From: Greg Kroah-Hartman Date: Tue, 10 Mar 2020 11:03:54 +0000 (+0100) Subject: 4.19-stable patches X-Git-Tag: v4.4.216~18 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=d3bc7fcbcf7a6aab07d3e85f7487b6d1f3e66939;p=thirdparty%2Fkernel%2Fstable-queue.git 4.19-stable patches added patches: arm-dts-imx6-phycore-som-fix-emmc-supply.patch asoc-dapm-correct-dapm-handling-of-active-widgets-during-shutdown.patch asoc-pcm-fix-possible-buffer-overflow-in-dpcm-state-sysfs-output.patch asoc-pcm512x-fix-unbalanced-regulator-enable-call-in-probe-error-path.patch drm-sun4i-de2-de3-remove-unsupported-vi-layer-formats.patch drm-sun4i-fix-de2-vi-layer-format-support.patch ib-hfi1-qib-ensure-rcu-is-locked-when-accessing-list.patch phy-mapphone-mdm6600-fix-timeouts-by-adding-wake-up-handling.patch phy-mapphone-mdm6600-fix-write-timeouts-with-shorter-gpio-toggle-interval.patch rdma-iwcm-fix-iwcm-work-deallocation.patch rmda-cm-fix-missing-ib_cm_destroy_id-in-ib_cm_insert_listen.patch --- diff --git a/queue-4.19/arm-dts-imx6-phycore-som-fix-emmc-supply.patch b/queue-4.19/arm-dts-imx6-phycore-som-fix-emmc-supply.patch new file mode 100644 index 00000000000..1df68282532 --- /dev/null +++ b/queue-4.19/arm-dts-imx6-phycore-som-fix-emmc-supply.patch @@ -0,0 +1,33 @@ +From eb0bbba7636b9fc81939d6087a5fe575e150c95a Mon Sep 17 00:00:00 2001 +From: Marco Felsch +Date: Thu, 16 Jan 2020 15:01:08 +0100 +Subject: ARM: dts: imx6: phycore-som: fix emmc supply + +From: Marco Felsch + +commit eb0bbba7636b9fc81939d6087a5fe575e150c95a upstream. + +Currently the vmmc is supplied by the 1.8V pmic rail but this is wrong. +The default module behaviour is to power VCCQ and VCC by the 3.3V power +rail. Optional the user can connect the VCCQ to the pmic 1.8V emmc +power rail using a solder jumper. + +Fixes: ddec5d1c0047 ("ARM: dts: imx6: Add initial support for phyCORE-i.MX 6 SOM") +Signed-off-by: Marco Felsch +Signed-off-by: Shawn Guo +Signed-off-by: Greg Kroah-Hartman + +--- + arch/arm/boot/dts/imx6qdl-phytec-phycore-som.dtsi | 1 - + 1 file changed, 1 deletion(-) + +--- a/arch/arm/boot/dts/imx6qdl-phytec-phycore-som.dtsi ++++ b/arch/arm/boot/dts/imx6qdl-phytec-phycore-som.dtsi +@@ -183,7 +183,6 @@ + pinctrl-0 = <&pinctrl_usdhc4>; + bus-width = <8>; + non-removable; +- vmmc-supply = <&vdd_emmc_1p8>; + status = "disabled"; + }; + diff --git a/queue-4.19/asoc-dapm-correct-dapm-handling-of-active-widgets-during-shutdown.patch b/queue-4.19/asoc-dapm-correct-dapm-handling-of-active-widgets-during-shutdown.patch new file mode 100644 index 00000000000..ec1e66affde --- /dev/null +++ b/queue-4.19/asoc-dapm-correct-dapm-handling-of-active-widgets-during-shutdown.patch @@ -0,0 +1,43 @@ +From 9b3193089e77d3b59b045146ff1c770dd899acb1 Mon Sep 17 00:00:00 2001 +From: Charles Keepax +Date: Fri, 28 Feb 2020 15:31:45 +0000 +Subject: ASoC: dapm: Correct DAPM handling of active widgets during shutdown + +From: Charles Keepax + +commit 9b3193089e77d3b59b045146ff1c770dd899acb1 upstream. + +commit c2caa4da46a4 ("ASoC: Fix widget powerdown on shutdown") added a +set of the power state during snd_soc_dapm_shutdown to ensure the +widgets powered off. However, when commit 39eb5fd13dff +("ASoC: dapm: Delay w->power update until the changes are written") +added the new_power member of the widget structure, to differentiate +between the current power state and the target power state, it did not +update the shutdown to use the new_power member. + +As new_power has not updated it will be left in the state set by the +last DAPM sequence, ie. 1 for active widgets. So as the DAPM sequence +for the shutdown proceeds it will turn the widgets on (despite them +already being on) rather than turning them off. + +Fixes: 39eb5fd13dff ("ASoC: dapm: Delay w->power update until the changes are written") +Signed-off-by: Charles Keepax +Link: https://lore.kernel.org/r/20200228153145.21013-1-ckeepax@opensource.cirrus.com +Signed-off-by: Mark Brown +Signed-off-by: Greg Kroah-Hartman + +--- + sound/soc/soc-dapm.