--- /dev/null
+From 74d6a5d5662975aed7f25952f62efbb6f6dadd29 Mon Sep 17 00:00:00 2001
+From: Wang Hai <wanghai38@huawei.com>
+Date: Fri, 12 Jun 2020 17:08:33 +0800
+Subject: 9p/trans_fd: Fix concurrency del of req_list in p9_fd_cancelled/p9_read_work
+
+From: Wang Hai <wanghai38@huawei.com>
+
+commit 74d6a5d5662975aed7f25952f62efbb6f6dadd29 upstream.
+
+p9_read_work and p9_fd_cancelled may be called concurrently.
+In some cases, req->req_list may be deleted by both p9_read_work
+and p9_fd_cancelled.
+
+We can fix it by ignoring replies associated with a cancelled
+request and ignoring cancelled request if message has been received
+before lock.
+
+Link: http://lkml.kernel.org/r/20200612090833.36149-1-wanghai38@huawei.com
+Fixes: 60ff779c4abb ("9p: client: remove unused code and any reference to "cancelled" function")
+Cc: <stable@vger.kernel.org> # v3.12+
+Reported-by: syzbot+77a25acfa0382e06ab23@syzkaller.appspotmail.com
+Signed-off-by: Wang Hai <wanghai38@huawei.com>
+Signed-off-by: Dominique Martinet <asmadeus@codewreck.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ net/9p/trans_fd.c | 15 ++++++++++++++-
+ 1 file changed, 14 insertions(+), 1 deletion(-)
+
+--- a/net/9p/trans_fd.c
++++ b/net/9p/trans_fd.c
+@@ -362,6 +362,10 @@ static void p9_read_work(struct work_str
+ if (m->rreq->status == REQ_STATUS_SENT) {
+ list_del(&m->rreq->req_list);
+ p9_client_cb(m->client, m->rreq, REQ_STATUS_RCVD);
++ } else if (m->rreq->status == REQ_STATUS_FLSHD) {
++ /* Ignore replies associated with a cancelled request. */
++ p9_debug(P9_DEBUG_TRANS,
++ "Ignore replies associated with a cancelled request\n");
+ } else {
+ spin_unlock(&m->client->lock);
+ p9_debug(P9_DEBUG_ERROR,
+@@ -703,11 +707,20 @@ static int p9_fd_cancelled(struct p9_cli
+ {
+ p9_debug(P9_DEBUG_TRANS, "client %p req %p\n", client, req);
+
++ spin_lock(&client->lock);
++ /* Ignore cancelled request if message has been received
++ * before lock.
++ */
++ if (req->status == REQ_STATUS_RCVD) {
++ spin_unlock(&client->lock);
++ return 0;
++ }
++
+ /* we haven't received a response for oldreq,
+ * remove it from the list.
+ */
+- spin_lock(&client->lock);
+ list_del(&req->req_list);
++ req->status = REQ_STATUS_FLSHD;
+ spin_unlock(&client->lock);
+ p9_req_put(req);
+
--- /dev/null
+From c2c3657f0aedb8736a0fb7b2b1985adfb86e7802 Mon Sep 17 00:00:00 2001
+From: Takashi Iwai <tiwai@suse.de>
+Date: Tue, 28 Jul 2020 10:20:33 +0200
+Subject: ALSA: hda/hdmi: Fix keep_power assignment for non-component devices
+
+From: Takashi Iwai <tiwai@suse.de>
+
+commit c2c3657f0aedb8736a0fb7b2b1985adfb86e7802 upstream.
+
+It's been reported that, when neither nouveau nor Nvidia graphics
+driver is used, the screen starts flickering. And, after comparing
+between the working case (stable 4.4.x) and the broken case, it turned
+out that the problem comes from the audio component binding. The
+Nvidia and AMD audio binding code clears the bus->keep_power flag
+whenever snd_hdac_acomp_init() succeeds. But this doesn't mean that
+the component is actually bound, but it merely indicates that it's
+ready for binding. So, when both nouveau and Nvidia are blacklisted
+or not ready, the driver keeps running without the audio component but
+also with bus->keep_power = false. This made the driver runtime PM
+kicked in and powering down when unused, which results in flickering
+in the graphics side, as it seems.
+
+For fixing the bug, this patch moves the bus->keep_power flag change
+into generic_acomp_notifier_set() that is the function called from the
+master_bind callback of component ops; i.e. it's guaranteed that the
+binding succeeded.
