--- /dev/null
+From eb0bbba7636b9fc81939d6087a5fe575e150c95a Mon Sep 17 00:00:00 2001
+From: Marco Felsch <m.felsch@pengutronix.de>
+Date: Thu, 16 Jan 2020 15:01:08 +0100
+Subject: ARM: dts: imx6: phycore-som: fix emmc supply
+
+From: Marco Felsch <m.felsch@pengutronix.de>
+
+commit eb0bbba7636b9fc81939d6087a5fe575e150c95a upstream.
+
+Currently the vmmc is supplied by the 1.8V pmic rail but this is wrong.
+The default module behaviour is to power VCCQ and VCC by the 3.3V power
+rail. Optional the user can connect the VCCQ to the pmic 1.8V emmc
+power rail using a solder jumper.
+
+Fixes: ddec5d1c0047 ("ARM: dts: imx6: Add initial support for phyCORE-i.MX 6 SOM")
+Signed-off-by: Marco Felsch <m.felsch@pengutronix.de>
+Signed-off-by: Shawn Guo <shawnguo@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ arch/arm/boot/dts/imx6qdl-phytec-phycore-som.dtsi | 1 -
+ 1 file changed, 1 deletion(-)
+
+--- a/arch/arm/boot/dts/imx6qdl-phytec-phycore-som.dtsi
++++ b/arch/arm/boot/dts/imx6qdl-phytec-phycore-som.dtsi
+@@ -183,7 +183,6 @@
+ pinctrl-0 = <&pinctrl_usdhc4>;
+ bus-width = <8>;
+ non-removable;
+- vmmc-supply = <&vdd_emmc_1p8>;
+ status = "disabled";
+ };
+
--- /dev/null
+From 9b3193089e77d3b59b045146ff1c770dd899acb1 Mon Sep 17 00:00:00 2001
+From: Charles Keepax <ckeepax@opensource.cirrus.com>
+Date: Fri, 28 Feb 2020 15:31:45 +0000
+Subject: ASoC: dapm: Correct DAPM handling of active widgets during shutdown
+
+From: Charles Keepax <ckeepax@opensource.cirrus.com>
+
+commit 9b3193089e77d3b59b045146ff1c770dd899acb1 upstream.
+
+commit c2caa4da46a4 ("ASoC: Fix widget powerdown on shutdown") added a
+set of the power state during snd_soc_dapm_shutdown to ensure the
+widgets powered off. However, when commit 39eb5fd13dff
+("ASoC: dapm: Delay w->power update until the changes are written")
+added the new_power member of the widget structure, to differentiate
+between the current power state and the target power state, it did not
+update the shutdown to use the new_power member.
+
+As new_power has not updated it will be left in the state set by the
+last DAPM sequence, ie. 1 for active widgets. So as the DAPM sequence
+for the shutdown proceeds it will turn the widgets on (despite them
+already being on) rather than turning them off.
+
+Fixes: 39eb5fd13dff ("ASoC: dapm: Delay w->power update until the changes are written")
+Signed-off-by: Charles Keepax <ckeepax@opensource.cirrus.com>
+Link: https://lore.kernel.org/r/20200228153145.21013-1-ckeepax@opensource.cirrus.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ sound/soc/soc-dapm.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/sound/soc/soc-dapm.c
++++ b/sound/soc/soc-dapm.c
+@@ -4551,7 +4551,7 @@ static void soc_dapm_shutdown_dapm(struc
+ continue;
+ if (w->power) {
+ dapm_seq_insert(w, &down_list, false);
+- w->power = 0;
++ w->new_power = 0;
+ powerdown = 1;
+ }
+ }
--- /dev/null
+From 6c89ffea60aa3b2a33ae7987de1e84bfb89e4c9e Mon Sep 17 00:00:00 2001
+From: Takashi Iwai <tiwai@suse.de>
+Date: Tue, 18 Feb 2020 12:17:37 +0100
+Subject: ASoC: pcm: Fix possible buffer overflow in dpcm state sysfs output
+
+From: Takashi Iwai <tiwai@suse.de>
+
+commit 6c89ffea60aa3b2a33ae7987de1e84bfb89e4c9e upstream.
+
+dpcm_show_state() invokes multiple snprintf() calls to concatenate
+formatted strings on the fixed size buffer. The usage of snprintf()
+is supposed for avoiding the buffer overflow, but it doesn't work as
+expected because snprintf() doesn't return the actual output size but
+the size to be written.
+
+Fix this bug by replacing all snprintf() calls with scnprintf()
+calls.
