From: Sasha Levin Date: Fri, 17 Jul 2020 16:16:19 +0000 (-0400) Subject: Fixes for 4.14 X-Git-Tag: v4.4.231~65 X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=5cc1fb476bc8d2c1eb3a3b4af74805f600880fc6;p=thirdparty%2Fkernel%2Fstable-queue.git Fixes for 4.14 Signed-off-by: Sasha Levin --- diff --git a/queue-4.14/net-dsa-bcm_sf2-fix-node-reference-count.patch b/queue-4.14/net-dsa-bcm_sf2-fix-node-reference-count.patch new file mode 100644 index 00000000000..057ce5626b8 --- /dev/null +++ b/queue-4.14/net-dsa-bcm_sf2-fix-node-reference-count.patch @@ -0,0 +1,77 @@ +From c372f414fc8c0fa139b6175254528f429e27ee6d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 17 Jun 2020 20:42:44 -0700 +Subject: net: dsa: bcm_sf2: Fix node reference count + +From: Florian Fainelli + +[ Upstream commit 8dbe4c5d5e40fe140221024f7b16bec9f310bf70 ] + +of_find_node_by_name() will do an of_node_put() on the "from" argument. +With CONFIG_OF_DYNAMIC enabled which checks for device_node reference +counts, we would be getting a warning like this: + +[ 6.347230] refcount_t: increment on 0; use-after-free. +[ 6.352498] WARNING: CPU: 3 PID: 77 at lib/refcount.c:156 +refcount_inc_checked+0x38/0x44 +[ 6.360601] Modules linked in: +[ 6.363661] CPU: 3 PID: 77 Comm: kworker/3:1 Tainted: G W +5.4.46-gb78b3e9956e6 #13 +[ 6.372546] Hardware name: BCM97278SV (DT) +[ 6.376649] Workqueue: events deferred_probe_work_func +[ 6.381796] pstate: 60000005 (nZCv daif -PAN -UAO) +[ 6.386595] pc : refcount_inc_checked+0x38/0x44 +[ 6.391133] lr : refcount_inc_checked+0x38/0x44 +... +[ 6.478791] Call trace: +[ 6.481243] refcount_inc_checked+0x38/0x44 +[ 6.485433] kobject_get+0x3c/0x4c +[ 6.488840] of_node_get+0x24/0x34 +[ 6.492247] of_irq_find_parent+0x3c/0xe0 +[ 6.496263] of_irq_parse_one+0xe4/0x1d0 +[ 6.500191] irq_of_parse_and_map+0x44/0x84 +[ 6.504381] bcm_sf2_sw_probe+0x22c/0x844 +[ 6.508397] platform_drv_probe+0x58/0xa8 +[ 6.512413] really_probe+0x238/0x3fc +[ 6.516081] driver_probe_device+0x11c/0x12c +[ 6.520358] __device_attach_driver+0xa8/0x100 +[ 6.524808] bus_for_each_drv+0xb4/0xd0 +[ 6.528650] __device_attach+0xd0/0x164 +[ 6.532493] device_initial_probe+0x24/0x30 +[ 6.536682] bus_probe_device+0x38/0x98 +[ 6.540524] deferred_probe_work_func+0xa8/0xd4 +[ 6.545061] process_one_work+0x178/0x288 +[ 6.549078] process_scheduled_works+0x44/0x48 +[ 6.553529] worker_thread+0x218/0x270 +[ 6.557285] kthread+0xdc/0xe4 +[ 6.560344] ret_from_fork+0x10/0x18 +[ 6.563925] ---[ end trace 68f65caf69bb152a ]--- + +Fix this by adding a of_node_get() to increment the reference count +prior to the call. + +Fixes: afa3b592953b ("net: dsa: bcm_sf2: Ensure correct sub-node is parsed") +Signed-off-by: Florian Fainelli +Reviewed-by: Andrew Lunn +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/dsa/bcm_sf2.