 797a8b4d768c5 ("iommu: Handle default domain attach failure")
+Reviewed-by: Lu Baolu <baolu.lu@linux.intel.com>
+Signed-off-by: Joerg Roedel <jroedel@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/iommu/iommu.c |    1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/drivers/iommu/iommu.c
++++ b/drivers/iommu/iommu.c
+@@ -613,6 +613,7 @@ err_put_group:
+       mutex_unlock(&group->mutex);
+       dev->iommu_group = NULL;
+       kobject_put(group->devices_kobj);
++      sysfs_remove_link(group->devices_kobj, device->name);
+ err_free_name:
+       kfree(device->name);
+ err_remove_link:
diff --git a/queue-4.14/rdma-bnxt_re-fix-send-work-entry-state-check-while-polling-completions.patch b/queue-4.14/rdma-bnxt_re-fix-send-work-entry-state-check-while-polling-completions.patch
new file mode 100644 (file)
index 0000000..19056b8
--- /dev/null
@@ -0,0 +1,50 @@
+From c5275723580922e5f3264f96751337661a153c7d Mon Sep 17 00:00:00 2001
+From: Selvin Xavier <selvin.xavier@broadcom.com>
+Date: Mon, 25 Nov 2019 00:39:30 -0800
+Subject: RDMA/bnxt_re: Fix Send Work Entry state check while polling completions
+
+From: Selvin Xavier <selvin.xavier@broadcom.com>
+
+commit c5275723580922e5f3264f96751337661a153c7d upstream.
+
+Some adapters need a fence Work Entry to handle retransmission.  Currently
+the driver checks for this condition, only if the Send queue entry is
+signalled. Implement the condition check, irrespective of the signalled
+state of the Work queue entries
+
+Failure to add the fence can result in access to memory that is already
+marked as completed, triggering data corruption, transmission failure,
+IOMMU failures, etc.
+
+Fixes: 9152e0b722b2 ("RDMA/bnxt_re: HW workarounds for handling specific conditions")
+Link: https://lore.kernel.org/r/1574671174-5064-3-git-send-email-selvin.xavier@broadcom.com
+Signed-off-by: Selvin Xavier <selvin.xavier@broadcom.com>
+Signed-off-by: Jason Gunthorpe <jgg@mellanox.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/infiniband/hw/bnxt_re/qplib_fp.c |   12 ++++++------
+ 1 file changed, 6 insertions(+), 6 deletions(-)
+
+--- a/drivers/infiniband/hw/bnxt_re/qplib_fp.c
++++ b/drivers/infiniband/hw/bnxt_re/qplib_fp.c
+@@ -2024,13 +2024,13 @@ static int bnxt_qplib_cq_process_req(str
+                       bnxt_qplib_mark_qp_error(qp);
+                       bnxt_qplib_unlock_buddy_cq(qp, cq);
+               } else {
++                      /* Before we complete, do WA 9060 */
++                      if (do_wa9060(qp, cq, cq_cons, sw_sq_cons,
++                                    cqe_sq_cons)) {
++                              *lib_qp = qp;
++                              goto out;
++                      }
+                       if (swq->flags & SQ_SEND_FLAGS_SIGNAL_COMP) {
+-                              /* Before we complete, do WA 9060 */
+-                              if (do_wa9060(qp, cq, cq_cons, sw_sq_cons,
+-                                            cqe_sq_cons)) {
+-                                      *lib_qp = qp;
+-                                      goto out;
+-                              }
+                               cqe->status = CQ_REQ_STATUS_OK;
+                               cqe++;
+                               (*budget)--;
diff --git a/queue-4.14/rtc-mt6397-fix-alarm-register-overwrite.patch b/queue-4.14/rtc-mt6397-fix-alarm-register-overwrite.patch
new file mode 100644 (file)
index 0000000..9524060
--- /dev/null
@@ -0,0 +1,103 @@
+From 653997eeecef95c3ead4fba1b2d27e6a5854d6cd Mon Sep 17 00:00:00 2001
+From: Ran Bi <ran.bi@mediatek.com>
+Date: Wed, 11 Dec 2019 17:43:54 +0800
+Subject: rtc: mt6397: fix alarm register overwrite
+
+From: Ran Bi <ran.bi@mediatek.com>
+
+commit 653997eeecef95c3ead4fba1b2d27e6a5854d6cd upstream.
+
+Alarm registers high byte was reserved for other functions.
+This add mask in alarm registers operation functions.
+This also fix error condition in interrupt handler.