+
+Fixes: f86dcef87b77 ("ASoC: dpcm: Add debugFS support for DPCM")
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Acked-by: Cezary Rojewski <cezary.rojewski@intel.com>
+Link: https://lore.kernel.org/r/20200218111737.14193-4-tiwai@suse.de
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ sound/soc/soc-pcm.c | 16 ++++++++--------
+ 1 file changed, 8 insertions(+), 8 deletions(-)
+
+--- a/sound/soc/soc-pcm.c
++++ b/sound/soc/soc-pcm.c
+@@ -3357,16 +3357,16 @@ static ssize_t dpcm_show_state(struct sn
+ ssize_t offset = 0;
+
+ /* FE state */
+- offset += snprintf(buf + offset, size - offset,
++ offset += scnprintf(buf + offset, size - offset,
+ "[%s - %s]\n", fe->dai_link->name,
+ stream ? "Capture" : "Playback");
+
+- offset += snprintf(buf + offset, size - offset, "State: %s\n",
++ offset += scnprintf(buf + offset, size - offset, "State: %s\n",
+ dpcm_state_string(fe->dpcm[stream].state));
+
+ if ((fe->dpcm[stream].state >= SND_SOC_DPCM_STATE_HW_PARAMS) &&
+ (fe->dpcm[stream].state <= SND_SOC_DPCM_STATE_STOP))
+- offset += snprintf(buf + offset, size - offset,
++ offset += scnprintf(buf + offset, size - offset,
+ "Hardware Params: "
+ "Format = %s, Channels = %d, Rate = %d\n",
+ snd_pcm_format_name(params_format(params)),
+@@ -3374,10 +3374,10 @@ static ssize_t dpcm_show_state(struct sn
+ params_rate(params));
+
+ /* BEs state */
+- offset += snprintf(buf + offset, size - offset, "Backends:\n");
++ offset += scnprintf(buf + offset, size - offset, "Backends:\n");
+
+ if (list_empty(&fe->dpcm[stream].be_clients)) {
+- offset += snprintf(buf + offset, size - offset,
++ offset += scnprintf(buf + offset, size - offset,
+ " No active DSP links\n");
+ goto out;
+ }
+@@ -3386,16 +3386,16 @@ static ssize_t dpcm_show_state(struct sn
+ struct snd_soc_pcm_runtime *be = dpcm->be;
+ params = &dpcm->hw_params;
+
+- offset += snprintf(buf + offset, size - offset,
++ offset += scnprintf(buf + offset, size - offset,
+ "- %s\n", be->dai_link->name);
+
+- offset += snprintf(buf + offset, size - offset,
++ offset += scnprintf(buf + offset, size - offset,
+ " State: %s\n",
+ dpcm_state_string(be->dpcm[stream].state));
+
+ if ((be->dpcm[stream].state >= SND_SOC_DPCM_STATE_HW_PARAMS) &&
+ (be->dpcm[stream].state <= SND_SOC_DPCM_STATE_STOP))
+- offset += snprintf(buf + offset, size - offset,
++ offset += scnprintf(buf + offset, size - offset,
+ " Hardware Params: "
+ "Format = %s, Channels = %d, Rate = %d\n",
+ snd_pcm_format_name(params_format(params)),
--- /dev/null
+From ac0a68997935c4acb92eaae5ad8982e0bb432d56 Mon Sep 17 00:00:00 2001
+From: Matthias Reichl <hias@horus.com>
+Date: Thu, 20 Feb 2020 21:29:56 +0100
+Subject: ASoC: pcm512x: Fix unbalanced regulator enable call in probe error path
+
+From: Matthias Reichl <hias@horus.com>
+
+commit ac0a68997935c4acb92eaae5ad8982e0bb432d56 upstream.
+
+When we get a clock error during probe we have to call
+regulator_bulk_disable before bailing out, otherwise we trigger
+a warning in regulator_put.
+
+Fix this by using "goto err" like in the error cases above.