+
+BugLink: https://bugzilla.kernel.org/show_bug.cgi?id=208609
+Fixes: 5a858e79c911 ("ALSA: hda - Disable audio component for legacy Nvidia HDMI codecs")
+Cc: <stable@vger.kernel.org>
+Link: https://lore.kernel.org/r/20200728082033.23933-1-tiwai@suse.de
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ sound/pci/hda/patch_hdmi.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/sound/pci/hda/patch_hdmi.c
++++ b/sound/pci/hda/patch_hdmi.c
+@@ -2483,6 +2483,7 @@ static void generic_acomp_notifier_set(s
+ mutex_lock(&spec->bind_lock);
+ spec->use_acomp_notifier = use_acomp;
+ spec->codec->relaxed_resume = use_acomp;
++ spec->codec->bus->keep_power = 0;
+ /* reprogram each jack detection logic depending on the notifier */
+ if (spec->use_jack_detect) {
+ for (i = 0; i < spec->num_pins; i++)
+@@ -2578,7 +2579,6 @@ static void generic_acomp_init(struct hd
+ if (!snd_hdac_acomp_init(&codec->bus->core, &spec->drm_audio_ops,
+ match_bound_vga, 0)) {
+ spec->acomp_registered = true;
+- codec->bus->keep_power = 0;
+ }
+ }
+
--- /dev/null
+From 4b43d05a1978a93a19374c6e6b817c9c1ff4ba4b Mon Sep 17 00:00:00 2001
+From: Armas Spann <zappel@retarded.farm>
+Date: Fri, 24 Jul 2020 16:06:16 +0200
+Subject: ALSA: hda/realtek: enable headset mic of ASUS ROG Zephyrus G15(GA502) series with ALC289
+
+From: Armas Spann <zappel@retarded.farm>
+
+commit 4b43d05a1978a93a19374c6e6b817c9c1ff4ba4b upstream.
+
+This patch adds support for headset mic to the ASUS ROG Zephyrus
+G15(GA502) notebook series by adding the corresponding
+vendor/pci_device id, as well as adding a new fixup for the used
+realtek ALC289. The fixup stets the correct pin to get the headset mic
+correctly recognized on audio-jack.
+
+Signed-off-by: Armas Spann <zappel@retarded.farm>
+Cc: <stable@vger.kernel.org>
+Link: https://lore.kernel.org/r/20200724140616.298892-1-zappel@retarded.farm
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ sound/pci/hda/patch_realtek.c | 9 +++++++++
+ 1 file changed, 9 insertions(+)
+
+--- a/sound/pci/hda/patch_realtek.c
++++ b/sound/pci/hda/patch_realtek.c
+@@ -6118,6 +6118,7 @@ enum {
+ ALC269VC_FIXUP_ACER_HEADSET_MIC,
+ ALC269VC_FIXUP_ACER_MIC_NO_PRESENCE,
+ ALC289_FIXUP_ASUS_G401,
++ ALC289_FIXUP_ASUS_GA502,
+ ALC256_FIXUP_ACER_MIC_NO_PRESENCE,
+ };
+
+@@ -7335,6 +7336,13 @@ static const struct hda_fixup alc269_fix
+ { }
+ },
+ },
++ [ALC289_FIXUP_ASUS_GA502] = {
++ .type = HDA_FIXUP_PINS,
++ .v.pins = (const struct hda_pintbl[]) {
++ { 0x19, 0x03a11020 }, /* headset mic with jack detect */
++ { }
++ },
++ },
+ [ALC256_FIXUP_ACER_MIC_NO_PRESENCE] = {
+ .type = HDA_FIXUP_PINS,
+ .v.pins = (const struct hda_pintbl[]) {
+@@ -7526,6 +7534,7 @@ static const struct snd_pci_quirk alc269
+ SND_PCI_QUIRK(0x1043, 0x1bbd, "ASUS Z550MA", ALC255_FIXUP_ASUS_MIC_NO_PRESENCE),
+ SND_PCI_QUIRK(0x1043, 0x1c23, "Asus X55U", ALC269_FIXUP_LIMIT_INT_MIC_BOOST),
+ SND_PCI_QUIRK(0x1043, 0x1ccd, "ASUS X555UB", ALC256_FIXUP_ASUS_MIC),
++ SND_PCI_QUIRK(0x1043, 0x1e11, "ASUS Zephyrus G15", ALC289_FIXUP_ASUS_GA502),
+ SND_PCI_QUIRK(0x1043, 0x1f11, "ASUS Zephyrus G14", ALC289_FIXUP_ASUS_G401),
+ SND_PCI_QUIRK(0x1043, 0x3030, "ASUS ZN270IE", ALC256_FIXUP_ASUS_AIO_GPIO2),
+ SND_PCI_QUIRK(0x1043, 0x831a, "ASUS P901", ALC269_FIXUP_STEREO_DMIC),
--- /dev/null
+From 6fa38ef1534e7e9320aa15e329eb1404ab2f70ac Mon Sep 17 00:00:00 2001
+From: PeiSen Hou <pshou@realtek.com>
+Date: Mon, 27 Jul 2020 13:56:47 +0200
+Subject: ALSA: hda/realtek: Fix add a "ultra_low_power" function for intel reference board (alc256)
+
+From: PeiSen Hou <pshou@realtek.com>
+
+commit 6fa38ef1534e7e9320aa15e329eb1404ab2f70ac upstream.
