--- /dev/null
+From 106bc79843c3c6f4f00753d1f46e54e815f99377 Mon Sep 17 00:00:00 2001
+From: David Howells <dhowells@redhat.com>
+Date: Wed, 11 Dec 2019 08:06:08 +0000
+Subject: afs: Fix missing cell comparison in afs_test_super()
+
+From: David Howells <dhowells@redhat.com>
+
+commit 106bc79843c3c6f4f00753d1f46e54e815f99377 upstream.
+
+Fix missing cell comparison in afs_test_super(). Without this, any pair
+volumes that have the same volume ID will share a superblock, no matter the
+cell, unless they're in different network namespaces.
+
+Normally, most users will only deal with a single cell and so they won't
+see this. Even if they do look into a second cell, they won't see a
+problem unless they happen to hit a volume with the same ID as one they've
+already got mounted.
+
+Before the patch:
+
+ # ls /afs/grand.central.org/archive
+ linuxdev/ mailman/ moin/ mysql/ pipermail/ stage/ twiki/
+ # ls /afs/kth.se/
+ linuxdev/ mailman/ moin/ mysql/ pipermail/ stage/ twiki/
+ # cat /proc/mounts | grep afs
+ none /afs afs rw,relatime,dyn,autocell 0 0
+ #grand.central.org:root.cell /afs/grand.central.org afs ro,relatime 0 0
+ #grand.central.org:root.archive /afs/grand.central.org/archive afs ro,relatime 0 0
+ #grand.central.org:root.archive /afs/kth.se afs ro,relatime 0 0
+
+After the patch:
+
+ # ls /afs/grand.central.org/archive
+ linuxdev/ mailman/ moin/ mysql/ pipermail/ stage/ twiki/
+ # ls /afs/kth.se/
+ admin/ common/ install/ OldFiles/ service/ system/
+ bakrestores/ home/ misc/ pkg/ src/ wsadmin/
+ # cat /proc/mounts | grep afs
+ none /afs afs rw,relatime,dyn,autocell 0 0
+ #grand.central.org:root.cell /afs/grand.central.org afs ro,relatime 0 0
+ #grand.central.org:root.archive /afs/grand.central.org/archive afs ro,relatime 0 0
+ #kth.se:root.cell /afs/kth.se afs ro,relatime 0 0
+
+Fixes: ^1da177e4c3f4 ("Linux-2.6.12-rc2")
+Reported-by: Carsten Jacobi <jacobi@de.ibm.com>
+Signed-off-by: David Howells <dhowells@redhat.com>
+Reviewed-by: Marc Dionne <marc.dionne@auristor.com>
+Tested-by: Jonathan Billings <jsbillings@jsbillings.org>
+cc: Todd DeSantis <atd@us.ibm.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ fs/afs/super.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/fs/afs/super.c
++++ b/fs/afs/super.c
+@@ -356,6 +356,7 @@ static int afs_test_super(struct super_b
+ return (as->net_ns == as1->net_ns &&
+ as->volume &&
+ as->volume->vid == as1->volume->vid &&
++ as->cell == as1->cell &&
+ !as->dyn_root);
+ }
+
--- /dev/null
+From 218fe9b7ec7f32c10a07539365488d80af7b0084 Mon Sep 17 00:00:00 2001
+From: Daniel Baluta <daniel.baluta@nxp.com>
+Date: Wed, 4 Dec 2019 17:13:33 +0200
+Subject: ASoC: soc-core: Set dpcm_playback / dpcm_capture
+
+From: Daniel Baluta <daniel.baluta@nxp.com>
+
+commit 218fe9b7ec7f32c10a07539365488d80af7b0084 upstream.
+
+When converting a normal link to a DPCM link we need
+to set dpcm_playback / dpcm_capture otherwise playback/capture
+streams will not be created resulting in errors like this:
+
+[ 36.039111] sai1-wm8960-hifi: ASoC: no backend playback stream
+
+Fixes: a655de808cbde ("ASoC: core: Allow topology to override machine driver FE DAI link config")
+Signed-off-by: Daniel Baluta <daniel.baluta@nxp.com>
+Link: https://lore.kernel.org/r/20191204151333.26625-1-daniel.baluta@nxp.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ sound/soc/soc-core.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/sound/soc/soc-core.c
++++ b/sound/soc/soc-core.c
+@@ -1921,6 +1921,8 @@ static void soc_check_tplg_fes(struct sn
+
+ /* convert non BE into BE */
+ dai_link->no_pcm = 1;
++ dai_link->dpcm_playback = 1;
++ dai_link->dpcm_capture = 1;
+
+ /* override any BE fixups */
+ dai_link->be_hw_params_fixup =
--- /dev/null
+From 2859b1784031b5709446af8f6039c467f136e67d Mon Sep 17 00:00:00 2001
+From: Olivier Moysan <olivier.moysan@st.com>
+Date: Wed, 4 Dec 2019 16:43:31 +0100
+Subject: ASoC: stm32: spdifrx: fix inconsistent lock state
+
+From: Olivier Moysan <olivier.moysan@st.com>
+
+commit 2859b1784031b5709446af8f6039c467f136e67d upstream.
+
+In current spdifrx driver locks may be requested as follows:
+- request lock on iec capture control, when starting synchronization.
+- request lock in interrupt context, when spdifrx stop is called
+from IRQ handler.
+
+Take lock with IRQs disabled, to avoid the possible deadlock.
+
+Lockdep report:
+[ 74.278059] ================================
+[ 74.282306] WARNING: inconsistent lock state
+[ 74.290120] --------------------------------
+...