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/net/dsa/bcm_sf2.c b/drivers/net/dsa/bcm_sf2.c +index b40ebc27e1ece..9f355673f630c 100644 +--- a/drivers/net/dsa/bcm_sf2.c ++++ b/drivers/net/dsa/bcm_sf2.c +@@ -1175,6 +1175,8 @@ static int bcm_sf2_sw_probe(struct platform_device *pdev) + */ + set_bit(0, priv->cfp.used); + ++ /* Balance of_node_put() done by of_find_node_by_name() */ ++ of_node_get(dn); + ports = of_find_node_by_name(dn, "ports"); + if (ports) { + bcm_sf2_identify_ports(priv, ports); +-- +2.25.1 + diff --git a/queue-4.14/of-of_mdio-correct-loop-scanning-logic.patch b/queue-4.14/of-of_mdio-correct-loop-scanning-logic.patch new file mode 100644 index 00000000000..8cd14c98610 --- /dev/null +++ b/queue-4.14/of-of_mdio-correct-loop-scanning-logic.patch @@ -0,0 +1,54 @@ +From 7dae030c5f10ac35e74528fd0781fed8e4d32864 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 19 Jun 2020 11:47:46 -0700 +Subject: of: of_mdio: Correct loop scanning logic + +From: Florian Fainelli + +[ Upstream commit 5a8d7f126c97d04d893f5e5be2b286437a0d01b0 ] + +Commit 209c65b61d94 ("drivers/of/of_mdio.c:fix of_mdiobus_register()") +introduced a break of the loop on the premise that a successful +registration should exit the loop. The premise is correct but not to +code, because rc && rc != -ENODEV is just a special error condition, +that means we would exit the loop even with rc == -ENODEV which is +absolutely not correct since this is the error code to indicate to the +MDIO bus layer that scanning should continue. + +Fix this by explicitly checking for rc = 0 as the only valid condition +to break out of the loop. + +Fixes: 209c65b61d94 ("drivers/of/of_mdio.c:fix of_mdiobus_register()") +Reviewed-by: Andrew Lunn +Signed-off-by: Florian Fainelli +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/of/of_mdio.c | 9 +++++++-- + 1 file changed, 7 insertions(+), 2 deletions(-) + +diff --git a/drivers/of/of_mdio.c b/drivers/of/of_mdio.c +index 69da2f6896dae..8b7d3e64b8cab 100644 +--- a/drivers/of/of_mdio.c ++++ b/drivers/of/of_mdio.c +@@ -256,10 +256,15 @@ int of_mdiobus_register(struct mii_bus *mdio, struct device_node *np) + child->name, addr); + + if (of_mdiobus_child_is_phy(child)) { ++ /* -ENODEV is the return code that PHYLIB has ++ * standardized on to indicate that bus ++ * scanning should continue. ++ */ + rc = of_mdiobus_register_phy(mdio, child, addr); +- if (rc && rc != -ENODEV) ++ if (!rc) ++ break; ++ if (rc != -ENODEV) + goto unregister; +- break; + } + } + } +-- +2.25.1 + diff --git a/queue-4.14/series b/queue-4.14/series index 74ae2d2ba18..28270ccb27a 100644 --- a/queue-4.14/series +++ b/queue-4.14/series @@ -66,3 +66,7 @@ iio-mma8452-add-missed-iio_device_unregister-call-in-mma8452_probe.patch iio-pressure-zpa2326-handle-pm_runtime_get_sync-failure.patch iio-pressure-ms5611-fix-buffer-element-alignment.patch iio-health-afe4403-fix-timestamp-alignment-and-prevent-data-leak.patch +spi-spi-fsl-dspi-fix-lockup-if-device-is-shutdown-du.patch +spi-fix-initial-spi_sr-value-in-spi-fsl-dspi.patch +net-dsa-bcm_sf2-fix-node-reference-count.patch +of-of_mdio-correct-loop-scanning-logic.patch diff --git a/queue-4.14/spi-fix-initial-spi_sr-value-in-spi-fsl-dspi.patch b/queue-4.14/spi-fix-initial-spi_sr-value-in-spi-fsl-dspi.patch new file mode 100644 index 00000000000..c512fa789e5 --- /dev/null +++ b/queue-4.14/spi-fix-initial-spi_sr-value-in-spi-fsl-dspi.patch @@ -0,0 +1,42 @@ +From f29541922cdb45bc515ee930e434263fa03105bd Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 26 Dec 2018 22:45:06 +0100 +Subject: spi: fix initial SPI_SR value in spi-fsl-dspi + +From: Angelo Dureghello + +[ Upstream commit aa54c1c9d90e6db75190813907190fadcce1bf45 ] + +On ColdFire