+
+Fixes: 5a3af1293194d ("ASoC: pcm512x: Add PCM512x driver")
+Signed-off-by: Matthias Reichl <hias@horus.com>
+Reviewed-by: Pierre-Louis Bossart <pierre-louis.bossart@linux.intel.com>
+Link: https://lore.kernel.org/r/20200220202956.29233-1-hias@horus.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ sound/soc/codecs/pcm512x.c | 8 +++++---
+ 1 file changed, 5 insertions(+), 3 deletions(-)
+
+--- a/sound/soc/codecs/pcm512x.c
++++ b/sound/soc/codecs/pcm512x.c
+@@ -1437,13 +1437,15 @@ int pcm512x_probe(struct device *dev, st
+ }
+
+ pcm512x->sclk = devm_clk_get(dev, NULL);
+- if (PTR_ERR(pcm512x->sclk) == -EPROBE_DEFER)
+- return -EPROBE_DEFER;
++ if (PTR_ERR(pcm512x->sclk) == -EPROBE_DEFER) {
++ ret = -EPROBE_DEFER;
++ goto err;
++ }
+ if (!IS_ERR(pcm512x->sclk)) {
+ ret = clk_prepare_enable(pcm512x->sclk);
+ if (ret != 0) {
+ dev_err(dev, "Failed to enable SCLK: %d\n", ret);
+- return ret;
++ goto err;
+ }
+ }
+
--- /dev/null
+From a4769905f0ae32cae4f096f646ab03b8b4794c74 Mon Sep 17 00:00:00 2001
+From: Jernej Skrabec <jernej.skrabec@siol.net>
+Date: Mon, 24 Feb 2020 18:38:55 +0100
+Subject: drm/sun4i: de2/de3: Remove unsupported VI layer formats
+
+From: Jernej Skrabec <jernej.skrabec@siol.net>
+
+commit a4769905f0ae32cae4f096f646ab03b8b4794c74 upstream.
+
+YUV444 and YVU444 are planar formats, but HW format RGB888 is packed.
+This means that those two mappings were never correct. Remove them.
+
+Fixes: 60a3dcf96aa8 ("drm/sun4i: Add DE2 definitions for YUV formats")
+Acked-by: Maxime Ripard <mripard@kernel.org>
+Signed-off-by: Jernej Skrabec <jernej.skrabec@siol.net>
+Link: https://patchwork.freedesktop.org/patch/msgid/20200224173901.174016-2-jernej.skrabec@siol.net
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/gpu/drm/sun4i/sun8i_mixer.c | 12 ------------
+ drivers/gpu/drm/sun4i/sun8i_vi_layer.c | 2 --
+ 2 files changed, 14 deletions(-)
+
+--- a/drivers/gpu/drm/sun4i/sun8i_mixer.c
++++ b/drivers/gpu/drm/sun4i/sun8i_mixer.c
+@@ -257,12 +257,6 @@ static const struct de2_fmt_info de2_for
+ .csc = SUN8I_CSC_MODE_YUV2RGB,
+ },
+ {
+- .drm_fmt = DRM_FORMAT_YUV444,
+- .de2_fmt = SUN8I_MIXER_FBFMT_RGB888,
+- .rgb = true,
+- .csc = SUN8I_CSC_MODE_YUV2RGB,
+- },
+- {
+ .drm_fmt = DRM_FORMAT_YUV422,
+ .de2_fmt = SUN8I_MIXER_FBFMT_YUV422,
+ .rgb = false,
+@@ -281,12 +275,6 @@ static const struct de2_fmt_info de2_for
+ .csc = SUN8I_CSC_MODE_YUV2RGB,
+ },
+ {
+- .drm_fmt = DRM_FORMAT_YVU444,
+- .de2_fmt = SUN8I_MIXER_FBFMT_RGB888,
+- .rgb = true,
+- .csc = SUN8I_CSC_MODE_YVU2RGB,
+- },
+- {
+ .drm_fmt = DRM_FORMAT_YVU422,
+ .de2_fmt = SUN8I_MIXER_FBFMT_YUV422,
+ .rgb = false,
+--- a/drivers/gpu/drm/sun4i/sun8i_vi_layer.c
++++ b/drivers/gpu/drm/sun4i/sun8i_vi_layer.c
+@@ -363,11 +363,9 @@ static const u32 sun8i_vi_layer_formats[
+ DRM_FORMAT_YUV411,
+ DRM_FORMAT_YUV420,
+ DRM_FORMAT_YUV422,
+- DRM_FORMAT_YUV444,
+ DRM_FORMAT_YVU411,
+ DRM_FORMAT_YVU420,
+ DRM_FORMAT_YVU422,
+- DRM_FORMAT_YVU444,
+ };
+
+ struct sun8i_vi_layer *sun8i_vi_layer_init_one(struct drm_device *drm,
--- /dev/null
+From 20896ef137340e9426cf322606f764452f5eb960 Mon Sep 17 00:00:00 2001
+From: Jernej Skrabec <jernej.skrabec@siol.net>
+Date: Mon, 24 Feb 2020 18:38:57 +0100
+Subject: drm/sun4i: Fix DE2 VI layer format support
+
+From: Jernej Skrabec <jernej.skrabec@siol.net>
+
+commit 20896ef137340e9426cf322606f764452f5eb960 upstream.
