From: Sasha Levin Date: Wed, 18 Mar 2020 23:55:02 +0000 (-0400) Subject: Fixes for 4.19 X-Git-Tag: v4.4.217~23 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=840682e8b7f16ff407a9a6187c66b75caecf6f49;p=thirdparty%2Fkernel%2Fstable-queue.git Fixes for 4.19 Signed-off-by: Sasha Levin --- diff --git a/queue-4.19/mmc-sdhci-omap-don-t-finish_mrq-on-a-command-error-d.patch b/queue-4.19/mmc-sdhci-omap-don-t-finish_mrq-on-a-command-error-d.patch new file mode 100644 index 00000000000..49b9d5bd3fd --- /dev/null +++ b/queue-4.19/mmc-sdhci-omap-don-t-finish_mrq-on-a-command-error-d.patch @@ -0,0 +1,90 @@ +From f242db9188a9dc62a1a078bf955c48897578ea8f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 11 Apr 2019 14:29:37 +0530 +Subject: mmc: sdhci-omap: Don't finish_mrq() on a command error during tuning + +From: Faiz Abbas + +[ Upstream commit 5c41ea6d52003b5bc77c2a82fd5ca7d480237d89 ] + +commit 5b0d62108b46 ("mmc: sdhci-omap: Add platform specific reset +callback") skips data resets during tuning operation. Because of this, +a data error or data finish interrupt might still arrive after a command +error has been handled and the mrq ended. This ends up with a "mmc0: Got +data interrupt 0x00000002 even though no data operation was in progress" +error message. + +Fix this by adding a platform specific callback for sdhci_irq. Mark the +mrq as a failure but wait for a data interrupt instead of calling +finish_mrq(). + +Fixes: 5b0d62108b46 ("mmc: sdhci-omap: Add platform specific reset +callback") +Signed-off-by: Faiz Abbas +Acked-by: Adrian Hunter +Cc: stable@vger.kernel.org +Signed-off-by: Ulf Hansson +Signed-off-by: Sasha Levin +--- + drivers/mmc/host/sdhci-omap.c | 38 +++++++++++++++++++++++++++++++++++ + 1 file changed, 38 insertions(+) + +diff --git a/drivers/mmc/host/sdhci-omap.c b/drivers/mmc/host/sdhci-omap.c +index 79ee5fc5a2013..833e13cabd2a8 100644 +--- a/drivers/mmc/host/sdhci-omap.c ++++ b/drivers/mmc/host/sdhci-omap.c +@@ -801,6 +801,43 @@ void sdhci_omap_reset(struct sdhci_host *host, u8 mask) + sdhci_reset(host, mask); + } + ++#define CMD_ERR_MASK (SDHCI_INT_CRC | SDHCI_INT_END_BIT | SDHCI_INT_INDEX |\ ++ SDHCI_INT_TIMEOUT) ++#define CMD_MASK (CMD_ERR_MASK | SDHCI_INT_RESPONSE) ++ ++static u32 sdhci_omap_irq(struct sdhci_host *host, u32 intmask) ++{ ++ struct sdhci_pltfm_host *pltfm_host = sdhci_priv(host); ++ struct sdhci_omap_host *omap_host = sdhci_pltfm_priv(pltfm_host); ++ ++ if (omap_host->is_tuning && host->cmd && !host->data_early && ++ (intmask & CMD_ERR_MASK)) { ++ ++ /* ++ * Since we are not resetting data lines during tuning ++ * operation, data error or data complete interrupts ++ * might still arrive. Mark this request as a failure ++ * but still wait for the data interrupt ++ */ ++ if (intmask & SDHCI_INT_TIMEOUT) ++ host->cmd->error = -ETIMEDOUT; ++ else ++ host->cmd->error = -EILSEQ; ++ ++ host->cmd = NULL; ++ ++ /* ++ * Sometimes command error interrupts and command complete ++ * interrupt will arrive together. Clear all command related ++ * interrupts here. ++ */ ++ sdhci_writel(host, intmask & CMD_MASK, SDHCI_INT_STATUS); ++ intmask &= ~CMD_MASK; ++ } ++ ++ return intmask; ++} ++ + static struct sdhci_ops sdhci_omap_ops = { + .set_clock = sdhci_omap_set_clock, + .set_power = sdhci_omap_set_power, +@@ -811,6 +848,7 @@ static struct sdhci_ops sdhci_omap_ops = { + .platform_send_init_74_clocks = sdhci_omap_init_74_clocks, + .reset = sdhci_omap_reset, + .set_uhs_signaling = sdhci_omap_set_uhs_signaling, ++ .irq = sdhci_omap_irq, + }; + + static int sdhci_omap_set_capabilities(struct sdhci_omap_host *omap_host) +-- +2.20.1 + diff --git a/queue-4.19/mmc-sdhci-omap-fix-tuning-procedure-for-temperatures.patch b/queue-4.19/mmc-sdhci-omap-fix-tuning-procedure-for-temperatures.patch new file mode 100644 index 00000000000..821c6cf0d92 --- /dev/null +++ b/queue-4.19/mmc-sdhci-omap-fix-tuning-procedure-for-temperatures.patch @@ -0,0 +1,42 @@ +From 49ada0390dee8e4db4da2ebcbc0b63e2d177c169 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 10 Oct 2019 16:22:30 +0530 +Subject: mmc: sdhci-omap: Fix Tuning procedure for temperatures < -20C + +From: Faiz Abbas + +[ Upstream commit feb40824d78eac5e48f56498dca941754dff33d7 ] + +According to the App note[1] detailing the tuning algorithm, for +temperatures < -20C, the initial tuning value should be min(largest value +in LPW - 24, ceil(13/16 ratio of LPW)). The largest value in LPW is +(max_window + 4 * (max_len - 1)) and not (max_window + 4 * max_len) itself. +Fix this implementation. + +[1] http://www.ti.com/lit/an/spraca9b/spraca9b.pdf + +Fixes: 961de0a856e3 ("mmc: sdhci-omap: Workaround errata regarding SDR104/HS200 tuning failures (i929)") +Cc: stable@vger.kernel.org +Signed-off-by: Faiz Abbas +Signed-off-by: Ulf Hansson +Signed-off-by: Sasha Levin +--- + drivers/mmc/host/sdhci-omap.