All of lore.kernel.org
 help / color / mirror / Atom feed
* [PATCH 5.12 000/677] 5.12.4-rc1 review
@ 2021-05-12 14:40 Greg Kroah-Hartman
  2021-05-12 14:40 ` [PATCH 5.12 001/677] Bluetooth: verify AMP hci_chan before amp_destroy Greg Kroah-Hartman
                   ` (684 more replies)
  0 siblings, 685 replies; 702+ messages in thread
From: Greg Kroah-Hartman @ 2021-05-12 14:40 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, torvalds, akpm, linux, shuah, patches,
	lkft-triage, pavel, jonathanh, f.fainelli, stable

This is the start of the stable review cycle for the 5.12.4 release.
There are 677 patches in this series, all will be posted as a response
to this one.  If anyone has any issues with these being applied, please
let me know.

Responses should be made by Fri, 14 May 2021 14:47:09 +0000.
Anything received after that time might be too late.

The whole patch series can be found in one patch at:
	https://www.kernel.org/pub/linux/kernel/v5.x/stable-review/patch-5.12.4-rc1.gz
or in the git tree and branch at:
	git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-5.12.y
and the diffstat can be found below.

thanks,

greg k-h

-------------
Pseudo-Shortlog of commits:

Greg Kroah-Hartman <gregkh@linuxfoundation.org>
    Linux 5.12.4-rc1

Xin Long <lucien.xin@gmail.com>
    sctp: delay auto_asconf init until binding the first addr

Xin Long <lucien.xin@gmail.com>
    Revert "net/sctp: fix race condition in sctp_destroy_sock"

Arnd Bergmann <arnd@arndb.de>
    smp: Fix smp_call_function_single_async prototype

Jonathon Reinhart <jonathon.reinhart@gmail.com>
    net: Only allow init netns to set default tcp cong to a restricted algo

Andrii Nakryiko <andrii@kernel.org>
    bpf: Prevent writable memory-mapping of read-only ringbuf pages

Thadeu Lima de Souza Cascardo <cascardo@canonical.com>
    bpf, ringbuf: Deny reserve of buffers larger than ringbuf

Daniel Borkmann <daniel@iogearbox.net>
    bpf: Fix alu32 const subreg bound tracking on bitwise operations

David Howells <dhowells@redhat.com>
    afs: Fix speculative status fetches

Jane Chu <jane.chu@oracle.com>
    mm/memory-failure: unnecessary amount of unmapping

Wang Wensheng <wangwensheng4@huawei.com>
    mm/sparse: add the missing sparse_buffer_fini() in error branch

Muchun Song <songmuchun@bytedance.com>
    mm: memcontrol: slab: fix obtain a reference to a freeing memcg

Vlastimil Babka <vbabka@suse.cz>
    mm, slub: enable slub_debug static key when creating cache with explicit debug flags

Dan Carpenter <dan.carpenter@oracle.com>
    kfifo: fix ternary sign extension bugs

Sergei Trofimovich <slyfox@gentoo.org>
    ia64: fix EFI_DEBUG build

Valentin Schneider <valentin.schneider@arm.com>
    ia64: ensure proper NUMA distance and possible map initialization

Leo Yan <leo.yan@linaro.org>
    perf session: Add swap operation for event TIME_CONV

Leo Yan <leo.yan@linaro.org>
    perf jit: Let convert_timestamp() to be backwards-compatible

Leo Yan <leo.yan@linaro.org>
    perf tools: Change fields type in perf_record_time_conv

Lv Yunlong <lyl2019@mail.ustc.edu.cn>
    net:nfc:digital: Fix a double free in digital_tg_recv_dep_req

Tobias Waldekranz <tobias@waldekranz.com>
    net: dsa: mv88e6xxx: Fix 6095/6097/6185 ports in non-SERDES CMODE

Linus Lüssing <linus.luessing@c0d3.blue>
    net: bridge: mcast: fix broken length + header check for MRDv6 Adv.

Lv Yunlong <lyl2019@mail.ustc.edu.cn>
    RDMA/bnxt_re: Fix a double free in bnxt_qplib_alloc_res

Lv Yunlong <lyl2019@mail.ustc.edu.cn>
    RDMA/siw: Fix a use after free in siw_alloc_mr

Daniel Borkmann <daniel@iogearbox.net>
    bpf: Fix propagation of 32 bit unsigned bounds from 64 bit bounds

Andrii Nakryiko <andrii@kernel.org>
    selftests/bpf: Fix core_reloc test runner

Andrii Nakryiko <andrii@kernel.org>
    selftests/bpf: Fix field existence CO-RE reloc tests

Andrii Nakryiko <andrii@kernel.org>
    selftests/bpf: Fix BPF_CORE_READ_BITFIELD() macro

Lv Yunlong <lyl2019@mail.ustc.edu.cn>
    net:emac/emac-mac: Fix a use after free in emac_mac_tx_buf_send

Davide Caratti <dcaratti@redhat.com>
    net/sched: act_ct: fix wild memory access when clearing fragments

Sean Christopherson <seanjc@google.com>
    KVM: SVM: Disable SEV/SEV-ES if NPT is disabled

Sean Christopherson <seanjc@google.com>
    KVM: SVM: Free sev_asid_bitmap during init if SEV setup fails

Sean Christopherson <seanjc@google.com>
    KVM: SVM: Zero out the VMCB array used to track SEV ASID association

Sean Christopherson <seanjc@google.com>
    KVM: VMX: Intercept FS/GS_BASE MSR accesses for 32-bit KVM

Michael Chan <michael.chan@broadcom.com>
    bnxt_en: Fix RX consumer index logic in the error path.

Mat Martineau <mathew.j.martineau@linux.intel.com>
    mptcp: Retransmit DATA_FIN

Danielle Ratson <danieller@nvidia.com>
    selftests: mlxsw: Remove a redundant if statement in tc_flower_scale test

Danielle Ratson <danieller@nvidia.com>
    selftests: mlxsw: Remove a redundant if statement in port_scale test

Petr Machata <petrm@nvidia.com>
    selftests: net: mirror_gre_vlan_bridge_1q: Make an FDB entry static

Phillip Potter <phil@philpotter.co.uk>
    net: geneve: modify IP header check in geneve6_xmit_skb and geneve_xmit_skb

Kunihiko Hayashi <hayashi.kunihiko@socionext.com>
    arm64: dts: uniphier: Change phy-mode to RGMII-ID to enable delay pins for RTL8211E

Kunihiko Hayashi <hayashi.kunihiko@socionext.com>
    ARM: dts: uniphier: Change phy-mode to RGMII-ID to enable delay pins for RTL8211E

Dan Carpenter <dan.carpenter@oracle.com>
    bnxt_en: fix ternary sign extension bug in bnxt_show_temp()

Martin Willi <martin@strongswan.org>
    net, xdp: Update pkt_type if generic XDP changes unicast MAC

Arnd Bergmann <arnd@arndb.de>
    net: enetc: fix link error again

Maxim Kochetkov <fido_max@inbox.ru>
    net: phy: marvell: fix m88e1111_set_downshift

Maxim Kochetkov <fido_max@inbox.ru>
    net: phy: marvell: fix m88e1011_set_downshift

Christophe Leroy <christophe.leroy@csgroup.eu>
    powerpc/52xx: Fix an invalid ASM expression ('addi' used instead of 'add')

Athira Rajeev <atrajeev@linux.vnet.ibm.com>
    powerpc/perf: Fix the threshold event selection for memory events in power10

Colin Ian King <colin.king@canonical.com>
    wlcore: Fix buffer overrun by snprintf due to incorrect buffer size

Shuah Khan <skhan@linuxfoundation.org>
    ath10k: Fix ath10k_wmi_tlv_op_pull_peer_stats_info() unlock without lock

Lv Yunlong <lyl2019@mail.ustc.edu.cn>
    ath10k: Fix a use after free in ath10k_htc_send_bundle

Toke Høiland-Jørgensen <toke@redhat.com>
    ath9k: Fix error check in ath9k_hw_read_revisions() for PCI devices

Christophe Leroy <christophe.leroy@csgroup.eu>
    powerpc/64: Fix the definition of the fixmap area

Shay Drory <shayd@nvidia.com>
    RDMA/core: Add CM to restrack after successful attachment to a device

Bob Pearson <rpearsonhpe@gmail.com>
    RDMA/rxe: Fix a bug in rxe_fill_ip_info()

Sean Wang <sean.wang@mediatek.com>
    mt76: mt7921: fix possible invalid register access

Colin Ian King <colin.king@canonical.com>
    mt76: mt7615: Fix a dereference of pointer sta before it is null checked

Martin Schiller <ms@dev.tdt.de>
    net: phy: intel-xway: enable integrated led functions

Yoshihiro Shimoda <yoshihiro.shimoda.uh@renesas.com>
    net: renesas: ravb: Fix a stuck issue when a lot of frames are received

Ong Boon Leong <boon.leong.ong@intel.com>
    net: stmmac: fix TSO and TBS feature enabling during driver open

Yinjun Zhang <yinjun.zhang@corigine.com>
    nfp: devlink: initialize the devlink port attribute "lanes"

Tobias Waldekranz <tobias@waldekranz.com>
    net: dsa: mv88e6xxx: Fix off-by-one in VTU devlink region size

Sean Christopherson <seanjc@google.com>
    crypto: ccp: Detect and reject "invalid" addresses destined for PSP

Leonardo Bras <leobras.c@gmail.com>
    powerpc/pseries/iommu: Fix window size for direct mapping with pmem

Lorenzo Bianconi <lorenzo@kernel.org>
    mt76: mt7921: run mt7921_mcu_fw_log_2_host holding mt76 mutex

Ryder Lee <ryder.lee@mediatek.com>
    mt76: mt7915: fix memleak when mt7915_unregister_device()

Ryder Lee <ryder.lee@mediatek.com>
    mt76: mt7615: fix memleak when mt7615_unregister_device()

Po-Hao Huang <phhuang@realtek.com>
    rtw88: refine napi deinit flow

Colin Ian King <colin.king@canonical.com>
    net: davinci_emac: Fix incorrect masking of tx and rx error channel

Vadym Kochan <vkochan@marvell.com>
    net: marvell: prestera: fix port event handling on init

Stefano Garzarella <sgarzare@redhat.com>
    vsock/virtio: free queued packets when closing socket

Edward Cree <ecree.xilinx@gmail.com>
    sfc: ef10: fix TX queue lookup in TX event handling

Colin Ian King <colin.king@canonical.com>
    ALSA: usb: midi: don't return -ENOMEM when usb_urb_ep_type_check fails

Sindhu Devale <sindhu.devale@intel.com>
    RDMA/i40iw: Fix error unwinding when i40iw_hmc_sd_one fails

Potnuri Bharat Teja <bharat@chelsio.com>
    RDMA/cxgb4: add missing qpid increment

Alexander Lobakin <alobakin@pm.me>
    gro: fix napi_gro_frags() Fast GRO breakage due to IP alignment check

Linus Walleij <linus.walleij@linaro.org>
    net: ethernet: ixp4xx: Set the DMA masks explicitly

Florent Revest <revest@chromium.org>
    libbpf: Initialize the bpf_seq_printf parameters array field by field

Stefano Garzarella <sgarzare@redhat.com>
    vsock/vmci: log once the failed queue pair allocation

Pablo Neira Ayuso <pablo@netfilter.org>
    netfilter: nftables_offload: special ethertype handling for VLAN

Pablo Neira Ayuso <pablo@netfilter.org>
    netfilter: nftables_offload: VLAN id needs host byteorder in flow dissector

Pablo Neira Ayuso <pablo@netfilter.org>
    netfilter: nft_payload: fix C-VLAN offload support

Lv Yunlong <lyl2019@mail.ustc.edu.cn>
    mwl8k: Fix a double Free in mwl8k_probe_hw

Qii Wang <qii.wang@mediatek.com>
    i2c: mediatek: Fix wrong dma sync flag

Sergey Shtylyov <s.shtylyov@omprussia.ru>
    i2c: sh7760: fix IRQ error path

Arnd Bergmann <arnd@arndb.de>
    wlcore: fix overlapping snprintf arguments in debugfs

Ping-Ke Shih <pkshih@realtek.com>
    rtlwifi: 8821ae: upgrade PHY and RF parameters

David Edmondson <david.edmondson@oracle.com>
    KVM: x86: dump_vmcs should not assume GUEST_IA32_EFER is valid

Srikar Dronamraju <srikar@linux.vnet.ibm.com>
    powerpc/smp: Reintroduce cpu_core_mask

Geliang Tang <geliangtang@gmail.com>
    mptcp: fix format specifiers for unsigned int

Dafna Hirschfeld <dafna.hirschfeld@collabora.com>
    iommu/mediatek: Always enable the clk on resume

Tyrel Datwyler <tyreld@linux.ibm.com>
    powerpc/pseries: extract host bridge from pci_bus prior to bus removal

Ilya Lipnitskiy <ilya.lipnitskiy@gmail.com>
    MIPS: pci-legacy: stop using of_pci_range_to_resource

Dan Carpenter <dan.carpenter@oracle.com>
    drm/amd/pm: fix error code in smu_set_power_limit()

Dan Carpenter <dan.carpenter@oracle.com>
    drm/amdgpu: fix an error code in init_pmu_entry_by_type_and_add()

Vitaly Chikunov <vt@altlinux.org>
    perf beauty: Fix fsconfig generator

Paul Menzel <pmenzel@molgen.mpg.de>
    iommu/amd: Put newline after closing bracket in warning

Christophe JAILLET <christophe.jaillet@wanadoo.fr>
    iommu/vt-d: Fix an error handling path in 'intel_prepare_irq_remapping()'

Dan Carpenter <dan.carpenter@oracle.com>
    drm/i915/gvt: Fix error code in intel_gvt_init_device()

Eric Dumazet <edumazet@google.com>
    net/packet: remove data races in fanout operations

Colin Ian King <colin.king@canonical.com>
    net/mlx5: Fix bit-wise and with zero

Shengjiu Wang <shengjiu.wang@nxp.com>
    ASoC: ak5558: correct reset polarity

Nicholas Piggin <npiggin@gmail.com>
    powerpc/syscall: switch user_exit_irqoff and trace_hardirqs_off order

Cédric Le Goater <clg@kaod.org>
    powerpc/xive: Fix xmon command "dxi"

Cédric Le Goater <clg@kaod.org>
    powerpc/xive: Drop check on irq_data in xive_core_debug_show()

Mukesh Sisodiya <mukesh.sisodiya@intel.com>
    iwlwifi: dbg: disable ini debug in 9000 family and below

Mordechay Goodstein <mordechay.goodstein@intel.com>
    iwlwifi: rs-fw: don't support stbc for HE 160

Alessio Balsini <balsini@android.com>
    fuse: fix matching of FUSE_DEV_IOC_CLONE command

Sergey Shtylyov <s.shtylyov@omprussia.ru>
    i2c: sh7760: add IRQ check

Sergey Shtylyov <s.shtylyov@omprussia.ru>
    i2c: rcar: add IRQ check

Sergey Shtylyov <s.shtylyov@omprussia.ru>
    i2c: mlxbf: add IRQ check

Sergey Shtylyov <s.shtylyov@omprussia.ru>
    i2c: jz4780: add IRQ check

Sergey Shtylyov <s.shtylyov@omprussia.ru>
    i2c: emev2: add IRQ check

Sergey Shtylyov <s.shtylyov@omprussia.ru>
    i2c: cadence: add IRQ check

Qinglang Miao <miaoqinglang@huawei.com>
    i2c: xiic: fix reference leak when pm_runtime_get_sync fails

Qinglang Miao <miaoqinglang@huawei.com>
    i2c: stm32f7: fix reference leak when pm_runtime_get_sync fails

Qinglang Miao <miaoqinglang@huawei.com>
    i2c: sprd: fix reference leak when pm_runtime_get_sync fails

Qinglang Miao <miaoqinglang@huawei.com>
    i2c: omap: fix reference leak when pm_runtime_get_sync fails

Qinglang Miao <miaoqinglang@huawei.com>
    i2c: imx: fix reference leak when pm_runtime_get_sync fails

Qinglang Miao <miaoqinglang@huawei.com>
    i2c: imx-lpi2c: fix reference leak when pm_runtime_get_sync fails

Qinglang Miao <miaoqinglang@huawei.com>
    i2c: img-scb: fix reference leak when pm_runtime_get_sync fails

Qinglang Miao <miaoqinglang@huawei.com>
    i2c: cadence: fix reference leak when pm_runtime_get_sync fails

Tudor Ambarus <tudor.ambarus@microchip.com>
    pinctrl: at91-pio4: Fix slew rate disablement

Gioh Kim <gi-oh.kim@ionos.com>
    RDMA/rtrs-clt: destroy sysfs after removing session from active list

Wang Wensheng <wangwensheng4@huawei.com>
    RDMA/srpt: Fix error return code in srpt_cm_req_recv()

Sean Wang <sean.wang@mediatek.com>
    mt76: mt7921: fix kernel crash when the firmware fails to download

Colin Ian King <colin.king@canonical.com>
    net: thunderx: Fix unintentional sign extension issue

Colin Ian King <colin.king@canonical.com>
    cxgb4: Fix unintentional sign extension issues

Wang Wensheng <wangwensheng4@huawei.com>
    RDMA/bnxt_re: Fix error return code in bnxt_qplib_cq_process_terminal()

Wang Wensheng <wangwensheng4@huawei.com>
    IB/hfi1: Fix error return code in parse_platform_config()

Wang Wensheng <wangwensheng4@huawei.com>
    RDMA/qedr: Fix error return code in qedr_iw_connect()

Amir Goldstein <amir73il@gmail.com>
    ovl: invalidate readdir cache on changes to dir with origin

Giuseppe Scrivano <gscrivan@redhat.com>
    ovl: show "userxattr" in the mount data

Nicholas Piggin <npiggin@gmail.com>
    KVM: PPC: Book3S HV P9: Restore host CTRL SPR after guest exit

Sean Wang <sean.wang@mediatek.com>
    mt76: mt7921: fix the dwell time control

Sean Wang <sean.wang@mediatek.com>
    mt76: mt7921: fix inappropriate WoW setup with the missing ARP informaiton

Lorenzo Bianconi <lorenzo@kernel.org>
    mt76: mt7921: always wake the device in mt7921_remove_interface

Ryder Lee <ryder.lee@mediatek.com>
    mt76: mt7915: cleanup mcu tx queue in mt7915_dma_reset()

Ryder Lee <ryder.lee@mediatek.com>
    mt76: mt7615: cleanup mcu tx queue in mt7615_dma_reset()

Sean Wang <sean.wang@mediatek.com>
    mt76: mt7663s: fix the possible device hang in high traffic

Sean Wang <sean.wang@mediatek.com>
    mt76: mt7663s: make all of packets 4-bytes aligned in sdio tx aggregation

Sean Wang <sean.wang@mediatek.com>
    mt76: mt7663: fix when beacon filter is being applied

Ryder Lee <ryder.lee@mediatek.com>
    mt76: mt7915: fix txrate reporting

Ryder Lee <ryder.lee@mediatek.com>
    mt76: mt7915: fix rxrate reporting

Sean Wang <sean.wang@mediatek.com>
    mt76: mt7921: fix the base of the dynamic remap

Sean Wang <sean.wang@mediatek.com>
    mt76: mt7921: fix the base of PCIe interrupt

Lorenzo Bianconi <lorenzo@kernel.org>
    mt76: check return value of mt76_txq_send_burst in mt76_txq_schedule_list

Lorenzo Bianconi <lorenzo@kernel.org>
    mt76: connac: fix kernel warning adding monitor interface

Ryder Lee <ryder.lee@mediatek.com>
    mt76: mt7915: fix mib stats counter reporting to mac80211

Lorenzo Bianconi <lorenzo@kernel.org>
    mt76: mt7615: fix mib stats counter reporting to mac80211

Ryder Lee <ryder.lee@mediatek.com>
    mt76: mt7615: fix TSF configuration

Lorenzo Bianconi <lorenzo@kernel.org>
    mt76: mt7921: fix stats register definitions

Lorenzo Bianconi <lorenzo@kernel.org>
    mt76: mt7915: fix aggr len debugfs node

Lorenzo Bianconi <lorenzo@kernel.org>
    mt76: mt7921: fix aggr length histogram

Lorenzo Bianconi <lorenzo@kernel.org>
    mt76: mt7615: fix memory leak in mt7615_coredump_work

Sean Wang <sean.wang@mediatek.com>
    mt76: mt7921: fixup rx bitrate statistics

Sean Wang <sean.wang@mediatek.com>
    mt76: connac: fix up the setting for ht40 mode in mt76_connac_mcu_uni_add_bss

Sean Wang <sean.wang@mediatek.com>
    mt76: mt7921: fix memory leak in mt7921_coredump_work

Sean Wang <sean.wang@mediatek.com>
    mt76: mt7921: fix suspend/resume sequence

Felix Fietkau <nbd@nbd.name>
    mt76: mt7915: fix tx skb dma unmap

Felix Fietkau <nbd@nbd.name>
    mt76: mt7615: fix tx skb dma unmap

Colin Ian King <colin.king@canonical.com>
    mt7601u: fix always true expression

Dan Carpenter <dan.carpenter@oracle.com>
    rtw88: Fix an error code in rtw_debugfs_set_rsvd_page()

Colin Ian King <colin.king@canonical.com>
    xfs: fix return of uninitialized value in variable error

Weihang Li <liweihang@huawei.com>
    RDMA/hns: Fix missing assignment of max_inline_data

Smita Koralahalli <Smita.KoralahalliChannabasappa@amd.com>
    perf vendor events amd: Fix broken L2 Cache Hits from L2 HWPF metric

Johannes Berg <johannes.berg@intel.com>
    mac80211: bail out if cipher schemes are invalid

Randy Dunlap <rdunlap@infradead.org>
    powerpc: iommu: fix build when neither PCI or IBMVIO is set

Athira Rajeev <atrajeev@linux.vnet.ibm.com>
    powerpc/perf: Fix PMU constraint check for EBB events

Michael Ellerman <mpe@ellerman.id.au>
    powerpc/64s: Use htab_convert_pte_flags() in hash__mark_rodata_ro()

Michael Ellerman <mpe@ellerman.id.au>
    powerpc/pseries: Add key to flags in pSeries_lpar_hpte_updateboltedpp()

Jordan Niethe <jniethe5@gmail.com>
    powerpc/64s: Fix pte update for kernel memory on radix

Mike Marciniszyn <mike.marciniszyn@cornelisnetworks.com>
    IB/hfi1: Use kzalloc() for mmu_rb_handler allocation

Colin Ian King <colin.king@canonical.com>
    liquidio: Fix unintented sign extension of a left shift of a u16

Krzysztof Kozlowski <krzysztof.kozlowski@canonical.com>
    ASoC: simple-card: fix possible uninitialized single_cpu local variable

Alexandru Elisei <alexandru.elisei@arm.com>
    KVM: arm64: Initialize VCPU mdcr_el2 before loading it

Hans de Goede <hdegoede@redhat.com>
    HID: lenovo: Map mic-mute button to KEY_F20 instead of KEY_MICMUTE

Hans de Goede <hdegoede@redhat.com>
    HID: lenovo: Check hid_get_drvdata() returns non NULL in lenovo_event()

Hans de Goede <hdegoede@redhat.com>
    HID: lenovo: Fix lenovo_led_set_tp10ubkbd() error handling

Hans de Goede <hdegoede@redhat.com>
    HID: lenovo: Use brightness_set_blocking callback for setting LEDs brightness

Takashi Iwai <tiwai@suse.de>
    ALSA: usb-audio: Add error checks for usb_driver_claim_interface() calls

Lu Baolu <baolu.lu@linux.intel.com>
    iommu/vt-d: Invalidate PASID cache when root/context entry changed

Lu Baolu <baolu.lu@linux.intel.com>
    iommu/vt-d: Remove WO permissions on second-level paging entries

Lu Baolu <baolu.lu@linux.intel.com>
    iommu/vt-d: Report the right page fault address

Lu Baolu <baolu.lu@linux.intel.com>
    iommu/vt-d: Report right snoop capability when using FL for IOVA

Xiang Chen <chenxiang66@hisilicon.com>
    iommu: Fix a boundary issue to avoid performance drop

Lu Baolu <baolu.lu@linux.intel.com>
    iommu/vt-d: Don't set then clear private data in prq_event_thread()

Wang Wensheng <wangwensheng4@huawei.com>
    KVM: arm64: Fix error return code in init_hyp_mode()

Álvaro Fernández Rojas <noltari@gmail.com>
    mips: bmips: fix syscon-reboot nodes

Salil Mehta <salil.mehta@huawei.com>
    net: hns3: Limiting the scope of vector_ring_chain variable

Dan Carpenter <dan.carpenter@oracle.com>
    nfc: pn533: prevent potential memory corruption

Håkon Bugge <haakon.bugge@oracle.com>
    RDMA/core: Fix corrupted SL on passive side

Andrew Scull <ascull@google.com>
    bug: Remove redundant condition check in report_bug

Yang Yingliang <yangyingliang@huawei.com>
    net/tipc: fix missing destroy_workqueue() on error in tipc_crypto_start()

Michael Ellerman <mpe@ellerman.id.au>
    powerpc/pseries: Only register vio drivers if vio bus exists

Paolo Abeni <pabeni@redhat.com>
    udp: never accept GSO_FRAGLIST packets

Paolo Abeni <pabeni@redhat.com>
    udp: skip L4 aggregation for UDP tunnel packets

Andre Edich <andre.edich@microchip.com>
    net: phy: lan87xx: fix access to wrong register of LAN87xx

Jia Zhou <zhou.jia2@zte.com.cn>
    ALSA: core: remove redundant spin_lock pair in snd_card_disconnect

Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
    ASoC: q6afe-clocks: fix reprobing of the driver

Yang Yingliang <yangyingliang@huawei.com>
    fs: dlm: fix missing unlock on error in accept_from_sock()

Álvaro Fernández Rojas <noltari@gmail.com>
    gpio: guard gpiochip_irqchip_add_domain() with GPIOLIB_IRQCHIP

Tiezhu Yang <yangtiezhu@loongson.cn>
    MIPS/bpf: Enable bpf_probe_read{, str}() on MIPS again

Chen Huang <chenhuang5@huawei.com>
    powerpc: Fix HAVE_HARDLOCKUP_DETECTOR_ARCH build configuration

Nicholas Piggin <npiggin@gmail.com>
    powerpc/64s: Fix hash fault to use TRAP accessor

Lv Yunlong <lyl2019@mail.ustc.edu.cn>
    IB/isert: Fix a use after free in isert_connect_request

Maor Gottlieb <maorg@nvidia.com>
    RDMA/mlx5: Fix drop packet rule in egress table

Zhen Lei <thunder.leizhen@huawei.com>
    iommu/arm-smmu-v3: add bit field SFM into GERROR_ERR_MASK

Shengjiu Wang <shengjiu.wang@nxp.com>
    ASoC: wm8960: Remove bitclk relax condition in wm8960_configure_sysclk

Huang Pei <huangpei@loongson.cn>
    MIPS: loongson64: fix bug when PAGE_SIZE > 16KB

Hanna Hawa <hhhawa@amazon.com>
    pinctrl: pinctrl-single: fix pcs_pin_dbg_show() when bits_per_mux is not zero

Hanna Hawa <hhhawa@amazon.com>
    pinctrl: pinctrl-single: remove unused parameter

Eric Dumazet <edumazet@google.com>
    inet: use bigger hash table for IP ID generation

Li Huafei <lihuafei1@huawei.com>
    ima: Fix the error code for restoring the PCR value

Huang Pei <huangpei@loongson.cn>
    MIPS: fix local_irq_{disable,enable} in asmmacro.h

Nathan Chancellor <nathan@kernel.org>
    powerpc/prom: Mark identical_pvr_fixup as __init

Nathan Chancellor <nathan@kernel.org>
    powerpc/fadump: Mark fadump_calculate_reserve_size as __init

Sebastian Andrzej Siewior <bigeasy@linutronix.de>
    powerpc/mm: Move the linear_mapping_mutex to the ifdef where it is used

KP Singh <kpsingh@kernel.org>
    libbpf: Add explicit padding to btf_dump_emit_type_decl_opts

Andrii Nakryiko <andrii@kernel.org>
    selftests/bpf: Re-generate vmlinux.h and BPF skeletons if bpftool changed

Rafał Miłecki <rafal@milecki.pl>
    net: dsa: bcm_sf2: fix BCM4908 RGMII reg(s)

Rafał Miłecki <rafal@milecki.pl>
    net: dsa: bcm_sf2: add function finding RGMII register

Dmitry Osipenko <digetx@gmail.com>
    ASoC: tegra30: i2s: Restore hardware state on runtime PM resume

Jacob Pan <jacob.jun.pan@linux.intel.com>
    iommu/vt-d: Reject unsupported page request modes

Robin Murphy <robin.murphy@arm.com>
    iommu/dma: Resurrect the "forcedac" option

Shameer Kolothum <shameerali.kolothum.thodi@huawei.com>
    iommu: Check dev->iommu in iommu_dev_xxx functions

Andrii Nakryiko <andrii@kernel.org>
    bpftool: Fix maybe-uninitialized warnings

Andrii Nakryiko <andrii@kernel.org>
    libbpf: Add explicit padding to bpf_xdp_set_link_opts

Xie He <xie.he.0141@gmail.com>
    net: lapbether: Prevent racing when checking whether the netif is running

Jiri Kosina <jkosina@suse.cz>
    Bluetooth: avoid deadlock between hci_dev->lock and socket lock

Sean Christopherson <seanjc@google.com>
    KVM: x86/mmu: Retry page faults that hit an invalid memslot

Marcus Folkesson <marcus.folkesson@gmail.com>
    wilc1000: write value to WILC_INTR2_ENABLE register

Yevgeny Kliteynik <kliteyn@nvidia.com>
    net/mlx5: DR, Add missing vhca_id consume from STEv1

Mark Zhang <markzhang@nvidia.com>
    RDMA/mlx5: Fix mlx5 rates to IB rates map

Maor Gottlieb <maorg@nvidia.com>
    RDMA/mlx5: Fix query RoCE port

Jason Gunthorpe <jgg@ziepe.ca>
    RDMA/mlx5: Zero out ODP related items in the mlx5_ib_mr

Cezary Rojewski <cezary.rojewski@intel.com>
    ASoC: Intel: Skylake: Compile when any configuration is selected

Colin Ian King <colin.king@canonical.com>
    ASoC: Intel: boards: sof-wm8804: add check for PLL setting

Arnaldo Carvalho de Melo <acme@redhat.com>
    perf symbols: Fix dso__fprintf_symbols_by_name() to return the number of printed chars

Maxim Mikityanskiy <maxtram95@gmail.com>
    HID: plantronics: Workaround for double volume key presses

Alexander Lobakin <alobakin@pm.me>
    xsk: Respect device's headroom and tailroom on generic xmit path

Lv Yunlong <lyl2019@mail.ustc.edu.cn>
    drivers/block/null_blk/main: Fix a double free in null_init.

Dan Carpenter <dan.carpenter@oracle.com>
    ataflop: fix off by one in ataflop_probe()

Dan Carpenter <dan.carpenter@oracle.com>
    ataflop: potential out of bounds in do_format()

Peter Zijlstra <peterz@infradead.org>
    kthread: Fix PF_KTHREAD vs to_kthread() race

Waiman Long <longman@redhat.com>
    sched/debug: Fix cgroup_path[] serialization

Dima Stepanov <dmitrii.stepanov@cloud.ionos.com>
    block/rnbd-clt-sysfs: Remove copy buffer overlap in rnbd_clt_get_path_name

Pavel Begunkov <asml.silence@gmail.com>
    io_uring: fix overflows checks in provide buffers

Nathan Chancellor <nathan@kernel.org>
    perf/amd/uncore: Fix sysfs type mismatch

Nathan Chancellor <nathan@kernel.org>
    x86/events/amd/iommu: Fix sysfs type mismatch

Dan Carpenter <dan.carpenter@oracle.com>
    HSI: core: fix resource leaks in hsi_add_client_from_dt()

Jernej Skrabec <jernej.skrabec@siol.net>
    media: cedrus: Fix H265 status definitions

Neil Armstrong <narmstrong@baylibre.com>
    media: meson-ge2d: fix rotation parameters

Niklas Cassel <niklas.cassel@wdc.com>
    nvme-pci: don't simple map sgl when sgls are disabled

Elad Grupi <elad.grupi@dell.com>
    nvmet-tcp: fix a segmentation fault during io parsing error

Fabrice Gasnier <fabrice.gasnier@foss.st.com>
    mfd: stm32-timers: Avoid clearing auto reload register

Orson Zhai <orson.zhai@unisoc.com>
    mailbox: sprd: Introduce refcnt when clients requests/free channels

Brian King <brking@linux.vnet.ibm.com>
    scsi: ibmvfc: Fix invalid state machine BUG_ON()

Sergey Shtylyov <s.shtylyov@omprussia.ru>
    scsi: sni_53c710: Add IRQ check

Sergey Shtylyov <s.shtylyov@omprussia.ru>
    scsi: sun3x_esp: Add IRQ check

Sergey Shtylyov <s.shtylyov@omprussia.ru>
    scsi: jazz_esp: Add IRQ check

Sergey Shtylyov <s.shtylyov@omprussia.ru>
    scsi: hisi_sas: Fix IRQ checks

Sergey Shtylyov <s.shtylyov@omprussia.ru>
    scsi: ufs: ufshcd-pltfrm: Fix deferred probing

Colin Ian King <colin.king@canonical.com>
    scsi: pm80xx: Fix potential infinite loop

Igor Pylypiv <ipylypiv@google.com>
    scsi: pm80xx: Increase timeout for pm80xx mpi_uninit_check()

Colin Ian King <colin.king@canonical.com>
    clk: uniphier: Fix potential infinite loop

Gustavo A. R. Silva <gustavoars@kernel.org>
    bcache: Use 64-bit arithmetic instead of 32-bit

Yingjie Wang <wangyingjie55@126.com>
    drm/radeon: Fix a missing check bug in radeon_dp_mst_detect()

Sefa Eyeoglu <contact@scrumplex.net>
    drm/amd/display: check fb of primary plane

Nirmoy Das <nirmoy.das@amd.com>
    drm/amd/display: use GFP_ATOMIC in dcn20_resource_construct

Chen Hui <clare.chenhui@huawei.com>
    clk: qcom: apss-ipq-pll: Add missing MODULE_DEVICE_TABLE

Chen Hui <clare.chenhui@huawei.com>
    clk: qcom: a53-pll: Add missing MODULE_DEVICE_TABLE

Chen Hui <clare.chenhui@huawei.com>
    clk: qcom: a7-pll: Add missing MODULE_DEVICE_TABLE

Jacopo Mondi <jacopo+renesas@jmondi.org>
    media: i2c: rdamc21: Fix warning on u8 cast

Dan Carpenter <dan.carpenter@oracle.com>
    drm: xlnx: zynqmp: fix a memset in zynqmp_dp_train()

Quanyang Wang <quanyang.wang@windriver.com>
    clk: zynqmp: pll: add set_pll_mode to check condition in zynqmp_pll_enable

Quanyang Wang <quanyang.wang@windriver.com>
    clk: zynqmp: move zynqmp_pll_set_mode out of round_rate callback

Jason Gunthorpe <jgg@ziepe.ca>
    vfio/mdev: Do not allow a mdev_type to have a NULL parent pointer

Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
    drm/msm/dpu: enable DPU_SSPP_QOS_8LVL for SM8250

Rob Clark <robdclark@chromium.org>
    drm/msm: Fix debugfs deadlock

Jason Gunthorpe <jgg@ziepe.ca>
    vfio/pci: Re-order vfio_pci_probe()

Jason Gunthorpe <jgg@ziepe.ca>
    vfio/pci: Move VGA and VF initialization to functions

Jason Gunthorpe <jgg@ziepe.ca>
    vfio/fsl-mc: Re-order vfio_fsl_mc_probe()

Daniel Almeida <daniel.almeida@collabora.com>
    media: rkvdec: Do not require all controls to be present in every request

Hans Verkuil <hverkuil-cisco@xs4all.nl>
    media: v4l2-ctrls.c: fix race condition in hdl->requests list

Lad Prabhakar <prabhakar.mahadev-lad.rj@bp.renesas.com>
    media: i2c: imx219: Balance runtime PM use-count

Lad Prabhakar <prabhakar.mahadev-lad.rj@bp.renesas.com>
    media: i2c: imx219: Move out locking/unlocking of vflip and hflip controls from imx219_set_stream

Sakari Ailus <sakari.ailus@linux.intel.com>
    media: ipu3-cio2: Fix pixel-rate derived link frequency

Sakari Ailus <sakari.ailus@linux.intel.com>
    media: ccs: Fix sub-device function

Hannes Reinecke <hare@suse.de>
    nvme: retrigger ANA log update if group descriptor isn't found

Ricardo Rivera-Matos <r-rivera-matos@ti.com>
    power: supply: bq25980: Move props from battery node

Adam Ford <aford173@gmail.com>
    clk: imx: Fix reparenting of UARTs not associated with stdout

Sagi Grimberg <sagi@grimberg.me>
    nvmet-tcp: fix incorrect locking in state_change sk callback

Sagi Grimberg <sagi@grimberg.me>
    nvme-tcp: block BH in sk state_change sk callback

Dafna Hirschfeld <dafna.hirschfeld@collabora.com>
    drm/mediatek: Don't support hdmi connector creation

Dafna Hirschfeld <dafna.hirschfeld@collabora.com>
    drm/mediatek: Switch the hdmi bridge ops to the atomic versions

Kenta.Tada@sony.com <Kenta.Tada@sony.com>
    seccomp: Fix CONFIG tests for Seccomp_filters

Sergey Shtylyov <s.shtylyov@omprussia.ru>
    ata: libahci_platform: fix IRQ check

Sergey Shtylyov <s.shtylyov@omprussia.ru>
    sata_mv: add IRQ checks

Sergey Shtylyov <s.shtylyov@omprussia.ru>
    pata_ipx4xx_cf: fix IRQ check

Sergey Shtylyov <s.shtylyov@omprussia.ru>
    pata_arasan_cf: fix IRQ check

Ilya Leoshkevich <iii@linux.ibm.com>
    selftests: fix prepending $(OUTPUT) to $(TEST_PROGS)

Yang Li <yang.lee@linux.alibaba.com>
    drm/omap: dsi: Add missing IRQF_ONESHOT

Masami Hiramatsu <mhiramat@kernel.org>
    x86/kprobes: Fix to check non boostable prefixes correctly

Bart Van Assche <bvanassche@acm.org>
    scsi: qla2xxx: Check kzalloc() return value

kernel test robot <lkp@intel.com>
    of: overlay: fix for_each_child.cocci warnings

Victor Lu <victorchengchi.lu@amd.com>
    drm/amd/display: Free local data after use

Felix Kuehling <Felix.Kuehling@amd.com>
    drm/amdkfd: Fix recursive lock warnings

Felix Kuehling <Felix.Kuehling@amd.com>
    drm/amdkfd: fix build error with AMD_IOMMU_V2=m

Masami Hiramatsu <mhiramat@kernel.org>
    x86/kprobes: Retrieve correct opcode for group instruction

Dan Carpenter <dan.carpenter@oracle.com>
    media: atomisp: Fix use after free in atomisp_alloc_css_stat_bufs()

Colin Ian King <colin.king@canonical.com>
    media: m88rs6000t: avoid potential out-of-bounds reads on arrays

Souptick Joarder <jrdr.linux@gmail.com>
    media: atomisp: Fixed error handling path

Colin Ian King <colin.king@canonical.com>
    media: [next] staging: media: atomisp: fix memory leak of object flash

Liu Ying <victor.liu@nxp.com>
    media: docs: Fix data organization of MEDIA_BUS_FMT_RGB101010_1X30

Wei Yongjun <weiyongjun1@huawei.com>
    media: m88ds3103: fix return value check in m88ds3103_probe()

Jia-Ju Bai <baijiaju1990@gmail.com>
    media: platform: sunxi: sun6i-csi: fix error return code of sun6i_video_start_streaming()

Christophe JAILLET <christophe.jaillet@wanadoo.fr>
    media: venus: core: Fix some resource leaks in the error path of 'venus_probe()'

Noralf Trønnes <noralf@tronnes.org>
    drm/probe-helper: Check epoch counter in output_poll_execute()

Matthias Schiffer <matthias.schiffer@ew.tq-group.com>
    power: supply: bq27xxx: fix sign of current_now for newer ICs

Douglas Anderson <dianders@chromium.org>
    drm/panel-simple: Undo enable if HPD never asserts

Jae Hyun Yoo <jae.hyun.yoo@linux.intel.com>
    media: aspeed: fix clock handling logic

Dafna Hirschfeld <dafna.hirschfeld@collabora.com>
    media: rkisp1: rsz: crash fix when setting src format

Yang Yingliang <yangyingliang@huawei.com>
    media: omap4iss: return error code when omap4iss_get() failed

Tasos Sahanidis <tasos@tasossah.com>
    media: saa7146: use sg_dma_len when building pgtable

Tasos Sahanidis <tasos@tasossah.com>
    media: saa7134: use sg_dma_len when building pgtable

Colin Ian King <colin.king@canonical.com>
    media: vivid: fix assignment of dev->fbuf_out_flags

Arnd Bergmann <arnd@arndb.de>
    media: mtk: fix mtk-smi dependency

Zhouyi Zhou <zhouzhouyi@gmail.com>
    rcu: Remove spurious instrumentation_end() in rcu_nmi_enter()

David Howells <dhowells@redhat.com>
    afs: Fix updating of i_mode due to 3rd party change

John Ogness <john.ogness@linutronix.de>
    printk: limit second loop of syslog_print_all

Valentin Schneider <valentin.schneider@arm.com>
    sched/fair: Fix shift-out-of-bounds in load_balance()

James Smart <jsmart2021@gmail.com>
    scsi: lpfc: Fix null pointer dereference in lpfc_prep_els_iocb()

Linus Walleij <linus.walleij@linaro.org>
    drm/mcde/panel: Inverse misunderstood flag

Dan Carpenter <dan.carpenter@oracle.com>
    drm/amd/display: Fix off by one in hdmi_14_process_transaction()

Marek Vasut <marex@denx.de>
    drm/stm: Fix bus_flags handling

Quanyang Wang <quanyang.wang@windriver.com>
    drm/tilcdc: send vblank event when disabling crtc

Dan Carpenter <dan.carpenter@oracle.com>
    soc: aspeed: fix a ternary sign expansion bug

Paul Durrant <pdurrant@amazon.com>
    xen-blkback: fix compatibility bug with single page rings

Quanyang Wang <quanyang.wang@windriver.com>
    spi: tools: make a symbolic link to the header file spi.h

Dario Binacchi <dariobin@libero.it>
    serial: omap: fix rs485 half-duplex filtering

Dario Binacchi <dariobin@libero.it>
    serial: omap: don't disable rs485 if rts gpio is missing

Tetsuo Handa <penguin-kernel@i-love.sakura.ne.jp>
    ttyprintk: Add TTY hangup callback.

Artur Petrosyan <Arthur.Petrosyan@synopsys.com>
    usb: dwc2: Fix hibernation between host and device modes.

Artur Petrosyan <Arthur.Petrosyan@synopsys.com>
    usb: dwc2: Fix host mode hibernation exit with remote wakeup flow.

Chris von Recklinghausen <crecklin@redhat.com>
    PM: hibernate: x86: Use crc32 instead of md5 for hibernation e820 integrity check

Michael Kelley <mikelley@microsoft.com>
    Drivers: hv: vmbus: Increase wait time for VMbus unload

Dan Carpenter <dan.carpenter@oracle.com>
    platform/surface: aggregator: fix a bit test

Paul Fertser <fercerpav@gmail.com>
    hwmon: (pmbus/pxe1610) don't bail out when not all pages are active

Ingo Molnar <mingo@kernel.org>
    x86/platform/uv: Fix !KEXEC build failure

Arnd Bergmann <arnd@arndb.de>
    btrfs: zoned: bail out in btrfs_alloc_chunk for bad input

Naohiro Aota <naohiro.aota@wdc.com>
    btrfs: zoned: move log tree node allocation out of log_root_tree->log_mutex

Quanyang Wang <quanyang.wang@windriver.com>
    spi: spi-zynqmp-gqspi: return -ENOMEM if dma_map_single fails

Quanyang Wang <quanyang.wang@windriver.com>
    spi: spi-zynqmp-gqspi: fix use-after-free in zynqmp_qspi_exec_op

Quanyang Wang <quanyang.wang@windriver.com>
    spi: spi-zynqmp-gqspi: fix hang issue when suspend/resume

Quanyang Wang <quanyang.wang@windriver.com>
    spi: spi-zynqmp-gqspi: fix clk_enable/disable imbalance issue

Ard Biesheuvel <ardb@kernel.org>
    crypto: arm64/aes-ce - deal with oversight in new CTR carry code

Dan Carpenter <dan.carpenter@oracle.com>
    Drivers: hv: vmbus: Use after free in __vmbus_open()

Eddie James <eajames@linux.ibm.com>
    ARM: dts: aspeed: Rainier: Fix humidity sensor bus address

Dinghao Liu <dinghao.liu@zju.edu.cn>
    spi: spi-zynqmp-gqspi: Fix runtime PM imbalance in zynqmp_qspi_probe

Badhri Jagan Sridharan <badhri@google.com>
    usb: typec: tcpm: Honour pSnkStdby requirement during negotiation

Steffen Dirkwinkel <s.dirkwinkel@beckhoff.com>
    platform/x86: pmc_atom: Match all Beckhoff Automation baytrail boards with critclk_systems DMI table

Zhihao Cheng <chengzhihao1@huawei.com>
    char: tpm: fix error return code in tpm_cr50_i2c_tis_recv()

James Bottomley <James.Bottomley@HansenPartnership.com>
    security: keys: trusted: fix TPM2 authorizations

Krzysztof Kozlowski <krzysztof.kozlowski@canonical.com>
    memory: samsung: exynos5422-dmc: handle clk_set_parent() failure

Krzysztof Kozlowski <krzysztof.kozlowski@canonical.com>
    memory: renesas-rpc-if: fix possible NULL pointer dereference of resource

Wei Yongjun <weiyongjun1@huawei.com>
    spi: spi-zynqmp-gqspi: Fix missing unlock on error in zynqmp_qspi_exec_op()

Pawel Laszczak <pawell@cadence.com>
    usb: cdnsp: Fixes issue with Configure Endpoint command

Liam Howlett <liam.howlett@oracle.com>
    m68k: Add missing mmap_read_lock() to sys_cacheflush()

Ye Bin <yebin10@huawei.com>
    usbip: vudc: fix missing unlock on error in usbip_sockfd_store()

Ayush Sawal <ayush.sawal@chelsio.com>
    crypto: chelsio - Read rxchannel-id from firmware

Dan Carpenter <dan.carpenter@oracle.com>
    node: fix device cleanups in error handling code

He Ying <heying24@huawei.com>
    firmware: qcom-scm: Fix QCOM_SCM configuration

Johan Hovold <johan@kernel.org>
    serial: core: return early on unsupported ioctls

Johan Hovold <johan@kernel.org>
    tty: fix return value for unsupported termiox ioctls

Johan Hovold <johan@kernel.org>
    tty: fix return value for unsupported ioctls

Johan Hovold <johan@kernel.org>
    tty: actually undefine superseded ASYNC flags

Johan Hovold <johan@kernel.org>
    USB: cdc-acm: fix TIOCGSERIAL implementation

Johan Hovold <johan@kernel.org>
    USB: cdc-acm: fix unprivileged TIOCCSERIAL

Colin Ian King <colin.king@canonical.com>
    usb: gadget: r8a66597: Add missing null check on return from platform_get_resource

Wang Li <wangli74@huawei.com>
    spi: fsl-lpspi: Fix PM reference leak in lpspi_prepare_xfer_hardware()

Quanyang Wang <quanyang.wang@windriver.com>
    spi: spi-zynqmp-gqspi: fix incorrect operating mode in zynqmp_qspi_read_op

Quanyang Wang <quanyang.wang@windriver.com>
    spi: spi-zynqmp-gqspi: transmit dummy circles by using the controller's internal functionality

Quanyang Wang <quanyang.wang@windriver.com>
    spi: spi-zynqmp-gqspi: add mutex locking for exec_op

Quanyang Wang <quanyang.wang@windriver.com>
    spi: spi-zynqmp-gqspi: use wait_for_completion_timeout to make zynqmp_qspi_exec_op not interruptible

Pali Rohár <pali@kernel.org>
    cpufreq: armada-37xx: Fix determining base CPU frequency

Pali Rohár <pali@kernel.org>
    cpufreq: armada-37xx: Fix driver cleanup when registration failed

Pali Rohár <pali@kernel.org>
    clk: mvebu: armada-37xx-periph: Fix workaround for switching from L1 to L0

Pali Rohár <pali@kernel.org>
    clk: mvebu: armada-37xx-periph: Fix switching CPU freq from 250 Mhz to 1 GHz

Pali Rohár <pali@kernel.org>
    cpufreq: armada-37xx: Fix the AVS value for load L1

Marek Behún <kabel@kernel.org>
    clk: mvebu: armada-37xx-periph: remove .set_parent method for CPU PM clock

Marek Behún <kabel@kernel.org>
    cpufreq: armada-37xx: Fix setting TBG parent for load levels

Lv Yunlong <lyl2019@mail.ustc.edu.cn>
    crypto: qat - Fix a double free in adf_create_ring

Colin Ian King <colin.king@canonical.com>
    crypto: sa2ul - Fix memory leak of rxd

Colin Ian King <colin.king@canonical.com>
    crypto: sun8i-ss - Fix memory leak of pad

Corentin Labbe <clabbe.montjoie@gmail.com>
    crypto: allwinner - add missing CRYPTO_ prefix

Nathan Chancellor <nathan@kernel.org>
    ACPI: CPPC: Replace cppc_attr with kobj_attribute

He Ying <heying24@huawei.com>
    cpuidle: Fix ARM_QCOM_SPM_CPUIDLE configuration

YueHaibing <yuehaibing@huawei.com>
    PM: runtime: Replace inline function pm_runtime_callbacks_present()

Bjorn Andersson <bjorn.andersson@linaro.org>
    soc: qcom: mdt_loader: Detect truncated read of segments

Bjorn Andersson <bjorn.andersson@linaro.org>
    soc: qcom: mdt_loader: Validate that p_filesz < p_memsz

Yang Yingliang <yangyingliang@huawei.com>
    spi: fsl: add missing iounmap() on error in of_fsl_spi_probe()

William A. Kennington III <wak@google.com>
    spi: Fix use-after-free with devm_spi_alloc_*

Wei Yongjun <weiyongjun1@huawei.com>
    clocksource/drivers/ingenic_ost: Fix return value check in ingenic_ost_probe()

Tony Lindgren <tony@atomide.com>
    clocksource/drivers/timer-ti-dm: Add missing set_state_oneshot_stopped

Tony Lindgren <tony@atomide.com>
    clocksource/drivers/timer-ti-dm: Fix posted mode status check order

Dong Aisheng <aisheng.dong@nxp.com>
    PM / devfreq: Use more accurate returned new_freq as resume_freq

Qinglang Miao <miaoqinglang@huawei.com>
    soc: qcom: pdr: Fix error return code in pdr_register_listener

Hans de Goede <hdegoede@redhat.com>
    platform/x86: dell-wmi-sysman: Make init_bios_attributes() ACPI object parsing more robust

Johan Hovold <johan@kernel.org>
    staging: greybus: uart: fix unprivileged TIOCCSERIAL

Johan Hovold <johan@kernel.org>
    staging: fwserial: fix TIOCGSERIAL implementation

Johan Hovold <johan@kernel.org>
    staging: fwserial: fix TIOCSSERIAL implementation

Colin Ian King <colin.king@canonical.com>
    staging: rtl8192u: Fix potential infinite loop

Ian Abbott <abbotti@mev.co.uk>
    staging: comedi: tests: ni_routes_test: Fix compilation error

Arnd Bergmann <arnd@arndb.de>
    irqchip/gic-v3: Fix OF_BAD_ADDR error handling

Lv Yunlong <lyl2019@mail.ustc.edu.cn>
    mtd: rawnand: gpmi: Fix a double free in gpmi_nand_init

Alexandru Ardelean <aardelean@deviqon.com>
    iio: adc: Kconfig: make AD9467 depend on ADI_AXI_ADC symbol

Stephen Boyd <swboyd@chromium.org>
    firmware: qcom_scm: Workaround lack of "is available" call on SC7180

Stephen Boyd <swboyd@chromium.org>
    firmware: qcom_scm: Reduce locking section for __get_convention()

Stephen Boyd <swboyd@chromium.org>
    firmware: qcom_scm: Make __qcom_scm_is_call_available() return bool

Finn Thain <fthain@telegraphics.com.au>
    m68k: mvme147,mvme16x: Don't wipe PCC timer config bits

Rander Wang <rander.wang@intel.com>
    soundwire: stream: fix memory leak in stream config error path

gexueyuan <gexueyuan@gmail.com>
    memory: pl353: fix mask of ECC page_size config register

Krzysztof Kozlowski <krzk@kernel.org>
    ARM: dts: qcom: msm8974-samsung-klte: correct fuel gauge interrupt trigger level

Krzysztof Kozlowski <krzk@kernel.org>
    ARM: dts: qcom: msm8974-lge-nexus5: correct fuel gauge interrupt trigger level

Andy Shevchenko <andriy.shevchenko@linux.intel.com>
    driver core: platform: Declare early_platform_cleanup() prototype

Srinivas Kandagatla <srinivas.kandagatla@linaro.org>
    nvmem: rmem: fix undefined reference to memremap

Ravi Kumar Bokka <rbokka@codeaurora.org>
    drivers: nvmem: Fix voltage settings for QTI qfprom-efuse

Yang Yingliang <yangyingliang@huawei.com>
    USB: gadget: udc: fix wrong pointer passed to IS_ERR() and PTR_ERR()

Tao Ren <rentao.bupt@gmail.com>
    usb: gadget: aspeed: fix dma map failure

Giovanni Cabiddu <giovanni.cabiddu@intel.com>
    crypto: qat - fix error path in adf_isr_resource_alloc()

Arnd Bergmann <arnd@arndb.de>
    crypto: poly1305 - fix poly1305_core_setkey() declaration

Olga Kornievskaia <kolga@netapp.com>
    NFSv4.2: fix copy stateid copying for the async copy

Fabien Parent <fparent@baylibre.com>
    arm64: dts: mediatek: fix reset GPIO level on pumpkin

Wei Yongjun <weiyongjun1@huawei.com>
    phy: ingenic: Fix a typo in ingenic_usb_phy_probe()

Wei Yongjun <weiyongjun1@huawei.com>
    phy: ralink: phy-mt7621-pci: fix return value check in mt7621_pci_phy_probe()

Geert Uytterhoeven <geert+renesas@glider.be>
    phy: marvell: ARMADA375_USBCLUSTER_PHY should not default to y, unconditionally

Sergio Paracuellos <sergio.paracuellos@gmail.com>
    phy: ralink: phy-mt7621-pci: fix XTAL bitmask

Kishon Vijay Abraham I <kishon@ti.com>
    phy: ti: j721e-wiz: Delete "clk_div_sel" clk provider during cleanup

Enric Balletbo i Serra <enric.balletbo@collabora.com>
    soc: mediatek: pm-domains: Fix missing error code in scpsys_add_subdomain()

Srinivas Kandagatla <srinivas.kandagatla@linaro.org>
    soundwire: bus: Fix device found flag correctly

Jonathan Marek <jonathan@marek.ca>
    arm64: dts: qcom: sm8250: fix display nodes

Pan Bian <bianpan2016@163.com>
    bus: qcom: Put child node before return

Chunfeng Yun <chunfeng.yun@mediatek.com>
    arm64: dts: mt8173: fix wrong power-domain phandle of pmic

Hsin-Yi Wang <hsinyi@chromium.org>
    arm64: dts: mt8183: Add gce client reg for display subcomponents

Yoshihiro Shimoda <yoshihiro.shimoda.uh@renesas.com>
    arm64: dts: renesas: r8a779a0: Fix PMU interrupt

Michael Walle <michael@walle.cc>
    mtd: require write permissions for locking and badblock ioctls

dillon min <dillon.minfei@gmail.com>
    dt-bindings: serial: stm32: Use 'type: object' instead of false for 'additionalProperties'

Christophe JAILLET <christophe.jaillet@wanadoo.fr>
    usb: gadget: s3c: Fix the error handling path in 's3c2410_udc_probe()'

Christophe JAILLET <christophe.jaillet@wanadoo.fr>
    usb: gadget: s3c: Fix incorrect resources releasing

Fabian Vogt <fabian@ritter-vogt.de>
    fotg210-udc: Complete OUT requests on short packets

Fabian Vogt <fabian@ritter-vogt.de>
    fotg210-udc: Don't DMA more than the buffer can take

Fabian Vogt <fabian@ritter-vogt.de>
    fotg210-udc: Mask GRP2 interrupts we don't handle

Fabian Vogt <fabian@ritter-vogt.de>
    fotg210-udc: Remove a dubious condition leading to fotg210_done

Fabian Vogt <fabian@ritter-vogt.de>
    fotg210-udc: Fix EP0 IN requests bigger than two packets

Fabian Vogt <fabian@ritter-vogt.de>
    fotg210-udc: Fix DMA on EP0 for length > max packet size

Tong Zhang <ztong0001@gmail.com>
    crypto: qat - ADF_STATUS_PF_RUNNING should be set after adf_dev_init

Tong Zhang <ztong0001@gmail.com>
    crypto: qat - don't release uninitialized resources

Rijo Thomas <Rijo-john.Thomas@amd.com>
    crypto: ccp - fix command queuing to TEE ring buffer

Andy Shevchenko <andriy.shevchenko@linux.intel.com>
    usb: gadget: pch_udc: Provide a GPIO line used on Intel Minnowboard (v1)

Andy Shevchenko <andriy.shevchenko@linux.intel.com>
    usb: gadget: pch_udc: Initialize device pointer before use

Andy Shevchenko <andriy.shevchenko@linux.intel.com>
    usb: gadget: pch_udc: Check for DMA mapping error

Andy Shevchenko <andriy.shevchenko@linux.intel.com>
    usb: gadget: pch_udc: Check if driver is present before calling ->setup()

Andy Shevchenko <andriy.shevchenko@linux.intel.com>
    usb: gadget: pch_udc: Replace cpu_to_le32() by lower_32_bits()

Rasmus Villemoes <linux@rasmusvillemoes.dk>
    devtmpfs: fix placement of complete() call

Dmitry Osipenko <digetx@gmail.com>
    usb: host: ehci-tegra: Select USB_GADGET Kconfig option

Otavio Pontes <otavio.pontes@intel.com>
    x86/microcode: Check for offline CPUs before requesting new microcode

Dan Carpenter <dan.carpenter@oracle.com>
    staging: qlge: fix an error code in probe()