+
+DE2 VI layer doesn't support blending which means alpha channel is
+ignored. Replace all formats with alpha with "don't care" (X) channel.
+
+Fixes: 7480ba4d7571 ("drm/sun4i: Add support for DE2 VI planes")
+Acked-by: Maxime Ripard <mripard@kernel.org>
+Signed-off-by: Jernej Skrabec <jernej.skrabec@siol.net>
+Link: https://patchwork.freedesktop.org/patch/msgid/20200224173901.174016-4-jernej.skrabec@siol.net
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/gpu/drm/sun4i/sun8i_mixer.c | 56 +++++++++++++++++++++++++++++++++
+ drivers/gpu/drm/sun4i/sun8i_vi_layer.c | 22 ++++++------
+ 2 files changed, 67 insertions(+), 11 deletions(-)
+
+--- a/drivers/gpu/drm/sun4i/sun8i_mixer.c
++++ b/drivers/gpu/drm/sun4i/sun8i_mixer.c
+@@ -111,46 +111,102 @@ static const struct de2_fmt_info de2_for
+ .csc = SUN8I_CSC_MODE_OFF,
+ },
+ {
++ /* for DE2 VI layer which ignores alpha */
++ .drm_fmt = DRM_FORMAT_XRGB4444,
++ .de2_fmt = SUN8I_MIXER_FBFMT_ARGB4444,
++ .rgb = true,
++ .csc = SUN8I_CSC_MODE_OFF,
++ },
++ {
+ .drm_fmt = DRM_FORMAT_ABGR4444,
+ .de2_fmt = SUN8I_MIXER_FBFMT_ABGR4444,
+ .rgb = true,
+ .csc = SUN8I_CSC_MODE_OFF,
+ },
+ {
++ /* for DE2 VI layer which ignores alpha */
++ .drm_fmt = DRM_FORMAT_XBGR4444,
++ .de2_fmt = SUN8I_MIXER_FBFMT_ABGR4444,
++ .rgb = true,
++ .csc = SUN8I_CSC_MODE_OFF,
++ },
++ {
+ .drm_fmt = DRM_FORMAT_RGBA4444,
+ .de2_fmt = SUN8I_MIXER_FBFMT_RGBA4444,
+ .rgb = true,
+ .csc = SUN8I_CSC_MODE_OFF,
+ },
+ {
++ /* for DE2 VI layer which ignores alpha */
++ .drm_fmt = DRM_FORMAT_RGBX4444,
++ .de2_fmt = SUN8I_MIXER_FBFMT_RGBA4444,
++ .rgb = true,
++ .csc = SUN8I_CSC_MODE_OFF,
++ },
++ {
+ .drm_fmt = DRM_FORMAT_BGRA4444,
+ .de2_fmt = SUN8I_MIXER_FBFMT_BGRA4444,
+ .rgb = true,
+ .csc = SUN8I_CSC_MODE_OFF,
+ },
+ {
++ /* for DE2 VI layer which ignores alpha */
++ .drm_fmt = DRM_FORMAT_BGRX4444,
++ .de2_fmt = SUN8I_MIXER_FBFMT_BGRA4444,
++ .rgb = true,
++ .csc = SUN8I_CSC_MODE_OFF,
++ },
++ {
+ .drm_fmt = DRM_FORMAT_ARGB1555,
+ .de2_fmt = SUN8I_MIXER_FBFMT_ARGB1555,
+ .rgb = true,
+ .csc = SUN8I_CSC_MODE_OFF,
+ },
+ {
++ /* for DE2 VI layer which ignores alpha */
++ .drm_fmt = DRM_FORMAT_XRGB1555,
++ .de2_fmt = SUN8I_MIXER_FBFMT_ARGB1555,
++ .rgb = true,
++ .csc = SUN8I_CSC_MODE_OFF,
++ },
++ {
+ .drm_fmt = DRM_FORMAT_ABGR1555,
+ .de2_fmt = SUN8I_MIXER_FBFMT_ABGR1555,
+ .rgb = true,
+ .csc = SUN8I_CSC_MODE_OFF,
+ },
+ {
++ /* for DE2 VI layer which ignores alpha */
++ .drm_fmt = DRM_FORMAT_XBGR1555,
++ .de2_fmt = SUN8I_MIXER_FBFMT_ABGR1555,
++ .rgb = true,
++ .csc = SUN8I_CSC_MODE_OFF,
++ },
++ {
+ .drm_fmt = DRM_FORMAT_RGBA5551,
