--- /dev/null
+From eb0bbba7636b9fc81939d6087a5fe575e150c95a Mon Sep 17 00:00:00 2001
+From: Marco Felsch <m.felsch@pengutronix.de>
+Date: Thu, 16 Jan 2020 15:01:08 +0100
+Subject: ARM: dts: imx6: phycore-som: fix emmc supply
+
+From: Marco Felsch <m.felsch@pengutronix.de>
+
+commit eb0bbba7636b9fc81939d6087a5fe575e150c95a upstream.
+
+Currently the vmmc is supplied by the 1.8V pmic rail but this is wrong.
+The default module behaviour is to power VCCQ and VCC by the 3.3V power
+rail. Optional the user can connect the VCCQ to the pmic 1.8V emmc
+power rail using a solder jumper.
+
+Fixes: ddec5d1c0047 ("ARM: dts: imx6: Add initial support for phyCORE-i.MX 6 SOM")
+Signed-off-by: Marco Felsch <m.felsch@pengutronix.de>
+Signed-off-by: Shawn Guo <shawnguo@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ arch/arm/boot/dts/imx6qdl-phytec-phycore-som.dtsi | 1 -
+ 1 file changed, 1 deletion(-)
+
+--- a/arch/arm/boot/dts/imx6qdl-phytec-phycore-som.dtsi
++++ b/arch/arm/boot/dts/imx6qdl-phytec-phycore-som.dtsi
+@@ -183,7 +183,6 @@
+ pinctrl-0 = <&pinctrl_usdhc4>;
+ bus-width = <8>;
+ non-removable;
+- vmmc-supply = <&vdd_emmc_1p8>;
+ status = "disabled";
+ };
+
--- /dev/null
+From 26c4b4758fce8f0ae744335e1762213be29db441 Mon Sep 17 00:00:00 2001
+From: Fabio Estevam <festevam@gmail.com>
+Date: Mon, 17 Feb 2020 16:15:03 -0300
+Subject: arm64: dts: imx8qxp-mek: Remove unexisting Ethernet PHY
+
+From: Fabio Estevam <festevam@gmail.com>
+
+commit 26c4b4758fce8f0ae744335e1762213be29db441 upstream.
+
+There is only on Ethernet port and one Ethernet PHY on imx8qxp-mek.
+
+Remove the unexisting ethphy1 port.
+
+This fixes a run-time warning:
+
+mdio_bus 5b040000.ethernet-1: MDIO device at address 1 is missing.
+
+Fixes: fdea904e85e1 ("arm64: dts: imx: add imx8qxp mek support")
+Signed-off-by: Fabio Estevam <festevam@gmail.com>
+Reviewed-by: Leonard Crestez <leonard.crestez@nxp.com>
+Signed-off-by: Shawn Guo <shawnguo@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ arch/arm64/boot/dts/freescale/imx8qxp-mek.dts | 5 -----
+ 1 file changed, 5 deletions(-)
+
+--- a/arch/arm64/boot/dts/freescale/imx8qxp-mek.dts
++++ b/arch/arm64/boot/dts/freescale/imx8qxp-mek.dts
+@@ -52,11 +52,6 @@
+ compatible = "ethernet-phy-ieee802.3-c22";
+ reg = <0>;
+ };
+-
+- ethphy1: ethernet-phy@1 {
+- compatible = "ethernet-phy-ieee802.3-c22";
+- reg = <1>;
+- };
+ };
+ };
+
--- /dev/null
+From 9b3193089e77d3b59b045146ff1c770dd899acb1 Mon Sep 17 00:00:00 2001
+From: Charles Keepax <ckeepax@opensource.cirrus.com>
+Date: Fri, 28 Feb 2020 15:31:45 +0000
+Subject: ASoC: dapm: Correct DAPM handling of active widgets during shutdown
+
+From: Charles Keepax <ckeepax@opensource.cirrus.com>
+
+commit 9b3193089e77d3b59b045146ff1c770dd899acb1 upstream.
+
+commit c2caa4da46a4 ("ASoC: Fix widget powerdown on shutdown") added a
+set of the power state during snd_soc_dapm_shutdown to ensure the
+widgets powered off. However, when commit 39eb5fd13dff
+("ASoC: dapm: Delay w->power update until the changes are written")
+added the new_power member of the widget structure, to differentiate
+between the current power state and the target power state, it did not
+update the shutdown to use the new_power member.
+
+As new_power has not updated it will be left in the state set by the
+last DAPM sequence, ie. 1 for active widgets. So as the DAPM sequence
+for the shutdown proceeds it will turn the widgets on (despite them
+already being on) rather than turning them off.
+
+Fixes: 39eb5fd13dff ("ASoC: dapm: Delay w->power update until the changes are written")
+Signed-off-by: Charles Keepax <ckeepax@opensource.cirrus.com>
+Link: https://lore.kernel.org/r/20200228153145.21013-1-ckeepax@opensource.cirrus.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ sound/soc/soc-dapm.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/sound/soc/soc-dapm.c
++++ b/sound/soc/soc-dapm.c
+@@ -4749,7 +4749,7 @@ static void soc_dapm_shutdown_dapm(struc
+ continue;
+ if (w->power) {
+ dapm_seq_insert(w, &down_list, false);
+- w->power = 0;
++ w->new_power = 0;
+ powerdown = 1;
+ }
+ }
--- /dev/null
+From 8308a09e87d2cb51adb186dc7d5a5c1913fb0758 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Amadeusz=20S=C5=82awi=C5=84ski?=
+ <amadeuszx.slawinski@linux.intel.com>
+Date: Mon, 24 Feb 2020 07:52:02 -0500
+Subject: ASoC: Intel: Skylake: Fix available clock counter incrementation
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Amadeusz Sławiński <amadeuszx.slawinski@linux.intel.com>
+
+commit 8308a09e87d2cb51adb186dc7d5a5c1913fb0758 upstream.
+
+Incrementation of avail_clk_cnt was incorrectly moved to error path. Put
+it back to success path.
+
+Fixes: 6ee927f2f01466 ('ASoC: Intel: Skylake: Fix NULL ptr dereference when unloading clk dev')
+Signed-off-by: Amadeusz Sławiński <amadeuszx.slawinski@linux.intel.com>
+Reviewed-by: Cezary Rojewski <cezary.rojewski@intel.com>
+Reviewed-by: Pierre-Louis Bossart <pierre-louis.bossart@linux.intel.com>
+Link: https://lore.kernel.org/r/20200224125202.13784-1-amadeuszx.slawinski@linux.intel.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ sound/soc/intel/skylake/skl-ssp-clk.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+--- a/sound/soc/intel/skylake/skl-ssp-clk.c
++++ b/sound/soc/intel/skylake/skl-ssp-clk.c
+@@ -384,9 +384,11 @@ static int skl_clk_dev_probe(struct plat
+ &clks[i], clk_pdata, i);
+
+ if (IS_ERR(data->clk[data->avail_clk_cnt])) {
+- ret = PTR_ERR(data->clk[data->avail_clk_cnt++]);
++ ret = PTR_ERR(data->clk[data->avail_clk_cnt]);
+ goto err_unreg_skl_clk;
+ }
++
++ data->avail_clk_cnt++;
+ }
+
+ platform_set_drvdata(pdev, data);
--- /dev/null
+From 6c89ffea60aa3b2a33ae7987de1e84bfb89e4c9e Mon Sep 17 00:00:00 2001
+From: Takashi Iwai <tiwai@suse.de>
+Date: Tue, 18 Feb 2020 12:17:37 +0100
+Subject: ASoC: pcm: Fix possible buffer overflow in dpcm state sysfs output
+
+From: Takashi Iwai <tiwai@suse.de>
+
+commit 6c89ffea60aa3b2a33ae7987de1e84bfb89e4c9e upstream.
+
+dpcm_show_state() invokes multiple snprintf() calls to concatenate
+formatted strings on the fixed size buffer. The usage of snprintf()
+is supposed for avoiding the buffer overflow, but it doesn't work as
+expected because snprintf() doesn't return the actual output size but
+the size to be written.
+
+Fix this bug by replacing all snprintf() calls with scnprintf()
+calls.
+
+Fixes: f86dcef87b77 ("ASoC: dpcm: Add debugFS support for DPCM")
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Acked-by: Cezary Rojewski <cezary.rojewski@intel.com>
+Link: https://lore.kernel.org/r/20200218111737.14193-4-tiwai@suse.de
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ sound/soc/soc-pcm.c | 16 ++++++++--------
+ 1 file changed, 8 insertions(+), 8 deletions(-)
+
+--- a/sound/soc/soc-pcm.c
++++ b/sound/soc/soc-pcm.c
+@@ -3192,16 +3192,16 @@ static ssize_t dpcm_show_state(struct sn
+ unsigned long flags;
+
+ /* FE state */
+- offset += snprintf(buf + offset, size - offset,
++ offset += scnprintf(buf + offset, size - offset,
+ "[%s - %s]\n", fe->dai_link->name,
+ stream ? "Capture" : "Playback");
+
+- offset += snprintf(buf + offset, size - offset, "State: %s\n",
++ offset += scnprintf(buf + offset, size - offset, "State: %s\n",
+ dpcm_state_string(fe->dpcm[stream].state));
+
+ if ((fe->dpcm[stream].state >= SND_SOC_DPCM_STATE_HW_PARAMS) &&
+ (fe->dpcm[stream].state <= SND_SOC_DPCM_STATE_STOP))
+- offset += snprintf(buf + offset, size - offset,
++ offset += scnprintf(buf + offset, size - offset,
+ "Hardware Params: "
+ "Format = %s, Channels = %d, Rate = %d\n",
+ snd_pcm_format_name(params_format(params)),
+@@ -3209,10 +3209,10 @@ static ssize_t dpcm_show_state(struct sn
+ params_rate(params));
+
+ /* BEs state */
+- offset += snprintf(buf + offset, size - offset, "Backends:\n");
++ offset += scnprintf(buf + offset, size - offset, "Backends:\n");
+
+ if (list_empty(&fe->dpcm[stream].be_clients)) {
+- offset += snprintf(buf + offset, size - offset,
++ offset += scnprintf(buf + offset, size - offset,
+ " No active DSP links\n");
+ goto out;
+ }
+@@ -3222,16 +3222,16 @@ static ssize_t dpcm_show_state(struct sn
+ struct snd_soc_pcm_runtime *be = dpcm->be;
+ params = &dpcm->hw_params;
+
+- offset += snprintf(buf + offset, size - offset,
++ offset += scnprintf(buf + offset, size - offset,
+ "- %s\n", be->dai_link->name);
+
+- offset += snprintf(buf + offset, size - offset,
++ offset += scnprintf(buf + offset, size - offset,
+ " State: %s\n",
+ dpcm_state_string(be->dpcm[stream].state));
+
+ if ((be->dpcm[stream].state >= SND_SOC_DPCM_STATE_HW_PARAMS) &&
+ (be->dpcm[stream].state <= SND_SOC_DPCM_STATE_STOP))
+- offset += snprintf(buf + offset, size - offset,
++ offset += scnprintf(buf + offset, size - offset,
+ " Hardware Params: "
+ "Format = %s, Channels = %d, Rate = %d\n",
+ snd_pcm_format_name(params_format(params)),
--- /dev/null
+From ac0a68997935c4acb92eaae5ad8982e0bb432d56 Mon Sep 17 00:00:00 2001
+From: Matthias Reichl <hias@horus.com>
+Date: Thu, 20 Feb 2020 21:29:56 +0100
+Subject: ASoC: pcm512x: Fix unbalanced regulator enable call in probe error path
+
+From: Matthias Reichl <hias@horus.com>
+
+commit ac0a68997935c4acb92eaae5ad8982e0bb432d56 upstream.
+
+When we get a clock error during probe we have to call
+regulator_bulk_disable before bailing out, otherwise we trigger
+a warning in regulator_put.
+
+Fix this by using "goto err" like in the error cases above.
+
+Fixes: 5a3af1293194d ("ASoC: pcm512x: Add PCM512x driver")
+Signed-off-by: Matthias Reichl <hias@horus.com>
+Reviewed-by: Pierre-Louis Bossart <pierre-louis.bossart@linux.intel.com>
+Link: https://lore.kernel.org/r/20200220202956.29233-1-hias@horus.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ sound/soc/codecs/pcm512x.c | 8 +++++---
+ 1 file changed, 5 insertions(+), 3 deletions(-)
+
+--- a/sound/soc/codecs/pcm512x.c
++++ b/sound/soc/codecs/pcm512x.c
+@@ -1564,13 +1564,15 @@ int pcm512x_probe(struct device *dev, st
+ }
+
+ pcm512x->sclk = devm_clk_get(dev, NULL);
+- if (PTR_ERR(pcm512x->sclk) == -EPROBE_DEFER)
+- return -EPROBE_DEFER;
++ if (PTR_ERR(pcm512x->sclk) == -EPROBE_DEFER) {
++ ret = -EPROBE_DEFER;
++ goto err;
++ }
+ if (!IS_ERR(pcm512x->sclk)) {
+ ret = clk_prepare_enable(pcm512x->sclk);
+ if (ret != 0) {
+ dev_err(dev, "Failed to enable SCLK: %d\n", ret);
+- return ret;
++ goto err;
+ }
+ }
+
--- /dev/null
+From f1861a7c58ba1ba43c7adff6909d9a920338e4a8 Mon Sep 17 00:00:00 2001
+From: Kuninori Morimoto <kuninori.morimoto.gx@renesas.com>
+Date: Fri, 28 Feb 2020 10:48:35 +0900
+Subject: ASoC: soc-component: tidyup snd_soc_pcm_component_sync_stop()
+
+From: Kuninori Morimoto <kuninori.morimoto.gx@renesas.com>
+
+commit f1861a7c58ba1ba43c7adff6909d9a920338e4a8 upstream.
+
+commit 1e5ddb6ba73894 ("ASoC: component: Add sync_stop PCM ops")
+added snd_soc_pcm_component_sync_stop(), but it is checking
+ioctrl instead of sync_stop. This is bug.
+This patch fixup it.
+
+Fixes: commit 1e5ddb6ba73894 ("ASoC: component: Add sync_stop PCM ops")
+Signed-off-by: Kuninori Morimoto <kuninori.morimoto.gx@renesas.com>
+Cc: Takashi Iwai <tiwai@suse.de>
+Link: https://lore.kernel.org/r/8736av7a8c.wl-kuninori.morimoto.gx@renesas.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ sound/soc/soc-component.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/sound/soc/soc-component.c
++++ b/sound/soc/soc-component.c
+@@ -452,7 +452,7 @@ int snd_soc_pcm_component_sync_stop(stru
+ int ret;
+
+ for_each_rtd_components(rtd, rtdcom, component) {
+- if (component->driver->ioctl) {
++ if (component->driver->sync_stop) {
+ ret = component->driver->sync_stop(component,
+ substream);
+ if (ret < 0)
--- /dev/null
+From 08f56f8f3799b2ed1c5ac7eed6d86a4926289655 Mon Sep 17 00:00:00 2001
+From: Chris Wilson <chris@chris-wilson.co.uk>
+Date: Mon, 2 Mar 2020 08:57:57 +0000
+Subject: drm/i915/perf: Reintroduce wait on OA configuration completion
+
+From: Chris Wilson <chris@chris-wilson.co.uk>
+
+commit 08f56f8f3799b2ed1c5ac7eed6d86a4926289655 upstream.