+[ 74.314373] CPU0
+[ 74.314377] ----
+[ 74.314381] lock(&(&spdifrx->lock)->rlock);
+[ 74.314396] <Interrupt>
+[ 74.314400] lock(&(&spdifrx->lock)->rlock);
+
+Fixes: 03e4d5d56fa5 ("ASoC: stm32: Add SPDIFRX support")
+
+Signed-off-by: Olivier Moysan <olivier.moysan@st.com>
+Link: https://lore.kernel.org/r/20191204154333.7152-2-olivier.moysan@st.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ sound/soc/stm/stm32_spdifrx.c | 12 +++++++-----
+ 1 file changed, 7 insertions(+), 5 deletions(-)
+
+--- a/sound/soc/stm/stm32_spdifrx.c
++++ b/sound/soc/stm/stm32_spdifrx.c
+@@ -313,6 +313,7 @@ static void stm32_spdifrx_dma_ctrl_stop(
+ static int stm32_spdifrx_start_sync(struct stm32_spdifrx_data *spdifrx)
+ {
+ int cr, cr_mask, imr, ret;
++ unsigned long flags;
+
+ /* Enable IRQs */
+ imr = SPDIFRX_IMR_IFEIE | SPDIFRX_IMR_SYNCDIE | SPDIFRX_IMR_PERRIE;
+@@ -320,7 +321,7 @@ static int stm32_spdifrx_start_sync(stru
+ if (ret)
+ return ret;
+
+- spin_lock(&spdifrx->lock);
++ spin_lock_irqsave(&spdifrx->lock, flags);
+
+ spdifrx->refcount++;
+
+@@ -353,7 +354,7 @@ static int stm32_spdifrx_start_sync(stru
+ "Failed to start synchronization\n");
+ }
+
+- spin_unlock(&spdifrx->lock);
++ spin_unlock_irqrestore(&spdifrx->lock, flags);
+
+ return ret;
+ }
+@@ -361,11 +362,12 @@ static int stm32_spdifrx_start_sync(stru
+ static void stm32_spdifrx_stop(struct stm32_spdifrx_data *spdifrx)
+ {
+ int cr, cr_mask, reg;
++ unsigned long flags;
+
+- spin_lock(&spdifrx->lock);
++ spin_lock_irqsave(&spdifrx->lock, flags);
+
+ if (--spdifrx->refcount) {
+- spin_unlock(&spdifrx->lock);
++ spin_unlock_irqrestore(&spdifrx->lock, flags);
+ return;
+ }
+
+@@ -384,7 +386,7 @@ static void stm32_spdifrx_stop(struct st
+ regmap_read(spdifrx->regmap, STM32_SPDIFRX_DR, ®);
+ regmap_read(spdifrx->regmap, STM32_SPDIFRX_CSR, ®);
+
+- spin_unlock(&spdifrx->lock);
++ spin_unlock_irqrestore(&spdifrx->lock, flags);
+ }
+
+ static int stm32_spdifrx_dma_ctrl_register(struct device *dev,
--- /dev/null
+From 86e1956af4c863d653136fd6e5694adf2054dbaa Mon Sep 17 00:00:00 2001
+From: Olivier Moysan <olivier.moysan@st.com>
+Date: Wed, 4 Dec 2019 16:43:32 +0100
+Subject: ASoC: stm32: spdifrx: fix race condition in irq handler
+
+From: Olivier Moysan <olivier.moysan@st.com>
+
+commit 86e1956af4c863d653136fd6e5694adf2054dbaa upstream.
+
+When snd_pcm_stop() is called in interrupt routine,
+substream context may have already been released.
+Add protection on substream context.
+
+Fixes: 03e4d5d56fa5 ("ASoC: stm32: Add SPDIFRX support")
+
+Signed-off-by: Olivier Moysan <olivier.moysan@st.com>
+Link: https://lore.kernel.org/r/20191204154333.7152-3-olivier.moysan@st.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ sound/soc/stm/stm32_spdifrx.c | 24 +++++++++++++++++++-----
+ 1 file changed, 19 insertions(+), 5 deletions(-)
+
+--- a/sound/soc/stm/stm32_spdifrx.c
++++ b/sound/soc/stm/stm32_spdifrx.c
+@@ -213,6 +213,7 @@
+ * @slave_config: dma slave channel runtime config pointer
+ * @phys_addr: SPDIFRX registers physical base address
+ * @lock: synchronization enabling lock
++ * @irq_lock: prevent race condition with IRQ on stream state
+ * @cs: channel status buffer
+ * @ub: user data buffer
+ * @irq: SPDIFRX interrupt line
+@@ -233,6 +234,7 @@ struct stm32_spdifrx_data {
+ struct dma_slave_config slave_config;
+ dma_addr_t phys_addr;
+ spinlock_t lock; /* Sync enabling lock */
++ spinlock_t irq_lock; /* Prevent race condition on stream state */
+ unsigned char cs[SPDIFRX_CS_BYTES_NB];
+ unsigned char ub[SPDIFRX_UB_BYTES_NB];
+ int irq;
+@@ -645,7 +647,6 @@ static const struct regmap_config stm32_
+ static irqreturn_t stm32_spdifrx_isr(int irq, void *devid)
+ {
+ struct stm32_spdifrx_data *spdifrx = (struct stm32_spdifrx_data *)devid;
+- struct snd_pcm_substream *substream = spdifrx->substream;
+ struct platform_device *pdev = spdifrx->pdev;
+ unsigned int cr, mask, sr, imr;
+ unsigned int flags;
+@@ -713,14 +714,19 @@ static irqreturn_t stm32_spdifrx_isr(int
+ regmap_update_bits(spdifrx->regmap, STM32_SPDIFRX_CR,
+ SPDIFRX_CR_SPDIFEN_MASK, cr);
+
+- if (substream)
+- snd_pcm_stop(substream, SNDRV_PCM_STATE_DISCONNECTED);
++ spin_lock(&spdifrx->irq_lock);
++ if (spdifrx->substream)
++ snd_pcm_stop(spdifrx->substream,
++ SNDRV_PCM_STATE_DISCONNECTED);
++ spin_unlock(&spdifrx->irq_lock);
+
+ return IRQ_HANDLED;
+ }
+
+- if (err_xrun && substream)
+- snd_pcm_stop_xrun(substream);
++ spin_lock(&spdifrx->irq_lock);
++ if (err_xrun && spdifrx->substream)
++ snd_pcm_stop_xrun(spdifrx->substream);
++ spin_unlock(&spdifrx->irq_lock);
+