+
+Intel requires to enable power saving mode for intel reference board (alc256)
+
+Signed-off-by: PeiSen Hou <pshou@realtek.com>
+Cc: <stable@vger.kernel.org>
+Link: https://lore.kernel.org/r/20200727115647.10967-1-tiwai@suse.de
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ sound/pci/hda/patch_realtek.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/sound/pci/hda/patch_realtek.c
++++ b/sound/pci/hda/patch_realtek.c
+@@ -7555,7 +7555,7 @@ static const struct snd_pci_quirk alc269
+ SND_PCI_QUIRK(0x10cf, 0x1629, "Lifebook U7x7", ALC255_FIXUP_LIFEBOOK_U7x7_HEADSET_MIC),
+ SND_PCI_QUIRK(0x10cf, 0x1845, "Lifebook U904", ALC269_FIXUP_LIFEBOOK_EXTMIC),
+ SND_PCI_QUIRK(0x10ec, 0x10f2, "Intel Reference board", ALC700_FIXUP_INTEL_REFERENCE),
+- SND_PCI_QUIRK(0x10ec, 0x1230, "Intel Reference board", ALC225_FIXUP_HEADSET_JACK),
++ SND_PCI_QUIRK(0x10ec, 0x1230, "Intel Reference board", ALC295_FIXUP_CHROME_BOOK),
+ SND_PCI_QUIRK(0x10f7, 0x8338, "Panasonic CF-SZ6", ALC269_FIXUP_HEADSET_MODE),
+ SND_PCI_QUIRK(0x144d, 0xc109, "Samsung Ativ book 9 (NP900X3G)", ALC269_FIXUP_INV_DMIC),
+ SND_PCI_QUIRK(0x144d, 0xc169, "Samsung Notebook 9 Pen (NP930SBE-K01US)", ALC298_FIXUP_SAMSUNG_HEADPHONE_VERY_QUIET),
--- /dev/null
+From 5649625344fe1f4695eace7c37d011e317bf66d5 Mon Sep 17 00:00:00 2001
+From: Kailang Yang <kailang@realtek.com>
+Date: Wed, 29 Jul 2020 15:09:27 +0800
+Subject: ALSA: hda/realtek - Fixed HP right speaker no sound
+
+From: Kailang Yang <kailang@realtek.com>
+
+commit 5649625344fe1f4695eace7c37d011e317bf66d5 upstream.
+
+HP NB right speaker had no sound output.
+This platform was connected to I2S Amp for speaker out.(None Realtek I2S Amp IC)
+EC need to check codec GPIO1 pin to initial I2S Amp.