+
+We still need to wait for the initial OA configuration to happen
+before we enable OA report writes to the OA buffer.
+
+Reported-by: Lionel Landwerlin <lionel.g.landwerlin@intel.com>
+Fixes: 15d0ace1f876 ("drm/i915/perf: execute OA configuration from command stream")
+Closes: https://gitlab.freedesktop.org/drm/intel/issues/1356
+Testcase: igt/perf/stream-open-close
+Signed-off-by: Chris Wilson <chris@chris-wilson.co.uk>
+Cc: Lionel Landwerlin <lionel.g.landwerlin@intel.com>
+Reviewed-by: Lionel Landwerlin <lionel.g.landwerlin@intel.com>
+Link: https://patchwork.freedesktop.org/patch/msgid/20200302085812.4172450-7-chris@chris-wilson.co.uk
+(cherry picked from commit 4b4e973d5eb89244b67d3223b60f752d0479f253)
+Signed-off-by: Jani Nikula <jani.nikula@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/gpu/drm/i915/i915_perf.c | 58 +++++++++++++++++++++++----------
+ drivers/gpu/drm/i915/i915_perf_types.h | 3 +
+ 2 files changed, 43 insertions(+), 18 deletions(-)
+
+--- a/drivers/gpu/drm/i915/i915_perf.c
++++ b/drivers/gpu/drm/i915/i915_perf.c
+@@ -1950,9 +1950,10 @@ out:
+ return i915_vma_get(oa_bo->vma);
+ }
+
+-static int emit_oa_config(struct i915_perf_stream *stream,
+- struct i915_oa_config *oa_config,
+- struct intel_context *ce)
++static struct i915_request *
++emit_oa_config(struct i915_perf_stream *stream,
++ struct i915_oa_config *oa_config,
++ struct intel_context *ce)
+ {
+ struct i915_request *rq;
+ struct i915_vma *vma;
+@@ -1960,7 +1961,7 @@ static int emit_oa_config(struct i915_pe
+
+ vma = get_oa_vma(stream, oa_config);
+ if (IS_ERR(vma))
+- return PTR_ERR(vma);
++ return ERR_CAST(vma);
+
+ err = i915_vma_pin(vma, 0, 0, PIN_GLOBAL | PIN_HIGH);
+ if (err)
+@@ -1983,13 +1984,17 @@ static int emit_oa_config(struct i915_pe
+ err = rq->engine->emit_bb_start(rq,
+ vma->node.start, 0,
+ I915_DISPATCH_SECURE);
++ if (err)
++ goto err_add_request;
++
++ i915_request_get(rq);
+ err_add_request:
+ i915_request_add(rq);
+ err_vma_unpin:
+ i915_vma_unpin(vma);
+ err_vma_put:
+ i915_vma_put(vma);
+- return err;
++ return err ? ERR_PTR(err) : rq;
+ }
+
+ static struct intel_context *oa_context(struct i915_perf_stream *stream)
+@@ -1997,7 +2002,8 @@ static struct intel_context *oa_context(
+ return stream->pinned_ctx ?: stream->engine->kernel_context;
+ }
+
+-static int hsw_enable_metric_set(struct i915_perf_stream *stream)
++static struct i915_request *
++hsw_enable_metric_set(struct i915_perf_stream *stream)
+ {
+ struct intel_uncore *uncore = stream->uncore;
+
+@@ -2408,7 +2414,8 @@ static int lrc_configure_all_contexts(st
+ return oa_configure_all_contexts(stream, regs, ARRAY_SIZE(regs));
+ }
+
+-static int gen8_enable_metric_set(struct i915_perf_stream *stream)
++static struct i915_request *
++gen8_enable_metric_set(struct i915_perf_stream *stream)
+ {
+ struct intel_uncore *uncore = stream->uncore;
+ struct i915_oa_config *oa_config = stream->oa_config;
+@@ -2450,12 +2457,13 @@ static int gen8_enable_metric_set(struct
+ */
+ ret = lrc_configure_all_contexts(stream, oa_config);
+ if (ret)
+- return ret;
++ return ERR_PTR(ret);
+
+ return emit_oa_config(stream, oa_config, oa_context(stream));
+ }
+
+-static int gen12_enable_metric_set(struct i915_perf_stream *stream)
++static struct i915_request *
++gen12_enable_metric_set(struct i915_perf_stream *stream)
+ {
+ struct intel_uncore *uncore = stream->uncore;
+ struct i915_oa_config *oa_config = stream->oa_config;
+@@ -2488,7 +2496,7 @@ static int gen12_enable_metric_set(struc
+ */
+ ret = gen12_configure_all_contexts(stream, oa_config);
+ if (ret)
+- return ret;
++ return ERR_PTR(ret);
+
+ /*
+ * For Gen12, performance counters are context
+@@ -2498,7 +2506,7 @@ static int gen12_enable_metric_set(struc
+ if (stream->ctx) {
+ ret = gen12_configure_oar_context(stream, true);
+ if (ret)
+- return ret;
++ return ERR_PTR(ret);
+ }
+
+ return emit_oa_config(stream, oa_config, oa_context(stream));
+@@ -2693,6 +2701,20 @@ static const struct i915_perf_stream_ops
+ .read = i915_oa_read,
+ };
+
++static int i915_perf_stream_enable_sync(struct i915_perf_stream *stream)
++{
++ struct i915_request *rq;
++
++ rq = stream->perf->ops.enable_metric_set(stream);
++ if (IS_ERR(rq))
++ return PTR_ERR(rq);
++
++ i915_request_wait(rq, 0, MAX_SCHEDULE_TIMEOUT);
++ i915_request_put(rq);
++
++ return 0;
++}
++
+ /**
+ * i915_oa_stream_init - validate combined props for OA stream and init
+ * @stream: An i915 perf stream
+@@ -2826,7 +2848,7 @@ static int i915_oa_stream_init(struct i9
+ stream->ops = &i915_oa_stream_ops;
+ perf->exclusive_stream = stream;
+
+- ret = perf->ops.enable_metric_set(stream);
++ ret = i915_perf_stream_enable_sync(stream);
+ if (ret) {
+ DRM_DEBUG("Unable to enable metric set\n");
+ goto err_enable;
+@@ -3144,7 +3166,7 @@ static long i915_perf_config_locked(stru
+ return -EINVAL;
+
+ if (config != stream->oa_config) {
+- int err;
++ struct i915_request *rq;
+
+ /*
+ * If OA is bound to a specific context, emit the
+@@ -3155,11 +3177,13 @@ static long i915_perf_config_locked(stru
+ * When set globally, we use a low priority kernel context,
+ * so it will effectively take effect when idle.
+ */
+- err = emit_oa_config(stream, config, oa_context(stream));
+- if (err == 0)
++ rq = emit_oa_config(stream, config, oa_context(stream));
++ if (!IS_ERR(rq)) {
+ config = xchg(&stream->oa_config, config);
+- else
+- ret = err;
++ i915_request_put(rq);
++ } else {
++ ret = PTR_ERR(rq);
++ }
+ }
+
+ i915_oa_config_put(config);
+--- a/drivers/gpu/drm/i915/i915_perf_types.h
++++ b/drivers/gpu/drm/i915/i915_perf_types.h
+@@ -339,7 +339,8 @@ struct i915_oa_ops {
+ * counter reports being sampled. May apply system constraints such as
+ * disabling EU clock gating as required.
+ */
+- int (*enable_metric_set)(struct i915_perf_stream *stream);
++ struct i915_request *
++ (*enable_metric_set)(struct i915_perf_stream *stream);
+
+ /**
+ * @disable_metric_set: Remove system constraints associated with using
--- /dev/null
+From c725161924f9a5872a3e53b73345a6026a5c170e Mon Sep 17 00:00:00 2001
+From: Matt Roper <matthew.d.roper@intel.com>
+Date: Thu, 27 Feb 2020 16:43:19 -0800
+Subject: drm/i915: Program MBUS with rmw during initialization
+
+From: Matt Roper <matthew.d.roper@intel.com>
+
+commit c725161924f9a5872a3e53b73345a6026a5c170e upstream.
+
+It wasn't terribly clear from the bspec's wording, but after discussion
+with the hardware folks, it turns out that we need to preserve the
+pre-existing contents of the MBUS ABOX control register when
+initializing a few specific bits.
+
+Bspec: 49213
+Bspec: 50096
+Fixes: 4cb4585e5a7f ("drm/i915/icl: initialize MBus during display init")
+Cc: Stanislav Lisovskiy <stanislav.lisovskiy@intel.com>
+Signed-off-by: Matt Roper <matthew.d.roper@intel.com>
+Link: https://patchwork.freedesktop.org/patch/msgid/20200204011032.582737-1-matthew.d.roper@intel.com
+Reviewed-by: Matt Atwood <matthew.s.atwood@intel.com>
+(cherry picked from commit 837b63e6087838d0f1e612d448405419199d8033)
+Signed-off-by: Jani Nikula <jani.nikula@intel.com>
+Link: https://patchwork.freedesktop.org/patch/msgid/20200228004320.127142-1-matthew.d.roper@intel.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/gpu/drm/i915/display/intel_display_power.c | 16 +++++++++++-----
+ 1 file changed, 11 insertions(+), 5 deletions(-)
+
+--- a/drivers/gpu/drm/i915/display/intel_display_power.c
++++ b/drivers/gpu/drm/i915/display/intel_display_power.c
+@@ -4471,13 +4471,19 @@ static void icl_dbuf_disable(struct drm_
+
+ static void icl_mbus_init(struct drm_i915_private *dev_priv)
+ {
+- u32 val;
++ u32 mask, val;
+
+- val = MBUS_ABOX_BT_CREDIT_POOL1(16) |
+- MBUS_ABOX_BT_CREDIT_POOL2(16) |
+- MBUS_ABOX_B_CREDIT(1) |
+- MBUS_ABOX_BW_CREDIT(1);
++ mask = MBUS_ABOX_BT_CREDIT_POOL1_MASK |
++ MBUS_ABOX_BT_CREDIT_POOL2_MASK |
++ MBUS_ABOX_B_CREDIT_MASK |
++ MBUS_ABOX_BW_CREDIT_MASK;
+
++ val = I915_READ(MBUS_ABOX_CTL);
++ val &= ~mask;
++ val |= MBUS_ABOX_BT_CREDIT_POOL1(16) |
++ MBUS_ABOX_BT_CREDIT_POOL2(16) |
++ MBUS_ABOX_B_CREDIT(1) |
++ MBUS_ABOX_BW_CREDIT(1);
+ I915_WRITE(MBUS_ABOX_CTL, val);
+ }
+
--- /dev/null
+From f4aaa44e8b20f7e0d4ea68d3bca4968b6ae5aaff Mon Sep 17 00:00:00 2001
+From: Dan Carpenter <dan.carpenter@oracle.com>
+Date: Fri, 28 Feb 2020 17:14:13 +0300
+Subject: drm/i915/selftests: Fix return in assert_mmap_offset()
+
+From: Dan Carpenter <dan.carpenter@oracle.com>
+
+commit f4aaa44e8b20f7e0d4ea68d3bca4968b6ae5aaff upstream.
+
+The assert_mmap_offset() returns type bool so if we return an error
+pointer that is "return true;" or success. If we have an error, then
+we should return false.
+
+Fixes: 3d81d589d6e3 ("drm/i915: Test exhaustion of the mmap space")
+Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
+Reviewed-by: Chris Wilson <chris@chris-wilson.co.uk>
+Signed-off-by: Chris Wilson <chris@chris-wilson.co.uk>
+Link: https://patchwork.freedesktop.org/patch/msgid/20200228141413.qfjf4abr323drlo4@kili.mountain
+(cherry picked from commit efbf928824820f2738f41271934f6ec2c6ebd587)
+Signed-off-by: Jani Nikula <jani.nikula@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/gpu/drm/i915/gem/selftests/i915_gem_mman.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/gpu/drm/i915/gem/selftests/i915_gem_mman.c
++++ b/drivers/gpu/drm/i915/gem/selftests/i915_gem_mman.c
+@@ -567,7 +567,7 @@ static bool assert_mmap_offset(struct dr
+
+ obj = i915_gem_object_create_internal(i915, size);
+ if (IS_ERR(obj))
+- return PTR_ERR(obj);
++ return false;
+
+ err = create_mmap_offset(obj);
+ i915_gem_object_put(obj);
--- /dev/null
+From 1b79cfd99ff5127e6a143767b51694a527b3ea38 Mon Sep 17 00:00:00 2001
+From: John Stultz <john.stultz@linaro.org>
+Date: Tue, 3 Mar 2020 16:32:28 +0000
+Subject: drm: kirin: Revert "Fix for hikey620 display offset problem"
+
+From: John Stultz <john.stultz@linaro.org>
+
+commit 1b79cfd99ff5127e6a143767b51694a527b3ea38 upstream.
+
+This reverts commit ff57c6513820efe945b61863cf4a51b79f18b592.
+
+With the commit ff57c6513820 ("drm: kirin: Fix for hikey620
+display offset problem") we added support for handling LDI
+overflows by resetting the hardware.
+
+However, its been observed that when we do hit the LDI overflow
+condition, the irq seems to be screaming, and we do nothing but
+stream:
+ [drm:ade_irq_handler [kirin_drm]] *ERROR* LDI underflow!
+over and over to the screen
+
+I've tried a few appraoches to avoid this, but none has yet
+been successful and the cure here is worse then the original
+disease, so revert this for now.