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/sound/soc/soc-dapm.c ++++ b/sound/soc/soc-dapm.c +@@ -4551,7 +4551,7 @@ static void soc_dapm_shutdown_dapm(struc + continue; + if (w->power) { + dapm_seq_insert(w, &down_list, false); +- w->power = 0; ++ w->new_power = 0; + powerdown = 1; + } + } diff --git a/queue-4.19/asoc-pcm-fix-possible-buffer-overflow-in-dpcm-state-sysfs-output.patch b/queue-4.19/asoc-pcm-fix-possible-buffer-overflow-in-dpcm-state-sysfs-output.patch new file mode 100644 index 00000000000..41cb1c65df2 --- /dev/null +++ b/queue-4.19/asoc-pcm-fix-possible-buffer-overflow-in-dpcm-state-sysfs-output.patch @@ -0,0 +1,84 @@ +From 6c89ffea60aa3b2a33ae7987de1e84bfb89e4c9e Mon Sep 17 00:00:00 2001 +From: Takashi Iwai +Date: Tue, 18 Feb 2020 12:17:37 +0100 +Subject: ASoC: pcm: Fix possible buffer overflow in dpcm state sysfs output + +From: Takashi Iwai + +commit 6c89ffea60aa3b2a33ae7987de1e84bfb89e4c9e upstream. + +dpcm_show_state() invokes multiple snprintf() calls to concatenate +formatted strings on the fixed size buffer. The usage of snprintf() +is supposed for avoiding the buffer overflow, but it doesn't work as +expected because snprintf() doesn't return the actual output size but +the size to be written. + +Fix this bug by replacing all snprintf() calls with scnprintf() +calls. + +Fixes: f86dcef87b77 ("ASoC: dpcm: Add debugFS support for DPCM") +Signed-off-by: Takashi Iwai +Acked-by: Cezary Rojewski +Link: https://lore.kernel.org/r/20200218111737.14193-4-tiwai@suse.de +Signed-off-by: Mark Brown +Signed-off-by: Greg Kroah-Hartman + +--- + sound/soc/soc-pcm.c | 16 ++++++++-------- + 1 file changed, 8 insertions(+), 8 deletions(-) + +--- a/sound/soc/soc-pcm.c ++++ b/sound/soc/soc-pcm.c +@@ -3357,16 +3357,16 @@ static ssize_t dpcm_show_state(struct sn + ssize_t offset = 0; + + /* FE state */ +- offset += snprintf(buf + offset, size - offset, ++ offset += scnprintf(buf + offset, size - offset, + "[%s - %s]\n", fe->dai_link->name, + stream ? "Capture" : "Playback"); + +- offset += snprintf(buf + offset, size - offset, "State: %s\n", ++ offset += scnprintf(buf + offset, size - offset, "State: %s\n", + dpcm_state_string(fe->dpcm[stream].state)); + + if ((fe->dpcm[stream].state >= SND_SOC_DPCM_STATE_HW_PARAMS) && + (fe->dpcm[stream].state <= SND_SOC_DPCM_STATE_STOP)) +- offset += snprintf(buf + offset, size - offset, ++ offset += scnprintf(buf + offset, size - offset, + "Hardware Params: " + "Format = %s, Channels = %d, Rate = %d\n", + snd_pcm_format_name(params_format(params)), +@@ -3374,10 +3374,10 @@ static ssize_t dpcm_show_state(struct sn + params_rate(params)); + + /* BEs state */ +- offset += snprintf(buf + offset, size - offset, "Backends:\n"); ++ offset += scnprintf(buf + offset, size - offset, "Backends:\n"); + + if (list_empty(&fe->dpcm[stream].be_clients)) { +- offset += snprintf(buf + offset, size - offset, ++ offset += scnprintf(buf + offset, size - offset, + " No active DSP links\n"); + goto out; + } +@@ -3386,16 +3386,16 @@ static ssize_t dpcm_show_state(struct sn + struct snd_soc_pcm_runtime *be = dpcm->be; + params = &dpcm->hw_params; + +- offset += snprintf(buf + offset, size - offset, ++ offset += scnprintf(buf + offset, size - offset, + "- %s\n", be->dai_link->name); + +- offset += snprintf(buf + offset, size - offset, ++ offset += scnprintf(buf + offset, size - offset, + " State: %s\n", + dpcm_state_string(be->dpcm[stream].state)); + + if ((be->dpcm[stream].state >= SND_SOC_DPCM_STATE_HW_PARAMS) && + (be->dpcm[stream].state <= SND_SOC_DPCM_STATE_STOP)) +- offset += snprintf(buf + offset, size - offset, ++ offset += scnprintf(buf + offset, size - offset, + " Hardware Params: " + "Format = %s, Channels = %d, Rate = %d\n", + snd_pcm_format_name(params_format(params)), diff --git a/queue-4.19/asoc-pcm512x-fix-unbalanced-regulator-enable-call-in-probe-error-path.patch b/queue-4.19/asoc-pcm512x-fix-unbalanced-regulator-enable-call-in-probe-error-path.patch new file mode 100644 index 00000000000..50c0f7cd58d --- /dev/null +++ b/queue-4.19/asoc-pcm512x-fix-unbalanced-regulator-enable-call-in-probe-error-path.patch @@ -0,0 +1,47 @@ +From ac0a68997935c4acb92eaae5ad8982e0bb432d56 Mon Sep 17 00:00:00 2001 +From: Matthias Reichl +Date: Thu, 20 Feb 2020 21:29:56 +0100 +Subject: ASoC: pcm512x: Fix unbalanced regulator enable call in probe error path + +From: Matthias Reichl + +commit ac0a68997935c4acb92eaae5ad8982e0bb432d56 upstream. + +When we get a clock error during probe we have to call +regulator_bulk_disable before bailing out, otherwise we trigger +a warning in regulator_put. + +Fix this by using "goto err" like in the error cases above. + +Fixes: 5a3af1293194d ("ASoC: pcm512x: Add PCM512x driver") +Signed-off-by: Matthias Reichl +Reviewed-by: Pierre-Louis Bossart +Link: https://lore.kernel.org/r/20200220202956.29233-1-hias@horus.com +Signed-off-by: Mark Brown +Signed-off-by: Greg Kroah-Hartman + +--- + sound/soc/codecs/pcm512x.c | 8 +++++--- + 1 file changed, 5 insertions(+), 3 deletions(-) + +--- a/sound/soc/codecs/pcm512x.c ++++ b/sound/soc/codecs/pcm512x.c +@@ -1437,13 +1437,15 @@ int pcm512x_probe(struct device *dev, st + } + + pcm512x->sclk = devm_clk_get(dev, NULL); +- if (PTR_ERR(pcm512x->sclk) == -EPROBE_DEFER) +- return -EPROBE_DEFER; ++ if (PTR_ERR(pcm512x->sclk) == -EPROBE_DEFER) { ++ ret = -EPROBE_DEFER; ++ goto err; ++ } + if (!IS_ERR(pcm512x->sclk)) { + ret = clk_prepare_enable(pcm512x->sclk); + if (ret != 0) { + dev_err(dev, "Failed to enable SCLK: %d\n", ret); +- return ret; ++ goto err; + } + } + diff --git a/queue-4.19/drm-sun4i-de2-de3-remove-unsupported-vi-layer-formats.patch b/queue-4.19/drm-sun4i-de2-de3-remove-unsupported-vi-layer-formats.patch new file mode 100644 index 00000000000..4f535ad33b9 --- /dev/null +++ b/queue-4.19/drm-sun4i-de2-de3-remove-unsupported-vi-layer-formats.patch @@ -0,0 +1,65 @@ +From a4769905f0ae32cae4f096f646ab03b8b4794c74 Mon Sep 17 00:00:00 2001 +From: Jernej Skrabec +Date: Mon, 24 Feb 2020 18:38:55 +0100 +Subject: drm/sun4i: de2/de3: Remove unsupported VI layer formats + +From: Jernej Skrabec + +commit a4769905f0ae32cae4f096f646ab03b8b4794c74 upstream. + +YUV444 and YVU444 are planar formats, but HW format RGB888 is packed. +This means that those two mappings were never correct. Remove them. + +Fixes: 60a3dcf96aa8 ("drm/sun4i: Add DE2 definitions for YUV formats") +Acked-by: Maxime Ripard +Signed-off-by: Jernej Skrabec +Link: https://patchwork.freedesktop.org/patch/msgid/20200224173901.174016-2-jernej.skrabec@siol.net +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/gpu/drm/sun4i/sun8i_mixer.c | 12 ------------ + drivers/gpu/drm/sun4i/sun8i_vi_layer.c | 2 -- + 2 files changed, 14 