Andrea Parri (Microsoft) <parri.andrea@gmail.com>
    Drivers: hv: vmbus: Drop error message when 'No request id available'

Alain Volmat <alain.volmat@foss.st.com>
    spi: stm32: Fix use-after-free on unbind

Eric Biggers <ebiggers@google.com>
    crypto: arm/blake2s - fix for big endian

Andy Lutomirski <luto@kernel.org>
    selftests/x86: Add a missing .note.GNU-stack section to thunks_32.S

Vladimir Barinov <vladimir.barinov@cogentembedded.com>
    arm64: dts: renesas: r8a77980: Fix vin4-7 endpoint binding

Dan Carpenter <dan.carpenter@oracle.com>
    regulator: bd9576: Fix return from bd957x_probe()

Rafał Miłecki <rafal@milecki.pl>
    arm64: dts: broadcom: bcm4908: set Asus GT-AC5300 port 7 PHY mode

Antonio Borneo <antonio.borneo@foss.st.com>
    spi: stm32: drop devres version of spi_register_master

Colin Ian King <colin.king@canonical.com>
    crypto: sun8i-ss - Fix memory leak of object d when dma_iv fails to map

Srinivas Kandagatla <srinivas.kandagatla@linaro.org>
    arm64: dts: qcom: db845c: fix correct powerdown pin for WSA881x

Shawn Guo <shawn.guo@linaro.org>
    arm64: dts: qcom: sm8350: fix number of pins in 'gpio-ranges'

Shawn Guo <shawn.guo@linaro.org>
    arm64: dts: qcom: sm8250: fix number of pins in 'gpio-ranges'

Shawn Guo <shawn.guo@linaro.org>
    arm64: dts: qcom: sm8150: fix number of pins in 'gpio-ranges'

Shawn Guo <shawn.guo@linaro.org>
    arm64: dts: qcom: sdm845: fix number of pins in 'gpio-ranges'

Douglas Anderson <dianders@chromium.org>
    arm64: dts: qcom: sc7180: Avoid glitching SPI CS at bootup on trogdor

Sai Prakash Ranjan <saiprakash.ranjan@codeaurora.org>
    arm64: dts: qcom: sm8250: Fix timer interrupt to specify EL2 physical timer

Sai Prakash Ranjan <saiprakash.ranjan@codeaurora.org>
    arm64: dts: qcom: sm8350: Fix level triggered PMU interrupt polarity

Sai Prakash Ranjan <saiprakash.ranjan@codeaurora.org>
    arm64: dts: qcom: sm8250: Fix level triggered PMU interrupt polarity

Matthias Kaehlcke <mka@chromium.org>
    arm64: dts: qcom: sc7180: trogdor: Fix trip point config of charger thermal zone

Nuno Sa <nuno.sa@analog.com>
    iio: adis16480: fix pps mode sampling frequency math

Aswath Govindraju <a-govindraju@ti.com>
    arm64: dts: ti: k3-j721e-main: Update the speed modes supported and their itap delay values for MMCSD subsystems

Valentin CARON - foss <valentin.caron@foss.st.com>
    ARM: dts: stm32: fix usart 2 & 3 pinconf to wake up with flow control

Jia-Ju Bai <baijiaju1990@gmail.com>
    mtd: maps: fix error return code of physmap_flash_remove()

Baruch Siach <baruch@tkos.co.il>
    mtd: parsers: qcom: incompatible with spi-nor 4k sectors

Miquel Raynal <miquel.raynal@bootlin.com>
    mtd: parsers: qcom: Fix error condition

David Bauer <mail@david-bauer.net>
    mtd: don't lock when recursively deleting partitions

Manivannan Sadhasivam <mani@kernel.org>
    mtd: rawnand: qcom: Return actual error code instead of -ENODEV

Manivannan Sadhasivam <mani@kernel.org>
    mtd: Handle possible -EPROBE_DEFER from parse_mtd_partitions()

Álvaro Fernández Rojas <noltari@gmail.com>
    mtd: rawnand: brcmnand: fix OOB R/W with Hamming ECC

Dan Carpenter <dan.carpenter@oracle.com>
    mtd: rawnand: fsmc: Fix error code in fsmc_nand_probe()

Rafał Miłecki <rafal@milecki.pl>
    arm64: dts: broadcom: bcm4908: fix switch parent node name

Arnd Bergmann <arnd@arndb.de>
    spi: rockchip: avoid objtool warning

Meng Li <Meng.Li@windriver.com>
    regmap: set debugfs_name to NULL after it is freed

David E. Box <david.e.box@linux.intel.com>
    mfd: intel_pmt: Fix nuisance messages and handling of disabled capabilities

Wei Yongjun <weiyongjun1@huawei.com>
    usb: typec: stusb160x: fix return value check in stusb160x_probe()

Wei Yongjun <weiyongjun1@huawei.com>
    usb: typec: tps6598x: Fix return value check in tps6598x_probe()

Badhri Jagan Sridharan <badhri@google.com>
    usb: typec: tcpci: Check ROLE_CONTROL while interpreting CC_STATUS

Badhri Jagan Sridharan <badhri@google.com>
    usb: typec: tcpm: Wait for vbus discharge to VSAFE0V before toggling

Erwan Le Ray <erwan.leray@foss.st.com>
    serial: stm32: fix tx_empty condition

Erwan Le Ray <erwan.leray@foss.st.com>
    serial: stm32: add FIFO flush when port is closed

Erwan Le Ray <erwan.leray@foss.st.com>
    serial: stm32: fix FIFO flush in startup and set_termios

Erwan Le Ray <erwan.leray@foss.st.com>
    serial: stm32: call stm32_transmit_chars locked

Erwan Le Ray <erwan.leray@foss.st.com>
    serial: stm32: fix tx dma completion, release channel

Wei Yongjun <weiyongjun1@huawei.com>
    serial: liteuart: fix return value check in liteuart_probe()

Erwan Le Ray <erwan.leray@foss.st.com>
    serial: stm32: fix a deadlock in set_termios

Erwan Le Ray <erwan.leray@foss.st.com>
    serial: stm32: fix wake-up flag handling

Erwan Le Ray <erwan.leray@foss.st.com>
    serial: stm32: fix a deadlock condition with wakeup event

Erwan Le Ray <erwan.leray@foss.st.com>
    serial: stm32: fix TX and RX FIFO thresholds

Erwan Le Ray <erwan.leray@foss.st.com>
    serial: stm32: fix incorrect characters on console

Erwan Le Ray <erwan.leray@foss.st.com>
    serial: stm32: fix startup by enabling usart for reception

Erwan Le Ray <erwan.leray@foss.st.com>
    serial: stm32: fix probe and remove order for dma

Mike Travis <mike.travis@hpe.com>
    x86/platform/uv: Set section block size for hubless architectures

Tony Lindgren <tony@atomide.com>
    bus: ti-sysc: Fix initializing module_pa for modules without sysc register

Yoshihiro Shimoda <yoshihiro.shimoda.uh@renesas.com>
    arm64: dts: renesas: Add mmc aliases into board dts files

Yoshihiro Shimoda <yoshihiro.shimoda.uh@renesas.com>
    ARM: dts: renesas: Add mmc aliases into R-Car Gen2 board dts files

Krzysztof Kozlowski <krzk@kernel.org>
    ARM: dts: s5pv210: correct fuel gauge interrupt trigger level on Fascinate family

Krzysztof Kozlowski <krzk@kernel.org>
    ARM: dts: exynos: correct PMIC interrupt trigger level on Snow

Krzysztof Kozlowski <krzk@kernel.org>
    ARM: dts: exynos: correct PMIC interrupt trigger level on SMDK5250

Krzysztof Kozlowski <krzk@kernel.org>
    ARM: dts: exynos: correct PMIC interrupt trigger level on P4 Note family

Krzysztof Kozlowski <krzk@kernel.org>
    ARM: dts: exynos: correct PMIC interrupt trigger level on Odroid X/U3 family

Krzysztof Kozlowski <krzk@kernel.org>
    ARM: dts: exynos: correct PMIC interrupt trigger level on Midas family

Krzysztof Kozlowski <krzk@kernel.org>
    ARM: dts: exynos: correct MUIC interrupt trigger level on Midas family

Krzysztof Kozlowski <krzk@kernel.org>
    ARM: dts: exynos: correct fuel gauge interrupt trigger level on Midas family

Krzysztof Kozlowski <krzk@kernel.org>
    ARM: dts: exynos: correct fuel gauge interrupt trigger level on P4 Note family

Krzysztof Kozlowski <krzk@kernel.org>
    ARM: dts: exynos: correct fuel gauge interrupt trigger level on GT-I9100

Colin Ian King <colin.king@canonical.com>
    memory: gpmc: fix out of bounds read and dereference on gpmc_cs[]

Corentin Labbe <clabbe.montjoie@gmail.com>
    crypto: sun8i-ss - fix result memory leak on error path

Wei Yongjun <weiyongjun1@huawei.com>
    crypto: keembay-ocs-aes - Fix error return code in kmb_ocs_aes_probe()

Wei Yongjun <weiyongjun1@huawei.com>
    crypto: keembay-ocs-hcu - Fix error return code in kmb_ocs_hcu_probe()

Luca Ceresoli <luca@lucaceresoli.net>
    fpga: fpga-mgr: xilinx-spi: fix error messages on -EPROBE_DEFER

Jiri Slaby <jirislaby@kernel.org>
    x86/vdso: Use proper modifier for len's format specifier in extract()

Nobuhiro Iwamatsu <iwamatsu@nigauri.org>
    firmware: xilinx: Remove zynqmp_pm_get_eemi_ops() in IS_REACHABLE(CONFIG_ZYNQMP_FIRMWARE)

Tejas Patel <tejas.patel@xilinx.com>
    firmware: xilinx: Fix dereferencing freed memory

Len Brown <len.brown@intel.com>
    Revert "tools/power turbostat: adjust for temperature offset"

Andy Shevchenko <andriy.shevchenko@linux.intel.com>
    usb: gadget: pch_udc: Revert d3cb25a12138 completely

Gerd Hoffmann <kraxel@redhat.com>
    Revert "drm/qxl: do not run release if qxl failed to init"

Dan Carpenter <dan.carpenter@oracle.com>
    ovl: fix missing revert_creds() on error path

Rikard Falkeborn <rikard.falkeborn@gmail.com>
    mfd: stmpe: Revert "Constify static struct resource"

Jae Hyun Yoo <jae.hyun.yoo@linux.intel.com>
    Revert "i3c master: fix missing destroy_workqueue() on error in i3c_master_register"

Xie He <xie.he.0141@gmail.com>
    Revert "drivers/net/wan/hdlc_fr: Fix a double free in pvc_xmit"

Paolo Bonzini <pbonzini@redhat.com>
    KVM: selftests: Always run vCPU thread with blocked SIG_IPI

Peter Xu <peterx@redhat.com>
    KVM: selftests: Sync data verify of dirty logging with guest sync

Eric Auger <eric.auger@redhat.com>
    KVM: arm64: Fix KVM_VGIC_V3_ADDR_TYPE_REDIST_REGION read

Marc Zyngier <maz@kernel.org>
    KVM: arm64: Fully zero the vcpu state on reset

David Brazdil <dbrazdil@google.com>
    KVM: arm64: Support PREL/PLT relocs in EL2 code

Sean Christopherson <seanjc@google.com>
    KVM: Stop looking for coalesced MMIO zones if the bus is destroyed

Sean Christopherson <seanjc@google.com>
    KVM: Destroy I/O bus devices on unregister failure _after_ sync'ing SRCU

Eric Auger <eric.auger@redhat.com>
    KVM: arm/arm64: Fix KVM_VGIC_V3_ADDR_TYPE_REDIST read

Sean Christopherson <seanjc@google.com>
    KVM: nVMX: Truncate base/index GPR value on address calc in !64-bit

Sean Christopherson <seanjc@google.com>
    KVM: nVMX: Truncate bits 63:32 of VMCS field on nested check in !64-bit

Sean Christopherson <seanjc@google.com>
    KVM: VMX: Truncate GPR value for DR and CR reads in !64-bit mode

Sean Christopherson <seanjc@google.com>
    KVM: nVMX: Defer the MMU reload to the normal path on an EPTP switch

Sean Christopherson <seanjc@google.com>
    KVM: SVM: Inject #GP on guest MSR_TSC_AUX accesses if RDTSCP unsupported

Sean Christopherson <seanjc@google.com>
    KVM: SVM: Do not allow SEV/SEV-ES initialization after vCPUs are created

Sean Christopherson <seanjc@google.com>
    KVM: SVM: Do not set sev->es_active until KVM_SEV_ES_INIT completes

Sean Christopherson <seanjc@google.com>
    KVM: SVM: Use online_vcpus, not created_vcpus, to iterate over vCPUs

Sean Christopherson <seanjc@google.com>
    KVM: SVM: Don't strip the C-bit from CR2 on #PF interception

Sean Christopherson <seanjc@google.com>
    KVM: nSVM: Set the shadow root level to the TDP level for nested NPT

Sean Christopherson <seanjc@google.com>
    KVM: x86: Remove emulator's broken checks on CR0/CR3/CR4 loads

Sean Christopherson <seanjc@google.com>
    KVM: x86: Check CR3 GPA for validity regardless of vCPU mode

Vitaly Kuznetsov <vkuznets@redhat.com>
    KVM: x86: Properly handle APF vs disabled LAPIC situation

Wanpeng Li <wanpengli@tencent.com>
    KVM: X86: Fix failure to boost kernel lock holder candidate in SEV-ES guests

Sean Christopherson <seanjc@google.com>
    KVM: x86/xen: Drop RAX[63:32] when processing hypercall

Sean Christopherson <seanjc@google.com>
    KVM: x86/mmu: Alloc page for PDPTEs when shadowing 32-bit NPT with 64-bit

Claudio Imbrenda <imbrenda@linux.ibm.com>
    KVM: s390: extend kvm_s390_shadow_fault to return entry pointer

Claudio Imbrenda <imbrenda@linux.ibm.com>
    KVM: s390: split kvm_s390_real_to_abs

Claudio Imbrenda <imbrenda@linux.ibm.com>
    KVM: s390: VSIE: fix MVPG handling for prefixing and MSO

David Hildenbrand <david@redhat.com>
    s390: fix detection of vector enhancements facility 1 vs. vector packed decimal facility

Heiko Carstens <hca@linux.ibm.com>
    KVM: s390: fix guarded storage control register handling

Claudio Imbrenda <imbrenda@linux.ibm.com>
    KVM: s390: split kvm_s390_logical_to_effective

Claudio Imbrenda <imbrenda@linux.ibm.com>
    KVM: s390: VSIE: correctly handle MVPG when in VSIE

Takashi Iwai <tiwai@suse.de>
    ALSA: hda/realtek: Fix speaker amp on HP Envy AiO 32

Sami Loone <sami@loone.fi>
    ALSA: hda/realtek: ALC285 Thinkpad jack pin quirk is unreachable

Takashi Iwai <tiwai@suse.de>
    ALSA: hda/realtek: Remove redundant entry for ALC861 Haier/Uniwill devices

Takashi Iwai <tiwai@suse.de>
    ALSA: hda/realtek: Re-order ALC662 quirk table entries

Takashi Iwai <tiwai@suse.de>
    ALSA: hda/realtek: Re-order remaining ALC269 quirk table entries

Takashi Iwai <tiwai@suse.de>
    ALSA: hda/realtek: Re-order ALC269 Lenovo quirk table entries

Takashi Iwai <tiwai@suse.de>
    ALSA: hda/realtek: Re-order ALC269 Sony quirk table entries

Takashi Iwai <tiwai@suse.de>
    ALSA: hda/realtek: Re-order ALC269 ASUS quirk table entries

Takashi Iwai <tiwai@suse.de>
    ALSA: hda/realtek: Re-order ALC269 Dell quirk table entries

Takashi Iwai <tiwai@suse.de>
    ALSA: hda/realtek: Re-order ALC269 Acer quirk table entries

Takashi Iwai <tiwai@suse.de>
    ALSA: hda/realtek: Re-order ALC269 HP quirk table entries

Takashi Iwai <tiwai@suse.de>
    ALSA: hda/realtek: Re-order ALC882 Clevo quirk table entries

Takashi Iwai <tiwai@suse.de>
    ALSA: hda/realtek: Re-order ALC882 Sony quirk table entries

Takashi Iwai <tiwai@suse.de>
    ALSA: hda/realtek: Re-order ALC882 Acer quirk table entries

Bas Nieuwenhuizen <bas@basnieuwenhuizen.nl>
    drm/amdgpu: Init GFX10_ADDR_CONFIG for VCN v3 in DPG mode.

Victor Zhao <Victor.Zhao@amd.com>
    drm/amdgpu: fix r initial values

Evan Quan <evan.quan@amd.com>
    drm/amdgpu: add new MC firmware for Polaris12 32bit ASIC

Christian König <christian.koenig@amd.com>
    drm/amdgpu: fix concurrent VM flushes on Vega/Navi v2

Harry Wentland <harry.wentland@amd.com>
    drm/amd/display: Reject non-zero src_y and src_x for video planes

Paul Cercueil <paul@crapouillou.net>
    drm: bridge/panel: Cleanup connector on bridge detach

Randy Dunlap <rdunlap@infradead.org>
    drm: bridge: fix ANX7625 use of mipi_dsi_() functions

Wayne Lin <Wayne.Lin@amd.com>
    drm/dp_mst: Set CLEAR_PAYLOAD_ID_TABLE as broadcast

Wayne Lin <Wayne.Lin@amd.com>
    drm/dp_mst: Revise broadcast msg lct & lcr

Colin Ian King <colin.king@canonical.com>
    drm/radeon: fix copy of uninitialized variable back to userspace

Boris Brezillon <boris.brezillon@collabora.com>
    drm/panfrost: Don't try to map pages that are already mapped

Boris Brezillon <boris.brezillon@collabora.com>
    drm/panfrost: Clear MMU irqs before handling the fault

Paul Cercueil <paul@crapouillou.net>
    drm/ingenic: Fix non-OSD mode

Gerd Hoffmann <kraxel@redhat.com>
    drm/qxl: use ttm bo priorities

Maciej W. Rozycki <macro@orcam.me.uk>
    FDDI: defxx: Make MMIO the configuration default except for EISA

Felix Fietkau <nbd@nbd.name>
    mt76: fix potential DMA mapping leak

Ping-Ke Shih <pkshih@realtek.com>
    rtw88: Fix array overrun in rtw_get_tx_power_params()

Johannes Berg <johannes.berg@intel.com>
    cfg80211: scan: drop entry from hidden_list on overflow

Randy Dunlap <rdunlap@infradead.org>
    net: xilinx: drivers need/depend on HAS_IOMEM

Dan Carpenter <dan.carpenter@oracle.com>
    ipw2x00: potential buffer overflow in libipw_wx_set_encodeext()

Ryder Lee <ryder.lee@mediatek.com>
    mt76: mt7615: use ieee80211_free_txskb() in mt7615_tx_token_put()

Nathan Chancellor <nathan@kernel.org>
    MIPS: generic: Update node names to avoid unit addresses

Maciej W. Rozycki <macro@orcam.me.uk>
    MIPS: Reinstate platform `__div64_32' handler

Jan Glauber <jglauber@digitalocean.com>
    md: Fix missing unused status line of /proc/mdstat

Zhao Heming <heming.zhao@suse.com>
    md: md_open returns -EBUSY when entering racing area

Christoph Hellwig <hch@lst.de>
    md: factor out a mddev_find_locked helper from mddev_find

Christoph Hellwig <hch@lst.de>
    md: split mddev_find

Heming Zhao <heming.zhao@suse.com>
    md-cluster: fix use-after-free issue when removing rdev

Sudhakar Panneerselvam <sudhakar.panneerselvam@oracle.com>
    md/bitmap: wait for external bitmap writes to complete during tear down

Xiao Ni <xni@redhat.com>
    async_xor: increase src_offs when dropping destination page

Alison Schofield <alison.schofield@intel.com>
    x86, sched: Treat Intel SNC topology as default, COD as exception

Paul Moore <paul@paul-moore.com>
    selinux: add proper NULL termination to the secclass_map permissions

Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>
    misc: vmw_vmci: explicitly initialize vmci_datagram payload

Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>
    misc: vmw_vmci: explicitly initialize vmci_notify_bm_set_msg struct

Kishon Vijay Abraham I <kishon@ti.com>
    phy: ti: j721e-wiz: Invoke wiz_init() before of_platform_device_create()

Hans de Goede <hdegoede@redhat.com>
    misc: lis3lv02d: Fix false-positive WARN on various HP models

Kishon Vijay Abraham I <kishon@ti.com>
    phy: cadence: Sierra: Fix PHY power_on sequence

Annaliese McDermond <nh6z@nh6z.net>
    sc16is7xx: Defer probe if device read fails

Ye Xiang <xiang.ye@intel.com>
    iio: hid-sensor-rotation: Fix quaternion data not correct

Gwendal Grignou <gwendal@chromium.org>
    iio: sx9310: Fix access to variable DT array

Linus Walleij <linus.walleij@linaro.org>
    iio: magnetometer: yas530: Fix return value on error path

Jonathan Cameron <Jonathan.Cameron@huawei.com>
    iio:adc:ad7476: Fix remove handling

Jonathan Cameron <Jonathan.Cameron@huawei.com>
    iio:accel:adis16201: Fix wrong axis assignment that prevents loading

Gwendal Grignou <gwendal@chromium.org>
    iio: sx9310: Fix write_.._debounce()

Linus Walleij <linus.walleij@linaro.org>
    iio: magnetometer: yas530: Include right header

Lars-Peter Clausen <lars@metafoo.de>
    iio: inv_mpu6050: Fully validate gyro and accel scale writes

Dmitry Osipenko <digetx@gmail.com>
    soc/tegra: regulators: Fix locking up when voltage-spread is out of range

Lukasz Luba <lukasz.luba@arm.com>
    PM / devfreq: Unlock mutex and free devfreq struct in error path

Kishon Vijay Abraham I <kishon@ti.com>
    PCI: keystone: Let AM65 use the pci_ops defined in pcie-designware-host.c

Dejin Zheng <zhengdejin5@gmail.com>
    PCI: xgene: Fix cfg resource mapping

Sean Christopherson <seanjc@google.com>
    KVM: x86: Defer the MMU unload to the normal path on an global INVPCID

Arun Easi <aeasi@marvell.com>
    PCI: Allow VPD access for QLogic ISP2722

Maciej W. Rozycki <macro@orcam.me.uk>
    FDDI: defxx: Bail out gracefully with unassigned PCI resource for CSR

Ilya Lipnitskiy <ilya.lipnitskiy@gmail.com>
    MIPS: pci-rt2880: fix slot 0 configuration

Ilya Lipnitskiy <ilya.lipnitskiy@gmail.com>
    MIPS: pci-mt7620: fix PLL lock check

Annaliese McDermond <nh6z@nh6z.net>
    ASoC: tlv320aic32x4: Increase maximum register in regmap

Annaliese McDermond <nh6z@nh6z.net>
    ASoC: tlv320aic32x4: Register clocks before registering component

Lukasz Majczak <lma@semihalf.com>
    ASoC: Intel: kbl_da7219_max98927: Fix kabylake_ssp_fixup function

Pierre-Louis Bossart <pierre-louis.bossart@linux.intel.com>
    ASoC: samsung: tm2_wm5110: check of of_parse return value

Chunfeng Yun <chunfeng.yun@mediatek.com>
    usb: xhci-mtk: improve bandwidth scheduling with TT

Chunfeng Yun <chunfeng.yun@mediatek.com>
    usb: xhci-mtk: remove or operator for setting schedule parameters

Johan Hovold <johan@kernel.org>
    USB: serial: xr: fix CSIZE handling

Badhri Jagan Sridharan <badhri@google.com>
    usb: typec: tcpm: update power supply once partner accepts

Badhri Jagan Sridharan <badhri@google.com>
    usb: typec: tcpm: Address incorrect values of tcpm psy for pps supply

Badhri Jagan Sridharan <badhri@google.com>
    usb: typec: tcpm: Address incorrect values of tcpm psy for fixed supply

Randy Dunlap <rdunlap@infradead.org>
    drm: bridge: fix LONTIUM use of mipi_dsi_() functions

Johan Hovold <johan@kernel.org>
    tty: mxser: fix TIOCSSERIAL permission check

Johan Hovold <johan@kernel.org>
    staging: fwserial: fix TIOCSSERIAL permission check

Johan Hovold <johan@kernel.org>
    tty: mxser: fix TIOCSSERIAL jiffies conversions

Johan Hovold <johan@kernel.org>
    tty: moxa: fix TIOCSSERIAL permission check

Johan Hovold <johan@kernel.org>
    staging: fwserial: fix TIOCSSERIAL jiffies conversions

Johan Hovold <johan@kernel.org>
    USB: serial: ti_usb_3410_5052: fix TIOCSSERIAL permission check

Johan Hovold <johan@kernel.org>
    staging: greybus: uart: fix TIOCSSERIAL jiffies conversions

Johan Hovold <johan@kernel.org>
    USB: serial: usb_wwan: fix TIOCSSERIAL jiffies conversions

Johan Hovold <johan@kernel.org>
    tty: amiserial: fix TIOCSSERIAL permission check

Johan Hovold <johan@kernel.org>
    tty: moxa: fix TIOCSSERIAL jiffies conversions

Hans de Goede <hdegoede@redhat.com>
    usb: roles: Call try_module_get() from usb_role_switch_find_by_fwnode()

Johan Hovold <johan@kernel.org>
    Revert "USB: cdc-acm: fix rounding error in TIOCSSERIAL"

Heikki Krogerus <heikki.krogerus@linux.intel.com>
    software node: Allow node addition to already existing device

Mike Leach <mike.leach@linaro.org>
    coresight: etm-perf: Fix define build issue when built as module

Thadeu Lima de Souza Cascardo <cascardo@canonical.com>
    io_uring: truncate lengths larger than MAX_RW_COUNT on provide buffers

Or Cohen <orcohen@paloaltonetworks.com>
    net/nfc: fix use-after-free llcp_sock_bind/connect

Lin Ma <linma@zju.edu.cn>
    bluetooth: eliminate the potential race condition when removing the HCI controller

Archie Pusaka <apusaka@chromium.org>
    Bluetooth: verify AMP hci_chan before amp_destroy


-------------

Diffstat:

 Documentation/admin-guide/kernel-parameters.txt    |  15 +-
 .../devicetree/bindings/serial/st,stm32-uart.yaml  |   3 +-
 Documentation/driver-api/xilinx/eemi.rst           |  31 +-
 .../userspace-api/media/v4l/subdev-formats.rst     |   4 +-
 Makefile                                           |   4 +-
 arch/arm/boot/dts/aspeed-bmc-ibm-rainier.dts       |   4 +-
 arch/arm/boot/dts/exynos4210-i9100.dts             |   2 +-
 arch/arm/boot/dts/exynos4412-midas.dtsi            |   6 +-
 arch/arm/boot/dts/exynos4412-odroid-common.dtsi    |   2 +-
 arch/arm/boot/dts/exynos4412-p4note.dtsi           |   4 +-
 arch/arm/boot/dts/exynos5250-smdk5250.dts          |   2 +-
 arch/arm/boot/dts/exynos5250-snow-common.dtsi      |   2 +-
 .../dts/qcom-msm8974-lge-nexus5-hammerhead.dts     |   2 +-
 arch/arm/boot/dts/qcom-msm8974-samsung-klte.dts    |   2 +-
 arch/arm/boot/dts/r8a7790-lager.dts                |   3 +
 arch/arm/boot/dts/r8a7791-koelsch.dts              |   3 +
 arch/arm/boot/dts/r8a7791-porter.dts               |   2 +
 arch/arm/boot/dts/r8a7793-gose.dts                 |   3 +
 arch/arm/boot/dts/r8a7794-alt.dts                  |   3 +
 arch/arm/boot/dts/r8a7794-silk.dts                 |   2 +
 arch/arm/boot/dts/s5pv210-fascinate4g.dts          |   2 +-
 arch/arm/boot/dts/stm32mp15-pinctrl.dtsi           |  21 +-
 arch/arm/boot/dts/uniphier-pxs2.dtsi               |   2 +-
 arch/arm/crypto/blake2s-core.S                     |  21 +
 arch/arm/crypto/poly1305-glue.c                    |   2 +-
 .../broadcom/bcm4908/bcm4908-asus-gt-ac5300.dts    |   1 +
 arch/arm64/boot/dts/broadcom/bcm4908/bcm4908.dtsi  |   2 +-
 arch/arm64/boot/dts/mediatek/mt8173-evb.dts        |   2 +-
 arch/arm64/boot/dts/mediatek/mt8183.dtsi           |   7 +
 arch/arm64/boot/dts/mediatek/pumpkin-common.dtsi   |   2 +-
 arch/arm64/boot/dts/qcom/sc7180-trogdor.dtsi       |  35 +-
 arch/arm64/boot/dts/qcom/sdm845-db845c.dts         |   4 +-
 arch/arm64/boot/dts/qcom/sdm845.dtsi               |   2 +-
 arch/arm64/boot/dts/qcom/sm8150.dtsi               |   2 +-
 arch/arm64/boot/dts/qcom/sm8250.dtsi               |  33 +-
 arch/arm64/boot/dts/qcom/sm8350.dtsi               |   4 +-
 arch/arm64/boot/dts/renesas/hihope-common.dtsi     |   3 +
 .../boot/dts/renesas/r8a774a1-beacon-rzg2m-kit.dts |   3 +
 .../boot/dts/renesas/r8a774b1-beacon-rzg2n-kit.dts |   3 +
 arch/arm64/boot/dts/renesas/r8a774c0-cat874.dts    |   2 +
 .../boot/dts/renesas/r8a774e1-beacon-rzg2h-kit.dts |   3 +
 arch/arm64/boot/dts/renesas/r8a77980.dtsi          |  16 +-
 arch/arm64/boot/dts/renesas/r8a77990-ebisu.dts     |   3 +
 arch/arm64/boot/dts/renesas/r8a779a0.dtsi          |   5 +-
 arch/arm64/boot/dts/renesas/salvator-common.dtsi   |   3 +
 arch/arm64/boot/dts/renesas/ulcb-kf.dtsi           |   1 +
 arch/arm64/boot/dts/renesas/ulcb.dtsi              |   2 +
 arch/arm64/boot/dts/socionext/uniphier-ld20.dtsi   |   2 +-
 arch/arm64/boot/dts/socionext/uniphier-pxs3.dtsi   |   4 +-
 arch/arm64/boot/dts/ti/k3-j721e-main.dtsi          |  17 +-
 arch/arm64/crypto/aes-modes.S                      |   1 +
 arch/arm64/crypto/poly1305-glue.c                  |   2 +-
 arch/arm64/include/asm/kvm_host.h                  |   1 +
 arch/arm64/kvm/arm.c                               |   6 +-
 arch/arm64/kvm/debug.c                             |  88 ++--
 arch/arm64/kvm/hyp/nvhe/gen-hyprel.c               |  18 +
 arch/arm64/kvm/reset.c                             |   5 +
 arch/arm64/kvm/vgic/vgic-kvm-device.c              |   7 +-
 arch/ia64/kernel/acpi.c                            |   7 +-
 arch/ia64/kernel/efi.c                             |  11 +-
 arch/m68k/include/asm/mvme147hw.h                  |   3 +
 arch/m68k/kernel/sys_m68k.c                        |   2 +
 arch/m68k/mvme147/config.c                         |  14 +-
 arch/m68k/mvme16x/config.c                         |  14 +-
 arch/mips/Kconfig                                  |   1 +
 arch/mips/boot/dts/brcm/bcm3368.dtsi               |   2 +-
 arch/mips/boot/dts/brcm/bcm63268.dtsi              |   2 +-
 arch/mips/boot/dts/brcm/bcm6358.dtsi               |   2 +-
 arch/mips/boot/dts/brcm/bcm6362.dtsi               |   2 +-
 arch/mips/boot/dts/brcm/bcm6368.dtsi               |   2 +-
 arch/mips/crypto/poly1305-glue.c                   |   2 +-
 arch/mips/generic/board-boston.its.S               |  10 +-
 arch/mips/generic/board-jaguar2.its.S              |  16 +-
 arch/mips/generic/board-luton.its.S                |   8 +-
 arch/mips/generic/board-ni169445.its.S             |  10 +-
 arch/mips/generic/board-ocelot.its.S               |  20 +-
 arch/mips/generic/board-serval.its.S               |   8 +-
 arch/mips/generic/board-xilfpga.its.S              |  10 +-
 arch/mips/generic/vmlinux.its.S                    |  10 +-
 arch/mips/include/asm/asmmacro.h                   |   3 +-
 arch/mips/include/asm/div64.h                      |  57 ++-
 arch/mips/loongson64/init.c                        |   2 +-
 arch/mips/pci/pci-legacy.c                         |   9 +-
 arch/mips/pci/pci-mt7620.c                         |   5 +-
 arch/mips/pci/pci-rt2880.c                         |  37 +-
 arch/powerpc/Kconfig                               |   2 +-
 arch/powerpc/Kconfig.debug                         |   1 +
 arch/powerpc/include/asm/book3s/64/pgtable.h       |   4 +-
 arch/powerpc/include/asm/book3s/64/radix.h         |   6 +-
 arch/powerpc/include/asm/fixmap.h                  |   9 +
 arch/powerpc/include/asm/nohash/64/pgtable.h       |   5 +-
 arch/powerpc/include/asm/smp.h                     |   5 +
 arch/powerpc/kernel/fadump.c                       |   2 +-
 arch/powerpc/kernel/interrupt.c                    |   4 +-
 arch/powerpc/kernel/prom.c                         |   2 +-
 arch/powerpc/kernel/smp.c                          |  39 +-
 arch/powerpc/kvm/book3s_hv.c                       |   3 +
 arch/powerpc/mm/book3s64/hash_pgtable.c            |   6 +-
 arch/powerpc/mm/book3s64/hash_utils.c              |   4 +-
 arch/powerpc/mm/book3s64/radix_pgtable.c           |   4 +-
 arch/powerpc/mm/mem.c                              |   2 +-
 arch/powerpc/perf/isa207-common.c                  |   4 +-
 arch/powerpc/perf/power10-events-list.h            |   4 +-
 arch/powerpc/platforms/52xx/lite5200_sleep.S       |   2 +-
 arch/powerpc/platforms/pseries/iommu.c             |   2 +-
 arch/powerpc/platforms/pseries/lpar.c              |   4 +-
 arch/powerpc/platforms/pseries/pci_dlpar.c         |   4 +-
 arch/powerpc/platforms/pseries/vio.c               |   4 +
 arch/powerpc/sysdev/xive/common.c                  |  35 +-
 arch/s390/kernel/setup.c                           |   4 +-
 arch/s390/kvm/gaccess.c                            |  30 +-
 arch/s390/kvm/gaccess.h                            |  60 ++-
 arch/s390/kvm/kvm-s390.c                           |   4 +-
 arch/s390/kvm/vsie.c                               | 109 ++++-
 arch/x86/Kconfig                                   |   1 +
 arch/x86/crypto/poly1305_glue.c                    |   6 +-
 arch/x86/entry/vdso/vdso2c.h                       |   2 +-
 arch/x86/events/amd/iommu.c                        |   6 +-
 arch/x86/events/amd/uncore.c                       |   6 +-
 arch/x86/kernel/apic/x2apic_uv_x.c                 |   3 +
 arch/x86/kernel/cpu/microcode/core.c               |   8 +-
 arch/x86/kernel/e820.c                             |   4 +-
 arch/x86/kernel/kprobes/core.c                     |  23 +-
 arch/x86/kernel/smpboot.c                          |  90 ++--
 arch/x86/kvm/emulate.c                             |  80 +---
 arch/x86/kvm/lapic.c                               |   6 +
 arch/x86/kvm/mmu/mmu.c                             |  63 ++-
 arch/x86/kvm/svm/sev.c                             |  42 +-
 arch/x86/kvm/svm/svm.c                             |  44 +-
 arch/x86/kvm/vmx/nested.c                          |  17 +-
 arch/x86/kvm/vmx/vmx.c                             |  19 +-
 arch/x86/kvm/x86.c                                 |  18 +-
 arch/x86/kvm/xen.c                                 |   2 +-
 arch/x86/power/hibernate.c                         |  89 +---
 crypto/async_tx/async_xor.c                        |   1 +
 drivers/acpi/cppc_acpi.c                           |  14 +-
 drivers/ata/libahci_platform.c                     |   4 +-
 drivers/ata/pata_arasan_cf.c                       |  15 +-
 drivers/ata/pata_ixp4xx_cf.c                       |   6 +-
 drivers/ata/sata_mv.c                              |   4 +
 drivers/base/devtmpfs.c                            |   2 +-
 drivers/base/node.c                                |  26 +-
 drivers/base/regmap/regmap-debugfs.c               |   1 +
 drivers/base/swnode.c                              |   5 +-
 drivers/block/ataflop.c                            |  16 +-
 drivers/block/null_blk/zoned.c                     |   1 +
 drivers/block/rnbd/rnbd-clt-sysfs.c                |   6 +-
 drivers/block/xen-blkback/common.h                 |   1 +
 drivers/block/xen-blkback/xenbus.c                 |  38 +-
 drivers/bus/qcom-ebi2.c                            |   4 +-
 drivers/bus/ti-sysc.c                              |   6 +-
 drivers/char/tpm/tpm_tis_i2c_cr50.c                |   1 +
 drivers/char/ttyprintk.c                           |  11 +
 drivers/clk/clk-ast2600.c                          |   4 +-
 drivers/clk/imx/clk-imx25.c                        |  12 +-
 drivers/clk/imx/clk-imx27.c                        |  13 +-
 drivers/clk/imx/clk-imx35.c                        |  10 +-
 drivers/clk/imx/clk-imx5.c                         |  30 +-
 drivers/clk/imx/clk-imx6q.c                        |  16 +-
 drivers/clk/imx/clk-imx6sl.c                       |  16 +-
 drivers/clk/imx/clk-imx6sll.c                      |  24 +-
 drivers/clk/imx/clk-imx6sx.c                       |  16 +-
 drivers/clk/imx/clk-imx7d.c                        |  22 +-
 drivers/clk/imx/clk-imx7ulp.c                      |  31 +-
 drivers/clk/imx/clk-imx8mm.c                       |  18 +-
 drivers/clk/imx/clk-imx8mn.c                       |  18 +-
 drivers/clk/imx/clk-imx8mp.c                       |  17 +-
 drivers/clk/imx/clk-imx8mq.c                       |  18 +-
 drivers/clk/imx/clk.c                              |  41 +-
 drivers/clk/imx/clk.h                              |   4 +-
 drivers/clk/mvebu/armada-37xx-periph.c             |  83 ++--
 drivers/clk/qcom/a53-pll.c                         |   1 +
 drivers/clk/qcom/a7-pll.c                          |   1 +
 drivers/clk/qcom/apss-ipq-pll.c                    |   1 +
 drivers/clk/uniphier/clk-uniphier-mux.c            |   4 +-
 drivers/clk/zynqmp/pll.c                           |  24 +-
 drivers/clocksource/ingenic-ost.c                  |   4 +-
 drivers/clocksource/timer-ti-dm-systimer.c         |  13 +-
 drivers/cpufreq/armada-37xx-cpufreq.c              |  76 +++-
 drivers/cpuidle/Kconfig.arm                        |   2 +-
 drivers/crypto/allwinner/Kconfig                   |  14 +-
 drivers/crypto/allwinner/sun8i-ss/sun8i-ss-hash.c  |   9 +-
 drivers/crypto/allwinner/sun8i-ss/sun8i-ss-prng.c  |   4 +-
 drivers/crypto/ccp/sev-dev.c                       |   3 +
 drivers/crypto/ccp/tee-dev.c                       |  49 +-
 drivers/crypto/ccp/tee-dev.h                       |  20 +-
 drivers/crypto/chelsio/chcr_algo.c                 |  19 +-
 drivers/crypto/keembay/keembay-ocs-aes-core.c      |   4 +-
 drivers/crypto/keembay/keembay-ocs-hcu-core.c      |   4 +-
 drivers/crypto/qat/qat_c3xxxvf/adf_drv.c           |   4 +-
 drivers/crypto/qat/qat_c62xvf/adf_drv.c            |   4 +-
 drivers/crypto/qat/qat_common/adf_isr.c            |  29 +-
 drivers/crypto/qat/qat_common/adf_transport.c      |   1 +
 drivers/crypto/qat/qat_common/adf_vf_isr.c         |  17 +-
 drivers/crypto/qat/qat_dh895xccvf/adf_drv.c        |   4 +-
 drivers/crypto/sa2ul.c                             |   8 +-
 drivers/devfreq/devfreq.c                          |   5 +-
 drivers/firmware/Kconfig                           |   1 +
 drivers/firmware/qcom_scm-smc.c                    |  12 +-
 drivers/firmware/qcom_scm.c                        |  88 ++--
 drivers/firmware/qcom_scm.h                        |   7 +-
 drivers/firmware/xilinx/zynqmp.c                   |   5 +-
 drivers/fpga/xilinx-spi.c                          |  24 +-
 drivers/gpu/drm/amd/amdgpu/amdgpu_display.c        |   2 +-
 drivers/gpu/drm/amd/amdgpu/amdgpu_ids.c            |  19 +-
 drivers/gpu/drm/amd/amdgpu/amdgpu_pmu.c            |   4 +-
 drivers/gpu/drm/amd/amdgpu/amdgpu_vm.c             |  12 +-
 drivers/gpu/drm/amd/amdgpu/amdgpu_vm.h             |   1 +
 drivers/gpu/drm/amd/amdgpu/gmc_v8_0.c              |  13 +-
 drivers/gpu/drm/amd/amdgpu/vcn_v3_0.c              |   4 +
 drivers/gpu/drm/amd/amdkfd/kfd_iommu.c             |   6 +
 drivers/gpu/drm/amd/amdkfd/kfd_iommu.h             |   9 +-
 drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c  |  20 +-
 drivers/gpu/drm/amd/display/dc/core/dc_link.c      |   1 +
 drivers/gpu/drm/amd/display/dc/dce/dce_abm.c       |   2 +-
 drivers/gpu/drm/amd/display/dc/dce/dce_dmcu.c      |   6 +-
 drivers/gpu/drm/amd/display/dc/dcn20/dcn20_dccg.c  |   2 +-
 .../gpu/drm/amd/display/dc/dcn20/dcn20_resource.c  |  26 +-
 drivers/gpu/drm/amd/display/dc/hdcp/hdcp_msg.c     |   9 +-
 drivers/gpu/drm/amd/pm/swsmu/amdgpu_smu.c          |   1 +
 drivers/gpu/drm/bridge/Kconfig                     |   3 +
 drivers/gpu/drm/bridge/analogix/Kconfig            |   1 +
 drivers/gpu/drm/bridge/panel.c                     |  12 +
 drivers/gpu/drm/drm_dp_mst_topology.c              |  17 +-
 drivers/gpu/drm/drm_probe_helper.c                 |   7 +-
 drivers/gpu/drm/i915/gvt/gvt.c                     |   8 +-
 drivers/gpu/drm/ingenic/ingenic-drm-drv.c          |  11 +-
 drivers/gpu/drm/mcde/mcde_dsi.c                    |   2 +-
 drivers/gpu/drm/mediatek/mtk_hdmi.c                | 174 +++----
 drivers/gpu/drm/msm/disp/dpu1/dpu_hw_catalog.c     |   2 +-
 drivers/gpu/drm/msm/msm_debugfs.c                  |  14 +-
 drivers/gpu/drm/msm/msm_drv.c                      |   3 +
 drivers/gpu/drm/msm/msm_drv.h                      |   9 +-
 drivers/gpu/drm/msm/msm_gem.c                      |  14 +-
 drivers/gpu/drm/msm/msm_gem.h                      |  12 +-
 drivers/gpu/drm/omapdrm/dss/dsi.c                  |   3 +-
 drivers/gpu/drm/panel/panel-novatek-nt35510.c      |   3 +-
 drivers/gpu/drm/panel/panel-samsung-s6d16d0.c      |   4 +-
 drivers/gpu/drm/panel/panel-samsung-s6e63m0-dsi.c  |   1 -
 drivers/gpu/drm/panel/panel-simple.c               |  11 +-
 drivers/gpu/drm/panel/panel-sony-acx424akp.c       |   3 +-
 drivers/gpu/drm/panfrost/panfrost_mmu.c            |  13 +-
 drivers/gpu/drm/qxl/qxl_cmd.c                      |   2 +-
 drivers/gpu/drm/qxl/qxl_display.c                  |   4 +-
 drivers/gpu/drm/qxl/qxl_drv.c                      |   2 -
 drivers/gpu/drm/qxl/qxl_gem.c                      |   2 +-
 drivers/gpu/drm/qxl/qxl_object.c                   |   5 +-
 drivers/gpu/drm/qxl/qxl_object.h                   |   1 +
 drivers/gpu/drm/qxl/qxl_release.c                  |  18 +-
 drivers/gpu/drm/radeon/radeon_dp_mst.c             |   3 +
 drivers/gpu/drm/radeon/radeon_kms.c                |   1 +
 drivers/gpu/drm/stm/ltdc.c                         |  33 +-
 drivers/gpu/drm/tilcdc/tilcdc_crtc.c               |   9 +
 drivers/gpu/drm/xlnx/zynqmp_dp.c                   |   2 +-
 drivers/hid/hid-ids.h                              |   1 +
 drivers/hid/hid-lenovo.c                           |  47 +-
 drivers/hid/hid-plantronics.c                      |  60 ++-
 drivers/hsi/hsi_core.c                             |   3 +-
 drivers/hv/channel.c                               |   2 +-
 drivers/hv/channel_mgmt.c                          |  30 +-
 drivers/hv/ring_buffer.c                           |   1 -
 drivers/hwmon/pmbus/pxe1610.c                      |   9 +
 drivers/hwtracing/coresight/coresight-etm-perf.c   |   2 +-
 drivers/i2c/busses/i2c-cadence.c                   |   9 +-
 drivers/i2c/busses/i2c-emev2.c                     |   5 +-
 drivers/i2c/busses/i2c-img-scb.c                   |   4 +-
 drivers/i2c/busses/i2c-imx-lpi2c.c                 |   2 +-
 drivers/i2c/busses/i2c-imx.c                       |   4 +-
 drivers/i2c/busses/i2c-jz4780.c                    |   5 +-
 drivers/i2c/busses/i2c-mlxbf.c                     |   2 +
 drivers/i2c/busses/i2c-mt65xx.c                    |   2 +-
 drivers/i2c/busses/i2c-omap.c                      |   8 +-
 drivers/i2c/busses/i2c-rcar.c                      |   5 +-
 drivers/i2c/busses/i2c-sh7760.c                    |   5 +-
 drivers/i2c/busses/i2c-sprd.c                      |   4 +-
 drivers/i2c/busses/i2c-stm32f7.c                   |  12 +-
 drivers/i2c/busses/i2c-xiic.c                      |   4 +-
 drivers/i3c/master.c                               |   5 +-
 drivers/iio/accel/adis16201.c                      |   2 +-
 drivers/iio/adc/Kconfig                            |   2 +-
 drivers/iio/adc/ad7476.c                           |  18 +-
 drivers/iio/imu/adis16480.c                        | 128 ++++--
 drivers/iio/imu/inv_mpu6050/inv_mpu_core.c         |  20 +-
 drivers/iio/magnetometer/yamaha-yas530.c           |   4 +-
 drivers/iio/orientation/hid-sensor-rotation.c      |  13 +-
 drivers/iio/proximity/sx9310.c                     |  52 ++-
 drivers/infiniband/core/cm.c                       |   3 +-
 drivers/infiniband/core/cma.c                      |  12 +-
 drivers/infiniband/hw/bnxt_re/qplib_fp.c           |   1 +
 drivers/infiniband/hw/bnxt_re/qplib_res.c          |   1 +
 drivers/infiniband/hw/cxgb4/resource.c             |   2 +-
 drivers/infiniband/hw/hfi1/firmware.c              |   1 +
 drivers/infiniband/hw/hfi1/mmu_rb.c                |   2 +-
 drivers/infiniband/hw/hns/hns_roce_hw_v2.c         |   1 +
 drivers/infiniband/hw/i40iw/i40iw_pble.c           |   6 +-
 drivers/infiniband/hw/mlx5/fs.c                    |   9 +-
 drivers/infiniband/hw/mlx5/main.c                  |   6 +-
 drivers/infiniband/hw/mlx5/mlx5_ib.h               | 103 +++--
 drivers/infiniband/hw/mlx5/mr.c                    |  14 +-
 drivers/infiniband/hw/mlx5/odp.c                   |   1 -
 drivers/infiniband/hw/mlx5/qp.c                    |  15 +-
 drivers/infiniband/hw/qedr/qedr_iw_cm.c            |   4 +-
 drivers/infiniband/sw/rxe/rxe_av.c                 |   2 +-
 drivers/infiniband/sw/siw/siw_mem.c                |   4 +-
 drivers/infiniband/ulp/isert/ib_isert.c            |  16 +-
 drivers/infiniband/ulp/rtrs/rtrs-clt.c             |   2 +-
 drivers/infiniband/ulp/srpt/ib_srpt.c              |   1 +
 drivers/iommu/amd/init.c                           |   2 +-
 drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.h        |   2 +-
 drivers/iommu/dma-iommu.c                          |  13 +-
 drivers/iommu/intel/iommu.c                        |  38 +-
 drivers/iommu/intel/irq_remapping.c                |   2 +-
 drivers/iommu/intel/pasid.c                        |  16 +
 drivers/iommu/intel/pasid.h                        |   1 +
 drivers/iommu/intel/svm.c                          |  18 +-
 drivers/iommu/iommu.c                              |  24 +-
 drivers/iommu/mtk_iommu.c                          |  19 +-
 drivers/irqchip/irq-gic-v3-mbi.c                   |   2 +-
 drivers/mailbox/sprd-mailbox.c                     |  43 +-
 drivers/md/bcache/writeback.c                      |   6 +-
 drivers/md/md-bitmap.c                             |   2 +
 drivers/md/md.c                                    |  73 +--
 drivers/media/common/saa7146/saa7146_core.c        |   2 +-
 drivers/media/common/saa7146/saa7146_video.c       |   3 +-
 drivers/media/dvb-frontends/m88ds3103.c            |   4 +-
 drivers/media/i2c/ccs/ccs-core.c                   |   4 +-
 drivers/media/i2c/imx219.c                         |  49 +-
 drivers/media/i2c/rdacm21.c                        |   2 +-
 drivers/media/pci/intel/ipu3/ipu3-cio2-main.c      |   2 +-
 drivers/media/pci/saa7134/saa7134-core.c           |   2 +-
 drivers/media/platform/Kconfig                     |   3 +
 drivers/media/platform/aspeed-video.c              |   9 +-
 drivers/media/platform/meson/ge2d/ge2d.c           |   4 +-
 drivers/media/platform/qcom/venus/core.c           |   7 +-
 .../platform/rockchip/rkisp1/rkisp1-resizer.c      |   9 +-
 .../media/platform/sunxi/sun6i-csi/sun6i_video.c   |   4 +-
 drivers/media/test-drivers/vivid/vivid-vid-out.c   |   2 +-
 drivers/media/tuners/m88rs6000t.c                  |   6 +-
 drivers/media/v4l2-core/v4l2-ctrls.c               |  17 +-
 drivers/memory/omap-gpmc.c                         |   7 +-
 drivers/memory/pl353-smc.c                         |   2 +-
 drivers/memory/renesas-rpc-if.c                    |   2 +-
 drivers/memory/samsung/exynos5422-dmc.c            |   4 +-
 drivers/mfd/intel_pmt.c                            |  11 +-
 drivers/mfd/stm32-timers.c                         |   7 +-
 drivers/mfd/stmpe.c                                |  14 +-
 drivers/misc/lis3lv02d/lis3lv02d.c                 |  21 +-
 drivers/misc/vmw_vmci/vmci_doorbell.c              |   2 +-
 drivers/misc/vmw_vmci/vmci_guest.c                 |   2 +-
 drivers/mtd/maps/physmap-core.c                    |   4 +-
 drivers/mtd/mtdchar.c                              |   8 +-
 drivers/mtd/mtdcore.c                              |   3 +
 drivers/mtd/mtdpart.c                              |   2 +-
 drivers/mtd/nand/raw/brcmnand/brcmnand.c           |   6 +
 drivers/mtd/nand/raw/fsmc_nand.c                   |   2 +
 drivers/mtd/nand/raw/gpmi-nand/gpmi-nand.c         |   2 +-
 drivers/mtd/nand/raw/qcom_nandc.c                  |   7 +-
 drivers/mtd/parsers/qcomsmempart.c                 |   9 +-
 drivers/net/dsa/bcm_sf2.c                          |  58 ++-
 drivers/net/dsa/bcm_sf2_regs.h                     |   3 +-
 drivers/net/dsa/mv88e6xxx/devlink.c                |   2 +-
 drivers/net/dsa/mv88e6xxx/serdes.c                 |   6 +-
 drivers/net/ethernet/broadcom/bnxt/bnxt.c          |  10 +-
 .../net/ethernet/cavium/liquidio/cn23xx_pf_regs.h  |   2 +-
 drivers/net/ethernet/cavium/thunder/nicvf_queues.c |   2 +-
 drivers/net/ethernet/chelsio/cxgb4/cxgb4_filter.c  |  22 +-
 drivers/net/ethernet/freescale/Makefile            |   4 +-
 drivers/net/ethernet/hisilicon/hns3/hns3_enet.c    |   3 +-
 .../net/ethernet/marvell/prestera/prestera_main.c  |   3 +-
 .../net/ethernet/mellanox/mlx5/core/fpga/ipsec.c   |   2 +-
 .../mellanox/mlx5/core/steering/dr_ste_v1.c        |   1 +
 drivers/net/ethernet/netronome/nfp/nfp_devlink.c   |   1 +
 drivers/net/ethernet/qualcomm/emac/emac-mac.c      |   4 +-
 drivers/net/ethernet/renesas/ravb_main.c           |  35 +-
 drivers/net/ethernet/sfc/ef10.c                    |   3 +-
 drivers/net/ethernet/stmicro/stmmac/stmmac_main.c  |  12 +-
 drivers/net/ethernet/ti/davinci_emac.c             |   4 +-
 drivers/net/ethernet/xilinx/Kconfig                |   3 +
 drivers/net/ethernet/xscale/ixp4xx_eth.c           |   5 +-
 drivers/net/fddi/Kconfig                           |  15 +-
 drivers/net/fddi/defxx.c                           |  47 +-
 drivers/net/geneve.c                               |   4 +-
 drivers/net/phy/intel-xway.c                       |  21 +
 drivers/net/phy/marvell.c                          |  52 ++-
 drivers/net/phy/smsc.c                             |   7 +-
 drivers/net/wan/hdlc_fr.c                          |   5 +-
 drivers/net/wan/lapbether.c                        |  32 +-
 drivers/net/wireless/ath/ath10k/htc.c              |   2 +-
 drivers/net/wireless/ath/ath10k/wmi-tlv.c          |   3 +
 drivers/net/wireless/ath/ath9k/htc_drv_init.c      |   2 +-
 drivers/net/wireless/ath/ath9k/hw.c                |   2 +-
 drivers/net/wireless/intel/ipw2x00/libipw_wx.c     |   6 +-
 drivers/net/wireless/intel/iwlwifi/iwl-dbg-tlv.c   |   5 +-
 drivers/net/wireless/intel/iwlwifi/mvm/rs-fw.c     |  20 +-
 drivers/net/wireless/marvell/mwl8k.c               |   1 +
 drivers/net/wireless/mediatek/mt76/dma.c           |   2 +-
 drivers/net/wireless/mediatek/mt76/mt7615/mac.c    |  56 +--
 drivers/net/wireless/mediatek/mt76/mt7615/main.c   |  28 +-
 drivers/net/wireless/mediatek/mt76/mt7615/mt7615.h |  10 +-
 .../net/wireless/mediatek/mt76/mt7615/pci_init.c   |   3 +-
 drivers/net/wireless/mediatek/mt76/mt7615/regs.h   |   7 +-
 .../net/wireless/mediatek/mt76/mt7615/sdio_txrx.c  |  11 +-
 .../net/wireless/mediatek/mt76/mt7615/usb_sdio.c   |   7 +-
 .../net/wireless/mediatek/mt76/mt76_connac_mcu.c   |   6 +-
 .../net/wireless/mediatek/mt76/mt7915/debugfs.c    |   2 +-
 drivers/net/wireless/mediatek/mt76/mt7915/init.c   |   3 +-
 drivers/net/wireless/mediatek/mt76/mt7915/mac.c    |  52 +--
 drivers/net/wireless/mediatek/mt76/mt7915/main.c   |  11 +-
 drivers/net/wireless/mediatek/mt76/mt7915/mcu.c    |  85 ++--
 drivers/net/wireless/mediatek/mt76/mt7915/mt7915.h |  10 +-
 .../net/wireless/mediatek/mt76/mt7921/debugfs.c    |  10 +-
 drivers/net/wireless/mediatek/mt76/mt7921/mac.c    | 192 ++++----
 drivers/net/wireless/mediatek/mt76/mt7921/mac.h    |  10 +-
 drivers/net/wireless/mediatek/mt76/mt7921/main.c   |  11 +-
 drivers/net/wireless/mediatek/mt76/mt7921/mcu.c    |  44 ++
 drivers/net/wireless/mediatek/mt76/mt7921/mt7921.h |  13 +-
 drivers/net/wireless/mediatek/mt76/mt7921/pci.c    |  26 +-
 drivers/net/wireless/mediatek/mt76/mt7921/regs.h   |  27 +-
 drivers/net/wireless/mediatek/mt76/sdio.c          |   3 +
 drivers/net/wireless/mediatek/mt76/tx.c            |  15 +-
 drivers/net/wireless/mediatek/mt7601u/eeprom.c     |   2 +-
 drivers/net/wireless/microchip/wilc1000/sdio.c     |   2 +-
 .../net/wireless/realtek/rtlwifi/rtl8821ae/table.c | 500 +++++++++++++++------
 drivers/net/wireless/realtek/rtw88/debug.c         |   2 +-
 drivers/net/wireless/realtek/rtw88/pci.c           |  19 +-
 drivers/net/wireless/realtek/rtw88/pci.h           |   1 +
 drivers/net/wireless/realtek/rtw88/phy.c           |   5 +-
 drivers/net/wireless/ti/wlcore/boot.c              |  13 +-
 drivers/net/wireless/ti/wlcore/debugfs.h           |   7 +-
 drivers/nfc/pn533/pn533.c                          |   3 +
 drivers/nvme/host/multipath.c                      |   4 +
 drivers/nvme/host/pci.c                            |   2 +-
 drivers/nvme/host/tcp.c                            |   4 +-
 drivers/nvme/target/tcp.c                          |  43 +-
 drivers/nvmem/Kconfig                              |   1 +
 drivers/nvmem/qfprom.c                             |  21 +
 drivers/of/overlay.c                               |   1 +
 drivers/pci/controller/dwc/pci-keystone.c          |   3 +-
 drivers/pci/controller/pci-xgene.c                 |   3 +-
 drivers/pci/vpd.c                                  |   1 -
 drivers/phy/cadence/phy-cadence-sierra.c           |   7 +-
 drivers/phy/ingenic/phy-ingenic-usb.c              |   4 +-
 drivers/phy/marvell/Kconfig                        |   4 +-
 drivers/phy/ralink/phy-mt7621-pci.c                |   6 +-
 drivers/phy/ti/phy-j721e-wiz.c                     |  23 +-
 drivers/pinctrl/pinctrl-at91-pio4.c                |   8 +-
 drivers/pinctrl/pinctrl-single.c                   |  63 +--
 drivers/platform/surface/aggregator/controller.c   |   2 +-
 drivers/platform/x86/dell/dell-wmi-sysman/sysman.c |  32 +-
 drivers/platform/x86/pmc_atom.c                    |  28 +-
 drivers/power/supply/bq25980_charger.c             |  40 +-
 drivers/power/supply/bq27xxx_battery.c             |   2 +-
 drivers/regulator/bd9576-regulator.c               |  11 +-
 drivers/scsi/hisi_sas/hisi_sas_v1_hw.c             |   6 +-
 drivers/scsi/ibmvscsi/ibmvfc.c                     |  57 ++-
 drivers/scsi/jazz_esp.c                            |   4 +-
 drivers/scsi/lpfc/lpfc_els.c                       |  50 +--
 drivers/scsi/pm8001/pm8001_hwi.c                   |   2 +-
 drivers/scsi/pm8001/pm80xx_hwi.c                   |   4 +-
 drivers/scsi/qla2xxx/qla_bsg.c                     |   4 +
 drivers/scsi/sni_53c710.c                          |   5 +-
 drivers/scsi/sun3x_esp.c                           |   4 +-
 drivers/scsi/ufs/ufshcd-pltfrm.c                   |   2 +-
 drivers/soc/aspeed/aspeed-lpc-snoop.c              |   4 +-
 drivers/soc/mediatek/mtk-pm-domains.c              |   5 +-
 drivers/soc/qcom/mdt_loader.c                      |  17 +
 drivers/soc/qcom/pdr_interface.c                   |   2 +-
 drivers/soc/tegra/regulators-tegra30.c             |   2 +-
 drivers/soundwire/bus.c                            |   3 +-
 drivers/soundwire/stream.c                         |  10 +-
 drivers/spi/spi-fsl-lpspi.c                        |   2 +-
 drivers/spi/spi-fsl-spi.c                          |  23 +-
 drivers/spi/spi-rockchip.c                         |  13 +-
 drivers/spi/spi-stm32.c                            |  27 +-
 drivers/spi/spi-zynqmp-gqspi.c                     | 168 ++++---
 drivers/spi/spi.c                                  |   9 +-
 .../staging/comedi/drivers/tests/ni_routes_test.c  |   6 +-
 drivers/staging/fwserial/fwserial.c                |  19 +-
 drivers/staging/greybus/uart.c                     |  13 +-
 drivers/staging/media/atomisp/i2c/atomisp-lm3554.c |  19 +-
 drivers/staging/media/atomisp/pci/atomisp_ioctl.c  |   4 +-
 drivers/staging/media/atomisp/pci/hmm/hmm_bo.c     |  13 +-
 drivers/staging/media/omap4iss/iss.c               |   4 +-
 drivers/staging/media/rkvdec/rkvdec.c              |  48 +-
 drivers/staging/media/rkvdec/rkvdec.h              |   1 -
 drivers/staging/media/sunxi/cedrus/cedrus_regs.h   |  17 +-
 drivers/staging/qlge/qlge_main.c                   |   6 +-
 drivers/staging/rtl8192u/r8192U_core.c             |   2 +-
 drivers/tty/amiserial.c                            |   1 +
 drivers/tty/moxa.c                                 |  18 +-
 drivers/tty/mxser.c                                |  31 +-
 drivers/tty/serial/liteuart.c                      |   4 +-
 drivers/tty/serial/omap-serial.c                   |  51 ++-
 drivers/tty/serial/sc16is7xx.c                     |   2 +-
 drivers/tty/serial/serial_core.c                   |   6 +-
 drivers/tty/serial/stm32-usart.c                   | 184 +++++---
 drivers/tty/serial/stm32-usart.h                   |   3 -
 drivers/tty/tty_io.c                               |  10 +-
 drivers/tty/tty_ioctl.c                            |   4 +-
 drivers/usb/cdns3/cdnsp-gadget.c                   |  17 +-
 drivers/usb/cdns3/cdnsp-gadget.h                   |   1 +
 drivers/usb/class/cdc-acm.c                        |  16 +-
 drivers/usb/dwc2/core_intr.c                       | 154 ++++---
 drivers/usb/dwc2/hcd.c                             |  10 +-
 drivers/usb/gadget/udc/aspeed-vhub/core.c          |   3 +-
 drivers/usb/gadget/udc/aspeed-vhub/epn.c           |   2 +-
 drivers/usb/gadget/udc/fotg210-udc.c               |  26 +-
 drivers/usb/gadget/udc/pch_udc.c                   | 123 +++--
 drivers/usb/gadget/udc/r8a66597-udc.c              |   2 +
 drivers/usb/gadget/udc/s3c2410_udc.c               |  24 +-
 drivers/usb/gadget/udc/snps_udc_plat.c             |   4 +-
 drivers/usb/host/Kconfig                           |   1 +
 drivers/usb/host/xhci-mtk-sch.c                    |  80 +++-
 drivers/usb/host/xhci-mtk.h                        |   6 +-
 drivers/usb/roles/class.c                          |   2 +
 drivers/usb/serial/ti_usb_3410_5052.c              |   9 +-
 drivers/usb/serial/usb_wwan.c                      |   9 +-
 drivers/usb/serial/xr_serial.c                     |   5 +
 drivers/usb/typec/stusb160x.c                      |   4 +-
 drivers/usb/typec/tcpm/tcpci.c                     |  21 +-
 drivers/usb/typec/tcpm/tcpm.c                      | 197 +++++---
 drivers/usb/typec/tps6598x.c                       |   4 +-
 drivers/usb/usbip/vudc_sysfs.c                     |   2 +
 drivers/vfio/fsl-mc/vfio_fsl_mc.c                  |  74 +--
 drivers/vfio/mdev/mdev_sysfs.c                     |   2 +-
 drivers/vfio/pci/vfio_pci.c                        | 131 ++++--
 fs/afs/dir.c                                       |   7 +
 fs/afs/dir_silly.c                                 |   3 +
 fs/afs/fs_operation.c                              |   6 +
 fs/afs/inode.c                                     |  12 +-
 fs/afs/internal.h                                  |   2 +
 fs/afs/write.c                                     |   1 +
 fs/btrfs/tree-log.c                                |  12 +-
 fs/btrfs/volumes.c                                 |   2 +
 fs/dlm/lowcomms.c                                  |   1 +
 fs/fuse/dev.c                                      |   7 +-
 fs/io_uring.c                                      |  14 +-
 fs/nfsd/nfs4proc.c                                 |   4 +-
 fs/overlayfs/copy_up.c                             |   3 +-
 fs/overlayfs/overlayfs.h                           |  30 +-
 fs/overlayfs/readdir.c                             |  12 -
 fs/overlayfs/super.c                               |   2 +
 fs/overlayfs/util.c                                |  31 +-
 fs/proc/array.c                                    |   2 +
 fs/xfs/libxfs/xfs_attr.c                           |   1 +
 include/crypto/internal/poly1305.h                 |   3 +-
 include/crypto/poly1305.h                          |   6 +-
 include/keys/trusted-type.h                        |   1 +
 include/linux/dma-iommu.h                          |   2 +
 include/linux/firmware/xlnx-zynqmp.h               |   5 -
 include/linux/gpio/driver.h                        |   9 +
 include/linux/hid.h                                |   2 +
 include/linux/intel-iommu.h                        |   1 +
 include/linux/iommu.h                              |   2 +-
 include/linux/kvm_host.h                           |   4 +-
 include/linux/mlx5/driver.h                        |   2 +-
 include/linux/platform_device.h                    |   3 +
 include/linux/pm_runtime.h                         |   2 +-
 include/linux/smp.h                                |   2 +-
 include/linux/spi/spi.h                            |   3 +
 include/linux/tty_driver.h                         |   2 +-
 include/linux/udp.h                                |  16 +-
 include/linux/usb/pd.h                             |   2 +
 include/net/addrconf.h                             |   1 -
 include/net/bluetooth/hci_core.h                   |   1 +
 include/net/netfilter/nf_tables_offload.h          |  12 +-
 include/uapi/linux/tty_flags.h                     |   4 +-
 init/init_task.c                                   |   2 +-
 kernel/bpf/ringbuf.c                               |  24 +-
 kernel/bpf/verifier.c                              |  30 +-
 kernel/kthread.c                                   |  33 +-
 kernel/printk/printk.c                             |   9 +-
 kernel/rcu/tree.c                                  |   1 -
 kernel/sched/core.c                                |   2 +-
 kernel/sched/debug.c                               |  42 +-
 kernel/sched/fair.c                                |   5 +-
 kernel/sched/sched.h                               |   7 +
 kernel/smp.c                                       |  20 +-
 kernel/up.c                                        |   2 +-
 lib/bug.c                                          |  33 +-
 lib/crypto/poly1305-donna32.c                      |   3 +-
 lib/crypto/poly1305-donna64.c                      |   3 +-
 lib/crypto/poly1305.c                              |   3 +-
 mm/memcontrol.c                                    |  10 +-
 mm/memory-failure.c                                |   2 +-
 mm/slub.c                                          |   9 +
 mm/sparse.c                                        |   1 +
 net/bluetooth/hci_conn.c                           |   4 -
 net/bluetooth/hci_event.c                          |   3 +-
 net/bluetooth/hci_request.c                        |  12 +-
 net/bridge/br_multicast.c                          |  33 +-
 net/core/dev.c                                     |  14 +-
 net/ipv4/route.c                                   |  42 +-
 net/ipv4/tcp_cong.c                                |   4 +
 net/ipv4/udp.c                                     |   3 +
 net/ipv4/udp_offload.c                             |  19 +-
 net/ipv6/mcast_snoop.c                             |  12 +-
 net/mac80211/main.c                                |   7 +-
 net/mptcp/protocol.c                               |  29 +-
 net/netfilter/nf_tables_offload.c                  |  44 ++
 net/netfilter/nft_cmp.c                            |  41 +-
 net/netfilter/nft_payload.c                        |  13 +-
 net/nfc/digital_dep.c                              |   2 +
 net/nfc/llcp_sock.c                                |   4 +
 net/packet/af_packet.c                             |  15 +-
 net/packet/internal.h                              |   2 +-
 net/sched/act_ct.c                                 |   6 +-
 net/sctp/socket.c                                  |  38 +-
 net/tipc/crypto.c                                  |   2 +
 net/vmw_vsock/virtio_transport_common.c            |  28 +-
 net/vmw_vsock/vmci_transport.c                     |   3 +-
 net/wireless/scan.c                                |   2 +
 net/xdp/xsk.c                                      |   8 +-
 samples/kfifo/bytestream-example.c                 |   8 +-
 samples/kfifo/inttype-example.c                    |   8 +-
 samples/kfifo/record-example.c                     |   8 +-
 security/integrity/ima/ima_template.c              |   4 +-
 security/keys/trusted-keys/trusted_tpm1.c          |  32 +-
 security/keys/trusted-keys/trusted_tpm2.c          |  10 +-
 security/selinux/include/classmap.h                |   5 +-
 sound/core/init.c                                  |   2 -
 sound/pci/hda/patch_realtek.c                      | 162 ++++---
 sound/soc/codecs/ak5558.c                          |   4 +-
 sound/soc/codecs/tlv320aic32x4.c                   |  12 +-
 sound/soc/codecs/wm8960.c                          |  12 +-
 sound/soc/generic/audio-graph-card.c               |   2 +-
 sound/soc/generic/simple-card.c                    |   2 +-
 sound/soc/intel/Makefile                           |   2 +-
 sound/soc/intel/boards/kbl_da7219_max98927.c       |  38 +-
 sound/soc/intel/boards/sof_wm8804.c                |   6 +-
 sound/soc/intel/skylake/Makefile                   |   2 +-
 sound/soc/qcom/qdsp6/q6afe-clocks.c                | 209 ++++-----
 sound/soc/qcom/qdsp6/q6afe.c                       |   2 +-
 sound/soc/qcom/qdsp6/q6afe.h                       |   2 +-
 sound/soc/samsung/tm2_wm5110.c                     |   2 +-
 sound/soc/tegra/tegra30_i2s.c                      |  40 +-
 sound/usb/card.c                                   |  14 +-
 sound/usb/midi.c                                   |   2 +-
 sound/usb/quirks.c                                 |  16 +-
 sound/usb/usbaudio.h                               |   2 +
 tools/bpf/bpftool/btf.c                            |   3 +
 tools/bpf/bpftool/main.c                           |   3 +-
 tools/bpf/bpftool/map.c                            |   2 +-
 tools/lib/bpf/bpf_core_read.h                      |  16 +-
 tools/lib/bpf/bpf_tracing.h                        |  40 +-
 tools/lib/bpf/btf.h                                |   1 +
 tools/lib/bpf/libbpf.h                             |   1 +
 tools/lib/perf/include/perf/event.h                |   7 +-
 tools/perf/pmu-events/arch/x86/amdzen1/cache.json  |   2 +-
 .../pmu-events/arch/x86/amdzen1/recommended.json   |   6 +-
 tools/perf/pmu-events/arch/x86/amdzen2/cache.json  |   2 +-
 .../pmu-events/arch/x86/amdzen2/recommended.json   |   6 +-
 tools/perf/trace/beauty/fsconfig.sh                |   7 +-
 tools/perf/util/jitdump.c                          |  30 +-
 tools/perf/util/session.c                          |  15 +-
 tools/perf/util/symbol_fprintf.c                   |   2 +-
 tools/power/x86/turbostat/turbostat.c              |  62 +--
 tools/spi/Makefile                                 |   5 +-
 tools/testing/selftests/bpf/Makefile               |   5 +-
 .../testing/selftests/bpf/prog_tests/core_reloc.c  |  51 ++-
 ...tf__core_reloc_existence___err_wrong_arr_kind.c |   3 -
 ...re_reloc_existence___err_wrong_arr_value_type.c |   3 -
 ...tf__core_reloc_existence___err_wrong_int_kind.c |   3 -
 .../btf__core_reloc_existence___err_wrong_int_sz.c |   3 -
 ...tf__core_reloc_existence___err_wrong_int_type.c |   3 -
 ..._core_reloc_existence___err_wrong_struct_type.c |   3 -
 .../btf__core_reloc_existence___wrong_field_defs.c |   3 +
 .../testing/selftests/bpf/progs/core_reloc_types.h |  20 +-
 .../testing/selftests/bpf/verifier/array_access.c  |   2 +-
 .../selftests/drivers/net/mlxsw/port_scale.sh      |   6 +-
 .../selftests/drivers/net/mlxsw/tc_flower_scale.sh |   6 +-
 tools/testing/selftests/kvm/dirty_log_test.c       |  69 ++-
 tools/testing/selftests/lib.mk                     |   3 +-
 .../net/forwarding/mirror_gre_vlan_bridge_1q.sh    |   2 +-
 tools/testing/selftests/x86/thunks_32.S            |   2 +
 virt/kvm/coalesced_mmio.c                          |  19 +-
 virt/kvm/kvm_main.c                                |  20 +-
 677 files changed, 6153 insertions(+), 3838 deletions(-)