+ return IRQ_HANDLED;
+ }
+@@ -729,9 +735,12 @@ static int stm32_spdifrx_startup(struct
+ struct snd_soc_dai *cpu_dai)
+ {
+ struct stm32_spdifrx_data *spdifrx = snd_soc_dai_get_drvdata(cpu_dai);
++ unsigned long flags;
+ int ret;
+
++ spin_lock_irqsave(&spdifrx->irq_lock, flags);
+ spdifrx->substream = substream;
++ spin_unlock_irqrestore(&spdifrx->irq_lock, flags);
+
+ ret = clk_prepare_enable(spdifrx->kclk);
+ if (ret)
+@@ -807,8 +816,12 @@ static void stm32_spdifrx_shutdown(struc
+ struct snd_soc_dai *cpu_dai)
+ {
+ struct stm32_spdifrx_data *spdifrx = snd_soc_dai_get_drvdata(cpu_dai);
++ unsigned long flags;
+
++ spin_lock_irqsave(&spdifrx->irq_lock, flags);
+ spdifrx->substream = NULL;
++ spin_unlock_irqrestore(&spdifrx->irq_lock, flags);
++
+ clk_disable_unprepare(spdifrx->kclk);
+ }
+
+@@ -912,6 +925,7 @@ static int stm32_spdifrx_probe(struct pl
+ spdifrx->pdev = pdev;
+ init_completion(&spdifrx->cs_completion);
+ spin_lock_init(&spdifrx->lock);
++ spin_lock_init(&spdifrx->irq_lock);
+
+ platform_set_drvdata(pdev, spdifrx);
+
--- /dev/null
+From 7935799e041ae10d380d04ea23868240f082bd11 Mon Sep 17 00:00:00 2001
+From: Nathan Chancellor <natechancellor@gmail.com>
+Date: Tue, 17 Dec 2019 20:04:51 -0700
+Subject: cifs: Adjust indentation in smb2_open_file
+
+From: Nathan Chancellor <natechancellor@gmail.com>
+
+commit 7935799e041ae10d380d04ea23868240f082bd11 upstream.
+
+Clang warns:
+
+../fs/cifs/smb2file.c:70:3: warning: misleading indentation; statement
+is not part of the previous 'if' [-Wmisleading-indentation]
+ if (oparms->tcon->use_resilient) {
+ ^
+../fs/cifs/smb2file.c:66:2: note: previous statement is here
+ if (rc)
+ ^
+1 warning generated.
+
+This warning occurs because there is a space after the tab on this line.
+Remove it so that the indentation is consistent with the Linux kernel
+coding style and clang no longer warns.
+
+Fixes: 592fafe644bf ("Add resilienthandles mount parm")
+Link: https://github.com/ClangBuiltLinux/linux/issues/826
+Signed-off-by: Nathan Chancellor <natechancellor@gmail.com>
+Signed-off-by: Steve French <stfrench@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ fs/cifs/smb2file.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/fs/cifs/smb2file.c
++++ b/fs/cifs/smb2file.c
+@@ -67,7 +67,7 @@ smb2_open_file(const unsigned int xid, s
+ goto out;
+
+
+- if (oparms->tcon->use_resilient) {
++ if (oparms->tcon->use_resilient) {
+ nr_ioctl_req.Timeout = 0; /* use server default (120 seconds) */
+ nr_ioctl_req.Reserved = 0;
+ rc = SMB2_ioctl(xid, oparms->tcon, fid->persistent_fid,
--- /dev/null
+From d935bd50dd14a7714cbdba9a76435dbb56edb1ae Mon Sep 17 00:00:00 2001
+From: Geert Uytterhoeven <geert+renesas@glider.be>
+Date: Wed, 27 Nov 2019 10:59:19 +0100
+Subject: gpio: Fix error message on out-of-range GPIO in lookup table
+
+From: Geert Uytterhoeven <geert+renesas@glider.be>
+
+commit d935bd50dd14a7714cbdba9a76435dbb56edb1ae upstream.
+
+When a GPIO offset in a lookup table is out-of-range, the printed error
+message (1) does not include the actual out-of-range value, and (2)
+contains an off-by-one error in the upper bound.
+
+Avoid user confusion by also printing the actual GPIO offset, and
+correcting the upper bound of the range.
+While at it, use "%u" for unsigned int.
+
+Sample impact:
+
+ -requested GPIO 0 is out of range [0..32] for chip e6052000.gpio
+ +requested GPIO 0 (45) is out of range [0..31] for chip e6052000.gpio
+
+Fixes: 2a3cf6a3599e9015 ("gpiolib: return -ENOENT if no GPIO mapping exists")
+Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
+Link: https://lore.kernel.org/r/20191127095919.4214-1-geert+renesas@glider.be
+Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/gpio/gpiolib.c | 5 +++--
+ 1 file changed, 3 insertions(+), 2 deletions(-)
+
+--- a/drivers/gpio/gpiolib.c
++++ b/drivers/gpio/gpiolib.c
+@@ -3757,8 +3757,9 @@ static struct gpio_desc *gpiod_find(stru
+
+ if (chip->ngpio <= p->chip_hwnum) {
+ dev_err(dev,
+- "requested GPIO %d is out of range [0..%d] for chip %s\n",
+- idx, chip->ngpio, chip->label);
++ "requested GPIO %u (%u) is out of range [0..%u] for chip %s\n",
++ idx, p->chip_hwnum, chip->ngpio - 1,
++ chip->label);
+ return ERR_PTR(-EINVAL);
+ }
+
--- /dev/null
+From 36f2e7207f21a83ca0054116191f119ac64583ab Mon Sep 17 00:00:00 2001
+From: Swapna Manupati <swapna.manupati@xilinx.com>
+Date: Thu, 26 Dec 2019 17:42:11 +0530
+Subject: gpio: zynq: Fix for bug in zynq_gpio_restore_context API
+
+From: Swapna Manupati <swapna.manupati@xilinx.com>
+
+commit 36f2e7207f21a83ca0054116191f119ac64583ab upstream.