deletions(-) + +--- a/drivers/gpu/drm/sun4i/sun8i_mixer.c ++++ b/drivers/gpu/drm/sun4i/sun8i_mixer.c +@@ -257,12 +257,6 @@ static const struct de2_fmt_info de2_for + .csc = SUN8I_CSC_MODE_YUV2RGB, + }, + { +- .drm_fmt = DRM_FORMAT_YUV444, +- .de2_fmt = SUN8I_MIXER_FBFMT_RGB888, +- .rgb = true, +- .csc = SUN8I_CSC_MODE_YUV2RGB, +- }, +- { + .drm_fmt = DRM_FORMAT_YUV422, + .de2_fmt = SUN8I_MIXER_FBFMT_YUV422, + .rgb = false, +@@ -281,12 +275,6 @@ static const struct de2_fmt_info de2_for + .csc = SUN8I_CSC_MODE_YUV2RGB, + }, + { +- .drm_fmt = DRM_FORMAT_YVU444, +- .de2_fmt = SUN8I_MIXER_FBFMT_RGB888, +- .rgb = true, +- .csc = SUN8I_CSC_MODE_YVU2RGB, +- }, +- { + .drm_fmt = DRM_FORMAT_YVU422, + .de2_fmt = SUN8I_MIXER_FBFMT_YUV422, + .rgb = false, +--- a/drivers/gpu/drm/sun4i/sun8i_vi_layer.c ++++ b/drivers/gpu/drm/sun4i/sun8i_vi_layer.c +@@ -363,11 +363,9 @@ static const u32 sun8i_vi_layer_formats[ + DRM_FORMAT_YUV411, + DRM_FORMAT_YUV420, + DRM_FORMAT_YUV422, +- DRM_FORMAT_YUV444, + DRM_FORMAT_YVU411, + DRM_FORMAT_YVU420, + DRM_FORMAT_YVU422, +- DRM_FORMAT_YVU444, + }; + + struct sun8i_vi_layer *sun8i_vi_layer_init_one(struct drm_device *drm, diff --git a/queue-4.19/drm-sun4i-fix-de2-vi-layer-format-support.patch b/queue-4.19/drm-sun4i-fix-de2-vi-layer-format-support.patch new file mode 100644 index 00000000000..a6fe526c730 --- /dev/null +++ b/queue-4.19/drm-sun4i-fix-de2-vi-layer-format-support.patch @@ -0,0 +1,168 @@ +From 20896ef137340e9426cf322606f764452f5eb960 Mon Sep 17 00:00:00 2001 +From: Jernej Skrabec +Date: Mon, 24 Feb 2020 18:38:57 +0100 +Subject: drm/sun4i: Fix DE2 VI layer format support + +From: Jernej Skrabec + +commit 20896ef137340e9426cf322606f764452f5eb960 upstream. + +DE2 VI layer doesn't support blending which means alpha channel is +ignored. Replace all formats with alpha with "don't care" (X) channel. + +Fixes: 7480ba4d7571 ("drm/sun4i: Add support for DE2 VI planes") +Acked-by: Maxime Ripard +Signed-off-by: Jernej Skrabec +Link: https://patchwork.freedesktop.org/patch/msgid/20200224173901.174016-4-jernej.skrabec@siol.net +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/gpu/drm/sun4i/sun8i_mixer.c | 56 +++++++++++++++++++++++++++++++++ + drivers/gpu/drm/sun4i/sun8i_vi_layer.c | 22 ++++++------ + 2 files changed, 67 insertions(+), 11 deletions(-) + +--- a/drivers/gpu/drm/sun4i/sun8i_mixer.c ++++ b/drivers/gpu/drm/sun4i/sun8i_mixer.c +@@ -111,46 +111,102 @@ static const struct de2_fmt_info de2_for + .csc = SUN8I_CSC_MODE_OFF, + }, + { ++ /* for DE2 VI layer which ignores alpha */ ++ .drm_fmt = DRM_FORMAT_XRGB4444, ++ .de2_fmt = SUN8I_MIXER_FBFMT_ARGB4444, ++ .rgb = true, ++ .csc = SUN8I_CSC_MODE_OFF, ++ }, ++ { + .drm_fmt = DRM_FORMAT_ABGR4444, + .de2_fmt = SUN8I_MIXER_FBFMT_ABGR4444, + .rgb = true, + .csc = SUN8I_CSC_MODE_OFF, + }, + { ++ /* for DE2 VI layer which ignores alpha */ ++ .drm_fmt = DRM_FORMAT_XBGR4444, ++ .de2_fmt = SUN8I_MIXER_FBFMT_ABGR4444, ++ .rgb = true, ++ .csc = SUN8I_CSC_MODE_OFF, ++ }, ++ { + .drm_fmt = DRM_FORMAT_RGBA4444, + .de2_fmt = SUN8I_MIXER_FBFMT_RGBA4444, + .rgb = true, + .csc = SUN8I_CSC_MODE_OFF, + }, + { ++ /* for DE2 VI layer which ignores alpha */ ++ .drm_fmt = DRM_FORMAT_RGBX4444, ++ .de2_fmt = SUN8I_MIXER_FBFMT_RGBA4444, ++ .rgb = true, ++ .csc = SUN8I_CSC_MODE_OFF, ++ }, ++ { + .drm_fmt = DRM_FORMAT_BGRA4444, + .de2_fmt = SUN8I_MIXER_FBFMT_BGRA4444, + .rgb = true, + .csc = SUN8I_CSC_MODE_OFF, + }, + { ++ /* for DE2 VI layer which ignores alpha */ ++ .drm_fmt = DRM_FORMAT_BGRX4444, ++ .de2_fmt = SUN8I_MIXER_FBFMT_BGRA4444, ++ .rgb = true, ++ .csc = SUN8I_CSC_MODE_OFF, ++ }, ++ { + .drm_fmt = DRM_FORMAT_ARGB1555, + .de2_fmt = SUN8I_MIXER_FBFMT_ARGB1555, + .rgb = true, + .csc = SUN8I_CSC_MODE_OFF, + }, + { ++ /* for DE2 VI layer which ignores alpha */ ++ .drm_fmt = DRM_FORMAT_XRGB1555, ++ .de2_fmt = SUN8I_MIXER_FBFMT_ARGB1555, ++ .rgb = true, ++ .csc = SUN8I_CSC_MODE_OFF, ++ }, ++ { + .drm_fmt = DRM_FORMAT_ABGR1555, + .de2_fmt = SUN8I_MIXER_FBFMT_ABGR1555, + .rgb = true, + .csc = SUN8I_CSC_MODE_OFF, + }, + { ++ /* for DE2 VI layer which ignores alpha */ ++ .drm_fmt = DRM_FORMAT_XBGR1555, ++ .de2_fmt = SUN8I_MIXER_FBFMT_ABGR1555, ++ .rgb = true, ++ .csc = SUN8I_CSC_MODE_OFF, ++ }, ++ { + .drm_fmt = DRM_FORMAT_RGBA5551, + .de2_fmt = SUN8I_MIXER_FBFMT_RGBA5551, + .rgb = true, + .csc = SUN8I_CSC_MODE_OFF, + }, + { ++ /* for DE2 VI layer which ignores alpha */ ++ .drm_fmt = DRM_FORMAT_RGBX5551, ++ .de2_fmt = SUN8I_MIXER_FBFMT_RGBA5551, ++ .rgb = true, ++ .csc = SUN8I_CSC_MODE_OFF, ++ }, ++ { + .drm_fmt = DRM_FORMAT_BGRA5551, + .de2_fmt = SUN8I_MIXER_FBFMT_BGRA5551, + .rgb = true, + .csc = SUN8I_CSC_MODE_OFF, ++ }, ++ { ++ /* for DE2 VI layer which ignores alpha */ ++ .drm_fmt = DRM_FORMAT_BGRX5551, ++ .de2_fmt = SUN8I_MIXER_FBFMT_BGRA5551, ++ .rgb = true, ++ .csc = SUN8I_CSC_MODE_OFF, + }, + { + .drm_fmt = DRM_FORMAT_UYVY, +--- a/drivers/gpu/drm/sun4i/sun8i_vi_layer.c ++++ b/drivers/gpu/drm/sun4i/sun8i_vi_layer.c +@@ -330,26 +330,26 @@ static const struct drm_plane_funcs sun8 + }; + + /* +- * While all RGB formats are supported, VI planes don't support +- * alpha blending, so there is no point having formats with alpha +- * channel if their opaque analog exist. ++ * While DE2 VI layer supports same RGB formats as UI layer, alpha ++ * channel is ignored. This structure lists all unique variants ++ * where alpha channel is replaced with "don't care" (X) channel. + */ + static const u32 sun8i_vi_layer_formats[] = { +- DRM_FORMAT_ABGR1555, +- DRM_FORMAT_ABGR4444, +- DRM_FORMAT_ARGB1555, +- DRM_FORMAT_ARGB4444, + DRM_FORMAT_BGR565, + DRM_FORMAT_BGR888, +- DRM_FORMAT_BGRA5551, +- DRM_FORMAT_BGRA4444, ++ DRM_FORMAT_BGRX4444, ++ DRM_FORMAT_BGRX5551, + DRM_FORMAT_BGRX8888, + DRM_FORMAT_RGB565, + DRM_FORMAT_RGB888, +- DRM_FORMAT_RGBA4444, +- DRM_FORMAT_RGBA5551, ++ DRM_FORMAT_RGBX4444, ++ DRM_FORMAT_RGBX5551, + DRM_FORMAT_RGBX8888, ++ DRM_FORMAT_XBGR1555, ++ DRM_FORMAT_XBGR4444, + DRM_FORMAT_XBGR8888, ++ DRM_FORMAT_XRGB1555, ++ DRM_FORMAT_XRGB4444, + DRM_FORMAT_XRGB8888, + + DRM_FORMAT_NV16, diff --git a/queue-4.19/ib-hfi1-qib-ensure-rcu-is-locked-when-accessing-list.patch b/queue-4.19/ib-hfi1-qib-ensure-rcu-is-locked-when-accessing-list.patch new file mode 100644 index 00000000000..03d29e9fffa --- /dev/null +++ b/queue-4.19/ib-hfi1-qib-ensure-rcu-is-locked-when-accessing-list.patch @@ -0,0 +1,66 @@ +From 817a68a6584aa08e323c64283fec5ded7be84759 Mon Sep 17 00:00:00 2001 +From: Dennis Dalessandro +Date: Tue, 25 Feb 2020 14:54:45 -0500 +Subject: IB/hfi1, qib: Ensure RCU is locked when accessing list + +From: Dennis Dalessandro + +commit 817a68a6584aa08e323c64283fec5ded7be84759 upstream. + +The packet handling function, specifically the iteration of the qp list +for mad packet processing misses locking RCU before running through the +list. Not only is this incorrect, but the list_for_each_entry_rcu() call +can not be called with a conditional check for lock dependency. Remedy +this by invoking the rcu lock and unlock around the critical section. + +This brings MAD packet processing in line with what is done for non-MAD +packets. + +Fixes: 