^ permalink raw reply	[flat|nested] 702+ messages in thread

* [PATCH 5.12 001/677] Bluetooth: verify AMP hci_chan before amp_destroy
  2021-05-12 14:40 [PATCH 5.12 000/677] 5.12.4-rc1 review Greg Kroah-Hartman
@ 2021-05-12 14:40 ` Greg Kroah-Hartman
  2021-05-12 14:40 ` [PATCH 5.12 002/677] bluetooth: eliminate the potential race condition when removing the HCI controller Greg Kroah-Hartman
                   ` (683 subsequent siblings)
  684 siblings, 0 replies; 702+ messages in thread
From: Greg Kroah-Hartman @ 2021-05-12 14:40 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Archie Pusaka,
	syzbot+98228e7407314d2d4ba2, Alain Michaud,
	Abhishek Pandit-Subedi, Marcel Holtmann, George Kennedy

From: Archie Pusaka <apusaka@chromium.org>

commit 5c4c8c9544099bb9043a10a5318130a943e32fc3 upstream.

hci_chan can be created in 2 places: hci_loglink_complete_evt() if
it is an AMP hci_chan, or l2cap_conn_add() otherwise. In theory,
Only AMP hci_chan should be removed by a call to
hci_disconn_loglink_complete_evt(). However, the controller might mess
up, call that function, and destroy an hci_chan which is not initiated
by hci_loglink_complete_evt().

This patch adds a verification that the destroyed hci_chan must have
been init'd by hci_loglink_complete_evt().

Example crash call trace:
Call Trace:
 __dump_stack lib/dump_stack.c:77 [inline]
 dump_stack+0xe3/0x144 lib/dump_stack.c:118
 print_address_description+0x67/0x22a mm/kasan/report.c:256
 kasan_report_error mm/kasan/report.c:354 [inline]
 kasan_report mm/kasan/report.c:412 [inline]
 kasan_report+0x251/0x28f mm/kasan/report.c:396
 hci_send_acl+0x3b/0x56e net/bluetooth/hci_core.c:4072
 l2cap_send_cmd+0x5af/0x5c2 net/bluetooth/l2cap_core.c:877
 l2cap_send_move_chan_cfm_icid+0x8e/0xb1 net/bluetooth/l2cap_core.c:4661
 l2cap_move_fail net/bluetooth/l2cap_core.c:5146 [inline]
 l2cap_move_channel_rsp net/bluetooth/l2cap_core.c:5185 [inline]
 l2cap_bredr_sig_cmd net/bluetooth/l2cap_core.c:5464 [inline]
 l2cap_sig_channel net/bluetooth/l2cap_core.c:5799 [inline]
 l2cap_recv_frame+0x1d12/0x51aa net/bluetooth/l2cap_core.c:7023
 l2cap_recv_acldata+0x2ea/0x693 net/bluetooth/l2cap_core.c:7596
 hci_acldata_packet net/bluetooth/hci_core.c:4606 [inline]
 hci_rx_work+0x2bd/0x45e net/bluetooth/hci_core.c:4796
 process_one_work+0x6f8/0xb50 kernel/workqueue.c:2175
 worker_thread+0x4fc/0x670 kernel/workqueue.c:2321
 kthread+0x2f0/0x304 kernel/kthread.c:253
 ret_from_fork+0x3a/0x50 arch/x86/entry/entry_64.S:415

Allocated by task 38:
 set_track mm/kasan/kasan.c:460 [inline]
 kasan_kmalloc+0x8d/0x9a mm/kasan/kasan.c:553
 kmem_cache_alloc_trace+0x102/0x129 mm/slub.c:2787
 kmalloc include/linux/slab.h:515 [inline]
 kzalloc include/linux/slab.h:709 [inline]
 hci_chan_create+0x86/0x26d net/bluetooth/hci_conn.c:1674
 l2cap_conn_add.part.0+0x1c/0x814 net/bluetooth/l2cap_core.c:7062
 l2cap_conn_add net/bluetooth/l2cap_core.c:7059 [inline]
 l2cap_connect_cfm+0x134/0x852 net/bluetooth/l2cap_core.c:7381
 hci_connect_cfm+0x9d/0x122 include/net/bluetooth/hci_core.h:1404
 hci_remote_ext_features_evt net/bluetooth/hci_event.c:4161 [inline]
 hci_event_packet+0x463f/0x72fa net/bluetooth/hci_event.c:5981
 hci_rx_work+0x197/0x45e net/bluetooth/hci_core.c:4791
 process_one_work+0x6f8/0xb50 kernel/workqueue.c:2175
 worker_thread+0x4fc/0x670 kernel/workqueue.c:2321
 kthread+0x2f0/0x304 kernel/kthread.c:253
 ret_from_fork+0x3a/0x50 arch/x86/entry/entry_64.S:415

Freed by task 1732:
 set_track mm/kasan/kasan.c:460 [inline]
 __kasan_slab_free mm/kasan/kasan.c:521 [inline]
 __kasan_slab_free+0x106/0x128 mm/kasan/kasan.c:493
 slab_free_hook mm/slub.c:1409 [inline]
 slab_free_freelist_hook+0xaa/0xf6 mm/slub.c:1436
 slab_free mm/slub.c:3009 [inline]
 kfree+0x182/0x21e mm/slub.c:3972
 hci_disconn_loglink_complete_evt net/bluetooth/hci_event.c:4891 [inline]
 hci_event_packet+0x6a1c/0x72fa net/bluetooth/hci_event.c:6050
 hci_rx_work+0x197/0x45e net/bluetooth/hci_core.c:4791
 process_one_work+0x6f8/0xb50 kernel/workqueue.c:2175
 worker_thread+0x4fc/0x670 kernel/workqueue.c:2321
 kthread+0x2f0/0x304 kernel/kthread.c:253
 ret_from_fork+0x3a/0x50 arch/x86/entry/entry_64.S:415

The buggy address belongs to the object at ffff8881d7af9180
 which belongs to the cache kmalloc-128 of size 128
The buggy address is located 24 bytes inside of
 128-byte region [ffff8881d7af9180, ffff8881d7af9200)
The buggy address belongs to the page:
page:ffffea00075ebe40 count:1 mapcount:0 mapping:ffff8881da403200 index:0x0
flags: 0x8000000000000200(slab)
raw: 8000000000000200 dead000000000100 dead000000000200 ffff8881da403200
raw: 0000000000000000 0000000080150015 00000001ffffffff 0000000000000000
page dumped because: kasan: bad access detected

Memory state around the buggy address:
 ffff8881d7af9080: fc fc fc fc fc fc fc fc fb fb fb fb fb fb fb fb
 ffff8881d7af9100: fb fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc
>ffff8881d7af9180: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
                            ^
 ffff8881d7af9200: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
 ffff8881d7af9280: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc

Signed-off-by: Archie Pusaka <apusaka@chromium.org>
Reported-by: syzbot+98228e7407314d2d4ba2@syzkaller.appspotmail.com
Reviewed-by: Alain Michaud <alainm@chromium.org>
Reviewed-by: Abhishek Pandit-Subedi <abhishekpandit@chromium.org>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Cc: George Kennedy <george.kennedy@oracle.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 include/net/bluetooth/hci_core.h |    1 +
 net/bluetooth/hci_event.c        |    3 ++-
 2 files changed, 3 insertions(+), 1 deletion(-)

--- a/include/net/bluetooth/hci_core.h
+++ b/include/net/bluetooth/hci_core.h
@@ -704,6 +704,7 @@ struct hci_chan {
 	struct sk_buff_head data_q;
 	unsigned int	sent;
 	__u8		state;
+	bool		amp;
 };
 
 struct hci_conn_params {
--- a/net/bluetooth/hci_event.c
+++ b/net/bluetooth/hci_event.c
@@ -5005,6 +5005,7 @@ static void hci_loglink_complete_evt(str
 		return;
 
 	hchan->handle = le16_to_cpu(ev->handle);
+	hchan->amp = true;
 
 	BT_DBG("hcon %p mgr %p hchan %p", hcon, hcon->amp_mgr, hchan);
 
@@ -5037,7 +5038,7 @@ static void hci_disconn_loglink_complete
 	hci_dev_lock(hdev);
 
 	hchan = hci_chan_lookup_handle(hdev, le16_to_cpu(ev->handle));
-	if (!hchan)
+	if (!hchan || !hchan->amp)
 		goto unlock;
 
 	amp_destroy_logical_link(hchan, ev->reason);



^ permalink raw reply	[flat|nested] 702+ messages in thread

* [PATCH 5.12 002/677] bluetooth: eliminate the potential race condition when removing the HCI controller
  2021-05-12 14:40 [PATCH 5.12 000/677] 5.12.4-rc1 review Greg Kroah-Hartman
  2021-05-12 14:40 ` [PATCH 5.12 001/677] Bluetooth: verify AMP hci_chan before amp_destroy Greg Kroah-Hartman
@ 2021-05-12 14:40 ` Greg Kroah-Hartman
  2021-05-12 14:40 ` [PATCH 5.12 003/677] net/nfc: fix use-after-free llcp_sock_bind/connect Greg Kroah-Hartman
                   ` (682 subsequent siblings)
  684 siblings, 0 replies; 702+ messages in thread
From: Greg Kroah-Hartman @ 2021-05-12 14:40 UTC (permalink / raw)
  To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Lin Ma, Marcel Holtmann

From: Lin Ma <linma@zju.edu.cn>

commit e2cb6b891ad2b8caa9131e3be70f45243df82a80 upstream.

There is a possible race condition vulnerability between issuing a HCI
command and removing the cont.  Specifically, functions hci_req_sync()
and hci_dev_do_close() can race each other like below:

thread-A in hci_req_sync()      |   thread-B in hci_dev_do_close()
                                |   hci_req_sync_lock(hdev);
test_bit(HCI_UP, &hdev->flags); |
...                             |   test_and_clear_bit(HCI_UP, &hdev->flags)
hci_req_sync_lock(hdev);        |
                                |
In this commit we alter the sequence in function hci_req_sync(). Hence,
the thread-A cannot issue th.

Signed-off-by: Lin Ma <linma@zju.edu.cn>
Cc: Marcel Holtmann <marcel@holtmann.org>
Fixes: 7c6a329e4447 ("[Bluetooth] Fix regression from using default link policy")
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 net/bluetooth/hci_request.c |   12 ++++++++----
 1 file changed, 8 insertions(+), 4 deletions(-)

--- a/net/bluetooth/hci_request.c
+++ b/net/bluetooth/hci_request.c
@@ -272,12 +272,16 @@ int hci_req_sync(struct hci_dev *hdev, i
 {
 	int ret;
 
-	if (!test_bit(HCI_UP, &hdev->flags))
-		return -ENETDOWN;
-
 	/* Serialize all requests */
 	hci_req_sync_lock(hdev);
-	ret = __hci_req_sync(hdev, req, opt, timeout, hci_status);
+	/* check the state after obtaing the lock to protect the HCI_UP
+	 * against any races from hci_dev_do_close when the controller
+	 * gets removed.
+	 */
+	if (test_bit(HCI_UP, &hdev->flags))
+		ret = __hci_req_sync(hdev, req, opt, timeout, hci_status);
+	else
+		ret = -ENETDOWN;
 	hci_req_sync_unlock(hdev);
 
 	return ret;



^ permalink raw reply	[flat|nested] 702+ messages in thread

* [PATCH 5.12 003/677] net/nfc: fix use-after-free llcp_sock_bind/connect
  2021-05-12 14:40 [PATCH 5.12 000/677] 5.12.4-rc1 review Greg Kroah-Hartman
  2021-05-12 14:40 ` [PATCH 5.12 001/677] Bluetooth: verify AMP hci_chan before amp_destroy Greg Kroah-Hartman
  2021-05-12 14:40 ` [PATCH 5.12 002/677] bluetooth: eliminate the potential race condition when removing the HCI controller Greg Kroah-Hartman
@ 2021-05-12 14:40 ` Greg Kroah-Hartman
  2021-05-12 14:40 ` [PATCH 5.12 004/677] io_uring: truncate lengths larger than MAX_RW_COUNT on provide buffers Greg Kroah-Hartman
                   ` (681 subsequent siblings)
  684 siblings, 0 replies; 702+ messages in thread
From: Greg Kroah-Hartman @ 2021-05-12 14:40 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Or Cohen, Nadav Markus, David S. Miller

From: Or Cohen <orcohen@paloaltonetworks.com>

commit c61760e6940dd4039a7f5e84a6afc9cdbf4d82b6 upstream.

Commits 8a4cd82d ("nfc: fix refcount leak in llcp_sock_connect()")
and c33b1cc62 ("nfc: fix refcount leak in llcp_sock_bind()")
fixed a refcount leak bug in bind/connect but introduced a
use-after-free if the same local is assigned to 2 different sockets.

This can be triggered by the following simple program:
    int sock1 = socket( AF_NFC, SOCK_STREAM, NFC_SOCKPROTO_LLCP );
    int sock2 = socket( AF_NFC, SOCK_STREAM, NFC_SOCKPROTO_LLCP );
    memset( &addr, 0, sizeof(struct sockaddr_nfc_llcp) );
    addr.sa_family = AF_NFC;
    addr.nfc_protocol = NFC_PROTO_NFC_DEP;
    bind( sock1, (struct sockaddr*) &addr, sizeof(struct sockaddr_nfc_llcp) )
    bind( sock2, (struct sockaddr*) &addr, sizeof(struct sockaddr_nfc_llcp) )
    close(sock1);
    close(sock2);

Fix this by assigning NULL to llcp_sock->local after calling
nfc_llcp_local_put.

This addresses CVE-2021-23134.

Reported-by: Or Cohen <orcohen@paloaltonetworks.com>
Reported-by: Nadav Markus <nmarkus@paloaltonetworks.com>
Fixes: c33b1cc62 ("nfc: fix refcount leak in llcp_sock_bind()")
Signed-off-by: Or Cohen <orcohen@paloaltonetworks.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 net/nfc/llcp_sock.c |    4 ++++
 1 file changed, 4 insertions(+)

--- a/net/nfc/llcp_sock.c
+++ b/net/nfc/llcp_sock.c
@@ -109,12 +109,14 @@ static int llcp_sock_bind(struct socket
 					  GFP_KERNEL);
 	if (!llcp_sock->service_name) {
 		nfc_llcp_local_put(llcp_sock->local);
+		llcp_sock->local = NULL;
 		ret = -ENOMEM;
 		goto put_dev;
 	}
 	llcp_sock->ssap = nfc_llcp_get_sdp_ssap(local, llcp_sock);
 	if (llcp_sock->ssap == LLCP_SAP_MAX) {
 		nfc_llcp_local_put(llcp_sock->local);
+		llcp_sock->local = NULL;
 		kfree(llcp_sock->service_name);
 		llcp_sock->service_name = NULL;
 		ret = -EADDRINUSE;
@@ -709,6 +711,7 @@ static int llcp_sock_connect(struct sock
 	llcp_sock->ssap = nfc_llcp_get_local_ssap(local);
 	if (llcp_sock->ssap == LLCP_SAP_MAX) {
 		nfc_llcp_local_put(llcp_sock->local);
+		llcp_sock->local = NULL;
 		ret = -ENOMEM;
 		goto put_dev;
 	}
@@ -756,6 +759,7 @@ sock_unlink:
 sock_llcp_release:
 	nfc_llcp_put_ssap(local, llcp_sock->ssap);
 	nfc_llcp_local_put(llcp_sock->local);
+	llcp_sock->local = NULL;
 
 put_dev:
 	nfc_put_device(dev);



^ permalink raw reply	[flat|nested] 702+ messages in thread

* [PATCH 5.12 004/677] io_uring: truncate lengths larger than MAX_RW_COUNT on provide buffers
  2021-05-12 14:40 [PATCH 5.12 000/677] 5.12.4-rc1 review Greg Kroah-Hartman
                   ` (2 preceding siblings ...)
  2021-05-12 14:40 ` [PATCH 5.12 003/677] net/nfc: fix use-after-free llcp_sock_bind/connect Greg Kroah-Hartman
@ 2021-05-12 14:40 ` Greg Kroah-Hartman
  2021-05-12 14:40 ` [PATCH 5.12 005/677] coresight: etm-perf: Fix define build issue when built as module Greg Kroah-Hartman
                   ` (680 subsequent siblings)
  684 siblings, 0 replies; 702+ messages in thread
From: Greg Kroah-Hartman @ 2021-05-12 14:40 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Thadeu Lima de Souza Cascardo, Jens Axboe

From: Thadeu Lima de Souza Cascardo <cascardo@canonical.com>

commit d1f82808877bb10d3deee7cf3374a4eb3fb582db upstream.

Read and write operations are capped to MAX_RW_COUNT. Some read ops rely on
that limit, and that is not guaranteed by the IORING_OP_PROVIDE_BUFFERS.

Truncate those lengths when doing io_add_buffers, so buffer addresses still
use the uncapped length.

Also, take the chance and change struct io_buffer len member to __u32, so
it matches struct io_provide_buffer len member.

This fixes CVE-2021-3491, also reported as ZDI-CAN-13546.

Fixes: ddf0322db79c ("io_uring: add IORING_OP_PROVIDE_BUFFERS")
Reported-by: Billy Jheng Bing-Jhong (@st424204)
Signed-off-by: Thadeu Lima de Souza Cascardo <cascardo@canonical.com>
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 fs/io_uring.c |    4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

--- a/fs/io_uring.c
+++ b/fs/io_uring.c
@@ -238,7 +238,7 @@ struct fixed_rsrc_data {
 struct io_buffer {
 	struct list_head list;
 	__u64 addr;
-	__s32 len;
+	__u32 len;
 	__u16 bid;
 };
 
@@ -4017,7 +4017,7 @@ static int io_add_buffers(struct io_prov
 			break;
 
 		buf->addr = addr;
-		buf->len = pbuf->len;
+		buf->len = min_t(__u32, pbuf->len, MAX_RW_COUNT);
 		buf->bid = bid;
 		addr += pbuf->len;
 		bid++;



^ permalink raw reply	[flat|nested] 702+ messages in thread

* [PATCH 5.12 005/677] coresight: etm-perf: Fix define build issue when built as module
  2021-05-12 14:40 [PATCH 5.12 000/677] 5.12.4-rc1 review Greg Kroah-Hartman
                   ` (3 preceding siblings ...)
  2021-05-12 14:40 ` [PATCH 5.12 004/677] io_uring: truncate lengths larger than MAX_RW_COUNT on provide buffers Greg Kroah-Hartman
@ 2021-05-12 14:40 ` Greg Kroah-Hartman
  2021-05-12 14:40 ` [PATCH 5.12 006/677] software node: Allow node addition to already existing device Greg Kroah-Hartman
                   ` (679 subsequent siblings)
  684 siblings, 0 replies; 702+ messages in thread
From: Greg Kroah-Hartman @ 2021-05-12 14:40 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Leo Yan, Mike Leach, Mathieu Poirier

From: Mike Leach <mike.leach@linaro.org>

commit 9204ff94868496f2d9b8b173af52ec455160c364 upstream.

CONFIG_CORESIGHT_SOURCE_ETM4X is undefined when built as module,
CONFIG_CORESIGHT_SOURCE_ETM4X_MODULE is defined instead.

Therefore code in format_attr_contextid_show() not correctly complied
when coresight built as module.

Use IS_ENABLED(CONFIG_CORESIGHT_SOURCE_ETM4X) to correct this.

Link: https://lore.kernel.org/r/20210414194808.22872-1-mike.leach@linaro.org
Fixes: 88f11864cf1d ("coresight: etm-perf: Support PID tracing for kernel at EL2")
Reviewed-by: Leo Yan <leo.yan@linaro.org>
Signed-off-by: Mike Leach <mike.leach@linaro.org>
Signed-off-by: Mathieu Poirier <mathieu.poirier@linaro.org>
Cc: stable <stable@vger.kernel.org>
Link: https://lore.kernel.org/r/20210415202404.945368-2-mathieu.poirier@linaro.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/hwtracing/coresight/coresight-etm-perf.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

--- a/drivers/hwtracing/coresight/coresight-etm-perf.c
+++ b/drivers/hwtracing/coresight/coresight-etm-perf.c
@@ -52,7 +52,7 @@ static ssize_t format_attr_contextid_sho
 {
 	int pid_fmt = ETM_OPT_CTXTID;
 
-#if defined(CONFIG_CORESIGHT_SOURCE_ETM4X)
+#if IS_ENABLED(CONFIG_CORESIGHT_SOURCE_ETM4X)
 	pid_fmt = is_kernel_in_hyp_mode() ? ETM_OPT_CTXTID2 : ETM_OPT_CTXTID;
 #endif
 	return sprintf(page, "config:%d\n", pid_fmt);



^ permalink raw reply	[flat|nested] 702+ messages in thread

* [PATCH 5.12 006/677] software node: Allow node addition to already existing device
  2021-05-12 14:40 [PATCH 5.12 000/677] 5.12.4-rc1 review Greg Kroah-Hartman
                   ` (4 preceding siblings ...)
  2021-05-12 14:40 ` [PATCH 5.12 005/677] coresight: etm-perf: Fix define build issue when built as module Greg Kroah-Hartman
@ 2021-05-12 14:40 ` Greg Kroah-Hartman
  2021-05-12 14:40 ` [PATCH 5.12 007/677] Revert "USB: cdc-acm: fix rounding error in TIOCSSERIAL" Greg Kroah-Hartman
                   ` (678 subsequent siblings)
  684 siblings, 0 replies; 702+ messages in thread
From: Greg Kroah-Hartman @ 2021-05-12 14:40 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Pierre-Louis Bossart, Heikki Krogerus

From: Heikki Krogerus <heikki.krogerus@linux.intel.com>

commit b622b24519f5b008f6d4e20e5675eaffa8fbd87b upstream.

If the node is added to an already exiting device, the node
needs to be also linked to the device separately.

This will make sure the reference count is kept in balance
also when the node is injected to a device afterwards.

Fixes: e68d0119e328 ("software node: Introduce device_add_software_node()")
Reported-by: Pierre-Louis Bossart <pierre-louis.bossart@linux.intel.com>
Signed-off-by: Heikki Krogerus <heikki.krogerus@linux.intel.com>
Cc: stable <stable@vger.kernel.org>
Link: https://lore.kernel.org/r/20210414075438.64547-1-heikki.krogerus@linux.intel.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/base/swnode.c |    5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

--- a/drivers/base/swnode.c
+++ b/drivers/base/swnode.c
@@ -1032,6 +1032,7 @@ int device_add_software_node(struct devi
 	}
 
 	set_secondary_fwnode(dev, &swnode->fwnode);
+	software_node_notify(dev, KOBJ_ADD);
 
 	return 0;
 }
@@ -1105,8 +1106,8 @@ int software_node_notify(struct device *
 
 	switch (action) {
 	case KOBJ_ADD:
-		ret = sysfs_create_link(&dev->kobj, &swnode->kobj,
-					"software_node");
+		ret = sysfs_create_link_nowarn(&dev->kobj, &swnode->kobj,
+					       "software_node");
 		if (ret)
 			break;
 



^ permalink raw reply	[flat|nested] 702+ messages in thread

* [PATCH 5.12 007/677] Revert "USB: cdc-acm: fix rounding error in TIOCSSERIAL"
  2021-05-12 14:40 [PATCH 5.12 000/677] 5.12.4-rc1 review Greg Kroah-Hartman
                   ` (5 preceding siblings ...)
  2021-05-12 14:40 ` [PATCH 5.12 006/677] software node: Allow node addition to already existing device Greg Kroah-Hartman
@ 2021-05-12 14:40 ` Greg Kroah-Hartman
  2021-05-12 14:40 ` [PATCH 5.12 008/677] usb: roles: Call try_module_get() from usb_role_switch_find_by_fwnode() Greg Kroah-Hartman
                   ` (677 subsequent siblings)
  684 siblings, 0 replies; 702+ messages in thread
From: Greg Kroah-Hartman @ 2021-05-12 14:40 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Anthony Mallet, Oliver Neukum, Johan Hovold

From: Johan Hovold <johan@kernel.org>

commit 729f7955cb987c5b7d7e54c87c5ad71c789934f7 upstream.

This reverts commit b401f8c4f492cbf74f3f59c9141e5be3071071bb.

The offending commit claimed that trying to set the values reported back
by TIOCGSERIAL as a regular user could result in an -EPERM error when HZ
is 250, but that was never the case.

With HZ=250, the default 0.5 second value of close_delay is converted to
125 jiffies when set and is converted back to 50 centiseconds by
TIOCGSERIAL as expected (not 12 cs as was claimed, even if that was the
case before an earlier fix).

Comparing the internal current and new jiffies values is just fine to
determine if the value is about to change so drop the bogus workaround
(which was also backported to stable).

For completeness: With different default values for these parameters or
with a HZ value not divisible by two, the lack of rounding when setting
the default values in tty_port_init() could result in an -EPERM being
returned, but this is hardly something we need to worry about.

Cc: Anthony Mallet <anthony.mallet@laas.fr>
Cc: stable@vger.kernel.org
Acked-by: Oliver Neukum <oneukum@suse.com>
Signed-off-by: Johan Hovold <johan@kernel.org>
Link: https://lore.kernel.org/r/20210408131602.27956-2-johan@kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/usb/class/cdc-acm.c |   11 ++---------
 1 file changed, 2 insertions(+), 9 deletions(-)

--- a/drivers/usb/class/cdc-acm.c
+++ b/drivers/usb/class/cdc-acm.c
@@ -942,7 +942,6 @@ static int set_serial_info(struct tty_st
 {
 	struct acm *acm = tty->driver_data;
 	unsigned int closing_wait, close_delay;
-	unsigned int old_closing_wait, old_close_delay;
 	int retval = 0;
 
 	close_delay = msecs_to_jiffies(ss->close_delay * 10);
@@ -950,17 +949,11 @@ static int set_serial_info(struct tty_st
 			ASYNC_CLOSING_WAIT_NONE :
 			msecs_to_jiffies(ss->closing_wait * 10);
 
-	/* we must redo the rounding here, so that the values match */
-	old_close_delay	= jiffies_to_msecs(acm->port.close_delay) / 10;
-	old_closing_wait = acm->port.closing_wait == ASYNC_CLOSING_WAIT_NONE ?
-				ASYNC_CLOSING_WAIT_NONE :
-				jiffies_to_msecs(acm->port.closing_wait) / 10;
-
 	mutex_lock(&acm->port.mutex);
 
 	if (!capable(CAP_SYS_ADMIN)) {
-		if ((ss->close_delay != old_close_delay) ||
-		    (ss->closing_wait != old_closing_wait))
+		if ((close_delay != acm->port.close_delay) ||
+		    (closing_wait != acm->port.closing_wait))
 			retval = -EPERM;
 		else
 			retval = -EOPNOTSUPP;



^ permalink raw reply	[flat|nested] 702+ messages in thread

* [PATCH 5.12 008/677] usb: roles: Call try_module_get() from usb_role_switch_find_by_fwnode()
  2021-05-12 14:40 [PATCH 5.12 000/677] 5.12.4-rc1 review Greg Kroah-Hartman
                   ` (6 preceding siblings ...)
  2021-05-12 14:40 ` [PATCH 5.12 007/677] Revert "USB: cdc-acm: fix rounding error in TIOCSSERIAL" Greg Kroah-Hartman
@ 2021-05-12 14:40 ` Greg Kroah-Hartman
  2021-05-12 14:40 ` [PATCH 5.12 009/677] tty: moxa: fix TIOCSSERIAL jiffies conversions Greg Kroah-Hartman
                   ` (676 subsequent siblings)
  684 siblings, 0 replies; 702+ messages in thread
From: Greg Kroah-Hartman @ 2021-05-12 14:40 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Guenter Roeck, Heikki Krogerus,
	Hans de Goede

From: Hans de Goede <hdegoede@redhat.com>

commit 3a2a91a2d51761557843996a66098eb7182b48b4 upstream.

usb_role_switch_find_by_fwnode() returns a reference to the role-switch
which must be put by calling usb_role_switch_put().

usb_role_switch_put() calls module_put(sw->dev.parent->driver->owner),
add a matching try_module_get() to usb_role_switch_find_by_fwnode(),
making it behave the same as the other usb_role_switch functions
which return a reference.

This avoids a WARN_ON being hit at kernel/module.c:1158 due to the
module-refcount going below 0.

Fixes: c6919d5e0cd1 ("usb: roles: Add usb_role_switch_find_by_fwnode()")
Cc: stable <stable@vger.kernel.org>
Reviewed-by: Guenter Roeck <linux@roeck-us.net>
Reviewed-by: Heikki Krogerus <heikki.krogerus@linux.intel.com>
Signed-off-by: Hans de Goede <hdegoede@redhat.com>
Link: https://lore.kernel.org/r/20210409124136.65591-1-hdegoede@redhat.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/usb/roles/class.c |    2 ++
 1 file changed, 2 insertions(+)

--- a/drivers/usb/roles/class.c
+++ b/drivers/usb/roles/class.c
@@ -189,6 +189,8 @@ usb_role_switch_find_by_fwnode(const str
 		return NULL;
 
 	dev = class_find_device_by_fwnode(role_class, fwnode);
+	if (dev)
+		WARN_ON(!try_module_get(dev->parent->driver->owner));
 
 	return dev ? to_role_switch(dev) : NULL;
 }



^ permalink raw reply	[flat|nested] 702+ messages in thread

* [PATCH 5.12 009/677] tty: moxa: fix TIOCSSERIAL jiffies conversions
  2021-05-12 14:40 [PATCH 5.12 000/677] 5.12.4-rc1 review Greg Kroah-Hartman
                   ` (7 preceding siblings ...)
  2021-05-12 14:40 ` [PATCH 5.12 008/677] usb: roles: Call try_module_get() from usb_role_switch_find_by_fwnode() Greg Kroah-Hartman
@ 2021-05-12 14:40 ` Greg Kroah-Hartman
  2021-05-12 14:40 ` [PATCH 5.12 010/677] tty: amiserial: fix TIOCSSERIAL permission check Greg Kroah-Hartman
                   ` (675 subsequent siblings)
  684 siblings, 0 replies; 702+ messages in thread
From: Greg Kroah-Hartman @ 2021-05-12 14:40 UTC (permalink / raw)
  To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Johan Hovold

From: Johan Hovold <johan@kernel.org>

commit 6e70b73ca5240c0059a1fbf8ccd4276d6cf71956 upstream.

The port close_delay parameter set by TIOCSSERIAL is specified in
jiffies, while the value returned by TIOCGSERIAL is specified in
centiseconds.

Add the missing conversions so that TIOCGSERIAL works as expected also
when HZ is not 100.

Cc: stable@vger.kernel.org
Signed-off-by: Johan Hovold <johan@kernel.org>
Link: https://lore.kernel.org/r/20210407102334.32361-11-johan@kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/tty/moxa.c |    4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

--- a/drivers/tty/moxa.c
+++ b/drivers/tty/moxa.c
@@ -2040,7 +2040,7 @@ static int moxa_get_serial_info(struct t
 	ss->line = info->port.tty->index,
 	ss->flags = info->port.flags,
 	ss->baud_base = 921600,
-	ss->close_delay = info->port.close_delay;
+	ss->close_delay = jiffies_to_msecs(info->port.close_delay) / 10;
 	mutex_unlock(&info->port.mutex);
 	return 0;
 }
@@ -2069,7 +2069,7 @@ static int moxa_set_serial_info(struct t
 			return -EPERM;
 		}
 	}
-	info->port.close_delay = ss->close_delay * HZ / 100;
+	info->port.close_delay = msecs_to_jiffies(ss->close_delay * 10);
 
 	MoxaSetFifo(info, ss->type == PORT_16550A);
 



^ permalink raw reply	[flat|nested] 702+ messages in thread

* [PATCH 5.12 010/677] tty: amiserial: fix TIOCSSERIAL permission check
  2021-05-12 14:40 [PATCH 5.12 000/677] 5.12.4-rc1 review Greg Kroah-Hartman
                   ` (8 preceding siblings ...)
  2021-05-12 14:40 ` [PATCH 5.12 009/677] tty: moxa: fix TIOCSSERIAL jiffies conversions Greg Kroah-Hartman
@ 2021-05-12 14:40 ` Greg Kroah-Hartman
  2021-05-12 14:40 ` [PATCH 5.12 011/677] USB: serial: usb_wwan: fix TIOCSSERIAL jiffies conversions Greg Kroah-Hartman
                   ` (674 subsequent siblings)
  684 siblings, 0 replies; 702+ messages in thread
From: Greg Kroah-Hartman @ 2021-05-12 14:40 UTC (permalink / raw)
  To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Johan Hovold

From: Johan Hovold <johan@kernel.org>

commit 1d31a831cc04f5f942de3e7d91edaa52310d3c99 upstream.

Changing the port closing_wait parameter is a privileged operation.

Add the missing check to TIOCSSERIAL so that -EPERM is returned in case
an unprivileged user tries to change the closing-wait setting.

Cc: stable@vger.kernel.org
Signed-off-by: Johan Hovold <johan@kernel.org>
Link: https://lore.kernel.org/r/20210407102334.32361-9-johan@kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/tty/amiserial.c |    1 +
 1 file changed, 1 insertion(+)

--- a/drivers/tty/amiserial.c
+++ b/drivers/tty/amiserial.c
@@ -970,6 +970,7 @@ static int set_serial_info(struct tty_st
 	if (!serial_isroot()) {
 		if ((ss->baud_base != state->baud_base) ||
 		    (ss->close_delay != port->close_delay) ||
+		    (ss->closing_wait != port->closing_wait) ||
 		    (ss->xmit_fifo_size != state->xmit_fifo_size) ||
 		    ((ss->flags & ~ASYNC_USR_MASK) !=
 		     (port->flags & ~ASYNC_USR_MASK))) {



^ permalink raw reply	[flat|nested] 702+ messages in thread

* [PATCH 5.12 011/677] USB: serial: usb_wwan: fix TIOCSSERIAL jiffies conversions
  2021-05-12 14:40 [PATCH 5.12 000/677] 5.12.4-rc1 review Greg Kroah-Hartman
                   ` (9 preceding siblings ...)
  2021-05-12 14:40 ` [PATCH 5.12 010/677] tty: amiserial: fix TIOCSSERIAL permission check Greg Kroah-Hartman
@ 2021-05-12 14:40 ` Greg Kroah-Hartman
  2021-05-12 14:40 ` [PATCH 5.12 012/677] staging: greybus: uart: " Greg Kroah-Hartman
                   ` (673 subsequent siblings)
  684 siblings, 0 replies; 702+ messages in thread
From: Greg Kroah-Hartman @ 2021-05-12 14:40 UTC (permalink / raw)
  To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Johan Hovold

From: Johan Hovold <johan@kernel.org>

commit 3d732690d2267f4d0e19077b178dffbedafdf0c9 upstream.

The port close_delay and closing_wait parameters set by TIOCSSERIAL are
specified in jiffies and not milliseconds.

Add the missing conversions so that the TIOCSSERIAL works as expected
also when HZ is not 1000.

Fixes: 02303f73373a ("usb-wwan: implement TIOCGSERIAL and TIOCSSERIAL to avoid blocking close(2)")
Cc: stable@vger.kernel.org      # 2.6.38
Reviewed-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Johan Hovold <johan@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/usb/serial/usb_wwan.c |    9 +++++----
 1 file changed, 5 insertions(+), 4 deletions(-)

--- a/drivers/usb/serial/usb_wwan.c
+++ b/drivers/usb/serial/usb_wwan.c
@@ -140,10 +140,10 @@ int usb_wwan_get_serial_info(struct tty_
 	ss->line            = port->minor;
 	ss->port            = port->port_number;
 	ss->baud_base       = tty_get_baud_rate(port->port.tty);
-	ss->close_delay	    = port->port.close_delay / 10;
+	ss->close_delay	    = jiffies_to_msecs(port->port.close_delay) / 10;
 	ss->closing_wait    = port->port.closing_wait == ASYNC_CLOSING_WAIT_NONE ?
 				 ASYNC_CLOSING_WAIT_NONE :
-				 port->port.closing_wait / 10;
+				 jiffies_to_msecs(port->port.closing_wait) / 10;
 	return 0;
 }
 EXPORT_SYMBOL(usb_wwan_get_serial_info);
@@ -155,9 +155,10 @@ int usb_wwan_set_serial_info(struct tty_
 	unsigned int closing_wait, close_delay;
 	int retval = 0;
 
-	close_delay = ss->close_delay * 10;
+	close_delay = msecs_to_jiffies(ss->close_delay * 10);
 	closing_wait = ss->closing_wait == ASYNC_CLOSING_WAIT_NONE ?
-			ASYNC_CLOSING_WAIT_NONE : ss->closing_wait * 10;
+			ASYNC_CLOSING_WAIT_NONE :
+			msecs_to_jiffies(ss->closing_wait * 10);
 
 	mutex_lock(&port->port.mutex);
 



^ permalink raw reply	[flat|nested] 702+ messages in thread

* [PATCH 5.12 012/677] staging: greybus: uart: fix TIOCSSERIAL jiffies conversions
  2021-05-12 14:40 [PATCH 5.12 000/677] 5.12.4-rc1 review Greg Kroah-Hartman
                   ` (10 preceding siblings ...)
  2021-05-12 14:40 ` [PATCH 5.12 011/677] USB: serial: usb_wwan: fix TIOCSSERIAL jiffies conversions Greg Kroah-Hartman
@ 2021-05-12 14:40 ` Greg Kroah-Hartman
  2021-05-12 14:40 ` [PATCH 5.12 013/677] USB: serial: ti_usb_3410_5052: fix TIOCSSERIAL permission check Greg Kroah-Hartman
                   ` (672 subsequent siblings)
  684 siblings, 0 replies; 702+ messages in thread
From: Greg Kroah-Hartman @ 2021-05-12 14:40 UTC (permalink / raw)
  To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Johan Hovold

From: Johan Hovold <johan@kernel.org>

commit b71e571adaa58be4fd289abebc8997e05b4c6b40 upstream.

The port close_delay and closing_wait parameters set by TIOCSSERIAL are
specified in jiffies and not milliseconds.

Add the missing conversions so that TIOCSSERIAL works as expected also
when HZ is not 1000.

Fixes: e68453ed28c5 ("greybus: uart-gb: now builds, more framework added")
Cc: stable@vger.kernel.org	# 4.9
Signed-off-by: Johan Hovold <johan@kernel.org>
Link: https://lore.kernel.org/r/20210407102334.32361-6-johan@kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/staging/greybus/uart.c |   11 +++++++----
 1 file changed, 7 insertions(+), 4 deletions(-)

--- a/drivers/staging/greybus/uart.c
+++ b/drivers/staging/greybus/uart.c
@@ -614,10 +614,12 @@ static int get_serial_info(struct tty_st
 	ss->line = gb_tty->minor;
 	ss->xmit_fifo_size = 16;
 	ss->baud_base = 9600;
-	ss->close_delay = gb_tty->port.close_delay / 10;
+	ss->close_delay = jiffies_to_msecs(gb_tty->port.close_delay) / 10;
 	ss->closing_wait =
 		gb_tty->port.closing_wait == ASYNC_CLOSING_WAIT_NONE ?
-		ASYNC_CLOSING_WAIT_NONE : gb_tty->port.closing_wait / 10;
+		ASYNC_CLOSING_WAIT_NONE :
+		jiffies_to_msecs(gb_tty->port.closing_wait) / 10;
+
 	return 0;
 }
 
@@ -629,9 +631,10 @@ static int set_serial_info(struct tty_st
 	unsigned int close_delay;
 	int retval = 0;
 
-	close_delay = ss->close_delay * 10;
+	close_delay = msecs_to_jiffies(ss->close_delay * 10);
 	closing_wait = ss->closing_wait == ASYNC_CLOSING_WAIT_NONE ?
-			ASYNC_CLOSING_WAIT_NONE : ss->closing_wait * 10;
+			ASYNC_CLOSING_WAIT_NONE :
+			msecs_to_jiffies(ss->closing_wait * 10);
 
 	mutex_lock(&gb_tty->port.mutex);
 	if (!capable(CAP_SYS_ADMIN)) {



^ permalink raw reply	[flat|nested] 702+ messages in thread

* [PATCH 5.12 013/677] USB: serial: ti_usb_3410_5052: fix TIOCSSERIAL permission check
  2021-05-12 14:40 [PATCH 5.12 000/677] 5.12.4-rc1 review Greg Kroah-Hartman
                   ` (11 preceding siblings ...)
  2021-05-12 14:40 ` [PATCH 5.12 012/677] staging: greybus: uart: " Greg Kroah-Hartman
@ 2021-05-12 14:40 ` Greg Kroah-Hartman
  2021-05-12 14:41 ` [PATCH 5.12 014/677] staging: fwserial: fix TIOCSSERIAL jiffies conversions Greg Kroah-Hartman
                   ` (671 subsequent siblings)
  684 siblings, 0 replies; 702+ messages in thread
From: Greg Kroah-Hartman @ 2021-05-12 14:40 UTC (permalink / raw)
  To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Johan Hovold

From: Johan Hovold <johan@kernel.org>

commit d370c90dcd64e427a79a093a070117a1571d4cd8 upstream.

Changing the port closing-wait parameter is a privileged operation so
make sure to return -EPERM if a regular user tries to change it.

Cc: stable@vger.kernel.org
Reviewed-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Johan Hovold <johan@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/usb/serial/ti_usb_3410_5052.c |    9 +++++++--
 1 file changed, 7 insertions(+), 2 deletions(-)

--- a/drivers/usb/serial/ti_usb_3410_5052.c
+++ b/drivers/usb/serial/ti_usb_3410_5052.c
@@ -1418,14 +1418,19 @@ static int ti_set_serial_info(struct tty
 	struct serial_struct *ss)
 {
 	struct usb_serial_port *port = tty->driver_data;
-	struct ti_port *tport = usb_get_serial_port_data(port);
+	struct tty_port *tport = &port->port;
 	unsigned cwait;
 
 	cwait = ss->closing_wait;
 	if (cwait != ASYNC_CLOSING_WAIT_NONE)
 		cwait = msecs_to_jiffies(10 * ss->closing_wait);
 
-	tport->tp_port->port.closing_wait = cwait;
+	if (!capable(CAP_SYS_ADMIN)) {
+		if (cwait != tport->closing_wait)
+			return -EPERM;
+	}
+
+	tport->closing_wait = cwait;
 
 	return 0;
 }



^ permalink raw reply	[flat|nested] 702+ messages in thread

* [PATCH 5.12 014/677] staging: fwserial: fix TIOCSSERIAL jiffies conversions
  2021-05-12 14:40 [PATCH 5.12 000/677] 5.12.4-rc1 review Greg Kroah-Hartman
                   ` (12 preceding siblings ...)
  2021-05-12 14:40 ` [PATCH 5.12 013/677] USB: serial: ti_usb_3410_5052: fix TIOCSSERIAL permission check Greg Kroah-Hartman
@ 2021-05-12 14:41 ` Greg Kroah-Hartman
  2021-05-12 14:41 ` [PATCH 5.12 015/677] tty: moxa: fix TIOCSSERIAL permission check Greg Kroah-Hartman
                   ` (670 subsequent siblings)
  684 siblings, 0 replies; 702+ messages in thread
From: Greg Kroah-Hartman @ 2021-05-12 14:41 UTC (permalink / raw)
  To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Johan Hovold

From: Johan Hovold <johan@kernel.org>

commit 7a3791afdbd5a951b09a7689bba856bd9f6c6a9f upstream.