+
+Cc: Xinliang Liu <xinliang.liu@linaro.org>
+Cc: Rongrong Zou <zourongrong@gmail.com>
+Cc: Xinwei Kong <kong.kongxinwei@hisilicon.com>
+Cc: Chen Feng <puck.chen@hisilicon.com>
+Cc: Sam Ravnborg <sam@ravnborg.org>
+Cc: David Airlie <airlied@linux.ie>
+Cc: Daniel Vetter <daniel@ffwll.ch>
+Cc: dri-devel <dri-devel@lists.freedesktop.org>
+Fixes: ff57c6513820 ("drm: kirin: Fix for hikey620 display offset problem")
+Signed-off-by: John Stultz <john.stultz@linaro.org>
+Acked-by: Xinliang Liu <xinliang.liu@linaro.org>
+Signed-off-by: Xinliang Liu <xinliang.liu@linaro.org>
+Link: https://patchwork.freedesktop.org/patch/msgid/20200303163228.52741-1-john.stultz@linaro.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/gpu/drm/hisilicon/kirin/kirin_ade_reg.h | 1 -
+ drivers/gpu/drm/hisilicon/kirin/kirin_drm_ade.c | 20 --------------------
+ 2 files changed, 21 deletions(-)
+
+--- a/drivers/gpu/drm/hisilicon/kirin/kirin_ade_reg.h
++++ b/drivers/gpu/drm/hisilicon/kirin/kirin_ade_reg.h
+@@ -83,7 +83,6 @@
+ #define VSIZE_OFST 20
+ #define LDI_INT_EN 0x741C
+ #define FRAME_END_INT_EN_OFST 1
+-#define UNDERFLOW_INT_EN_OFST 2
+ #define LDI_CTRL 0x7420
+ #define BPP_OFST 3
+ #define DATA_GATE_EN BIT(2)
+--- a/drivers/gpu/drm/hisilicon/kirin/kirin_drm_ade.c
++++ b/drivers/gpu/drm/hisilicon/kirin/kirin_drm_ade.c
+@@ -46,7 +46,6 @@ struct ade_hw_ctx {
+ struct clk *media_noc_clk;
+ struct clk *ade_pix_clk;
+ struct reset_control *reset;
+- struct work_struct display_reset_wq;
+ bool power_on;
+ int irq;
+
+@@ -136,7 +135,6 @@ static void ade_init(struct ade_hw_ctx *
+ */
+ ade_update_bits(base + ADE_CTRL, FRM_END_START_OFST,
+ FRM_END_START_MASK, REG_EFFECTIVE_IN_ADEEN_FRMEND);
+- ade_update_bits(base + LDI_INT_EN, UNDERFLOW_INT_EN_OFST, MASK(1), 1);
+ }
+
+ static bool ade_crtc_mode_fixup(struct drm_crtc *crtc,
+@@ -304,17 +302,6 @@ static void ade_crtc_disable_vblank(stru
+ MASK(1), 0);
+ }
+
+-static void drm_underflow_wq(struct work_struct *work)
+-{
+- struct ade_hw_ctx *ctx = container_of(work, struct ade_hw_ctx,
+- display_reset_wq);
+- struct drm_device *drm_dev = ctx->crtc->dev;
+- struct drm_atomic_state *state;
+-
+- state = drm_atomic_helper_suspend(drm_dev);
+- drm_atomic_helper_resume(drm_dev, state);
+-}
+-
+ static irqreturn_t ade_irq_handler(int irq, void *data)
+ {
+ struct ade_hw_ctx *ctx = data;
+@@ -331,12 +318,6 @@ static irqreturn_t ade_irq_handler(int i
+ MASK(1), 1);
+ drm_crtc_handle_vblank(crtc);
+ }
+- if (status & BIT(UNDERFLOW_INT_EN_OFST)) {
+- ade_update_bits(base + LDI_INT_CLR, UNDERFLOW_INT_EN_OFST,
+- MASK(1), 1);
+- DRM_ERROR("LDI underflow!");
+- schedule_work(&ctx->display_reset_wq);
+- }
+
+ return IRQ_HANDLED;
+ }
+@@ -919,7 +900,6 @@ static void *ade_hw_ctx_alloc(struct pla
+ if (ret)
+ return ERR_PTR(-EIO);
+
+- INIT_WORK(&ctx->display_reset_wq, drm_underflow_wq);
+ ctx->crtc = crtc;
+
+ return ctx;
--- /dev/null
+From 3d2ed431b8f39483477bc3c3a2aefbc9778ffe12 Mon Sep 17 00:00:00 2001
+From: Phong LE <ple@baylibre.com>
+Date: Wed, 19 Feb 2020 15:13:24 +0100
+Subject: drm/mediatek: Handle component type MTK_DISP_OVL_2L correctly
+
+From: Phong LE <ple@baylibre.com>
+
+commit 3d2ed431b8f39483477bc3c3a2aefbc9778ffe12 upstream.
+
+The larb device remains NULL if the type is MTK_DISP_OVL_2L.
+A kernel panic is raised when a crtc uses mtk_smi_larb_get or
+mtk_smi_larb_put.
+
+Fixes: b17bdd0d7a73 ("drm/mediatek: add component OVL_2L0")
+
+Signed-off-by: Phong LE <ple@baylibre.com>
+Signed-off-by: CK Hu <ck.hu@mediatek.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/gpu/drm/mediatek/mtk_drm_ddp_comp.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/drivers/gpu/drm/mediatek/mtk_drm_ddp_comp.c
++++ b/drivers/gpu/drm/mediatek/mtk_drm_ddp_comp.c
+@@ -358,6 +358,7 @@ int mtk_ddp_comp_init(struct device *dev
+ /* Only DMA capable components need the LARB property */
+ comp->larb_dev = NULL;
+ if (type != MTK_DISP_OVL &&
++ type != MTK_DISP_OVL_2L &&
+ type != MTK_DISP_RDMA &&
+ type != MTK_DISP_WDMA)
+ return 0;
--- /dev/null
+From eb9d8ddbc107d02e489681f9dcbf93949e1a99a4 Mon Sep 17 00:00:00 2001
+From: Tomeu Vizoso <tomeu.vizoso@collabora.com>
+Date: Wed, 12 Feb 2020 14:22:36 -0600
+Subject: drm/panfrost: Don't try to map on error faults
+
+From: Tomeu Vizoso <tomeu.vizoso@collabora.com>
+
+commit eb9d8ddbc107d02e489681f9dcbf93949e1a99a4 upstream.
+
+If the exception type isn't a translation fault, don't try to map and
+instead go straight to a terminal fault.
+
+Otherwise, we can get flooded by kernel warnings and further faults.
+
+Fixes: 187d2929206e ("drm/panfrost: Add support for GPU heap allocations")
+Signed-off-by: Rob Herring <robh@kernel.org>
+Signed-off-by: Tomeu Vizoso <tomeu.vizoso@collabora.com>
+Reviewed-by: Steven Price <steven.price@arm.com>
+Reviewed-by: Tomeu Vizoso <tomeu.vizoso@collabora.com>
+Acked-by: Alyssa Rosenzweig <alyssa.rosenzweig@collabora.com>
+Link: https://patchwork.freedesktop.org/patch/msgid/20200212202236.13095-1-robh@kernel.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/gpu/drm/panfrost/panfrost_mmu.c | 44 +++++++++++++-------------------
+ 1 file changed, 19 insertions(+), 25 deletions(-)
+
+--- a/drivers/gpu/drm/panfrost/panfrost_mmu.c
++++ b/drivers/gpu/drm/panfrost/panfrost_mmu.c
+@@ -601,33 +601,27 @@ static irqreturn_t panfrost_mmu_irq_hand
+ source_id = (fault_status >> 16);
+
+ /* Page fault only */
+- if ((status & mask) == BIT(i)) {
+- WARN_ON(exception_type < 0xC1 || exception_type > 0xC4);
+-
++ ret = -1;
++ if ((status & mask) == BIT(i) && (exception_type & 0xF8) == 0xC0)
+ ret = panfrost_mmu_map_fault_addr(pfdev, i, addr);
+- if (!ret) {
+- mmu_write(pfdev, MMU_INT_CLEAR, BIT(i));
+- status &= ~mask;
+- continue;
+- }
+- }
+
+- /* terminal fault, print info about the fault */
+- dev_err(pfdev->dev,
+- "Unhandled Page fault in AS%d at VA 0x%016llX\n"
+- "Reason: %s\n"
+- "raw fault status: 0x%X\n"
+- "decoded fault status: %s\n"
+- "exception type 0x%X: %s\n"
+- "access type 0x%X: %s\n"
+- "source id 0x%X\n",
+- i, addr,
+- "TODO",
+- fault_status,
+- (fault_status & (1 << 10) ? "DECODER FAULT" : "SLAVE FAULT"),
+- exception_type, panfrost_exception_name(pfdev, exception_type),
+- access_type, access_type_name(pfdev, fault_status),
+- source_id);
++ if (ret)
++ /* terminal fault, print info about the fault */
++ dev_err(pfdev->dev,
++ "Unhandled Page fault in AS%d at VA 0x%016llX\n"
++ "Reason: %s\n"
++ "raw fault status: 0x%X\n"
++ "decoded fault status: %s\n"
++ "exception type 0x%X: %s\n"
++ "access type 0x%X: %s\n"
++ "source id 0x%X\n",
++ i, addr,
++ "TODO",
++ fault_status,
++ (fault_status & (1 << 10) ? "DECODER FAULT" : "SLAVE FAULT"),
++ exception_type, panfrost_exception_name(pfdev, exception_type),
++ access_type, access_type_name(pfdev, fault_status),
++ source_id);
+
+ mmu_write(pfdev, MMU_INT_CLEAR, mask);
+
--- /dev/null
+From 169ca4b38932112e8b2ee8baef9cea44678625b3 Mon Sep 17 00:00:00 2001
+From: Jernej Skrabec <jernej.skrabec@siol.net>
+Date: Mon, 24 Feb 2020 18:38:56 +0100
+Subject: drm/sun4i: Add separate DE3 VI layer formats
+
+From: Jernej Skrabec <jernej.skrabec@siol.net>
+
+commit 169ca4b38932112e8b2ee8baef9cea44678625b3 upstream.
+
+DE3 VI layers support alpha blending, but DE2 VI layers do not.
+Additionally, DE3 VI layers support 10-bit RGB and YUV formats.
+
+Make a separate list for DE3.
+
+Fixes: c50519e6db4d ("drm/sun4i: Add basic support for DE3")
+Acked-by: Maxime Ripard <mripard@kernel.org>
+Signed-off-by: Jernej Skrabec <jernej.skrabec@siol.net>
+Link: https://patchwork.freedesktop.org/patch/msgid/20200224173901.174016-3-jernej.skrabec@siol.net
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/gpu/drm/sun4i/sun8i_mixer.c | 36 ++++++++++++++++++++
+ drivers/gpu/drm/sun4i/sun8i_mixer.h | 11 ++++++
+ drivers/gpu/drm/sun4i/sun8i_vi_layer.c | 58 +++++++++++++++++++++++++++++++--
+ 3 files changed, 102 insertions(+), 3 deletions(-)
+
+--- a/drivers/gpu/drm/sun4i/sun8i_mixer.c
++++ b/drivers/gpu/drm/sun4i/sun8i_mixer.c
+@@ -149,6 +149,30 @@ static const struct de2_fmt_info de2_for
+ .csc = SUN8I_CSC_MODE_OFF,
+ },
+ {
++ .drm_fmt = DRM_FORMAT_ARGB2101010,
++ .de2_fmt = SUN8I_MIXER_FBFMT_ARGB2101010,
++ .rgb = true,
++ .csc = SUN8I_CSC_MODE_OFF,
++ },
++ {
++ .drm_fmt = DRM_FORMAT_ABGR2101010,
++ .de2_fmt = SUN8I_MIXER_FBFMT_ABGR2101010,
++ .rgb = true,
++ .csc = SUN8I_CSC_MODE_OFF,
++ },
++ {
++ .drm_fmt = DRM_FORMAT_RGBA1010102,
++ .de2_fmt = SUN8I_MIXER_FBFMT_RGBA1010102,
++ .rgb = true,
++ .csc = SUN8I_CSC_MODE_OFF,
++ },
++ {
++ .drm_fmt = DRM_FORMAT_BGRA1010102,
++ .de2_fmt = SUN8I_MIXER_FBFMT_BGRA1010102,
++ .rgb = true,
++ .csc = SUN8I_CSC_MODE_OFF,
++ },
++ {
+ .drm_fmt = DRM_FORMAT_UYVY,
+ .de2_fmt = SUN8I_MIXER_FBFMT_UYVY,
+ .rgb = false,
+@@ -244,6 +268,18 @@ static const struct de2_fmt_info de2_for
+ .rgb = false,
+ .csc = SUN8I_CSC_MODE_YVU2RGB,
+ },
++ {
++ .drm_fmt = DRM_FORMAT_P010,
++ .de2_fmt = SUN8I_MIXER_FBFMT_P010_YUV,
++ .rgb = false,
++ .csc = SUN8I_CSC_MODE_YUV2RGB,
++ },
++ {
++ .drm_fmt = DRM_FORMAT_P210,
++ .de2_fmt = SUN8I_MIXER_FBFMT_P210_YUV,
++ .rgb = false,
++ .csc = SUN8I_CSC_MODE_YUV2RGB,
++ },
+ };
+
+ const struct de2_fmt_info *sun8i_mixer_format_info(u32 format)
+--- a/drivers/gpu/drm/sun4i/sun8i_mixer.h
++++ b/drivers/gpu/drm/sun4i/sun8i_mixer.h
+@@ -93,6 +93,10 @@
+ #define SUN8I_MIXER_FBFMT_ABGR1555 17
+ #define SUN8I_MIXER_FBFMT_RGBA5551 18
+ #define SUN8I_MIXER_FBFMT_BGRA5551 19
++#define SUN8I_MIXER_FBFMT_ARGB2101010 20
++#define SUN8I_MIXER_FBFMT_ABGR2101010 21
++#define SUN8I_MIXER_FBFMT_RGBA1010102 22
++#define SUN8I_MIXER_FBFMT_BGRA1010102 23
+
+ #define SUN8I_MIXER_FBFMT_YUYV 0
+ #define SUN8I_MIXER_FBFMT_UYVY 1
+@@ -109,6 +113,13 @@
+ /* format 12 is semi-planar YUV411 UVUV */
+ /* format 13 is semi-planar YUV411 VUVU */
+ #define SUN8I_MIXER_FBFMT_YUV411 14
++/* format 15 doesn't exist */
++/* format 16 is P010 YVU */
++#define SUN8I_MIXER_FBFMT_P010_YUV 17
++/* format 18 is P210 YVU */
++#define SUN8I_MIXER_FBFMT_P210_YUV 19
++/* format 20 is packed YVU444 10-bit */
++/* format 21 is packed YUV444 10-bit */
+
+ /*
+ * Sub-engines listed bellow are unused for now. The EN registers are here only
+--- a/drivers/gpu/drm/sun4i/sun8i_vi_layer.c
++++ b/drivers/gpu/drm/sun4i/sun8i_vi_layer.c
+@@ -438,24 +438,76 @@ static const u32 sun8i_vi_layer_formats[
+ DRM_FORMAT_YVU444,
+ };
+
++static const u32 sun8i_vi_layer_de3_formats[] = {
++ DRM_FORMAT_ABGR1555,
++ DRM_FORMAT_ABGR2101010,
++ DRM_FORMAT_ABGR4444,
++ DRM_FORMAT_ABGR8888,
++ DRM_FORMAT_ARGB1555,
++ DRM_FORMAT_ARGB2101010,
++ DRM_FORMAT_ARGB4444,
++ DRM_FORMAT_ARGB8888,
++ DRM_FORMAT_BGR565,
++ DRM_FORMAT_BGR888,
++ DRM_FORMAT_BGRA1010102,
++ DRM_FORMAT_BGRA5551,
++ DRM_FORMAT_BGRA4444,
++ DRM_FORMAT_BGRA8888,
++ DRM_FORMAT_BGRX8888,
++ DRM_FORMAT_RGB565,
++ DRM_FORMAT_RGB888,
++ DRM_FORMAT_RGBA1010102,
++ DRM_FORMAT_RGBA4444,
++ DRM_FORMAT_RGBA5551,
++ DRM_FORMAT_RGBA8888,
++ DRM_FORMAT_RGBX8888,
++ DRM_FORMAT_XBGR8888,
++ DRM_FORMAT_XRGB8888,
++
++ DRM_FORMAT_NV16,
++ DRM_FORMAT_NV12,
++ DRM_FORMAT_NV21,
++ DRM_FORMAT_NV61,
++ DRM_FORMAT_P010,
++ DRM_FORMAT_P210,
++ DRM_FORMAT_UYVY,
++ DRM_FORMAT_VYUY,
++ DRM_FORMAT_YUYV,
++ DRM_FORMAT_YVYU,
++ DRM_FORMAT_YUV411,
++ DRM_FORMAT_YUV420,
++ DRM_FORMAT_YUV422,
++ DRM_FORMAT_YVU411,
++ DRM_FORMAT_YVU420,
++ DRM_FORMAT_YVU422,
++};
++
+ struct sun8i_vi_layer *sun8i_vi_layer_init_one(struct drm_device *drm,
+ struct sun8i_mixer *mixer,
+ int index)
+ {
+ u32 supported_encodings, supported_ranges;
++ unsigned int plane_cnt, format_count;
+ struct sun8i_vi_layer *layer;
+- unsigned int plane_cnt;
++ const u32 *formats;
+ int ret;
+
+ layer = devm_kzalloc(drm->dev, sizeof(*layer), GFP_KERNEL);
+ if (!layer)
+ return ERR_PTR(-ENOMEM);
+
++ if (mixer->cfg->is_de3) {
++ formats = sun8i_vi_layer_de3_formats;
++ format_count = ARRAY_SIZE(sun8i_vi_layer_de3_formats);
++ } else {
++ formats = sun8i_vi_layer_formats;
++ format_count = ARRAY_SIZE(sun8i_vi_layer_formats);
++ }
++
+ /* possible crtcs are set later */
+ ret = drm_universal_plane_init(drm, &layer->plane, 0,
+ &sun8i_vi_layer_funcs,
+- sun8i_vi_layer_formats,
+- ARRAY_SIZE(sun8i_vi_layer_formats),
++ formats, format_count,
+ NULL, DRM_PLANE_TYPE_OVERLAY, NULL);
+ if (ret) {
+ dev_err(drm->dev, "Couldn't initialize layer\n");
--- /dev/null
+From a4769905f0ae32cae4f096f646ab03b8b4794c74 Mon Sep 17 00:00:00 2001
+From: Jernej Skrabec <jernej.skrabec@siol.net>
+Date: Mon, 24 Feb 2020 18:38:55 +0100
+Subject: drm/sun4i: de2/de3: Remove unsupported VI layer formats
+
+From: Jernej Skrabec <jernej.skrabec@siol.net>
+
+commit a4769905f0ae32cae4f096f646ab03b8b4794c74 upstream.