+ .de2_fmt = SUN8I_MIXER_FBFMT_RGBA5551,
+ .rgb = true,
+ .csc = SUN8I_CSC_MODE_OFF,
+ },
+ {
++ /* for DE2 VI layer which ignores alpha */
++ .drm_fmt = DRM_FORMAT_RGBX5551,
++ .de2_fmt = SUN8I_MIXER_FBFMT_RGBA5551,
++ .rgb = true,
++ .csc = SUN8I_CSC_MODE_OFF,
++ },
++ {
+ .drm_fmt = DRM_FORMAT_BGRA5551,
+ .de2_fmt = SUN8I_MIXER_FBFMT_BGRA5551,
+ .rgb = true,
+ .csc = SUN8I_CSC_MODE_OFF,
++ },
++ {
++ /* for DE2 VI layer which ignores alpha */
++ .drm_fmt = DRM_FORMAT_BGRX5551,
++ .de2_fmt = SUN8I_MIXER_FBFMT_BGRA5551,
++ .rgb = true,
++ .csc = SUN8I_CSC_MODE_OFF,
+ },
+ {
+ .drm_fmt = DRM_FORMAT_UYVY,
+--- a/drivers/gpu/drm/sun4i/sun8i_vi_layer.c
++++ b/drivers/gpu/drm/sun4i/sun8i_vi_layer.c
+@@ -330,26 +330,26 @@ static const struct drm_plane_funcs sun8
+ };
+
+ /*
+- * While all RGB formats are supported, VI planes don't support
+- * alpha blending, so there is no point having formats with alpha
+- * channel if their opaque analog exist.
++ * While DE2 VI layer supports same RGB formats as UI layer, alpha
++ * channel is ignored. This structure lists all unique variants
++ * where alpha channel is replaced with "don't care" (X) channel.
+ */
+ static const u32 sun8i_vi_layer_formats[] = {
+- DRM_FORMAT_ABGR1555,
+- DRM_FORMAT_ABGR4444,
+- DRM_FORMAT_ARGB1555,
+- DRM_FORMAT_ARGB4444,
+ DRM_FORMAT_BGR565,
+ DRM_FORMAT_BGR888,
+- DRM_FORMAT_BGRA5551,
+- DRM_FORMAT_BGRA4444,
++ DRM_FORMAT_BGRX4444,
++ DRM_FORMAT_BGRX5551,
+ DRM_FORMAT_BGRX8888,
+ DRM_FORMAT_RGB565,
+ DRM_FORMAT_RGB888,
+- DRM_FORMAT_RGBA4444,
+- DRM_FORMAT_RGBA5551,
++ DRM_FORMAT_RGBX4444,
++ DRM_FORMAT_RGBX5551,
+ DRM_FORMAT_RGBX8888,
++ DRM_FORMAT_XBGR1555,
++ DRM_FORMAT_XBGR4444,
+ DRM_FORMAT_XBGR8888,
++ DRM_FORMAT_XRGB1555,
++ DRM_FORMAT_XRGB4444,
+ DRM_FORMAT_XRGB8888,
+
+ DRM_FORMAT_NV16,
--- /dev/null
+From 817a68a6584aa08e323c64283fec5ded7be84759 Mon Sep 17 00:00:00 2001
+From: Dennis Dalessandro <dennis.dalessandro@intel.com>
+Date: Tue, 25 Feb 2020 14:54:45 -0500
+Subject: IB/hfi1, qib: Ensure RCU is locked when accessing list
+
+From: Dennis Dalessandro <dennis.dalessandro@intel.com>
+
+commit 817a68a6584aa08e323c64283fec5ded7be84759 upstream.
+
+The packet handling function, specifically the iteration of the qp list
+for mad packet processing misses locking RCU before running through the
+list. Not only is this incorrect, but the list_for_each_entry_rcu() call
+can not be called with a conditional check for lock dependency. Remedy
+this by invoking the rcu lock and unlock around the critical section.
+
+This brings MAD packet processing in line with what is done for non-MAD
+packets.