The port close_delay parameter set by TIOCSSERIAL is specified in
jiffies, while the value returned by TIOCGSERIAL is specified in
centiseconds.

Add the missing conversions so that TIOCGSERIAL works as expected also
when HZ is not 100.

Fixes: 7355ba3445f2 ("staging: fwserial: Add TTY-over-Firewire serial driver")
Cc: stable@vger.kernel.org      # 3.8
Signed-off-by: Johan Hovold <johan@kernel.org>
Link: https://lore.kernel.org/r/20210407102334.32361-2-johan@kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/staging/fwserial/fwserial.c |    4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

--- a/drivers/staging/fwserial/fwserial.c
+++ b/drivers/staging/fwserial/fwserial.c
@@ -1223,7 +1223,7 @@ static int get_serial_info(struct tty_st
 	ss->flags = port->port.flags;
 	ss->xmit_fifo_size = FWTTY_PORT_TXFIFO_LEN;
 	ss->baud_base = 400000000;
-	ss->close_delay = port->port.close_delay;
+	ss->close_delay = jiffies_to_msecs(port->port.close_delay) / 10;
 	mutex_unlock(&port->port.mutex);
 	return 0;
 }
@@ -1245,7 +1245,7 @@ static int set_serial_info(struct tty_st
 			return -EPERM;
 		}
 	}
-	port->port.close_delay = ss->close_delay * HZ / 100;
+	port->port.close_delay = msecs_to_jiffies(ss->close_delay * 10);
 	mutex_unlock(&port->port.mutex);
 
 	return 0;



^ permalink raw reply	[flat|nested] 702+ messages in thread

* [PATCH 5.12 015/677] tty: moxa: fix TIOCSSERIAL permission check
  2021-05-12 14:40 [PATCH 5.12 000/677] 5.12.4-rc1 review Greg Kroah-Hartman
                   ` (13 preceding siblings ...)
  2021-05-12 14:41 ` [PATCH 5.12 014/677] staging: fwserial: fix TIOCSSERIAL jiffies conversions Greg Kroah-Hartman
@ 2021-05-12 14:41 ` Greg Kroah-Hartman
  2021-05-12 14:41 ` [PATCH 5.12 016/677] tty: mxser: fix TIOCSSERIAL jiffies conversions Greg Kroah-Hartman
                   ` (669 subsequent siblings)
  684 siblings, 0 replies; 702+ messages in thread
From: Greg Kroah-Hartman @ 2021-05-12 14:41 UTC (permalink / raw)
  To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Johan Hovold

From: Johan Hovold <johan@kernel.org>

commit dc8c8437658667be9b11ec25c4b5482ed2becdaa upstream.

Changing the port close delay or type are privileged operations so make
sure to return -EPERM if a regular user tries to change them.

Cc: stable@vger.kernel.org
Signed-off-by: Johan Hovold <johan@kernel.org>
Link: https://lore.kernel.org/r/20210407102334.32361-12-johan@kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/tty/moxa.c |   16 +++++++++++-----
 1 file changed, 11 insertions(+), 5 deletions(-)

--- a/drivers/tty/moxa.c
+++ b/drivers/tty/moxa.c
@@ -2050,6 +2050,7 @@ static int moxa_set_serial_info(struct t
 		struct serial_struct *ss)
 {
 	struct moxa_port *info = tty->driver_data;
+	unsigned int close_delay;
 
 	if (tty->index == MAX_PORTS)
 		return -EINVAL;
@@ -2061,19 +2062,24 @@ static int moxa_set_serial_info(struct t
 			ss->baud_base != 921600)
 		return -EPERM;
 
+	close_delay = msecs_to_jiffies(ss->close_delay * 10);
+
 	mutex_lock(&info->port.mutex);
 	if (!capable(CAP_SYS_ADMIN)) {
-		if (((ss->flags & ~ASYNC_USR_MASK) !=
+		if (close_delay != info->port.close_delay ||
+		    ss->type != info->type ||
+		    ((ss->flags & ~ASYNC_USR_MASK) !=
 		     (info->port.flags & ~ASYNC_USR_MASK))) {
 			mutex_unlock(&info->port.mutex);
 			return -EPERM;
 		}
-	}
-	info->port.close_delay = msecs_to_jiffies(ss->close_delay * 10);
+	} else {
+		info->port.close_delay = close_delay;
 
-	MoxaSetFifo(info, ss->type == PORT_16550A);
+		MoxaSetFifo(info, ss->type == PORT_16550A);
 
-	info->type = ss->type;
+		info->type = ss->type;
+	}
 	mutex_unlock(&info->port.mutex);
 	return 0;
 }



^ permalink raw reply	[flat|nested] 702+ messages in thread

* [PATCH 5.12 016/677] tty: mxser: fix TIOCSSERIAL jiffies conversions
  2021-05-12 14:40 [PATCH 5.12 000/677] 5.12.4-rc1 review Greg Kroah-Hartman
                   ` (14 preceding siblings ...)
  2021-05-12 14:41 ` [PATCH 5.12 015/677] tty: moxa: fix TIOCSSERIAL permission check Greg Kroah-Hartman
@ 2021-05-12 14:41 ` Greg Kroah-Hartman
  2021-05-12 14:41 ` [PATCH 5.12 017/677] staging: fwserial: fix TIOCSSERIAL permission check Greg Kroah-Hartman
                   ` (668 subsequent siblings)
  684 siblings, 0 replies; 702+ messages in thread
From: Greg Kroah-Hartman @ 2021-05-12 14:41 UTC (permalink / raw)
  To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Johan Hovold

From: Johan Hovold <johan@kernel.org>

commit be6cf583d24dfe87324dd2830d90fc056e0a6648 upstream.

The port close_delay and closing wait parameters set by TIOCSSERIAL are
specified in jiffies, while the values returned by TIOCGSERIAL are
specified in centiseconds.

Add the missing conversions so that TIOCSSERIAL works as expected also
when HZ is not 100.

Cc: stable@vger.kernel.org
Signed-off-by: Johan Hovold <johan@kernel.org>
Link: https://lore.kernel.org/r/20210407102334.32361-14-johan@kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/tty/mxser.c |   24 ++++++++++++++++++------
 1 file changed, 18 insertions(+), 6 deletions(-)

--- a/drivers/tty/mxser.c
+++ b/drivers/tty/mxser.c
@@ -1208,19 +1208,26 @@ static int mxser_get_serial_info(struct
 {
 	struct mxser_port *info = tty->driver_data;
 	struct tty_port *port = &info->port;
+	unsigned int closing_wait, close_delay;
 
 	if (tty->index == MXSER_PORTS)
 		return -ENOTTY;
 
 	mutex_lock(&port->mutex);
+
+	close_delay = jiffies_to_msecs(info->port.close_delay) / 10;
+	closing_wait = info->port.closing_wait;
+	if (closing_wait != ASYNC_CLOSING_WAIT_NONE)
+		closing_wait = jiffies_to_msecs(closing_wait) / 10;
+
 	ss->type = info->type,
 	ss->line = tty->index,
 	ss->port = info->ioaddr,
 	ss->irq = info->board->irq,
 	ss->flags = info->port.flags,
 	ss->baud_base = info->baud_base,
-	ss->close_delay = info->port.close_delay,
-	ss->closing_wait = info->port.closing_wait,
+	ss->close_delay = close_delay;
+	ss->closing_wait = closing_wait;
 	ss->custom_divisor = info->custom_divisor,
 	mutex_unlock(&port->mutex);
 	return 0;
@@ -1233,7 +1240,7 @@ static int mxser_set_serial_info(struct
 	struct tty_port *port = &info->port;
 	speed_t baud;
 	unsigned long sl_flags;
-	unsigned int flags;
+	unsigned int flags, close_delay, closing_wait;
 	int retval = 0;
 
 	if (tty->index == MXSER_PORTS)
@@ -1255,9 +1262,14 @@ static int mxser_set_serial_info(struct
 
 	flags = port->flags & ASYNC_SPD_MASK;
 
+	close_delay = msecs_to_jiffies(ss->close_delay * 10);
+	closing_wait = ss->closing_wait;
+	if (closing_wait != ASYNC_CLOSING_WAIT_NONE)
+		closing_wait = msecs_to_jiffies(closing_wait * 10);
+
 	if (!capable(CAP_SYS_ADMIN)) {
 		if ((ss->baud_base != info->baud_base) ||
-				(ss->close_delay != info->port.close_delay) ||
+				(close_delay != info->port.close_delay) ||
 				((ss->flags & ~ASYNC_USR_MASK) != (info->port.flags & ~ASYNC_USR_MASK))) {
 			mutex_unlock(&port->mutex);
 			return -EPERM;
@@ -1271,8 +1283,8 @@ static int mxser_set_serial_info(struct
 		 */
 		port->flags = ((port->flags & ~ASYNC_FLAGS) |
 				(ss->flags & ASYNC_FLAGS));
-		port->close_delay = ss->close_delay * HZ / 100;
-		port->closing_wait = ss->closing_wait * HZ / 100;
+		port->close_delay = close_delay;
+		port->closing_wait = closing_wait;
 		if ((port->flags & ASYNC_SPD_MASK) == ASYNC_SPD_CUST &&
 				(ss->baud_base != info->baud_base ||
 				ss->custom_divisor !=



^ permalink raw reply	[flat|nested] 702+ messages in thread

* [PATCH 5.12 017/677] staging: fwserial: fix TIOCSSERIAL permission check
  2021-05-12 14:40 [PATCH 5.12 000/677] 5.12.4-rc1 review Greg Kroah-Hartman
                   ` (15 preceding siblings ...)
  2021-05-12 14:41 ` [PATCH 5.12 016/677] tty: mxser: fix TIOCSSERIAL jiffies conversions Greg Kroah-Hartman
@ 2021-05-12 14:41 ` Greg Kroah-Hartman
  2021-05-12 14:41 ` [PATCH 5.12 018/677] tty: mxser: " Greg Kroah-Hartman
                   ` (667 subsequent siblings)
  684 siblings, 0 replies; 702+ messages in thread
From: Greg Kroah-Hartman @ 2021-05-12 14:41 UTC (permalink / raw)
  To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Johan Hovold

From: Johan Hovold <johan@kernel.org>

commit 2104eb283df66a482b60254299acbe3c68c03412 upstream.

Changing the port close-delay parameter is a privileged operation so
make sure to return -EPERM if a regular user tries to change it.

Fixes: 7355ba3445f2 ("staging: fwserial: Add TTY-over-Firewire serial driver")
Cc: stable@vger.kernel.org      # 3.8
Signed-off-by: Johan Hovold <johan@kernel.org>
Link: https://lore.kernel.org/r/20210407102334.32361-3-johan@kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/staging/fwserial/fwserial.c |    8 ++++++--
 1 file changed, 6 insertions(+), 2 deletions(-)

--- a/drivers/staging/fwserial/fwserial.c
+++ b/drivers/staging/fwserial/fwserial.c
@@ -1232,20 +1232,24 @@ static int set_serial_info(struct tty_st
 			   struct serial_struct *ss)
 {
 	struct fwtty_port *port = tty->driver_data;
+	unsigned int cdelay;
 
 	if (ss->irq != 0 || ss->port != 0 || ss->custom_divisor != 0 ||
 	    ss->baud_base != 400000000)
 		return -EPERM;
 
+	cdelay = msecs_to_jiffies(ss->close_delay * 10);
+
 	mutex_lock(&port->port.mutex);
 	if (!capable(CAP_SYS_ADMIN)) {
-		if (((ss->flags & ~ASYNC_USR_MASK) !=
+		if (cdelay != port->port.close_delay ||
+		    ((ss->flags & ~ASYNC_USR_MASK) !=
 		     (port->port.flags & ~ASYNC_USR_MASK))) {
 			mutex_unlock(&port->port.mutex);
 			return -EPERM;
 		}
 	}
-	port->port.close_delay = msecs_to_jiffies(ss->close_delay * 10);
+	port->port.close_delay = cdelay;
 	mutex_unlock(&port->port.mutex);
 
 	return 0;



^ permalink raw reply	[flat|nested] 702+ messages in thread

* [PATCH 5.12 018/677] tty: mxser: fix TIOCSSERIAL permission check
  2021-05-12 14:40 [PATCH 5.12 000/677] 5.12.4-rc1 review Greg Kroah-Hartman
                   ` (16 preceding siblings ...)
  2021-05-12 14:41 ` [PATCH 5.12 017/677] staging: fwserial: fix TIOCSSERIAL permission check Greg Kroah-Hartman
@ 2021-05-12 14:41 ` Greg Kroah-Hartman
  2021-05-12 14:41   ` Greg Kroah-Hartman
                   ` (666 subsequent siblings)
  684 siblings, 0 replies; 702+ messages in thread
From: Greg Kroah-Hartman @ 2021-05-12 14:41 UTC (permalink / raw)
  To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Johan Hovold

From: Johan Hovold <johan@kernel.org>

commit b91cfb2573aeb5ab426fc3c35bcfe9e0d2a7ecbc upstream.

Changing the port type and closing_wait parameter are privileged
operations so make sure to return -EPERM if a regular user tries to
change them.

Note that the closing_wait parameter would not actually have been
changed but the return value did not indicate that.

Cc: stable@vger.kernel.org
Signed-off-by: Johan Hovold <johan@kernel.org>
Link: https://lore.kernel.org/r/20210407102334.32361-15-johan@kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/tty/mxser.c |    7 ++++---
 1 file changed, 4 insertions(+), 3 deletions(-)

--- a/drivers/tty/mxser.c
+++ b/drivers/tty/mxser.c
@@ -1270,6 +1270,7 @@ static int mxser_set_serial_info(struct
 	if (!capable(CAP_SYS_ADMIN)) {
 		if ((ss->baud_base != info->baud_base) ||
 				(close_delay != info->port.close_delay) ||
+				(closing_wait != info->port.closing_wait) ||
 				((ss->flags & ~ASYNC_USR_MASK) != (info->port.flags & ~ASYNC_USR_MASK))) {
 			mutex_unlock(&port->mutex);
 			return -EPERM;
@@ -1296,11 +1297,11 @@ static int mxser_set_serial_info(struct
 			baud = ss->baud_base / ss->custom_divisor;
 			tty_encode_baud_rate(tty, baud, baud);
 		}
-	}
 
-	info->type = ss->type;
+		info->type = ss->type;
 
-	process_txrx_fifo(info);
+		process_txrx_fifo(info);
+	}
 
 	if (tty_port_initialized(port)) {
 		if (flags != (port->flags & ASYNC_SPD_MASK)) {



^ permalink raw reply	[flat|nested] 702+ messages in thread

* [PATCH 5.12 019/677] drm: bridge: fix LONTIUM use of mipi_dsi_() functions
  2021-05-12 14:40 [PATCH 5.12 000/677] 5.12.4-rc1 review Greg Kroah-Hartman
@ 2021-05-12 14:41   ` Greg Kroah-Hartman
  2021-05-12 14:40 ` [PATCH 5.12 002/677] bluetooth: eliminate the potential race condition when removing the HCI controller Greg Kroah-Hartman
                     ` (683 subsequent siblings)
  684 siblings, 0 replies; 702+ messages in thread
From: Greg Kroah-Hartman @ 2021-05-12 14:41 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, kernel test robot, Randy Dunlap,
	Adren Grassein, Dmitry Baryshkov, Sam Ravnborg, Vinod Koul,
	Bjorn Andersson, Srinivas Kandagatla, Andrzej Hajda,
	Neil Armstrong, Robert Foss, dri-devel

From: Randy Dunlap <rdunlap@infradead.org>

commit ad085b3a712a89e4a48472121b231add7a8362e4 upstream.

The Lontium DRM bridge drivers use mipi_dsi_() function interfaces so
they need to select DRM_MIPI_DSI to prevent build errors.

ERROR: modpost: "mipi_dsi_attach" [drivers/gpu/drm/bridge/lontium-lt9611uxc.ko] undefined!
ERROR: modpost: "mipi_dsi_device_register_full" [drivers/gpu/drm/bridge/lontium-lt9611uxc.ko] undefined!
ERROR: modpost: "of_find_mipi_dsi_host_by_node" [drivers/gpu/drm/bridge/lontium-lt9611uxc.ko] undefined!
ERROR: modpost: "mipi_dsi_device_unregister" [drivers/gpu/drm/bridge/lontium-lt9611uxc.ko] undefined!
ERROR: modpost: "mipi_dsi_detach" [drivers/gpu/drm/bridge/lontium-lt9611uxc.ko] undefined!
ERROR: modpost: "mipi_dsi_attach" [drivers/gpu/drm/bridge/lontium-lt9611.ko] undefined!
ERROR: modpost: "mipi_dsi_device_register_full" [drivers/gpu/drm/bridge/lontium-lt9611.ko] undefined!
ERROR: modpost: "of_find_mipi_dsi_host_by_node" [drivers/gpu/drm/bridge/lontium-lt9611.ko] undefined!
ERROR: modpost: "mipi_dsi_device_unregister" [drivers/gpu/drm/bridge/lontium-lt9611.ko] undefined!
ERROR: modpost: "mipi_dsi_detach" [drivers/gpu/drm/bridge/lontium-lt9611.ko] undefined!
WARNING: modpost: suppressed 5 unresolved symbol warnings because there were too many)

Fixes: 23278bf54afe ("drm/bridge: Introduce LT9611 DSI to HDMI bridge")
Fixes: 0cbbd5b1a012 ("drm: bridge: add support for lontium LT9611UXC bridge")
Fixes: 30e2ae943c26 ("drm/bridge: Introduce LT8912B DSI to HDMI bridge")
Reported-by: kernel test robot <lkp@intel.com>
Signed-off-by: Randy Dunlap <rdunlap@infradead.org>
Reviewed-by: Adren Grassein <adrien.grassein@gmail.com>
Cc: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
Cc: Sam Ravnborg <sam@ravnborg.org>
Cc: Vinod Koul <vkoul@kernel.org>
Cc: Bjorn Andersson <bjorn.andersson@linaro.org>
Cc: Srinivas Kandagatla <srinivas.kandagatla@linaro.org>
Cc: Adrien Grassein <adrien.grassein@gmail.com>
Cc: Andrzej Hajda <a.hajda@samsung.com>
Cc: Neil Armstrong <narmstrong@baylibre.com>
Cc: Robert Foss <robert.foss@linaro.org>
Cc: dri-devel@lists.freedesktop.org
Cc: stable@vger.kernel.org
Signed-off-by: Robert Foss <robert.foss@linaro.org>
Link: https://patchwork.freedesktop.org/patch/msgid/20210415183639.1487-1-rdunlap@infradead.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/gpu/drm/bridge/Kconfig |    3 +++
 1 file changed, 3 insertions(+)

--- a/drivers/gpu/drm/bridge/Kconfig
+++ b/drivers/gpu/drm/bridge/Kconfig
@@ -67,6 +67,7 @@ config DRM_LONTIUM_LT9611UXC
 	depends on OF
 	select DRM_PANEL_BRIDGE
 	select DRM_KMS_HELPER
+	select DRM_MIPI_DSI
 	select REGMAP_I2C
 	help
 	  Driver for Lontium LT9611UXC DSI to HDMI bridge
@@ -151,6 +152,7 @@ config DRM_SII902X
 	tristate "Silicon Image sii902x RGB/HDMI bridge"
 	depends on OF
 	select DRM_KMS_HELPER
+	select DRM_MIPI_DSI
 	select REGMAP_I2C
 	select I2C_MUX
 	select SND_SOC_HDMI_CODEC if SND_SOC
@@ -200,6 +202,7 @@ config DRM_TOSHIBA_TC358767
 	tristate "Toshiba TC358767 eDP bridge"
 	depends on OF
 	select DRM_KMS_HELPER
+	select DRM_MIPI_DSI
 	select REGMAP_I2C
 	select DRM_PANEL
 	help



^ permalink raw reply	[flat|nested] 702+ messages in thread

* [PATCH 5.12 019/677] drm: bridge: fix LONTIUM use of mipi_dsi_() functions
@ 2021-05-12 14:41   ` Greg Kroah-Hartman
  0 siblings, 0 replies; 702+ messages in thread
From: Greg Kroah-Hartman @ 2021-05-12 14:41 UTC (permalink / raw)
  To: linux-kernel
  Cc: kernel test robot, Neil Armstrong, Greg Kroah-Hartman, dri-devel,
	Randy Dunlap, stable, Bjorn Andersson, Andrzej Hajda, Vinod Koul,
	Srinivas Kandagatla, Adren Grassein, Dmitry Baryshkov,
	Sam Ravnborg, Robert Foss

From: Randy Dunlap <rdunlap@infradead.org>

commit ad085b3a712a89e4a48472121b231add7a8362e4 upstream.

The Lontium DRM bridge drivers use mipi_dsi_() function interfaces so
they need to select DRM_MIPI_DSI to prevent build errors.

ERROR: modpost: "mipi_dsi_attach" [drivers/gpu/drm/bridge/lontium-lt9611uxc.ko] undefined!
ERROR: modpost: "mipi_dsi_device_register_full" [drivers/gpu/drm/bridge/lontium-lt9611uxc.ko] undefined!
ERROR: modpost: "of_find_mipi_dsi_host_by_node" [drivers/gpu/drm/bridge/lontium-lt9611uxc.ko] undefined!
ERROR: modpost: "mipi_dsi_device_unregister" [drivers/gpu/drm/bridge/lontium-lt9611uxc.ko] undefined!
ERROR: modpost: "mipi_dsi_detach" [drivers/gpu/drm/bridge/lontium-lt9611uxc.ko] undefined!
ERROR: modpost: "mipi_dsi_attach" [drivers/gpu/drm/bridge/lontium-lt9611.ko] undefined!
ERROR: modpost: "mipi_dsi_device_register_full" [drivers/gpu/drm/bridge/lontium-lt9611.ko] undefined!
ERROR: modpost: "of_find_mipi_dsi_host_by_node" [drivers/gpu/drm/bridge/lontium-lt9611.ko] undefined!
ERROR: modpost: "mipi_dsi_device_unregister" [drivers/gpu/drm/bridge/lontium-lt9611.ko] undefined!
ERROR: modpost: "mipi_dsi_detach" [drivers/gpu/drm/bridge/lontium-lt9611.ko] undefined!
WARNING: modpost: suppressed 5 unresolved symbol warnings because there were too many)

Fixes: 23278bf54afe ("drm/bridge: Introduce LT9611 DSI to HDMI bridge")
Fixes: 0cbbd5b1a012 ("drm: bridge: add support for lontium LT9611UXC bridge")
Fixes: 30e2ae943c26 ("drm/bridge: Introduce LT8912B DSI to HDMI bridge")
Reported-by: kernel test robot <lkp@intel.com>
Signed-off-by: Randy Dunlap <rdunlap@infradead.org>
Reviewed-by: Adren Grassein <adrien.grassein@gmail.com>
Cc: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
Cc: Sam Ravnborg <sam@ravnborg.org>
Cc: Vinod Koul <vkoul@kernel.org>
Cc: Bjorn Andersson <bjorn.andersson@linaro.org>
Cc: Srinivas Kandagatla <srinivas.kandagatla@linaro.org>
Cc: Adrien Grassein <adrien.grassein@gmail.com>
Cc: Andrzej Hajda <a.hajda@samsung.com>
Cc: Neil Armstrong <narmstrong@baylibre.com>
Cc: Robert Foss <robert.foss@linaro.org>
Cc: dri-devel@lists.freedesktop.org
Cc: stable@vger.kernel.org
Signed-off-by: Robert Foss <robert.foss@linaro.org>
Link: https://patchwork.freedesktop.org/patch/msgid/20210415183639.1487-1-rdunlap@infradead.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/gpu/drm/bridge/Kconfig |    3 +++
 1 file changed, 3 insertions(+)

--- a/drivers/gpu/drm/bridge/Kconfig
+++ b/drivers/gpu/drm/bridge/Kconfig
@@ -67,6 +67,7 @@ config DRM_LONTIUM_LT9611UXC
 	depends on OF
 	select DRM_PANEL_BRIDGE
 	select DRM_KMS_HELPER
+	select DRM_MIPI_DSI
 	select REGMAP_I2C
 	help
 	  Driver for Lontium LT9611UXC DSI to HDMI bridge
@@ -151,6 +152,7 @@ config DRM_SII902X
 	tristate "Silicon Image sii902x RGB/HDMI bridge"
 	depends on OF
 	select DRM_KMS_HELPER
+	select DRM_MIPI_DSI
 	select REGMAP_I2C
 	select I2C_MUX
 	select SND_SOC_HDMI_CODEC if SND_SOC
@@ -200,6 +202,7 @@ config DRM_TOSHIBA_TC358767
 	tristate "Toshiba TC358767 eDP bridge"
 	depends on OF
 	select DRM_KMS_HELPER
+	select DRM_MIPI_DSI
 	select REGMAP_I2C
 	select DRM_PANEL
 	help



^ permalink raw reply	[flat|nested] 702+ messages in thread

* [PATCH 5.12 020/677] usb: typec: tcpm: Address incorrect values of tcpm psy for fixed supply
  2021-05-12 14:40 [PATCH 5.12 000/677] 5.12.4-rc1 review Greg Kroah-Hartman
                   ` (18 preceding siblings ...)
  2021-05-12 14:41   ` Greg Kroah-Hartman
@ 2021-05-12 14:41 ` Greg Kroah-Hartman
  2021-05-12 14:41 ` [PATCH 5.12 021/677] usb: typec: tcpm: Address incorrect values of tcpm psy for pps supply Greg Kroah-Hartman
                   ` (664 subsequent siblings)
  684 siblings, 0 replies; 702+ messages in thread
From: Greg Kroah-Hartman @ 2021-05-12 14:41 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Badhri Jagan Sridharan,
	Guenter Roeck, Adam Thomson, Heikki Krogerus

From: Badhri Jagan Sridharan <badhri@google.com>

commit f3dedafb8263ca4791a92a23f5230068f5bde008 upstream.

tcpm_pd_build_request overwrites current_limit and supply_voltage
even before port partner accepts the requests. This leaves stale
values in current_limit and supply_voltage that get exported by
"tcpm-source-psy-". Solving this problem by caching the request
values of current limit/supply voltage in req_current_limit
and req_supply_voltage. current_limit/supply_voltage gets updated
once the port partner accepts the request.

Fixes: f2a8aa053c176 ("typec: tcpm: Represent source supply through power_supply")
Signed-off-by: Badhri Jagan Sridharan <badhri@google.com>
Cc: stable <stable@vger.kernel.org>
Reviewed-by: Guenter Roeck <linux@roeck-us.net>
Reviewed-by: Adam Thomson <Adam.Thomson.Opensource@diasemi.com>
Reviewed-by: Heikki Krogerus <heikki.krogerus@linux.intel.com>
Link: https://lore.kernel.org/r/20210407200723.1914388-1-badhri@google.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/usb/typec/tcpm/tcpm.c |   17 ++++++++++-------
 1 file changed, 10 insertions(+), 7 deletions(-)

--- a/drivers/usb/typec/tcpm/tcpm.c
+++ b/drivers/usb/typec/tcpm/tcpm.c
@@ -389,7 +389,10 @@ struct tcpm_port {
 	unsigned int operating_snk_mw;
 	bool update_sink_caps;
 
-	/* Requested current / voltage */
+	/* Requested current / voltage to the port partner */
+	u32 req_current_limit;
+	u32 req_supply_voltage;
+	/* Actual current / voltage limit of the local port */
 	u32 current_limit;
 	u32 supply_voltage;
 
@@ -2432,8 +2435,8 @@ static void tcpm_pd_ctrl_request(struct
 		case SNK_TRANSITION_SINK:
 			if (port->vbus_present) {
 				tcpm_set_current_limit(port,
-						       port->current_limit,
-						       port->supply_voltage);
+						       port->req_current_limit,
+						       port->req_supply_voltage);
 				port->explicit_contract = true;
 				tcpm_set_auto_vbus_discharge_threshold(port,
 								       TYPEC_PWR_MODE_PD,
@@ -2542,8 +2545,8 @@ static void tcpm_pd_ctrl_request(struct
 			break;
 		case SNK_NEGOTIATE_PPS_CAPABILITIES:
 			port->pps_data.active = true;
-			port->supply_voltage = port->pps_data.out_volt;
-			port->current_limit = port->pps_data.op_curr;
+			port->req_supply_voltage = port->pps_data.out_volt;
+			port->req_current_limit = port->pps_data.op_curr;
 			tcpm_set_state(port, SNK_TRANSITION_SINK, 0);
 			break;
 		case SOFT_RESET_SEND:
@@ -3192,8 +3195,8 @@ static int tcpm_pd_build_request(struct
 			 flags & RDO_CAP_MISMATCH ? " [mismatch]" : "");
 	}
 
-	port->current_limit = ma;
-	port->supply_voltage = mv;
+	port->req_current_limit = ma;
+	port->req_supply_voltage = mv;
 
 	return 0;
 }



^ permalink raw reply	[flat|nested] 702+ messages in thread

* [PATCH 5.12 021/677] usb: typec: tcpm: Address incorrect values of tcpm psy for pps supply
  2021-05-12 14:40 [PATCH 5.12 000/677] 5.12.4-rc1 review Greg Kroah-Hartman
                   ` (19 preceding siblings ...)
  2021-05-12 14:41 ` [PATCH 5.12 020/677] usb: typec: tcpm: Address incorrect values of tcpm psy for fixed supply Greg Kroah-Hartman
@ 2021-05-12 14:41 ` Greg Kroah-Hartman
  2021-05-12 14:41 ` [PATCH 5.12 022/677] usb: typec: tcpm: update power supply once partner accepts Greg Kroah-Hartman
                   ` (663 subsequent siblings)
  684 siblings, 0 replies; 702+ messages in thread
From: Greg Kroah-Hartman @ 2021-05-12 14:41 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Badhri Jagan Sridharan, Adam Thomson,
	Heikki Krogerus

From: Badhri Jagan Sridharan <badhri@google.com>

commit e3a0720224873587954b55d193d5b4abb14f0443 upstream.

tcpm_pd_select_pps_apdo overwrites port->pps_data.min_volt,
port->pps_data.max_volt, port->pps_data.max_curr even before
port partner accepts the requests. This leaves incorrect values
in current_limit and supply_voltage that get exported by
"tcpm-source-psy-". Solving this problem by caching the request
values in req_min_volt, req_max_volt, req_max_curr, req_out_volt,
req_op_curr. min_volt, max_volt, max_curr gets updated once the
partner accepts the request. current_limit, supply_voltage gets updated
once local port's tcpm enters SNK_TRANSITION_SINK when the accepted
current_limit and supply_voltage is enforced.

Fixes: f2a8aa053c176 ("typec: tcpm: Represent source supply through power_supply")
Signed-off-by: Badhri Jagan Sridharan <badhri@google.com>
Cc: stable <stable@vger.kernel.org>
Reviewed-by: Adam Thomson <Adam.Thomson.Opensource@diasemi.com>
Reviewed-by: Heikki Krogerus <heikki.krogerus@linux.intel.com>
Link: https://lore.kernel.org/r/20210407200723.1914388-2-badhri@google.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/usb/typec/tcpm/tcpm.c |   88 +++++++++++++++++++++++++-----------------
 1 file changed, 53 insertions(+), 35 deletions(-)

--- a/drivers/usb/typec/tcpm/tcpm.c
+++ b/drivers/usb/typec/tcpm/tcpm.c
@@ -268,12 +268,27 @@ struct pd_mode_data {
 	struct typec_altmode_desc altmode_desc[ALTMODE_DISCOVERY_MAX];
 };
 
+/*
+ * @min_volt: Actual min voltage at the local port
+ * @req_min_volt: Requested min voltage to the port partner
+ * @max_volt: Actual max voltage at the local port
+ * @req_max_volt: Requested max voltage to the port partner
+ * @max_curr: Actual max current at the local port
+ * @req_max_curr: Requested max current of the port partner
+ * @req_out_volt: Requested output voltage to the port partner
+ * @req_op_curr: Requested operating current to the port partner
+ * @supported: Parter has atleast one APDO hence supports PPS
+ * @active: PPS mode is active
+ */
 struct pd_pps_data {
 	u32 min_volt;
+	u32 req_min_volt;
 	u32 max_volt;
+	u32 req_max_volt;
 	u32 max_curr;
-	u32 out_volt;
-	u32 op_curr;
+	u32 req_max_curr;
+	u32 req_out_volt;
+	u32 req_op_curr;
 	bool supported;
 	bool active;
 };
@@ -2495,8 +2510,8 @@ static void tcpm_pd_ctrl_request(struct
 			break;
 		case SNK_NEGOTIATE_PPS_CAPABILITIES:
 			/* Revert data back from any requested PPS updates */
-			port->pps_data.out_volt = port->supply_voltage;
-			port->pps_data.op_curr = port->current_limit;
+			port->pps_data.req_out_volt = port->supply_voltage;
+			port->pps_data.req_op_curr = port->current_limit;
 			port->pps_status = (type == PD_CTRL_WAIT ?
 					    -EAGAIN : -EOPNOTSUPP);
 
@@ -2545,8 +2560,11 @@ static void tcpm_pd_ctrl_request(struct
 			break;
 		case SNK_NEGOTIATE_PPS_CAPABILITIES:
 			port->pps_data.active = true;
-			port->req_supply_voltage = port->pps_data.out_volt;
-			port->req_current_limit = port->pps_data.op_curr;
+			port->pps_data.min_volt = port->pps_data.req_min_volt;
+			port->pps_data.max_volt = port->pps_data.req_max_volt;
+			port->pps_data.max_curr = port->pps_data.req_max_curr;
+			port->req_supply_voltage = port->pps_data.req_out_volt;
+			port->req_current_limit = port->pps_data.req_op_curr;
 			tcpm_set_state(port, SNK_TRANSITION_SINK, 0);
 			break;
 		case SOFT_RESET_SEND:
@@ -3105,16 +3123,16 @@ static unsigned int tcpm_pd_select_pps_a
 		src = port->source_caps[src_pdo];
 		snk = port->snk_pdo[snk_pdo];
 
-		port->pps_data.min_volt = max(pdo_pps_apdo_min_voltage(src),
-					      pdo_pps_apdo_min_voltage(snk));
-		port->pps_data.max_volt = min(pdo_pps_apdo_max_voltage(src),
-					      pdo_pps_apdo_max_voltage(snk));
-		port->pps_data.max_curr = min_pps_apdo_current(src, snk);
-		port->pps_data.out_volt = min(port->pps_data.max_volt,
-					      max(port->pps_data.min_volt,
-						  port->pps_data.out_volt));
-		port->pps_data.op_curr = min(port->pps_data.max_curr,
-					     port->pps_data.op_curr);
+		port->pps_data.req_min_volt = max(pdo_pps_apdo_min_voltage(src),
+						  pdo_pps_apdo_min_voltage(snk));
+		port->pps_data.req_max_volt = min(pdo_pps_apdo_max_voltage(src),
+						  pdo_pps_apdo_max_voltage(snk));
+		port->pps_data.req_max_curr = min_pps_apdo_current(src, snk);
+		port->pps_data.req_out_volt = min(port->pps_data.max_volt,
+						  max(port->pps_data.min_volt,
+						      port->pps_data.req_out_volt));
+		port->pps_data.req_op_curr = min(port->pps_data.max_curr,
+						 port->pps_data.req_op_curr);
 		power_supply_changed(port->psy);
 	}
 
@@ -3242,10 +3260,10 @@ static int tcpm_pd_build_pps_request(str
 			tcpm_log(port, "Invalid APDO selected!");
 			return -EINVAL;
 		}
-		max_mv = port->pps_data.max_volt;
-		max_ma = port->pps_data.max_curr;
-		out_mv = port->pps_data.out_volt;
-		op_ma = port->pps_data.op_curr;
+		max_mv = port->pps_data.req_max_volt;
+		max_ma = port->pps_data.req_max_curr;
+		out_mv = port->pps_data.req_out_volt;
+		op_ma = port->pps_data.req_op_curr;
 		break;
 	default:
 		tcpm_log(port, "Invalid PDO selected!");
@@ -3292,8 +3310,8 @@ static int tcpm_pd_build_pps_request(str
 	tcpm_log(port, "Requesting APDO %d: %u mV, %u mA",
 		 src_pdo_index, out_mv, op_ma);
 
-	port->pps_data.op_curr = op_ma;
-	port->pps_data.out_volt = out_mv;
+	port->pps_data.req_op_curr = op_ma;
+	port->pps_data.req_out_volt = out_mv;
 
 	return 0;
 }
@@ -5377,7 +5395,7 @@ static int tcpm_try_role(struct typec_po
 	return ret;
 }
 
-static int tcpm_pps_set_op_curr(struct tcpm_port *port, u16 op_curr)
+static int tcpm_pps_set_op_curr(struct tcpm_port *port, u16 req_op_curr)
 {
 	unsigned int target_mw;
 	int ret;
@@ -5395,12 +5413,12 @@ static int tcpm_pps_set_op_curr(struct t
 		goto port_unlock;
 	}
 
-	if (op_curr > port->pps_data.max_curr) {
+	if (req_op_curr > port->pps_data.max_curr) {
 		ret = -EINVAL;
 		goto port_unlock;
 	}
 
-	target_mw = (op_curr * port->pps_data.out_volt) / 1000;
+	target_mw = (req_op_curr * port->supply_voltage) / 1000;
 	if (target_mw < port->operating_snk_mw) {
 		ret = -EINVAL;
 		goto port_unlock;
@@ -5414,10 +5432,10 @@ static int tcpm_pps_set_op_curr(struct t
 	}
 
 	/* Round down operating current to align with PPS valid steps */
-	op_curr = op_curr - (op_curr % RDO_PROG_CURR_MA_STEP);
+	req_op_curr = req_op_curr - (req_op_curr % RDO_PROG_CURR_MA_STEP);
 
 	reinit_completion(&port->pps_complete);
-	port->pps_data.op_curr = op_curr;
+	port->pps_data.req_op_curr = req_op_curr;
 	port->pps_status = 0;
 	port->pps_pending = true;
 	mutex_unlock(&port->lock);
@@ -5438,7 +5456,7 @@ swap_unlock:
 	return ret;
 }
 
-static int tcpm_pps_set_out_volt(struct tcpm_port *port, u16 out_volt)
+static int tcpm_pps_set_out_volt(struct tcpm_port *port, u16 req_out_volt)
 {
 	unsigned int target_mw;
 	int ret;
@@ -5456,13 +5474,13 @@ static int tcpm_pps_set_out_volt(struct
 		goto port_unlock;
 	}
 
-	if (out_volt < port->pps_data.min_volt ||
-	    out_volt > port->pps_data.max_volt) {
+	if (req_out_volt < port->pps_data.min_volt ||
+	    req_out_volt > port->pps_data.max_volt) {
 		ret = -EINVAL;
 		goto port_unlock;
 	}
 
-	target_mw = (port->pps_data.op_curr * out_volt) / 1000;
+	target_mw = (port->current_limit * req_out_volt) / 1000;
 	if (target_mw < port->operating_snk_mw) {
 		ret = -EINVAL;
 		goto port_unlock;
@@ -5476,10 +5494,10 @@ static int tcpm_pps_set_out_volt(struct
 	}
 
 	/* Round down output voltage to align with PPS valid steps */
-	out_volt = out_volt - (out_volt % RDO_PROG_VOLT_MV_STEP);
+	req_out_volt = req_out_volt - (req_out_volt % RDO_PROG_VOLT_MV_STEP);
 
 	reinit_completion(&port->pps_complete);
-	port->pps_data.out_volt = out_volt;
+	port->pps_data.req_out_volt = req_out_volt;
 	port->pps_status = 0;
 	port->pps_pending = true;
 	mutex_unlock(&port->lock);
@@ -5537,8 +5555,8 @@ static int tcpm_pps_activate(struct tcpm
 
 	/* Trigger PPS request or move back to standard PDO contract */
 	if (activate) {
-		port->pps_data.out_volt = port->supply_voltage;
-		port->pps_data.op_curr = port->current_limit;
+		port->pps_data.req_out_volt = port->supply_voltage;
+		port->pps_data.req_op_curr = port->current_limit;
 	}
 	mutex_unlock(&port->lock);
 



^ permalink raw reply	[flat|nested] 702+ messages in thread

* [PATCH 5.12 022/677] usb: typec: tcpm: update power supply once partner accepts
  2021-05-12 14:40 [PATCH 5.12 000/677] 5.12.4-rc1 review Greg Kroah-Hartman
                   ` (20 preceding siblings ...)
  2021-05-12 14:41 ` [PATCH 5.12 021/677] usb: typec: tcpm: Address incorrect values of tcpm psy for pps supply Greg Kroah-Hartman
@ 2021-05-12 14:41 ` Greg Kroah-Hartman
  2021-05-12 14:41 ` [PATCH 5.12 023/677] USB: serial: xr: fix CSIZE handling Greg Kroah-Hartman
                   ` (662 subsequent siblings)
  684 siblings, 0 replies; 702+ messages in thread
From: Greg Kroah-Hartman @ 2021-05-12 14:41 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Badhri Jagan Sridharan, Adam Thomson,
	Heikki Krogerus

From: Badhri Jagan Sridharan <badhri@google.com>

commit 4050f2683f2c3151dc3dd1501ac88c57caf810ff upstream.

power_supply_changed needs to be called to notify clients
after the partner accepts the requested values for the pps
case.

Also, remove the redundant power_supply_changed at the end
of the tcpm_reset_port as power_supply_changed is already
called right after usb_type is changed.

Fixes: f2a8aa053c176 ("typec: tcpm: Represent source supply through power_supply")
Signed-off-by: Badhri Jagan Sridharan <badhri@google.com>
Cc: stable <stable@vger.kernel.org>
Reviewed-by: Adam Thomson <Adam.Thomson.Opensource@diasemi.com>
Reviewed-by: Heikki Krogerus <heikki.krogerus@linux.intel.com>
Link: https://lore.kernel.org/r/20210407200723.1914388-3-badhri@google.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/usb/typec/tcpm/tcpm.c |    4 +---
 1 file changed, 1 insertion(+), 3 deletions(-)

--- a/drivers/usb/typec/tcpm/tcpm.c
+++ b/drivers/usb/typec/tcpm/tcpm.c
@@ -2565,6 +2565,7 @@ static void tcpm_pd_ctrl_request(struct
 			port->pps_data.max_curr = port->pps_data.req_max_curr;
 			port->req_supply_voltage = port->pps_data.req_out_volt;
 			port->req_current_limit = port->pps_data.req_op_curr;
+			power_supply_changed(port->psy);
 			tcpm_set_state(port, SNK_TRANSITION_SINK, 0);
 			break;
 		case SOFT_RESET_SEND:
@@ -3133,7 +3134,6 @@ static unsigned int tcpm_pd_select_pps_a
 						      port->pps_data.req_out_volt));
 		port->pps_data.req_op_curr = min(port->pps_data.max_curr,
 						 port->pps_data.req_op_curr);
-		power_supply_changed(port->psy);
 	}
 
 	return src_pdo;
@@ -3554,8 +3554,6 @@ static void tcpm_reset_port(struct tcpm_
 	port->sink_cap_done = false;
 	if (port->tcpc->enable_frs)
 		port->tcpc->enable_frs(port->tcpc, false);
-
-	power_supply_changed(port->psy);
 }
 
 static void tcpm_detach(struct tcpm_port *port)



^ permalink raw reply	[flat|nested] 702+ messages in thread

* [PATCH 5.12 023/677] USB: serial: xr: fix CSIZE handling
  2021-05-12 14:40 [PATCH 5.12 000/677] 5.12.4-rc1 review Greg Kroah-Hartman
                   ` (21 preceding siblings ...)
  2021-05-12 14:41 ` [PATCH 5.12 022/677] usb: typec: tcpm: update power supply once partner accepts Greg Kroah-Hartman
@ 2021-05-12 14:41 ` Greg Kroah-Hartman
  2021-05-12 14:41 ` [PATCH 5.12 024/677] usb: xhci-mtk: remove or operator for setting schedule parameters Greg Kroah-Hartman
                   ` (661 subsequent siblings)
  684 siblings, 0 replies; 702+ messages in thread
From: Greg Kroah-Hartman @ 2021-05-12 14:41 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Manivannan Sadhasivam, Johan Hovold

From: Johan Hovold <johan@kernel.org>

commit ea7ada4de2f7406150dd35ecd0302842587a464e upstream.

The XR21V141X does not have a 5- or 6-bit mode, but the current
implementation failed to properly restore the old setting when CS5 or
CS6 was requested. Instead an invalid request would be sent to the
device.

Fixes: c2d405aa86b4 ("USB: serial: add MaxLinear/Exar USB to Serial driver")
Reviewed-by: Manivannan Sadhasivam <mani@kernel.org>
Cc: stable@vger.kernel.org	# 5.12
Signed-off-by: Johan Hovold <johan@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/usb/serial/xr_serial.c |    5 +++++
 1 file changed, 5 insertions(+)

--- a/drivers/usb/serial/xr_serial.c
+++ b/drivers/usb/serial/xr_serial.c
@@ -468,6 +468,11 @@ static void xr_set_termios(struct tty_st
 		if (old_termios)
 			termios->c_cflag |= old_termios->c_cflag & CSIZE;
 		else
+			termios->c_cflag |= CS8;
+
+		if (C_CSIZE(tty) == CS7)
+			bits |= XR21V141X_UART_DATA_7;
+		else
 			bits |= XR21V141X_UART_DATA_8;
 		break;
 	case CS7:



^ permalink raw reply	[flat|nested] 702+ messages in thread

* [PATCH 5.12 024/677] usb: xhci-mtk: remove or operator for setting schedule parameters
  2021-05-12 14:40 [PATCH 5.12 000/677] 5.12.4-rc1 review Greg Kroah-Hartman
                   ` (22 preceding siblings ...)
  2021-05-12 14:41 ` [PATCH 5.12 023/677] USB: serial: xr: fix CSIZE handling Greg Kroah-Hartman
@ 2021-05-12 14:41 ` Greg Kroah-Hartman
  2021-05-12 14:41 ` [PATCH 5.12 025/677] usb: xhci-mtk: improve bandwidth scheduling with TT Greg Kroah-Hartman
                   ` (660 subsequent siblings)
  684 siblings, 0 replies; 702+ messages in thread
From: Greg Kroah-Hartman @ 2021-05-12 14:41 UTC (permalink / raw)
  To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Chunfeng Yun

From: Chunfeng Yun <chunfeng.yun@mediatek.com>

commit 5fa5827566e3affa1657ccf9b22706c06a5d021a upstream.

Side effect may happen if use or operator to set schedule parameters
when the parameters are already set before. Set them directly due to
other bits are reserved.

Fixes: 54f6a8af3722 ("usb: xhci-mtk: skip dropping bandwidth of unchecked endpoints")
Cc: stable <stable@vger.kernel.org>
Signed-off-by: Chunfeng Yun <chunfeng.yun@mediatek.com>
Link: https://lore.kernel.org/r/d287899e6beb2fc1bfb8900c75a872f628ecde55.1615170625.git.chunfeng.yun@mediatek.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/usb/host/xhci-mtk-sch.c |    6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

--- a/drivers/usb/host/xhci-mtk-sch.c
+++ b/drivers/usb/host/xhci-mtk-sch.c
@@ -643,7 +643,7 @@ int xhci_mtk_add_ep_quirk(struct usb_hcd
 		 */
 		if (usb_endpoint_xfer_int(&ep->desc)
 			|| usb_endpoint_xfer_isoc(&ep->desc))
-			ep_ctx->reserved[0] |= cpu_to_le32(EP_BPKTS(1));
+			ep_ctx->reserved[0] = cpu_to_le32(EP_BPKTS(1));
 
 		return 0;
 	}
@@ -730,10 +730,10 @@ int xhci_mtk_check_bandwidth(struct usb_
 		list_move_tail(&sch_ep->endpoint, &sch_bw->bw_ep_list);
 
 		ep_ctx = xhci_get_ep_ctx(xhci, virt_dev->in_ctx, ep_index);
-		ep_ctx->reserved[0] |= cpu_to_le32(EP_BPKTS(sch_ep->pkts)
+		ep_ctx->reserved[0] = cpu_to_le32(EP_BPKTS(sch_ep->pkts)
 			| EP_BCSCOUNT(sch_ep->cs_count)
 			| EP_BBM(sch_ep->burst_mode));
-		ep_ctx->reserved[1] |= cpu_to_le32(EP_BOFFSET(sch_ep->offset)
+		ep_ctx->reserved[1] = cpu_to_le32(EP_BOFFSET(sch_ep->offset)
 			| EP_BREPEAT(sch_ep->repeat));
 
 		xhci_dbg(xhci, " PKTS:%x, CSCOUNT:%x, BM:%x, OFFSET:%x, REPEAT:%x\n",



^ permalink raw reply	[flat|nested] 702+ messages in thread

* [PATCH 5.12 025/677] usb: xhci-mtk: improve bandwidth scheduling with TT
  2021-05-12 14:40 [PATCH 5.12 000/677] 5.12.4-rc1 review Greg Kroah-Hartman
                   ` (23 preceding siblings ...)
  2021-05-12 14:41 ` [PATCH 5.12 024/677] usb: xhci-mtk: remove or operator for setting schedule parameters Greg Kroah-Hartman
@ 2021-05-12 14:41 ` Greg Kroah-Hartman
  2021-05-12 14:41 ` [PATCH 5.12 026/677] ASoC: samsung: tm2_wm5110: check of of_parse return value Greg Kroah-Hartman
                   ` (659 subsequent siblings)
  684 siblings, 0 replies; 702+ messages in thread
From: Greg Kroah-Hartman @ 2021-05-12 14:41 UTC (permalink / raw)
  To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Yaqii Wu, Chunfeng Yun

From: Chunfeng Yun <chunfeng.yun@mediatek.com>

commit e19ee44a3d07c232f9241024dab1ebd0748cdf5f upstream.

When the USB headset is plug into an external hub, sometimes
can't set config due to not enough bandwidth, so need improve
LS/FS INT/ISOC bandwidth scheduling with TT.

Fixes: 54f6a8af3722 ("usb: xhci-mtk: skip dropping bandwidth of unchecked endpoints")
Cc: stable <stable@vger.kernel.org>
Signed-off-by: Yaqii Wu <yaqii.wu@mediatek.com>
Signed-off-by: Chunfeng Yun <chunfeng.yun@mediatek.com>
Link: https://lore.kernel.org/r/2f30e81400a59afef5f8231c98149169c7520519.1615170625.git.chunfeng.yun@mediatek.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/usb/host/xhci-mtk-sch.c |   74 ++++++++++++++++++++++++++++++++--------
 drivers/usb/host/xhci-mtk.h     |    6 ++-
 2 files changed, 64 insertions(+), 16 deletions(-)

--- a/drivers/usb/host/xhci-mtk-sch.c
+++ b/drivers/usb/host/xhci-mtk-sch.c
@@ -378,6 +378,31 @@ static void update_bus_bw(struct mu3h_sc
 	sch_ep->allocated = used;
 }
 
+static int check_fs_bus_bw(struct mu3h_sch_ep_info *sch_ep, int offset)
+{
+	struct mu3h_sch_tt *tt = sch_ep->sch_tt;
+	u32 num_esit, tmp;
+	int base;
+	int i, j;
+
+	num_esit = XHCI_MTK_MAX_ESIT / sch_ep->esit;
+	for (i = 0; i < num_esit; i++) {
+		base = offset + i * sch_ep->esit;
+
+		/*
+		 * Compared with hs bus, no matter what ep type,
+		 * the hub will always delay one uframe to send data
+		 */
+		for (j = 0; j < sch_ep->cs_count; j++) {
+			tmp = tt->fs_bus_bw[base + j] + sch_ep->bw_cost_per_microframe;
+			if (tmp > FS_PAYLOAD_MAX)
+				return -ERANGE;
+		}
+	}
+
+	return 0;
+}
+
 static int check_sch_tt(struct usb_device *udev,
 	struct mu3h_sch_ep_info *sch_ep, u32 offset)
 {
@@ -402,7 +427,7 @@ static int check_sch_tt(struct usb_devic
 			return -ERANGE;
 
 		for (i = 0; i < sch_ep->cs_count; i++)
-			if (test_bit(offset + i, tt->split_bit_map))
+			if (test_bit(offset + i, tt->ss_bit_map))
 				return -ERANGE;
 
 	} else {
@@ -432,7 +457,7 @@ static int check_sch_tt(struct usb_devic
 			cs_count = 7; /* HW limit */
 
 		for (i = 0; i < cs_count + 2; i++) {
-			if (test_bit(offset + i, tt->split_bit_map))
+			if (test_bit(offset + i, tt->ss_bit_map))
 				return -ERANGE;
 		}
 
@@ -448,24 +473,44 @@ static int check_sch_tt(struct usb_devic
 			sch_ep->num_budget_microframes = sch_ep->esit;
 	}
 
-	return 0;
+	return check_fs_bus_bw(sch_ep, offset);
 }
 
 static void update_sch_tt(struct usb_device *udev,
-	struct mu3h_sch_ep_info *sch_ep)
+	struct mu3h_sch_ep_info *sch_ep, bool used)
 {
 	struct mu3h_sch_tt *tt = sch_ep->sch_tt;
 	u32 base, num_esit;
+	int bw_updated;
+	int bits;
 	int i, j;
 
 	num_esit = XHCI_MTK_MAX_ESIT / sch_ep->esit;
+	bits = (sch_ep->ep_type == ISOC_OUT_EP) ? sch_ep->cs_count : 1;
+
+	if (used)
+		bw_updated = sch_ep->bw_cost_per_microframe;
+	else
+		bw_updated = -sch_ep->bw_cost_per_microframe;
+
 	for (i = 0; i < num_esit; i++) {
 		base = sch_ep->offset + i * sch_ep->esit;
-		for (j = 0; j < sch_ep->num_budget_microframes; j++)
-			set_bit(base + j, tt->split_bit_map);
+
+		for (j = 0; j < bits; j++) {
+			if (used)
+				set_bit(base + j, tt->ss_bit_map);
+			else
+				clear_bit(base + j, tt->ss_bit_map);
+		}
+
+		for (j = 0; j < sch_ep->cs_count; j++)
+			tt->fs_bus_bw[base + j] += bw_updated;
 	}
 
-	list_add_tail(&sch_ep->tt_endpoint, &tt->ep_list);
+	if (used)
+		list_add_tail(&sch_ep->tt_endpoint, &tt->ep_list);
+	else
+		list_del(&sch_ep->tt_endpoint);
 }
 
 static int check_sch_bw(struct usb_device *udev,
@@ -535,7 +580,7 @@ static int check_sch_bw(struct usb_devic
 		if (!tt_offset_ok)
 			return -ERANGE;
 
-		update_sch_tt(udev, sch_ep);
+		update_sch_tt(udev, sch_ep, 1);
 	}
 
 	/* update bus bandwidth info */
@@ -548,15 +593,16 @@ static void destroy_sch_ep(struct usb_de
 	struct mu3h_sch_bw_info *sch_bw, struct mu3h_sch_ep_info *sch_ep)
 {
 	/* only release ep bw check passed by check_sch_bw() */
-	if (sch_ep->allocated)
+	if (sch_ep->allocated) {
 		update_bus_bw(sch_bw, sch_ep, 0);
+		if (sch_ep->sch_tt)
+			update_sch_tt(udev, sch_ep, 0);
+	}
 
-	list_del(&sch_ep->endpoint);
-
-	if (sch_ep->sch_tt) {
-		list_del(&sch_ep->tt_endpoint);
+	if (sch_ep->sch_tt)
 		drop_tt(udev);
-	}
+
+	list_del(&sch_ep->endpoint);
 	kfree(sch_ep);
 }
 
--- a/drivers/usb/host/xhci-mtk.h
+++ b/drivers/usb/host/xhci-mtk.h
@@ -20,13 +20,15 @@
 #define XHCI_MTK_MAX_ESIT	64
 
 /**
- * @split_bit_map: used to avoid split microframes overlay
+ * @ss_bit_map: used to avoid start split microframes overlay
+ * @fs_bus_bw: array to keep track of bandwidth already used for FS
  * @ep_list: Endpoints using this TT
  * @usb_tt: usb TT related
  * @tt_port: TT port number
  */
 struct mu3h_sch_tt {
-	DECLARE_BITMAP(split_bit_map, XHCI_MTK_MAX_ESIT);
+	DECLARE_BITMAP(ss_bit_map, XHCI_MTK_MAX_ESIT);
+	u32 fs_bus_bw[XHCI_MTK_MAX_ESIT];
 	struct list_head ep_list;
 	struct usb_tt *usb_tt;
 	int tt_port;



^ permalink raw reply	[flat|nested] 702+ messages in thread

* [PATCH 5.12 026/677] ASoC: samsung: tm2_wm5110: check of of_parse return value
  2021-05-12 14:40 [PATCH 5.12 000/677] 5.12.4-rc1 review Greg Kroah-Hartman
                   ` (24 preceding siblings ...)
  2021-05-12 14:41 ` [PATCH 5.12 025/677] usb: xhci-mtk: improve bandwidth scheduling with TT Greg Kroah-Hartman
@ 2021-05-12 14:41 ` Greg Kroah-Hartman
  2021-05-12 14:41 ` [PATCH 5.12 027/677] ASoC: Intel: kbl_da7219_max98927: Fix kabylake_ssp_fixup function Greg Kroah-Hartman
                   ` (658 subsequent siblings)
  684 siblings, 0 replies; 702+ messages in thread
From: Greg Kroah-Hartman @ 2021-05-12 14:41 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Krzysztof Kozlowski,
	Krzysztof Kozlowski, Sylwester Nawrocki, Pierre-Louis Bossart,
	Mark Brown

From: Pierre-Louis Bossart <pierre-louis.bossart@linux.intel.com>

commit d58970da324732686529655c21791cef0ee547c4 upstream.

cppcheck warning:

sound/soc/samsung/tm2_wm5110.c:605:6: style: Variable 'ret' is
reassigned a value before the old one has been
used. [redundantAssignment]
 ret = devm_snd_soc_register_component(dev, &tm2_component,
     ^
sound/soc/samsung/tm2_wm5110.c:554:7: note: ret is assigned
  ret = of_parse_phandle_with_args(dev->of_node, "i2s-controller",
      ^
sound/soc/samsung/tm2_wm5110.c:605:6: note: ret is overwritten
 ret = devm_snd_soc_register_component(dev, &tm2_component,
     ^

The args is a stack variable, so it could have junk (uninitialized)
therefore args.np could have a non-NULL and random value even though
property was missing. Later could trigger invalid pointer dereference.

There's no need to check for args.np because args.np won't be
initialized on errors.