+
+Signed-off-by: Kailang Yang <kailang@realtek.com>
+Cc: <stable@vger.kernel.org>
+Link: https://lore.kernel.org/r/01285f623ac7447187482fb4a8ecaa7c@realtek.com
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ sound/pci/hda/patch_realtek.c | 19 ++++++++++++++++++-
+ 1 file changed, 18 insertions(+), 1 deletion(-)
+
+--- a/sound/pci/hda/patch_realtek.c
++++ b/sound/pci/hda/patch_realtek.c
+@@ -5940,6 +5940,16 @@ static void alc_fixup_disable_mic_vref(s
+ snd_hda_codec_set_pin_target(codec, 0x19, PIN_VREFHIZ);
+ }
+
++static void alc285_fixup_hp_gpio_amp_init(struct hda_codec *codec,
++ const struct hda_fixup *fix, int action)
++{
++ if (action != HDA_FIXUP_ACT_INIT)
++ return;
++
++ msleep(100);
++ alc_write_coef_idx(codec, 0x65, 0x0);
++}
++
+ /* for hda_fixup_thinkpad_acpi() */
+ #include "thinkpad_helper.c"
+
+@@ -6120,6 +6130,7 @@ enum {
+ ALC289_FIXUP_ASUS_GA401,
+ ALC289_FIXUP_ASUS_GA502,
+ ALC256_FIXUP_ACER_MIC_NO_PRESENCE,
++ ALC285_FIXUP_HP_GPIO_AMP_INIT,
+ };
+
+ static const struct hda_fixup alc269_fixups[] = {
+@@ -7352,6 +7363,12 @@ static const struct hda_fixup alc269_fix
+ .chained = true,
+ .chain_id = ALC256_FIXUP_ASUS_HEADSET_MODE
+ },
++ [ALC285_FIXUP_HP_GPIO_AMP_INIT] = {
++ .type = HDA_FIXUP_FUNC,
++ .v.func = alc285_fixup_hp_gpio_amp_init,
++ .chained = true,
++ .chain_id = ALC285_FIXUP_HP_GPIO_LED
++ },
+ };
+
+ static const struct snd_pci_quirk alc269_fixup_tbl[] = {
+@@ -7502,7 +7519,7 @@ static const struct snd_pci_quirk alc269
+ SND_PCI_QUIRK(0x103c, 0x84e7, "HP Pavilion 15", ALC269_FIXUP_HP_MUTE_LED_MIC3),
+ SND_PCI_QUIRK(0x103c, 0x869d, "HP", ALC236_FIXUP_HP_MUTE_LED),
+ SND_PCI_QUIRK(0x103c, 0x8729, "HP", ALC285_FIXUP_HP_GPIO_LED),
+- SND_PCI_QUIRK(0x103c, 0x8736, "HP", ALC285_FIXUP_HP_GPIO_LED),
++ SND_PCI_QUIRK(0x103c, 0x8736, "HP", ALC285_FIXUP_HP_GPIO_AMP_INIT),
+ SND_PCI_QUIRK(0x103c, 0x877a, "HP", ALC285_FIXUP_HP_MUTE_LED),
+ SND_PCI_QUIRK(0x103c, 0x877d, "HP", ALC236_FIXUP_HP_MUTE_LED),
+ SND_PCI_QUIRK(0x1043, 0x103e, "ASUS X540SA", ALC256_FIXUP_ASUS_MIC),
--- /dev/null
+From 293a92c1d9913248b9987b68f3a5d6d2f0aae62b Mon Sep 17 00:00:00 2001
+From: Armas Spann <zappel@retarded.farm>
+Date: Fri, 24 Jul 2020 16:08:37 +0200
+Subject: ALSA: hda/realtek: typo_fix: enable headset mic of ASUS ROG Zephyrus G14(GA401) series with ALC289
+
+From: Armas Spann <zappel@retarded.farm>
+
+commit 293a92c1d9913248b9987b68f3a5d6d2f0aae62b upstream.
+
+This patch fixes a small typo I accidently submitted with the initial patch. The board should be named GA401 not G401.