+
+Fixes: 7724105686e7 ("IB/hfi1: add driver files")
+Link: https://lore.kernel.org/r/20200225195445.140896.41873.stgit@awfm-01.aw.intel.com
+Reviewed-by: Mike Marciniszyn <mike.marciniszyn@intel.com>
+Signed-off-by: Dennis Dalessandro <dennis.dalessandro@intel.com>
+Signed-off-by: Jason Gunthorpe <jgg@mellanox.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/infiniband/hw/hfi1/verbs.c | 4 +++-
+ drivers/infiniband/hw/qib/qib_verbs.c | 2 ++
+ 2 files changed, 5 insertions(+), 1 deletion(-)
+
+--- a/drivers/infiniband/hw/hfi1/verbs.c
++++ b/drivers/infiniband/hw/hfi1/verbs.c
+@@ -595,10 +595,11 @@ static inline void hfi1_handle_packet(st
+ opa_get_lid(packet->dlid, 9B));
+ if (!mcast)
+ goto drop;
++ rcu_read_lock();
+ list_for_each_entry_rcu(p, &mcast->qp_list, list) {
+ packet->qp = p->qp;
+ if (hfi1_do_pkey_check(packet))
+- goto drop;
++ goto unlock_drop;
+ spin_lock_irqsave(&packet->qp->r_lock, flags);
+ packet_handler = qp_ok(packet);
+ if (likely(packet_handler))
+@@ -607,6 +608,7 @@ static inline void hfi1_handle_packet(st
+ ibp->rvp.n_pkt_drops++;
+ spin_unlock_irqrestore(&packet->qp->r_lock, flags);
+ }
++ rcu_read_unlock();
+ /*
+ * Notify rvt_multicast_detach() if it is waiting for us
+ * to finish.
+--- a/drivers/infiniband/hw/qib/qib_verbs.c
++++ b/drivers/infiniband/hw/qib/qib_verbs.c
+@@ -360,8 +360,10 @@ void qib_ib_rcv(struct qib_ctxtdata *rcd
+ if (mcast == NULL)
+ goto drop;
+ this_cpu_inc(ibp->pmastats->n_multicast_rcv);
++ rcu_read_lock();
+ list_for_each_entry_rcu(p, &mcast->qp_list, list)
+ qib_qp_rcv(rcd, hdr, 1, data, tlen, p->qp);
++ rcu_read_unlock();
+ /*
+ * Notify rvt_multicast_detach() if it is waiting for us
+ * to finish.
--- /dev/null
+From be4e3c737eebd75815633f4b8fd766defaf0f1fc Mon Sep 17 00:00:00 2001
+From: Tony Lindgren <tony@atomide.com>
+Date: Sun, 15 Sep 2019 13:15:52 -0700
+Subject: phy: mapphone-mdm6600: Fix timeouts by adding wake-up handling
+
+From: Tony Lindgren <tony@atomide.com>
+
+commit be4e3c737eebd75815633f4b8fd766defaf0f1fc upstream.
+
+We have an interrupt handler for the wake-up GPIO pin, but we're missing
+the code to wake-up the system. This can cause timeouts receiving data
+for the UART that shares the wake-up GPIO pin with the USB PHY.
+
+All we need to do is just wake the system and kick the autosuspend
+timeout to fix the issue.
+
+Fixes: 5d1ebbda0318 ("phy: mapphone-mdm6600: Add USB PHY driver for MDM6600 on Droid 4")
+Cc: Marcel Partap <mpartap@gmx.net>
+Cc: Merlijn Wajer <merlijn@wizzup.org>
+Cc: Michael Scott <hashcode0f@gmail.com>
+Cc: NeKit <nekit1000@gmail.com>
+Cc: Pavel Machek <pavel@ucw.cz>
+Cc: Sebastian Reichel <sre@kernel.org>
+Signed-off-by: Tony Lindgren <tony@atomide.com>
+Signed-off-by: Kishon Vijay Abraham I <kishon@ti.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/phy/motorola/phy-mapphone-mdm6600.c | 18 ++++++++++++++++--
+ 1 file changed, 16 insertions(+), 2 deletions(-)
+
+--- a/drivers/phy/motorola/phy-mapphone-mdm6600.c
++++ b/drivers/phy/motorola/phy-mapphone-mdm6600.c
+@@ -224,10 +224,24 @@ static irqreturn_t phy_mdm6600_wakeirq_t
+ {
+ struct phy_mdm6600 *ddata = data;
+ struct gpio_desc *mode_gpio1;
++ int error, wakeup;
+
+ mode_gpio1 = ddata->mode_gpios->desc[PHY_MDM6600_MODE1];
+- dev_dbg(ddata->dev, "OOB wake on mode_gpio1: %i\n",
+- gpiod_get_value(mode_gpio1));
++ wakeup = gpiod_get_value(mode_gpio1);
++ if (!wakeup)
++ return IRQ_NONE;
++
++ dev_dbg(ddata->dev, "OOB wake on mode_gpio1: %i\n", wakeup);
++ error = pm_runtime_get_sync(ddata->dev);
++ if (error < 0) {
++ pm_runtime_put_noidle(ddata->dev);
++
++ return IRQ_NONE;
++ }
++
++ /* Just wake-up and kick the autosuspend timer */
++ pm_runtime_mark_last_busy(ddata->dev);
++ pm_runtime_put_autosuspend(ddata->dev);
+
+ return IRQ_HANDLED;
+ }
--- /dev/null
+From 46b7edf1c7b7c91004c4db2c355cbd033f2385f9 Mon Sep 17 00:00:00 2001
+From: Tony Lindgren <tony@atomide.com>
+Date: Tue, 4 Feb 2020 07:36:02 -0800
+Subject: phy: mapphone-mdm6600: Fix write timeouts with shorter GPIO toggle interval
+
+From: Tony Lindgren <tony@atomide.com>
+
+commit 46b7edf1c7b7c91004c4db2c355cbd033f2385f9 upstream.