+
+YUV444 and YVU444 are planar formats, but HW format RGB888 is packed.
+This means that those two mappings were never correct. Remove them.
+
+Fixes: 60a3dcf96aa8 ("drm/sun4i: Add DE2 definitions for YUV formats")
+Acked-by: Maxime Ripard <mripard@kernel.org>
+Signed-off-by: Jernej Skrabec <jernej.skrabec@siol.net>
+Link: https://patchwork.freedesktop.org/patch/msgid/20200224173901.174016-2-jernej.skrabec@siol.net
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/gpu/drm/sun4i/sun8i_mixer.c | 12 ------------
+ drivers/gpu/drm/sun4i/sun8i_vi_layer.c | 2 --
+ 2 files changed, 14 deletions(-)
+
+--- a/drivers/gpu/drm/sun4i/sun8i_mixer.c
++++ b/drivers/gpu/drm/sun4i/sun8i_mixer.c
+@@ -277,12 +277,6 @@ static const struct de2_fmt_info de2_for
+ .csc = SUN8I_CSC_MODE_YUV2RGB,
+ },
+ {
+- .drm_fmt = DRM_FORMAT_YUV444,
+- .de2_fmt = SUN8I_MIXER_FBFMT_RGB888,
+- .rgb = true,
+- .csc = SUN8I_CSC_MODE_YUV2RGB,
+- },
+- {
+ .drm_fmt = DRM_FORMAT_YUV422,
+ .de2_fmt = SUN8I_MIXER_FBFMT_YUV422,
+ .rgb = false,
+@@ -301,12 +295,6 @@ static const struct de2_fmt_info de2_for
+ .csc = SUN8I_CSC_MODE_YUV2RGB,
+ },
+ {
+- .drm_fmt = DRM_FORMAT_YVU444,
+- .de2_fmt = SUN8I_MIXER_FBFMT_RGB888,
+- .rgb = true,
+- .csc = SUN8I_CSC_MODE_YVU2RGB,
+- },
+- {
+ .drm_fmt = DRM_FORMAT_YVU422,
+ .de2_fmt = SUN8I_MIXER_FBFMT_YUV422,
+ .rgb = false,
+--- a/drivers/gpu/drm/sun4i/sun8i_vi_layer.c
++++ b/drivers/gpu/drm/sun4i/sun8i_vi_layer.c
+@@ -431,11 +431,9 @@ static const u32 sun8i_vi_layer_formats[
+ DRM_FORMAT_YUV411,
+ DRM_FORMAT_YUV420,
+ DRM_FORMAT_YUV422,
+- DRM_FORMAT_YUV444,
+ DRM_FORMAT_YVU411,
+ DRM_FORMAT_YVU420,
+ DRM_FORMAT_YVU422,
+- DRM_FORMAT_YVU444,
+ };
+
+ static const u32 sun8i_vi_layer_de3_formats[] = {
--- /dev/null
+From 20896ef137340e9426cf322606f764452f5eb960 Mon Sep 17 00:00:00 2001
+From: Jernej Skrabec <jernej.skrabec@siol.net>
+Date: Mon, 24 Feb 2020 18:38:57 +0100
+Subject: drm/sun4i: Fix DE2 VI layer format support
+
+From: Jernej Skrabec <jernej.skrabec@siol.net>
+
+commit 20896ef137340e9426cf322606f764452f5eb960 upstream.
+
+DE2 VI layer doesn't support blending which means alpha channel is
+ignored. Replace all formats with alpha with "don't care" (X) channel.
+
+Fixes: 7480ba4d7571 ("drm/sun4i: Add support for DE2 VI planes")
+Acked-by: Maxime Ripard <mripard@kernel.org>
+Signed-off-by: Jernej Skrabec <jernej.skrabec@siol.net>
+Link: https://patchwork.freedesktop.org/patch/msgid/20200224173901.174016-4-jernej.skrabec@siol.net
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/gpu/drm/sun4i/sun8i_mixer.c | 56 +++++++++++++++++++++++++++++++++
+ drivers/gpu/drm/sun4i/sun8i_vi_layer.c | 22 ++++++------
+ 2 files changed, 67 insertions(+), 11 deletions(-)
+
+--- a/drivers/gpu/drm/sun4i/sun8i_mixer.c
++++ b/drivers/gpu/drm/sun4i/sun8i_mixer.c
+@@ -107,46 +107,102 @@ static const struct de2_fmt_info de2_for
+ .csc = SUN8I_CSC_MODE_OFF,
+ },
+ {
++ /* for DE2 VI layer which ignores alpha */
++ .drm_fmt = DRM_FORMAT_XRGB4444,
++ .de2_fmt = SUN8I_MIXER_FBFMT_ARGB4444,
++ .rgb = true,
++ .csc = SUN8I_CSC_MODE_OFF,
++ },
++ {
+ .drm_fmt = DRM_FORMAT_ABGR4444,
+ .de2_fmt = SUN8I_MIXER_FBFMT_ABGR4444,
+ .rgb = true,
+ .csc = SUN8I_CSC_MODE_OFF,
+ },
+ {
++ /* for DE2 VI layer which ignores alpha */
++ .drm_fmt = DRM_FORMAT_XBGR4444,
++ .de2_fmt = SUN8I_MIXER_FBFMT_ABGR4444,
++ .rgb = true,
++ .csc = SUN8I_CSC_MODE_OFF,
++ },
++ {
+ .drm_fmt = DRM_FORMAT_RGBA4444,
+ .de2_fmt = SUN8I_MIXER_FBFMT_RGBA4444,
+ .rgb = true,
+ .csc = SUN8I_CSC_MODE_OFF,
+ },
+ {
++ /* for DE2 VI layer which ignores alpha */
++ .drm_fmt = DRM_FORMAT_RGBX4444,
++ .de2_fmt = SUN8I_MIXER_FBFMT_RGBA4444,
++ .rgb = true,
++ .csc = SUN8I_CSC_MODE_OFF,
++ },
++ {
+ .drm_fmt = DRM_FORMAT_BGRA4444,
+ .de2_fmt = SUN8I_MIXER_FBFMT_BGRA4444,
+ .rgb = true,
+ .csc = SUN8I_CSC_MODE_OFF,
+ },
+ {
++ /* for DE2 VI layer which ignores alpha */
++ .drm_fmt = DRM_FORMAT_BGRX4444,
++ .de2_fmt = SUN8I_MIXER_FBFMT_BGRA4444,
++ .rgb = true,
++ .csc = SUN8I_CSC_MODE_OFF,
++ },
++ {
+ .drm_fmt = DRM_FORMAT_ARGB1555,
+ .de2_fmt = SUN8I_MIXER_FBFMT_ARGB1555,
+ .rgb = true,
+ .csc = SUN8I_CSC_MODE_OFF,
+ },
+ {
++ /* for DE2 VI layer which ignores alpha */
++ .drm_fmt = DRM_FORMAT_XRGB1555,
++ .de2_fmt = SUN8I_MIXER_FBFMT_ARGB1555,
++ .rgb = true,
++ .csc = SUN8I_CSC_MODE_OFF,
++ },
++ {
+ .drm_fmt = DRM_FORMAT_ABGR1555,
+ .de2_fmt = SUN8I_MIXER_FBFMT_ABGR1555,
+ .rgb = true,
+ .csc = SUN8I_CSC_MODE_OFF,
+ },
+ {
++ /* for DE2 VI layer which ignores alpha */
++ .drm_fmt = DRM_FORMAT_XBGR1555,
++ .de2_fmt = SUN8I_MIXER_FBFMT_ABGR1555,
++ .rgb = true,
++ .csc = SUN8I_CSC_MODE_OFF,
++ },
++ {
+ .drm_fmt = DRM_FORMAT_RGBA5551,
+ .de2_fmt = SUN8I_MIXER_FBFMT_RGBA5551,
+ .rgb = true,
+ .csc = SUN8I_CSC_MODE_OFF,
+ },
+ {
++ /* for DE2 VI layer which ignores alpha */
++ .drm_fmt = DRM_FORMAT_RGBX5551,
++ .de2_fmt = SUN8I_MIXER_FBFMT_RGBA5551,
++ .rgb = true,
++ .csc = SUN8I_CSC_MODE_OFF,
++ },
++ {
+ .drm_fmt = DRM_FORMAT_BGRA5551,
+ .de2_fmt = SUN8I_MIXER_FBFMT_BGRA5551,
+ .rgb = true,
+ .csc = SUN8I_CSC_MODE_OFF,
++ },
++ {
++ /* for DE2 VI layer which ignores alpha */
++ .drm_fmt = DRM_FORMAT_BGRX5551,
++ .de2_fmt = SUN8I_MIXER_FBFMT_BGRA5551,
++ .rgb = true,
++ .csc = SUN8I_CSC_MODE_OFF,
+ },
+ {
+ .drm_fmt = DRM_FORMAT_ARGB2101010,
+--- a/drivers/gpu/drm/sun4i/sun8i_vi_layer.c
++++ b/drivers/gpu/drm/sun4i/sun8i_vi_layer.c
+@@ -398,26 +398,26 @@ static const struct drm_plane_funcs sun8
+ };
+
+ /*
+- * While all RGB formats are supported, VI planes don't support
+- * alpha blending, so there is no point having formats with alpha
+- * channel if their opaque analog exist.
++ * While DE2 VI layer supports same RGB formats as UI layer, alpha
++ * channel is ignored. This structure lists all unique variants
++ * where alpha channel is replaced with "don't care" (X) channel.
+ */
+ static const u32 sun8i_vi_layer_formats[] = {
+- DRM_FORMAT_ABGR1555,
+- DRM_FORMAT_ABGR4444,
+- DRM_FORMAT_ARGB1555,
+- DRM_FORMAT_ARGB4444,
+ DRM_FORMAT_BGR565,
+ DRM_FORMAT_BGR888,
+- DRM_FORMAT_BGRA5551,
+- DRM_FORMAT_BGRA4444,
++ DRM_FORMAT_BGRX4444,
++ DRM_FORMAT_BGRX5551,
+ DRM_FORMAT_BGRX8888,
+ DRM_FORMAT_RGB565,
+ DRM_FORMAT_RGB888,
+- DRM_FORMAT_RGBA4444,
+- DRM_FORMAT_RGBA5551,
++ DRM_FORMAT_RGBX4444,
++ DRM_FORMAT_RGBX5551,
+ DRM_FORMAT_RGBX8888,
++ DRM_FORMAT_XBGR1555,
++ DRM_FORMAT_XBGR4444,
+ DRM_FORMAT_XBGR8888,
++ DRM_FORMAT_XRGB1555,
++ DRM_FORMAT_XRGB4444,
+ DRM_FORMAT_XRGB8888,
+
+ DRM_FORMAT_NV16,
--- /dev/null
+From 8c8c06207bcfc5a7e5918fc0a0f7f7b9a2e196d6 Mon Sep 17 00:00:00 2001
+From: Ahzo <Ahzo@tutanota.com>
+Date: Tue, 25 Feb 2020 13:56:14 -0500
+Subject: drm/ttm: fix leaking fences via ttm_buffer_object_transfer
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Ahzo <Ahzo@tutanota.com>
+
+commit 8c8c06207bcfc5a7e5918fc0a0f7f7b9a2e196d6 upstream.
+
+Set the drm_device to NULL, so that the newly created buffer object
+doesn't appear to use the embedded gem object.
+
+This is necessary, because otherwise no corresponding dma_resv_fini for
+the dma_resv_init is called, resulting in a memory leak.
+
+The dma_resv_fini in ttm_bo_release_list is only called if the embedded
+gem object is not used, which is determined by checking if the
+drm_device is NULL.
+
+Bug: https://gitlab.freedesktop.org/drm/amd/issues/958
+Fixes: 1e053b10ba60 ("drm/ttm: use gem reservation object")
+Reviewed-by: Christian König <christian.koenig@amd.com>
+Signed-off-by: Ahzo <Ahzo@tutanota.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Christian König <christian.koenig@amd.com>
+Link: https://patchwork.freedesktop.org/patch/355089/
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/gpu/drm/ttm/ttm_bo_util.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/drivers/gpu/drm/ttm/ttm_bo_util.c
++++ b/drivers/gpu/drm/ttm/ttm_bo_util.c
+@@ -516,6 +516,7 @@ static int ttm_buffer_object_transfer(st
+ fbo->base.base.resv = &fbo->base.base._resv;
+
+ dma_resv_init(&fbo->base.base._resv);
++ fbo->base.base.dev = NULL;
+ ret = dma_resv_trylock(&fbo->base.base._resv);
+ WARN_ON(!ret);
+
--- /dev/null
+From f5bfeff44612d304deb100065a9f712309dc2783 Mon Sep 17 00:00:00 2001
+From: Leonard Crestez <leonard.crestez@nxp.com>
+Date: Thu, 20 Feb 2020 18:29:36 +0200
+Subject: firmware: imx: Align imx_sc_msg_req_cpu_start to 4
+
+From: Leonard Crestez <leonard.crestez@nxp.com>
+
+commit f5bfeff44612d304deb100065a9f712309dc2783 upstream.