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/mmc/host/sdhci-omap.c b/drivers/mmc/host/sdhci-omap.c +index 833e13cabd2a8..05ade7a2dd243 100644 +--- a/drivers/mmc/host/sdhci-omap.c ++++ b/drivers/mmc/host/sdhci-omap.c +@@ -387,7 +387,7 @@ static int sdhci_omap_execute_tuning(struct mmc_host *mmc, u32 opcode) + * on temperature + */ + if (temperature < -20000) +- phase_delay = min(max_window + 4 * max_len - 24, ++ phase_delay = min(max_window + 4 * (max_len - 1) - 24, + max_window + + DIV_ROUND_UP(13 * max_len, 16) * 4); + else if (temperature < 20000) +-- +2.20.1 + diff --git a/queue-4.19/series b/queue-4.19/series index 99a90b52525..8bca37ab830 100644 --- a/queue-4.19/series +++ b/queue-4.19/series @@ -29,3 +29,7 @@ net-rmnet-fix-bridge-mode-bugs.patch net-rmnet-fix-packet-forwarding-in-rmnet-bridge-mode.patch sfc-fix-timestamp-reconstruction-at-16-bit-rollover-.patch jbd2-fix-data-races-at-struct-journal_head.patch +wimax-i2400-fix-memory-leak.patch +wimax-i2400-fix-memory-leak-in-i2400m_op_rfkill_sw_t.patch +mmc-sdhci-omap-don-t-finish_mrq-on-a-command-error-d.patch +mmc-sdhci-omap-fix-tuning-procedure-for-temperatures.patch diff --git a/queue-4.19/wimax-i2400-fix-memory-leak-in-i2400m_op_rfkill_sw_t.patch b/queue-4.19/wimax-i2400-fix-memory-leak-in-i2400m_op_rfkill_sw_t.patch new file mode 100644 index 00000000000..ecad5e0c883 --- /dev/null +++ b/queue-4.19/wimax-i2400-fix-memory-leak-in-i2400m_op_rfkill_sw_t.patch @@ -0,0 +1,44 @@ +From ae7d354ecef2efff3a8dd1ac4a6c483ab7ef52ff Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 25 Oct 2019 23:53:30 -0500 +Subject: wimax: i2400: Fix memory leak in i2400m_op_rfkill_sw_toggle + +From: Navid Emamdoost + +[ Upstream commit 6f3ef5c25cc762687a7341c18cbea5af54461407 ] + +In the implementation of i2400m_op_rfkill_sw_toggle() the allocated +buffer for cmd should be released before returning. The +documentation for i2400m_msg_to_dev() says when it returns the buffer +can be reused. Meaning cmd should be released in either case. Move +kfree(cmd) before return to be reached by all execution paths. + +Fixes: 2507e6ab7a9a ("wimax: i2400: fix memory leak") +Signed-off-by: Navid Emamdoost +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/wimax/i2400m/op-rfkill.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/net/wimax/i2400m/op-rfkill.c b/drivers/net/wimax/i2400m/op-rfkill.c +index 7c92e8ace9c2f..dc6fe93ce71f6 100644 +--- a/drivers/net/wimax/i2400m/op-rfkill.c ++++ b/drivers/net/wimax/i2400m/op-rfkill.c +@@ -142,12 +142,12 @@ int i2400m_op_rfkill_sw_toggle(struct wimax_dev *wimax_dev, + "%d\n", result); + result = 0; + error_cmd: +- kfree(cmd); + kfree_skb(ack_skb); + error_msg_to_dev: + error_alloc: + d_fnend(4, dev, "(wimax_dev %p state %d) = %d\n", + wimax_dev, state, result); ++ kfree(cmd); + return result; + } + +-- +2.20.1 + diff --git a/queue-4.19/wimax-i2400-fix-memory-leak.patch b/queue-4.19/wimax-i2400-fix-memory-leak.patch new file mode 100644 index 00000000000..1ba700c390e --- /dev/null +++ b/queue-4.19/wimax-i2400-fix-memory-leak.patch @@ -0,0 +1,34 @@ +From 543108d94dfb786591ae0cb8c5016624e7e4129f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 10 Sep 2019 18:01:40 -0500 +Subject: wimax: i2400: fix memory leak + +From: Navid Emamdoost + +[ Upstream commit 2507e6ab7a9a440773be476141a255934468c5ef ] + +In i2400m_op_rfkill_sw_toggle cmd buffer should be released along with +skb response. + +Signed-off-by: Navid Emamdoost +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/wimax/i2400m/op-rfkill.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/net/wimax/i2400m/op-rfkill.c b/drivers/net/wimax/i2400m/op-rfkill.c +index b0dba35a8ad2a..7c92e8ace9c2f 100644 +--- a/drivers/net/wimax/i2400m/op-rfkill.c ++++ b/drivers/net/wimax/i2400m/op-rfkill.c +@@ -142,6 +142,7 @@ int i2400m_op_rfkill_sw_toggle(struct wimax_dev *wimax_dev, + "%d\n", result); + result = 0; + error_cmd: ++ kfree(cmd); + kfree_skb(ack_skb); + error_msg_to_dev: + error_alloc: +-- +2.20.1 +