+
+I've noticed that when writing data to the modem the writes can time out
+at some point eventually. Looks like kicking the modem idle GPIO every
+600 ms instead of once a second fixes the issue. Note that this rate is
+different from our runtime PM autosuspend rate MDM6600_MODEM_IDLE_DELAY_MS
+that we still want to keep at 1 second, so let's add a separate define for
+PHY_MDM6600_IDLE_KICK_MS.
+
+Fixes: f7f50b2a7b05 ("phy: mapphone-mdm6600: Add runtime PM support for n_gsm on USB suspend")
+Cc: Marcel Partap <mpartap@gmx.net>
+Cc: Merlijn Wajer <merlijn@wizzup.org>
+Cc: Michael Scott <hashcode0f@gmail.com>
+Cc: NeKit <nekit1000@gmail.com>
+Cc: Pavel Machek <pavel@ucw.cz>
+Cc: Sebastian Reichel <sre@kernel.org>
+Signed-off-by: Tony Lindgren <tony@atomide.com>
+Signed-off-by: Kishon Vijay Abraham I <kishon@ti.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/phy/motorola/phy-mapphone-mdm6600.c | 9 ++++++++-
+ 1 file changed, 8 insertions(+), 1 deletion(-)
+
+--- a/drivers/phy/motorola/phy-mapphone-mdm6600.c
++++ b/drivers/phy/motorola/phy-mapphone-mdm6600.c
+@@ -19,6 +19,7 @@
+
+ #define PHY_MDM6600_PHY_DELAY_MS 4000 /* PHY enable 2.2s to 3.5s */
+ #define PHY_MDM6600_ENABLED_DELAY_MS 8000 /* 8s more total for MDM6600 */
++#define PHY_MDM6600_WAKE_KICK_MS 600 /* time on after GPIO toggle */
+ #define MDM6600_MODEM_IDLE_DELAY_MS 1000 /* modem after USB suspend */
+ #define MDM6600_MODEM_WAKE_DELAY_MS 200 /* modem response after idle */
+
+@@ -491,8 +492,14 @@ static void phy_mdm6600_modem_wake(struc
+
+ ddata = container_of(work, struct phy_mdm6600, modem_wake_work.work);
+ phy_mdm6600_wake_modem(ddata);
++
++ /*
++ * The modem does not always stay awake 1.2 seconds after toggling
++ * the wake GPIO, and sometimes it idles after about some 600 ms
++ * making writes time out.
++ */
+ schedule_delayed_work(&ddata->modem_wake_work,
+- msecs_to_jiffies(MDM6600_MODEM_IDLE_DELAY_MS));
++ msecs_to_jiffies(PHY_MDM6600_WAKE_KICK_MS));
+ }
+
+ static int __maybe_unused phy_mdm6600_runtime_suspend(struct device *dev)
--- /dev/null
+From 810dbc69087b08fd53e1cdd6c709f385bc2921ad Mon Sep 17 00:00:00 2001
+From: Bernard Metzler <bmt@zurich.ibm.com>
+Date: Mon, 2 Mar 2020 19:16:14 +0100
+Subject: RDMA/iwcm: Fix iwcm work deallocation
+
+From: Bernard Metzler <bmt@zurich.ibm.com>
+
+commit 810dbc69087b08fd53e1cdd6c709f385bc2921ad upstream.