+
+The imx SC api strongly assumes that messages are composed out of
+4-bytes words but some of our message structs have odd sizeofs.
+
+This produces many oopses with CONFIG_KASAN=y.
+
+Fix by marking with __aligned(4).
+
+Fixes: d90bf296ae18 ("firmware: imx: Add support to start/stop a CPU")
+Signed-off-by: Leonard Crestez <leonard.crestez@nxp.com>
+Signed-off-by: Shawn Guo <shawnguo@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/firmware/imx/misc.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/firmware/imx/misc.c
++++ b/drivers/firmware/imx/misc.c
+@@ -24,7 +24,7 @@ struct imx_sc_msg_req_cpu_start {
+ u32 address_lo;
+ u16 resource;
+ u8 enable;
+-} __packed;
++} __packed __aligned(4);
+
+ struct imx_sc_msg_req_misc_get_ctrl {
+ struct imx_sc_rpc_msg hdr;
--- /dev/null
+From 1e6a4eba693ac72e6f91b4252458c933110e5f4c Mon Sep 17 00:00:00 2001
+From: Leonard Crestez <leonard.crestez@nxp.com>
+Date: Thu, 20 Feb 2020 18:29:34 +0200
+Subject: firmware: imx: misc: Align imx sc msg structs to 4
+
+From: Leonard Crestez <leonard.crestez@nxp.com>
+
+commit 1e6a4eba693ac72e6f91b4252458c933110e5f4c upstream.
+
+The imx SC api strongly assumes that messages are composed out of
+4-bytes words but some of our message structs have odd sizeofs.
+
+This produces many oopses with CONFIG_KASAN=y:
+
+ BUG: KASAN: stack-out-of-bounds in imx_mu_send_data+0x108/0x1f0
+
+It shouldn't cause an issues in normal use because these structs are
+always allocated on the stack.
+
+Fixes: 15e1f2bc8b3b ("firmware: imx: add misc svc support")
+Signed-off-by: Leonard Crestez <leonard.crestez@nxp.com>
+Signed-off-by: Shawn Guo <shawnguo@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/firmware/imx/misc.c | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+--- a/drivers/firmware/imx/misc.c
++++ b/drivers/firmware/imx/misc.c
+@@ -16,7 +16,7 @@ struct imx_sc_msg_req_misc_set_ctrl {
+ u32 ctrl;
+ u32 val;
+ u16 resource;
+-} __packed;
++} __packed __aligned(4);
+
+ struct imx_sc_msg_req_cpu_start {
+ struct imx_sc_rpc_msg hdr;
+@@ -30,12 +30,12 @@ struct imx_sc_msg_req_misc_get_ctrl {
+ struct imx_sc_rpc_msg hdr;
+ u32 ctrl;
+ u16 resource;
+-} __packed;
++} __packed __aligned(4);
+
+ struct imx_sc_msg_resp_misc_get_ctrl {
+ struct imx_sc_rpc_msg hdr;
+ u32 val;
+-} __packed;
++} __packed __aligned(4);
+
+ /*
+ * This function sets a miscellaneous control value.
--- /dev/null
+From 7c1a1c814ccc858633c761951c2546041202b24e Mon Sep 17 00:00:00 2001
+From: Leonard Crestez <leonard.crestez@nxp.com>
+Date: Thu, 20 Feb 2020 18:29:35 +0200
+Subject: firmware: imx: scu-pd: Align imx sc msg structs to 4
+
+From: Leonard Crestez <leonard.crestez@nxp.com>
+
+commit 7c1a1c814ccc858633c761951c2546041202b24e upstream.
+
+The imx SC api strongly assumes that messages are composed out of
+4-bytes words but some of our message structs have odd sizeofs.
+
+This produces many oopses with CONFIG_KASAN=y.
+
+Fix by marking with __aligned(4).
+
+Fixes: c800cd7824bd ("firmware: imx: add SCU power domain driver")
+Signed-off-by: Leonard Crestez <leonard.crestez@nxp.com>
+Signed-off-by: Shawn Guo <shawnguo@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/firmware/imx/scu-pd.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/firmware/imx/scu-pd.c
++++ b/drivers/firmware/imx/scu-pd.c
+@@ -61,7 +61,7 @@ struct imx_sc_msg_req_set_resource_power
+ struct imx_sc_rpc_msg hdr;
+ u16 resource;
+ u8 mode;
+-} __packed;
++} __packed __aligned(4);
+
+ #define IMX_SCU_PD_NAME_SIZE 20
+ struct imx_sc_pm_domain {
--- /dev/null
+From 817a68a6584aa08e323c64283fec5ded7be84759 Mon Sep 17 00:00:00 2001
+From: Dennis Dalessandro <dennis.dalessandro@intel.com>
+Date: Tue, 25 Feb 2020 14:54:45 -0500
+Subject: IB/hfi1, qib: Ensure RCU is locked when accessing list
+
+From: Dennis Dalessandro <dennis.dalessandro@intel.com>
+
+commit 817a68a6584aa08e323c64283fec5ded7be84759 upstream.
+
+The packet handling function, specifically the iteration of the qp list
+for mad packet processing misses locking RCU before running through the
+list. Not only is this incorrect, but the list_for_each_entry_rcu() call
+can not be called with a conditional check for lock dependency. Remedy
+this by invoking the rcu lock and unlock around the critical section.
+
+This brings MAD packet processing in line with what is done for non-MAD
+packets.
+
+Fixes: 7724105686e7 ("IB/hfi1: add driver files")
+Link: https://lore.kernel.org/r/20200225195445.140896.41873.stgit@awfm-01.aw.intel.com
+Reviewed-by: Mike Marciniszyn <mike.marciniszyn@intel.com>
+Signed-off-by: Dennis Dalessandro <dennis.dalessandro@intel.com>
+Signed-off-by: Jason Gunthorpe <jgg@mellanox.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/infiniband/hw/hfi1/verbs.c | 4 +++-
+ drivers/infiniband/hw/qib/qib_verbs.c | 2 ++
+ 2 files changed, 5 insertions(+), 1 deletion(-)
+
+--- a/drivers/infiniband/hw/hfi1/verbs.c
++++ b/drivers/infiniband/hw/hfi1/verbs.c
+@@ -515,10 +515,11 @@ static inline void hfi1_handle_packet(st
+ opa_get_lid(packet->dlid, 9B));
+ if (!mcast)
+ goto drop;
++ rcu_read_lock();
+ list_for_each_entry_rcu(p, &mcast->qp_list, list) {
+ packet->qp = p->qp;
+ if (hfi1_do_pkey_check(packet))
+- goto drop;
++ goto unlock_drop;
+ spin_lock_irqsave(&packet->qp->r_lock, flags);
+ packet_handler = qp_ok(packet);
+ if (likely(packet_handler))
+@@ -527,6 +528,7 @@ static inline void hfi1_handle_packet(st
+ ibp->rvp.n_pkt_drops++;
+ spin_unlock_irqrestore(&packet->qp->r_lock, flags);
+ }
++ rcu_read_unlock();
+ /*
+ * Notify rvt_multicast_detach() if it is waiting for us
+ * to finish.
+--- a/drivers/infiniband/hw/qib/qib_verbs.c
++++ b/drivers/infiniband/hw/qib/qib_verbs.c
+@@ -329,8 +329,10 @@ void qib_ib_rcv(struct qib_ctxtdata *rcd
+ if (mcast == NULL)
+ goto drop;
+ this_cpu_inc(ibp->pmastats->n_multicast_rcv);
++ rcu_read_lock();
+ list_for_each_entry_rcu(p, &mcast->qp_list, list)
+ qib_qp_rcv(rcd, hdr, 1, data, tlen, p->qp);
++ rcu_read_unlock();
+ /*
+ * Notify rvt_multicast_detach() if it is waiting for us
+ * to finish.
--- /dev/null
+From de5ed007a03d71daaa505f5daa4d3666530c7090 Mon Sep 17 00:00:00 2001
+From: Artemy Kovalyov <artemyko@mellanox.com>
+Date: Thu, 27 Feb 2020 13:39:18 +0200
+Subject: IB/mlx5: Fix implicit ODP race
+
+From: Artemy Kovalyov <artemyko@mellanox.com>
+
+commit de5ed007a03d71daaa505f5daa4d3666530c7090 upstream.
+
+Following race may occur because of the call_srcu and the placement of
+the synchronize_srcu vs the xa_erase.
+
+CPU0 CPU1
+
+mlx5_ib_free_implicit_mr: destroy_unused_implicit_child_mr:
+ xa_erase(odp_mkeys)
+ synchronize_srcu()
+ xa_lock(implicit_children)
+ if (still in xarray)
+ atomic_inc()
+ call_srcu()
+ xa_unlock(implicit_children)
+ xa_erase(implicit_children):
+ xa_lock(implicit_children)
+ __xa_erase()
+ xa_unlock(implicit_children)
+
+ flush_workqueue()
+ [..]
+ free_implicit_child_mr_rcu:
+ (via call_srcu)
+ queue_work()
+
+ WARN_ON(atomic_read())
+ [..]
+ free_implicit_child_mr_work:
+ (via wq)
+ free_implicit_child_mr()
+ mlx5_mr_cache_invalidate()
+ mlx5_ib_update_xlt() <-- UMR QP fail
+ atomic_dec()
+
+The wait_event() solves the race because it blocks until
+free_implicit_child_mr_work() completes.
+
+Fixes: 5256edcb98a1 ("RDMA/mlx5: Rework implicit ODP destroy")
+Link: https://lore.kernel.org/r/20200227113918.94432-1-leon@kernel.org
+Signed-off-by: Artemy Kovalyov <artemyko@mellanox.com>
+Reviewed-by: Jason Gunthorpe <jgg@mellanox.com>
+Signed-off-by: Leon Romanovsky <leonro@mellanox.com>
+Signed-off-by: Jason Gunthorpe <jgg@mellanox.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/infiniband/hw/mlx5/mlx5_ib.h | 1 +
+ drivers/infiniband/hw/mlx5/odp.c | 17 +++++++----------
+ 2 files changed, 8 insertions(+), 10 deletions(-)
+
+--- a/drivers/infiniband/hw/mlx5/mlx5_ib.h
++++ b/drivers/infiniband/hw/mlx5/mlx5_ib.h
+@@ -629,6 +629,7 @@ struct mlx5_ib_mr {
+
+ /* For ODP and implicit */
+ atomic_t num_deferred_work;
++ wait_queue_head_t q_deferred_work;
+ struct xarray implicit_children;
+ union {
+ struct rcu_head rcu;
+--- a/drivers/infiniband/hw/mlx5/odp.c
++++ b/drivers/infiniband/hw/mlx5/odp.c
+@@ -197,7 +197,8 @@ static void free_implicit_child_mr(struc
+ mr->parent = NULL;
+ mlx5_mr_cache_free(mr->dev, mr);
+ ib_umem_odp_release(odp);
+- atomic_dec(&imr->num_deferred_work);
++ if (atomic_dec_and_test(&imr->num_deferred_work))
++ wake_up(&imr->q_deferred_work);
+ }
+
+ static void free_implicit_child_mr_work(struct work_struct *work)
+@@ -516,6 +517,7 @@ struct mlx5_ib_mr *mlx5_ib_alloc_implici
+ imr->umem = &umem_odp->umem;
+ imr->is_odp_implicit = true;
+ atomic_set(&imr->num_deferred_work, 0);
++ init_waitqueue_head(&imr->q_deferred_work);
+ xa_init(&imr->implicit_children);
+
+ err = mlx5_ib_update_xlt(imr, 0,
+@@ -573,10 +575,7 @@ void mlx5_ib_free_implicit_mr(struct mlx
+ * under xa_lock while the child is in the xarray. Thus at this point
+ * it is only decreasing, and all work holding it is now on the wq.
+ */
+- if (atomic_read(&imr->num_deferred_work)) {
+- flush_workqueue(system_unbound_wq);
+- WARN_ON(atomic_read(&imr->num_deferred_work));
+- }
++ wait_event(imr->q_deferred_work, !atomic_read(&imr->num_deferred_work));
+
+ /*
+ * Fence the imr before we destroy the children. This allows us to
+@@ -607,10 +606,7 @@ void mlx5_ib_fence_odp_mr(struct mlx5_ib
+ /* Wait for all running page-fault handlers to finish. */
+ synchronize_srcu(&mr->dev->odp_srcu);
+
+- if (atomic_read(&mr->num_deferred_work)) {
+- flush_workqueue(system_unbound_wq);
+- WARN_ON(atomic_read(&mr->num_deferred_work));
+- }
++ wait_event(mr->q_deferred_work, !atomic_read(&mr->num_deferred_work));
+
+ dma_fence_odp_mr(mr);
+ }
+@@ -1682,7 +1678,8 @@ static void destroy_prefetch_work(struct
+ u32 i;
+
+ for (i = 0; i < work->num_sge; ++i)
+- atomic_dec(&work->frags[i].mr->num_deferred_work);
++ if (atomic_dec_and_test(&work->frags[i].mr->num_deferred_work))
++ wake_up(&work->frags[i].mr->q_deferred_work);
+ kvfree(work);
+ }
+
--- /dev/null
+From be4e3c737eebd75815633f4b8fd766defaf0f1fc Mon Sep 17 00:00:00 2001
+From: Tony Lindgren <tony@atomide.com>
+Date: Sun, 15 Sep 2019 13:15:52 -0700
+Subject: phy: mapphone-mdm6600: Fix timeouts by adding wake-up handling
+
+From: Tony Lindgren <tony@atomide.com>
+
+commit be4e3c737eebd75815633f4b8fd766defaf0f1fc upstream.
+
+We have an interrupt handler for the wake-up GPIO pin, but we're missing
+the code to wake-up the system. This can cause timeouts receiving data
+for the UART that shares the wake-up GPIO pin with the USB PHY.
+
+All we need to do is just wake the system and kick the autosuspend
+timeout to fix the issue.