7724105686e7 ("IB/hfi1: add driver files") +Link: https://lore.kernel.org/r/20200225195445.140896.41873.stgit@awfm-01.aw.intel.com +Reviewed-by: Mike Marciniszyn +Signed-off-by: Dennis Dalessandro +Signed-off-by: Jason Gunthorpe +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/infiniband/hw/hfi1/verbs.c | 4 +++- + drivers/infiniband/hw/qib/qib_verbs.c | 2 ++ + 2 files changed, 5 insertions(+), 1 deletion(-) + +--- a/drivers/infiniband/hw/hfi1/verbs.c ++++ b/drivers/infiniband/hw/hfi1/verbs.c +@@ -595,10 +595,11 @@ static inline void hfi1_handle_packet(st + opa_get_lid(packet->dlid, 9B)); + if (!mcast) + goto drop; ++ rcu_read_lock(); + list_for_each_entry_rcu(p, &mcast->qp_list, list) { + packet->qp = p->qp; + if (hfi1_do_pkey_check(packet)) +- goto drop; ++ goto unlock_drop; + spin_lock_irqsave(&packet->qp->r_lock, flags); + packet_handler = qp_ok(packet); + if (likely(packet_handler)) +@@ -607,6 +608,7 @@ static inline void hfi1_handle_packet(st + ibp->rvp.n_pkt_drops++; + spin_unlock_irqrestore(&packet->qp->r_lock, flags); + } ++ rcu_read_unlock(); + /* + * Notify rvt_multicast_detach() if it is waiting for us + * to finish. +--- a/drivers/infiniband/hw/qib/qib_verbs.c ++++ b/drivers/infiniband/hw/qib/qib_verbs.c +@@ -360,8 +360,10 @@ void qib_ib_rcv(struct qib_ctxtdata *rcd + if (mcast == NULL) + goto drop; + this_cpu_inc(ibp->pmastats->n_multicast_rcv); ++ rcu_read_lock(); + list_for_each_entry_rcu(p, &mcast->qp_list, list) + qib_qp_rcv(rcd, hdr, 1, data, tlen, p->qp); ++ rcu_read_unlock(); + /* + * Notify rvt_multicast_detach() if it is waiting for us + * to finish. diff --git a/queue-4.19/phy-mapphone-mdm6600-fix-timeouts-by-adding-wake-up-handling.patch b/queue-4.19/phy-mapphone-mdm6600-fix-timeouts-by-adding-wake-up-handling.patch new file mode 100644 index 00000000000..6a7bd66cb37 --- /dev/null +++ b/queue-4.19/phy-mapphone-mdm6600-fix-timeouts-by-adding-wake-up-handling.patch @@ -0,0 +1,60 @@ +From be4e3c737eebd75815633f4b8fd766defaf0f1fc Mon Sep 17 00:00:00 2001 +From: Tony Lindgren +Date: Sun, 15 Sep 2019 13:15:52 -0700 +Subject: phy: mapphone-mdm6600: Fix timeouts by adding wake-up handling + +From: Tony Lindgren + +commit be4e3c737eebd75815633f4b8fd766defaf0f1fc upstream. + +We have an interrupt handler for the wake-up GPIO pin, but we're missing +the code to wake-up the system. This can cause timeouts receiving data +for the UART that shares the wake-up GPIO pin with the USB PHY. + +All we need to do is just wake the system and kick the autosuspend +timeout to fix the issue. + +Fixes: 5d1ebbda0318 ("phy: mapphone-mdm6600: Add USB PHY driver for MDM6600 on Droid 4") +Cc: Marcel Partap +Cc: Merlijn Wajer +Cc: Michael Scott +Cc: NeKit +Cc: Pavel Machek +Cc: Sebastian Reichel +Signed-off-by: Tony Lindgren +Signed-off-by: Kishon Vijay Abraham I +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/phy/motorola/phy-mapphone-mdm6600.c | 18 ++++++++++++++++-- + 1 file changed, 16 insertions(+), 2 deletions(-) + +--- a/drivers/phy/motorola/phy-mapphone-mdm6600.c ++++ b/drivers/phy/motorola/phy-mapphone-mdm6600.c +@@ -224,10 +224,24 @@ static irqreturn_t phy_mdm6600_wakeirq_t + { + struct phy_mdm6600 *ddata = data; + struct gpio_desc *mode_gpio1; ++ int error, wakeup; + + mode_gpio1 = ddata->mode_gpios->desc[PHY_MDM6600_MODE1]; +- dev_dbg(ddata->dev, "OOB wake on mode_gpio1: %i\n", +- gpiod_get_value(mode_gpio1)); ++ wakeup = gpiod_get_value(mode_gpio1); ++ if (!wakeup) ++ return IRQ_NONE; ++ ++ dev_dbg(ddata->dev, "OOB wake on mode_gpio1: %i\n", wakeup); ++ error = pm_runtime_get_sync(ddata->dev); ++ if (error < 0) { ++ pm_runtime_put_noidle(ddata->dev); ++ ++ return IRQ_NONE; ++ } ++ ++ /* Just wake-up and kick the autosuspend timer */ ++ pm_runtime_mark_last_busy(ddata->dev); ++ pm_runtime_put_autosuspend(ddata->dev); + + return IRQ_HANDLED; + } diff --git a/queue-4.19/phy-mapphone-mdm6600-fix-write-timeouts-with-shorter-gpio-toggle-interval.patch b/queue-4.19/phy-mapphone-mdm6600-fix-write-timeouts-with-shorter-gpio-toggle-interval.patch new file mode 100644 index 00000000000..d77d4a025cd --- /dev/null +++ b/queue-4.19/phy-mapphone-mdm6600-fix-write-timeouts-with-shorter-gpio-toggle-interval.patch @@ -0,0 +1,57 @@ +From 46b7edf1c7b7c91004c4db2c355cbd033f2385f9 Mon Sep 17 00:00:00 2001 +From: Tony Lindgren +Date: Tue, 4 Feb 2020 07:36:02 -0800 +Subject: phy: mapphone-mdm6600: Fix write timeouts with shorter GPIO toggle interval + +From: Tony Lindgren + +commit 46b7edf1c7b7c91004c4db2c355cbd033f2385f9 upstream. + +I've noticed that when writing data to the modem the writes can time out +at some point eventually. Looks like kicking the modem idle GPIO every +600 ms instead of once a second fixes the issue. Note that this rate is +different from our runtime PM autosuspend rate MDM6600_MODEM_IDLE_DELAY_MS +that we still want to keep at 1 second, so let's add a separate define for +PHY_MDM6600_IDLE_KICK_MS. + +Fixes: f7f50b2a7b05 ("phy: mapphone-mdm6600: Add runtime PM support for n_gsm on USB suspend") +Cc: Marcel Partap +Cc: Merlijn Wajer +Cc: Michael Scott +Cc: NeKit +Cc: Pavel Machek +Cc: Sebastian Reichel +Signed-off-by: Tony Lindgren +Signed-off-by: Kishon Vijay Abraham I +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/phy/motorola/phy-mapphone-mdm6600.c | 9 ++++++++- + 1 file changed, 8 insertions(+), 1 deletion(-) + +--- a/drivers/phy/motorola/phy-mapphone-mdm6600.c ++++ b/drivers/phy/motorola/phy-mapphone-mdm6600.c +@@ -19,6 +19,7 @@ + + #define PHY_MDM6600_PHY_DELAY_MS 4000 /* PHY enable 2.2s to 3.5s */ + #define PHY_MDM6600_ENABLED_DELAY_MS 8000 /* 8s more total for MDM6600 */ ++#define PHY_MDM6600_WAKE_KICK_MS 600 /* time on after GPIO toggle */ + #define MDM6600_MODEM_IDLE_DELAY_MS 1000 /* modem after USB suspend */ + #define MDM6600_MODEM_WAKE_DELAY_MS 200 /* modem response after idle */ + +@@ -491,8 +492,14 @@ static void phy_mdm6600_modem_wake(struc + + ddata = container_of(work, struct phy_mdm6600, modem_wake_work.work); + phy_mdm6600_wake_modem(ddata); ++ ++ /* ++ * The modem does not always stay awake 1.2 seconds after toggling ++ * the wake GPIO, and sometimes it idles after about some 600 ms ++ * making writes time out. ++ */ + schedule_delayed_work(&ddata->modem_wake_work, +- msecs_to_jiffies(MDM6600_MODEM_IDLE_DELAY_MS)); ++ msecs_to_jiffies(PHY_MDM6600_WAKE_KICK_MS)); + } + + static int __maybe_unused phy_mdm6600_runtime_suspend(struct device *dev) diff --git a/queue-4.19/rdma-iwcm-fix-iwcm-work-deallocation.patch b/queue-4.19/rdma-iwcm-fix-iwcm-work-deallocation.patch new file mode 100644 index 00000000000..689bd522c50 --- /dev/null +++ b/queue-4.19/rdma-iwcm-fix-iwcm-work-deallocation.patch @@ -0,0 +1,41 @@ +From 810dbc69087b08fd53e1cdd6c709f385bc2921ad Mon Sep 17 00:00:00 2001 +From: Bernard Metzler +Date: Mon, 2 Mar 2020 19:16:14 +0100 +Subject: RDMA/iwcm: Fix iwcm work deallocation + +From: Bernard Metzler + +commit 810dbc69087b08fd53e1cdd6c709f385bc2921ad upstream. + +The dealloc_work_entries() function must update the work_free_list pointer +while freeing its entries, since potentially called again on same list. A +second iteration of the work list caused system crash. This happens, if +work allocation fails during cma_iw_listen() and free_cm_id() tries to +free the list again during cleanup. + +Fixes: 922a8e9fb2e0 ("RDMA: iWARP Connection Manager.") +Link: https://lore.kernel.org/r/20200302181614.17042-1-bmt@zurich.ibm.com +Reported-by: syzbot+cb0c054eabfba4342146@syzkaller.appspotmail.com +Signed-off-by: Bernard Metzler +Reviewed-by: Jason Gunthorpe +Signed-off-by: Jason Gunthorpe +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/infiniband/core/iwcm.