+
+This patch writes the inverse value of Interrupt Mask Status
+register into the Interrupt Enable register in
+zynq_gpio_restore_context API to fix the bug.
+
+Fixes: e11de4de28c0 ("gpio: zynq: Add support for suspend resume")
+Signed-off-by: Swapna Manupati <swapna.manupati@xilinx.com>
+Signed-off-by: Michal Simek <michal.simek@xilinx.com>
+Signed-off-by: Srinivas Neeli <srinivas.neeli@xilinx.com>
+Link: https://lore.kernel.org/r/1577362338-28744-2-git-send-email-srinivas.neeli@xilinx.com
+Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/gpio/gpio-zynq.c | 8 +++++---
+ 1 file changed, 5 insertions(+), 3 deletions(-)
+
+--- a/drivers/gpio/gpio-zynq.c
++++ b/drivers/gpio/gpio-zynq.c
+@@ -639,6 +639,8 @@ static void zynq_gpio_restore_context(st
+ unsigned int bank_num;
+
+ for (bank_num = 0; bank_num < gpio->p_data->max_bank; bank_num++) {
++ writel_relaxed(ZYNQ_GPIO_IXR_DISABLE_ALL, gpio->base_addr +
++ ZYNQ_GPIO_INTDIS_OFFSET(bank_num));
+ writel_relaxed(gpio->context.datalsw[bank_num],
+ gpio->base_addr +
+ ZYNQ_GPIO_DATA_LSW_OFFSET(bank_num));
+@@ -648,9 +650,6 @@ static void zynq_gpio_restore_context(st
+ writel_relaxed(gpio->context.dirm[bank_num],
+ gpio->base_addr +
+ ZYNQ_GPIO_DIRM_OFFSET(bank_num));
+- writel_relaxed(gpio->context.int_en[bank_num],
+- gpio->base_addr +
+- ZYNQ_GPIO_INTEN_OFFSET(bank_num));
+ writel_relaxed(gpio->context.int_type[bank_num],
+ gpio->base_addr +
+ ZYNQ_GPIO_INTTYPE_OFFSET(bank_num));
+@@ -660,6 +659,9 @@ static void zynq_gpio_restore_context(st
+ writel_relaxed(gpio->context.int_any[bank_num],
+ gpio->base_addr +
+ ZYNQ_GPIO_INTANY_OFFSET(bank_num));
++ writel_relaxed(~(gpio->context.int_en[bank_num]),
++ gpio->base_addr +
++ ZYNQ_GPIO_INTEN_OFFSET(bank_num));
+ }
+ }
+
--- /dev/null
+From 3ed0a1d563903bdb4b4c36c58c4d9c1bcb23a6e6 Mon Sep 17 00:00:00 2001
+From: Taehee Yoo <ap420073@gmail.com>
+Date: Sun, 22 Dec 2019 11:27:08 +0000
+Subject: hsr: reset network header when supervision frame is created
+
+From: Taehee Yoo <ap420073@gmail.com>
+
+commit 3ed0a1d563903bdb4b4c36c58c4d9c1bcb23a6e6 upstream.
+
+The supervision frame is L2 frame.
+When supervision frame is created, hsr module doesn't set network header.
+If tap routine is enabled, dev_queue_xmit_nit() is called and it checks
+network_header. If network_header pointer wasn't set(or invalid),
+it resets network_header and warns.
+In order to avoid unnecessary warning message, resetting network_header
+is needed.
+
+Test commands:
+ ip netns add nst
+ ip link add veth0 type veth peer name veth1
+ ip link add veth2 type veth peer name veth3
+ ip link set veth1 netns nst
+ ip link set veth3 netns nst
+ ip link set veth0 up
+ ip link set veth2 up
+ ip link add hsr0 type hsr slave1 veth0 slave2 veth2
+ ip a a 192.168.100.1/24 dev hsr0
+ ip link set hsr0 up
+ ip netns exec nst ip link set veth1 up
+ ip netns exec nst ip link set veth3 up
+ ip netns exec nst ip link add hsr1 type hsr slave1 veth1 slave2 veth3
+ ip netns exec nst ip a a 192.168.100.2/24 dev hsr1
+ ip netns exec nst ip link set hsr1 up
+ tcpdump -nei veth0
+
+Splat looks like:
+[ 175.852292][ C3] protocol 88fb is buggy, dev veth0
+
+Fixes: f421436a591d ("net/hsr: Add support for the High-availability Seamless Redundancy protocol (HSRv0)")
+Signed-off-by: Taehee Yoo <ap420073@gmail.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ net/hsr/hsr_device.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/net/hsr/hsr_device.c
++++ b/net/hsr/hsr_device.c
+@@ -281,6 +281,8 @@ static void send_hsr_supervision_frame(s
+ skb->dev->dev_addr, skb->len) <= 0)
+ goto out;
+ skb_reset_mac_header(skb);
++ skb_reset_network_header(skb);
++ skb_reset_transport_header(skb);
+
+ if (hsrVer > 0) {
+ hsr_tag = skb_put(skb, sizeof(struct hsr_tag));
--- /dev/null
+From 7d4e6ccd1fb09dbfbc49746ca82bd5c25ad4bfe4 Mon Sep 17 00:00:00 2001
+From: Jon Derrick <jonathan.derrick@intel.com>
+Date: Tue, 31 Dec 2019 13:24:19 -0700
+Subject: iommu: Remove device link to group on failure
+
+From: Jon Derrick <jonathan.derrick@intel.com>
+
+commit 7d4e6ccd1fb09dbfbc49746ca82bd5c25ad4bfe4 upstream.