+
+Fixes: 5d1ebbda0318 ("phy: mapphone-mdm6600: Add USB PHY driver for MDM6600 on Droid 4")
+Cc: Marcel Partap <mpartap@gmx.net>
+Cc: Merlijn Wajer <merlijn@wizzup.org>
+Cc: Michael Scott <hashcode0f@gmail.com>
+Cc: NeKit <nekit1000@gmail.com>
+Cc: Pavel Machek <pavel@ucw.cz>
+Cc: Sebastian Reichel <sre@kernel.org>
+Signed-off-by: Tony Lindgren <tony@atomide.com>
+Signed-off-by: Kishon Vijay Abraham I <kishon@ti.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/phy/motorola/phy-mapphone-mdm6600.c | 18 ++++++++++++++++--
+ 1 file changed, 16 insertions(+), 2 deletions(-)
+
+--- a/drivers/phy/motorola/phy-mapphone-mdm6600.c
++++ b/drivers/phy/motorola/phy-mapphone-mdm6600.c
+@@ -243,10 +243,24 @@ static irqreturn_t phy_mdm6600_wakeirq_t
+ {
+ struct phy_mdm6600 *ddata = data;
+ struct gpio_desc *mode_gpio1;
++ int error, wakeup;
+
+ mode_gpio1 = ddata->mode_gpios->desc[PHY_MDM6600_MODE1];
+- dev_dbg(ddata->dev, "OOB wake on mode_gpio1: %i\n",
+- gpiod_get_value(mode_gpio1));
++ wakeup = gpiod_get_value(mode_gpio1);
++ if (!wakeup)
++ return IRQ_NONE;
++
++ dev_dbg(ddata->dev, "OOB wake on mode_gpio1: %i\n", wakeup);
++ error = pm_runtime_get_sync(ddata->dev);
++ if (error < 0) {
++ pm_runtime_put_noidle(ddata->dev);
++
++ return IRQ_NONE;
++ }
++
++ /* Just wake-up and kick the autosuspend timer */
++ pm_runtime_mark_last_busy(ddata->dev);
++ pm_runtime_put_autosuspend(ddata->dev);
+
+ return IRQ_HANDLED;
+ }
--- /dev/null
+From 46b7edf1c7b7c91004c4db2c355cbd033f2385f9 Mon Sep 17 00:00:00 2001
+From: Tony Lindgren <tony@atomide.com>
+Date: Tue, 4 Feb 2020 07:36:02 -0800
+Subject: phy: mapphone-mdm6600: Fix write timeouts with shorter GPIO toggle interval
+
+From: Tony Lindgren <tony@atomide.com>
+
+commit 46b7edf1c7b7c91004c4db2c355cbd033f2385f9 upstream.
+
+I've noticed that when writing data to the modem the writes can time out
+at some point eventually. Looks like kicking the modem idle GPIO every
+600 ms instead of once a second fixes the issue. Note that this rate is
+different from our runtime PM autosuspend rate MDM6600_MODEM_IDLE_DELAY_MS
+that we still want to keep at 1 second, so let's add a separate define for
+PHY_MDM6600_IDLE_KICK_MS.
+
+Fixes: f7f50b2a7b05 ("phy: mapphone-mdm6600: Add runtime PM support for n_gsm on USB suspend")
+Cc: Marcel Partap <mpartap@gmx.net>
+Cc: Merlijn Wajer <merlijn@wizzup.org>
+Cc: Michael Scott <hashcode0f@gmail.com>
+Cc: NeKit <nekit1000@gmail.com>
+Cc: Pavel Machek <pavel@ucw.cz>
+Cc: Sebastian Reichel <sre@kernel.org>
+Signed-off-by: Tony Lindgren <tony@atomide.com>
+Signed-off-by: Kishon Vijay Abraham I <kishon@ti.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/phy/motorola/phy-mapphone-mdm6600.c | 9 ++++++++-
+ 1 file changed, 8 insertions(+), 1 deletion(-)
+
+--- a/drivers/phy/motorola/phy-mapphone-mdm6600.c
++++ b/drivers/phy/motorola/phy-mapphone-mdm6600.c
+@@ -20,6 +20,7 @@
+
+ #define PHY_MDM6600_PHY_DELAY_MS 4000 /* PHY enable 2.2s to 3.5s */
+ #define PHY_MDM6600_ENABLED_DELAY_MS 8000 /* 8s more total for MDM6600 */
++#define PHY_MDM6600_WAKE_KICK_MS 600 /* time on after GPIO toggle */
+ #define MDM6600_MODEM_IDLE_DELAY_MS 1000 /* modem after USB suspend */
+ #define MDM6600_MODEM_WAKE_DELAY_MS 200 /* modem response after idle */
+
+@@ -510,8 +511,14 @@ static void phy_mdm6600_modem_wake(struc
+
+ ddata = container_of(work, struct phy_mdm6600, modem_wake_work.work);
+ phy_mdm6600_wake_modem(ddata);
++
++ /*
++ * The modem does not always stay awake 1.2 seconds after toggling
++ * the wake GPIO, and sometimes it idles after about some 600 ms
++ * making writes time out.
++ */
+ schedule_delayed_work(&ddata->modem_wake_work,
+- msecs_to_jiffies(MDM6600_MODEM_IDLE_DELAY_MS));
++ msecs_to_jiffies(PHY_MDM6600_WAKE_KICK_MS));
+ }
+
+ static int __maybe_unused phy_mdm6600_runtime_suspend(struct device *dev)
--- /dev/null
+From e38b55ea0443da35a50a3eb2079ad3612cf763b9 Mon Sep 17 00:00:00 2001
+From: Maor Gottlieb <maorg@mellanox.com>
+Date: Thu, 27 Feb 2020 13:27:08 +0200
+Subject: RDMA/core: Fix protection fault in ib_mr_pool_destroy
+
+From: Maor Gottlieb <maorg@mellanox.com>
+
+commit e38b55ea0443da35a50a3eb2079ad3612cf763b9 upstream.
+
+Fix NULL pointer dereference in the error flow of ib_create_qp_user
+when accessing to uninitialized list pointers - rdma_mrs and sig_mrs.
+The following crash from syzkaller revealed it.
+
+ kasan: GPF could be caused by NULL-ptr deref or user memory access
+ general protection fault: 0000 [#1] SMP KASAN PTI
+ CPU: 1 PID: 23167 Comm: syz-executor.1 Not tainted 5.5.0-rc5 #2
+ Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS
+ rel-1.12.1-0-ga5cab58e9a3f-prebuilt.qemu.org 04/01/2014
+ RIP: 0010:ib_mr_pool_destroy+0x81/0x1f0
+ Code: 00 00 fc ff df 49 c1 ec 03 4d 01 fc e8 a8 ea 72 fe 41 80 3c 24 00
+ 0f 85 62 01 00 00 48 8b 13 48 89 d6 4c 8d 6a c8 48 c1 ee 03 <42> 80 3c
+ 3e 00 0f 85 34 01 00 00 48 8d 7a 08 4c 8b 02 48 89 fe 48
+ RSP: 0018:ffffc9000951f8b0 EFLAGS: 00010046
+ RAX: 0000000000040000 RBX: ffff88810f268038 RCX: ffffffff82c41628
+ RDX: 0000000000000000 RSI: 0000000000000000 RDI: ffffc9000951f850
+ RBP: ffff88810f268020 R08: 0000000000000004 R09: fffff520012a3f0a
+ R10: 0000000000000001 R11: fffff520012a3f0a R12: ffffed1021e4d007
+ R13: ffffffffffffffc8 R14: 0000000000000246 R15: dffffc0000000000
+ FS: 00007f54bc788700(0000) GS:ffff88811b100000(0000)
+ knlGS:0000000000000000
+ CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
+ CR2: 0000000000000000 CR3: 0000000116920002 CR4: 0000000000360ee0
+ DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
+ DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
+ Call Trace:
+ rdma_rw_cleanup_mrs+0x15/0x30
+ ib_destroy_qp_user+0x674/0x7d0
+ ib_create_qp_user+0xb01/0x11c0
+ create_qp+0x1517/0x2130
+ ib_uverbs_create_qp+0x13e/0x190
+ ib_uverbs_write+0xaa5/0xdf0
+ __vfs_write+0x7c/0x100
+ vfs_write+0x168/0x4a0
+ ksys_write+0xc8/0x200
+ do_syscall_64+0x9c/0x390
+ entry_SYSCALL_64_after_hwframe+0x44/0xa9
+ RIP: 0033:0x465b49
+ Code: f7 d8 64 89 02 b8 ff ff ff ff c3 66 0f 1f 44 00 00 48 89 f8 48 89
+ f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01
+ f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48
+ RSP: 002b:00007f54bc787c58 EFLAGS: 00000246 ORIG_RAX: 0000000000000001
+ RAX: ffffffffffffffda RBX: 000000000073bf00 RCX: 0000000000465b49
+ RDX: 0000000000000040 RSI: 0000000020000540 RDI: 0000000000000003
+ RBP: 00007f54bc787c70 R08: 0000000000000000 R09: 0000000000000000
+ R10: 0000000000000000 R11: 0000000000000246 R12: 00007f54bc7886bc
+ R13: 00000000004ca2ec R14: 000000000070ded0 R15: 0000000000000005
+
+Fixes: a060b5629ab0 ("IB/core: generic RDMA READ/WRITE API")
+Link: https://lore.kernel.org/r/20200227112708.93023-1-leon@kernel.org
+Signed-off-by: Maor Gottlieb <maorg@mellanox.com>
+Signed-off-by: Leon Romanovsky <leonro@mellanox.com>
+Reviewed-by: Jason Gunthorpe <jgg@mellanox.com>
+Signed-off-by: Jason Gunthorpe <jgg@mellanox.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/infiniband/core/core_priv.h | 15 +++++++++++++++
+ drivers/infiniband/core/uverbs_cmd.c | 10 ----------
+ drivers/infiniband/core/verbs.c | 10 ----------
+ 3 files changed, 15 insertions(+), 20 deletions(-)
+
+--- a/drivers/infiniband/core/core_priv.h
++++ b/drivers/infiniband/core/core_priv.h
+@@ -338,6 +338,21 @@ static inline struct ib_qp *_ib_create_q
+ qp->pd = pd;
+ qp->uobject = uobj;
+ qp->real_qp = qp;
++
++ qp->qp_type = attr->qp_type;
++ qp->qp_context = attr->qp_context;
++ qp->rwq_ind_tbl = attr->rwq_ind_tbl;
++ qp->send_cq = attr->send_cq;
++ qp->recv_cq = attr->recv_cq;
++ qp->srq = attr->srq;
++ qp->rwq_ind_tbl = attr->rwq_ind_tbl;
++ qp->event_handler = attr->event_handler;
++
++ atomic_set(&qp->usecnt, 0);
++ spin_lock_init(&qp->mr_lock);
++ INIT_LIST_HEAD(&qp->rdma_mrs);
++ INIT_LIST_HEAD(&qp->sig_mrs);
++
+ /*
+ * We don't track XRC QPs for now, because they don't have PD
+ * and more importantly they are created internaly by driver,
+--- a/drivers/infiniband/core/uverbs_cmd.c
++++ b/drivers/infiniband/core/uverbs_cmd.c
+@@ -1433,17 +1433,7 @@ static int create_qp(struct uverbs_attr_
+ if (ret)
+ goto err_cb;
+
+- qp->pd = pd;
+- qp->send_cq = attr.send_cq;
+- qp->recv_cq = attr.recv_cq;
+- qp->srq = attr.srq;
+- qp->rwq_ind_tbl = ind_tbl;
+- qp->event_handler = attr.event_handler;
+- qp->qp_context = attr.qp_context;
+- qp->qp_type = attr.qp_type;
+- atomic_set(&qp->usecnt, 0);
+ atomic_inc(&pd->usecnt);
+- qp->port = 0;
+ if (attr.send_cq)
+ atomic_inc(&attr.send_cq->usecnt);
+ if (attr.recv_cq)
+--- a/drivers/infiniband/core/verbs.c
++++ b/drivers/infiniband/core/verbs.c
+@@ -1182,16 +1182,6 @@ struct ib_qp *ib_create_qp_user(struct i
+ if (ret)
+ goto err;
+
+- qp->qp_type = qp_init_attr->qp_type;
+- qp->rwq_ind_tbl = qp_init_attr->rwq_ind_tbl;
+-
+- atomic_set(&qp->usecnt, 0);
+- qp->mrs_used = 0;
+- spin_lock_init(&qp->mr_lock);
+- INIT_LIST_HEAD(&qp->rdma_mrs);
+- INIT_LIST_HEAD(&qp->sig_mrs);
+- qp->port = 0;
+-
+ if (qp_init_attr->qp_type == IB_QPT_XRC_TGT) {
+ struct ib_qp *xrc_qp =
+ create_xrc_qp_user(qp, qp_init_attr, udata);
--- /dev/null
+From 810dbc69087b08fd53e1cdd6c709f385bc2921ad Mon Sep 17 00:00:00 2001
+From: Bernard Metzler <bmt@zurich.ibm.com>
+Date: Mon, 2 Mar 2020 19:16:14 +0100
+Subject: RDMA/iwcm: Fix iwcm work deallocation
+
+From: Bernard Metzler <bmt@zurich.ibm.com>
+
+commit 810dbc69087b08fd53e1cdd6c709f385bc2921ad upstream.
+
+The dealloc_work_entries() function must update the work_free_list pointer
+while freeing its entries, since potentially called again on same list. A
+second iteration of the work list caused system crash. This happens, if
+work allocation fails during cma_iw_listen() and free_cm_id() tries to
+free the list again during cleanup.
+
+Fixes: 922a8e9fb2e0 ("RDMA: iWARP Connection Manager.")
+Link: https://lore.kernel.org/r/20200302181614.17042-1-bmt@zurich.ibm.com
+Reported-by: syzbot+cb0c054eabfba4342146@syzkaller.appspotmail.com
+Signed-off-by: Bernard Metzler <bmt@zurich.ibm.com>
+Reviewed-by: Jason Gunthorpe <jgg@mellanox.com>
+Signed-off-by: Jason Gunthorpe <jgg@mellanox.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/infiniband/core/iwcm.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+--- a/drivers/infiniband/core/iwcm.c
++++ b/drivers/infiniband/core/iwcm.c
+@@ -159,8 +159,10 @@ static void dealloc_work_entries(struct
+ {
+ struct list_head *e, *tmp;
+
+- list_for_each_safe(e, tmp, &cm_id_priv->work_free_list)
++ list_for_each_safe(e, tmp, &cm_id_priv->work_free_list) {
++ list_del(e);
+ kfree(list_entry(e, struct iwcm_work, free_list));
++ }
+ }
+
+ static int alloc_work_entries(struct iwcm_id_private *cm_id_priv, int count)
--- /dev/null
+From 78f34a16c28654cb47791257006f90d0948f2f0c Mon Sep 17 00:00:00 2001
+From: Mark Zhang <markz@mellanox.com>
+Date: Thu, 27 Feb 2020 14:51:11 +0200
+Subject: RDMA/nldev: Fix crash when set a QP to a new counter but QPN is missing
+
+From: Mark Zhang <markz@mellanox.com>
+
+commit 78f34a16c28654cb47791257006f90d0948f2f0c upstream.
+
+This fixes the kernel crash when a RDMA_NLDEV_CMD_STAT_SET command is
+received, but the QP number parameter is not available.