Fixes: 8d1513cef51a ("ASoC: samsung: Add support for HDMI audio on TM2 board")
Cc: <stable@vger.kernel.org>
Suggested-by: Krzysztof Kozlowski <krzk@kernel.org>
Reviewed-by: Krzysztof Kozlowski <krzysztof.kozlowski@canonical.com>
Reviewed-by: Sylwester Nawrocki <s.nawrocki@samsung.com>
Signed-off-by: Pierre-Louis Bossart <pierre-louis.bossart@linux.intel.com>
Link: https://lore.kernel.org/r/20210312180231.2741-2-pierre-louis.bossart@linux.intel.com
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 sound/soc/samsung/tm2_wm5110.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

--- a/sound/soc/samsung/tm2_wm5110.c
+++ b/sound/soc/samsung/tm2_wm5110.c
@@ -553,7 +553,7 @@ static int tm2_probe(struct platform_dev
 
 		ret = of_parse_phandle_with_args(dev->of_node, "i2s-controller",
 						 cells_name, i, &args);
-		if (!args.np) {
+		if (ret) {
 			dev_err(dev, "i2s-controller property parse error: %d\n", i);
 			ret = -EINVAL;
 			goto dai_node_put;



^ permalink raw reply	[flat|nested] 702+ messages in thread

* [PATCH 5.12 027/677] ASoC: Intel: kbl_da7219_max98927: Fix kabylake_ssp_fixup function
  2021-05-12 14:40 [PATCH 5.12 000/677] 5.12.4-rc1 review Greg Kroah-Hartman
                   ` (25 preceding siblings ...)
  2021-05-12 14:41 ` [PATCH 5.12 026/677] ASoC: samsung: tm2_wm5110: check of of_parse return value Greg Kroah-Hartman
@ 2021-05-12 14:41 ` Greg Kroah-Hartman
  2021-05-12 14:41 ` [PATCH 5.12 028/677] ASoC: tlv320aic32x4: Register clocks before registering component Greg Kroah-Hartman
                   ` (657 subsequent siblings)
  684 siblings, 0 replies; 702+ messages in thread
From: Greg Kroah-Hartman @ 2021-05-12 14:41 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Lukasz Majczak, Pierre-Louis Bossart,
	Mark Brown

From: Lukasz Majczak <lma@semihalf.com>

commit a523ef731ac6674dc07574f31bf44cc5bfa14e4d upstream.

kabylake_ssp_fixup function uses snd_soc_dpcm to identify the
codecs DAIs. The HW parameters are changed based on the codec DAI of the
stream. The earlier approach to get snd_soc_dpcm was using container_of()
macro on snd_pcm_hw_params.

The structures have been modified over time and snd_soc_dpcm does not have
snd_pcm_hw_params as a reference but as a copy. This causes the current
driver to crash when used.

This patch changes the way snd_soc_dpcm is extracted. snd_soc_pcm_runtime
holds 2 dpcm instances (one for playback and one for capture). 2 codecs
on the SSP are dmic (capture) and speakers (playback). Based on the
stream direction, snd_soc_dpcm is extracted from snd_soc_pcm_runtime.

Tested for all use cases of the driver.
Based on similar fix in kbl_rt5663_rt5514_max98927.c
from Harsha Priya <harshapriya.n@intel.com> and
Vamshi Krishna Gopal <vamshi.krishna.gopal@intel.com>

Cc: <stable@vger.kernel.org> # 5.4+
Signed-off-by: Lukasz Majczak <lma@semihalf.com>
Acked-by: Pierre-Louis Bossart <pierre-louis.bossart@linux.intel.com>
Link: https://lore.kernel.org/r/20210415124347.475432-1-lma@semihalf.com
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 sound/soc/intel/boards/kbl_da7219_max98927.c |   38 +++++++++++++++++++++------
 1 file changed, 30 insertions(+), 8 deletions(-)

--- a/sound/soc/intel/boards/kbl_da7219_max98927.c
+++ b/sound/soc/intel/boards/kbl_da7219_max98927.c
@@ -282,12 +282,34 @@ static int kabylake_ssp_fixup(struct snd
 	struct snd_interval *chan = hw_param_interval(params,
 			SNDRV_PCM_HW_PARAM_CHANNELS);
 	struct snd_mask *fmt = hw_param_mask(params, SNDRV_PCM_HW_PARAM_FORMAT);
-	struct snd_soc_dpcm *dpcm = container_of(
-			params, struct snd_soc_dpcm, hw_params);
-	struct snd_soc_dai_link *fe_dai_link = dpcm->fe->dai_link;
-	struct snd_soc_dai_link *be_dai_link = dpcm->be->dai_link;
+	struct snd_soc_dpcm *dpcm, *rtd_dpcm = NULL;
 
 	/*
+	 * The following loop will be called only for playback stream
+	 * In this platform, there is only one playback device on every SSP
+	 */
+	for_each_dpcm_fe(rtd, SNDRV_PCM_STREAM_PLAYBACK, dpcm) {
+		rtd_dpcm = dpcm;
+		break;
+	}
+
+	/*
+	 * This following loop will be called only for capture stream
+	 * In this platform, there is only one capture device on every SSP
+	 */
+	for_each_dpcm_fe(rtd, SNDRV_PCM_STREAM_CAPTURE, dpcm) {
+		rtd_dpcm = dpcm;
+		break;
+	}
+
+	if (!rtd_dpcm)
+		return -EINVAL;
+
+	/*
+	 * The above 2 loops are mutually exclusive based on the stream direction,
+	 * thus rtd_dpcm variable will never be overwritten
+	 */
+	/*
 	 * Topology for kblda7219m98373 & kblmax98373 supports only S24_LE,
 	 * where as kblda7219m98927 & kblmax98927 supports S16_LE by default.
 	 * Skipping the port wise FE and BE configuration for kblda7219m98373 &
@@ -309,9 +331,9 @@ static int kabylake_ssp_fixup(struct snd
 	/*
 	 * The ADSP will convert the FE rate to 48k, stereo, 24 bit
 	 */
-	if (!strcmp(fe_dai_link->name, "Kbl Audio Port") ||
-	    !strcmp(fe_dai_link->name, "Kbl Audio Headset Playback") ||
-	    !strcmp(fe_dai_link->name, "Kbl Audio Capture Port")) {
+	if (!strcmp(rtd_dpcm->fe->dai_link->name, "Kbl Audio Port") ||
+	    !strcmp(rtd_dpcm->fe->dai_link->name, "Kbl Audio Headset Playback") ||
+	    !strcmp(rtd_dpcm->fe->dai_link->name, "Kbl Audio Capture Port")) {
 		rate->min = rate->max = 48000;
 		chan->min = chan->max = 2;
 		snd_mask_none(fmt);
@@ -322,7 +344,7 @@ static int kabylake_ssp_fixup(struct snd
 	 * The speaker on the SSP0 supports S16_LE and not S24_LE.
 	 * thus changing the mask here
 	 */
-	if (!strcmp(be_dai_link->name, "SSP0-Codec"))
+	if (!strcmp(rtd_dpcm->be->dai_link->name, "SSP0-Codec"))
 		snd_mask_set_format(fmt, SNDRV_PCM_FORMAT_S16_LE);
 
 	return 0;



^ permalink raw reply	[flat|nested] 702+ messages in thread

* [PATCH 5.12 028/677] ASoC: tlv320aic32x4: Register clocks before registering component
  2021-05-12 14:40 [PATCH 5.12 000/677] 5.12.4-rc1 review Greg Kroah-Hartman
                   ` (26 preceding siblings ...)
  2021-05-12 14:41 ` [PATCH 5.12 027/677] ASoC: Intel: kbl_da7219_max98927: Fix kabylake_ssp_fixup function Greg Kroah-Hartman
@ 2021-05-12 14:41 ` Greg Kroah-Hartman
  2021-05-12 14:41 ` [PATCH 5.12 029/677] ASoC: tlv320aic32x4: Increase maximum register in regmap Greg Kroah-Hartman
                   ` (656 subsequent siblings)
  684 siblings, 0 replies; 702+ messages in thread
From: Greg Kroah-Hartman @ 2021-05-12 14:41 UTC (permalink / raw)
  To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Annaliese McDermond, Mark Brown

From: Annaliese McDermond <nh6z@nh6z.net>

commit 1ca1156cfd69530e6b7cb99943baf90c8bd871a5 upstream.

Clock registration must be performed before the component is
registered.  aic32x4_component_probe attempts to get all the
clocks right off the bat.  If the component is registered before
the clocks there is a race condition where the clocks may not
be registered by the time aic32x4_componet_probe actually runs.

Fixes: d1c859d314d8 ("ASoC: codec: tlv3204: Increased maximum supported channels")
Cc: stable@vger.kernel.org
Signed-off-by: Annaliese McDermond <nh6z@nh6z.net>
Link: https://lore.kernel.org/r/0101017889850206-dcac4cce-8cc8-4a21-80e9-4e4bef44b981-000000@us-west-2.amazonses.com
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 sound/soc/codecs/tlv320aic32x4.c |    8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

--- a/sound/soc/codecs/tlv320aic32x4.c
+++ b/sound/soc/codecs/tlv320aic32x4.c
@@ -1243,6 +1243,10 @@ int aic32x4_probe(struct device *dev, st
 	if (ret)
 		goto err_disable_regulators;
 
+	ret = aic32x4_register_clocks(dev, aic32x4->mclk_name);
+	if (ret)
+		goto err_disable_regulators;
+
 	ret = devm_snd_soc_register_component(dev,
 			&soc_component_dev_aic32x4, &aic32x4_dai, 1);
 	if (ret) {
@@ -1250,10 +1254,6 @@ int aic32x4_probe(struct device *dev, st
 		goto err_disable_regulators;
 	}
 
-	ret = aic32x4_register_clocks(dev, aic32x4->mclk_name);
-	if (ret)
-		goto err_disable_regulators;
-
 	return 0;
 
 err_disable_regulators:



^ permalink raw reply	[flat|nested] 702+ messages in thread

* [PATCH 5.12 029/677] ASoC: tlv320aic32x4: Increase maximum register in regmap
  2021-05-12 14:40 [PATCH 5.12 000/677] 5.12.4-rc1 review Greg Kroah-Hartman
                   ` (27 preceding siblings ...)
  2021-05-12 14:41 ` [PATCH 5.12 028/677] ASoC: tlv320aic32x4: Register clocks before registering component Greg Kroah-Hartman
@ 2021-05-12 14:41 ` Greg Kroah-Hartman
  2021-05-12 14:41   ` Greg Kroah-Hartman
                   ` (655 subsequent siblings)
  684 siblings, 0 replies; 702+ messages in thread
From: Greg Kroah-Hartman @ 2021-05-12 14:41 UTC (permalink / raw)
  To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Annaliese McDermond, Mark Brown

From: Annaliese McDermond <nh6z@nh6z.net>

commit 29654ed8384e9dbaf4cfba689dbcb664a6ab4bb7 upstream.

AIC32X4_REFPOWERUP was added as a register, but the maximum register value
in the regmap and regmap range was not correspondingly increased.  This
caused an error when this register was attempted to be written.

Fixes: ec96690de82c ("ASoC: tlv320aic32x4: Enable fast charge")
Cc: stable@vger.kernel.org
Signed-off-by: Annaliese McDermond <nh6z@nh6z.net>
Link: https://lore.kernel.org/r/0101017889851cab-ce60cfdb-d88c-43d8-bbd2-7fbf34a0c912-000000@us-west-2.amazonses.com
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 sound/soc/codecs/tlv320aic32x4.c |    4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

--- a/sound/soc/codecs/tlv320aic32x4.c
+++ b/sound/soc/codecs/tlv320aic32x4.c
@@ -577,12 +577,12 @@ static const struct regmap_range_cfg aic
 		.window_start = 0,
 		.window_len = 128,
 		.range_min = 0,
-		.range_max = AIC32X4_RMICPGAVOL,
+		.range_max = AIC32X4_REFPOWERUP,
 	},
 };
 
 const struct regmap_config aic32x4_regmap_config = {
-	.max_register = AIC32X4_RMICPGAVOL,
+	.max_register = AIC32X4_REFPOWERUP,
 	.ranges = aic32x4_regmap_pages,
 	.num_ranges = ARRAY_SIZE(aic32x4_regmap_pages),
 };



^ permalink raw reply	[flat|nested] 702+ messages in thread

* [PATCH 5.12 030/677] MIPS: pci-mt7620: fix PLL lock check
  2021-05-12 14:40 [PATCH 5.12 000/677] 5.12.4-rc1 review Greg Kroah-Hartman
@ 2021-05-12 14:41   ` Greg Kroah-Hartman
  2021-05-12 14:40 ` [PATCH 5.12 002/677] bluetooth: eliminate the potential race condition when removing the HCI controller Greg Kroah-Hartman
                     ` (683 subsequent siblings)
  684 siblings, 0 replies; 702+ messages in thread
From: Greg Kroah-Hartman @ 2021-05-12 14:41 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Ilya Lipnitskiy, John Crispin,
	linux-mips, linux-mediatek, Thomas Bogendoerfer

From: Ilya Lipnitskiy <ilya.lipnitskiy@gmail.com>

commit c15b99ae2ba9ea30da3c7cd4765b8a4707e530a6 upstream.

Upstream a long-standing OpenWrt patch [0] that fixes MT7620 PCIe PLL
lock check. The existing code checks the wrong register bit: PPLL_SW_SET
is not defined in PPLL_CFG1 and bit 31 of PPLL_CFG1 is marked as reserved
in the MT7620 Programming Guide. The correct bit to check for PLL lock
is PPLL_LD (bit 23).

Also reword the error message for clarity.

Without this change it is unlikely that this driver ever worked with
mainline kernel.

[0]: https://lists.infradead.org/pipermail/lede-commits/2017-July/004441.html

Signed-off-by: Ilya Lipnitskiy <ilya.lipnitskiy@gmail.com>
Cc: John Crispin <john@phrozen.org>
Cc: linux-mips@vger.kernel.org
Cc: linux-mediatek@lists.infradead.org
Cc: linux-kernel@vger.kernel.org
Cc: stable@vger.kernel.org
Signed-off-by: Thomas Bogendoerfer <tsbogend@alpha.franken.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 arch/mips/pci/pci-mt7620.c |    5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

--- a/arch/mips/pci/pci-mt7620.c
+++ b/arch/mips/pci/pci-mt7620.c
@@ -30,6 +30,7 @@
 #define RALINK_GPIOMODE			0x60
 
 #define PPLL_CFG1			0x9c
+#define PPLL_LD				BIT(23)
 
 #define PPLL_DRV			0xa0
 #define PDRV_SW_SET			BIT(31)
@@ -239,8 +240,8 @@ static int mt7620_pci_hw_init(struct pla
 	rt_sysc_m32(0, RALINK_PCIE0_CLK_EN, RALINK_CLKCFG1);
 	mdelay(100);
 
-	if (!(rt_sysc_r32(PPLL_CFG1) & PDRV_SW_SET)) {
-		dev_err(&pdev->dev, "MT7620 PPLL unlock\n");
+	if (!(rt_sysc_r32(PPLL_CFG1) & PPLL_LD)) {
+		dev_err(&pdev->dev, "pcie PLL not locked, aborting init\n");
 		reset_control_assert(rstpcie0);
 		rt_sysc_m32(RALINK_PCIE0_CLK_EN, 0, RALINK_CLKCFG1);
 		return -1;



^ permalink raw reply	[flat|nested] 702+ messages in thread

* [PATCH 5.12 030/677] MIPS: pci-mt7620: fix PLL lock check
@ 2021-05-12 14:41   ` Greg Kroah-Hartman
  0 siblings, 0 replies; 702+ messages in thread
From: Greg Kroah-Hartman @ 2021-05-12 14:41 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Ilya Lipnitskiy, John Crispin,
	linux-mips, linux-mediatek, Thomas Bogendoerfer

From: Ilya Lipnitskiy <ilya.lipnitskiy@gmail.com>

commit c15b99ae2ba9ea30da3c7cd4765b8a4707e530a6 upstream.

Upstream a long-standing OpenWrt patch [0] that fixes MT7620 PCIe PLL
lock check. The existing code checks the wrong register bit: PPLL_SW_SET
is not defined in PPLL_CFG1 and bit 31 of PPLL_CFG1 is marked as reserved
in the MT7620 Programming Guide. The correct bit to check for PLL lock
is PPLL_LD (bit 23).

Also reword the error message for clarity.

Without this change it is unlikely that this driver ever worked with
mainline kernel.

[0]: https://lists.infradead.org/pipermail/lede-commits/2017-July/004441.html

Signed-off-by: Ilya Lipnitskiy <ilya.lipnitskiy@gmail.com>
Cc: John Crispin <john@phrozen.org>
Cc: linux-mips@vger.kernel.org
Cc: linux-mediatek@lists.infradead.org
Cc: linux-kernel@vger.kernel.org
Cc: stable@vger.kernel.org
Signed-off-by: Thomas Bogendoerfer <tsbogend@alpha.franken.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 arch/mips/pci/pci-mt7620.c |    5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

--- a/arch/mips/pci/pci-mt7620.c
+++ b/arch/mips/pci/pci-mt7620.c
@@ -30,6 +30,7 @@
 #define RALINK_GPIOMODE			0x60
 
 #define PPLL_CFG1			0x9c
+#define PPLL_LD				BIT(23)
 
 #define PPLL_DRV			0xa0
 #define PDRV_SW_SET			BIT(31)
@@ -239,8 +240,8 @@ static int mt7620_pci_hw_init(struct pla
 	rt_sysc_m32(0, RALINK_PCIE0_CLK_EN, RALINK_CLKCFG1);
 	mdelay(100);
 
-	if (!(rt_sysc_r32(PPLL_CFG1) & PDRV_SW_SET)) {
-		dev_err(&pdev->dev, "MT7620 PPLL unlock\n");
+	if (!(rt_sysc_r32(PPLL_CFG1) & PPLL_LD)) {
+		dev_err(&pdev->dev, "pcie PLL not locked, aborting init\n");
 		reset_control_assert(rstpcie0);
 		rt_sysc_m32(RALINK_PCIE0_CLK_EN, 0, RALINK_CLKCFG1);
 		return -1;



_______________________________________________
Linux-mediatek mailing list
Linux-mediatek@lists.infradead.org
http://lists.infradead.org/mailman/listinfo/linux-mediatek

^ permalink raw reply	[flat|nested] 702+ messages in thread

* [PATCH 5.12 031/677] MIPS: pci-rt2880: fix slot 0 configuration
  2021-05-12 14:40 [PATCH 5.12 000/677] 5.12.4-rc1 review Greg Kroah-Hartman
                   ` (29 preceding siblings ...)
  2021-05-12 14:41   ` Greg Kroah-Hartman
@ 2021-05-12 14:41 ` Greg Kroah-Hartman
  2021-05-12 14:41 ` [PATCH 5.12 032/677] FDDI: defxx: Bail out gracefully with unassigned PCI resource for CSR Greg Kroah-Hartman
                   ` (653 subsequent siblings)
  684 siblings, 0 replies; 702+ messages in thread
From: Greg Kroah-Hartman @ 2021-05-12 14:41 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Ilya Lipnitskiy, Lorenzo Pieralisi,
	Tobias Wolf, Thomas Bogendoerfer

From: Ilya Lipnitskiy <ilya.lipnitskiy@gmail.com>

commit 8e98b697006d749d745d3b174168a877bb96c500 upstream.

pci_fixup_irqs() used to call pcibios_map_irq on every PCI device, which
for RT2880 included bus 0 slot 0. After pci_fixup_irqs() got removed,
only slots/funcs with devices attached would be called. While arguably
the right thing, that left no chance for this driver to ever initialize
slot 0, effectively bricking PCI and USB on RT2880 devices such as the
Belkin F5D8235-4 v1.

Slot 0 configuration needs to happen after PCI bus enumeration, but
before any device at slot 0x11 (func 0 or 1) is talked to. That was
determined empirically by testing on a Belkin F5D8235-4 v1 device. A
minimal BAR 0 config write followed by read, then setting slot 0
PCI_COMMAND to MASTER | IO | MEMORY is all that seems to be required for
proper functionality.

Tested by ensuring that full- and high-speed USB devices get enumerated
on the Belkin F5D8235-4 v1 (with an out of tree DTS file from OpenWrt).

Fixes: 04c81c7293df ("MIPS: PCI: Replace pci_fixup_irqs() call with host bridge IRQ mapping hooks")
Signed-off-by: Ilya Lipnitskiy <ilya.lipnitskiy@gmail.com>
Cc: Lorenzo Pieralisi <lorenzo.pieralisi@arm.com>
Cc: Tobias Wolf <dev-NTEO@vplace.de>
Cc: <stable@vger.kernel.org> # v4.14+
Signed-off-by: Thomas Bogendoerfer <tsbogend@alpha.franken.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 arch/mips/pci/pci-rt2880.c |   37 ++++++++++++++++++++++++-------------
 1 file changed, 24 insertions(+), 13 deletions(-)

--- a/arch/mips/pci/pci-rt2880.c
+++ b/arch/mips/pci/pci-rt2880.c
@@ -180,7 +180,6 @@ static inline void rt2880_pci_write_u32(
 
 int pcibios_map_irq(const struct pci_dev *dev, u8 slot, u8 pin)
 {
-	u16 cmd;
 	int irq = -1;
 
 	if (dev->bus->number != 0)
@@ -188,8 +187,6 @@ int pcibios_map_irq(const struct pci_dev
 
 	switch (PCI_SLOT(dev->devfn)) {
 	case 0x00:
-		rt2880_pci_write_u32(PCI_BASE_ADDRESS_0, 0x08000000);
-		(void) rt2880_pci_read_u32(PCI_BASE_ADDRESS_0);
 		break;
 	case 0x11:
 		irq = RT288X_CPU_IRQ_PCI;
@@ -201,16 +198,6 @@ int pcibios_map_irq(const struct pci_dev
 		break;
 	}
 
-	pci_write_config_byte((struct pci_dev *) dev,
-		PCI_CACHE_LINE_SIZE, 0x14);
-	pci_write_config_byte((struct pci_dev *) dev, PCI_LATENCY_TIMER, 0xFF);
-	pci_read_config_word((struct pci_dev *) dev, PCI_COMMAND, &cmd);
-	cmd |= PCI_COMMAND_MASTER | PCI_COMMAND_IO | PCI_COMMAND_MEMORY |
-		PCI_COMMAND_INVALIDATE | PCI_COMMAND_FAST_BACK |
-		PCI_COMMAND_SERR | PCI_COMMAND_WAIT | PCI_COMMAND_PARITY;
-	pci_write_config_word((struct pci_dev *) dev, PCI_COMMAND, cmd);
-	pci_write_config_byte((struct pci_dev *) dev, PCI_INTERRUPT_LINE,
-			      dev->irq);
 	return irq;
 }
 
@@ -251,6 +238,30 @@ static int rt288x_pci_probe(struct platf
 
 int pcibios_plat_dev_init(struct pci_dev *dev)
 {
+	static bool slot0_init;
+
+	/*
+	 * Nobody seems to initialize slot 0, but this platform requires it, so
+	 * do it once when some other slot is being enabled. The PCI subsystem
+	 * should configure other slots properly, so no need to do anything
+	 * special for those.
+	 */
+	if (!slot0_init && dev->bus->number == 0) {
+		u16 cmd;
+		u32 bar0;
+
+		slot0_init = true;
+
+		pci_bus_write_config_dword(dev->bus, 0, PCI_BASE_ADDRESS_0,
+					   0x08000000);
+		pci_bus_read_config_dword(dev->bus, 0, PCI_BASE_ADDRESS_0,
+					  &bar0);
+
+		pci_bus_read_config_word(dev->bus, 0, PCI_COMMAND, &cmd);
+		cmd |= PCI_COMMAND_MASTER | PCI_COMMAND_IO | PCI_COMMAND_MEMORY;
+		pci_bus_write_config_word(dev->bus, 0, PCI_COMMAND, cmd);
+	}
+
 	return 0;
 }
 



^ permalink raw reply	[flat|nested] 702+ messages in thread

* [PATCH 5.12 032/677] FDDI: defxx: Bail out gracefully with unassigned PCI resource for CSR
  2021-05-12 14:40 [PATCH 5.12 000/677] 5.12.4-rc1 review Greg Kroah-Hartman
                   ` (30 preceding siblings ...)
  2021-05-12 14:41 ` [PATCH 5.12 031/677] MIPS: pci-rt2880: fix slot 0 configuration Greg Kroah-Hartman
@ 2021-05-12 14:41 ` Greg Kroah-Hartman
  2021-05-12 14:41 ` [PATCH 5.12 033/677] PCI: Allow VPD access for QLogic ISP2722 Greg Kroah-Hartman
                   ` (652 subsequent siblings)
  684 siblings, 0 replies; 702+ messages in thread
From: Greg Kroah-Hartman @ 2021-05-12 14:41 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Maciej W. Rozycki, David S. Miller

From: Maciej W. Rozycki <macro@orcam.me.uk>

commit f626ca682912fab55dff15469ce893ae16b65c7e upstream.

Recent versions of the PCI Express specification have deprecated support
for I/O transactions and actually some PCIe host bridges, such as Power
Systems Host Bridge 4 (PHB4), do not implement them.

For those systems the PCI BARs that request a mapping in the I/O space
have the length recorded in the corresponding PCI resource set to zero,
which makes it unassigned:

# lspci -s 0031:02:04.0 -v
0031:02:04.0 FDDI network controller: Digital Equipment Corporation PCI-to-PDQ Interface Chip [PFI] FDDI (DEFPA) (rev 02)
	Subsystem: Digital Equipment Corporation FDDIcontroller/PCI (DEFPA)
	Flags: bus master, medium devsel, latency 136, IRQ 57, NUMA node 8
	Memory at 620c080020000 (32-bit, non-prefetchable) [size=128]
	I/O ports at <unassigned> [disabled]
	Memory at 620c080030000 (32-bit, non-prefetchable) [size=64K]
	Capabilities: [50] Power Management version 2
	Kernel driver in use: defxx
	Kernel modules: defxx

#

Regardless the driver goes ahead and requests it (here observed with a
Raptor Talos II POWER9 system), resulting in an odd /proc/ioport entry:

# cat /proc/ioports
00000000-ffffffffffffffff : 0031:02:04.0
#

Furthermore, the system gets confused as the driver actually continues
and pokes at those locations, causing a flood of messages being output
to the system console by the underlying system firmware, like:

defxx: v1.11 2014/07/01  Lawrence V. Stefani and others
defxx 0031:02:04.0: enabling device (0140 -> 0142)
LPC[000]: Got SYNC no-response error. Error address reg: 0xd0010000
IPMI: dropping non severe PEL event
LPC[000]: Got SYNC no-response error. Error address reg: 0xd0010014
IPMI: dropping non severe PEL event
LPC[000]: Got SYNC no-response error. Error address reg: 0xd0010014
IPMI: dropping non severe PEL event

and so on and so on (possibly intermixed actually, as there's no locking
between the kernel and the firmware in console port access with this
particular system, but cleaned up above for clarity), and once some 10k
of such pairs of the latter two messages have been produced an interace
eventually shows up in a useless state:

0031:02:04.0: DEFPA at I/O addr = 0x0, IRQ = 57, Hardware addr = 00-00-00-00-00-00

This was not expected to happen as resource handling was added to the
driver a while ago, because it was not known at that time that a PCI
system would be possible that cannot assign port I/O resources, and
oddly enough `request_region' does not fail, which would have caught it.

Correct the problem then by checking for the length of zero for the CSR
resource and bail out gracefully refusing to register an interface if
that turns out to be the case, producing messages like:

defxx: v1.11 2014/07/01  Lawrence V. Stefani and others
0031:02:04.0: Cannot use I/O, no address set, aborting
0031:02:04.0: Recompile driver with "CONFIG_DEFXX_MMIO=y"

Keep the original check for the EISA MMIO resource as implemented,
because in that case the length is hardwired to 0x400 as a consequence
of how the compare/mask address decoding works in the ESIC chip and it
is only the base address that is set to zero if MMIO has been disabled
for the adapter in EISA configuration, which in turn could be a valid
bus address in a legacy-free system implementing PCI, especially for
port I/O.

Where the EISA MMIO resource has been disabled for the adapter in EISA
configuration this arrangement keeps producing messages like:

eisa 00:05: EISA: slot 5: DEC3002 detected
defxx: v1.11 2014/07/01  Lawrence V. Stefani and others
00:05: Cannot use MMIO, no address set, aborting
00:05: Recompile driver with "CONFIG_DEFXX_MMIO=n"
00:05: Or run ECU and set adapter's MMIO location

with the last two lines now swapped for easier handling in the driver.

There is no need to check for and catch the case of a port I/O resource
not having been assigned for EISA as the adapter uses the slot-specific
I/O space, which gets assigned by how EISA has been specified and maps
directly to the particular slot an option card has been placed in.  And
the EISA variant of the adapter has additional registers that are only
accessible via the port I/O space anyway.

While at it factor out the error message calls into helpers and fix an
argument order bug with the `pr_err' call now in `dfx_register_res_err'.

Signed-off-by: Maciej W. Rozycki <macro@orcam.me.uk>
Fixes: 4d0438e56a8f ("defxx: Clean up DEFEA resource management")
Cc: stable@vger.kernel.org # v3.19+
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/net/fddi/defxx.c |   47 ++++++++++++++++++++++++++++++-----------------
 1 file changed, 30 insertions(+), 17 deletions(-)

--- a/drivers/net/fddi/defxx.c
+++ b/drivers/net/fddi/defxx.c
@@ -495,6 +495,25 @@ static const struct net_device_ops dfx_n
 	.ndo_set_mac_address	= dfx_ctl_set_mac_address,
 };
 
+static void dfx_register_res_alloc_err(const char *print_name, bool mmio,
+				       bool eisa)
+{
+	pr_err("%s: Cannot use %s, no address set, aborting\n",
+	       print_name, mmio ? "MMIO" : "I/O");
+	pr_err("%s: Recompile driver with \"CONFIG_DEFXX_MMIO=%c\"\n",
+	       print_name, mmio ? 'n' : 'y');
+	if (eisa && mmio)
+		pr_err("%s: Or run ECU and set adapter's MMIO location\n",
+		       print_name);
+}
+
+static void dfx_register_res_err(const char *print_name, bool mmio,
+				 unsigned long start, unsigned long len)
+{
+	pr_err("%s: Cannot reserve %s resource 0x%lx @ 0x%lx, aborting\n",
+	       print_name, mmio ? "MMIO" : "I/O", len, start);
+}
+
 /*
  * ================
  * = dfx_register =
@@ -568,15 +587,12 @@ static int dfx_register(struct device *b
 	dev_set_drvdata(bdev, dev);
 
 	dfx_get_bars(bdev, bar_start, bar_len);
-	if (dfx_bus_eisa && dfx_use_mmio && bar_start[0] == 0) {
-		pr_err("%s: Cannot use MMIO, no address set, aborting\n",
-		       print_name);
-		pr_err("%s: Run ECU and set adapter's MMIO location\n",
-		       print_name);
-		pr_err("%s: Or recompile driver with \"CONFIG_DEFXX_MMIO=n\""
-		       "\n", print_name);
+	if (bar_len[0] == 0 ||
+	    (dfx_bus_eisa && dfx_use_mmio && bar_start[0] == 0)) {
+		dfx_register_res_alloc_err(print_name, dfx_use_mmio,
+					   dfx_bus_eisa);
 		err = -ENXIO;
-		goto err_out;
+		goto err_out_disable;
 	}
 
 	if (dfx_use_mmio)
@@ -585,18 +601,16 @@ static int dfx_register(struct device *b
 	else
 		region = request_region(bar_start[0], bar_len[0], print_name);
 	if (!region) {
-		pr_err("%s: Cannot reserve %s resource 0x%lx @ 0x%lx, "
-		       "aborting\n", dfx_use_mmio ? "MMIO" : "I/O", print_name,
-		       (long)bar_len[0], (long)bar_start[0]);
+		dfx_register_res_err(print_name, dfx_use_mmio,
+				     bar_start[0], bar_len[0]);
 		err = -EBUSY;
 		goto err_out_disable;
 	}
 	if (bar_start[1] != 0) {
 		region = request_region(bar_start[1], bar_len[1], print_name);
 		if (!region) {
-			pr_err("%s: Cannot reserve I/O resource "
-			       "0x%lx @ 0x%lx, aborting\n", print_name,
-			       (long)bar_len[1], (long)bar_start[1]);
+			dfx_register_res_err(print_name, 0,
+					     bar_start[1], bar_len[1]);
 			err = -EBUSY;
 			goto err_out_csr_region;
 		}
@@ -604,9 +618,8 @@ static int dfx_register(struct device *b
 	if (bar_start[2] != 0) {
 		region = request_region(bar_start[2], bar_len[2], print_name);
 		if (!region) {
-			pr_err("%s: Cannot reserve I/O resource "
-			       "0x%lx @ 0x%lx, aborting\n", print_name,
-			       (long)bar_len[2], (long)bar_start[2]);
+			dfx_register_res_err(print_name, 0,
+					     bar_start[2], bar_len[2]);
 			err = -EBUSY;
 			goto err_out_bh_region;
 		}



^ permalink raw reply	[flat|nested] 702+ messages in thread

* [PATCH 5.12 033/677] PCI: Allow VPD access for QLogic ISP2722
  2021-05-12 14:40 [PATCH 5.12 000/677] 5.12.4-rc1 review Greg Kroah-Hartman
                   ` (31 preceding siblings ...)
  2021-05-12 14:41 ` [PATCH 5.12 032/677] FDDI: defxx: Bail out gracefully with unassigned PCI resource for CSR Greg Kroah-Hartman
@ 2021-05-12 14:41 ` Greg Kroah-Hartman
  2021-05-12 14:41 ` [PATCH 5.12 034/677] KVM: x86: Defer the MMU unload to the normal path on an global INVPCID Greg Kroah-Hartman
                   ` (651 subsequent siblings)
  684 siblings, 0 replies; 702+ messages in thread
From: Greg Kroah-Hartman @ 2021-05-12 14:41 UTC (permalink / raw)
  To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Arun Easi, Bjorn Helgaas

From: Arun Easi <aeasi@marvell.com>

commit e00dc69b5f17c444a38cd9745a0f76bc989b3af4 upstream.

0d5370d1d852 ("PCI: Prevent VPD access for QLogic ISP2722") disabled access
to VPD of the ISP2722-based 16/32Gb Fibre Channel to PCIe Adapter because
reading past the end of the VPD caused NMIs.

104daa71b396 ("PCI: Determine actual VPD size on first access") limits
reads to the actual size of VPD, which should prevent these NMIs.

104daa71b396 was merged *before* 0d5370d1d852, but we think the testing
that prompted 0d5370d1d852 ("PCI: Prevent VPD access for QLogic ISP2722")
was done with a kernel that lacked 104daa71b396.  See [1, 2].

Remove the quirk added by 0d5370d1d852 ("PCI: Prevent VPD access for QLogic
ISP2722") so customers can read the HBA VPD.

[1] https://lore.kernel.org/linux-pci/alpine.LRH.2.21.9999.2012161641230.28924@irv1user01.caveonetworks.com/
[2] https://lore.kernel.org/linux-pci/alpine.LRH.2.21.9999.2104071535110.13940@irv1user01.caveonetworks.com/
[bhelgaas: commit log]
Link: https://lore.kernel.org/r/20210409215153.16569-2-aeasi@marvell.com
Signed-off-by: Arun Easi <aeasi@marvell.com>
Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
Cc: stable@vger.kernel.org      # v4.6+
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/pci/vpd.c |    1 -
 1 file changed, 1 deletion(-)

--- a/drivers/pci/vpd.c
+++ b/drivers/pci/vpd.c
@@ -570,7 +570,6 @@ DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_LS
 DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_LSI_LOGIC, 0x005f, quirk_blacklist_vpd);
 DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_ATTANSIC, PCI_ANY_ID,
 		quirk_blacklist_vpd);
-DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_QLOGIC, 0x2261, quirk_blacklist_vpd);
 /*
  * The Amazon Annapurna Labs 0x0031 device id is reused for other non Root Port
  * device types, so the quirk is registered for the PCI_CLASS_BRIDGE_PCI class.



^ permalink raw reply	[flat|nested] 702+ messages in thread

* [PATCH 5.12 034/677] KVM: x86: Defer the MMU unload to the normal path on an global INVPCID
  2021-05-12 14:40 [PATCH 5.12 000/677] 5.12.4-rc1 review Greg Kroah-Hartman
                   ` (32 preceding siblings ...)
  2021-05-12 14:41 ` [PATCH 5.12 033/677] PCI: Allow VPD access for QLogic ISP2722 Greg Kroah-Hartman
@ 2021-05-12 14:41 ` Greg Kroah-Hartman
  2021-05-12 14:41 ` [PATCH 5.12 035/677] PCI: xgene: Fix cfg resource mapping Greg Kroah-Hartman
                   ` (650 subsequent siblings)
  684 siblings, 0 replies; 702+ messages in thread
From: Greg Kroah-Hartman @ 2021-05-12 14:41 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Sean Christopherson, Paolo Bonzini

From: Sean Christopherson <seanjc@google.com>

commit f66c53b3b94f658590e1012bf6d922f8b7e01bda upstream.

Defer unloading the MMU after a INVPCID until the instruction emulation
has completed, i.e. until after RIP has been updated.

On VMX, this is a benign bug as VMX doesn't touch the MMU when skipping
an emulated instruction.  However, on SVM, if nrip is disabled, the
emulator is used to skip an instruction, which would lead to fireworks
if the emulator were invoked without a valid MMU.

Fixes: eb4b248e152d ("kvm: vmx: Support INVPCID in shadow paging mode")
Cc: stable@vger.kernel.org
Signed-off-by: Sean Christopherson <seanjc@google.com>
Message-Id: <20210305011101.3597423-15-seanjc@google.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 arch/x86/kvm/x86.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

--- a/arch/x86/kvm/x86.c
+++ b/arch/x86/kvm/x86.c
@@ -11539,7 +11539,7 @@ int kvm_handle_invpcid(struct kvm_vcpu *
 
 		fallthrough;
 	case INVPCID_TYPE_ALL_INCL_GLOBAL:
-		kvm_mmu_unload(vcpu);
+		kvm_make_request(KVM_REQ_MMU_RELOAD, vcpu);
 		return kvm_skip_emulated_instruction(vcpu);
 
 	default:



^ permalink raw reply	[flat|nested] 702+ messages in thread

* [PATCH 5.12 035/677] PCI: xgene: Fix cfg resource mapping
  2021-05-12 14:40 [PATCH 5.12 000/677] 5.12.4-rc1 review Greg Kroah-Hartman
                   ` (33 preceding siblings ...)
  2021-05-12 14:41 ` [PATCH 5.12 034/677] KVM: x86: Defer the MMU unload to the normal path on an global INVPCID Greg Kroah-Hartman
@ 2021-05-12 14:41 ` Greg Kroah-Hartman
  2021-05-12 14:41 ` [PATCH 5.12 036/677] PCI: keystone: Let AM65 use the pci_ops defined in pcie-designware-host.c Greg Kroah-Hartman
                   ` (649 subsequent siblings)
  684 siblings, 0 replies; 702+ messages in thread
From: Greg Kroah-Hartman @ 2021-05-12 14:41 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, dann.frazier, Dejin Zheng, Lorenzo Pieralisi

From: Dejin Zheng <zhengdejin5@gmail.com>

commit d4707d79fae08c8996a1ba45965a491045a22dda upstream.

In commit e2dcd20b1645 a change was made to use
devm_platform_ioremap_resource_byname() to simplify code and remove
the res variable; this was wrong since the res variable is still needed
and as an outcome the port->cfg_addr gets an erroneous address.

Revert the change going back to original behaviour.

Link: https://lore.kernel.org/r/20210328144118.305074-1-zhengdejin5@gmail.com
Fixes: e2dcd20b1645a ("PCI: controller: Convert to devm_platform_ioremap_resource_byname()")
Reported-by: dann.frazier@canonical.com
Tested-by: dann frazier <dann.frazier@canonical.com>
Signed-off-by: Dejin Zheng <zhengdejin5@gmail.com>
Signed-off-by: Lorenzo Pieralisi <lorenzo.pieralisi@arm.com>
Cc: stable@vger.kernel.org    # v5.9+
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/pci/controller/pci-xgene.c |    3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

--- a/drivers/pci/controller/pci-xgene.c
+++ b/drivers/pci/controller/pci-xgene.c
@@ -354,7 +354,8 @@ static int xgene_pcie_map_reg(struct xge
 	if (IS_ERR(port->csr_base))
 		return PTR_ERR(port->csr_base);
 
-	port->cfg_base = devm_platform_ioremap_resource_byname(pdev, "cfg");
+	res = platform_get_resource_byname(pdev, IORESOURCE_MEM, "cfg");
+	port->cfg_base = devm_ioremap_resource(dev, res);
 	if (IS_ERR(port->cfg_base))
 		return PTR_ERR(port->cfg_base);
 	port->cfg_addr = res->start;



^ permalink raw reply	[flat|nested] 702+ messages in thread

* [PATCH 5.12 036/677] PCI: keystone: Let AM65 use the pci_ops defined in pcie-designware-host.c
  2021-05-12 14:40 [PATCH 5.12 000/677] 5.12.4-rc1 review Greg Kroah-Hartman
                   ` (34 preceding siblings ...)
  2021-05-12 14:41 ` [PATCH 5.12 035/677] PCI: xgene: Fix cfg resource mapping Greg Kroah-Hartman
@ 2021-05-12 14:41 ` Greg Kroah-Hartman
  2021-05-12 14:41 ` [PATCH 5.12 037/677] PM / devfreq: Unlock mutex and free devfreq struct in error path Greg Kroah-Hartman
                   ` (648 subsequent siblings)
  684 siblings, 0 replies; 702+ messages in thread
From: Greg Kroah-Hartman @ 2021-05-12 14:41 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Kishon Vijay Abraham I,
	Lorenzo Pieralisi, Krzysztof Wilczyński

From: Kishon Vijay Abraham I <kishon@ti.com>

commit 3d0b2a3a87ce5ae85de46c4241afd52ab8b566fe upstream.

Both TI's AM65x (K3) and TI's K2 PCIe driver are implemented in
pci-keystone. However Only K2 PCIe driver should use it's own pci_ops
for configuration space accesses. But commit 10a797c6e54a
("PCI: dwc: keystone: Use pci_ops for config space accessors") used
custom pci_ops for both AM65x and K2. This breaks configuration space
access for AM65x platform. Fix it here.

Link: https://lore.kernel.org/r/20210317131518.11040-1-kishon@ti.com
Fixes: 10a797c6e54a ("PCI: dwc: keystone: Use pci_ops for config space accessors")
Signed-off-by: Kishon Vijay Abraham I <kishon@ti.com>
Signed-off-by: Lorenzo Pieralisi <lorenzo.pieralisi@arm.com>
Reviewed-by: Krzysztof Wilczyński <kw@linux.com>
Cc: <stable@vger.kernel.org> # v5.10
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/pci/controller/dwc/pci-keystone.c |    3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

--- a/drivers/pci/controller/dwc/pci-keystone.c
+++ b/drivers/pci/controller/dwc/pci-keystone.c
@@ -798,7 +798,8 @@ static int __init ks_pcie_host_init(stru
 	int ret;
 
 	pp->bridge->ops = &ks_pcie_ops;
-	pp->bridge->child_ops = &ks_child_pcie_ops;
+	if (!ks_pcie->is_am6)
+		pp->bridge->child_ops = &ks_child_pcie_ops;
 
 	ret = ks_pcie_config_legacy_irq(ks_pcie);
 	if (ret)



^ permalink raw reply	[flat|nested] 702+ messages in thread

* [PATCH 5.12 037/677] PM / devfreq: Unlock mutex and free devfreq struct in error path
  2021-05-12 14:40 [PATCH 5.12 000/677] 5.12.4-rc1 review Greg Kroah-Hartman
                   ` (35 preceding siblings ...)
  2021-05-12 14:41 ` [PATCH 5.12 036/677] PCI: keystone: Let AM65 use the pci_ops defined in pcie-designware-host.c Greg Kroah-Hartman
@ 2021-05-12 14:41 ` Greg Kroah-Hartman
  2021-05-12 14:41 ` [PATCH 5.12 038/677] soc/tegra: regulators: Fix locking up when voltage-spread is out of range Greg Kroah-Hartman
                   ` (647 subsequent siblings)
  684 siblings, 0 replies; 702+ messages in thread
From: Greg Kroah-Hartman @ 2021-05-12 14:41 UTC (permalink / raw)
  To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Lukasz Luba, Chanwoo Choi

From: Lukasz Luba <lukasz.luba@arm.com>

commit 8b50a7995770d41a2e8d9c422cd2882aca0dedd2 upstream.

The devfreq->lock is held for time of setup. Release the lock in the
error path, before jumping to the end of the function.

Change the goto destination which frees the allocated memory.

Cc: v5.9+ <stable@vger.kernel.org> # v5.9+
Fixes: 4dc3bab8687f ("PM / devfreq: Add support delayed timer for polling mode")
Signed-off-by: Lukasz Luba <lukasz.luba@arm.com>
Signed-off-by: Chanwoo Choi <cw00.choi@samsung.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/devfreq/devfreq.c |    3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

--- a/drivers/devfreq/devfreq.c
+++ b/drivers/devfreq/devfreq.c
@@ -821,7 +821,8 @@ struct devfreq *devfreq_add_device(struc
 
 	if (devfreq->profile->timer < 0
 		|| devfreq->profile->timer >= DEVFREQ_TIMER_NUM) {
-		goto err_out;
+		mutex_unlock(&devfreq->lock);
+		goto err_dev;
 	}
 
 	if (!devfreq->profile->max_state && !devfreq->profile->freq_table) {



^ permalink raw reply	[flat|nested] 702+ messages in thread

* [PATCH 5.12 038/677] soc/tegra: regulators: Fix locking up when voltage-spread is out of range
  2021-05-12 14:40 [PATCH 5.12 000/677] 5.12.4-rc1 review Greg Kroah-Hartman
                   ` (36 preceding siblings ...)
  2021-05-12 14:41 ` [PATCH 5.12 037/677] PM / devfreq: Unlock mutex and free devfreq struct in error path Greg Kroah-Hartman
@ 2021-05-12 14:41 ` Greg Kroah-Hartman
  2021-05-12 14:41 ` [PATCH 5.12 039/677] iio: inv_mpu6050: Fully validate gyro and accel scale writes Greg Kroah-Hartman
                   ` (646 subsequent siblings)
  684 siblings, 0 replies; 702+ messages in thread
From: Greg Kroah-Hartman @ 2021-05-12 14:41 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Peter Geis, Dmitry Osipenko,
	Thierry Reding, Matt Merhar

From: Dmitry Osipenko <digetx@gmail.com>

commit ef85bb582c41524e9e68dfdbde48e519dac4ab3d upstream.

Fix voltage coupler lockup which happens when voltage-spread is out
of range due to a bug in the code. The max-spread requirement shall be
accounted when CPU regulator doesn't have consumers. This problem is
observed on Tegra30 Ouya game console once system-wide DVFS is enabled
in a device-tree.

Fixes: 783807436f36 ("soc/tegra: regulators: Add regulators coupler for Tegra30")
Cc: stable@vger.kernel.org
Reported-by: Peter Geis <pgwipeout@gmail.com>
Tested-by: Peter Geis <pgwipeout@gmail.com> # Ouya T30
Tested-by: Matt Merhar <mattmerhar@protonmail.com> # Ouya T30
Signed-off-by: Dmitry Osipenko <digetx@gmail.com>
Signed-off-by: Thierry Reding <treding@nvidia.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/soc/tegra/regulators-tegra30.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

--- a/drivers/soc/tegra/regulators-tegra30.c
+++ b/drivers/soc/tegra/regulators-tegra30.c
@@ -178,7 +178,7 @@ static int tegra30_voltage_update(struct
 	 * survive the voltage drop if it's running on a higher frequency.
 	 */
 	if (!cpu_min_uV_consumers)
-		cpu_min_uV = cpu_uV;
+		cpu_min_uV = max(cpu_uV, cpu_min_uV);
 
 	/*
 	 * Bootloader shall set up voltages correctly, but if it



^ permalink raw reply	[flat|nested] 702+ messages in thread

* [PATCH 5.12 039/677] iio: inv_mpu6050: Fully validate gyro and accel scale writes
  2021-05-12 14:40 [PATCH 5.12 000/677] 5.12.4-rc1 review Greg Kroah-Hartman
                   ` (37 preceding siblings ...)
  2021-05-12 14:41 ` [PATCH 5.12 038/677] soc/tegra: regulators: Fix locking up when voltage-spread is out of range Greg Kroah-Hartman
@ 2021-05-12 14:41 ` Greg Kroah-Hartman
  2021-05-12 14:41 ` [PATCH 5.12 040/677] iio: magnetometer: yas530: Include right header Greg Kroah-Hartman
                   ` (645 subsequent siblings)
  684 siblings, 0 replies; 702+ messages in thread
From: Greg Kroah-Hartman @ 2021-05-12 14:41 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Lars-Peter Clausen,
	Jean-Baptiste Maneyrol, Stable, Jonathan Cameron

From: Lars-Peter Clausen <lars@metafoo.de>

commit e09fe9135399807b8397798a53160e055dc6c29f upstream.

When setting the gyro or accelerometer scale the inv_mpu6050 driver ignores
the integer part of the value. As a result e.g. all of 0.13309, 1.13309,
12345.13309, ... are accepted as a valid gyro scale and 0.13309 is the
scale that gets set in all those cases.

Make sure to check that the integer part of the scale value is 0 and reject
it otherwise.

Fixes: 09a642b78523 ("Invensense MPU6050 Device Driver.")
Signed-off-by: Lars-Peter Clausen <lars@metafoo.de>
Acked-by: Jean-Baptiste Maneyrol <jmaneyrol@invensense.com>
Link: https://lore.kernel.org/r/20210405114441.24167-1-lars@metafoo.de
Cc: <Stable@vger.kernel.org>
Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/iio/imu/inv_mpu6050/inv_mpu_core.c |   20 ++++++++++++++------
 1 file changed, 14 insertions(+), 6 deletions(-)

--- a/drivers/iio/imu/inv_mpu6050/inv_mpu_core.c
+++ b/drivers/iio/imu/inv_mpu6050/inv_mpu_core.c
@@ -731,12 +731,16 @@ inv_mpu6050_read_raw(struct iio_dev *ind
 	}
 }
 
-static int inv_mpu6050_write_gyro_scale(struct inv_mpu6050_state *st, int val)
+static int inv_mpu6050_write_gyro_scale(struct inv_mpu6050_state *st, int val,
+					int val2)
 {
 	int result, i;
 
+	if (val != 0)
+		return -EINVAL;
+
 	for (i = 0; i < ARRAY_SIZE(gyro_scale_6050); ++i) {
-		if (gyro_scale_6050[i] == val) {
+		if (gyro_scale_6050[i] == val2) {
 			result = inv_mpu6050_set_gyro_fsr(st, i);
 			if (result)
 				return result;
@@ -767,13 +771,17 @@ static int inv_write_raw_get_fmt(struct
 	return -EINVAL;
 }
 
-static int inv_mpu6050_write_accel_scale(struct inv_mpu6050_state *st, int val)
+static int inv_mpu6050_write_accel_scale(struct inv_mpu6050_state *st, int val,
+					 int val2)
 {
 	int result, i;
 	u8 d;
 
+	if (val != 0)
+		return -EINVAL;
+
 	for (i = 0; i < ARRAY_SIZE(accel_scale); ++i) {
-		if (accel_scale[i] == val) {
+		if (accel_scale[i] == val2) {
 			d = (i << INV_MPU6050_ACCL_CONFIG_FSR_SHIFT);
 			result = regmap_write(st->map, st->reg->accl_config, d);
 			if (result)
@@ -814,10 +822,10 @@ static int inv_mpu6050_write_raw(struct
 	case IIO_CHAN_INFO_SCALE:
 		switch (chan->type) {
 		case IIO_ANGL_VEL:
-			result = inv_mpu6050_write_gyro_scale(st, val2);
+			result = inv_mpu6050_write_gyro_scale(st, val, val2);
 			break;
 		case IIO_ACCEL:
-			result = inv_mpu6050_write_accel_scale(st, val2);
+			result = inv_mpu6050_write_accel_scale(st, val, val2);
 			break;
 		default:
 			result = -EINVAL;



^ permalink raw reply	[flat|nested] 702+ messages in thread

* [PATCH 5.12 040/677] iio: magnetometer: yas530: Include right header
  2021-05-12 14:40 [PATCH 5.12 000/677] 5.12.4-rc1 review Greg Kroah-Hartman
                   ` (38 preceding siblings ...)
  2021-05-12 14:41 ` [PATCH 5.12 039/677] iio: inv_mpu6050: Fully validate gyro and accel scale writes Greg Kroah-Hartman
@ 2021-05-12 14:41 ` Greg Kroah-Hartman
  2021-05-12 14:41 ` [PATCH 5.12 041/677] iio: sx9310: Fix write_.._debounce() Greg Kroah-Hartman
                   ` (644 subsequent siblings)
  684 siblings, 0 replies; 702+ messages in thread
From: Greg Kroah-Hartman @ 2021-05-12 14:41 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, kernel test robot, Harvey Harrison,
	Linus Walleij, Stable, Jonathan Cameron

From: Linus Walleij <linus.walleij@linaro.org>

commit bb354aeb364f9dee51e16edfdf6194ce4ba9237e upstream.

To get access to the big endian byte order parsing helpers
drivers need to include <asm/unaligned.h> and nothing else.

Reported-by: kernel test robot <lkp@intel.com>
Suggested-by: Harvey Harrison <harvey.harrison@gmail.com>
Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
Cc: <Stable@vger.kernel.org>
Link: https://lore.kernel.org/r/20210215153032.47962-1-linus.walleij@linaro.org
Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/iio/magnetometer/yamaha-yas530.c |    3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

--- a/drivers/iio/magnetometer/yamaha-yas530.c
+++ b/drivers/iio/magnetometer/yamaha-yas530.c
@@ -32,13 +32,14 @@
 #include <linux/regmap.h>
 #include <linux/regulator/consumer.h>
 #include <linux/random.h>
-#include <linux/unaligned/be_byteshift.h>
 
 #include <linux/iio/buffer.h>
 #include <linux/iio/iio.h>
 #include <linux/iio/trigger_consumer.h>
 #include <linux/iio/triggered_buffer.h>
 
+#include <asm/unaligned.h>
+
 /* This register map covers YAS530 and YAS532 but differs in YAS 537 and YAS539 */
 #define YAS5XX_DEVICE_ID		0x80
 #define YAS5XX_ACTUATE_INIT_COIL	0x81



^ permalink raw reply	[flat|nested] 702+ messages in thread

* [PATCH 5.12 041/677] iio: sx9310: Fix write_.._debounce()
  2021-05-12 14:40 [PATCH 5.12 000/677] 5.12.4-rc1 review Greg Kroah-Hartman
                   ` (39 preceding siblings ...)
  2021-05-12 14:41 ` [PATCH 5.12 040/677] iio: magnetometer: yas530: Include right header Greg Kroah-Hartman
@ 2021-05-12 14:41 ` Greg Kroah-Hartman
  2021-05-12 14:41 ` [PATCH 5.12 042/677] iio:accel:adis16201: Fix wrong axis assignment that prevents loading Greg Kroah-Hartman
                   ` (643 subsequent siblings)
  684 siblings, 0 replies; 702+ messages in thread
From: Greg Kroah-Hartman @ 2021-05-12 14:41 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Gwendal Grignou, Stephen Boyd,
	Jonathan Cameron

From: Gwendal Grignou <gwendal@chromium.org>

commit fc948409ccc1e8afe8655cee77c686eedbfbee60 upstream.

Check input to be sure it matches Semtech sx9310 specification and
can fit into debounce register.
Compare argument writen to thresh_.._period with read from same
sysfs attribute:

Before:                   Afer:
write   |  read           write   |  read
-1      |     8           -1 fails: -EINVAL
0       |     8           0       |     0
1       |     0           1       |     0
2..15   |  2^log2(N)      2..15   |  2^log2(N)
16      |     0           >= 16 fails: -EINVAL

Fixes: 1b6872015f0b ("iio: sx9310: Support setting debounce values")
Signed-off-by: Gwendal Grignou <gwendal@chromium.org>
Cc: stable@vger.kernel.org
Reviewed-by: Stephen Boyd <swboyd@chromium.org>
Link: https://lore.kernel.org/r/20210331182222.219533-1-gwendal@chromium.org
Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/iio/proximity/sx9310.c |   12 ++++++++++--
 1 file changed, 10 insertions(+), 2 deletions(-)

--- a/drivers/iio/proximity/sx9310.c
+++ b/drivers/iio/proximity/sx9310.c
@@ -763,7 +763,11 @@ static int sx9310_write_far_debounce(str
 	int ret;
 	unsigned int regval;
 
-	val = ilog2(val);
+	if (val > 0)
+		val = ilog2(val);
+	if (!FIELD_FIT(SX9310_REG_PROX_CTRL10_FAR_DEBOUNCE_MASK, val))
+		return -EINVAL;
+
 	regval = FIELD_PREP(SX9310_REG_PROX_CTRL10_FAR_DEBOUNCE_MASK, val);
 
 	mutex_lock(&data->mutex);
@@ -780,7 +784,11 @@ static int sx9310_write_close_debounce(s
 	int ret;
 	unsigned int regval;
 
-	val = ilog2(val);
+	if (val > 0)
+		val = ilog2(val);
+	if (!FIELD_FIT(SX9310_REG_PROX_CTRL10_CLOSE_DEBOUNCE_MASK, val))
+		return -EINVAL;
+
 	regval = FIELD_PREP(SX9310_REG_PROX_CTRL10_CLOSE_DEBOUNCE_MASK, val);
 
 	mutex_lock(&data->mutex);



^ permalink raw reply	[flat|nested] 702+ messages in thread

* [PATCH 5.12 042/677] iio:accel:adis16201: Fix wrong axis assignment that prevents loading
  2021-05-12 14:40 [PATCH 5.12 000/677] 5.12.4-rc1 review Greg Kroah-Hartman
                   ` (40 preceding siblings ...)
  2021-05-12 14:41 ` [PATCH 5.12 041/677] iio: sx9310: Fix write_.._debounce() Greg Kroah-Hartman
@ 2021-05-12 14:41 ` Greg Kroah-Hartman
  2021-05-12 14:41 ` [PATCH 5.12 043/677] iio:adc:ad7476: Fix remove handling Greg Kroah-Hartman
                   ` (642 subsequent siblings)
  684 siblings, 0 replies; 702+ messages in thread
From: Greg Kroah-Hartman @ 2021-05-12 14:41 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Jonathan Cameron, Stable,
	Himanshu Jha, Nuno Sá,
	Alexandru Ardelean

From: Jonathan Cameron <Jonathan.Cameron@huawei.com>

commit 4e102429f3dc62dce546f6107e34a4284634196d upstream.

Whilst running some basic tests as part of writing up the dt-bindings for
this driver (to follow), it became clear it doesn't actually load
currently.

iio iio:device1: tried to double register : in_incli_x_index
adis16201 spi0.0: Failed to create buffer sysfs interfaces
adis16201: probe of spi0.0 failed with error -16

Looks like a cut and paste / update bug.  Fixes tag obviously not accurate
but we don't want to bother carry thing back to before the driver moved
out of staging.