+
+This adds the missing teardown step that removes the device link from
+the group when the device addition fails.
+
+Signed-off-by: Jon Derrick <jonathan.derrick@intel.com>
+Fixes: 797a8b4d768c5 ("iommu: Handle default domain attach failure")
+Reviewed-by: Lu Baolu <baolu.lu@linux.intel.com>
+Signed-off-by: Joerg Roedel <jroedel@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/iommu/iommu.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/drivers/iommu/iommu.c
++++ b/drivers/iommu/iommu.c
+@@ -650,6 +650,7 @@ err_put_group:
+ mutex_unlock(&group->mutex);
+ dev->iommu_group = NULL;
+ kobject_put(group->devices_kobj);
++ sysfs_remove_link(group->devices_kobj, device->name);
+ err_free_name:
+ kfree(device->name);
+ err_remove_link:
--- /dev/null
+From 8bcef0d54067077cf9a6cb129022c77559926e8c Mon Sep 17 00:00:00 2001
+From: Peter Ujfalusi <peter.ujfalusi@ti.com>
+Date: Tue, 7 Jan 2020 10:45:44 +0200
+Subject: mtd: onenand: omap2: Pass correct flags for prep_dma_memcpy
+
+From: Peter Ujfalusi <peter.ujfalusi@ti.com>
+
+commit 8bcef0d54067077cf9a6cb129022c77559926e8c upstream.
+
+The commit converting the driver to DMAengine was missing the flags for
+the memcpy prepare call.
+It went unnoticed since the omap-dma driver was ignoring them.
+
+Fixes: 3ed6a4d1de2c5 (" mtd: onenand: omap2: Convert to use dmaengine for memcp")
+Reported-by: Aaro Koskinen <aaro.koskinen@iki.fi>
+Signed-off-by: Peter Ujfalusi <peter.ujfalusi@ti.com>
+Tested-by: H. Nikolaus Schaller <hns@goldelico.com>
+Tested-by: Aaro Koskinen <aaro.koskinen@iki.fi>
+Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/mtd/nand/onenand/omap2.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+--- a/drivers/mtd/nand/onenand/omap2.c
++++ b/drivers/mtd/nand/onenand/omap2.c
+@@ -341,7 +341,8 @@ static inline int omap2_onenand_dma_tran
+ struct dma_async_tx_descriptor *tx;
+ dma_cookie_t cookie;
+
+- tx = dmaengine_prep_dma_memcpy(c->dma_chan, dst, src, count, 0);
++ tx = dmaengine_prep_dma_memcpy(c->dma_chan, dst, src, count,
++ DMA_CTRL_ACK | DMA_PREP_INTERRUPT);
+ if (!tx) {
+ dev_err(&c->pdev->dev, "Failed to prepare DMA memcpy\n");
+ return -EIO;
--- /dev/null
+From 9a4467a6b282a299b932608ac2c9034f8415359f Mon Sep 17 00:00:00 2001
+From: Selvin Xavier <selvin.xavier@broadcom.com>
+Date: Mon, 25 Nov 2019 00:39:29 -0800
+Subject: RDMA/bnxt_re: Avoid freeing MR resources if dereg fails
+
+From: Selvin Xavier <selvin.xavier@broadcom.com>
+
+commit 9a4467a6b282a299b932608ac2c9034f8415359f upstream.
+
+The driver returns an error code for MR dereg, but frees the MR structure.
+When the MR dereg is retried due to previous error, the system crashes as
+the structure is already freed.
+
+ BUG: unable to handle kernel NULL pointer dereference at 00000000000001b8
+ PGD 0 P4D 0
+ Oops: 0000 [#1] SMP PTI
+ CPU: 7 PID: 12178 Comm: ib_send_bw Kdump: loaded Not tainted 4.18.0-124.el8.x86_64 #1
+ Hardware name: Dell Inc. PowerEdge R430/03XKDV, BIOS 1.1.10 03/10/2015
+ RIP: 0010:__dev_printk+0x2a/0x70
+ Code: 0f 1f 44 00 00 49 89 d1 48 85 f6 0f 84 f6 2b 00 00 4c 8b 46 70 4d 85 c0 75 04 4c 8b
+46 10 48 8b 86 a8 00 00 00 48 85 c0 74 16 <48> 8b 08 0f be 7f 01 48 c7 c2 13 ac ac 83 83 ef 30 e9 10 fe ff ff
+ RSP: 0018:ffffaf7c04607a60 EFLAGS: 00010006
+ RAX: 00000000000001b8 RBX: ffffa0010c91c488 RCX: 0000000000000246
+ RDX: ffffaf7c04607a68 RSI: ffffa0010c91caa8 RDI: ffffffff83a788eb
+ RBP: ffffaf7c04607ac8 R08: 0000000000000000 R09: ffffaf7c04607a68
+ R10: 0000000000000000 R11: 0000000000000001 R12: ffffaf7c04607b90
+ R13: 000000000000000e R14: 0000000000000000 R15: 00000000ffffa001
+ FS: 0000146fa1f1cdc0(0000) GS:ffffa0012fac0000(0000) knlGS:0000000000000000
+ CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
+ CR2: 00000000000001b8 CR3: 000000007680a003 CR4: 00000000001606e0
+ Call Trace:
+ dev_err+0x6c/0x90
+ ? dev_printk_emit+0x4e/0x70
+ bnxt_qplib_rcfw_send_message+0x594/0x660 [bnxt_re]
+ ? dev_err+0x6c/0x90
+ bnxt_qplib_free_mrw+0x80/0xe0 [bnxt_re]
+ bnxt_re_dereg_mr+0x2e/0xd0 [bnxt_re]
+ ib_dereg_mr+0x2f/0x50 [ib_core]
+ destroy_hw_idr_uobject+0x20/0x70 [ib_uverbs]
+ uverbs_destroy_uobject+0x2e/0x170 [ib_uverbs]
+ __uverbs_cleanup_ufile+0x6e/0x90 [ib_uverbs]
+ uverbs_destroy_ufile_hw+0x61/0x130 [ib_uverbs]
+ ib_uverbs_close+0x1f/0x80 [ib_uverbs]
+ __fput+0xb7/0x230
+ task_work_run+0x8a/0xb0
+ do_exit+0x2da/0xb40
+...