+
+ iwpm_register_pid: Unable to send a nlmsg (client = 2)
+ infiniband syz1: RDMA CMA: cma_listen_on_dev, error -98
+ general protection fault, probably for non-canonical address 0xdffffc0000000000: 0000 [#1] PREEMPT SMP KASAN
+ KASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007]
+ CPU: 0 PID: 9754 Comm: syz-executor069 Not tainted 5.6.0-rc2-syzkaller #0
+ Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
+ RIP: 0010:nla_get_u32 include/net/netlink.h:1474 [inline]
+ RIP: 0010:nldev_stat_set_doit+0x63c/0xb70 drivers/infiniband/core/nldev.c:1760
+ Code: fc 01 0f 84 58 03 00 00 e8 41 83 bf fb 4c 8b a3 58 fd ff ff 48 b8 00 00 00 00 00 fc ff df 49 8d 7c 24 04 48 89 fa 48 c1 ea 03 <0f> b6 14 02 48 89 f8 83 e0 07 83 c0 03 38 d0 7c 08 84 d2 0f 85 6d
+ RSP: 0018:ffffc900068bf350 EFLAGS: 00010247
+ RAX: dffffc0000000000 RBX: ffffc900068bf728 RCX: ffffffff85b60470
+ RDX: 0000000000000000 RSI: ffffffff85b6047f RDI: 0000000000000004
+ RBP: ffffc900068bf750 R08: ffff88808c3ee140 R09: ffff8880a25e6010
+ R10: ffffed10144bcddc R11: ffff8880a25e6ee3 R12: 0000000000000000
+ R13: ffff88809acb0000 R14: ffff888092a42c80 R15: 000000009ef2e29a
+ FS: 0000000001ff0880(0000) GS:ffff8880ae800000(0000) knlGS:0000000000000000
+ CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
+ CR2: 00007f4733e34000 CR3: 00000000a9b27000 CR4: 00000000001406f0
+ DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
+ DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
+ Call Trace:
+ rdma_nl_rcv_msg drivers/infiniband/core/netlink.c:195 [inline]
+ rdma_nl_rcv_skb drivers/infiniband/core/netlink.c:239 [inline]
+ rdma_nl_rcv+0x5d9/0x980 drivers/infiniband/core/netlink.c:259
+ netlink_unicast_kernel net/netlink/af_netlink.c:1303 [inline]
+ netlink_unicast+0x59e/0x7e0 net/netlink/af_netlink.c:1329
+ netlink_sendmsg+0x91c/0xea0 net/netlink/af_netlink.c:1918
+ sock_sendmsg_nosec net/socket.c:652 [inline]
+ sock_sendmsg+0xd7/0x130 net/socket.c:672
+ ____sys_sendmsg+0x753/0x880 net/socket.c:2343
+ ___sys_sendmsg+0x100/0x170 net/socket.c:2397
+ __sys_sendmsg+0x105/0x1d0 net/socket.c:2430
+ __do_sys_sendmsg net/socket.c:2439 [inline]
+ __se_sys_sendmsg net/socket.c:2437 [inline]
+ __x64_sys_sendmsg+0x78/0xb0 net/socket.c:2437
+ do_syscall_64+0xfa/0x790 arch/x86/entry/common.c:294
+ entry_SYSCALL_64_after_hwframe+0x49/0xbe
+ RIP: 0033:0x4403d9
+ Code: 18 89 d0 c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 fb 13 fc ff c3 66 2e 0f 1f 84 00 00 00 00
+ RSP: 002b:00007ffc0efbc5c8 EFLAGS: 00000246 ORIG_RAX: 000000000000002e
+ RAX: ffffffffffffffda RBX: 00000000004002c8 RCX: 00000000004403d9
+ RDX: 0000000000000000 RSI: 0000000020000240 RDI: 0000000000000004
+ RBP: 00000000006ca018 R08: 0000000000000008 R09: 00000000004002c8
+ R10: 000000000000004a R11: 0000000000000246 R12: 0000000000401c60
+ R13: 0000000000401cf0 R14: 0000000000000000 R15: 0000000000000000
+
+Fixes: b389327df905 ("RDMA/nldev: Allow counter manual mode configration through RDMA netlink")
+Link: https://lore.kernel.org/r/20200227125111.99142-1-leon@kernel.org
+Reported-by: syzbot+bd4af81bc51ee0283445@syzkaller.appspotmail.com
+Signed-off-by: Mark Zhang <markz@mellanox.com>
+Signed-off-by: Leon Romanovsky <leonro@mellanox.com>
+Signed-off-by: Jason Gunthorpe <jgg@mellanox.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/infiniband/core/nldev.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/drivers/infiniband/core/nldev.c
++++ b/drivers/infiniband/core/nldev.c
+@@ -1756,6 +1756,8 @@ static int nldev_stat_set_doit(struct sk
+ if (ret)
+ goto err_msg;
+ } else {
++ if (!tb[RDMA_NLDEV_ATTR_RES_LQPN])
++ goto err_msg;
+ qpn = nla_get_u32(tb[RDMA_NLDEV_ATTR_RES_LQPN]);
+ if (tb[RDMA_NLDEV_ATTR_STAT_COUNTER_ID]) {
+ cntn = nla_get_u32(tb[RDMA_NLDEV_ATTR_STAT_COUNTER_ID]);
--- /dev/null
+From a4e63bce1414df7ab6eb82ca9feb8494ce13e554 Mon Sep 17 00:00:00 2001
+From: Jason Gunthorpe <jgg@ziepe.ca>
+Date: Thu, 27 Feb 2020 13:41:18 +0200
+Subject: RDMA/odp: Ensure the mm is still alive before creating an implicit child
+
+From: Jason Gunthorpe <jgg@mellanox.com>
+
+commit a4e63bce1414df7ab6eb82ca9feb8494ce13e554 upstream.
+
+Registration of a mmu_notifier requires the caller to hold a mmget() on
+the mm as registration is not permitted to race with exit_mmap(). There is
+a BUG_ON inside the mmu_notifier to guard against this.
+
+Normally creating a umem is done against current which implicitly holds
+the mmget(), however an implicit ODP child is created from a pagefault
+work queue and is not guaranteed to have a mmget().
+
+Call mmget() around this registration and abort faulting if the MM has
+gone to exit_mmap().
+
+Before the patch below the notifier was registered when the implicit ODP
+parent was created, so there was no chance to register a notifier outside
+of current.
+
+Fixes: c571feca2dc9 ("RDMA/odp: use mmu_notifier_get/put for 'struct ib_ucontext_per_mm'")
+Link: https://lore.kernel.org/r/20200227114118.94736-1-leon@kernel.org
+Signed-off-by: Leon Romanovsky <leonro@mellanox.com>
+Signed-off-by: Jason Gunthorpe <jgg@mellanox.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/infiniband/core/umem_odp.c | 24 +++++++++++++++++++-----
+ 1 file changed, 19 insertions(+), 5 deletions(-)
+
+--- a/drivers/infiniband/core/umem_odp.c
++++ b/drivers/infiniband/core/umem_odp.c
+@@ -187,14 +187,28 @@ ib_umem_odp_alloc_child(struct ib_umem_o
+ odp_data->page_shift = PAGE_SHIFT;
+ odp_data->notifier.ops = ops;
+
++ /*
++ * A mmget must be held when registering a notifier, the owming_mm only
++ * has a mm_grab at this point.
++ */
++ if (!mmget_not_zero(umem->owning_mm)) {
++ ret = -EFAULT;
++ goto out_free;
++ }
++
+ odp_data->tgid = get_pid(root->tgid);
+ ret = ib_init_umem_odp(odp_data, ops);
+- if (ret) {
+- put_pid(odp_data->tgid);
+- kfree(odp_data);
+- return ERR_PTR(ret);
+- }
++ if (ret)
++ goto out_tgid;
++ mmput(umem->owning_mm);
+ return odp_data;
++
++out_tgid:
++ put_pid(odp_data->tgid);
++ mmput(umem->owning_mm);
++out_free:
++ kfree(odp_data);
++ return ERR_PTR(ret);
+ }
+ EXPORT_SYMBOL(ib_umem_odp_alloc_child);
+
--- /dev/null
+From 6affca140cbea01f497c4f4e16f1e2be7f74bd04 Mon Sep 17 00:00:00 2001
+From: Max Gurtovoy <maxg@mellanox.com>
+Date: Thu, 20 Feb 2020 12:08:18 +0200
+Subject: RDMA/rw: Fix error flow during RDMA context initialization
+
+From: Max Gurtovoy <maxg@mellanox.com>
+
+commit 6affca140cbea01f497c4f4e16f1e2be7f74bd04 upstream.
+
+In case the SGL was mapped for P2P DMA operation, we must unmap it using
+pci_p2pdma_unmap_sg during the error unwind of rdma_rw_ctx_init()
+
+Fixes: 7f73eac3a713 ("PCI/P2PDMA: Introduce pci_p2pdma_unmap_sg()")
+Link: https://lore.kernel.org/r/20200220100819.41860-1-maxg@mellanox.com
+Signed-off-by: Max Gurtovoy <maxg@mellanox.com>
+Reviewed-by: Leon Romanovsky <leonro@mellanox.com>
+Reviewed-by: Logan Gunthorpe <logang@deltatee.com>
+Signed-off-by: Jason Gunthorpe <jgg@mellanox.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/infiniband/core/rw.c | 31 ++++++++++++++++++++-----------
+ 1 file changed, 20 insertions(+), 11 deletions(-)
+
+--- a/drivers/infiniband/core/rw.c
++++ b/drivers/infiniband/core/rw.c
+@@ -273,6 +273,23 @@ static int rdma_rw_init_single_wr(struct
+ return 1;
+ }
+
++static void rdma_rw_unmap_sg(struct ib_device *dev, struct scatterlist *sg,
++ u32 sg_cnt, enum dma_data_direction dir)
++{
++ if (is_pci_p2pdma_page(sg_page(sg)))
++ pci_p2pdma_unmap_sg(dev->dma_device, sg, sg_cnt, dir);
++ else
++ ib_dma_unmap_sg(dev, sg, sg_cnt, dir);
++}
++
++static int rdma_rw_map_sg(struct ib_device *dev, struct scatterlist *sg,
++ u32 sg_cnt, enum dma_data_direction dir)
++{
++ if (is_pci_p2pdma_page(sg_page(sg)))
++ return pci_p2pdma_map_sg(dev->dma_device, sg, sg_cnt, dir);
++ return ib_dma_map_sg(dev, sg, sg_cnt, dir);
++}
++
+ /**
+ * rdma_rw_ctx_init - initialize a RDMA READ/WRITE context
+ * @ctx: context to initialize
+@@ -295,11 +312,7 @@ int rdma_rw_ctx_init(struct rdma_rw_ctx
+ struct ib_device *dev = qp->pd->device;
+ int ret;
+
+- if (is_pci_p2pdma_page(sg_page(sg)))
+- ret = pci_p2pdma_map_sg(dev->dma_device, sg, sg_cnt, dir);
+- else
+- ret = ib_dma_map_sg(dev, sg, sg_cnt, dir);
+-
++ ret = rdma_rw_map_sg(dev, sg, sg_cnt, dir);
+ if (!ret)
+ return -ENOMEM;
+ sg_cnt = ret;
+@@ -338,7 +351,7 @@ int rdma_rw_ctx_init(struct rdma_rw_ctx
+ return ret;
+
+ out_unmap_sg:
+- ib_dma_unmap_sg(dev, sg, sg_cnt, dir);
++ rdma_rw_unmap_sg(dev, sg, sg_cnt, dir);
+ return ret;
+ }
+ EXPORT_SYMBOL(rdma_rw_ctx_init);
+@@ -588,11 +601,7 @@ void rdma_rw_ctx_destroy(struct rdma_rw_
+ break;
+ }
+
+- if (is_pci_p2pdma_page(sg_page(sg)))
+- pci_p2pdma_unmap_sg(qp->pd->device->dma_device, sg,
+- sg_cnt, dir);
+- else
+- ib_dma_unmap_sg(qp->pd->device, sg, sg_cnt, dir);
++ rdma_rw_unmap_sg(qp->pd->device, sg, sg_cnt, dir);
+ }
+ EXPORT_SYMBOL(rdma_rw_ctx_destroy);
+
--- /dev/null
+From 12e5eef0f4d8087ea7b559f6630be08ffea2d851 Mon Sep 17 00:00:00 2001
+From: Bernard Metzler <bmt@zurich.ibm.com>
+Date: Mon, 2 Mar 2020 16:58:14 +0100
+Subject: RDMA/siw: Fix failure handling during device creation
+
+From: Bernard Metzler <bmt@zurich.ibm.com>
+
+commit 12e5eef0f4d8087ea7b559f6630be08ffea2d851 upstream.
+
+A failing call to ib_device_set_netdev() during device creation caused
+system crash due to xa_destroy of uninitialized xarray hit by device
+deallocation. Fixed by moving xarray initialization before potential
+device deallocation.
+
+Fixes: bdcf26bf9b3a ("rdma/siw: network and RDMA core interface")
+Link: https://lore.kernel.org/r/20200302155814.9896-1-bmt@zurich.ibm.com
+Reported-by: syzbot+2e80962bedd9559fe0b3@syzkaller.appspotmail.com
+Signed-off-by: Bernard Metzler <bmt@zurich.ibm.com>
+Signed-off-by: Jason Gunthorpe <jgg@mellanox.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/infiniband/sw/siw/siw_main.c | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+--- a/drivers/infiniband/sw/siw/siw_main.c
++++ b/drivers/infiniband/sw/siw/siw_main.c
+@@ -388,6 +388,9 @@ static struct siw_device *siw_device_cre
+ { .max_segment_size = SZ_2G };
+ base_dev->num_comp_vectors = num_possible_cpus();
+
++ xa_init_flags(&sdev->qp_xa, XA_FLAGS_ALLOC1);
++ xa_init_flags(&sdev->mem_xa, XA_FLAGS_ALLOC1);
++
+ ib_set_device_ops(base_dev, &siw_device_ops);
+ rv = ib_device_set_netdev(base_dev, netdev, 1);
+ if (rv)
+@@ -415,9 +418,6 @@ static struct siw_device *siw_device_cre
+ sdev->attrs.max_srq_wr = SIW_MAX_SRQ_WR;
+ sdev->attrs.max_srq_sge = SIW_MAX_SGE;
+
+- xa_init_flags(&sdev->qp_xa, XA_FLAGS_ALLOC1);
+- xa_init_flags(&sdev->mem_xa, XA_FLAGS_ALLOC1);
+-
+ INIT_LIST_HEAD(&sdev->cep_list);
+ INIT_LIST_HEAD(&sdev->qp_list);
+
--- /dev/null
+From a5b0cda136f4f420a8e24e50d19dfcef2f81df2e Mon Sep 17 00:00:00 2001
+From: Petr Vorel <petr.vorel@gmail.com>
+Date: Tue, 28 Jan 2020 00:14:39 +0100
+Subject: regulator: qcom_spmi: Fix docs for PM8004
+
+From: Petr Vorel <petr.vorel@gmail.com>
+
+commit a5b0cda136f4f420a8e24e50d19dfcef2f81df2e upstream.