+
+Fixes: ff53664daff2 ("ALSA: hda/realtek: enable headset mic of ASUS ROG Zephyrus G14(G401) series with ALC289")
+Signed-off-by: Armas Spann <zappel@retarded.farm>
+Cc: <stable@vger.kernel.org>
+Link: https://lore.kernel.org/r/20200724140837.302763-1-zappel@retarded.farm
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ sound/pci/hda/patch_realtek.c | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+--- a/sound/pci/hda/patch_realtek.c
++++ b/sound/pci/hda/patch_realtek.c
+@@ -6117,7 +6117,7 @@ enum {
+ ALC269VC_FIXUP_ACER_VCOPPERBOX_PINS,
+ ALC269VC_FIXUP_ACER_HEADSET_MIC,
+ ALC269VC_FIXUP_ACER_MIC_NO_PRESENCE,
+- ALC289_FIXUP_ASUS_G401,
++ ALC289_FIXUP_ASUS_GA401,
+ ALC289_FIXUP_ASUS_GA502,
+ ALC256_FIXUP_ACER_MIC_NO_PRESENCE,
+ };
+@@ -7329,7 +7329,7 @@ static const struct hda_fixup alc269_fix
+ .chained = true,
+ .chain_id = ALC269_FIXUP_HEADSET_MIC
+ },
+- [ALC289_FIXUP_ASUS_G401] = {
++ [ALC289_FIXUP_ASUS_GA401] = {
+ .type = HDA_FIXUP_PINS,
+ .v.pins = (const struct hda_pintbl[]) {
+ { 0x19, 0x03a11020 }, /* headset mic with jack detect */
+@@ -7535,7 +7535,7 @@ static const struct snd_pci_quirk alc269
+ SND_PCI_QUIRK(0x1043, 0x1c23, "Asus X55U", ALC269_FIXUP_LIMIT_INT_MIC_BOOST),
+ SND_PCI_QUIRK(0x1043, 0x1ccd, "ASUS X555UB", ALC256_FIXUP_ASUS_MIC),
+ SND_PCI_QUIRK(0x1043, 0x1e11, "ASUS Zephyrus G15", ALC289_FIXUP_ASUS_GA502),
+- SND_PCI_QUIRK(0x1043, 0x1f11, "ASUS Zephyrus G14", ALC289_FIXUP_ASUS_G401),
++ SND_PCI_QUIRK(0x1043, 0x1f11, "ASUS Zephyrus G14", ALC289_FIXUP_ASUS_GA401),
+ SND_PCI_QUIRK(0x1043, 0x3030, "ASUS ZN270IE", ALC256_FIXUP_ASUS_AIO_GPIO2),
+ SND_PCI_QUIRK(0x1043, 0x831a, "ASUS P901", ALC269_FIXUP_STEREO_DMIC),
+ SND_PCI_QUIRK(0x1043, 0x834a, "ASUS S101", ALC269_FIXUP_STEREO_DMIC),
--- /dev/null
+From 3da87ec67a491b9633a82045896c076b794bf938 Mon Sep 17 00:00:00 2001
+From: Laurence Tratt <laurie@tratt.net>
+Date: Sun, 21 Jun 2020 08:50:05 +0100
+Subject: ALSA: usb-audio: Add implicit feedback quirk for SSL2
+
+From: Laurence Tratt <laurie@tratt.net>
+
+commit 3da87ec67a491b9633a82045896c076b794bf938 upstream.
+
+As expected, this requires the same quirk as the SSL2+ in order for the
+clock to sync. This was suggested by, and tested on an SSL2, by Dmitry.
+
+Suggested-by: Dmitry <dpavlushko@gmail.com>
+Signed-off-by: Laurence Tratt <laurie@tratt.net>
+Cc: <stable@vger.kernel.org>
+Link: https://lore.kernel.org/r/20200621075005.52mjjfc6dtdjnr3h@overdrive.tratt.net
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ sound/usb/pcm.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/sound/usb/pcm.c
++++ b/sound/usb/pcm.c
+@@ -354,6 +354,7 @@ static int set_sync_ep_implicit_fb_quirk
+ ifnum = 0;
+ goto add_sync_ep_from_ifnum;
+ case USB_ID(0x07fd, 0x0008): /* MOTU M Series */
++ case USB_ID(0x31e9, 0x0001): /* Solid State Logic SSL2 */
+ case USB_ID(0x31e9, 0x0002): /* Solid State Logic SSL2+ */
+ case USB_ID(0x0d9a, 0x00df): /* RTX6001 */
+ ep = 0x81;
--- /dev/null
+From 54a485e9ec084da1a4b32dcf7749c7d760ed8aa5 Mon Sep 17 00:00:00 2001
+From: Mike Marciniszyn <mike.marciniszyn@intel.com>
+Date: Tue, 28 Jul 2020 14:38:48 -0400
+Subject: IB/rdmavt: Fix RQ counting issues causing use of an invalid RWQE
+
+From: Mike Marciniszyn <mike.marciniszyn@intel.com>
+
+commit 54a485e9ec084da1a4b32dcf7749c7d760ed8aa5 upstream.
+
+The lookaside count is improperly initialized to the size of the
+Receive Queue with the additional +1. In the traces below, the
+RQ size is 384, so the count was set to 385.