+ RIP: 0033:0x146fa113a387
+ Code: Bad RIP value.
+ RSP: 002b:00007fff945d1478 EFLAGS: 00000246 ORIG_RAX: ffffffffffffff02
+ RAX: 0000000000000000 RBX: 000055a248908d70 RCX: 0000000000000000
+ RDX: 0000146fa1f2b000 RSI: 0000000000000001 RDI: 000055a248906488
+ RBP: 000055a248909630 R08: 0000000000010000 R09: 0000000000000000
+ R10: 0000000000000000 R11: 0000000000000000 R12: 000055a248906488
+ R13: 0000000000000001 R14: 0000000000000000 R15: 000055a2489095f0
+
+Do not free the MR structures, when driver returns error to the stack.
+
+Fixes: 872f3578241d ("RDMA/bnxt_re: Add support for MRs with Huge pages")
+Link: https://lore.kernel.org/r/1574671174-5064-2-git-send-email-selvin.xavier@broadcom.com
+Signed-off-by: Selvin Xavier <selvin.xavier@broadcom.com>
+Signed-off-by: Jason Gunthorpe <jgg@mellanox.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/infiniband/hw/bnxt_re/ib_verbs.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+--- a/drivers/infiniband/hw/bnxt_re/ib_verbs.c
++++ b/drivers/infiniband/hw/bnxt_re/ib_verbs.c
+@@ -3368,8 +3368,10 @@ int bnxt_re_dereg_mr(struct ib_mr *ib_mr
+ int rc;
+
+ rc = bnxt_qplib_free_mrw(&rdev->qplib_res, &mr->qplib_mr);
+- if (rc)
++ if (rc) {
+ dev_err(rdev_to_dev(rdev), "Dereg MR failed: %#x\n", rc);
++ return rc;
++ }
+
+ if (mr->pages) {
+ rc = bnxt_qplib_free_fast_reg_page_list(&rdev->qplib_res,
--- /dev/null
+From c5275723580922e5f3264f96751337661a153c7d Mon Sep 17 00:00:00 2001
+From: Selvin Xavier <selvin.xavier@broadcom.com>
+Date: Mon, 25 Nov 2019 00:39:30 -0800
+Subject: RDMA/bnxt_re: Fix Send Work Entry state check while polling completions
+
+From: Selvin Xavier <selvin.xavier@broadcom.com>
+
+commit c5275723580922e5f3264f96751337661a153c7d upstream.
+
+Some adapters need a fence Work Entry to handle retransmission. Currently
+the driver checks for this condition, only if the Send queue entry is
+signalled. Implement the condition check, irrespective of the signalled
+state of the Work queue entries
+
+Failure to add the fence can result in access to memory that is already
+marked as completed, triggering data corruption, transmission failure,
+IOMMU failures, etc.
+
+Fixes: 9152e0b722b2 ("RDMA/bnxt_re: HW workarounds for handling specific conditions")
+Link: https://lore.kernel.org/r/1574671174-5064-3-git-send-email-selvin.xavier@broadcom.com
+Signed-off-by: Selvin Xavier <selvin.xavier@broadcom.com>
+Signed-off-by: Jason Gunthorpe <jgg@mellanox.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/infiniband/hw/bnxt_re/qplib_fp.c | 12 ++++++------
+ 1 file changed, 6 insertions(+), 6 deletions(-)
+
+--- a/drivers/infiniband/hw/bnxt_re/qplib_fp.c
++++ b/drivers/infiniband/hw/bnxt_re/qplib_fp.c
+@@ -2273,13 +2273,13 @@ static int bnxt_qplib_cq_process_req(str
+ /* Add qp to flush list of the CQ */
+ bnxt_qplib_add_flush_qp(qp);
+ } else {
++ /* Before we complete, do WA 9060 */
++ if (do_wa9060(qp, cq, cq_cons, sw_sq_cons,
++ cqe_sq_cons)) {
++ *lib_qp = qp;
++ goto out;
++ }
+ if (swq->flags & SQ_SEND_FLAGS_SIGNAL_COMP) {
+- /* Before we complete, do WA 9060 */
+- if (do_wa9060(qp, cq, cq_cons, sw_sq_cons,
+- cqe_sq_cons)) {
+- *lib_qp = qp;
+- goto out;
+- }
+ cqe->status = CQ_REQ_STATUS_OK;
+ cqe++;
+ (*budget)--;
--- /dev/null
+From 653997eeecef95c3ead4fba1b2d27e6a5854d6cd Mon Sep 17 00:00:00 2001
+From: Ran Bi <ran.bi@mediatek.com>
+Date: Wed, 11 Dec 2019 17:43:54 +0800
+Subject: rtc: mt6397: fix alarm register overwrite
+
+From: Ran Bi <ran.bi@mediatek.com>
+
+commit 653997eeecef95c3ead4fba1b2d27e6a5854d6cd upstream.
+
+Alarm registers high byte was reserved for other functions.
