--- /dev/null
+From f242db9188a9dc62a1a078bf955c48897578ea8f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 11 Apr 2019 14:29:37 +0530
+Subject: mmc: sdhci-omap: Don't finish_mrq() on a command error during tuning
+
+From: Faiz Abbas <faiz_abbas@ti.com>
+
+[ Upstream commit 5c41ea6d52003b5bc77c2a82fd5ca7d480237d89 ]
+
+commit 5b0d62108b46 ("mmc: sdhci-omap: Add platform specific reset
+callback") skips data resets during tuning operation. Because of this,
+a data error or data finish interrupt might still arrive after a command
+error has been handled and the mrq ended. This ends up with a "mmc0: Got
+data interrupt 0x00000002 even though no data operation was in progress"
+error message.
+
+Fix this by adding a platform specific callback for sdhci_irq. Mark the
+mrq as a failure but wait for a data interrupt instead of calling
+finish_mrq().
+
+Fixes: 5b0d62108b46 ("mmc: sdhci-omap: Add platform specific reset
+callback")
+Signed-off-by: Faiz Abbas <faiz_abbas@ti.com>
+Acked-by: Adrian Hunter <adrian.hunter@intel.com>
+Cc: stable@vger.kernel.org
+Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/mmc/host/sdhci-omap.c | 38 +++++++++++++++++++++++++++++++++++
+ 1 file changed, 38 insertions(+)
+
+diff --git a/drivers/mmc/host/sdhci-omap.c b/drivers/mmc/host/sdhci-omap.c
+index 79ee5fc5a2013..833e13cabd2a8 100644
+--- a/drivers/mmc/host/sdhci-omap.c
++++ b/drivers/mmc/host/sdhci-omap.c
+@@ -801,6 +801,43 @@ void sdhci_omap_reset(struct sdhci_host *host, u8 mask)
+ sdhci_reset(host, mask);
+ }
+
++#define CMD_ERR_MASK (SDHCI_INT_CRC | SDHCI_INT_END_BIT | SDHCI_INT_INDEX |\
++ SDHCI_INT_TIMEOUT)
++#define CMD_MASK (CMD_ERR_MASK | SDHCI_INT_RESPONSE)
++
++static u32 sdhci_omap_irq(struct sdhci_host *host, u32 intmask)
++{
++ struct sdhci_pltfm_host *pltfm_host = sdhci_priv(host);
++ struct sdhci_omap_host *omap_host = sdhci_pltfm_priv(pltfm_host);
++
++ if (omap_host->is_tuning && host->cmd && !host->data_early &&
++ (intmask & CMD_ERR_MASK)) {
++
++ /*
++ * Since we are not resetting data lines during tuning
++ * operation, data error or data complete interrupts
++ * might still arrive. Mark this request as a failure
++ * but still wait for the data interrupt
++ */
++ if (intmask & SDHCI_INT_TIMEOUT)
++ host->cmd->error = -ETIMEDOUT;
++ else
++ host->cmd->error = -EILSEQ;
++
++ host->cmd = NULL;
++
++ /*
++ * Sometimes command error interrupts and command complete
++ * interrupt will arrive together. Clear all command related
++ * interrupts here.
++ */
++ sdhci_writel(host, intmask & CMD_MASK, SDHCI_INT_STATUS);
++ intmask &= ~CMD_MASK;
++ }
++
++ return intmask;
++}
++
+ static struct sdhci_ops sdhci_omap_ops = {
+ .set_clock = sdhci_omap_set_clock,
+ .set_power = sdhci_omap_set_power,
+@@ -811,6 +848,7 @@ static struct sdhci_ops sdhci_omap_ops = {
+ .platform_send_init_74_clocks = sdhci_omap_init_74_clocks,
+ .reset = sdhci_omap_reset,
+ .set_uhs_signaling = sdhci_omap_set_uhs_signaling,
++ .irq = sdhci_omap_irq,
+ };
+
+ static int sdhci_omap_set_capabilities(struct sdhci_omap_host *omap_host)
+--
+2.20.1
+
--- /dev/null
+From 49ada0390dee8e4db4da2ebcbc0b63e2d177c169 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 10 Oct 2019 16:22:30 +0530
+Subject: mmc: sdhci-omap: Fix Tuning procedure for temperatures < -20C
+
+From: Faiz Abbas <faiz_abbas@ti.com>
+
+[ Upstream commit feb40824d78eac5e48f56498dca941754dff33d7 ]
+
+According to the App note[1] detailing the tuning algorithm, for
+temperatures < -20C, the initial tuning value should be min(largest value
+in LPW - 24, ceil(13/16 ratio of LPW)). The largest value in LPW is
+(max_window + 4 * (max_len - 1)) and not (max_window + 4 * max_len) itself.
+Fix this implementation.