Fixes: 591298e54cea ("Staging: iio: accel: adis16201: Move adis16201 driver out of staging")
Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
Cc: <Stable@vger.kernel.org>
Cc: Himanshu Jha <himanshujha199640@gmail.com>
Cc: Nuno Sá <nuno.sa@analog.com>
Reviewed-by: Alexandru Ardelean <ardeleanalex@gmail.com>
Link: https://lore.kernel.org/r/20210321182956.844652-1-jic23@kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/iio/accel/adis16201.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

--- a/drivers/iio/accel/adis16201.c
+++ b/drivers/iio/accel/adis16201.c
@@ -215,7 +215,7 @@ static const struct iio_chan_spec adis16
 	ADIS_AUX_ADC_CHAN(ADIS16201_AUX_ADC_REG, ADIS16201_SCAN_AUX_ADC, 0, 12),
 	ADIS_INCLI_CHAN(X, ADIS16201_XINCL_OUT_REG, ADIS16201_SCAN_INCLI_X,
 			BIT(IIO_CHAN_INFO_CALIBBIAS), 0, 14),
-	ADIS_INCLI_CHAN(X, ADIS16201_YINCL_OUT_REG, ADIS16201_SCAN_INCLI_Y,
+	ADIS_INCLI_CHAN(Y, ADIS16201_YINCL_OUT_REG, ADIS16201_SCAN_INCLI_Y,
 			BIT(IIO_CHAN_INFO_CALIBBIAS), 0, 14),
 	IIO_CHAN_SOFT_TIMESTAMP(7)
 };



^ permalink raw reply	[flat|nested] 702+ messages in thread

* [PATCH 5.12 043/677] iio:adc:ad7476: Fix remove handling
  2021-05-12 14:40 [PATCH 5.12 000/677] 5.12.4-rc1 review Greg Kroah-Hartman
                   ` (41 preceding siblings ...)
  2021-05-12 14:41 ` [PATCH 5.12 042/677] iio:accel:adis16201: Fix wrong axis assignment that prevents loading Greg Kroah-Hartman
@ 2021-05-12 14:41 ` Greg Kroah-Hartman
  2021-05-12 14:41 ` [PATCH 5.12 044/677] iio: magnetometer: yas530: Fix return value on error path Greg Kroah-Hartman
                   ` (641 subsequent siblings)
  684 siblings, 0 replies; 702+ messages in thread
From: Greg Kroah-Hartman @ 2021-05-12 14:41 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Jonathan Cameron, Michael Hennerich,
	Alexandru Ardelean, Stable

From: Jonathan Cameron <Jonathan.Cameron@huawei.com>

commit 6baee4bd63f5fdf1716f88e95c21a683e94fe30d upstream.

This driver was in an odd half way state between devm based cleanup
and manual cleanup (most of which was missing).
I would guess something went wrong with a rebase or similar.
Anyhow, this basically finishes the job as a precursor to improving
the regulator handling.

Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
Fixes: 4bb2b8f94ace3 ("iio: adc: ad7476: implement devm_add_action_or_reset")
Cc: Michael Hennerich <michael.hennerich@analog.com>
Reviewed-by: Alexandru Ardelean <ardeleanalex@gmail.com>
Cc: <Stable@vger.kernel.org>
Link: https://lore.kernel.org/r/20210401171759.318140-2-jic23@kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/iio/adc/ad7476.c |   18 ++++--------------
 1 file changed, 4 insertions(+), 14 deletions(-)

--- a/drivers/iio/adc/ad7476.c
+++ b/drivers/iio/adc/ad7476.c
@@ -321,25 +321,15 @@ static int ad7476_probe(struct spi_devic
 	spi_message_init(&st->msg);
 	spi_message_add_tail(&st->xfer, &st->msg);
 
-	ret = iio_triggered_buffer_setup(indio_dev, NULL,
-			&ad7476_trigger_handler, NULL);
+	ret = devm_iio_triggered_buffer_setup(&spi->dev, indio_dev, NULL,
+					      &ad7476_trigger_handler, NULL);
 	if (ret)
-		goto error_disable_reg;
+		return ret;
 
 	if (st->chip_info->reset)
 		st->chip_info->reset(st);
 
-	ret = iio_device_register(indio_dev);
-	if (ret)
-		goto error_ring_unregister;
-	return 0;
-
-error_ring_unregister:
-	iio_triggered_buffer_cleanup(indio_dev);
-error_disable_reg:
-	regulator_disable(st->reg);
-
-	return ret;
+	return devm_iio_device_register(&spi->dev, indio_dev);
 }
 
 static const struct spi_device_id ad7476_id[] = {



^ permalink raw reply	[flat|nested] 702+ messages in thread

* [PATCH 5.12 044/677] iio: magnetometer: yas530: Fix return value on error path
  2021-05-12 14:40 [PATCH 5.12 000/677] 5.12.4-rc1 review Greg Kroah-Hartman
                   ` (42 preceding siblings ...)
  2021-05-12 14:41 ` [PATCH 5.12 043/677] iio:adc:ad7476: Fix remove handling Greg Kroah-Hartman
@ 2021-05-12 14:41 ` Greg Kroah-Hartman
  2021-05-12 14:41 ` [PATCH 5.12 045/677] iio: sx9310: Fix access to variable DT array Greg Kroah-Hartman
                   ` (640 subsequent siblings)
  684 siblings, 0 replies; 702+ messages in thread
From: Greg Kroah-Hartman @ 2021-05-12 14:41 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, kernel test robot, Dan Carpenter,
	Andy Shevchenko, Linus Walleij, Stable, Jonathan Cameron

From: Linus Walleij <linus.walleij@linaro.org>

commit e64837bf9e2c063d6b5bab51c0554a60270f636d upstream.

There was a missed return variable assignment in the
default errorpath of the switch statement in yas5xx_probe().
Fix it.

Reported-by: kernel test robot <lkp@intel.com>
Reported-by: Dan Carpenter <dan.carpenter@oracle.com>
Suggested-by: Andy Shevchenko <andy.shevchenko@gmail.com>
Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
Link: https://lore.kernel.org/r/20210215153023.47899-1-linus.walleij@linaro.org
Cc: <Stable@vger.kernel.org>
Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/iio/magnetometer/yamaha-yas530.c |    1 +
 1 file changed, 1 insertion(+)

--- a/drivers/iio/magnetometer/yamaha-yas530.c
+++ b/drivers/iio/magnetometer/yamaha-yas530.c
@@ -888,6 +888,7 @@ static int yas5xx_probe(struct i2c_clien
 		strncpy(yas5xx->name, "yas532", sizeof(yas5xx->name));
 		break;
 	default:
+		ret = -ENODEV;
 		dev_err(dev, "unhandled device ID %02x\n", yas5xx->devid);
 		goto assert_reset;
 	}



^ permalink raw reply	[flat|nested] 702+ messages in thread

* [PATCH 5.12 045/677] iio: sx9310: Fix access to variable DT array
  2021-05-12 14:40 [PATCH 5.12 000/677] 5.12.4-rc1 review Greg Kroah-Hartman
                   ` (43 preceding siblings ...)
  2021-05-12 14:41 ` [PATCH 5.12 044/677] iio: magnetometer: yas530: Fix return value on error path Greg Kroah-Hartman
@ 2021-05-12 14:41 ` Greg Kroah-Hartman
  2021-05-12 14:41 ` [PATCH 5.12 046/677] iio: hid-sensor-rotation: Fix quaternion data not correct Greg Kroah-Hartman
                   ` (639 subsequent siblings)
  684 siblings, 0 replies; 702+ messages in thread
From: Greg Kroah-Hartman @ 2021-05-12 14:41 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Gwendal Grignou, Andy Shevchenko,
	Jonathan Cameron

From: Gwendal Grignou <gwendal@chromium.org>

commit 6f0078ae704d94b1a93e5f3d0a44cf3d8090fa91 upstream.

With the current code, we want to read 4 entries from DT array
"semtech,combined-sensors". If there are less, we silently fail as
of_property_read_u32_array() returns -EOVERFLOW.

First count the number of entries and if between 1 and 4, collect the
content of the array.

Fixes: 5b19ca2c78a0 ("iio: sx9310: Set various settings from DT")
Signed-off-by: Gwendal Grignou <gwendal@chromium.org>
Reviewed-by: Andy Shevchenko <andy.shevchenko@gmail.com>
Link: https://lore.kernel.org/r/20210326184603.251683-2-gwendal@chromium.org
Cc: <stable@vger.kernel.org>
Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/iio/proximity/sx9310.c |   40 ++++++++++++++++++++++++++++------------
 1 file changed, 28 insertions(+), 12 deletions(-)

--- a/drivers/iio/proximity/sx9310.c
+++ b/drivers/iio/proximity/sx9310.c
@@ -1221,17 +1221,17 @@ static int sx9310_init_compensation(stru
 }
 
 static const struct sx9310_reg_default *
-sx9310_get_default_reg(struct sx9310_data *data, int i,
+sx9310_get_default_reg(struct sx9310_data *data, int idx,
 		       struct sx9310_reg_default *reg_def)
 {
-	int ret;
 	const struct device_node *np = data->client->dev.of_node;
-	u32 combined[SX9310_NUM_CHANNELS] = { 4, 4, 4, 4 };
+	u32 combined[SX9310_NUM_CHANNELS];
+	u32 start = 0, raw = 0, pos = 0;
 	unsigned long comb_mask = 0;
+	int ret, i, count;
 	const char *res;
-	u32 start = 0, raw = 0, pos = 0;
 
-	memcpy(reg_def, &sx9310_default_regs[i], sizeof(*reg_def));
+	memcpy(reg_def, &sx9310_default_regs[idx], sizeof(*reg_def));
 	if (!np)
 		return reg_def;
 
@@ -1242,15 +1242,31 @@ sx9310_get_default_reg(struct sx9310_dat
 			reg_def->def |= SX9310_REG_PROX_CTRL2_SHIELDEN_GROUND;
 		}
 
-		reg_def->def &= ~SX9310_REG_PROX_CTRL2_COMBMODE_MASK;
-		of_property_read_u32_array(np, "semtech,combined-sensors",
-					   combined, ARRAY_SIZE(combined));
-		for (i = 0; i < ARRAY_SIZE(combined); i++) {
-			if (combined[i] <= SX9310_NUM_CHANNELS)
-				comb_mask |= BIT(combined[i]);
+		count = of_property_count_elems_of_size(np, "semtech,combined-sensors",
+							sizeof(u32));
+		if (count > 0 && count <= ARRAY_SIZE(combined)) {
+			ret = of_property_read_u32_array(np, "semtech,combined-sensors",
+							 combined, count);
+			if (ret)
+				break;
+		} else {
+			/*
+			 * Either the property does not exist in the DT or the
+			 * number of entries is incorrect.
+			 */
+			break;
 		}
+		for (i = 0; i < count; i++) {
+			if (combined[i] >= SX9310_NUM_CHANNELS) {
+				/* Invalid sensor (invalid DT). */
+				break;
+			}
+			comb_mask |= BIT(combined[i]);
+		}
+		if (i < count)
+			break;
 
-		comb_mask &= 0xf;
+		reg_def->def &= ~SX9310_REG_PROX_CTRL2_COMBMODE_MASK;
 		if (comb_mask == (BIT(3) | BIT(2) | BIT(1) | BIT(0)))
 			reg_def->def |= SX9310_REG_PROX_CTRL2_COMBMODE_CS0_CS1_CS2_CS3;
 		else if (comb_mask == (BIT(1) | BIT(2)))



^ permalink raw reply	[flat|nested] 702+ messages in thread

* [PATCH 5.12 046/677] iio: hid-sensor-rotation: Fix quaternion data not correct
  2021-05-12 14:40 [PATCH 5.12 000/677] 5.12.4-rc1 review Greg Kroah-Hartman
                   ` (44 preceding siblings ...)
  2021-05-12 14:41 ` [PATCH 5.12 045/677] iio: sx9310: Fix access to variable DT array Greg Kroah-Hartman
@ 2021-05-12 14:41 ` Greg Kroah-Hartman
  2021-05-12 14:41 ` [PATCH 5.12 047/677] sc16is7xx: Defer probe if device read fails Greg Kroah-Hartman
                   ` (638 subsequent siblings)
  684 siblings, 0 replies; 702+ messages in thread
From: Greg Kroah-Hartman @ 2021-05-12 14:41 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Ye Xiang, Stable, Jonathan Cameron

From: Ye Xiang <xiang.ye@intel.com>

commit 6c3b615379d7cd90d2f70b3cf9860c5a4910546a upstream.

Because the data of HID_USAGE_SENSOR_ORIENT_QUATERNION defined by ISH FW
is s16, but quaternion data type is in_rot_quaternion_type(le:s16/32X4>>0),
need to transform data type from s16 to s32

May require manual backporting.

Fixes: fc18dddc0625 ("iio: hid-sensors: Added device rotation support")
Signed-off-by: Ye Xiang <xiang.ye@intel.com>
Link: https://lore.kernel.org/r/20210130102546.31397-1-xiang.ye@intel.com
Cc: <Stable@vger.kernel.org>
Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/iio/orientation/hid-sensor-rotation.c |   13 ++++++++++---
 1 file changed, 10 insertions(+), 3 deletions(-)

--- a/drivers/iio/orientation/hid-sensor-rotation.c
+++ b/drivers/iio/orientation/hid-sensor-rotation.c
@@ -21,7 +21,7 @@ struct dev_rot_state {
 	struct hid_sensor_common common_attributes;
 	struct hid_sensor_hub_attribute_info quaternion;
 	struct {
-		u32 sampled_vals[4] __aligned(16);
+		s32 sampled_vals[4] __aligned(16);
 		u64 timestamp __aligned(8);
 	} scan;
 	int scale_pre_decml;
@@ -170,8 +170,15 @@ static int dev_rot_capture_sample(struct
 	struct dev_rot_state *rot_state = iio_priv(indio_dev);
 
 	if (usage_id == HID_USAGE_SENSOR_ORIENT_QUATERNION) {
-		memcpy(&rot_state->scan.sampled_vals, raw_data,
-		       sizeof(rot_state->scan.sampled_vals));
+		if (raw_len / 4 == sizeof(s16)) {
+			rot_state->scan.sampled_vals[0] = ((s16 *)raw_data)[0];
+			rot_state->scan.sampled_vals[1] = ((s16 *)raw_data)[1];
+			rot_state->scan.sampled_vals[2] = ((s16 *)raw_data)[2];
+			rot_state->scan.sampled_vals[3] = ((s16 *)raw_data)[3];
+		} else {
+			memcpy(&rot_state->scan.sampled_vals, raw_data,
+			       sizeof(rot_state->scan.sampled_vals));
+		}
 
 		dev_dbg(&indio_dev->dev, "Recd Quat len:%zu::%zu\n", raw_len,
 			sizeof(rot_state->scan.sampled_vals));



^ permalink raw reply	[flat|nested] 702+ messages in thread

* [PATCH 5.12 047/677] sc16is7xx: Defer probe if device read fails
  2021-05-12 14:40 [PATCH 5.12 000/677] 5.12.4-rc1 review Greg Kroah-Hartman
                   ` (45 preceding siblings ...)
  2021-05-12 14:41 ` [PATCH 5.12 046/677] iio: hid-sensor-rotation: Fix quaternion data not correct Greg Kroah-Hartman
@ 2021-05-12 14:41 ` Greg Kroah-Hartman
  2021-05-12 14:41 ` [PATCH 5.12 048/677] phy: cadence: Sierra: Fix PHY power_on sequence Greg Kroah-Hartman
                   ` (637 subsequent siblings)
  684 siblings, 0 replies; 702+ messages in thread
From: Greg Kroah-Hartman @ 2021-05-12 14:41 UTC (permalink / raw)
  To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Annaliese McDermond

From: Annaliese McDermond <nh6z@nh6z.net>

commit 158e800e0fde91014812f5cdfb92ce812e3a33b4 upstream.

A test was added to the probe function to ensure the device was
actually connected and working before successfully completing a
probe.  If the device was actually there, but the I2C bus was not
ready yet for whatever reason, the probe fails permanently.

Change the probe so that we defer the probe on a regmap read
failure so that we try the probe again when the dependent drivers
are potentially loaded.  This should not affect the case where the
device truly isn't present because the probe will never successfully
complete.

Fixes: 2aa916e67db3 ("sc16is7xx: Read the LSR register for basic device presence check")
Cc: stable@vger.kernel.org
Signed-off-by: Annaliese McDermond <nh6z@nh6z.net>
Link: https://lore.kernel.org/r/010101787f9c3fd8-c1815c00-2d6b-4c85-a96a-a13e68597fda-000000@us-west-2.amazonses.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/tty/serial/sc16is7xx.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

--- a/drivers/tty/serial/sc16is7xx.c
+++ b/drivers/tty/serial/sc16is7xx.c
@@ -1196,7 +1196,7 @@ static int sc16is7xx_probe(struct device
 	ret = regmap_read(regmap,
 			  SC16IS7XX_LSR_REG << SC16IS7XX_REG_SHIFT, &val);
 	if (ret < 0)
-		return ret;
+		return -EPROBE_DEFER;
 
 	/* Alloc port structure */
 	s = devm_kzalloc(dev, struct_size(s, p, devtype->nr_uart), GFP_KERNEL);



^ permalink raw reply	[flat|nested] 702+ messages in thread

* [PATCH 5.12 048/677] phy: cadence: Sierra: Fix PHY power_on sequence
  2021-05-12 14:40 [PATCH 5.12 000/677] 5.12.4-rc1 review Greg Kroah-Hartman
                   ` (46 preceding siblings ...)
  2021-05-12 14:41 ` [PATCH 5.12 047/677] sc16is7xx: Defer probe if device read fails Greg Kroah-Hartman
@ 2021-05-12 14:41 ` Greg Kroah-Hartman
  2021-05-12 14:41 ` [PATCH 5.12 049/677] misc: lis3lv02d: Fix false-positive WARN on various HP models Greg Kroah-Hartman
                   ` (636 subsequent siblings)
  684 siblings, 0 replies; 702+ messages in thread
From: Greg Kroah-Hartman @ 2021-05-12 14:41 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Kishon Vijay Abraham I,
	Philipp Zabel, Vinod Koul

From: Kishon Vijay Abraham I <kishon@ti.com>

commit 5b4f5757f83be34d1428a1ffbb68d4a1966e9aae upstream.

Commit 44d30d622821d ("phy: cadence: Add driver for Sierra PHY")
de-asserts PHY_RESET even before the configurations are loaded in
phy_init(). However PHY_RESET should be de-asserted only after
all the configurations has been initialized, instead of de-asserting
in probe. Fix it here.

Fixes: 44d30d622821d ("phy: cadence: Add driver for Sierra PHY")
Signed-off-by: Kishon Vijay Abraham I <kishon@ti.com>
Cc: <stable@vger.kernel.org> # v5.4+
Reviewed-by: Philipp Zabel <p.zabel@pengutronix.de>
Link: https://lore.kernel.org/r/20210319124128.13308-2-kishon@ti.com
Signed-off-by: Vinod Koul <vkoul@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/phy/cadence/phy-cadence-sierra.c |    7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

--- a/drivers/phy/cadence/phy-cadence-sierra.c
+++ b/drivers/phy/cadence/phy-cadence-sierra.c
@@ -319,6 +319,12 @@ static int cdns_sierra_phy_on(struct phy
 	u32 val;
 	int ret;
 
+	ret = reset_control_deassert(sp->phy_rst);
+	if (ret) {
+		dev_err(dev, "Failed to take the PHY out of reset\n");
+		return ret;
+	}
+
 	/* Take the PHY lane group out of reset */
 	ret = reset_control_deassert(ins->lnk_rst);
 	if (ret) {
@@ -616,7 +622,6 @@ static int cdns_sierra_phy_probe(struct
 
 	pm_runtime_enable(dev);
 	phy_provider = devm_of_phy_provider_register(dev, of_phy_simple_xlate);
-	reset_control_deassert(sp->phy_rst);
 	return PTR_ERR_OR_ZERO(phy_provider);
 
 put_child:



^ permalink raw reply	[flat|nested] 702+ messages in thread

* [PATCH 5.12 049/677] misc: lis3lv02d: Fix false-positive WARN on various HP models
  2021-05-12 14:40 [PATCH 5.12 000/677] 5.12.4-rc1 review Greg Kroah-Hartman
                   ` (47 preceding siblings ...)
  2021-05-12 14:41 ` [PATCH 5.12 048/677] phy: cadence: Sierra: Fix PHY power_on sequence Greg Kroah-Hartman
@ 2021-05-12 14:41 ` Greg Kroah-Hartman
  2021-05-12 14:41 ` [PATCH 5.12 050/677] phy: ti: j721e-wiz: Invoke wiz_init() before of_platform_device_create() Greg Kroah-Hartman
                   ` (635 subsequent siblings)
  684 siblings, 0 replies; 702+ messages in thread
From: Greg Kroah-Hartman @ 2021-05-12 14:41 UTC (permalink / raw)
  To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Hans de Goede

From: Hans de Goede <hdegoede@redhat.com>

commit 3641762c1c9c7cfd84a7061a0a73054f09b412e3 upstream.

Before this commit lis3lv02d_get_pwron_wait() had a WARN_ONCE() to catch
a potential divide by 0. WARN macros should only be used to catch internal
kernel bugs and that is not the case here. We have been receiving a lot of
bug reports about kernel backtraces caused by this WARN.

The div value being checked comes from the lis3->odrs[] array. Which
is sized to be a power-of-2 matching the number of bits in lis3->odr_mask.

The only lis3 model where this array is not entirely filled with non zero
values. IOW the only model where we can hit the div == 0 check is the
3dc ("8 bits 3DC sensor") model:

int lis3_3dc_rates[16] = {0, 1, 10, 25, 50, 100, 200, 400, 1600, 5000};

Note the 0 value at index 0, according to the datasheet an odr index of 0
means "Power-down mode". HP typically uses a lis3 accelerometer for HDD
fall protection. What I believe is happening here is that on newer
HP devices, which only contain a SDD, the BIOS is leaving the lis3 device
powered-down since it is not used for HDD fall protection.

Note that the lis3_3dc_rates array initializer only specifies 10 values,
which matches the datasheet. So it also contains 6 zero values at the end.

Replace the WARN with a normal check, which treats an odr index of 0
as power-down and uses a normal dev_err() to report the error in case
odr index point past the initialized part of the array.

Fixes: 1510dd5954be ("lis3lv02d: avoid divide by zero due to unchecked")
Cc: stable@vger.kernel.org
Signed-off-by: Hans de Goede <hdegoede@redhat.com>
BugLink: https://bugzilla.redhat.com/show_bug.cgi?id=785814
BugLink: https://bugzilla.redhat.com/show_bug.cgi?id=1817027
BugLink: https://bugs.centos.org/view.php?id=10720
Link: https://lore.kernel.org/r/20210217102501.31758-1-hdegoede@redhat.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/misc/lis3lv02d/lis3lv02d.c |   21 ++++++++++++++++-----
 1 file changed, 16 insertions(+), 5 deletions(-)

--- a/drivers/misc/lis3lv02d/lis3lv02d.c
+++ b/drivers/misc/lis3lv02d/lis3lv02d.c
@@ -208,7 +208,7 @@ static int lis3_3dc_rates[16] = {0, 1, 1
 static int lis3_3dlh_rates[4] = {50, 100, 400, 1000};
 
 /* ODR is Output Data Rate */
-static int lis3lv02d_get_odr(struct lis3lv02d *lis3)
+static int lis3lv02d_get_odr_index(struct lis3lv02d *lis3)
 {
 	u8 ctrl;
 	int shift;
@@ -216,15 +216,23 @@ static int lis3lv02d_get_odr(struct lis3
 	lis3->read(lis3, CTRL_REG1, &ctrl);
 	ctrl &= lis3->odr_mask;
 	shift = ffs(lis3->odr_mask) - 1;
-	return lis3->odrs[(ctrl >> shift)];
+	return (ctrl >> shift);
 }
 
 static int lis3lv02d_get_pwron_wait(struct lis3lv02d *lis3)
 {
-	int div = lis3lv02d_get_odr(lis3);
+	int odr_idx = lis3lv02d_get_odr_index(lis3);
+	int div = lis3->odrs[odr_idx];
 
-	if (WARN_ONCE(div == 0, "device returned spurious data"))
+	if (div == 0) {
+		if (odr_idx == 0) {
+			/* Power-down mode, not sampling no need to sleep */
+			return 0;
+		}
+
+		dev_err(&lis3->pdev->dev, "Error unknown odrs-index: %d\n", odr_idx);
 		return -ENXIO;
+	}
 
 	/* LIS3 power on delay is quite long */
 	msleep(lis3->pwron_delay / div);
@@ -816,9 +824,12 @@ static ssize_t lis3lv02d_rate_show(struc
 			struct device_attribute *attr, char *buf)
 {
 	struct lis3lv02d *lis3 = dev_get_drvdata(dev);
+	int odr_idx;
 
 	lis3lv02d_sysfs_poweron(lis3);
-	return sprintf(buf, "%d\n", lis3lv02d_get_odr(lis3));
+
+	odr_idx = lis3lv02d_get_odr_index(lis3);
+	return sprintf(buf, "%d\n", lis3->odrs[odr_idx]);
 }
 
 static ssize_t lis3lv02d_rate_set(struct device *dev,



^ permalink raw reply	[flat|nested] 702+ messages in thread

* [PATCH 5.12 050/677] phy: ti: j721e-wiz: Invoke wiz_init() before of_platform_device_create()
  2021-05-12 14:40 [PATCH 5.12 000/677] 5.12.4-rc1 review Greg Kroah-Hartman
                   ` (48 preceding siblings ...)
  2021-05-12 14:41 ` [PATCH 5.12 049/677] misc: lis3lv02d: Fix false-positive WARN on various HP models Greg Kroah-Hartman
@ 2021-05-12 14:41 ` Greg Kroah-Hartman
  2021-05-12 14:41 ` [PATCH 5.12 051/677] misc: vmw_vmci: explicitly initialize vmci_notify_bm_set_msg struct Greg Kroah-Hartman
                   ` (634 subsequent siblings)
  684 siblings, 0 replies; 702+ messages in thread
From: Greg Kroah-Hartman @ 2021-05-12 14:41 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Kishon Vijay Abraham I,
	Swapnil Jakhade, Vinod Koul

From: Kishon Vijay Abraham I <kishon@ti.com>

commit f7eb147d306ad2efae6837e20d2944f03be42eb4 upstream.

Invoke wiz_init() before configuring anything else in Sierra/Torrent
(invoked as part of of_platform_device_create()). wiz_init() resets the
SERDES device and any configuration done in the probe() of
Sierra/Torrent will be lost. In order to prevent SERDES configuration
from getting reset, invoke wiz_init() immediately before invoking
of_platform_device_create().

Fixes: 091876cc355d ("phy: ti: j721e-wiz: Add support for WIZ module present in TI J721E SoC")
Signed-off-by: Kishon Vijay Abraham I <kishon@ti.com>
Reviewed-by: Swapnil Jakhade <sjakhade@cadence.com>
Cc: <stable@vger.kernel.org> # v5.10
Link: https://lore.kernel.org/r/20210319124128.13308-3-kishon@ti.com
Signed-off-by: Vinod Koul <vkoul@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/phy/ti/phy-j721e-wiz.c |   17 +++++++----------
 1 file changed, 7 insertions(+), 10 deletions(-)

--- a/drivers/phy/ti/phy-j721e-wiz.c
+++ b/drivers/phy/ti/phy-j721e-wiz.c
@@ -947,27 +947,24 @@ static int wiz_probe(struct platform_dev
 		goto err_get_sync;
 	}
 
+	ret = wiz_init(wiz);
+	if (ret) {
+		dev_err(dev, "WIZ initialization failed\n");
+		goto err_wiz_init;
+	}
+
 	serdes_pdev = of_platform_device_create(child_node, NULL, dev);
 	if (!serdes_pdev) {
 		dev_WARN(dev, "Unable to create SERDES platform device\n");
 		ret = -ENOMEM;
-		goto err_pdev_create;
-	}
-	wiz->serdes_pdev = serdes_pdev;
-
-	ret = wiz_init(wiz);
-	if (ret) {
-		dev_err(dev, "WIZ initialization failed\n");
 		goto err_wiz_init;
 	}
+	wiz->serdes_pdev = serdes_pdev;
 
 	of_node_put(child_node);
 	return 0;
 
 err_wiz_init:
-	of_platform_device_destroy(&serdes_pdev->dev, NULL);
-
-err_pdev_create:
 	wiz_clock_cleanup(wiz, node);
 
 err_get_sync:



^ permalink raw reply	[flat|nested] 702+ messages in thread

* [PATCH 5.12 051/677] misc: vmw_vmci: explicitly initialize vmci_notify_bm_set_msg struct
  2021-05-12 14:40 [PATCH 5.12 000/677] 5.12.4-rc1 review Greg Kroah-Hartman
                   ` (49 preceding siblings ...)
  2021-05-12 14:41 ` [PATCH 5.12 050/677] phy: ti: j721e-wiz: Invoke wiz_init() before of_platform_device_create() Greg Kroah-Hartman
@ 2021-05-12 14:41 ` Greg Kroah-Hartman
  2021-05-12 14:41 ` [PATCH 5.12 052/677] misc: vmw_vmci: explicitly initialize vmci_datagram payload Greg Kroah-Hartman
                   ` (633 subsequent siblings)
  684 siblings, 0 replies; 702+ messages in thread
From: Greg Kroah-Hartman @ 2021-05-12 14:41 UTC (permalink / raw)
  To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Tetsuo Handa

From: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>

commit 376565b9717c30cd58ad33860fa42697615fa2e4 upstream.

KMSAN complains that the vmci_use_ppn64() == false path in
vmci_dbell_register_notification_bitmap() left upper 32bits of
bitmap_set_msg.bitmap_ppn64 member uninitialized.

  =====================================================
  BUG: KMSAN: uninit-value in kmsan_check_memory+0xd/0x10
  CPU: 1 PID: 1 Comm: swapper/0 Not tainted 5.11.0-rc7+ #4
  Hardware name: VMware, Inc. VMware Virtual Platform/440BX Desktop Reference Platform, BIOS 6.00 02/27/2020
  Call Trace:
   dump_stack+0x21c/0x280
   kmsan_report+0xfb/0x1e0
   kmsan_internal_check_memory+0x484/0x520
   kmsan_check_memory+0xd/0x10
   iowrite8_rep+0x86/0x380
   vmci_send_datagram+0x150/0x280
   vmci_dbell_register_notification_bitmap+0x133/0x1e0
   vmci_guest_probe_device+0xcab/0x1e70
   pci_device_probe+0xab3/0xe70
   really_probe+0xd16/0x24d0
   driver_probe_device+0x29d/0x3a0
   device_driver_attach+0x25a/0x490
   __driver_attach+0x78c/0x840
   bus_for_each_dev+0x210/0x340
   driver_attach+0x89/0xb0
   bus_add_driver+0x677/0xc40
   driver_register+0x485/0x8e0
   __pci_register_driver+0x1ff/0x350
   vmci_guest_init+0x3e/0x41
   vmci_drv_init+0x1d6/0x43f
   do_one_initcall+0x39c/0x9a0
   do_initcall_level+0x1d7/0x259
   do_initcalls+0x127/0x1cb
   do_basic_setup+0x33/0x36
   kernel_init_freeable+0x29a/0x3ed
   kernel_init+0x1f/0x840
   ret_from_fork+0x1f/0x30

  Local variable ----bitmap_set_msg@vmci_dbell_register_notification_bitmap created at:
   vmci_dbell_register_notification_bitmap+0x50/0x1e0
   vmci_dbell_register_notification_bitmap+0x50/0x1e0

  Bytes 28-31 of 32 are uninitialized
  Memory access of size 32 starts at ffff88810098f570
  =====================================================

Fixes: 83e2ec765be03e8a ("VMCI: doorbell implementation.")
Cc: <stable@vger.kernel.org>
Signed-off-by: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>
Link: https://lore.kernel.org/r/20210402121742.3917-1-penguin-kernel@I-love.SAKURA.ne.jp
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/misc/vmw_vmci/vmci_doorbell.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

--- a/drivers/misc/vmw_vmci/vmci_doorbell.c
+++ b/drivers/misc/vmw_vmci/vmci_doorbell.c
@@ -326,7 +326,7 @@ int vmci_dbell_host_context_notify(u32 s
 bool vmci_dbell_register_notification_bitmap(u64 bitmap_ppn)
 {
 	int result;
-	struct vmci_notify_bm_set_msg bitmap_set_msg;
+	struct vmci_notify_bm_set_msg bitmap_set_msg = { };
 
 	bitmap_set_msg.hdr.dst = vmci_make_handle(VMCI_HYPERVISOR_CONTEXT_ID,
 						  VMCI_SET_NOTIFY_BITMAP);



^ permalink raw reply	[flat|nested] 702+ messages in thread

* [PATCH 5.12 052/677] misc: vmw_vmci: explicitly initialize vmci_datagram payload
  2021-05-12 14:40 [PATCH 5.12 000/677] 5.12.4-rc1 review Greg Kroah-Hartman
                   ` (50 preceding siblings ...)
  2021-05-12 14:41 ` [PATCH 5.12 051/677] misc: vmw_vmci: explicitly initialize vmci_notify_bm_set_msg struct Greg Kroah-Hartman
@ 2021-05-12 14:41 ` Greg Kroah-Hartman
  2021-05-12 14:41 ` [PATCH 5.12 053/677] selinux: add proper NULL termination to the secclass_map permissions Greg Kroah-Hartman
                   ` (632 subsequent siblings)
  684 siblings, 0 replies; 702+ messages in thread
From: Greg Kroah-Hartman @ 2021-05-12 14:41 UTC (permalink / raw)
  To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Tetsuo Handa

From: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>

commit b2192cfeba8481224da0a4ec3b4a7ccd80b1623b upstream.

KMSAN complains that vmci_check_host_caps() left the payload part of
check_msg uninitialized.

  =====================================================
  BUG: KMSAN: uninit-value in kmsan_check_memory+0xd/0x10
  CPU: 1 PID: 1 Comm: swapper/0 Tainted: G    B             5.11.0-rc7+ #4
  Hardware name: VMware, Inc. VMware Virtual Platform/440BX Desktop Reference Platform, BIOS 6.00 02/27/2020
  Call Trace:
   dump_stack+0x21c/0x280
   kmsan_report+0xfb/0x1e0
   kmsan_internal_check_memory+0x202/0x520
   kmsan_check_memory+0xd/0x10
   iowrite8_rep+0x86/0x380
   vmci_guest_probe_device+0xf0b/0x1e70
   pci_device_probe+0xab3/0xe70
   really_probe+0xd16/0x24d0
   driver_probe_device+0x29d/0x3a0
   device_driver_attach+0x25a/0x490
   __driver_attach+0x78c/0x840
   bus_for_each_dev+0x210/0x340
   driver_attach+0x89/0xb0
   bus_add_driver+0x677/0xc40
   driver_register+0x485/0x8e0
   __pci_register_driver+0x1ff/0x350
   vmci_guest_init+0x3e/0x41
   vmci_drv_init+0x1d6/0x43f
   do_one_initcall+0x39c/0x9a0
   do_initcall_level+0x1d7/0x259
   do_initcalls+0x127/0x1cb
   do_basic_setup+0x33/0x36
   kernel_init_freeable+0x29a/0x3ed
   kernel_init+0x1f/0x840
   ret_from_fork+0x1f/0x30

  Uninit was created at:
   kmsan_internal_poison_shadow+0x5c/0xf0
   kmsan_slab_alloc+0x8d/0xe0
   kmem_cache_alloc+0x84f/0xe30
   vmci_guest_probe_device+0xd11/0x1e70
   pci_device_probe+0xab3/0xe70
   really_probe+0xd16/0x24d0
   driver_probe_device+0x29d/0x3a0
   device_driver_attach+0x25a/0x490
   __driver_attach+0x78c/0x840
   bus_for_each_dev+0x210/0x340
   driver_attach+0x89/0xb0
   bus_add_driver+0x677/0xc40
   driver_register+0x485/0x8e0
   __pci_register_driver+0x1ff/0x350
   vmci_guest_init+0x3e/0x41
   vmci_drv_init+0x1d6/0x43f
   do_one_initcall+0x39c/0x9a0
   do_initcall_level+0x1d7/0x259
   do_initcalls+0x127/0x1cb
   do_basic_setup+0x33/0x36
   kernel_init_freeable+0x29a/0x3ed
   kernel_init+0x1f/0x840
   ret_from_fork+0x1f/0x30

  Bytes 28-31 of 36 are uninitialized
  Memory access of size 36 starts at ffff8881675e5f00
  =====================================================

Fixes: 1f166439917b69d3 ("VMCI: guest side driver implementation.")
Cc: <stable@vger.kernel.org>
Signed-off-by: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>
Link: https://lore.kernel.org/r/20210402121742.3917-2-penguin-kernel@I-love.SAKURA.ne.jp
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/misc/vmw_vmci/vmci_guest.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

--- a/drivers/misc/vmw_vmci/vmci_guest.c
+++ b/drivers/misc/vmw_vmci/vmci_guest.c
@@ -168,7 +168,7 @@ static int vmci_check_host_caps(struct p
 				VMCI_UTIL_NUM_RESOURCES * sizeof(u32);
 	struct vmci_datagram *check_msg;
 
-	check_msg = kmalloc(msg_size, GFP_KERNEL);
+	check_msg = kzalloc(msg_size, GFP_KERNEL);
 	if (!check_msg) {
 		dev_err(&pdev->dev, "%s: Insufficient memory\n", __func__);
 		return -ENOMEM;



^ permalink raw reply	[flat|nested] 702+ messages in thread

* [PATCH 5.12 053/677] selinux: add proper NULL termination to the secclass_map permissions
  2021-05-12 14:40 [PATCH 5.12 000/677] 5.12.4-rc1 review Greg Kroah-Hartman
                   ` (51 preceding siblings ...)
  2021-05-12 14:41 ` [PATCH 5.12 052/677] misc: vmw_vmci: explicitly initialize vmci_datagram payload Greg Kroah-Hartman
@ 2021-05-12 14:41 ` Greg Kroah-Hartman
  2021-05-12 14:41 ` [PATCH 5.12 054/677] x86, sched: Treat Intel SNC topology as default, COD as exception Greg Kroah-Hartman
                   ` (631 subsequent siblings)
  684 siblings, 0 replies; 702+ messages in thread
From: Greg Kroah-Hartman @ 2021-05-12 14:41 UTC (permalink / raw)
  To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Paul Moore

From: Paul Moore <paul@paul-moore.com>

commit e4c82eafb609c2badc56f4e11bc50fcf44b8e9eb upstream.

This patch adds the missing NULL termination to the "bpf" and
"perf_event" object class permission lists.

This missing NULL termination should really only affect the tools
under scripts/selinux, with the most important being genheaders.c,
although in practice this has not been an issue on any of my dev/test
systems.  If the problem were to manifest itself it would likely
result in bogus permissions added to the end of the object class;
thankfully with no access control checks using these bogus
permissions and no policies defining these permissions the impact
would likely be limited to some noise about undefined permissions
during policy load.

Cc: stable@vger.kernel.org
Fixes: ec27c3568a34 ("selinux: bpf: Add selinux check for eBPF syscall operations")
Fixes: da97e18458fb ("perf_event: Add support for LSM and SELinux checks")
Signed-off-by: Paul Moore <paul@paul-moore.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 security/selinux/include/classmap.h |    5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

--- a/security/selinux/include/classmap.h
+++ b/security/selinux/include/classmap.h
@@ -242,11 +242,12 @@ struct security_class_mapping secclass_m
 	{ "infiniband_endport",
 	  { "manage_subnet", NULL } },
 	{ "bpf",
-	  {"map_create", "map_read", "map_write", "prog_load", "prog_run"} },
+	  { "map_create", "map_read", "map_write", "prog_load", "prog_run",
+	    NULL } },
 	{ "xdp_socket",
 	  { COMMON_SOCK_PERMS, NULL } },
 	{ "perf_event",
-	  {"open", "cpu", "kernel", "tracepoint", "read", "write"} },
+	  { "open", "cpu", "kernel", "tracepoint", "read", "write", NULL } },
 	{ "lockdown",
 	  { "integrity", "confidentiality", NULL } },
 	{ "anon_inode",



^ permalink raw reply	[flat|nested] 702+ messages in thread

* [PATCH 5.12 054/677] x86, sched: Treat Intel SNC topology as default, COD as exception
  2021-05-12 14:40 [PATCH 5.12 000/677] 5.12.4-rc1 review Greg Kroah-Hartman
                   ` (52 preceding siblings ...)
  2021-05-12 14:41 ` [PATCH 5.12 053/677] selinux: add proper NULL termination to the secclass_map permissions Greg Kroah-Hartman
@ 2021-05-12 14:41 ` Greg Kroah-Hartman
  2021-05-12 14:41 ` [PATCH 5.12 055/677] async_xor: increase src_offs when dropping destination page Greg Kroah-Hartman
                   ` (630 subsequent siblings)
  684 siblings, 0 replies; 702+ messages in thread
From: Greg Kroah-Hartman @ 2021-05-12 14:41 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Peter Zijlstra (Intel),
	Alison Schofield, Dave Hansen

From: Alison Schofield <alison.schofield@intel.com>

commit 2c88d45edbb89029c1190bb3b136d2602f057c98 upstream.

Commit 1340ccfa9a9a ("x86,sched: Allow topologies where NUMA nodes
share an LLC") added a vendor and model specific check to never
call topology_sane() for Intel Skylake Server systems where NUMA
nodes share an LLC.

Intel Ice Lake and Sapphire Rapids CPUs also enumerate an LLC that is
shared by multiple NUMA nodes. The LLC on these CPUs is shared for
off-package data access but private to the NUMA node for on-package
access. Rather than managing a list of allowable SNC topologies, make
this SNC topology the default, and treat Intel's Cluster-On-Die (COD)
topology as the exception.

In SNC mode, Sky Lake, Ice Lake, and Sapphire Rapids servers do not
emit this warning:

sched: CPU #3's llc-sibling CPU #0 is not on the same node! [node: 1 != 0]. Ignoring dependency.

Suggested-by: Peter Zijlstra (Intel) <peterz@infradead.org>
Signed-off-by: Alison Schofield <alison.schofield@intel.com>
Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
Acked-by: Dave Hansen <dave.hansen@linux.intel.com>
Cc: stable@vger.kernel.org
Link: https://lkml.kernel.org/r/20210310190233.31752-1-alison.schofield@intel.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 arch/x86/kernel/smpboot.c |   90 +++++++++++++++++++++++-----------------------
 1 file changed, 46 insertions(+), 44 deletions(-)

--- a/arch/x86/kernel/smpboot.c
+++ b/arch/x86/kernel/smpboot.c
@@ -458,29 +458,52 @@ static bool match_smt(struct cpuinfo_x86
 	return false;
 }
 
+static bool match_die(struct cpuinfo_x86 *c, struct cpuinfo_x86 *o)
+{
+	if (c->phys_proc_id == o->phys_proc_id &&
+	    c->cpu_die_id == o->cpu_die_id)
+		return true;
+	return false;
+}
+
 /*
- * Define snc_cpu[] for SNC (Sub-NUMA Cluster) CPUs.
+ * Unlike the other levels, we do not enforce keeping a
+ * multicore group inside a NUMA node.  If this happens, we will
+ * discard the MC level of the topology later.
+ */
+static bool match_pkg(struct cpuinfo_x86 *c, struct cpuinfo_x86 *o)
+{
+	if (c->phys_proc_id == o->phys_proc_id)
+		return true;
+	return false;
+}
+
+/*
+ * Define intel_cod_cpu[] for Intel COD (Cluster-on-Die) CPUs.
  *
- * These are Intel CPUs that enumerate an LLC that is shared by
- * multiple NUMA nodes. The LLC on these systems is shared for
- * off-package data access but private to the NUMA node (half
- * of the package) for on-package access.
+ * Any Intel CPU that has multiple nodes per package and does not
+ * match intel_cod_cpu[] has the SNC (Sub-NUMA Cluster) topology.
  *
- * CPUID (the source of the information about the LLC) can only
- * enumerate the cache as being shared *or* unshared, but not
- * this particular configuration. The CPU in this case enumerates
- * the cache to be shared across the entire package (spanning both
- * NUMA nodes).
+ * When in SNC mode, these CPUs enumerate an LLC that is shared
+ * by multiple NUMA nodes. The LLC is shared for off-package data
+ * access but private to the NUMA node (half of the package) for
+ * on-package access. CPUID (the source of the information about
+ * the LLC) can only enumerate the cache as shared or unshared,
+ * but not this particular configuration.
  */
 
-static const struct x86_cpu_id snc_cpu[] = {
-	X86_MATCH_INTEL_FAM6_MODEL(SKYLAKE_X, NULL),
+static const struct x86_cpu_id intel_cod_cpu[] = {
+	X86_MATCH_INTEL_FAM6_MODEL(HASWELL_X, 0),	/* COD */
+	X86_MATCH_INTEL_FAM6_MODEL(BROADWELL_X, 0),	/* COD */
+	X86_MATCH_INTEL_FAM6_MODEL(ANY, 1),		/* SNC */
 	{}
 };
 
 static bool match_llc(struct cpuinfo_x86 *c, struct cpuinfo_x86 *o)
 {
+	const struct x86_cpu_id *id = x86_match_cpu(intel_cod_cpu);
 	int cpu1 = c->cpu_index, cpu2 = o->cpu_index;
+	bool intel_snc = id && id->driver_data;
 
 	/* Do not match if we do not have a valid APICID for cpu: */
 	if (per_cpu(cpu_llc_id, cpu1) == BAD_APICID)
@@ -495,32 +518,12 @@ static bool match_llc(struct cpuinfo_x86
 	 * means 'c' does not share the LLC of 'o'. This will be
 	 * reflected to userspace.
 	 */
-	if (!topology_same_node(c, o) && x86_match_cpu(snc_cpu))
+	if (match_pkg(c, o) && !topology_same_node(c, o) && intel_snc)
 		return false;
 
 	return topology_sane(c, o, "llc");
 }
 
-/*
- * Unlike the other levels, we do not enforce keeping a
- * multicore group inside a NUMA node.  If this happens, we will
- * discard the MC level of the topology later.
- */
-static bool match_pkg(struct cpuinfo_x86 *c, struct cpuinfo_x86 *o)
-{
-	if (c->phys_proc_id == o->phys_proc_id)
-		return true;
-	return false;
-}
-
-static bool match_die(struct cpuinfo_x86 *c, struct cpuinfo_x86 *o)
-{
-	if ((c->phys_proc_id == o->phys_proc_id) &&
-		(c->cpu_die_id == o->cpu_die_id))
-		return true;
-	return false;
-}
-
 
 #if defined(CONFIG_SCHED_SMT) || defined(CONFIG_SCHED_MC)
 static inline int x86_sched_itmt_flags(void)
@@ -592,14 +595,23 @@ void set_cpu_sibling_map(int cpu)
 	for_each_cpu(i, cpu_sibling_setup_mask) {
 		o = &cpu_data(i);
 
+		if (match_pkg(c, o) && !topology_same_node(c, o))
+			x86_has_numa_in_package = true;
+
 		if ((i == cpu) || (has_smt && match_smt(c, o)))
 			link_mask(topology_sibling_cpumask, cpu, i);
 
 		if ((i == cpu) || (has_mp && match_llc(c, o)))
 			link_mask(cpu_llc_shared_mask, cpu, i);
 
+		if ((i == cpu) || (has_mp && match_die(c, o)))
+			link_mask(topology_die_cpumask, cpu, i);
 	}
 
+	threads = cpumask_weight(topology_sibling_cpumask(cpu));
+	if (threads > __max_smt_threads)
+		__max_smt_threads = threads;
+
 	/*
 	 * This needs a separate iteration over the cpus because we rely on all
 	 * topology_sibling_cpumask links to be set-up.
@@ -613,8 +625,7 @@ void set_cpu_sibling_map(int cpu)
 			/*
 			 *  Does this new cpu bringup a new core?
 			 */
-			if (cpumask_weight(
-			    topology_sibling_cpumask(cpu)) == 1) {
+			if (threads == 1) {
 				/*
 				 * for each core in package, increment
 				 * the booted_cores for this new cpu
@@ -631,16 +642,7 @@ void set_cpu_sibling_map(int cpu)
 			} else if (i != cpu && !c->booted_cores)
 				c->booted_cores = cpu_data(i).booted_cores;
 		}
-		if (match_pkg(c, o) && !topology_same_node(c, o))
-			x86_has_numa_in_package = true;
-
-		if ((i == cpu) || (has_mp && match_die(c, o)))
-			link_mask(topology_die_cpumask, cpu, i);
 	}
-
-	threads = cpumask_weight(topology_sibling_cpumask(cpu));
-	if (threads > __max_smt_threads)
-		__max_smt_threads = threads;
 }
 
 /* maps the cpu to the sched domain representing multi-core */



^ permalink raw reply	[flat|nested] 702+ messages in thread

* [PATCH 5.12 055/677] async_xor: increase src_offs when dropping destination page
  2021-05-12 14:40 [PATCH 5.12 000/677] 5.12.4-rc1 review Greg Kroah-Hartman
                   ` (53 preceding siblings ...)
  2021-05-12 14:41 ` [PATCH 5.12 054/677] x86, sched: Treat Intel SNC topology as default, COD as exception Greg Kroah-Hartman
@ 2021-05-12 14:41 ` Greg Kroah-Hartman
  2021-05-12 14:41 ` [PATCH 5.12 056/677] md/bitmap: wait for external bitmap writes to complete during tear down Greg Kroah-Hartman
                   ` (629 subsequent siblings)
  684 siblings, 0 replies; 702+ messages in thread
From: Greg Kroah-Hartman @ 2021-05-12 14:41 UTC (permalink / raw)
  To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Xiao Ni, Song Liu

From: Xiao Ni <xni@redhat.com>

commit ceaf2966ab082bbc4d26516f97b3ca8a676e2af8 upstream.

Now we support sharing one page if PAGE_SIZE is not equal stripe size. To
support this, it needs to support calculating xor value with different
offsets for each r5dev. One offset array is used to record those offsets.

In RMW mode, parity page is used as a source page. It sets
ASYNC_TX_XOR_DROP_DST before calculating xor value in ops_run_prexor5.
So it needs to add src_list and src_offs at the same time. Now it only
needs src_list. So the xor value which is calculated is wrong. It can
cause data corruption problem.

I can reproduce this problem 100% on a POWER8 machine. The steps are:

  mdadm -CR /dev/md0 -l5 -n3 /dev/sdb1 /dev/sdc1 /dev/sdd1 --size=3G
  mkfs.xfs /dev/md0
  mount /dev/md0 /mnt/test
  mount: /mnt/test: mount(2) system call failed: Structure needs cleaning.

Fixes: 29bcff787a25 ("md/raid5: add new xor function to support different page offset")
Cc: stable@vger.kernel.org # v5.10+
Signed-off-by: Xiao Ni <xni@redhat.com>
Signed-off-by: Song Liu <song@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 crypto/async_tx/async_xor.c |    1 +
 1 file changed, 1 insertion(+)

--- a/crypto/async_tx/async_xor.c
+++ b/crypto/async_tx/async_xor.c
@@ -233,6 +233,7 @@ async_xor_offs(struct page *dest, unsign
 		if (submit->flags & ASYNC_TX_XOR_DROP_DST) {
 			src_cnt--;
 			src_list++;
+			src_offs++;
 		}
 
 		/* wait for any prerequisite operations */



^ permalink raw reply	[flat|nested] 702+ messages in thread

* [PATCH 5.12 056/677] md/bitmap: wait for external bitmap writes to complete during tear down
  2021-05-12 14:40 [PATCH 5.12 000/677] 5.12.4-rc1 review Greg Kroah-Hartman
                   ` (54 preceding siblings ...)
  2021-05-12 14:41 ` [PATCH 5.12 055/677] async_xor: increase src_offs when dropping destination page Greg Kroah-Hartman
@ 2021-05-12 14:41 ` Greg Kroah-Hartman
  2021-05-12 14:41 ` [PATCH 5.12 057/677] md-cluster: fix use-after-free issue when removing rdev Greg Kroah-Hartman
                   ` (628 subsequent siblings)
  684 siblings, 0 replies; 702+ messages in thread
From: Greg Kroah-Hartman @ 2021-05-12 14:41 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Sudhakar Panneerselvam, Zhao Heming,
	Song Liu

From: Sudhakar Panneerselvam <sudhakar.panneerselvam@oracle.com>

commit 404a8ef512587b2460107d3272c17a89aef75edf upstream.

NULL pointer dereference was observed in super_written() when it tries
to access the mddev structure.

[The below stack trace is from an older kernel, but the problem described
in this patch applies to the mainline kernel.]

[ 1194.474861] task: ffff8fdd20858000 task.stack: ffffb99d40790000
[ 1194.488000] RIP: 0010:super_written+0x29/0xe1
[ 1194.499688] RSP: 0018:ffff8ffb7fcc3c78 EFLAGS: 00010046
[ 1194.512477] RAX: 0000000000000000 RBX: ffff8ffb7bf4a000 RCX: ffff8ffb78991048
[ 1194.527325] RDX: 0000000000000001 RSI: 0000000000000000 RDI: ffff8ffb56b8a200
[ 1194.542576] RBP: ffff8ffb7fcc3c90 R08: 000000000000000b R09: 0000000000000000
[ 1194.558001] R10: ffff8ffb56b8a298 R11: 0000000000000000 R12: ffff8ffb56b8a200
[ 1194.573070] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000
[ 1194.588117] FS:  0000000000000000(0000) GS:ffff8ffb7fcc0000(0000) knlGS:0000000000000000
[ 1194.604264] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 1194.617375] CR2: 00000000000002b8 CR3: 00000021e040a002 CR4: 00000000007606e0
[ 1194.632327] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
[ 1194.647865] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
[ 1194.663316] PKRU: 55555554
[ 1194.674090] Call Trace:
[ 1194.683735]  <IRQ>
[ 1194.692948]  bio_endio+0xae/0x135
[ 1194.703580]  blk_update_request+0xad/0x2fa
[ 1194.714990]  blk_update_bidi_request+0x20/0x72
[ 1194.726578]  __blk_end_bidi_request+0x2c/0x4d
[ 1194.738373]  __blk_end_request_all+0x31/0x49
[ 1194.749344]  blk_flush_complete_seq+0x377/0x383
[ 1194.761550]  flush_end_io+0x1dd/0x2a7
[ 1194.772910]  blk_finish_request+0x9f/0x13c
[ 1194.784544]  scsi_end_request+0x180/0x25c
[ 1194.796149]  scsi_io_completion+0xc8/0x610
[ 1194.807503]  scsi_finish_command+0xdc/0x125
[ 1194.818897]  scsi_softirq_done+0x81/0xde
[ 1194.830062]  blk_done_softirq+0xa4/0xcc
[ 1194.841008]  __do_softirq+0xd9/0x29f
[ 1194.851257]  irq_exit+0xe6/0xeb
[ 1194.861290]  do_IRQ+0x59/0xe3
[ 1194.871060]  common_interrupt+0x1c6/0x382
[ 1194.881988]  </IRQ>
[ 1194.890646] RIP: 0010:cpuidle_enter_state+0xdd/0x2a5
[ 1194.902532] RSP: 0018:ffffb99d40793e68 EFLAGS: 00000246 ORIG_RAX: ffffffffffffff43
[ 1194.917317] RAX: ffff8ffb7fce27c0 RBX: ffff8ffb7fced800 RCX: 000000000000001f
[ 1194.932056] RDX: 0000000000000000 RSI: 0000000000000004 RDI: 0000000000000000
[ 1194.946428] RBP: ffffb99d40793ea0 R08: 0000000000000004 R09: 0000000000002ed2
[ 1194.960508] R10: 0000000000002664 R11: 0000000000000018 R12: 0000000000000003
[ 1194.974454] R13: 000000000000000b R14: ffffffff925715a0 R15: 0000011610120d5a
[ 1194.988607]  ? cpuidle_enter_state+0xcc/0x2a5
[ 1194.999077]  cpuidle_enter+0x17/0x19
[ 1195.008395]  call_cpuidle+0x23/0x3a
[ 1195.017718]  do_idle+0x172/0x1d5
[ 1195.026358]  cpu_startup_entry+0x73/0x75
[ 1195.035769]  start_secondary+0x1b9/0x20b
[ 1195.044894]  secondary_startup_64+0xa5/0xa5
[ 1195.084921] RIP: super_written+0x29/0xe1 RSP: ffff8ffb7fcc3c78
[ 1195.096354] CR2: 00000000000002b8

bio in the above stack is a bitmap write whose completion is invoked after
the tear down sequence sets the mddev structure to NULL in rdev.

During tear down, there is an attempt to flush the bitmap writes, but for
external bitmaps, there is no explicit wait for all the bitmap writes to
complete. For instance, md_bitmap_flush() is called to flush the bitmap
writes, but the last call to md_bitmap_daemon_work() in md_bitmap_flush()
could generate new bitmap writes for which there is no explicit wait to
complete those writes. The call to md_bitmap_update_sb() will return
simply for external bitmaps and the follow-up call to md_update_sb() is
conditional and may not get called for external bitmaps. This results in a
kernel panic when the completion routine, super_written() is called which
tries to reference mddev in the rdev that has been set to
NULL(in unbind_rdev_from_array() by tear down sequence).

The solution is to call md_super_wait() for external bitmaps after the
last call to md_bitmap_daemon_work() in md_bitmap_flush() to ensure there
are no pending bitmap writes before proceeding with the tear down.

Cc: stable@vger.kernel.org
Signed-off-by: Sudhakar Panneerselvam <sudhakar.panneerselvam@oracle.com>
Reviewed-by: Zhao Heming <heming.zhao@suse.com>
Signed-off-by: Song Liu <song@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/md/md-bitmap.c |    2 ++
 1 file changed, 2 insertions(+)

--- a/drivers/md/md-bitmap.c
+++ b/drivers/md/md-bitmap.c
@@ -1722,6 +1722,8 @@ void md_bitmap_flush(struct mddev *mddev
 	md_bitmap_daemon_work(mddev);
 	bitmap->daemon_lastrun -= sleep;
 	md_bitmap_daemon_work(mddev);
+	if (mddev->bitmap_info.external)
+		md_super_wait(mddev);
 	md_bitmap_update_sb(bitmap);
 }
 



^ permalink raw reply	[flat|nested] 702+ messages in thread

* [PATCH 5.12 057/677] md-cluster: fix use-after-free issue when removing rdev
  2021-05-12 14:40 [PATCH 5.12 000/677] 5.12.4-rc1 review Greg Kroah-Hartman
                   ` (55 preceding siblings ...)
  2021-05-12 14:41 ` [PATCH 5.12 056/677] md/bitmap: wait for external bitmap writes to complete during tear down Greg Kroah-Hartman
@ 2021-05-12 14:41 ` Greg Kroah-Hartman
  2021-05-12 14:41 ` [PATCH 5.12 058/677] md: split mddev_find Greg Kroah-Hartman
                   ` (627 subsequent siblings)
  684 siblings, 0 replies; 702+ messages in thread
From: Greg Kroah-Hartman @ 2021-05-12 14:41 UTC (permalink / raw)
  To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Gang He, Heming Zhao, Song Liu

From: Heming Zhao <heming.zhao@suse.com>

commit f7c7a2f9a23e5b6e0f5251f29648d0238bb7757e upstream.

md_kick_rdev_from_array will remove rdev, so we should
use rdev_for_each_safe to search list.