+This add mask in alarm registers operation functions.
+This also fix error condition in interrupt handler.
+
+Fixes: fc2979118f3f ("rtc: mediatek: Add MT6397 RTC driver")
+
+Signed-off-by: Ran Bi <ran.bi@mediatek.com>
+Signed-off-by: Hsin-Hsiung Wang <hsin-hsiung.wang@mediatek.com>
+Link: https://lore.kernel.org/r/1576057435-3561-6-git-send-email-hsin-hsiung.wang@mediatek.com
+Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/rtc/rtc-mt6397.c | 47 +++++++++++++++++++++++++++++++++--------------
+ 1 file changed, 33 insertions(+), 14 deletions(-)
+
+--- a/drivers/rtc/rtc-mt6397.c
++++ b/drivers/rtc/rtc-mt6397.c
+@@ -55,6 +55,14 @@
+
+ #define RTC_AL_SEC 0x0018
+
++#define RTC_AL_SEC_MASK 0x003f
++#define RTC_AL_MIN_MASK 0x003f
++#define RTC_AL_HOU_MASK 0x001f
++#define RTC_AL_DOM_MASK 0x001f
++#define RTC_AL_DOW_MASK 0x0007
++#define RTC_AL_MTH_MASK 0x000f
++#define RTC_AL_YEA_MASK 0x007f
++
+ #define RTC_PDN2 0x002e
+ #define RTC_PDN2_PWRON_ALARM BIT(4)
+
+@@ -111,7 +119,7 @@ static irqreturn_t mtk_rtc_irq_handler_t
+ irqen = irqsta & ~RTC_IRQ_EN_AL;
+ mutex_lock(&rtc->lock);
+ if (regmap_write(rtc->regmap, rtc->addr_base + RTC_IRQ_EN,
+- irqen) < 0)
++ irqen) == 0)
+ mtk_rtc_write_trigger(rtc);
+ mutex_unlock(&rtc->lock);
+
+@@ -233,12 +241,12 @@ static int mtk_rtc_read_alarm(struct dev
+ alm->pending = !!(pdn2 & RTC_PDN2_PWRON_ALARM);
+ mutex_unlock(&rtc->lock);
+
+- tm->tm_sec = data[RTC_OFFSET_SEC];
+- tm->tm_min = data[RTC_OFFSET_MIN];
+- tm->tm_hour = data[RTC_OFFSET_HOUR];
+- tm->tm_mday = data[RTC_OFFSET_DOM];
+- tm->tm_mon = data[RTC_OFFSET_MTH];
+- tm->tm_year = data[RTC_OFFSET_YEAR];
++ tm->tm_sec = data[RTC_OFFSET_SEC] & RTC_AL_SEC_MASK;
++ tm->tm_min = data[RTC_OFFSET_MIN] & RTC_AL_MIN_MASK;
++ tm->tm_hour = data[RTC_OFFSET_HOUR] & RTC_AL_HOU_MASK;
++ tm->tm_mday = data[RTC_OFFSET_DOM] & RTC_AL_DOM_MASK;
++ tm->tm_mon = data[RTC_OFFSET_MTH] & RTC_AL_MTH_MASK;
++ tm->tm_year = data[RTC_OFFSET_YEAR] & RTC_AL_YEA_MASK;
+
+ tm->tm_year += RTC_MIN_YEAR_OFFSET;
+ tm->tm_mon--;
+@@ -259,14 +267,25 @@ static int mtk_rtc_set_alarm(struct devi
+ tm->tm_year -= RTC_MIN_YEAR_OFFSET;
+ tm->tm_mon++;
+
+- data[RTC_OFFSET_SEC] = tm->tm_sec;
+- data[RTC_OFFSET_MIN] = tm->tm_min;
+- data[RTC_OFFSET_HOUR] = tm->tm_hour;
+- data[RTC_OFFSET_DOM] = tm->tm_mday;
+- data[RTC_OFFSET_MTH] = tm->tm_mon;
+- data[RTC_OFFSET_YEAR] = tm->tm_year;
+-
+ mutex_lock(&rtc->lock);
++ ret = regmap_bulk_read(rtc->regmap, rtc->addr_base + RTC_AL_SEC,
++ data, RTC_OFFSET_COUNT);
++ if (ret < 0)
++ goto exit;
++
++ data[RTC_OFFSET_SEC] = ((data[RTC_OFFSET_SEC] & ~(RTC_AL_SEC_MASK)) |
++ (tm->tm_sec & RTC_AL_SEC_MASK));
++ data[RTC_OFFSET_MIN] = ((data[RTC_OFFSET_MIN] & ~(RTC_AL_MIN_MASK)) |
++ (tm->tm_min & RTC_AL_MIN_MASK));
++ data[RTC_OFFSET_HOUR] = ((data[RTC_OFFSET_HOUR] & ~(RTC_AL_HOU_MASK)) |
++ (tm->tm_hour & RTC_AL_HOU_MASK));
++ data[RTC_OFFSET_DOM] = ((data[RTC_OFFSET_DOM] & ~(RTC_AL_DOM_MASK)) |
++ (tm->tm_mday & RTC_AL_DOM_MASK));
++ data[RTC_OFFSET_MTH] = ((data[RTC_OFFSET_MTH] & ~(RTC_AL_MTH_MASK)) |
++ (tm->tm_mon & RTC_AL_MTH_MASK));
++ data[RTC_OFFSET_YEAR] = ((data[RTC_OFFSET_YEAR] & ~(RTC_AL_YEA_MASK)) |
++ (tm->tm_year & RTC_AL_YEA_MASK));
++
+ if (alm->enabled) {
+ ret = regmap_bulk_write(rtc->regmap,
+ rtc->addr_base + RTC_AL_SEC,
--- /dev/null
+From 68c57bfd52836e31bff33e5e1fc64029749d2c35 Mon Sep 17 00:00:00 2001
+From: Alexandra Winter <wintera@linux.ibm.com>
+Date: Mon, 23 Dec 2019 15:03:23 +0100
+Subject: s390/qeth: fix false reporting of VNIC CHAR config failure
+
+From: Alexandra Winter <wintera@linux.ibm.com>
+
+commit 68c57bfd52836e31bff33e5e1fc64029749d2c35 upstream.