+
+The lookaside count is then rarely refreshed. Note the high and
+incorrect count in the trace below:
+
+rvt_get_rwqe: [hfi1_0] wqe ffffc900078e9008 wr_id 55c7206d75a0 qpn c
+ qpt 2 pid 3018 num_sge 1 head 1 tail 0, count 385
+rvt_get_rwqe: (hfi1_rc_rcv+0x4eb/0x1480 [hfi1] <- rvt_get_rwqe) ret=0x1
+
+The head,tail indicate there is only one RWQE posted although the count
+says 385 and we correctly return the element 0.
+
+The next call to rvt_get_rwqe with the decremented count:
+
+rvt_get_rwqe: [hfi1_0] wqe ffffc900078e9058 wr_id 0 qpn c
+ qpt 2 pid 3018 num_sge 0 head 1 tail 1, count 384
+rvt_get_rwqe: (hfi1_rc_rcv+0x4eb/0x1480 [hfi1] <- rvt_get_rwqe) ret=0x1
+
+Note that the RQ is empty (head == tail) yet we return the RWQE at tail 1,
+which is not valid because of the bogus high count.
+
+Best case, the RWQE has never been posted and the rc logic sees an RWQE
+that is too small (all zeros) and puts the QP into an error state.
+
+In the worst case, a server slow at posting receive buffers might fool
+rvt_get_rwqe() into fetching an old RWQE and corrupt memory.
+
+Fix by deleting the faulty initialization code and creating an
+inline to fetch the posted count and convert all callers to use
+new inline.
+
+Fixes: f592ae3c999f ("IB/rdmavt: Fracture single lock used for posting and processing RWQEs")
+Link: https://lore.kernel.org/r/20200728183848.22226.29132.stgit@awfm-01.aw.intel.com
+Reported-by: Zhaojuan Guo <zguo@redhat.com>
+Cc: <stable@vger.kernel.org> # 5.4.x
+Reviewed-by: Kaike Wan <kaike.wan@intel.com>
+Signed-off-by: Mike Marciniszyn <mike.marciniszyn@intel.com>
+Tested-by: Honggang Li <honli@redhat.com>
+Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/infiniband/sw/rdmavt/qp.c | 33 ++++-----------------------------
+ drivers/infiniband/sw/rdmavt/rc.c | 4 +---
+ include/rdma/rdmavt_qp.h | 19 +++++++++++++++++++
+ 3 files changed, 24 insertions(+), 32 deletions(-)
+
+--- a/drivers/infiniband/sw/rdmavt/qp.c
++++ b/drivers/infiniband/sw/rdmavt/qp.c
+@@ -898,8 +898,6 @@ static void rvt_init_qp(struct rvt_dev_i
+ qp->s_tail_ack_queue = 0;
+ qp->s_acked_ack_queue = 0;
+ qp->s_num_rd_atomic = 0;
+- if (qp->r_rq.kwq)
+- qp->r_rq.kwq->count = qp->r_rq.size;
+ qp->r_sge.num_sge = 0;
+ atomic_set(&qp->s_reserved_used, 0);
+ }
+@@ -2353,31 +2351,6 @@ bad_lkey:
+ }
+
+ /**
+- * get_count - count numbers of request work queue entries
+- * in circular buffer
+- * @rq: data structure for request queue entry
+- * @tail: tail indices of the circular buffer
+- * @head: head indices of the circular buffer
+- *
+- * Return - total number of entries in the circular buffer
+- */
+-static u32 get_count(struct rvt_rq *rq, u32 tail, u32 head)
+-{
+- u32 count;
+-
+- count = head;
+-
+- if (count >= rq->size)
+- count = 0;
+- if (count < tail)
+- count += rq->size - tail;
+- else
+- count -= tail;
+-
+- return count;
+-}
+-
+-/**
+ * get_rvt_head - get head indices of the circular buffer
+ * @rq: data structure for request queue entry
+ * @ip: the QP
+@@ -2451,7 +2424,7 @@ int rvt_get_rwqe(struct rvt_qp *qp, bool
+
+ if (kwq->count < RVT_RWQ_COUNT_THRESHOLD) {
+ head = get_rvt_head(rq, ip);
+- kwq->count = get_count(rq, tail, head);
++ kwq->count = rvt_get_rq_count(rq, head, tail);
+ }
+ if (unlikely(kwq->count == 0)) {
+ ret = 0;
+@@ -2486,7 +2459,9 @@ int rvt_get_rwqe(struct rvt_qp *qp, bool
+ * the number of remaining WQEs.