mcf54418, using DSPI_DMA_MODE mode, spi transfers +at first boot stage are not succeding: + +m25p80 spi0.1: unrecognized JEDEC id bytes: 00, 00, 00 + +The reason is the SPI_SR initial value set by the driver, that +is not clearing (not setting to 1) the RF_DF flag. After a tour +on the dspi hw modules that use this driver(Vybrid, ColdFire and +ls1021a) a better init value for SR register has been set. + +Signed-off-by: Angelo Dureghello +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + drivers/spi/spi-fsl-dspi.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/spi/spi-fsl-dspi.c b/drivers/spi/spi-fsl-dspi.c +index cce9e34306787..6da70a62e1964 100644 +--- a/drivers/spi/spi-fsl-dspi.c ++++ b/drivers/spi/spi-fsl-dspi.c +@@ -76,7 +76,7 @@ + #define SPI_SR 0x2c + #define SPI_SR_EOQF 0x10000000 + #define SPI_SR_TCFQF 0x80000000 +-#define SPI_SR_CLEAR 0xdaad0000 ++#define SPI_SR_CLEAR 0x9aaf0000 + + #define SPI_RSER_TFFFE BIT(25) + #define SPI_RSER_TFFFD BIT(24) +-- +2.25.1 + diff --git a/queue-4.14/spi-spi-fsl-dspi-fix-lockup-if-device-is-shutdown-du.patch b/queue-4.14/spi-spi-fsl-dspi-fix-lockup-if-device-is-shutdown-du.patch new file mode 100644 index 00000000000..10647b6b370 --- /dev/null +++ b/queue-4.14/spi-spi-fsl-dspi-fix-lockup-if-device-is-shutdown-du.patch @@ -0,0 +1,60 @@ +From fcc6c6ec40f3707e0fdecad7da58da01d05d335a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 22 Jun 2020 13:05:41 +0200 +Subject: spi: spi-fsl-dspi: Fix lockup if device is shutdown during SPI + transfer + +From: Krzysztof Kozlowski + +[ Upstream commit 3c525b69e8c1a9a6944e976603c7a1a713e728f9 ] + +During shutdown, the driver should unregister the SPI controller +and stop the hardware. Otherwise the dspi_transfer_one_message() could +wait on completion infinitely. + +Additionally, calling spi_unregister_controller() first in device +shutdown reverse-matches the probe function, where SPI controller is +registered at the end. + +Fixes: dc234825997e ("spi: spi-fsl-dspi: Adding shutdown hook") +Reported-by: Vladimir Oltean +Signed-off-by: Krzysztof Kozlowski +Tested-by: Vladimir Oltean +Reviewed-by: Vladimir Oltean +Cc: +Link: https://lore.kernel.org/r/20200622110543.5035-2-krzk@kernel.org +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + drivers/spi/spi-fsl-dspi.c | 15 +-------------- + 1 file changed, 1 insertion(+), 14 deletions(-) + +diff --git a/drivers/spi/spi-fsl-dspi.c b/drivers/spi/spi-fsl-dspi.c +index dabff9718d426..cce9e34306787 100644 +--- a/drivers/spi/spi-fsl-dspi.c ++++ b/drivers/spi/spi-fsl-dspi.c +@@ -1097,20 +1097,7 @@ static int dspi_remove(struct platform_device *pdev) + + static void dspi_shutdown(struct platform_device *pdev) + { +- struct spi_controller *ctlr = platform_get_drvdata(pdev); +- struct fsl_dspi *dspi = spi_controller_get_devdata(ctlr); +- +- /* Disable RX and TX */ +- regmap_update_bits(dspi->regmap, SPI_MCR, +- SPI_MCR_DIS_TXF | SPI_MCR_DIS_RXF, +- SPI_MCR_DIS_TXF | SPI_MCR_DIS_RXF); +- +- /* Stop Running */ +- regmap_update_bits(dspi->regmap, SPI_MCR, SPI_MCR_HALT, SPI_MCR_HALT); +- +- dspi_release_dma(dspi); +- clk_disable_unprepare(dspi->clk); +- spi_unregister_controller(dspi->master); ++ dspi_remove(pdev); + } + + static struct platform_driver fsl_dspi_driver = { +-- +2.25.1 +