+
+Fixes: fc2979118f3f ("rtc: mediatek: Add MT6397 RTC driver")
+
+Signed-off-by: Ran Bi <ran.bi@mediatek.com>
+Signed-off-by: Hsin-Hsiung Wang <hsin-hsiung.wang@mediatek.com>
+Link: https://lore.kernel.org/r/1576057435-3561-6-git-send-email-hsin-hsiung.wang@mediatek.com
+Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/rtc/rtc-mt6397.c |   47 +++++++++++++++++++++++++++++++++--------------
+ 1 file changed, 33 insertions(+), 14 deletions(-)
+
+--- a/drivers/rtc/rtc-mt6397.c
++++ b/drivers/rtc/rtc-mt6397.c
+@@ -55,6 +55,14 @@
+ #define RTC_AL_SEC            0x0018
++#define RTC_AL_SEC_MASK               0x003f
++#define RTC_AL_MIN_MASK               0x003f
++#define RTC_AL_HOU_MASK               0x001f
++#define RTC_AL_DOM_MASK               0x001f
++#define RTC_AL_DOW_MASK               0x0007
++#define RTC_AL_MTH_MASK               0x000f
++#define RTC_AL_YEA_MASK               0x007f
++
+ #define RTC_PDN2              0x002e
+ #define RTC_PDN2_PWRON_ALARM  BIT(4)
+@@ -111,7 +119,7 @@ static irqreturn_t mtk_rtc_irq_handler_t
+               irqen = irqsta & ~RTC_IRQ_EN_AL;
+               mutex_lock(&rtc->lock);
+               if (regmap_write(rtc->regmap, rtc->addr_base + RTC_IRQ_EN,
+-                               irqen) < 0)
++                               irqen) == 0)
+                       mtk_rtc_write_trigger(rtc);
+               mutex_unlock(&rtc->lock);
+@@ -233,12 +241,12 @@ static int mtk_rtc_read_alarm(struct dev
+       alm->pending = !!(pdn2 & RTC_PDN2_PWRON_ALARM);
+       mutex_unlock(&rtc->lock);
+-      tm->tm_sec = data[RTC_OFFSET_SEC];
+-      tm->tm_min = data[RTC_OFFSET_MIN];
+-      tm->tm_hour = data[RTC_OFFSET_HOUR];
+-      tm->tm_mday = data[RTC_OFFSET_DOM];
+-      tm->tm_mon = data[RTC_OFFSET_MTH];
+-      tm->tm_year = data[RTC_OFFSET_YEAR];
++      tm->tm_sec = data[RTC_OFFSET_SEC] & RTC_AL_SEC_MASK;
++      tm->tm_min = data[RTC_OFFSET_MIN] & RTC_AL_MIN_MASK;
++      tm->tm_hour = data[RTC_OFFSET_HOUR] & RTC_AL_HOU_MASK;
++      tm->tm_mday = data[RTC_OFFSET_DOM] & RTC_AL_DOM_MASK;
++      tm->tm_mon = data[RTC_OFFSET_MTH] & RTC_AL_MTH_MASK;
++      tm->tm_year = data[RTC_OFFSET_YEAR] & RTC_AL_YEA_MASK;
+       tm->tm_year += RTC_MIN_YEAR_OFFSET;
+       tm->tm_mon--;
+@@ -259,14 +267,25 @@ static int mtk_rtc_set_alarm(struct devi
+       tm->tm_year -= RTC_MIN_YEAR_OFFSET;
+       tm->tm_mon++;
+-      data[RTC_OFFSET_SEC] = tm->tm_sec;
+-      data[RTC_OFFSET_MIN] = tm->tm_min;
+-      data[RTC_OFFSET_HOUR] = tm->tm_hour;
+-      data[RTC_OFFSET_DOM] = tm->tm_mday;
+-      data[RTC_OFFSET_MTH] = tm->tm_mon;
+-      data[RTC_OFFSET_YEAR] = tm->tm_year;
+-
+       mutex_lock(&rtc->lock);
++      ret = regmap_bulk_read(rtc->regmap, rtc->addr_base + RTC_AL_SEC,
++                             data, RTC_OFFSET_COUNT);
++      if (ret < 0)
++              goto exit;
++
++      data[RTC_OFFSET_SEC] = ((data[RTC_OFFSET_SEC] & ~(RTC_AL_SEC_MASK)) |
++                              (tm->tm_sec & RTC_AL_SEC_MASK));
++      data[RTC_OFFSET_MIN] = ((data[RTC_OFFSET_MIN] & ~(RTC_AL_MIN_MASK)) |
++                              (tm->tm_min & RTC_AL_MIN_MASK));
++      data[RTC_OFFSET_HOUR] = ((data[RTC_OFFSET_HOUR] & ~(RTC_AL_HOU_MASK)) |
++                              (tm->tm_hour & RTC_AL_HOU_MASK));
++      data[RTC_OFFSET_DOM] = ((data[RTC_OFFSET_DOM] & ~(RTC_AL_DOM_MASK)) |
++                              (tm->tm_mday & RTC_AL_DOM_MASK));
++      data[RTC_OFFSET_MTH] = ((data[RTC_OFFSET_MTH] & ~(RTC_AL_MTH_MASK)) |
++                              (tm->tm_mon & RTC_AL_MTH_MASK));
++      data[RTC_OFFSET_YEAR] = ((data[RTC_OFFSET_YEAR] & ~(RTC_AL_YEA_MASK)) |
++                              (tm->tm_year & RTC_AL_YEA_MASK));
++
+       if (alm->enabled) {
+               ret = regmap_bulk_write(rtc->regmap,
+                                       rtc->addr_base + RTC_AL_SEC,
index b4b6bfe07d0066d2ad2d993f167d62be56bf085f..9324c8858c699973d9bbab504a7f9604c8c4d844 100644 (file)
@@ -17,3 +17,12 @@ wimax-i2400-fix-memory-leak-in-i2400m_op_rfkill_sw_toggle.patch
 iwlwifi-dbg_ini-fix-memory-leak-in-alloc_sgtable.patch
 dccp-fix-memleak-in-__feat_register_sp.patch
 drm-i915-fix-use-after-free-when-destroying-gem-context.patch
+rtc-mt6397-fix-alarm-register-overwrite.patch
+rdma-bnxt_re-fix-send-work-entry-state-check-while-polling-completions.patch
+asoc-stm32-spdifrx-fix-inconsistent-lock-state.patch
+asoc-stm32-spdifrx-fix-race-condition-in-irq-handler.patch
+gpio-zynq-fix-for-bug-in-zynq_gpio_restore_context-api.patch
+iommu-remove-device-link-to-group-on-failure.patch
+gpio-fix-error-message-on-out-of-range-gpio-in-lookup-table.patch
+hsr-reset-network-header-when-supervision-frame-is-created.patch
+cifs-adjust-indentation-in-smb2_open_file.patch