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +--- a/drivers/infiniband/core/iwcm.c ++++ b/drivers/infiniband/core/iwcm.c +@@ -158,8 +158,10 @@ static void dealloc_work_entries(struct + { + struct list_head *e, *tmp; + +- list_for_each_safe(e, tmp, &cm_id_priv->work_free_list) ++ list_for_each_safe(e, tmp, &cm_id_priv->work_free_list) { ++ list_del(e); + kfree(list_entry(e, struct iwcm_work, free_list)); ++ } + } + + static int alloc_work_entries(struct iwcm_id_private *cm_id_priv, int count) diff --git a/queue-4.19/rmda-cm-fix-missing-ib_cm_destroy_id-in-ib_cm_insert_listen.patch b/queue-4.19/rmda-cm-fix-missing-ib_cm_destroy_id-in-ib_cm_insert_listen.patch new file mode 100644 index 00000000000..76127034039 --- /dev/null +++ b/queue-4.19/rmda-cm-fix-missing-ib_cm_destroy_id-in-ib_cm_insert_listen.patch @@ -0,0 +1,32 @@ +From c14dfddbd869bf0c2bafb7ef260c41d9cebbcfec Mon Sep 17 00:00:00 2001 +From: Jason Gunthorpe +Date: Fri, 21 Feb 2020 15:20:26 +0000 +Subject: RMDA/cm: Fix missing ib_cm_destroy_id() in ib_cm_insert_listen() + +From: Jason Gunthorpe + +commit c14dfddbd869bf0c2bafb7ef260c41d9cebbcfec upstream. + +The algorithm pre-allocates a cm_id since allocation cannot be done while +holding the cm.lock spinlock, however it doesn't free it on one error +path, leading to a memory leak. + +Fixes: 067b171b8679 ("IB/cm: Share listening CM IDs") +Link: https://lore.kernel.org/r/20200221152023.GA8680@ziepe.ca +Signed-off-by: Jason Gunthorpe +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/infiniband/core/cm.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/drivers/infiniband/core/cm.c ++++ b/drivers/infiniband/core/cm.c +@@ -1231,6 +1231,7 @@ struct ib_cm_id *ib_cm_insert_listen(str + /* Sharing an ib_cm_id with different handlers is not + * supported */ + spin_unlock_irqrestore(&cm.lock, flags); ++ ib_destroy_cm_id(cm_id); + return ERR_PTR(-EINVAL); + } + atomic_inc(&cm_id_priv->refcount); diff --git a/queue-4.19/series b/queue-4.19/series index b8783c0ab50..f3952120558 100644 --- a/queue-4.19/series +++ b/queue-4.19/series @@ -63,3 +63,14 @@ asoc-intel-skl-fix-pin-debug-prints.patch asoc-intel-skl-fix-possible-buffer-overflow-in-debug-outputs.patch dmaengine-imx-sdma-remove-dma_slave_config-direction.patch dmaengine-imx-sdma-fix-the-event-id-check-to-include-rx-event-for-uart6.patch +asoc-pcm-fix-possible-buffer-overflow-in-dpcm-state-sysfs-output.patch +asoc-pcm512x-fix-unbalanced-regulator-enable-call-in-probe-error-path.patch +asoc-dapm-correct-dapm-handling-of-active-widgets-during-shutdown.patch +drm-sun4i-fix-de2-vi-layer-format-support.patch +drm-sun4i-de2-de3-remove-unsupported-vi-layer-formats.patch +phy-mapphone-mdm6600-fix-timeouts-by-adding-wake-up-handling.patch +phy-mapphone-mdm6600-fix-write-timeouts-with-shorter-gpio-toggle-interval.patch +arm-dts-imx6-phycore-som-fix-emmc-supply.patch +rdma-iwcm-fix-iwcm-work-deallocation.patch +rmda-cm-fix-missing-ib_cm_destroy_id-in-ib_cm_insert_listen.patch +ib-hfi1-qib-ensure-rcu-is-locked-when-accessing-list.patch