+
+Symptom: Error message "Configuring the VNIC characteristics failed"
+in dmesg whenever an OSA interface on z15 is set online.
+
+The VNIC characteristics get re-programmed when setting a L2 device
+online. This follows the selected 'wanted' characteristics - with the
+exception that the INVISIBLE characteristic unconditionally gets
+switched off.
+
+For devices that don't support INVISIBLE (ie. OSA), the resulting
+IO failure raises a noisy error message
+("Configuring the VNIC characteristics failed").
+For IQD, INVISIBLE is off by default anyways.
+
+So don't unnecessarily special-case the INVISIBLE characteristic, and
+thereby suppress the misleading error message on OSA devices.
+
+Fixes: caa1f0b10d18 ("s390/qeth: add VNICC enable/disable support")
+Signed-off-by: Alexandra Winter <wintera@linux.ibm.com>
+Reviewed-by: Julian Wiedmann <jwi@linux.ibm.com>
+Signed-off-by: Julian Wiedmann <jwi@linux.ibm.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/s390/net/qeth_l2_main.c | 1 -
+ 1 file changed, 1 deletion(-)
+
+--- a/drivers/s390/net/qeth_l2_main.c
++++ b/drivers/s390/net/qeth_l2_main.c
+@@ -2367,7 +2367,6 @@ static void qeth_l2_vnicc_init(struct qe
+ error = qeth_l2_vnicc_recover_timeout(card, QETH_VNICC_LEARNING,
+ timeout);
+ chars_tmp = card->options.vnicc.wanted_chars ^ QETH_VNICC_DEFAULT;
+- chars_tmp |= QETH_VNICC_BRIDGE_INVISIBLE;
+ chars_len = sizeof(card->options.vnicc.wanted_chars) * BITS_PER_BYTE;
+ for_each_set_bit(i, &chars_tmp, chars_len) {
+ vnicc = BIT(i);
--- /dev/null
+From e8a66d800471e2df7f0b484e2e46898b21d1fa82 Mon Sep 17 00:00:00 2001
+From: Alexandra Winter <wintera@linux.ibm.com>
+Date: Mon, 23 Dec 2019 15:03:24 +0100
+Subject: s390/qeth: Fix vnicc_is_in_use if rx_bcast not set
+
+From: Alexandra Winter <wintera@linux.ibm.com>
+
+commit e8a66d800471e2df7f0b484e2e46898b21d1fa82 upstream.
+
+Symptom: After vnicc/rx_bcast has been manually set to 0,
+ bridge_* sysfs parameters can still be set or written.
+Only occurs on HiperSockets, as OSA doesn't support changing rx_bcast.
+
+Vnic characteristics and bridgeport settings are mutually exclusive.
+rx_bcast defaults to 1, so manually setting it to 0 should disable
+bridge_* parameters.
+
+Instead it makes sense here to check the supported mask. If the card
+does not support vnicc at all, bridge commands are always allowed.
+
+Fixes: caa1f0b10d18 ("s390/qeth: add VNICC enable/disable support")
+Signed-off-by: Alexandra Winter <wintera@linux.ibm.com>
+Signed-off-by: Julian Wiedmann <jwi@linux.ibm.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/s390/net/qeth_l2_main.c | 3 +--
+ 1 file changed, 1 insertion(+), 2 deletions(-)
+
+--- a/drivers/s390/net/qeth_l2_main.c
++++ b/drivers/s390/net/qeth_l2_main.c
+@@ -2285,8 +2285,7 @@ int qeth_l2_vnicc_get_timeout(struct qet
+ /* check if VNICC is currently enabled */
+ bool qeth_l2_vnicc_is_in_use(struct qeth_card *card)
+ {
+- /* if everything is turned off, VNICC is not active */
+- if (!card->options.vnicc.cur_chars)
++ if (!card->options.vnicc.sup_chars)
+ return false;
+ /* default values are only OK if rx_bcast was not enabled by user
+ * or the card is offline.
rdma-fix-goto-target-to-release-the-allocated-memory.patch
dccp-fix-memleak-in-__feat_register_sp.patch
drm-i915-fix-use-after-free-when-destroying-gem-context.patch
+rtc-mt6397-fix-alarm-register-overwrite.patch
+rdma-bnxt_re-avoid-freeing-mr-resources-if-dereg-fails.patch
+rdma-bnxt_re-fix-send-work-entry-state-check-while-polling-completions.patch
+asoc-soc-core-set-dpcm_playback-dpcm_capture.patch
+asoc-stm32-spdifrx-fix-inconsistent-lock-state.patch
+asoc-stm32-spdifrx-fix-race-condition-in-irq-handler.patch
+mtd-onenand-omap2-pass-correct-flags-for-prep_dma_memcpy.patch
+gpio-zynq-fix-for-bug-in-zynq_gpio_restore_context-api.patch
+iommu-remove-device-link-to-group-on-failure.patch
+gpio-fix-error-message-on-out-of-range-gpio-in-lookup-table.patch
+hsr-reset-network-header-when-supervision-frame-is-created.patch
+s390-qeth-fix-false-reporting-of-vnic-char-config-failure.patch
+s390-qeth-fix-vnicc_is_in_use-if-rx_bcast-not-set.patch
+cifs-adjust-indentation-in-smb2_open_file.patch
+afs-fix-missing-cell-comparison-in-afs_test_super.patch
projects / thirdparty / kernel / stable-queue.git / commitdiff