+
+The dealloc_work_entries() function must update the work_free_list pointer
+while freeing its entries, since potentially called again on same list. A
+second iteration of the work list caused system crash. This happens, if
+work allocation fails during cma_iw_listen() and free_cm_id() tries to
+free the list again during cleanup.
+
+Fixes: 922a8e9fb2e0 ("RDMA: iWARP Connection Manager.")
+Link: https://lore.kernel.org/r/20200302181614.17042-1-bmt@zurich.ibm.com
+Reported-by: syzbot+cb0c054eabfba4342146@syzkaller.appspotmail.com
+Signed-off-by: Bernard Metzler <bmt@zurich.ibm.com>
+Reviewed-by: Jason Gunthorpe <jgg@mellanox.com>
+Signed-off-by: Jason Gunthorpe <jgg@mellanox.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/infiniband/core/iwcm.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+--- a/drivers/infiniband/core/iwcm.c
++++ b/drivers/infiniband/core/iwcm.c
+@@ -158,8 +158,10 @@ static void dealloc_work_entries(struct
+ {
+ struct list_head *e, *tmp;
+
+- list_for_each_safe(e, tmp, &cm_id_priv->work_free_list)
++ list_for_each_safe(e, tmp, &cm_id_priv->work_free_list) {
++ list_del(e);
+ kfree(list_entry(e, struct iwcm_work, free_list));
++ }
+ }
+
+ static int alloc_work_entries(struct iwcm_id_private *cm_id_priv, int count)
--- /dev/null
+From c14dfddbd869bf0c2bafb7ef260c41d9cebbcfec Mon Sep 17 00:00:00 2001
+From: Jason Gunthorpe <jgg@ziepe.ca>
+Date: Fri, 21 Feb 2020 15:20:26 +0000
+Subject: RMDA/cm: Fix missing ib_cm_destroy_id() in ib_cm_insert_listen()
+
+From: Jason Gunthorpe <jgg@mellanox.com>
+
+commit c14dfddbd869bf0c2bafb7ef260c41d9cebbcfec upstream.
+
+The algorithm pre-allocates a cm_id since allocation cannot be done while
+holding the cm.lock spinlock, however it doesn't free it on one error
+path, leading to a memory leak.
+
+Fixes: 067b171b8679 ("IB/cm: Share listening CM IDs")
+Link: https://lore.kernel.org/r/20200221152023.GA8680@ziepe.ca
+Signed-off-by: Jason Gunthorpe <jgg@mellanox.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/infiniband/core/cm.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/drivers/infiniband/core/cm.c
++++ b/drivers/infiniband/core/cm.c
+@@ -1231,6 +1231,7 @@ struct ib_cm_id *ib_cm_insert_listen(str
+ /* Sharing an ib_cm_id with different handlers is not
+ * supported */
+ spin_unlock_irqrestore(&cm.lock, flags);
++ ib_destroy_cm_id(cm_id);
+ return ERR_PTR(-EINVAL);
+ }
+ atomic_inc(&cm_id_priv->refcount);
asoc-intel-skl-fix-possible-buffer-overflow-in-debug-outputs.patch
dmaengine-imx-sdma-remove-dma_slave_config-direction.patch
dmaengine-imx-sdma-fix-the-event-id-check-to-include-rx-event-for-uart6.patch
+asoc-pcm-fix-possible-buffer-overflow-in-dpcm-state-sysfs-output.patch
+asoc-pcm512x-fix-unbalanced-regulator-enable-call-in-probe-error-path.patch
+asoc-dapm-correct-dapm-handling-of-active-widgets-during-shutdown.patch
+drm-sun4i-fix-de2-vi-layer-format-support.patch
+drm-sun4i-de2-de3-remove-unsupported-vi-layer-formats.patch
+phy-mapphone-mdm6600-fix-timeouts-by-adding-wake-up-handling.patch
+phy-mapphone-mdm6600-fix-write-timeouts-with-shorter-gpio-toggle-interval.patch
+arm-dts-imx6-phycore-som-fix-emmc-supply.patch
+rdma-iwcm-fix-iwcm-work-deallocation.patch
+rmda-cm-fix-missing-ib_cm_destroy_id-in-ib_cm_insert_listen.patch
+ib-hfi1-qib-ensure-rcu-is-locked-when-accessing-list.patch
projects / thirdparty / kernel / stable-queue.git / commitdiff