+
+[1] http://www.ti.com/lit/an/spraca9b/spraca9b.pdf
+
+Fixes: 961de0a856e3 ("mmc: sdhci-omap: Workaround errata regarding SDR104/HS200 tuning failures (i929)")
+Cc: stable@vger.kernel.org
+Signed-off-by: Faiz Abbas <faiz_abbas@ti.com>
+Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/mmc/host/sdhci-omap.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/mmc/host/sdhci-omap.c b/drivers/mmc/host/sdhci-omap.c
+index 833e13cabd2a8..05ade7a2dd243 100644
+--- a/drivers/mmc/host/sdhci-omap.c
++++ b/drivers/mmc/host/sdhci-omap.c
+@@ -387,7 +387,7 @@ static int sdhci_omap_execute_tuning(struct mmc_host *mmc, u32 opcode)
+ * on temperature
+ */
+ if (temperature < -20000)
+- phase_delay = min(max_window + 4 * max_len - 24,
++ phase_delay = min(max_window + 4 * (max_len - 1) - 24,
+ max_window +
+ DIV_ROUND_UP(13 * max_len, 16) * 4);
+ else if (temperature < 20000)
+--
+2.20.1
+
net-rmnet-fix-packet-forwarding-in-rmnet-bridge-mode.patch
sfc-fix-timestamp-reconstruction-at-16-bit-rollover-.patch
jbd2-fix-data-races-at-struct-journal_head.patch
+wimax-i2400-fix-memory-leak.patch
+wimax-i2400-fix-memory-leak-in-i2400m_op_rfkill_sw_t.patch
+mmc-sdhci-omap-don-t-finish_mrq-on-a-command-error-d.patch
+mmc-sdhci-omap-fix-tuning-procedure-for-temperatures.patch
--- /dev/null
+From ae7d354ecef2efff3a8dd1ac4a6c483ab7ef52ff Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 25 Oct 2019 23:53:30 -0500
+Subject: wimax: i2400: Fix memory leak in i2400m_op_rfkill_sw_toggle
+
+From: Navid Emamdoost <navid.emamdoost@gmail.com>
+
+[ Upstream commit 6f3ef5c25cc762687a7341c18cbea5af54461407 ]
+
+In the implementation of i2400m_op_rfkill_sw_toggle() the allocated
+buffer for cmd should be released before returning. The
+documentation for i2400m_msg_to_dev() says when it returns the buffer
+can be reused. Meaning cmd should be released in either case. Move
+kfree(cmd) before return to be reached by all execution paths.
+
+Fixes: 2507e6ab7a9a ("wimax: i2400: fix memory leak")
+Signed-off-by: Navid Emamdoost <navid.emamdoost@gmail.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wimax/i2400m/op-rfkill.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/net/wimax/i2400m/op-rfkill.c b/drivers/net/wimax/i2400m/op-rfkill.c
+index 7c92e8ace9c2f..dc6fe93ce71f6 100644
+--- a/drivers/net/wimax/i2400m/op-rfkill.c
++++ b/drivers/net/wimax/i2400m/op-rfkill.c
+@@ -142,12 +142,12 @@ int i2400m_op_rfkill_sw_toggle(struct wimax_dev *wimax_dev,
+ "%d\n", result);
+ result = 0;
+ error_cmd:
+- kfree(cmd);
+ kfree_skb(ack_skb);
+ error_msg_to_dev:
+ error_alloc:
+ d_fnend(4, dev, "(wimax_dev %p state %d) = %d\n",
+ wimax_dev, state, result);
++ kfree(cmd);
+ return result;
+ }
+
+--
+2.20.1
+
--- /dev/null
+From 543108d94dfb786591ae0cb8c5016624e7e4129f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 10 Sep 2019 18:01:40 -0500
+Subject: wimax: i2400: fix memory leak
+
+From: Navid Emamdoost <navid.emamdoost@gmail.com>
+
+[ Upstream commit 2507e6ab7a9a440773be476141a255934468c5ef ]
+
+In i2400m_op_rfkill_sw_toggle cmd buffer should be released along with
+skb response.
+
+Signed-off-by: Navid Emamdoost <navid.emamdoost@gmail.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wimax/i2400m/op-rfkill.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/net/wimax/i2400m/op-rfkill.c b/drivers/net/wimax/i2400m/op-rfkill.c
+index b0dba35a8ad2a..7c92e8ace9c2f 100644
+--- a/drivers/net/wimax/i2400m/op-rfkill.c
++++ b/drivers/net/wimax/i2400m/op-rfkill.c
+@@ -142,6 +142,7 @@ int i2400m_op_rfkill_sw_toggle(struct wimax_dev *wimax_dev,
+ "%d\n", result);
+ result = 0;
+ error_cmd:
++ kfree(cmd);
+ kfree_skb(ack_skb);
+ error_msg_to_dev:
+ error_alloc:
+--
+2.20.1
+
projects / thirdparty / kernel / stable-queue.git / commitdiff