+
+Fixes: 2e36e140b8b8 ("regulator: qcom_spmi: Add support for PM8004 regulators")
+
+Signed-off-by: Petr Vorel <petr.vorel@gmail.com>
+Link: https://lore.kernel.org/r/20200127231439.3562452-1-petr.vorel@gmail.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ Documentation/devicetree/bindings/regulator/qcom,spmi-regulator.txt | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/Documentation/devicetree/bindings/regulator/qcom,spmi-regulator.txt
++++ b/Documentation/devicetree/bindings/regulator/qcom,spmi-regulator.txt
+@@ -161,7 +161,7 @@ The regulator node houses sub-nodes for
+ sub-node is identified using the node's name, with valid values listed for each
+ of the PMICs below.
+
+-pm8005:
++pm8004:
+ s2, s5
+
+ pm8005:
--- /dev/null
+From 02fbabd5f4ed182d2c616e49309f5a3efd9ec671 Mon Sep 17 00:00:00 2001
+From: Fabrice Gasnier <fabrice.gasnier@st.com>
+Date: Wed, 4 Mar 2020 09:55:32 +0100
+Subject: regulator: stm32-vrefbuf: fix a possible overshoot when re-enabling
+
+From: Fabrice Gasnier <fabrice.gasnier@st.com>
+
+commit 02fbabd5f4ed182d2c616e49309f5a3efd9ec671 upstream.
+
+There maybe an overshoot, when disabling, then re-enabling vrefbuf
+too quickly. VREFBUF is used by ADC/DAC on some boards. When re-enabling
+too quickly, an overshoot on the reference voltage make the conversions
+inaccurate for a short period of time.
+- Don't put the VREFBUF in HiZ when disabling, to force an active
+discharge.
+- Enforce a 1ms OFF/ON delay
+
+Fixes: 0cdbf481e927 ("regulator: Add support for stm32-vrefbuf")
+
+Signed-off-by: Fabrice Gasnier <fabrice.gasnier@st.com>
+Message-Id: <1583312132-20932-1-git-send-email-fabrice.gasnier@st.com>
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/regulator/stm32-vrefbuf.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+--- a/drivers/regulator/stm32-vrefbuf.c
++++ b/drivers/regulator/stm32-vrefbuf.c
+@@ -88,7 +88,7 @@ static int stm32_vrefbuf_disable(struct
+ }
+
+ val = readl_relaxed(priv->base + STM32_VREFBUF_CSR);
+- val = (val & ~STM32_ENVR) | STM32_HIZ;
++ val &= ~STM32_ENVR;
+ writel_relaxed(val, priv->base + STM32_VREFBUF_CSR);
+
+ pm_runtime_mark_last_busy(priv->dev);
+@@ -175,6 +175,7 @@ static const struct regulator_desc stm32
+ .volt_table = stm32_vrefbuf_voltages,
+ .n_voltages = ARRAY_SIZE(stm32_vrefbuf_voltages),
+ .ops = &stm32_vrefbuf_volt_ops,
++ .off_on_delay = 1000,
+ .type = REGULATOR_VOLTAGE,
+ .owner = THIS_MODULE,
+ };
--- /dev/null
+From e4103312d7b7afb8a3a7a842a33ef2b1856b2c0f Mon Sep 17 00:00:00 2001
+From: Parav Pandit <parav@mellanox.com>
+Date: Wed, 12 Feb 2020 09:26:29 +0200
+Subject: Revert "RDMA/cma: Simplify rdma_resolve_addr() error flow"
+
+From: Parav Pandit <parav@mellanox.com>
+
+commit e4103312d7b7afb8a3a7a842a33ef2b1856b2c0f upstream.
+
+This reverts commit 219d2e9dfda9431b808c28d5efc74b404b95b638.
+
+The call chain below requires the cm_id_priv's destination address to be
+setup before performing rdma_bind_addr(). Otherwise source port allocation
+fails as cma_port_is_unique() no longer sees the correct tuple to allow
+duplicate users of the source port.
+
+rdma_resolve_addr()
+ cma_bind_addr()
+ rdma_bind_addr()
+ cma_get_port()
+ cma_alloc_any_port()
+ cma_port_is_unique() <- compared with zero daddr
+
+This can result in false failures to connect, particularly if the source
+port range is restricted.
+
+Fixes: 219d2e9dfda9 ("RDMA/cma: Simplify rdma_resolve_addr() error flow")
+Link: https://lore.kernel.org/r/20200212072635.682689-4-leon@kernel.org
+Signed-off-by: Parav Pandit <parav@mellanox.com>
+Signed-off-by: Leon Romanovsky <leonro@mellanox.com>
+Signed-off-by: Jason Gunthorpe <jgg@mellanox.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/infiniband/core/cma.c | 15 +++++++++++----
+ 1 file changed, 11 insertions(+), 4 deletions(-)
+
+--- a/drivers/infiniband/core/cma.c
++++ b/drivers/infiniband/core/cma.c
+@@ -3182,19 +3182,26 @@ int rdma_resolve_addr(struct rdma_cm_id
+ int ret;
+
+ id_priv = container_of(id, struct rdma_id_private, id);
++ memcpy(cma_dst_addr(id_priv), dst_addr, rdma_addr_size(dst_addr));
+ if (id_priv->state == RDMA_CM_IDLE) {
+ ret = cma_bind_addr(id, src_addr, dst_addr);
+- if (ret)
++ if (ret) {
++ memset(cma_dst_addr(id_priv), 0,
++ rdma_addr_size(dst_addr));
+ return ret;
++ }
+ }
+
+- if (cma_family(id_priv) != dst_addr->sa_family)
++ if (cma_family(id_priv) != dst_addr->sa_family) {
++ memset(cma_dst_addr(id_priv), 0, rdma_addr_size(dst_addr));
+ return -EINVAL;
++ }
+
+- if (!cma_comp_exch(id_priv, RDMA_CM_ADDR_BOUND, RDMA_CM_ADDR_QUERY))
++ if (!cma_comp_exch(id_priv, RDMA_CM_ADDR_BOUND, RDMA_CM_ADDR_QUERY)) {
++ memset(cma_dst_addr(id_priv), 0, rdma_addr_size(dst_addr));
+ return -EINVAL;
++ }
+
+- memcpy(cma_dst_addr(id_priv), dst_addr, rdma_addr_size(dst_addr));
+ if (cma_any_addr(dst_addr)) {
+ ret = cma_resolve_loopback(id_priv);
+ } else {
--- /dev/null
+From c14dfddbd869bf0c2bafb7ef260c41d9cebbcfec Mon Sep 17 00:00:00 2001
+From: Jason Gunthorpe <jgg@ziepe.ca>
+Date: Fri, 21 Feb 2020 15:20:26 +0000
+Subject: RMDA/cm: Fix missing ib_cm_destroy_id() in ib_cm_insert_listen()
+
+From: Jason Gunthorpe <jgg@mellanox.com>
+
+commit c14dfddbd869bf0c2bafb7ef260c41d9cebbcfec upstream.
+
+The algorithm pre-allocates a cm_id since allocation cannot be done while
+holding the cm.lock spinlock, however it doesn't free it on one error
+path, leading to a memory leak.
+
+Fixes: 067b171b8679 ("IB/cm: Share listening CM IDs")
+Link: https://lore.kernel.org/r/20200221152023.GA8680@ziepe.ca
+Signed-off-by: Jason Gunthorpe <jgg@mellanox.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/infiniband/core/cm.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/drivers/infiniband/core/cm.c
++++ b/drivers/infiniband/core/cm.c
+@@ -1202,6 +1202,7 @@ struct ib_cm_id *ib_cm_insert_listen(str
+ /* Sharing an ib_cm_id with different handlers is not
+ * supported */
+ spin_unlock_irqrestore(&cm.lock, flags);
++ ib_destroy_cm_id(cm_id);
+ return ERR_PTR(-EINVAL);
+ }
+ refcount_inc(&cm_id_priv->refcount);
asoc-sof-fix-snd_sof_ipc_stream_posn.patch
asoc-intel-skl-fix-pin-debug-prints.patch
asoc-intel-skl-fix-possible-buffer-overflow-in-debug-outputs.patch
+asoc-pcm-fix-possible-buffer-overflow-in-dpcm-state-sysfs-output.patch
+asoc-pcm512x-fix-unbalanced-regulator-enable-call-in-probe-error-path.patch
+asoc-intel-skylake-fix-available-clock-counter-incrementation.patch
+asoc-dapm-correct-dapm-handling-of-active-widgets-during-shutdown.patch
+asoc-soc-component-tidyup-snd_soc_pcm_component_sync_stop.patch
+spi-atmel-quadspi-fix-possible-mmio-window-size-overrun.patch
+drm-panfrost-don-t-try-to-map-on-error-faults.patch
+drm-mediatek-handle-component-type-mtk_disp_ovl_2l-correctly.patch
+drm-ttm-fix-leaking-fences-via-ttm_buffer_object_transfer.patch
+drm-kirin-revert-fix-for-hikey620-display-offset-problem.patch
+drm-sun4i-add-separate-de3-vi-layer-formats.patch
+drm-sun4i-fix-de2-vi-layer-format-support.patch
+drm-sun4i-de2-de3-remove-unsupported-vi-layer-formats.patch
+drm-i915-program-mbus-with-rmw-during-initialization.patch
+drm-i915-selftests-fix-return-in-assert_mmap_offset.patch
+drm-i915-perf-reintroduce-wait-on-oa-configuration-completion.patch
+phy-mapphone-mdm6600-fix-timeouts-by-adding-wake-up-handling.patch
+phy-mapphone-mdm6600-fix-write-timeouts-with-shorter-gpio-toggle-interval.patch
+arm-dts-imx6-phycore-som-fix-emmc-supply.patch
+arm64-dts-imx8qxp-mek-remove-unexisting-ethernet-phy.patch
+firmware-imx-misc-align-imx-sc-msg-structs-to-4.patch
+firmware-imx-scu-pd-align-imx-sc-msg-structs-to-4.patch
+firmware-imx-align-imx_sc_msg_req_cpu_start-to-4.patch
+soc-imx-scu-align-imx-sc-msg-structs-to-4.patch
+revert-rdma-cma-simplify-rdma_resolve_addr-error-flow.patch
+rdma-rw-fix-error-flow-during-rdma-context-initialization.patch
+rdma-odp-ensure-the-mm-is-still-alive-before-creating-an-implicit-child.patch
+rdma-nldev-fix-crash-when-set-a-qp-to-a-new-counter-but-qpn-is-missing.patch
+rdma-siw-fix-failure-handling-during-device-creation.patch
+rdma-iwcm-fix-iwcm-work-deallocation.patch
+rdma-core-fix-protection-fault-in-ib_mr_pool_destroy.patch
+regulator-stm32-vrefbuf-fix-a-possible-overshoot-when-re-enabling.patch
+regulator-qcom_spmi-fix-docs-for-pm8004.patch
+rmda-cm-fix-missing-ib_cm_destroy_id-in-ib_cm_insert_listen.patch
+ib-mlx5-fix-implicit-odp-race.patch
+ib-hfi1-qib-ensure-rcu-is-locked-when-accessing-list.patch
--- /dev/null
+From f10e58a5d20e1cf3a39a842da92c9dd0c3c23849 Mon Sep 17 00:00:00 2001
+From: Leonard Crestez <leonard.crestez@nxp.com>
+Date: Thu, 20 Feb 2020 18:29:39 +0200
+Subject: soc: imx-scu: Align imx sc msg structs to 4
+
+From: Leonard Crestez <leonard.crestez@nxp.com>
+
+commit f10e58a5d20e1cf3a39a842da92c9dd0c3c23849 upstream.
+
+The imx SC api strongly assumes that messages are composed out of
+4-bytes words but some of our message structs have odd sizeofs.
+
+This produces many oopses with CONFIG_KASAN=y.
+
+Fix by marking with __aligned(4).
+
+Fixes: 73feb4d0f8f1 ("soc: imx-scu: Add SoC UID(unique identifier) support")
+Signed-off-by: Leonard Crestez <leonard.crestez@nxp.com>
+Signed-off-by: Shawn Guo <shawnguo@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/soc/imx/soc-imx-scu.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/soc/imx/soc-imx-scu.c
++++ b/drivers/soc/imx/soc-imx-scu.c
+@@ -25,7 +25,7 @@ struct imx_sc_msg_misc_get_soc_id {
+ u32 id;
+ } resp;
+ } data;
+-} __packed;
++} __packed __aligned(4);
+
+ struct imx_sc_msg_misc_get_soc_uid {
+ struct imx_sc_rpc_msg hdr;
--- /dev/null
+From 8e093ea4d3593379be46b845b9e823179558047e Mon Sep 17 00:00:00 2001
+From: Tudor Ambarus <tudor.ambarus@microchip.com>
+Date: Fri, 28 Feb 2020 15:55:32 +0000
+Subject: spi: atmel-quadspi: fix possible MMIO window size overrun
+
+From: Tudor Ambarus <tudor.ambarus@microchip.com>
+
+commit 8e093ea4d3593379be46b845b9e823179558047e upstream.
+
+The QSPI controller memory space is limited to 128MB:
+0x9000_00000-0x9800_00000/0XD000_0000--0XD800_0000.
+
+There are nor flashes that are bigger in size than the memory size
+supported by the controller: Micron MT25QL02G (256 MB).
+
+Check if the address exceeds the MMIO window size. An improvement
+would be to add support for regular SPI mode and fall back to it
+when the flash memories overrun the controller's memory space.
+
+Fixes: 0e6aae08e9ae ("spi: Add QuadSPI driver for Atmel SAMA5D2")
+Signed-off-by: Tudor Ambarus <tudor.ambarus@microchip.com>
+Link: https://lore.kernel.org/r/20200228155437.1558219-1-tudor.ambarus@microchip.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/spi/atmel-quadspi.c | 11 +++++++++++
+ 1 file changed, 11 insertions(+)
+
+--- a/drivers/spi/atmel-quadspi.c
++++ b/drivers/spi/atmel-quadspi.c
+@@ -149,6 +149,7 @@ struct atmel_qspi {
+ struct clk *qspick;
+ struct platform_device *pdev;
+ const struct atmel_qspi_caps *caps;
++ resource_size_t mmap_size;
+ u32 pending;
+ u32 mr;
+ u32 scr;
+@@ -329,6 +330,14 @@ static int atmel_qspi_exec_op(struct spi
+ u32 sr, offset;
+ int err;
+
++ /*
++ * Check if the address exceeds the MMIO window size. An improvement
++ * would be to add support for regular SPI mode and fall back to it
++ * when the flash memories overrun the controller's memory space.
++ */
++ if (op->addr.val + op->data.nbytes > aq->mmap_size)
++ return -ENOTSUPP;
++
+ err = atmel_qspi_set_cfg(aq, op, &offset);
+ if (err)
+ return err;
+@@ -480,6 +489,8 @@ static int atmel_qspi_probe(struct platf
+ goto exit;
+ }
+
++ aq->mmap_size = resource_size(res);
++
+ /* Get the peripheral clock */
+ aq->pclk = devm_clk_get(&pdev->dev, "pclk");
+ if (IS_ERR(aq->pclk))
projects / thirdparty / kernel / stable-queue.git / commitdiff