+ */
+ if (kwq->count < srq->limit) {
+- kwq->count = get_count(rq, tail, get_rvt_head(rq, ip));
++ kwq->count =
++ rvt_get_rq_count(rq,
++ get_rvt_head(rq, ip), tail);
+ if (kwq->count < srq->limit) {
+ struct ib_event ev;
+
+--- a/drivers/infiniband/sw/rdmavt/rc.c
++++ b/drivers/infiniband/sw/rdmavt/rc.c
+@@ -127,9 +127,7 @@ __be32 rvt_compute_aeth(struct rvt_qp *q
+ * not atomic, which is OK, since the fuzziness is
+ * resolved as further ACKs go out.
+ */
+- credits = head - tail;
+- if ((int)credits < 0)
+- credits += qp->r_rq.size;
++ credits = rvt_get_rq_count(&qp->r_rq, head, tail);
+ }
+ /*
+ * Binary search the credit table to find the code to
+--- a/include/rdma/rdmavt_qp.h
++++ b/include/rdma/rdmavt_qp.h
+@@ -278,6 +278,25 @@ struct rvt_rq {
+ spinlock_t lock ____cacheline_aligned_in_smp;
+ };
+
++/**
++ * rvt_get_rq_count - count numbers of request work queue entries
++ * in circular buffer
++ * @rq: data structure for request queue entry
++ * @head: head indices of the circular buffer
++ * @tail: tail indices of the circular buffer
++ *
++ * Return - total number of entries in the Receive Queue
++ */
++
++static inline u32 rvt_get_rq_count(struct rvt_rq *rq, u32 head, u32 tail)
++{
++ u32 count = head - tail;
++
++ if ((s32)count < 0)
++ count += rq->size;
++ return count;
++}
++
+ /*
+ * This structure holds the information that the send tasklet needs
+ * to send a RDMA read response or atomic operation.
ath10k-enable-transmit-data-ack-rssi-for-qca9884.patch
pci-aspm-disable-aspm-on-asmedia-asm1083-1085-pcie-to-pci-bridge.patch
mm-filemap.c-don-t-bother-dropping-mmap_sem-for-zero-size-readahead.patch
+alsa-usb-audio-add-implicit-feedback-quirk-for-ssl2.patch
+alsa-hda-realtek-enable-headset-mic-of-asus-rog-zephyrus-g15-ga502-series-with-alc289.patch
+alsa-hda-realtek-typo_fix-enable-headset-mic-of-asus-rog-zephyrus-g14-ga401-series-with-alc289.patch
+alsa-hda-realtek-fix-add-a-ultra_low_power-function-for-intel-reference-board-alc256.patch
+alsa-hda-realtek-fixed-hp-right-speaker-no-sound.patch
+alsa-hda-hdmi-fix-keep_power-assignment-for-non-component-devices.patch
+ib-rdmavt-fix-rq-counting-issues-causing-use-of-an-invalid-rwqe.patch
+vhost-scsi-fix-up-req-type-endian-ness.patch
+9p-trans_fd-fix-concurrency-del-of-req_list-in-p9_fd_cancelled-p9_read_work.patch
--- /dev/null
+From 295c1b9852d000580786375304a9800bd9634d15 Mon Sep 17 00:00:00 2001
+From: "Michael S. Tsirkin" <mst@redhat.com>
+Date: Fri, 10 Jul 2020 06:36:16 -0400
+Subject: vhost/scsi: fix up req type endian-ness
+
+From: Michael S. Tsirkin <mst@redhat.com>
+
+commit 295c1b9852d000580786375304a9800bd9634d15 upstream.
+
+vhost/scsi doesn't handle type conversion correctly
+for request type when using virtio 1.0 and up for BE,
+or cross-endian platforms.
+
+Fix it up using vhost_32_to_cpu.
+
+Cc: stable@vger.kernel.org
+Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
+Acked-by: Jason Wang <jasowang@redhat.com>
+Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/vhost/scsi.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/vhost/scsi.c
++++ b/drivers/vhost/scsi.c
+@@ -1215,7 +1215,7 @@ vhost_scsi_ctl_handle_vq(struct vhost_sc
+ continue;
+ }
+
+- switch (v_req.type) {
++ switch (vhost32_to_cpu(vq, v_req.type)) {
+ case VIRTIO_SCSI_T_TMF:
+ vc.req = &v_req.tmf;
+ vc.req_size = sizeof(struct virtio_scsi_ctrl_tmf_req);
projects / thirdparty / kernel / stable-queue.git / commitdiff