How to trigger:

env: Two nodes on kvm-qemu x86_64 VMs (2C2G with 2 iscsi luns).

```
node2=192.168.0.3

for i in {1..20}; do
    echo ==== $i `date` ====;

    mdadm -Ss && ssh ${node2} "mdadm -Ss"
    wipefs -a /dev/sda /dev/sdb

    mdadm -CR /dev/md0 -b clustered -e 1.2 -n 2 -l 1 /dev/sda \
       /dev/sdb --assume-clean
    ssh ${node2} "mdadm -A /dev/md0 /dev/sda /dev/sdb"
    mdadm --wait /dev/md0
    ssh ${node2} "mdadm --wait /dev/md0"

    mdadm --manage /dev/md0 --fail /dev/sda --remove /dev/sda
    sleep 1
done
```

Crash stack:

```
stack segment: 0000 [#1] SMP
... ...
RIP: 0010:md_check_recovery+0x1e8/0x570 [md_mod]
... ...
RSP: 0018:ffffb149807a7d68 EFLAGS: 00010207
RAX: 0000000000000000 RBX: ffff9d494c180800 RCX: ffff9d490fc01e50
RDX: fffff047c0ed8308 RSI: 0000000000000246 RDI: 0000000000000246
RBP: 6b6b6b6b6b6b6b6b R08: ffff9d490fc01e40 R09: 0000000000000000
R10: 0000000000000001 R11: 0000000000000001 R12: 0000000000000000
R13: ffff9d494c180818 R14: ffff9d493399ef38 R15: ffff9d4933a1d800
FS:  0000000000000000(0000) GS:ffff9d494f700000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007fe68cab9010 CR3: 000000004c6be001 CR4: 00000000003706e0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
 raid1d+0x5c/0xd40 [raid1]
 ? finish_task_switch+0x75/0x2a0
 ? lock_timer_base+0x67/0x80
 ? try_to_del_timer_sync+0x4d/0x80
 ? del_timer_sync+0x41/0x50
 ? schedule_timeout+0x254/0x2d0
 ? md_start_sync+0xe0/0xe0 [md_mod]
 ? md_thread+0x127/0x160 [md_mod]
 md_thread+0x127/0x160 [md_mod]
 ? wait_woken+0x80/0x80
 kthread+0x10d/0x130
 ? kthread_park+0xa0/0xa0
 ret_from_fork+0x1f/0x40
```

Fixes: dbb64f8635f5d ("md-cluster: Fix adding of new disk with new reload code")
Fixes: 659b254fa7392 ("md-cluster: remove a disk asynchronously from cluster environment")
Cc: stable@vger.kernel.org
Reviewed-by: Gang He <ghe@suse.com>
Signed-off-by: Heming Zhao <heming.zhao@suse.com>
Signed-off-by: Song Liu <song@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/md/md.c |    8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

--- a/drivers/md/md.c
+++ b/drivers/md/md.c
@@ -9251,11 +9251,11 @@ void md_check_recovery(struct mddev *mdd
 		}
 
 		if (mddev_is_clustered(mddev)) {
-			struct md_rdev *rdev;
+			struct md_rdev *rdev, *tmp;
 			/* kick the device if another node issued a
 			 * remove disk.
 			 */
-			rdev_for_each(rdev, mddev) {
+			rdev_for_each_safe(rdev, tmp, mddev) {
 				if (test_and_clear_bit(ClusterRemove, &rdev->flags) &&
 						rdev->raid_disk < 0)
 					md_kick_rdev_from_array(rdev);
@@ -9569,7 +9569,7 @@ err_wq:
 static void check_sb_changes(struct mddev *mddev, struct md_rdev *rdev)
 {
 	struct mdp_superblock_1 *sb = page_address(rdev->sb_page);
-	struct md_rdev *rdev2;
+	struct md_rdev *rdev2, *tmp;
 	int role, ret;
 	char b[BDEVNAME_SIZE];
 
@@ -9586,7 +9586,7 @@ static void check_sb_changes(struct mdde
 	}
 
 	/* Check for change of roles in the active devices */
-	rdev_for_each(rdev2, mddev) {
+	rdev_for_each_safe(rdev2, tmp, mddev) {
 		if (test_bit(Faulty, &rdev2->flags))
 			continue;
 



^ permalink raw reply	[flat|nested] 702+ messages in thread

* [PATCH 5.12 058/677] md: split mddev_find
  2021-05-12 14:40 [PATCH 5.12 000/677] 5.12.4-rc1 review Greg Kroah-Hartman
                   ` (56 preceding siblings ...)
  2021-05-12 14:41 ` [PATCH 5.12 057/677] md-cluster: fix use-after-free issue when removing rdev Greg Kroah-Hartman
@ 2021-05-12 14:41 ` Greg Kroah-Hartman
  2021-05-12 14:41 ` [PATCH 5.12 059/677] md: factor out a mddev_find_locked helper from mddev_find Greg Kroah-Hartman
                   ` (626 subsequent siblings)
  684 siblings, 0 replies; 702+ messages in thread
From: Greg Kroah-Hartman @ 2021-05-12 14:41 UTC (permalink / raw)
  To: linux-kernel; +Cc: Greg Kroah-Hartman, stable

From: Christoph Hellwig <hch@lst.de>

commit 65aa97c4d2bfd76677c211b9d03ef05a98c6d68e upstream.

Split mddev_find into a simple mddev_find that just finds an existing
mddev by the unit number, and a more complicated mddev_find that deals
with find or allocating a mddev.

This turns out to fix this bug reported by Zhao Heming.

----------------------------- snip ------------------------------
commit d3374825ce57 ("md: make devices disappear when they are no longer
needed.") introduced protection between mddev creating & removing. The
md_open shouldn't create mddev when all_mddevs list doesn't contain
mddev. With currently code logic, there will be very easy to trigger
soft lockup in non-preempt env.

---
 drivers/md/md.c |   24 +++++++++++++++++++-----
 1 file changed, 19 insertions(+), 5 deletions(-)

--- a/drivers/md/md.c
+++ b/drivers/md/md.c
@@ -736,6 +736,22 @@ EXPORT_SYMBOL_GPL(mddev_init);
 
 static struct mddev *mddev_find(dev_t unit)
 {
+	struct mddev *mddev;
+
+	if (MAJOR(unit) != MD_MAJOR)
+		unit &= ~((1 << MdpMinorShift) - 1);
+
+	spin_lock(&all_mddevs_lock);
+	mddev = mddev_find_locked(unit);
+	if (mddev)
+		mddev_get(mddev);
+	spin_unlock(&all_mddevs_lock);
+
+	return mddev;
+}
+
+static struct mddev *mddev_find_or_alloc(dev_t unit)
+{
 	struct mddev *mddev, *new = NULL;
 
 	if (unit && MAJOR(unit) != MD_MAJOR)
@@ -5644,7 +5660,7 @@ static int md_alloc(dev_t dev, char *nam
 	 * writing to /sys/module/md_mod/parameters/new_array.
 	 */
 	static DEFINE_MUTEX(disks_mutex);
-	struct mddev *mddev = mddev_find(dev);
+	struct mddev *mddev = mddev_find_or_alloc(dev);
 	struct gendisk *disk;
 	int partitioned;
 	int shift;
@@ -6524,11 +6540,9 @@ static void autorun_devices(int part)
 
 		md_probe(dev);
 		mddev = mddev_find(dev);
-		if (!mddev || !mddev->gendisk) {
-			if (mddev)
-				mddev_put(mddev);
+		if (!mddev)
 			break;
-		}
+
 		if (mddev_lock(mddev))
 			pr_warn("md: %s locked, cannot run\n", mdname(mddev));
 		else if (mddev->raid_disks || mddev->major_version



^ permalink raw reply	[flat|nested] 702+ messages in thread

* [PATCH 5.12 059/677] md: factor out a mddev_find_locked helper from mddev_find
  2021-05-12 14:40 [PATCH 5.12 000/677] 5.12.4-rc1 review Greg Kroah-Hartman
                   ` (57 preceding siblings ...)
  2021-05-12 14:41 ` [PATCH 5.12 058/677] md: split mddev_find Greg Kroah-Hartman
@ 2021-05-12 14:41 ` Greg Kroah-Hartman
  2021-05-12 14:41 ` [PATCH 5.12 060/677] md: md_open returns -EBUSY when entering racing area Greg Kroah-Hartman
                   ` (625 subsequent siblings)
  684 siblings, 0 replies; 702+ messages in thread
From: Greg Kroah-Hartman @ 2021-05-12 14:41 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Heming Zhao, Christoph Hellwig, Song Liu

From: Christoph Hellwig <hch@lst.de>

commit 8b57251f9a91f5e5a599de7549915d2d226cc3af upstream.

Factor out a self-contained helper to just lookup a mddev by the dev_t
"unit".

Cc: stable@vger.kernel.org
Reviewed-by: Heming Zhao <heming.zhao@suse.com>
Signed-off-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: Song Liu <song@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/md/md.c |   32 +++++++++++++++++++-------------
 1 file changed, 19 insertions(+), 13 deletions(-)

--- a/drivers/md/md.c
+++ b/drivers/md/md.c
@@ -734,6 +734,17 @@ void mddev_init(struct mddev *mddev)
 }
 EXPORT_SYMBOL_GPL(mddev_init);
 
+static struct mddev *mddev_find_locked(dev_t unit)
+{
+	struct mddev *mddev;
+
+	list_for_each_entry(mddev, &all_mddevs, all_mddevs)
+		if (mddev->unit == unit)
+			return mddev;
+
+	return NULL;
+}
+
 static struct mddev *mddev_find(dev_t unit)
 {
 	struct mddev *mddev;
@@ -761,13 +772,13 @@ static struct mddev *mddev_find_or_alloc
 	spin_lock(&all_mddevs_lock);
 
 	if (unit) {
-		list_for_each_entry(mddev, &all_mddevs, all_mddevs)
-			if (mddev->unit == unit) {
-				mddev_get(mddev);
-				spin_unlock(&all_mddevs_lock);
-				kfree(new);
-				return mddev;
-			}
+		mddev = mddev_find_locked(unit);
+		if (mddev) {
+			mddev_get(mddev);
+			spin_unlock(&all_mddevs_lock);
+			kfree(new);
+			return mddev;
+		}
 
 		if (new) {
 			list_add(&new->all_mddevs, &all_mddevs);
@@ -793,12 +804,7 @@ static struct mddev *mddev_find_or_alloc
 				return NULL;
 			}
 
-			is_free = 1;
-			list_for_each_entry(mddev, &all_mddevs, all_mddevs)
-				if (mddev->unit == dev) {
-					is_free = 0;
-					break;
-				}
+			is_free = !mddev_find_locked(dev);
 		}
 		new->unit = dev;
 		new->md_minor = MINOR(dev);



^ permalink raw reply	[flat|nested] 702+ messages in thread

* [PATCH 5.12 060/677] md: md_open returns -EBUSY when entering racing area
  2021-05-12 14:40 [PATCH 5.12 000/677] 5.12.4-rc1 review Greg Kroah-Hartman
                   ` (58 preceding siblings ...)
  2021-05-12 14:41 ` [PATCH 5.12 059/677] md: factor out a mddev_find_locked helper from mddev_find Greg Kroah-Hartman
@ 2021-05-12 14:41 ` Greg Kroah-Hartman
  2021-05-12 14:41 ` [PATCH 5.12 061/677] md: Fix missing unused status line of /proc/mdstat Greg Kroah-Hartman
                   ` (624 subsequent siblings)
  684 siblings, 0 replies; 702+ messages in thread
From: Greg Kroah-Hartman @ 2021-05-12 14:41 UTC (permalink / raw)
  To: linux-kernel; +Cc: Greg Kroah-Hartman, stable

From: Zhao Heming <heming.zhao@suse.com>

commit 6a4db2a60306eb65bfb14ccc9fde035b74a4b4e7 upstream.

commit d3374825ce57 ("md: make devices disappear when they are no longer
needed.") introduced protection between mddev creating & removing. The
md_open shouldn't create mddev when all_mddevs list doesn't contain
mddev. With currently code logic, there will be very easy to trigger
soft lockup in non-preempt env.

This patch changes md_open returning from -ERESTARTSYS to -EBUSY, which
will break the infinitely retry when md_open enter racing area.

This patch is partly fix soft lockup issue, full fix needs mddev_find
is split into two functions: mddev_find & mddev_find_or_alloc. And
md_open should call new mddev_find (it only does searching job).

For more detail, please refer with Christoph's "split mddev_find" patch
in later commits.

---
 drivers/md/md.c |    3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

--- a/drivers/md/md.c
+++ b/drivers/md/md.c
@@ -7841,8 +7841,7 @@ static int md_open(struct block_device *
 		/* Wait until bdev->bd_disk is definitely gone */
 		if (work_pending(&mddev->del_work))
 			flush_workqueue(md_misc_wq);
-		/* Then retry the open from the top */
-		return -ERESTARTSYS;
+		return -EBUSY;
 	}
 	BUG_ON(mddev != bdev->bd_disk->private_data);
 



^ permalink raw reply	[flat|nested] 702+ messages in thread

* [PATCH 5.12 061/677] md: Fix missing unused status line of /proc/mdstat
  2021-05-12 14:40 [PATCH 5.12 000/677] 5.12.4-rc1 review Greg Kroah-Hartman
                   ` (59 preceding siblings ...)
  2021-05-12 14:41 ` [PATCH 5.12 060/677] md: md_open returns -EBUSY when entering racing area Greg Kroah-Hartman
@ 2021-05-12 14:41 ` Greg Kroah-Hartman
  2021-05-12 14:41 ` [PATCH 5.12 062/677] MIPS: Reinstate platform `__div64_32 handler Greg Kroah-Hartman
                   ` (623 subsequent siblings)
  684 siblings, 0 replies; 702+ messages in thread
From: Greg Kroah-Hartman @ 2021-05-12 14:41 UTC (permalink / raw)
  To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Jan Glauber, Song Liu

From: Jan Glauber <jglauber@digitalocean.com>

commit 7abfabaf5f805f5171d133ce6af9b65ab766e76a upstream.

Reading /proc/mdstat with a read buffer size that would not
fit the unused status line in the first read will skip this
line from the output.

So 'dd if=/proc/mdstat bs=64 2>/dev/null' will not print something
like: unused devices: <none>

Don't return NULL immediately in start() for v=2 but call
show() once to print the status line also for multiple reads.

Cc: stable@vger.kernel.org
Fixes: 1f4aace60b0e ("fs/seq_file.c: simplify seq_file iteration code and interface")
Signed-off-by: Jan Glauber <jglauber@digitalocean.com>
Signed-off-by: Song Liu <songliubraving@fb.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/md/md.c |    6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

--- a/drivers/md/md.c
+++ b/drivers/md/md.c
@@ -8172,7 +8172,11 @@ static void *md_seq_start(struct seq_fil
 	loff_t l = *pos;
 	struct mddev *mddev;
 
-	if (l >= 0x10000)
+	if (l == 0x10000) {
+		++*pos;
+		return (void *)2;
+	}
+	if (l > 0x10000)
 		return NULL;
 	if (!l--)
 		/* header */



^ permalink raw reply	[flat|nested] 702+ messages in thread

* [PATCH 5.12 062/677] MIPS: Reinstate platform `__div64_32 handler
  2021-05-12 14:40 [PATCH 5.12 000/677] 5.12.4-rc1 review Greg Kroah-Hartman
                   ` (60 preceding siblings ...)
  2021-05-12 14:41 ` [PATCH 5.12 061/677] md: Fix missing unused status line of /proc/mdstat Greg Kroah-Hartman
@ 2021-05-12 14:41 ` Greg Kroah-Hartman
  2021-05-12 14:41 ` [PATCH 5.12 063/677] MIPS: generic: Update node names to avoid unit addresses Greg Kroah-Hartman
                   ` (622 subsequent siblings)
  684 siblings, 0 replies; 702+ messages in thread
From: Greg Kroah-Hartman @ 2021-05-12 14:41 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Huacai Chen, Maciej W. Rozycki,
	Thomas Bogendoerfer

From: Maciej W. Rozycki <macro@orcam.me.uk>

commit c49f71f60754acbff37505e1d16ca796bf8a8140 upstream.

Our current MIPS platform `__div64_32' handler is inactive, because it
is incorrectly only enabled for 64-bit configurations, for which generic
`do_div' code does not call it anyway.

The handler is not suitable for being called from there though as it
only calculates 32 bits of the quotient under the assumption the 64-bit
divident has been suitably reduced.  Code for such reduction used to be
there, however it has been incorrectly removed with commit c21004cd5b4c
("MIPS: Rewrite <asm/div64.h> to work with gcc 4.4.0."), which should
have only updated an obsoleted constraint for an inline asm involving
$hi and $lo register outputs, while possibly wiring the original MIPS
variant of the `do_div' macro as `__div64_32' handler for the generic
`do_div' implementation

Correct the handler as follows then:

- Revert most of the commit referred, however retaining the current
  formatting, except for the final two instructions of the inline asm
  sequence, which the original commit missed.  Omit the original 64-bit
  parts though.

- Rename the original `do_div' macro to `__div64_32'.  Use the combined
  `x' constraint referring to the MD accumulator as a whole, replacing
  the original individual `h' and `l' constraints used for $hi and $lo
  registers respectively, of which `h' has been obsoleted with GCC 4.4.
  Update surrounding code accordingly.

  We have since removed support for GCC versions before 4.9, so no need
  for a special arrangement here; GCC has supported the `x' constraint
  since forever anyway, or at least going back to 1991.

- Rename the `__base' local variable in `__div64_32' to `__radix' to
  avoid a conflict with a local variable in `do_div'.

- Actually enable this code for 32-bit rather than 64-bit configurations
  by qualifying it with BITS_PER_LONG being 32 instead of 64.  Include
  <asm/bitsperlong.h> for this macro rather than <linux/types.h> as we
  don't need anything else.

- Finally include <asm-generic/div64.h> last rather than first.

This has passed correctness verification with test_div64 and reduced the
module's average execution time down to 1.0668s and 0.2629s from 2.1529s
and 0.5647s respectively for an R3400 CPU @40MHz and a 5Kc CPU @160MHz.
For a reference 64-bit `do_div' code where we have the DDIVU instruction
available to do the whole calculation right away averages at 0.0660s for
the latter CPU.

Fixes: c21004cd5b4c ("MIPS: Rewrite <asm/div64.h> to work with gcc 4.4.0.")
Reported-by: Huacai Chen <chenhuacai@kernel.org>
Signed-off-by: Maciej W. Rozycki <macro@orcam.me.uk>
Cc: stable@vger.kernel.org # v2.6.30+
Signed-off-by: Thomas Bogendoerfer <tsbogend@alpha.franken.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 arch/mips/include/asm/div64.h |   57 ++++++++++++++++++++++++++++++------------
 1 file changed, 41 insertions(+), 16 deletions(-)

--- a/arch/mips/include/asm/div64.h
+++ b/arch/mips/include/asm/div64.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2000, 2004  Maciej W. Rozycki
+ * Copyright (C) 2000, 2004, 2021  Maciej W. Rozycki
  * Copyright (C) 2003, 07 Ralf Baechle (ralf@linux-mips.org)
  *
  * This file is subject to the terms and conditions of the GNU General Public
@@ -9,25 +9,18 @@
 #ifndef __ASM_DIV64_H
 #define __ASM_DIV64_H
 
-#include <asm-generic/div64.h>
-
-#if BITS_PER_LONG == 64
+#include <asm/bitsperlong.h>
 
-#include <linux/types.h>
+#if BITS_PER_LONG == 32
 
 /*
  * No traps on overflows for any of these...
  */
 
-#define __div64_32(n, base)						\
-({									\
+#define do_div64_32(res, high, low, base) ({				\
 	unsigned long __cf, __tmp, __tmp2, __i;				\
 	unsigned long __quot32, __mod32;				\
-	unsigned long __high, __low;					\
-	unsigned long long __n;						\
 									\
-	__high = *__n >> 32;						\
-	__low = __n;							\
 	__asm__(							\
 	"	.set	push					\n"	\
 	"	.set	noat					\n"	\
@@ -51,18 +44,50 @@
 	"	subu	%0, %0, %z6				\n"	\
 	"	addiu	%2, %2, 1				\n"	\
 	"3:							\n"	\
-	"	bnez	%4, 0b\n\t"					\
-	"	 srl	%5, %1, 0x1f\n\t"				\
+	"	bnez	%4, 0b					\n"	\
+	"	 srl	%5, %1, 0x1f				\n"	\
 	"	.set	pop"						\
 	: "=&r" (__mod32), "=&r" (__tmp),				\
 	  "=&r" (__quot32), "=&r" (__cf),				\
 	  "=&r" (__i), "=&r" (__tmp2)					\
-	: "Jr" (base), "0" (__high), "1" (__low));			\
+	: "Jr" (base), "0" (high), "1" (low));				\
 									\
-	(__n) = __quot32;						\
+	(res) = __quot32;						\
 	__mod32;							\
 })
 
-#endif /* BITS_PER_LONG == 64 */
+#define __div64_32(n, base) ({						\
+	unsigned long __upper, __low, __high, __radix;			\
+	unsigned long long __modquot;					\
+	unsigned long long __quot;					\
+	unsigned long long __div;					\
+	unsigned long __mod;						\
+									\
+	__div = (*n);							\
+	__radix = (base);						\
+									\
+	__high = __div >> 32;						\
+	__low = __div;							\
+	__upper = __high;						\
+									\
+	if (__high) {							\
+		__asm__("divu	$0, %z1, %z2"				\
+		: "=x" (__modquot)					\
+		: "Jr" (__high), "Jr" (__radix));			\
+		__upper = __modquot >> 32;				\
+		__high = __modquot;					\
+	}								\
+									\
+	__mod = do_div64_32(__low, __upper, __low, __radix);		\
+									\
+	__quot = __high;						\
+	__quot = __quot << 32 | __low;					\
+	(*n) = __quot;							\
+	__mod;								\
+})
+
+#endif /* BITS_PER_LONG == 32 */
+
+#include <asm-generic/div64.h>
 
 #endif /* __ASM_DIV64_H */



^ permalink raw reply	[flat|nested] 702+ messages in thread

* [PATCH 5.12 063/677] MIPS: generic: Update node names to avoid unit addresses
  2021-05-12 14:40 [PATCH 5.12 000/677] 5.12.4-rc1 review Greg Kroah-Hartman
                   ` (61 preceding siblings ...)
  2021-05-12 14:41 ` [PATCH 5.12 062/677] MIPS: Reinstate platform `__div64_32 handler Greg Kroah-Hartman
@ 2021-05-12 14:41 ` Greg Kroah-Hartman
  2021-05-12 14:41 ` [PATCH 5.12 064/677] mt76: mt7615: use ieee80211_free_txskb() in mt7615_tx_token_put() Greg Kroah-Hartman
                   ` (621 subsequent siblings)
  684 siblings, 0 replies; 702+ messages in thread
From: Greg Kroah-Hartman @ 2021-05-12 14:41 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Simon Glass, Nathan Chancellor,
	Tom Rini, Thomas Bogendoerfer

From: Nathan Chancellor <nathan@kernel.org>

commit e607ff630c6053ecc67502677c0e50053d7892d4 upstream.

With the latest mkimage from U-Boot 2021.04, the generic defconfigs no
longer build, failing with:

/usr/bin/mkimage: verify_header failed for FIT Image support with exit code 1

This is expected after the linked U-Boot commits because '@' is
forbidden in the node names due to the way that libfdt treats nodes with
the same prefix but different unit addresses.

Switch the '@' in the node name to '-'. Drop the unit addresses from the
hash and kernel child nodes because there is only one node so they do
not need to have a number to differentiate them.

Cc: stable@vger.kernel.org
Link: https://source.denx.de/u-boot/u-boot/-/commit/79af75f7776fc20b0d7eb6afe1e27c00fdb4b9b4
Link: https://source.denx.de/u-boot/u-boot/-/commit/3f04db891a353f4b127ed57279279f851c6b4917
Suggested-by: Simon Glass <sjg@chromium.org>
Signed-off-by: Nathan Chancellor <nathan@kernel.org>
Reviewed-by: Tom Rini <trini@konsulko.com>
Signed-off-by: Thomas Bogendoerfer <tsbogend@alpha.franken.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 arch/mips/generic/board-boston.its.S   |   10 +++++-----
 arch/mips/generic/board-jaguar2.its.S  |   16 ++++++++--------
 arch/mips/generic/board-luton.its.S    |    8 ++++----
 arch/mips/generic/board-ni169445.its.S |   10 +++++-----
 arch/mips/generic/board-ocelot.its.S   |   20 ++++++++++----------
 arch/mips/generic/board-serval.its.S   |    8 ++++----
 arch/mips/generic/board-xilfpga.its.S  |   10 +++++-----
 arch/mips/generic/vmlinux.its.S        |   10 +++++-----
 8 files changed, 46 insertions(+), 46 deletions(-)

--- a/arch/mips/generic/board-boston.its.S
+++ b/arch/mips/generic/board-boston.its.S
@@ -1,22 +1,22 @@
 / {
 	images {
-		fdt@boston {
+		fdt-boston {
 			description = "img,boston Device Tree";
 			data = /incbin/("boot/dts/img/boston.dtb");
 			type = "flat_dt";
 			arch = "mips";
 			compression = "none";
-			hash@0 {
+			hash {
 				algo = "sha1";
 			};
 		};
 	};
 
 	configurations {
-		conf@boston {
+		conf-boston {
 			description = "Boston Linux kernel";
-			kernel = "kernel@0";
-			fdt = "fdt@boston";
+			kernel = "kernel";
+			fdt = "fdt-boston";
 		};
 	};
 };
--- a/arch/mips/generic/board-jaguar2.its.S
+++ b/arch/mips/generic/board-jaguar2.its.S
@@ -1,23 +1,23 @@
 /* SPDX-License-Identifier: (GPL-2.0 OR MIT) */
 / {
 	images {
-		fdt@jaguar2_pcb110 {
+		fdt-jaguar2_pcb110 {
 			description = "MSCC Jaguar2 PCB110 Device Tree";
 			data = /incbin/("boot/dts/mscc/jaguar2_pcb110.dtb");
 			type = "flat_dt";
 			arch = "mips";
 			compression = "none";
-			hash@0 {
+			hash {
 				algo = "sha1";
 			};
 		};
-		fdt@jaguar2_pcb111 {
+		fdt-jaguar2_pcb111 {
 			description = "MSCC Jaguar2 PCB111 Device Tree";
 			data = /incbin/("boot/dts/mscc/jaguar2_pcb111.dtb");
 			type = "flat_dt";
 			arch = "mips";
 			compression = "none";
-			hash@0 {
+			hash {
 				algo = "sha1";
 			};
 		};
@@ -26,14 +26,14 @@
 	configurations {
 		pcb110 {
 			description = "Jaguar2 Linux kernel";
-			kernel = "kernel@0";
-			fdt = "fdt@jaguar2_pcb110";
+			kernel = "kernel";
+			fdt = "fdt-jaguar2_pcb110";
 			ramdisk = "ramdisk";
 		};
 		pcb111 {
 			description = "Jaguar2 Linux kernel";
-			kernel = "kernel@0";
-			fdt = "fdt@jaguar2_pcb111";
+			kernel = "kernel";
+			fdt = "fdt-jaguar2_pcb111";
 			ramdisk = "ramdisk";
 		};
 	};
--- a/arch/mips/generic/board-luton.its.S
+++ b/arch/mips/generic/board-luton.its.S
@@ -1,13 +1,13 @@
 /* SPDX-License-Identifier: (GPL-2.0 OR MIT) */
 / {
 	images {
-		fdt@luton_pcb091 {
+		fdt-luton_pcb091 {
 			description = "MSCC Luton PCB091 Device Tree";
 			data = /incbin/("boot/dts/mscc/luton_pcb091.dtb");
 			type = "flat_dt";
 			arch = "mips";
 			compression = "none";
-			hash@0 {
+			hash {
 				algo = "sha1";
 			};
 		};
@@ -16,8 +16,8 @@
 	configurations {
 		pcb091 {
 			description = "Luton Linux kernel";
-			kernel = "kernel@0";
-			fdt = "fdt@luton_pcb091";
+			kernel = "kernel";
+			fdt = "fdt-luton_pcb091";
 		};
 	};
 };
--- a/arch/mips/generic/board-ni169445.its.S
+++ b/arch/mips/generic/board-ni169445.its.S
@@ -1,22 +1,22 @@
 / {
 	images {
-		fdt@ni169445 {
+		fdt-ni169445 {
 			description = "NI 169445 device tree";
 			data = /incbin/("boot/dts/ni/169445.dtb");
 			type = "flat_dt";
 			arch = "mips";
 			compression = "none";
-			hash@0 {
+			hash {
 				algo = "sha1";
 			};
 		};
 	};
 
 	configurations {
-		conf@ni169445 {
+		conf-ni169445 {
 			description = "NI 169445 Linux Kernel";
-			kernel = "kernel@0";
-			fdt = "fdt@ni169445";
+			kernel = "kernel";
+			fdt = "fdt-ni169445";
 		};
 	};
 };
--- a/arch/mips/generic/board-ocelot.its.S
+++ b/arch/mips/generic/board-ocelot.its.S
@@ -1,40 +1,40 @@
 /* SPDX-License-Identifier: (GPL-2.0 OR MIT) */
 / {
 	images {
-		fdt@ocelot_pcb123 {
+		fdt-ocelot_pcb123 {
 			description = "MSCC Ocelot PCB123 Device Tree";
 			data = /incbin/("boot/dts/mscc/ocelot_pcb123.dtb");
 			type = "flat_dt";
 			arch = "mips";
 			compression = "none";
-			hash@0 {
+			hash {
 				algo = "sha1";
 			};
 		};
 
-		fdt@ocelot_pcb120 {
+		fdt-ocelot_pcb120 {
 			description = "MSCC Ocelot PCB120 Device Tree";
 			data = /incbin/("boot/dts/mscc/ocelot_pcb120.dtb");
 			type = "flat_dt";
 			arch = "mips";
 			compression = "none";
-			hash@0 {
+			hash {
 				algo = "sha1";
 			};
 		};
 	};
 
 	configurations {
-		conf@ocelot_pcb123 {
+		conf-ocelot_pcb123 {
 			description = "Ocelot Linux kernel";
-			kernel = "kernel@0";
-			fdt = "fdt@ocelot_pcb123";
+			kernel = "kernel";
+			fdt = "fdt-ocelot_pcb123";
 		};
 
-		conf@ocelot_pcb120 {
+		conf-ocelot_pcb120 {
 			description = "Ocelot Linux kernel";
-			kernel = "kernel@0";
-			fdt = "fdt@ocelot_pcb120";
+			kernel = "kernel";
+			fdt = "fdt-ocelot_pcb120";
 		};
 	};
 };
--- a/arch/mips/generic/board-serval.its.S
+++ b/arch/mips/generic/board-serval.its.S
@@ -1,13 +1,13 @@
 /* SPDX-License-Identifier: (GPL-2.0 OR MIT) */
 / {
 	images {
-		fdt@serval_pcb105 {
+		fdt-serval_pcb105 {
 			description = "MSCC Serval PCB105 Device Tree";
 			data = /incbin/("boot/dts/mscc/serval_pcb105.dtb");
 			type = "flat_dt";
 			arch = "mips";
 			compression = "none";
-			hash@0 {
+			hash {
 				algo = "sha1";
 			};
 		};
@@ -16,8 +16,8 @@
 	configurations {
 		pcb105 {
 			description = "Serval Linux kernel";
-			kernel = "kernel@0";
-			fdt = "fdt@serval_pcb105";
+			kernel = "kernel";
+			fdt = "fdt-serval_pcb105";
 			ramdisk = "ramdisk";
 		};
 	};
--- a/arch/mips/generic/board-xilfpga.its.S
+++ b/arch/mips/generic/board-xilfpga.its.S
@@ -1,22 +1,22 @@
 / {
 	images {
-		fdt@xilfpga {
+		fdt-xilfpga {
 			description = "MIPSfpga (xilfpga) Device Tree";
 			data = /incbin/("boot/dts/xilfpga/nexys4ddr.dtb");
 			type = "flat_dt";
 			arch = "mips";
 			compression = "none";
-			hash@0 {
+			hash {
 				algo = "sha1";
 			};
 		};
 	};
 
 	configurations {
-		conf@xilfpga {
+		conf-xilfpga {
 			description = "MIPSfpga Linux kernel";
-			kernel = "kernel@0";
-			fdt = "fdt@xilfpga";
+			kernel = "kernel";
+			fdt = "fdt-xilfpga";
 		};
 	};
 };
--- a/arch/mips/generic/vmlinux.its.S
+++ b/arch/mips/generic/vmlinux.its.S
@@ -6,7 +6,7 @@
 	#address-cells = <ADDR_CELLS>;
 
 	images {
-		kernel@0 {
+		kernel {
 			description = KERNEL_NAME;
 			data = /incbin/(VMLINUX_BINARY);
 			type = "kernel";
@@ -15,18 +15,18 @@
 			compression = VMLINUX_COMPRESSION;
 			load = /bits/ ADDR_BITS <VMLINUX_LOAD_ADDRESS>;
 			entry = /bits/ ADDR_BITS <VMLINUX_ENTRY_ADDRESS>;
-			hash@0 {
+			hash {
 				algo = "sha1";
 			};
 		};
 	};
 
 	configurations {
-		default = "conf@default";
+		default = "conf-default";
 
-		conf@default {
+		conf-default {
 			description = "Generic Linux kernel";
-			kernel = "kernel@0";
+			kernel = "kernel";
 		};
 	};
 };



^ permalink raw reply	[flat|nested] 702+ messages in thread

* [PATCH 5.12 064/677] mt76: mt7615: use ieee80211_free_txskb() in mt7615_tx_token_put()
  2021-05-12 14:40 [PATCH 5.12 000/677] 5.12.4-rc1 review Greg Kroah-Hartman
                   ` (62 preceding siblings ...)
  2021-05-12 14:41 ` [PATCH 5.12 063/677] MIPS: generic: Update node names to avoid unit addresses Greg Kroah-Hartman
@ 2021-05-12 14:41 ` Greg Kroah-Hartman
  2021-05-12 14:41 ` [PATCH 5.12 065/677] ipw2x00: potential buffer overflow in libipw_wx_set_encodeext() Greg Kroah-Hartman
                   ` (620 subsequent siblings)
  684 siblings, 0 replies; 702+ messages in thread
From: Greg Kroah-Hartman @ 2021-05-12 14:41 UTC (permalink / raw)
  To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Ryder Lee, Felix Fietkau

From: Ryder Lee <ryder.lee@mediatek.com>

commit 06991d1f73a9bdbc5f234ee96737b9102705b89c upstream.

We should use ieee80211_free_txskb() to report skb status avoid wrong
aql accounting after reset.

Cc: stable@vger.kernel.org
Signed-off-by: Ryder Lee <ryder.lee@mediatek.com>
Signed-off-by: Felix Fietkau <nbd@nbd.name>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/net/wireless/mediatek/mt76/mt7615/mac.c |    8 ++++++--
 1 file changed, 6 insertions(+), 2 deletions(-)

--- a/drivers/net/wireless/mediatek/mt76/mt7615/mac.c
+++ b/drivers/net/wireless/mediatek/mt76/mt7615/mac.c
@@ -2000,8 +2000,12 @@ void mt7615_tx_token_put(struct mt7615_d
 	spin_lock_bh(&dev->token_lock);
 	idr_for_each_entry(&dev->token, txwi, id) {
 		mt7615_txp_skb_unmap(&dev->mt76, txwi);
-		if (txwi->skb)
-			dev_kfree_skb_any(txwi->skb);
+		if (txwi->skb) {
+			struct ieee80211_hw *hw;
+
+			hw = mt76_tx_status_get_hw(&dev->mt76, txwi->skb);
+			ieee80211_free_txskb(hw, txwi->skb);
+		}
 		mt76_put_txwi(&dev->mt76, txwi);
 	}
 	spin_unlock_bh(&dev->token_lock);



^ permalink raw reply	[flat|nested] 702+ messages in thread

* [PATCH 5.12 065/677] ipw2x00: potential buffer overflow in libipw_wx_set_encodeext()
  2021-05-12 14:40 [PATCH 5.12 000/677] 5.12.4-rc1 review Greg Kroah-Hartman
                   ` (63 preceding siblings ...)
  2021-05-12 14:41 ` [PATCH 5.12 064/677] mt76: mt7615: use ieee80211_free_txskb() in mt7615_tx_token_put() Greg Kroah-Hartman
@ 2021-05-12 14:41 ` Greg Kroah-Hartman
  2021-05-12 14:41 ` [PATCH 5.12 066/677] net: xilinx: drivers need/depend on HAS_IOMEM Greg Kroah-Hartman
                   ` (619 subsequent siblings)
  684 siblings, 0 replies; 702+ messages in thread
From: Greg Kroah-Hartman @ 2021-05-12 14:41 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Dan Carpenter, Stanislav Yakovlev,
	Kalle Valo

From: Dan Carpenter <dan.carpenter@oracle.com>

commit 260a9ad9446723d4063ed802989758852809714d upstream.

The "ext->key_len" is a u16 that comes from the user.  If it's over
SCM_KEY_LEN (32) that could lead to memory corruption.

Fixes: e0d369d1d969 ("[PATCH] ieee82011: Added WE-18 support to default wireless extension handler")
Cc: stable@vger.kernel.org
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Acked-by: Stanislav Yakovlev <stas.yakovlev@gmail.com>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
Link: https://lore.kernel.org/r/YHaoA1i+8uT4ir4h@mwanda
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/net/wireless/intel/ipw2x00/libipw_wx.c |    6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

--- a/drivers/net/wireless/intel/ipw2x00/libipw_wx.c
+++ b/drivers/net/wireless/intel/ipw2x00/libipw_wx.c
@@ -633,8 +633,10 @@ int libipw_wx_set_encodeext(struct libip
 	}
 
 	if (ext->alg != IW_ENCODE_ALG_NONE) {
-		memcpy(sec.keys[idx], ext->key, ext->key_len);
-		sec.key_sizes[idx] = ext->key_len;
+		int key_len = clamp_val(ext->key_len, 0, SCM_KEY_LEN);
+
+		memcpy(sec.keys[idx], ext->key, key_len);
+		sec.key_sizes[idx] = key_len;
 		sec.flags |= (1 << idx);
 		if (ext->alg == IW_ENCODE_ALG_WEP) {
 			sec.encode_alg[idx] = SEC_ALG_WEP;



^ permalink raw reply	[flat|nested] 702+ messages in thread

* [PATCH 5.12 066/677] net: xilinx: drivers need/depend on HAS_IOMEM
  2021-05-12 14:40 [PATCH 5.12 000/677] 5.12.4-rc1 review Greg Kroah-Hartman
                   ` (64 preceding siblings ...)
  2021-05-12 14:41 ` [PATCH 5.12 065/677] ipw2x00: potential buffer overflow in libipw_wx_set_encodeext() Greg Kroah-Hartman
@ 2021-05-12 14:41 ` Greg Kroah-Hartman
  2021-05-12 14:41 ` [PATCH 5.12 067/677] cfg80211: scan: drop entry from hidden_list on overflow Greg Kroah-Hartman
                   ` (618 subsequent siblings)
  684 siblings, 0 replies; 702+ messages in thread
From: Greg Kroah-Hartman @ 2021-05-12 14:41 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Randy Dunlap, kernel test robot,
	Radhey Shyam Pandey, Gary Guo, Zhang Changzhong, Andre Przywara,
	Daniel Borkmann, David S. Miller, Jakub Kicinski, netdev

From: Randy Dunlap <rdunlap@infradead.org>

commit 46fd4471615c1bff9d87c411140807762c25667a upstream.

kernel test robot reports build errors in 3 Xilinx ethernet drivers.
They all use ioremap functions that are only available when HAS_IOMEM
is set/enabled. If it is not enabled, they all have build errors,
so make these 3 drivers depend on HAS_IOMEM.

ld: drivers/net/ethernet/xilinx/xilinx_emaclite.o: in function `xemaclite_of_probe':
xilinx_emaclite.c:(.text+0x9fc): undefined reference to `devm_ioremap_resource'

ld: drivers/net/ethernet/xilinx/xilinx_axienet_main.o: in function `axienet_probe':
xilinx_axienet_main.c:(.text+0x942): undefined reference to `devm_ioremap_resource'

ld: drivers/net/ethernet/xilinx/ll_temac_main.o: in function `temac_probe':
ll_temac_main.c:(.text+0x1283): undefined reference to `devm_platform_ioremap_resource_byname'
ld: ll_temac_main.c:(.text+0x13ad): undefined reference to `devm_of_iomap'
ld: ll_temac_main.c:(.text+0x162e): undefined reference to `devm_platform_ioremap_resource'

Fixes: 8a3b7a252dca ("drivers/net/ethernet/xilinx: added Xilinx AXI Ethernet driver")
Signed-off-by: Randy Dunlap <rdunlap@infradead.org>
Reported-by: kernel test robot <lkp@intel.com>
Cc: Radhey Shyam Pandey <radhey.shyam.pandey@xilinx.com>
Cc: Gary Guo <gary@garyguo.net>
Cc: Zhang Changzhong <zhangchangzhong@huawei.com>
Cc: Andre Przywara <andre.przywara@arm.com>
Cc: stable@vger.kernel.org
Cc: Daniel Borkmann <daniel@iogearbox.net>
Cc: "David S. Miller" <davem@davemloft.net>
Cc: Jakub Kicinski <kuba@kernel.org>
Cc: netdev@vger.kernel.org
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/net/ethernet/xilinx/Kconfig |    3 +++
 1 file changed, 3 insertions(+)

--- a/drivers/net/ethernet/xilinx/Kconfig
+++ b/drivers/net/ethernet/xilinx/Kconfig
@@ -18,12 +18,14 @@ if NET_VENDOR_XILINX
 
 config XILINX_EMACLITE
 	tristate "Xilinx 10/100 Ethernet Lite support"
+	depends on HAS_IOMEM
 	select PHYLIB
 	help
 	  This driver supports the 10/100 Ethernet Lite from Xilinx.
 
 config XILINX_AXI_EMAC
 	tristate "Xilinx 10/100/1000 AXI Ethernet support"
+	depends on HAS_IOMEM
 	select PHYLINK
 	help
 	  This driver supports the 10/100/1000 Ethernet from Xilinx for the
@@ -31,6 +33,7 @@ config XILINX_AXI_EMAC
 
 config XILINX_LL_TEMAC
 	tristate "Xilinx LL TEMAC (LocalLink Tri-mode Ethernet MAC) driver"
+	depends on HAS_IOMEM
 	select PHYLIB
 	help
 	  This driver supports the Xilinx 10/100/1000 LocalLink TEMAC



^ permalink raw reply	[flat|nested] 702+ messages in thread

* [PATCH 5.12 067/677] cfg80211: scan: drop entry from hidden_list on overflow
  2021-05-12 14:40 [PATCH 5.12 000/677] 5.12.4-rc1 review Greg Kroah-Hartman
                   ` (65 preceding siblings ...)
  2021-05-12 14:41 ` [PATCH 5.12 066/677] net: xilinx: drivers need/depend on HAS_IOMEM Greg Kroah-Hartman
@ 2021-05-12 14:41 ` Greg Kroah-Hartman
  2021-05-12 14:41 ` [PATCH 5.12 068/677] rtw88: Fix array overrun in rtw_get_tx_power_params() Greg Kroah-Hartman
                   ` (617 subsequent siblings)
  684 siblings, 0 replies; 702+ messages in thread
From: Greg Kroah-Hartman @ 2021-05-12 14:41 UTC (permalink / raw)
  To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Dan Carpenter, Johannes Berg

From: Johannes Berg <johannes.berg@intel.com>

commit 010bfbe768f7ecc876ffba92db30432de4997e2a upstream.

If we overflow the maximum number of BSS entries and free the
new entry, drop it from any hidden_list that it may have been
added to in the code above or in cfg80211_combine_bsses().

Reported-by: Dan Carpenter <dan.carpenter@oracle.com>
Link: https://lore.kernel.org/r/20210416094212.5de7d1676ad7.Ied283b0bc5f504845e7d6ab90626bdfa68bb3dc0@changeid
Cc: stable@vger.kernel.org
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 net/wireless/scan.c |    2 ++
 1 file changed, 2 insertions(+)

--- a/net/wireless/scan.c
+++ b/net/wireless/scan.c
@@ -1751,6 +1751,8 @@ cfg80211_bss_update(struct cfg80211_regi
 
 		if (rdev->bss_entries >= bss_entries_limit &&
 		    !cfg80211_bss_expire_oldest(rdev)) {
+			if (!list_empty(&new->hidden_list))
+				list_del(&new->hidden_list);
 			kfree(new);
 			goto drop;
 		}



^ permalink raw reply	[flat|nested] 702+ messages in thread

* [PATCH 5.12 068/677] rtw88: Fix array overrun in rtw_get_tx_power_params()
  2021-05-12 14:40 [PATCH 5.12 000/677] 5.12.4-rc1 review Greg Kroah-Hartman
                   ` (66 preceding siblings ...)
  2021-05-12 14:41 ` [PATCH 5.12 067/677] cfg80211: scan: drop entry from hidden_list on overflow Greg Kroah-Hartman
@ 2021-05-12 14:41 ` Greg Kroah-Hartman
  2021-05-12 14:41 ` [PATCH 5.12 069/677] mt76: fix potential DMA mapping leak Greg Kroah-Hartman
                   ` (616 subsequent siblings)
  684 siblings, 0 replies; 702+ messages in thread
From: Greg Kroah-Hartman @ 2021-05-12 14:41 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable,
	Богдан
	Пилипенко,
	Larry Finger, Ping-Ke Shih, Kalle Valo

From: Ping-Ke Shih <pkshih@realtek.com>

commit 2ff25985ea9ccc6c9af2c77b0b49045adcc62e0e upstream.

Using a kernel with the Undefined Behaviour Sanity Checker (UBSAN) enabled, the
following array overrun is logged:

================================================================================
UBSAN: array-index-out-of-bounds in /home/finger/wireless-drivers-next/drivers/net/wireless/realtek/rtw88/phy.c:1789:34
index 5 is out of range for type 'u8 [5]'
CPU: 2 PID: 84 Comm: kworker/u16:3 Tainted: G           O      5.12.0-rc5-00086-gd88bba47038e-dirty #651
Hardware name: TOSHIBA TECRA A50-A/TECRA A50-A, BIOS Version 4.50   09/29/2014
Workqueue: phy0 ieee80211_scan_work [mac80211]
Call Trace:
 dump_stack+0x64/0x7c
 ubsan_epilogue+0x5/0x40
 __ubsan_handle_out_of_bounds.cold+0x43/0x48
 rtw_get_tx_power_params+0x83a/drivers/net/wireless/realtek/rtw88/0xad0 [rtw_core]
 ? rtw_pci_read16+0x20/0x20 [rtw_pci]
 ? check_hw_ready+0x50/0x90 [rtw_core]
 rtw_phy_get_tx_power_index+0x4d/0xd0 [rtw_core]
 rtw_phy_set_tx_power_level+0xee/0x1b0 [rtw_core]
 rtw_set_channel+0xab/0x110 [rtw_core]
 rtw_ops_config+0x87/0xc0 [rtw_core]
 ieee80211_hw_config+0x9d/0x130 [mac80211]
 ieee80211_scan_state_set_channel+0x81/0x170 [mac80211]
 ieee80211_scan_work+0x19f/0x2a0 [mac80211]
 process_one_work+0x1dd/0x3a0
 worker_thread+0x49/0x330
 ? rescuer_thread+0x3a0/0x3a0
 kthread+0x134/0x150
 ? kthread_create_worker_on_cpu+0x70/0x70
 ret_from_fork+0x22/0x30
================================================================================

The statement where an array is being overrun is shown in the following snippet:

	if (rate <= DESC_RATE11M)
		tx_power = pwr_idx_2g->cck_base[group];
	else
====>		tx_power = pwr_idx_2g->bw40_base[group];

The associated arrays are defined in main.h as follows:

struct rtw_2g_txpwr_idx {
	u8 cck_base[6];
	u8 bw40_base[5];
	struct rtw_2g_1s_pwr_idx_diff ht_1s_diff;
	struct rtw_2g_ns_pwr_idx_diff ht_2s_diff;
	struct rtw_2g_ns_pwr_idx_diff ht_3s_diff;
	struct rtw_2g_ns_pwr_idx_diff ht_4s_diff;
};

The problem arises because the value of group is 5 for channel 14. The trivial
increase in the dimension of bw40_base fails as this struct must match the layout of
efuse. The fix is to add the rate as an argument to rtw_get_channel_group() and set
the group for channel 14 to 4 if rate <= DESC_RATE11M.

This patch fixes commit fa6dfe6bff24 ("rtw88: resolve order of tx power setting routines")

Fixes: fa6dfe6bff24 ("rtw88: resolve order of tx power setting routines")
Reported-by: Богдан Пилипенко <bogdan.pylypenko107@gmail.com>
Signed-off-by: Larry Finger <Larry.Finger@lwfinger.net>
Signed-off-by: Ping-Ke Shih <pkshih@realtek.com>
Cc: Stable <stable@vger.kernel.org>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
Link: https://lore.kernel.org/r/20210401192717.28927-1-Larry.Finger@lwfinger.net
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/net/wireless/realtek/rtw88/phy.c |    5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

--- a/drivers/net/wireless/realtek/rtw88/phy.c
+++ b/drivers/net/wireless/realtek/rtw88/phy.c
@@ -1584,7 +1584,7 @@ void rtw_phy_load_tables(struct rtw_dev
 }
 EXPORT_SYMBOL(rtw_phy_load_tables);
 
-static u8 rtw_get_channel_group(u8 channel)
+static u8 rtw_get_channel_group(u8 channel, u8 rate)
 {
 	switch (channel) {
 	default:
@@ -1628,6 +1628,7 @@ static u8 rtw_get_channel_group(u8 chann
 	case 106:
 		return 4;
 	case 14:
+		return rate <= DESC_RATE11M ? 5 : 4;
 	case 108:
 	case 110:
 	case 112:
@@ -1879,7 +1880,7 @@ void rtw_get_tx_power_params(struct rtw_
 	s8 *remnant = &pwr_param->pwr_remnant;
 
 	pwr_idx = &rtwdev->efuse.txpwr_idx_table[path];
-	group = rtw_get_channel_group(ch);
+	group = rtw_get_channel_group(ch, rate);
 
 	/* base power index for 2.4G/5G */
 	if (IS_CH_2G_BAND(ch)) {



^ permalink raw reply	[flat|nested] 702+ messages in thread

* [PATCH 5.12 069/677] mt76: fix potential DMA mapping leak
  2021-05-12 14:40 [PATCH 5.12 000/677] 5.12.4-rc1 review Greg Kroah-Hartman
                   ` (67 preceding siblings ...)
  2021-05-12 14:41 ` [PATCH 5.12 068/677] rtw88: Fix array overrun in rtw_get_tx_power_params() Greg Kroah-Hartman
@ 2021-05-12 14:41 ` Greg Kroah-Hartman
  2021-05-12 14:41 ` [PATCH 5.12 070/677] FDDI: defxx: Make MMIO the configuration default except for EISA Greg Kroah-Hartman
                   ` (615 subsequent siblings)
  684 siblings, 0 replies; 702+ messages in thread
From: Greg Kroah-Hartman @ 2021-05-12 14:41 UTC (permalink / raw)
  To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Felix Fietkau

From: Felix Fietkau <nbd@nbd.name>

commit b4403cee6400c5f679e9c4a82b91d61aa961eccf upstream.

With buf uninitialized in mt76_dma_tx_queue_skb_raw, its field skip_unmap
could potentially inherit a non-zero value from stack garbage.
If this happens, it will cause DMA mappings for MCU command frames to not be
unmapped after completion

Fixes: 27d5c528a7ca ("mt76: fix double DMA unmap of the first buffer on 7615/7915")
Cc: stable@vger.kernel.org
Signed-off-by: Felix Fietkau <nbd@nbd.name>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/net/wireless/mediatek/mt76/dma.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

--- a/drivers/net/wireless/mediatek/mt76/dma.c
+++ b/drivers/net/wireless/mediatek/mt76/dma.c
@@ -309,7 +309,7 @@ static int
 mt76_dma_tx_queue_skb_raw(struct mt76_dev *dev, struct mt76_queue *q,
 			  struct sk_buff *skb, u32 tx_info)
 {
-	struct mt76_queue_buf buf;
+	struct mt76_queue_buf buf = {};
 	dma_addr_t addr;
 
 	if (q->queued + 1 >= q->ndesc - 1)



^ permalink raw reply	[flat|nested] 702+ messages in thread

* [PATCH 5.12 070/677] FDDI: defxx: Make MMIO the configuration default except for EISA
  2021-05-12 14:40 [PATCH 5.12 000/677] 5.12.4-rc1 review Greg Kroah-Hartman
                   ` (68 preceding siblings ...)
  2021-05-12 14:41 ` [PATCH 5.12 069/677] mt76: fix potential DMA mapping leak Greg Kroah-Hartman
@ 2021-05-12 14:41 ` Greg Kroah-Hartman
  2021-05-12 14:41 ` [PATCH 5.12 071/677] drm/qxl: use ttm bo priorities Greg Kroah-Hartman
                   ` (614 subsequent siblings)
  684 siblings, 0 replies; 702+ messages in thread
From: Greg Kroah-Hartman @ 2021-05-12 14:41 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Maciej W. Rozycki, David S. Miller

From: Maciej W. Rozycki <macro@orcam.me.uk>

commit 193ced4a79599352d63cb8c9e2f0c6043106eb6a upstream.

Recent versions of the PCI Express specification have deprecated support
for I/O transactions and actually some PCIe host bridges, such as Power
Systems Host Bridge 4 (PHB4), do not implement them.

The default kernel configuration choice for the defxx driver is the use
of I/O ports rather than MMIO for PCI and EISA systems.  It may have
made sense as a conservative backwards compatible choice back when MMIO
operation support was added to the driver as a part of TURBOchannel bus
support.  However nowadays this configuration choice makes the driver
unusable with systems that do not implement I/O transactions for PCIe.

Make DEFXX_MMIO the configuration default then, except where configured
for EISA.  This exception is because an EISA adapter can have its MMIO
decoding disabled with ECU (EISA Configuration Utility) and therefore
not available with the resource allocation infrastructure we implement,
while port I/O is always readily available as it uses slot-specific
addressing, directly mapped to the slot an option card has been placed
in and handled with our EISA bus support core.  Conversely a kernel that
supports modern systems which may not have I/O transactions implemented
for PCIe will usually not be expected to handle legacy EISA systems.

The change of the default will make it easier for people, including but
not limited to distribution packagers, to make a working choice for the
driver.

Update the option description accordingly and while at it replace the
potentially ambiguous PIO acronym with IOP for "port I/O" vs "I/O ports"
according to our nomenclature used elsewhere.

Signed-off-by: Maciej W. Rozycki <macro@orcam.me.uk>
Fixes: e89a2cfb7d7b ("[TC] defxx: TURBOchannel support")
Cc: stable@vger.kernel.org # v2.6.21+
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/net/fddi/Kconfig |   15 +++++++++------
 1 file changed, 9 insertions(+), 6 deletions(-)

--- a/drivers/net/fddi/Kconfig
+++ b/drivers/net/fddi/Kconfig
@@ -40,17 +40,20 @@ config DEFXX
 
 config DEFXX_MMIO
 	bool
-	prompt "Use MMIO instead of PIO" if PCI || EISA
+	prompt "Use MMIO instead of IOP" if PCI || EISA
 	depends on DEFXX
-	default n if PCI || EISA
+	default n if EISA
 	default y
 	help
 	  This instructs the driver to use EISA or PCI memory-mapped I/O
-	  (MMIO) as appropriate instead of programmed I/O ports (PIO).
+	  (MMIO) as appropriate instead of programmed I/O ports (IOP).
 	  Enabling this gives an improvement in processing time in parts
-	  of the driver, but it may cause problems with EISA (DEFEA)
-	  adapters.  TURBOchannel does not have the concept of I/O ports,
-	  so MMIO is always used for these (DEFTA) adapters.
+	  of the driver, but it requires a memory window to be configured
+	  for EISA (DEFEA) adapters that may not always be available.
+	  Conversely some PCIe host bridges do not support IOP, so MMIO
+	  may be required to access PCI (DEFPA) adapters on downstream PCI
+	  buses with some systems.  TURBOchannel does not have the concept
+	  of I/O ports, so MMIO is always used for these (DEFTA) adapters.
 
 	  If unsure, say N.
 



^ permalink raw reply	[flat|nested] 702+ messages in thread

* [PATCH 5.12 071/677] drm/qxl: use ttm bo priorities
  2021-05-12 14:40 [PATCH 5.12 000/677] 5.12.4-rc1 review Greg Kroah-Hartman
                   ` (69 preceding siblings ...)
  2021-05-12 14:41 ` [PATCH 5.12 070/677] FDDI: defxx: Make MMIO the configuration default except for EISA Greg Kroah-Hartman
@ 2021-05-12 14:41 ` Greg Kroah-Hartman
  2021-05-12 14:41 ` [PATCH 5.12 072/677] drm/ingenic: Fix non-OSD mode Greg Kroah-Hartman
                   ` (613 subsequent siblings)
  684 siblings, 0 replies; 702+ messages in thread
From: Greg Kroah-Hartman @ 2021-05-12 14:41 UTC (permalink / raw)
  To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Gerd Hoffmann, Thomas Zimmermann

From: Gerd Hoffmann <kraxel@redhat.com>

commit 4fff19ae427548d8c37260c975a4b20d3c040ec6 upstream.

Allow to set priorities for buffer objects.  Use priority 1 for surface
and cursor command releases.  Use priority 0 for drawing command
releases.  That way the short-living drawing commands are first in line
when it comes to eviction, making it *much* less likely that
ttm_bo_mem_force_space() picks something which can't be evicted and
throws an error after waiting a while without success.

Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
Acked-by: Thomas Zimmermann <tzimmermann@suse.de>
Link: http://patchwork.freedesktop.org/patch/msgid/20210217123213.2199186-4-kraxel@redhat.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/gpu/drm/qxl/qxl_cmd.c     |    2 +-
 drivers/gpu/drm/qxl/qxl_display.c |    4 ++--
 drivers/gpu/drm/qxl/qxl_gem.c     |    2 +-
 drivers/gpu/drm/qxl/qxl_object.c  |    5 +++--
 drivers/gpu/drm/qxl/qxl_object.h  |    1 +
 drivers/gpu/drm/qxl/qxl_release.c |   18 ++++++++++++------
 6 files changed, 20 insertions(+), 12 deletions(-)

--- a/drivers/gpu/drm/qxl/qxl_cmd.c
+++ b/drivers/gpu/drm/qxl/qxl_cmd.c
@@ -268,7 +268,7 @@ int qxl_alloc_bo_reserved(struct qxl_dev
 	int ret;
 
 	ret = qxl_bo_create(qdev, size, false /* not kernel - device */,
-			    false, QXL_GEM_DOMAIN_VRAM, NULL, &bo);
+			    false, QXL_GEM_DOMAIN_VRAM, 0, NULL, &bo);
 	if (ret) {
 		DRM_ERROR("failed to allocate VRAM BO\n");
 		return ret;
--- a/drivers/gpu/drm/qxl/qxl_display.c
+++ b/drivers/gpu/drm/qxl/qxl_display.c
@@ -798,8 +798,8 @@ static int qxl_plane_prepare_fb(struct d
 				qdev->dumb_shadow_bo = NULL;
 			}
 			qxl_bo_create(qdev, surf.height * surf.stride,
-				      true, true, QXL_GEM_DOMAIN_SURFACE, &surf,
-				      &qdev->dumb_shadow_bo);
+				      true, true, QXL_GEM_DOMAIN_SURFACE, 0,
+				      &surf, &qdev->dumb_shadow_bo);
 		}
 		if (user_bo->shadow != qdev->dumb_shadow_bo) {
 			if (user_bo->shadow) {
--- a/drivers/gpu/drm/qxl/qxl_gem.c
+++ b/drivers/gpu/drm/qxl/qxl_gem.c
@@ -55,7 +55,7 @@ int qxl_gem_object_create(struct qxl_dev
 	/* At least align on page size */
 	if (alignment < PAGE_SIZE)
 		alignment = PAGE_SIZE;
-	r = qxl_bo_create(qdev, size, kernel, false, initial_domain, surf, &qbo);
+	r = qxl_bo_create(qdev, size, kernel, false, initial_domain, 0, surf, &qbo);
 	if (r) {
 		if (r != -ERESTARTSYS)
 			DRM_ERROR(
--- a/drivers/gpu/drm/qxl/qxl_object.c
+++ b/drivers/gpu/drm/qxl/qxl_object.c
@@ -103,8 +103,8 @@ static const struct drm_gem_object_funcs
 	.print_info = drm_gem_ttm_print_info,
 };
 
-int qxl_bo_create(struct qxl_device *qdev,
-		  unsigned long size, bool kernel, bool pinned, u32 domain,
+int qxl_bo_create(struct qxl_device *qdev, unsigned long size,
+		  bool kernel, bool pinned, u32 domain, u32 priority,
 		  struct qxl_surface *surf,
 		  struct qxl_bo **bo_ptr)
 {
@@ -137,6 +137,7 @@ int qxl_bo_create(struct qxl_device *qde
 
 	qxl_ttm_placement_from_domain(bo, domain);
 
+	bo->tbo.priority = priority;
 	r = ttm_bo_init_reserved(&qdev->mman.bdev, &bo->tbo, size, type,
 				 &bo->placement, 0, &ctx, size,
 				 NULL, NULL, &qxl_ttm_bo_destroy);
--- a/drivers/gpu/drm/qxl/qxl_object.h
+++ b/drivers/gpu/drm/qxl/qxl_object.h
@@ -61,6 +61,7 @@ static inline u64 qxl_bo_mmap_offset(str
 extern int qxl_bo_create(struct qxl_device *qdev,
 			 unsigned long size,
 			 bool kernel, bool pinned, u32 domain,
+			 u32 priority,
 			 struct qxl_surface *surf,
 			 struct qxl_bo **bo_ptr);
 extern int qxl_bo_kmap(struct qxl_bo *bo, struct dma_buf_map *map);
--- a/drivers/gpu/drm/qxl/qxl_release.c
+++ b/drivers/gpu/drm/qxl/qxl_release.c
@@ -199,11 +199,12 @@ qxl_release_free(struct qxl_device *qdev
 }
 
 static int qxl_release_bo_alloc(struct qxl_device *qdev,
-				struct qxl_bo **bo)
+				struct qxl_bo **bo,
+				u32 priority)
 {
 	/* pin releases bo's they are too messy to evict */
 	return qxl_bo_create(qdev, PAGE_SIZE, false, true,
-			     QXL_GEM_DOMAIN_VRAM, NULL, bo);
+			     QXL_GEM_DOMAIN_VRAM, priority, NULL, bo);
 }
 
 int qxl_release_list_add(struct qxl_release *release, struct qxl_bo *bo)
@@ -326,13 +327,18 @@ int qxl_alloc_release_reserved(struct qx
 	int ret = 0;
 	union qxl_release_info *info;
 	int cur_idx;
+	u32 priority;
 
-	if (type == QXL_RELEASE_DRAWABLE)
+	if (type == QXL_RELEASE_DRAWABLE) {
 		cur_idx = 0;
-	else if (type == QXL_RELEASE_SURFACE_CMD)
+		priority = 0;
+	} else if (type == QXL_RELEASE_SURFACE_CMD) {
 		cur_idx = 1;
-	else if (type == QXL_RELEASE_CURSOR_CMD)
+		priority = 1;
+	} else if (type == QXL_RELEASE_CURSOR_CMD) {
 		cur_idx = 2;
+		priority = 1;
+	}
 	else {
 		DRM_ERROR("got illegal type: %d\n", type);
 		return -EINVAL;
@@ -352,7 +358,7 @@ int qxl_alloc_release_reserved(struct qx
 		qdev->current_release_bo[cur_idx] = NULL;
 	}
 	if (!qdev->current_release_bo[cur_idx]) {
-		ret = qxl_release_bo_alloc(qdev, &qdev->current_release_bo[cur_idx]);
+		ret = qxl_release_bo_alloc(qdev, &qdev->current_release_bo[cur_idx], priority);
 		if (ret) {
 			mutex_unlock(&qdev->release_mutex);
 			if (free_bo) {



^ permalink raw reply	[flat|nested] 702+ messages in thread

* [PATCH 5.12 072/677] drm/ingenic: Fix non-OSD mode
  2021-05-12 14:40 [PATCH 5.12 000/677] 5.12.4-rc1 review Greg Kroah-Hartman
                   ` (70 preceding siblings ...)
  2021-05-12 14:41 ` [PATCH 5.12 071/677] drm/qxl: use ttm bo priorities Greg Kroah-Hartman
@ 2021-05-12 14:41 ` Greg Kroah-Hartman
  2021-05-12 14:41 ` [PATCH 5.12 073/677] drm/panfrost: Clear MMU irqs before handling the fault Greg Kroah-Hartman
                   ` (612 subsequent siblings)
  684 siblings, 0 replies; 702+ messages in thread
From: Greg Kroah-Hartman @ 2021-05-12 14:41 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Paul Cercueil, Daniel Vetter,
	H. Nikolaus Schaller

From: Paul Cercueil <paul@crapouillou.net>

commit 7b4957684e5d813fcbdc98144e3cc5c4467b3e2e upstream.

Even though the JZ4740 did not have the OSD mode, it had (according to
the documentation) two DMA channels, but there is absolutely no
information about how to select the second DMA channel.

Make the ingenic-drm driver work in non-OSD mode by using the
foreground0 plane (which is bound to the DMA0 channel) as the primary
plane, instead of the foreground1 plane, which is the primary plane
when in OSD mode.

Fixes: 3c9bea4ef32b ("drm/ingenic: Add support for OSD mode")
Cc: <stable@vger.kernel.org> # v5.8+
Signed-off-by: Paul Cercueil <paul@crapouillou.net>
Acked-by: Daniel Vetter <daniel.vetter@ffwll.ch>
Tested-by: H. Nikolaus Schaller <hns@goldelico.com>
Link: https://patchwork.freedesktop.org/patch/msgid/20210124085552.29146-5-paul@crapouillou.net
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/gpu/drm/ingenic/ingenic-drm-drv.c |   11 +++++++----
 1 file changed, 7 insertions(+), 4 deletions(-)

--- a/drivers/gpu/drm/ingenic/ingenic-drm-drv.c
+++ b/drivers/gpu/drm/ingenic/ingenic-drm-drv.c
@@ -554,7 +554,7 @@ static void ingenic_drm_plane_atomic_upd
 		height = state->src_h >> 16;
 		cpp = state->fb->format->cpp[0];
 
-		if (priv->soc_info->has_osd && plane->type == DRM_PLANE_TYPE_OVERLAY)
+		if (!priv->soc_info->has_osd || plane->type == DRM_PLANE_TYPE_OVERLAY)
 			hwdesc = &priv->dma_hwdescs->hwdesc_f0;
 		else
 			hwdesc = &priv->dma_hwdescs->hwdesc_f1;
@@ -826,6 +826,7 @@ static int ingenic_drm_bind(struct devic
 	const struct jz_soc_info *soc_info;
 	struct ingenic_drm *priv;
 	struct clk *parent_clk;
+	struct drm_plane *primary;
 	struct drm_bridge *bridge;
 	struct drm_panel *panel;
 	struct drm_encoder *encoder;
@@ -940,9 +941,11 @@ static int ingenic_drm_bind(struct devic
 	if (soc_info->has_osd)
 		priv->ipu_plane = drm_plane_from_index(drm, 0);
 
-	drm_plane_helper_add(&priv->f1, &ingenic_drm_plane_helper_funcs);
+	primary = priv->soc_info->has_osd ? &priv->f1 : &priv->f0;
 
-	ret = drm_universal_plane_init(drm, &priv->f1, 1,
+	drm_plane_helper_add(primary, &ingenic_drm_plane_helper_funcs);
+
+	ret = drm_universal_plane_init(drm, primary, 1,
 				       &ingenic_drm_primary_plane_funcs,
 				       priv->soc_info->formats_f1,
 				       priv->soc_info->num_formats_f1,
@@ -954,7 +957,7 @@ static int ingenic_drm_bind(struct devic
 
 	drm_crtc_helper_add(&priv->crtc, &ingenic_drm_crtc_helper_funcs);
 
-	ret = drm_crtc_init_with_planes(drm, &priv->crtc, &priv->f1,
+	ret = drm_crtc_init_with_planes(drm, &priv->crtc, primary,
 					NULL, &ingenic_drm_crtc_funcs, NULL);
 	if (ret) {
 		dev_err(dev, "Failed to init CRTC: %i\n", ret);



^ permalink raw reply	[flat|nested] 702+ messages in thread

* [PATCH 5.12 073/677] drm/panfrost: Clear MMU irqs before handling the fault
  2021-05-12 14:40 [PATCH 5.12 000/677] 5.12.4-rc1 review Greg Kroah-Hartman
                   ` (71 preceding siblings ...)
  2021-05-12 14:41 ` [PATCH 5.12 072/677] drm/ingenic: Fix non-OSD mode Greg Kroah-Hartman
@ 2021-05-12 14:41 ` Greg Kroah-Hartman
  2021-05-12 14:42 ` [PATCH 5.12 074/677] drm/panfrost: Dont try to map pages that are already mapped Greg Kroah-Hartman
                   ` (611 subsequent siblings)
  684 siblings, 0 replies; 702+ messages in thread
From: Greg Kroah-Hartman @ 2021-05-12 14:41 UTC (permalink / raw)
  To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Boris Brezillon, Steven Price

From: Boris Brezillon <boris.brezillon@collabora.com>

commit 3aa0a80fc692c9959c261f4c5bfe9c23ddd90562 upstream.

When a fault is handled it will unblock the GPU which will continue
executing its shader and might fault almost immediately on a different
page. If we clear interrupts after handling the fault we might miss new
faults, so clear them before.

Cc: <stable@vger.kernel.org>
Fixes: 187d2929206e ("drm/panfrost: Add support for GPU heap allocations")
Signed-off-by: Boris Brezillon <boris.brezillon@collabora.com>
Reviewed-by: Steven Price <steven.price@arm.com>
Link: https://patchwork.freedesktop.org/patch/msgid/20210205111757.585248-2-boris.brezillon@collabora.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/gpu/drm/panfrost/panfrost_mmu.c |    4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

--- a/drivers/gpu/drm/panfrost/panfrost_mmu.c
+++ b/drivers/gpu/drm/panfrost/panfrost_mmu.c
@@ -593,6 +593,8 @@ static irqreturn_t panfrost_mmu_irq_hand
 		access_type = (fault_status >> 8) & 0x3;
 		source_id = (fault_status >> 16);
 
+		mmu_write(pfdev, MMU_INT_CLEAR, mask);
+
 		/* Page fault only */
 		ret = -1;
 		if ((status & mask) == BIT(i) && (exception_type & 0xF8) == 0xC0)
@@ -616,8 +618,6 @@ static irqreturn_t panfrost_mmu_irq_hand
 				access_type, access_type_name(pfdev, fault_status),
 				source_id);
 
-		mmu_write(pfdev, MMU_INT_CLEAR, mask);
-
 		status &= ~mask;
 	}
 



^ permalink raw reply	[flat|nested] 702+ messages in thread

* [PATCH 5.12 074/677] drm/panfrost: Dont try to map pages that are already mapped
  2021-05-12 14:40 [PATCH 5.12 000/677] 5.12.4-rc1 review Greg Kroah-Hartman
                   ` (72 preceding siblings ...)
  2021-05-12 14:41 ` [PATCH 5.12 073/677] drm/panfrost: Clear MMU irqs before handling the fault Greg Kroah-Hartman
@ 2021-05-12 14:42 ` Greg Kroah-Hartman
  2021-05-12 14:42 ` [PATCH 5.12 075/677] drm/radeon: fix copy of uninitialized variable back to userspace Greg Kroah-Hartman
                   ` (610 subsequent siblings)
  684 siblings, 0 replies; 702+ messages in thread
From: Greg Kroah-Hartman @ 2021-05-12 14:42 UTC (permalink / raw)
  To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Boris Brezillon, Steven Price

From: Boris Brezillon <boris.brezillon@collabora.com>

commit f45da8204ff1707c529a8769f5467ff16f504b26 upstream.

We allocate 2MB chunks at a time, so it might appear that a page fault
has already been handled by a previous page fault when we reach
panfrost_mmu_map_fault_addr(). Bail out in that case to avoid mapping the
same area twice.

Cc: <stable@vger.kernel.org>
Fixes: 187d2929206e ("drm/panfrost: Add support for GPU heap allocations")
Signed-off-by: Boris Brezillon <boris.brezillon@collabora.com>
Reviewed-by: Steven Price <steven.price@arm.com>
Link: https://patchwork.freedesktop.org/patch/msgid/20210205111757.585248-3-boris.brezillon@collabora.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/gpu/drm/panfrost/panfrost_mmu.c |    9 ++++++++-
 1 file changed, 8 insertions(+), 1 deletion(-)

--- a/drivers/gpu/drm/panfrost/panfrost_mmu.c
+++ b/drivers/gpu/drm/panfrost/panfrost_mmu.c
@@ -488,8 +488,14 @@ static int panfrost_mmu_map_fault_addr(s
 		}
 		bo->base.pages = pages;
 		bo->base.pages_use_count = 1;
-	} else
+	} else {
 		pages = bo->base.pages;
+		if (pages[page_offset]) {
+			/* Pages are already mapped, bail out. */
+			mutex_unlock(&bo->base.pages_lock);
+			goto out;
+		}
+	}
 
 	mapping = bo->base.base.filp->f_mapping;
 	mapping_set_unevictable(mapping);
@@ -522,6 +528,7 @@ static int panfrost_mmu_map_fault_addr(s
 
 	dev_dbg(pfdev->dev, "mapped page fault @ AS%d %llx", as, addr);
 
+out:
 	panfrost_gem_mapping_put(bomapping);
 
 	return 0;



^ permalink raw reply	[flat|nested] 702+ messages in thread

* [PATCH 5.12 075/677] drm/radeon: fix copy of uninitialized variable back to userspace
  2021-05-12 14:40 [PATCH 5.12 000/677] 5.12.4-rc1 review Greg Kroah-Hartman
                   ` (73 preceding siblings ...)
  2021-05-12 14:42 ` [PATCH 5.12 074/677] drm/panfrost: Dont try to map pages that are already mapped Greg Kroah-Hartman
@ 2021-05-12 14:42 ` Greg Kroah-Hartman
  2021-05-12 14:42 ` [PATCH 5.12 076/677] drm/dp_mst: Revise broadcast msg lct & lcr Greg Kroah-Hartman
                   ` (609 subsequent siblings)
  684 siblings, 0 replies; 702+ messages in thread
From: Greg Kroah-Hartman @ 2021-05-12 14:42 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Christian König, Colin Ian King,
	Alex Deucher

From: Colin Ian King <colin.king@canonical.com>

commit 8dbc2ccac5a65c5b57e3070e36a3dc97c7970d96 upstream.

Currently the ioctl command RADEON_INFO_SI_BACKEND_ENABLED_MASK can
copy back uninitialised data in value_tmp that pointer *value points
to. This can occur when rdev->family is less than CHIP_BONAIRE and
less than CHIP_TAHITI.  Fix this by adding in a missing -EINVAL
so that no invalid value is copied back to userspace.

Addresses-Coverity: ("Uninitialized scalar variable)
Cc: stable@vger.kernel.org # 3.13+
Fixes: 439a1cfffe2c ("drm/radeon: expose render backend mask to the userspace")
Reviewed-by: Christian König <christian.koenig@amd.com>
Signed-off-by: Colin Ian King <colin.king@canonical.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/gpu/drm/radeon/radeon_kms.c |    1 +
 1 file changed, 1 insertion(+)

--- a/drivers/gpu/drm/radeon/radeon_kms.c
+++ b/drivers/gpu/drm/radeon/radeon_kms.c
@@ -518,6 +518,7 @@ int radeon_info_ioctl(struct drm_device
 			*value = rdev->config.si.backend_enable_mask;
 		} else {
 			DRM_DEBUG_KMS("BACKEND_ENABLED_MASK is si+ only!\n");
+			return -EINVAL;
 		}
 		break;
 	case RADEON_INFO_MAX_SCLK:



^ permalink raw reply	[flat|nested] 702+ messages in thread

* [PATCH 5.12 076/677] drm/dp_mst: Revise broadcast msg lct & lcr
  2021-05-12 14:40 [PATCH 5.12 000/677] 5.12.4-rc1 review Greg Kroah-Hartman
                   ` (74 preceding siblings ...)
  2021-05-12 14:42 ` [PATCH 5.12 075/677] drm/radeon: fix copy of uninitialized variable back to userspace Greg Kroah-Hartman
@ 2021-05-12 14:42 ` Greg Kroah-Hartman
  2021-05-12 14:42 ` [PATCH 5.12 077/677] drm/dp_mst: Set CLEAR_PAYLOAD_ID_TABLE as broadcast Greg Kroah-Hartman
                   ` (608 subsequent siblings)
  684 siblings, 0 replies; 702+ messages in thread
From: Greg Kroah-Hartman @ 2021-05-12 14:42 UTC (permalink / raw)
  To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Wayne Lin, Lyude Paul

From: Wayne Lin <Wayne.Lin@amd.com>

commit 419e91ea3143bf26991442465ac64d9461e98d96 upstream.

[Why & How]
According to DP spec, broadcast message LCT equals to 1 and LCR equals
to 6. Current implementation is incorrect. Fix it.
In addition, revise a bit the hdr->rad handling to include broadcast
case.

Signed-off-by: Wayne Lin <Wayne.Lin@amd.com>
Cc: stable@vger.kernel.org
Reviewed-by: Lyude Paul <lyude@redhat.com>
Signed-off-by: Lyude Paul <lyude@redhat.com>
Link: https://patchwork.freedesktop.org/patch/msgid/20210224101521.6713-2-Wayne.Lin@amd.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/gpu/drm/drm_dp_mst_topology.c |   13 +++++++++----
 1 file changed, 9 insertions(+), 4 deletions(-)

--- a/drivers/gpu/drm/drm_dp_mst_topology.c
+++ b/drivers/gpu/drm/drm_dp_mst_topology.c
@@ -2829,10 +2829,15 @@ static int set_hdr_from_dst_qlock(struct
 	else
 		hdr->broadcast = 0;
 	hdr->path_msg = txmsg->path_msg;
-	hdr->lct = mstb->lct;
-	hdr->lcr = mstb->lct - 1;
-	if (mstb->lct > 1)
-		memcpy(hdr->rad, mstb->rad, mstb->lct / 2);
+	if (hdr->broadcast) {
+		hdr->lct = 1;
+		hdr->lcr = 6;
+	} else {
+		hdr->lct = mstb->lct;
+		hdr->lcr = mstb->lct - 1;
+	}
+
+	memcpy(hdr->rad, mstb->rad, hdr->lct / 2);
 
 	return 0;
 }



^ permalink raw reply	[flat|nested] 702+ messages in thread

* [PATCH 5.12 077/677] drm/dp_mst: Set CLEAR_PAYLOAD_ID_TABLE as broadcast
  2021-05-12 14:40 [PATCH 5.12 000/677] 5.12.4-rc1 review Greg Kroah-Hartman
                   ` (75 preceding siblings ...)
  2021-05-12 14:42 ` [PATCH 5.12 076/677] drm/dp_mst: Revise broadcast msg lct & lcr Greg Kroah-Hartman
@ 2021-05-12 14:42 ` Greg Kroah-Hartman
  2021-05-12 14:42   ` Greg Kroah-Hartman
                   ` (607 subsequent siblings)
  684 siblings, 0 replies; 702+ messages in thread
From: Greg Kroah-Hartman @ 2021-05-12 14:42 UTC (permalink / raw)
  To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Wayne Lin, Lyude Paul

From: Wayne Lin <Wayne.Lin@amd.com>

commit d919d3d6cdb31d0f9fe06c880f683a24f2838813 upstream.

[Why & How]
According to DP spec, CLEAR_PAYLOAD_ID_TABLE is a path broadcast request
message and current implementation is incorrect. Fix it.

Signed-off-by: Wayne Lin <Wayne.Lin@amd.com>
Cc: stable@vger.kernel.org
Reviewed-by: Lyude Paul <lyude@redhat.com>
Signed-off-by: Lyude Paul <lyude@redhat.com>
Link: https://patchwork.freedesktop.org/patch/msgid/20210224101521.6713-3-Wayne.Lin@amd.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/gpu/drm/drm_dp_mst_topology.c |    4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

--- a/drivers/gpu/drm/drm_dp_mst_topology.c
+++ b/drivers/gpu/drm/drm_dp_mst_topology.c
@@ -1154,6 +1154,7 @@ static void build_clear_payload_id_table
 
 	req.req_type = DP_CLEAR_PAYLOAD_ID_TABLE;
 	drm_dp_encode_sideband_req(&req, msg);
+	msg->path_msg = true;
 }
 
 static int build_enum_path_resources(struct drm_dp_sideband_msg_tx *msg,
@@ -2824,7 +2825,8 @@ static int set_hdr_from_dst_qlock(struct
 
 	req_type = txmsg->msg[0] & 0x7f;
 	if (req_type == DP_CONNECTION_STATUS_NOTIFY ||
-		req_type == DP_RESOURCE_STATUS_NOTIFY)
+		req_type == DP_RESOURCE_STATUS_NOTIFY ||
+		req_type == DP_CLEAR_PAYLOAD_ID_TABLE)
 		hdr->broadcast = 1;
 	else
 		hdr->broadcast = 0;



^ permalink raw reply	[flat|nested] 702+ messages in thread

* [PATCH 5.12 078/677] drm: bridge: fix ANX7625 use of mipi_dsi_() functions
  2021-05-12 14:40 [PATCH 5.12 000/677] 5.12.4-rc1 review Greg Kroah-Hartman
@ 2021-05-12 14:42   ` Greg Kroah-Hartman
  2021-05-12 14:40 ` [PATCH 5.12 002/677] bluetooth: eliminate the potential race condition when removing the HCI controller Greg Kroah-Hartman
                     ` (683 subsequent siblings)
  684 siblings, 0 replies; 702+ messages in thread
From: Greg Kroah-Hartman @ 2021-05-12 14:42 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, kernel test robot, Randy Dunlap,
	Robert Foss, Xin Ji, Sam Ravnborg, dri-devel, Andrzej Hajda,
	Neil Armstrong

From: Randy Dunlap <rdunlap@infradead.org>

commit ed01fca38717169fcb61bd45ad1c3750d9c40d59 upstream.

The Analogix DRM ANX7625 bridge driver uses mips_dsi_() function
interfaces so it should select DRM_MIPI_DSI to prevent build errors.

ERROR: modpost: "mipi_dsi_attach" [drivers/gpu/drm/bridge/analogix/anx7625.ko] undefined!
ERROR: modpost: "mipi_dsi_device_register_full" [drivers/gpu/drm/bridge/analogix/anx7625.ko] undefined!
ERROR: modpost: "of_find_mipi_dsi_host_by_node" [drivers/gpu/drm/bridge/analogix/anx7625.ko] undefined!
ERROR: modpost: "mipi_dsi_device_unregister" [drivers/gpu/drm/bridge/analogix/anx7625.ko] undefined!
ERROR: modpost: "mipi_dsi_detach" [drivers/gpu/drm/bridge/analogix/anx7625.ko] undefined!

Fixes: 8bdfc5dae4e3 ("drm/bridge: anx7625: Add anx7625 MIPI DSI/DPI to DP")
Reported-by: kernel test robot <lkp@intel.com>
Signed-off-by: Randy Dunlap <rdunlap@infradead.org>
Reviewed-by: Robert Foss <robert.foss@linaro.org>
Cc: Xin Ji <xji@analogixsemi.com>
Cc: Sam Ravnborg <sam@ravnborg.org>
Cc: dri-devel@lists.freedesktop.org
Cc: Andrzej Hajda <a.hajda@samsung.com>
Cc: Neil Armstrong <narmstrong@baylibre.com>
Cc: Robert Foss <robert.foss@linaro.org>
Cc: stable@vger.kernel.org
Signed-off-by: Robert Foss <robert.foss@linaro.org>
Link: https://patchwork.freedesktop.org/patch/msgid/20210415183619.1431-1-rdunlap@infradead.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/gpu/drm/bridge/analogix/Kconfig |    1 +
 1 file changed, 1 insertion(+)

--- a/drivers/gpu/drm/bridge/analogix/Kconfig
+++ b/drivers/gpu/drm/bridge/analogix/Kconfig
@@ -30,6 +30,7 @@ config DRM_ANALOGIX_ANX7625
 	tristate "Analogix Anx7625 MIPI to DP interface support"
 	depends on DRM
 	depends on OF
+	select DRM_MIPI_DSI
 	help
 	  ANX7625 is an ultra-low power 4K mobile HD transmitter
 	  designed for portable devices. It converts MIPI/DPI to



^ permalink raw reply	[flat|nested] 702+ messages in thread

* [PATCH 5.12 078/677] drm: bridge: fix ANX7625 use of mipi_dsi_() functions
@ 2021-05-12 14:42   ` Greg Kroah-Hartman
  0 siblings, 0 replies; 702+ messages in thread
From: Greg Kroah-Hartman @ 2021-05-12 14:42 UTC (permalink / raw)
  To: linux-kernel
  Cc: kernel test robot, Neil Armstrong, Greg Kroah-Hartman, dri-devel,
	Randy Dunlap, Robert Foss, Andrzej Hajda, stable, Sam Ravnborg,
	Xin Ji

From: Randy Dunlap <rdunlap@infradead.org>

commit ed01fca38717169fcb61bd45ad1c3750d9c40d59 upstream.

The Analogix DRM ANX7625 bridge driver uses mips_dsi_() function
interfaces so it should select DRM_MIPI_DSI to prevent build errors.

ERROR: modpost: "mipi_dsi_attach" [drivers/gpu/drm/bridge/analogix/anx7625.ko] undefined!
ERROR: modpost: "mipi_dsi_device_register_full" [drivers/gpu/drm/bridge/analogix/anx7625.ko] undefined!
ERROR: modpost: "of_find_mipi_dsi_host_by_node" [drivers/gpu/drm/bridge/analogix/anx7625.ko] undefined!
ERROR: modpost: "mipi_dsi_device_unregister" [drivers/gpu/drm/bridge/analogix/anx7625.ko] undefined!
ERROR: modpost: "mipi_dsi_detach" [drivers/gpu/drm/bridge/analogix/anx7625.ko] undefined!

Fixes: 8bdfc5dae4e3 ("drm/bridge: anx7625: Add anx7625 MIPI DSI/DPI to DP")
Reported-by: kernel test robot <lkp@intel.com>
Signed-off-by: Randy Dunlap <rdunlap@infradead.org>
Reviewed-by: Robert Foss <robert.foss@linaro.org>
Cc: Xin Ji <xji@analogixsemi.com>
Cc: Sam Ravnborg <sam@ravnborg.org>
Cc: dri-devel@lists.freedesktop.org
Cc: Andrzej Hajda <a.hajda@samsung.com>
Cc: Neil Armstrong <narmstrong@baylibre.com>
Cc: Robert Foss <robert.foss@linaro.org>
Cc: stable@vger.kernel.org
Signed-off-by: Robert Foss <robert.foss@linaro.org>
Link: https://patchwork.freedesktop.org/patch/msgid/20210415183619.1431-1-rdunlap@infradead.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/gpu/drm/bridge/analogix/Kconfig |    1 +
 1 file changed, 1 insertion(+)

--- a/drivers/gpu/drm/bridge/analogix/Kconfig
+++ b/drivers/gpu/drm/bridge/analogix/Kconfig
@@ -30,6 +30,7 @@ config DRM_ANALOGIX_ANX7625
 	tristate "Analogix Anx7625 MIPI to DP interface support"
 	depends on DRM
 	depends on OF
+	select DRM_MIPI_DSI
 	help
 	  ANX7625 is an ultra-low power 4K mobile HD transmitter
 	  designed for portable devices. It converts MIPI/DPI to



^ permalink raw reply	[flat|nested] 702+ messages in thread

* [PATCH 5.12 079/677] drm: bridge/panel: Cleanup connector on bridge detach
  2021-05-12 14:40 [PATCH 5.12 000/677] 5.12.4-rc1 review Greg Kroah-Hartman
                   ` (77 preceding siblings ...)
  2021-05-12 14:42   ` Greg Kroah-Hartman
@ 2021-05-12 14:42 ` Greg Kroah-Hartman
  2021-05-12 14:42   ` Greg Kroah-Hartman
                   ` (605 subsequent siblings)
  684 siblings, 0 replies; 702+ messages in thread
From: Greg Kroah-Hartman @ 2021-05-12 14:42 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Andrzej Hajda, Neil Armstrong,
	Laurent Pinchart, Jonas Karlman, Jernej Skrabec, Paul Cercueil,
	Laurent Pinchart

From: Paul Cercueil <paul@crapouillou.net>

commit 4d906839d321c2efbf3fed4bc31ffd9ff55b75c0 upstream.

If we don't call drm_connector_cleanup() manually in
panel_bridge_detach(), the connector will be cleaned up with the other
DRM objects in the call to drm_mode_config_cleanup(). However, since our
drm_connector is devm-allocated, by the time drm_mode_config_cleanup()
will be called, our connector will be long gone. Therefore, the
connector must be cleaned up when the bridge is detached to avoid
use-after-free conditions.

v2: Cleanup connector only if it was created

v3: Add FIXME

v4: (Use connector->dev) directly in if() block

Fixes: 13dfc0540a57 ("drm/bridge: Refactor out the panel wrapper from the lvds-encoder bridge.")
Cc: <stable@vger.kernel.org> # 4.12+
Cc: Andrzej Hajda <a.hajda@samsung.com>
Cc: Neil Armstrong <narmstrong@baylibre.com>
Cc: Laurent Pinchart <Laurent.pinchart@ideasonboard.com>
Cc: Jonas Karlman <jonas@kwiboo.se>
Cc: Jernej Skrabec <jernej.skrabec@siol.net>
Signed-off-by: Paul Cercueil <paul@crapouillou.net>
Reviewed-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
Link: https://patchwork.freedesktop.org/patch/msgid/20210327115742.18986-2-paul@crapouillou.net
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/gpu/drm/bridge/panel.c |   12 ++++++++++++
 1 file changed, 12 insertions(+)

--- a/drivers/gpu/drm/bridge/panel.c
+++ b/drivers/gpu/drm/bridge/panel.c
@@ -87,6 +87,18 @@ static int panel_bridge_attach(struct dr
 
 static void panel_bridge_detach(struct drm_bridge *bridge)
 {
+	struct panel_bridge *panel_bridge = drm_bridge_to_panel_bridge(bridge);
+	struct drm_connector *connector = &panel_bridge->connector;
+
+	/*
+	 * Cleanup the connector if we know it was initialized.
+	 *
+	 * FIXME: This wouldn't be needed if the panel_bridge structure was
+	 * allocated with drmm_kzalloc(). This might be tricky since the
+	 * drm_device pointer can only be retrieved when the bridge is attached.
+	 */
+	if (connector->dev)
+		drm_connector_cleanup(connector);
 }
 
 static void panel_bridge_pre_enable(struct drm_bridge *bridge)



^ permalink raw reply	[flat|nested] 702+ messages in thread

* [PATCH 5.12 080/677] drm/amd/display: Reject non-zero src_y and src_x for video planes
  2021-05-12 14:40 [PATCH 5.12 000/677] 5.12.4-rc1 review Greg Kroah-Hartman
@ 2021-05-12 14:42   ` Greg Kroah-Hartman
  2021-05-12 14:40 ` [PATCH 5.12 002/677] bluetooth: eliminate the potential race condition when removing the HCI controller Greg Kroah-Hartman
                     ` (683 subsequent siblings)
  684 siblings, 0 replies; 702+ messages in thread
From: Greg Kroah-Hartman @ 2021-05-12 14:42 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Harry Wentland, nicholas.kazlauskas,
	amd-gfx, alexander.deucher, Roman.Li, hersenxs.wu, danny.wang,
	Christian König

From: Harry Wentland <harry.wentland@amd.com>

commit d89f6048bdcb6a56abb396c584747d5eeae650db upstream.

[Why]
This hasn't been well tested and leads to complete system hangs on DCN1
based systems, possibly others.

The system hang can be reproduced by gesturing the video on the YouTube
Android app on ChromeOS into full screen.

[How]
Reject atomic commits with non-zero drm_plane_state.src_x or src_y values.

v2:
 - Add code comment describing the reason we're rejecting non-zero
   src_x and src_y
 - Drop gerrit Change-Id
 - Add stable CC
 - Based on amd-staging-drm-next

v3: removed trailing whitespace

Signed-off-by: Harry Wentland <harry.wentland@amd.com>
Cc: stable@vger.kernel.org
Cc: nicholas.kazlauskas@amd.com
Cc: amd-gfx@lists.freedesktop.org
Cc: alexander.deucher@amd.com
Cc: Roman.Li@amd.com
Cc: hersenxs.wu@amd.com
Cc: danny.wang@amd.com
Reviewed-by: Nicholas Kazlauskas <nicholas.kazlauskas@amd.com>
Acked-by: Christian König <christian.koenig@amd.com>
Reviewed-by: Hersen Wu <hersenxs.wu@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Cc: stable@vger.kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c |   17 +++++++++++++++++
 1 file changed, 17 insertions(+)

--- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
+++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
@@ -3850,6 +3850,23 @@ static int fill_dc_scaling_info(const st
 	scaling_info->src_rect.x = state->src_x >> 16;
 	scaling_info->src_rect.y = state->src_y >> 16;
 
+	/*
+	 * For reasons we don't (yet) fully understand a non-zero
+	 * src_y coordinate into an NV12 buffer can cause a
+	 * system hang. To avoid hangs (and maybe be overly cautious)
+	 * let's reject both non-zero src_x and src_y.
+	 *
+	 * We currently know of only one use-case to reproduce a
+	 * scenario with non-zero src_x and src_y for NV12, which
+	 * is to gesture the YouTube Android app into full screen
+	 * on ChromeOS.
+	 */
+	if (state->fb &&
+	    state->fb->format->format == DRM_FORMAT_NV12 &&
+	    (scaling_info->src_rect.x != 0 ||
+	     scaling_info->src_rect.y != 0))
+		return -EINVAL;
+
 	scaling_info->src_rect.width = state->src_w >> 16;
 	if (scaling_info->src_rect.width == 0)
 		return -EINVAL;



^ permalink raw reply	[flat|nested] 702+ messages in thread

* [PATCH 5.12 080/677] drm/amd/display: Reject non-zero src_y and src_x for video planes
@ 2021-05-12 14:42   ` Greg Kroah-Hartman
  0 siblings, 0 replies; 702+ messages in thread
From: Greg Kroah-Hartman @ 2021-05-12 14:42 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, Roman.Li, amd-gfx, Christian König,
	danny.wang, hersenxs.wu, stable, alexander.deucher,
	Harry Wentland, nicholas.kazlauskas

From: Harry Wentland <harry.wentland@amd.com>

commit d89f6048bdcb6a56abb396c584747d5eeae650db upstream.

[Why]
This hasn't been well tested and leads to complete system hangs on DCN1
based systems, possibly others.

The system hang can be reproduced by gesturing the video on the YouTube
Android app on ChromeOS into full screen.

[How]
Reject atomic commits with non-zero drm_plane_state.src_x or src_y values.

v2:
 - Add code comment describing the reason we're rejecting non-zero
   src_x and src_y
 - Drop gerrit Change-Id
 - Add stable CC
 - Based on amd-staging-drm-next

v3: removed trailing whitespace

Signed-off-by: Harry Wentland <harry.wentland@amd.com>
Cc: stable@vger.kernel.org
Cc: nicholas.kazlauskas@amd.com
Cc: amd-gfx@lists.freedesktop.org
Cc: alexander.deucher@amd.com
Cc: Roman.Li@amd.com
Cc: hersenxs.wu@amd.com
Cc: danny.wang@amd.com
Reviewed-by: Nicholas Kazlauskas <nicholas.kazlauskas@amd.com>
Acked-by: Christian König <christian.koenig@amd.com>
Reviewed-by: Hersen Wu <hersenxs.wu@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Cc: stable@vger.kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c |   17 +++++++++++++++++
 1 file changed, 17 insertions(+)

--- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
+++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
@@ -3850,6 +3850,23 @@ static int fill_dc_scaling_info(const st
 	scaling_info->src_rect.x = state->src_x >> 16;
 	scaling_info->src_rect.y = state->src_y >> 16;
 
+	/*
+	 * For reasons we don't (yet) fully understand a non-zero
+	 * src_y coordinate into an NV12 buffer can cause a
+	 * system hang. To avoid hangs (and maybe be overly cautious)
+	 * let's reject both non-zero src_x and src_y.
+	 *
+	 * We currently know of only one use-case to reproduce a
+	 * scenario with non-zero src_x and src_y for NV12, which
+	 * is to gesture the YouTube Android app into full screen
+	 * on ChromeOS.
+	 */
+	if (state->fb &&
+	    state->fb->format->format == DRM_FORMAT_NV12 &&
+	    (scaling_info->src_rect.x != 0 ||
+	     scaling_info->src_rect.y != 0))
+		return -EINVAL;
+
 	scaling_info->src_rect.width = state->src_w >> 16;
 	if (scaling_info->src_rect.width == 0)
 		return -EINVAL;


_______________________________________________
amd-gfx mailing list
amd-gfx@lists.freedesktop.org
https://lists.freedesktop.org/mailman/listinfo/amd-gfx

^ permalink raw reply	[flat|nested] 702+ messages in thread

* [PATCH 5.12 081/677] drm/amdgpu: fix concurrent VM flushes on Vega/Navi v2
  2021-05-12 14:40 [PATCH 5.12 000/677] 5.12.4-rc1 review Greg Kroah-Hartman
                   ` (79 preceding siblings ...)
  2021-05-12 14:42   ` Greg Kroah-Hartman
@ 2021-05-12 14:42 ` Greg Kroah-Hartman
  2021-05-12 14:42 ` [PATCH 5.12 082/677] drm/amdgpu: add new MC firmware for Polaris12 32bit ASIC Greg Kroah-Hartman
                   ` (603 subsequent siblings)
  684 siblings, 0 replies; 702+ messages in thread
From: Greg Kroah-Hartman @ 2021-05-12 14:42 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Christian König, James Zhu,
	Alex Deucher

From: Christian König <christian.koenig@amd.com>

commit 20a5f5a98e1bb3d40acd97e89299e8c2d22784be upstream.

Starting with Vega the hardware supports concurrent flushes
of VMID which can be used to implement per process VMID
allocation.

But concurrent flushes are mutual exclusive with back to
back VMID allocations, fix this to avoid a VMID used in
two ways at the same time.

v2: don't set ring to NULL

Signed-off-by: Christian König <christian.koenig@amd.com>
Reviewed-by: James Zhu <James.Zhu@amd.com>
Tested-by: James Zhu <James.Zhu@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Cc: stable@vger.kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/gpu/drm/amd/amdgpu/amdgpu_ids.c |   19 +++++++++++--------
 drivers/gpu/drm/amd/amdgpu/amdgpu_vm.c  |    6 ++++++
 drivers/gpu/drm/amd/amdgpu/amdgpu_vm.h  |    1 +
 3 files changed, 18 insertions(+), 8 deletions(-)

--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_ids.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_ids.c
@@ -215,7 +215,11 @@ static int amdgpu_vmid_grab_idle(struct
 	/* Check if we have an idle VMID */
 	i = 0;
 	list_for_each_entry((*idle), &id_mgr->ids_lru, list) {
-		fences[i] = amdgpu_sync_peek_fence(&(*idle)->active, ring);
+		/* Don't use per engine and per process VMID at the same time */
+		struct amdgpu_ring *r = adev->vm_manager.concurrent_flush ?
+			NULL : ring;
+
+		fences[i] = amdgpu_sync_peek_fence(&(*idle)->active, r);
 		if (!fences[i])
 			break;
 		++i;
@@ -281,7 +285,7 @@ static int amdgpu_vmid_grab_reserved(str
 	if (updates && (*id)->flushed_updates &&
 	    updates->context == (*id)->flushed_updates->context &&
 	    !dma_fence_is_later(updates, (*id)->flushed_updates))
-	    updates = NULL;
+		updates = NULL;
 
 	if ((*id)->owner != vm->immediate.fence_context ||
 	    job->vm_pd_addr != (*id)->pd_gpu_addr ||
@@ -290,6 +294,10 @@ static int amdgpu_vmid_grab_reserved(str
 	     !dma_fence_is_signaled((*id)->last_flush))) {
 		struct dma_fence *tmp;
 
+		/* Don't use per engine and per process VMID at the same time */
+		if (adev->vm_manager.concurrent_flush)
+			ring = NULL;
+
 		/* to prevent one context starved by another context */
 		(*id)->pd_gpu_addr = 0;
 		tmp = amdgpu_sync_peek_fence(&(*id)->active, ring);
@@ -365,12 +373,7 @@ static int amdgpu_vmid_grab_used(struct
 		if (updates && (!flushed || dma_fence_is_later(updates, flushed)))
 			needs_flush = true;
 
-		/* Concurrent flushes are only possible starting with Vega10 and
-		 * are broken on Navi10 and Navi14.
-		 */
-		if (needs_flush && (adev->asic_type < CHIP_VEGA10 ||
-				    adev->asic_type == CHIP_NAVI10 ||
-				    adev->asic_type == CHIP_NAVI14))
+		if (needs_flush && !adev->vm_manager.concurrent_flush)
 			continue;
 
 		/* Good, we can use this VMID. Remember this submission as
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_vm.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_vm.c
@@ -3147,6 +3147,12 @@ void amdgpu_vm_manager_init(struct amdgp
 {
 	unsigned i;
 
+	/* Concurrent flushes are only possible starting with Vega10 and
+	 * are broken on Navi10 and Navi14.
+	 */
+	adev->vm_manager.concurrent_flush = !(adev->asic_type < CHIP_VEGA10 ||
+					      adev->asic_type == CHIP_NAVI10 ||
+					      adev->asic_type == CHIP_NAVI14);
 	amdgpu_vmid_mgr_init(adev);
 
 	adev->vm_manager.fence_context =
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_vm.h
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_vm.h
@@ -331,6 +331,7 @@ struct amdgpu_vm_manager {
 	/* Handling of VMIDs */
 	struct amdgpu_vmid_mgr			id_mgr[AMDGPU_MAX_VMHUBS];
 	unsigned int				first_kfd_vmid;
+	bool					concurrent_flush;
 
 	/* Handling of VM fences */
 	u64					fence_context;



^ permalink raw reply	[flat|nested] 702+ messages in thread

* [PATCH 5.12 082/677] drm/amdgpu: add new MC firmware for Polaris12 32bit ASIC
  2021-05-12 14:40 [PATCH 5.12 000/677] 5.12.4-rc1 review Greg Kroah-Hartman
                   ` (80 preceding siblings ...)
  2021-05-12 14:42 ` [PATCH 5.12 081/677] drm/amdgpu: fix concurrent VM flushes on Vega/Navi v2 Greg Kroah-Hartman
@ 2021-05-12 14:42 ` Greg Kroah-Hartman
  2021-05-12 14:42 ` [PATCH 5.12 083/677] drm/amdgpu: fix r initial values Greg Kroah-Hartman
                   ` (602 subsequent siblings)
  684 siblings, 0 replies; 702+ messages in thread
From: Greg Kroah-Hartman @ 2021-05-12 14:42 UTC (permalink / raw)
  To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Evan Quan, Alex Deucher

From: Evan Quan <evan.quan@amd.com>

commit c83c4e1912446db697a120eb30126cd80cbf6349 upstream.

Polaris12 32bit ASIC needs a special MC firmware.

Signed-off-by: Evan Quan <evan.quan@amd.com>
Reviewed-by: Alex Deucher <alexander.deucher@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Cc: stable@vger.kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/gpu/drm/amd/amdgpu/gmc_v8_0.c |   13 ++++++++++---
 1 file changed, 10 insertions(+), 3 deletions(-)

--- a/drivers/gpu/drm/amd/amdgpu/gmc_v8_0.c
+++ b/drivers/gpu/drm/amd/amdgpu/gmc_v8_0.c
@@ -59,6 +59,7 @@ MODULE_FIRMWARE("amdgpu/tonga_mc.bin");
 MODULE_FIRMWARE("amdgpu/polaris11_mc.bin");
 MODULE_FIRMWARE("amdgpu/polaris10_mc.bin");
 MODULE_FIRMWARE("amdgpu/polaris12_mc.bin");
+MODULE_FIRMWARE("amdgpu/polaris12_32_mc.bin");
 MODULE_FIRMWARE("amdgpu/polaris11_k_mc.bin");
 MODULE_FIRMWARE("amdgpu/polaris10_k_mc.bin");
 MODULE_FIRMWARE("amdgpu/polaris12_k_mc.bin");
@@ -243,10 +244,16 @@ static int gmc_v8_0_init_microcode(struc
 			chip_name = "polaris10";
 		break;
 	case CHIP_POLARIS12:
-		if (ASICID_IS_P23(adev->pdev->device, adev->pdev->revision))
+		if (ASICID_IS_P23(adev->pdev->device, adev->pdev->revision)) {
 			chip_name = "polaris12_k";
-		else
-			chip_name = "polaris12";
+		} else {
+			WREG32(mmMC_SEQ_IO_DEBUG_INDEX, ixMC_IO_DEBUG_UP_159);
+			/* Polaris12 32bit ASIC needs a special MC firmware */
+			if (RREG32(mmMC_SEQ_IO_DEBUG_DATA) == 0x05b4dc40)
+				chip_name = "polaris12_32";
+			else
+				chip_name = "polaris12";
+		}
 		break;
 	case CHIP_FIJI:
 	case CHIP_CARRIZO:



^ permalink raw reply	[flat|nested] 702+ messages in thread

* [PATCH 5.12 083/677] drm/amdgpu: fix r initial values
  2021-05-12 14:40 [PATCH 5.12 000/677] 5.12.4-rc1 review Greg Kroah-Hartman
                   ` (81 preceding siblings ...)
  2021-05-12 14:42 ` [PATCH 5.12 082/677] drm/amdgpu: add new MC firmware for Polaris12 32bit ASIC Greg Kroah-Hartman
@ 2021-05-12 14:42 ` Greg Kroah-Hartman
  2021-05-12 14:42 ` [PATCH 5.12 084/677] drm/amdgpu: Init GFX10_ADDR_CONFIG for VCN v3 in DPG mode Greg Kroah-Hartman
                   ` (601 subsequent siblings)
  684 siblings, 0 replies; 702+ messages in thread
From: Greg Kroah-Hartman @ 2021-05-12 14:42 UTC (permalink / raw)
  To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Victor Zhao, Alex Deucher

From: Victor Zhao <Victor.Zhao@amd.com>

commit 4b12ee6f426e5e36396501a58f3a1af5b92a7e06 upstream.

Sriov gets suspend of IP block <dce_virtual> failed as return
value was not initialized.

v2: return 0 directly to align original code semantic before this
was broken out into a separate helper function instead of setting
initial values

Signed-off-by: Victor Zhao <Victor.Zhao@amd.com>
Reviewed-by: Alex Deucher <alexander.deucher@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Cc: stable@vger.kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/gpu/drm/amd/amdgpu/amdgpu_display.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_display.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_display.c
@@ -1355,7 +1355,7 @@ int amdgpu_display_suspend_helper(struct
 			}
 		}
 	}
-	return r;
+	return 0;
 }
 
 int amdgpu_display_resume_helper(struct amdgpu_device *adev)



^ permalink raw reply	[flat|nested] 702+ messages in thread

* [PATCH 5.12 084/677] drm/amdgpu: Init GFX10_ADDR_CONFIG for VCN v3 in DPG mode.
  2021-05-12 14:40 [PATCH 5.12 000/677] 5.12.4-rc1 review Greg Kroah-Hartman
                   ` (82 preceding siblings ...)
  2021-05-12 14:42 ` [PATCH 5.12 083/677] drm/amdgpu: fix r initial values Greg Kroah-Hartman
@ 2021-05-12 14:42 ` Greg Kroah-Hartman
  2021-05-12 14:42 ` [PATCH 5.12 085/677] ALSA: hda/realtek: Re-order ALC882 Acer quirk table entries Greg Kroah-Hartman
                   ` (600 subsequent siblings)
  684 siblings, 0 replies; 702+ messages in thread
From: Greg Kroah-Hartman @ 2021-05-12 14:42 UTC (permalink / raw)
  To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Bas Nieuwenhuizen, Alex Deucher

From: Bas Nieuwenhuizen <bas@basnieuwenhuizen.nl>

commit 8bf073ca9235fe38d7b74a0b4e779cfa7cc70fc9 upstream.

Otherwise tiling modes that require the values form this field
(In particular _*_X) would be corrupted upon video decode.

Copied from the VCN v2 code.

Fixes: 99541f392b4d ("drm/amdgpu: add mc resume DPG mode for VCN3.0")
Reviewed-and-Tested by: Leo Liu <leo.liu@amd.com>
Signed-off-by: Bas Nieuwenhuizen <bas@basnieuwenhuizen.nl>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Cc: stable@vger.kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/gpu/drm/amd/amdgpu/vcn_v3_0.c |    4 ++++
 1 file changed, 4 insertions(+)

--- a/drivers/gpu/drm/amd/amdgpu/vcn_v3_0.c
+++ b/drivers/gpu/drm/amd/amdgpu/vcn_v3_0.c
@@ -584,6 +584,10 @@ static void vcn_v3_0_mc_resume_dpg_mode(
 	WREG32_SOC15_DPG_MODE(inst_idx, SOC15_DPG_MODE_OFFSET(
 			VCN, inst_idx, mmUVD_VCPU_NONCACHE_SIZE0),
 			AMDGPU_GPU_PAGE_ALIGN(sizeof(struct amdgpu_fw_shared)), 0, indirect);
+
+	/* VCN global tiling registers */
+	WREG32_SOC15_DPG_MODE(0, SOC15_DPG_MODE_OFFSET(
+		UVD, 0, mmUVD_GFX10_ADDR_CONFIG), adev->gfx.config.gb_addr_config, 0, indirect);
 }
 
 static void vcn_v3_0_disable_static_power_gating(struct amdgpu_device *adev, int inst)



^ permalink raw reply	[flat|nested] 702+ messages in thread

* [PATCH 5.12 085/677] ALSA: hda/realtek: Re-order ALC882 Acer quirk table entries
  2021-05-12 14:40 [PATCH 5.12 000/677] 5.12.4-rc1 review Greg Kroah-Hartman
                   ` (83 preceding siblings ...)
  2021-05-12 14:42 ` [PATCH 5.12 084/677] drm/amdgpu: Init GFX10_ADDR_CONFIG for VCN v3 in DPG mode Greg Kroah-Hartman
@ 2021-05-12 14:42 ` Greg Kroah-Hartman
  2021-05-12 14:42 ` [PATCH 5.12 086/677] ALSA: hda/realtek: Re-order ALC882 Sony " Greg Kroah-Hartman
                   ` (599 subsequent siblings)
  684 siblings, 0 replies; 702+ messages in thread
From: Greg Kroah-Hartman @ 2021-05-12 14:42 UTC (permalink / raw)
  To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Takashi Iwai

From: Takashi Iwai <tiwai@suse.de>

commit b265047ac56bad8c4f3d0c8bf9cb4e828ee0d28e upstream.

Just re-order the alc882_fixup_tbl[] entries for Acer devices for
avoiding the oversight of the duplicated or unapplied item in future.
No functional changes.

Also Cc-to-stable for the further patch applications.

Cc: <stable@vger.kernel.org>
Link: https://lore.kernel.org/r/20210428112704.23967-2-tiwai@suse.de
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 sound/pci/hda/patch_realtek.c |    6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

--- a/sound/pci/hda/patch_realtek.c
+++ b/sound/pci/hda/patch_realtek.c
@@ -2470,13 +2470,13 @@ static const struct snd_pci_quirk alc882
 		      ALC882_FIXUP_ACER_ASPIRE_8930G),
 	SND_PCI_QUIRK(0x1025, 0x0146, "Acer Aspire 6935G",
 		      ALC882_FIXUP_ACER_ASPIRE_8930G),
+	SND_PCI_QUIRK(0x1025, 0x0142, "Acer Aspire 7730G",
+		      ALC882_FIXUP_ACER_ASPIRE_4930G),
+	SND_PCI_QUIRK(0x1025, 0x0155, "Packard-Bell M5120", ALC882_FIXUP_PB_M5210),
 	SND_PCI_QUIRK(0x1025, 0x015e, "Acer Aspire 6930G",
 		      ALC882_FIXUP_ACER_ASPIRE_4930G),
 	SND_PCI_QUIRK(0x1025, 0x0166, "Acer Aspire 6530G",
 		      ALC882_FIXUP_ACER_ASPIRE_4930G),
-	SND_PCI_QUIRK(0x1025, 0x0142, "Acer Aspire 7730G",
-		      ALC882_FIXUP_ACER_ASPIRE_4930G),
-	SND_PCI_QUIRK(0x1025, 0x0155, "Packard-Bell M5120", ALC882_FIXUP_PB_M5210),
 	SND_PCI_QUIRK(0x1025, 0x021e, "Acer Aspire 5739G",
 		      ALC882_FIXUP_ACER_ASPIRE_4930G),
 	SND_PCI_QUIRK(0x1025, 0x0259, "Acer Aspire 5935", ALC889_FIXUP_DAC_ROUTE),



^ permalink raw reply	[flat|nested] 702+ messages in thread

* [PATCH 5.12 086/677] ALSA: hda/realtek: Re-order ALC882 Sony quirk table entries
  2021-05-12 14:40 [PATCH 5.12 000/677] 5.12.4-rc1 review Greg Kroah-Hartman
                   ` (84 preceding siblings ...)
  2021-05-12 14:42 ` [PATCH 5.12 085/677] ALSA: hda/realtek: Re-order ALC882 Acer quirk table entries Greg Kroah-Hartman
@ 2021-05-12 14:42 ` Greg Kroah-Hartman
  2021-05-12 14:42 ` [PATCH 5.12 087/677] ALSA: hda/realtek: Re-order ALC882 Clevo " Greg Kroah-Hartman
                   ` (598 subsequent siblings)
  684 siblings, 0 replies; 702+ messages in thread
From: Greg Kroah-Hartman @ 2021-05-12 14:42 UTC (permalink / raw)
  To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Takashi Iwai

From: Takashi Iwai <tiwai@suse.de>

commit b7529c18feecb1af92f9db08c8e7fe446a82d96d upstream.

Just re-order the alc882_fixup_tbl[] entries for Sony devices for
avoiding the oversight of the duplicated or unapplied item in future.
No functional changes.

Also Cc-to-stable for the further patch applications.

Cc: <stable@vger.kernel.org>
Link: https://lore.kernel.org/r/20210428112704.23967-3-tiwai@suse.de
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 sound/pci/hda/patch_realtek.c |    4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

--- a/sound/pci/hda/patch_realtek.c
+++ b/sound/pci/hda/patch_realtek.c
@@ -2489,11 +2489,11 @@ static const struct snd_pci_quirk alc882
 	SND_PCI_QUIRK(0x1043, 0x835f, "Asus Eee 1601", ALC888_FIXUP_EEE1601),
 	SND_PCI_QUIRK(0x1043, 0x84bc, "ASUS ET2700", ALC887_FIXUP_ASUS_BASS),
 	SND_PCI_QUIRK(0x1043, 0x8691, "ASUS ROG Ranger VIII", ALC882_FIXUP_GPIO3),
+	SND_PCI_QUIRK(0x104d, 0x9043, "Sony Vaio VGC-LN51JGB", ALC882_FIXUP_NO_PRIMARY_HP),
+	SND_PCI_QUIRK(0x104d, 0x9044, "Sony VAIO AiO", ALC882_FIXUP_NO_PRIMARY_HP),
 	SND_PCI_QUIRK(0x104d, 0x9047, "Sony Vaio TT", ALC889_FIXUP_VAIO_TT),
 	SND_PCI_QUIRK(0x104d, 0x905a, "Sony Vaio Z", ALC882_FIXUP_NO_PRIMARY_HP),
 	SND_PCI_QUIRK(0x104d, 0x9060, "Sony Vaio VPCL14M1R", ALC882_FIXUP_NO_PRIMARY_HP),
-	SND_PCI_QUIRK(0x104d, 0x9043, "Sony Vaio VGC-LN51JGB", ALC882_FIXUP_NO_PRIMARY_HP),
-	SND_PCI_QUIRK(0x104d, 0x9044, "Sony VAIO AiO", ALC882_FIXUP_NO_PRIMARY_HP),
 
 	/* All Apple entries are in codec SSIDs */
 	SND_PCI_QUIRK(0x106b, 0x00a0, "MacBookPro 3,1", ALC889_FIXUP_MBP_VREF),



^ permalink raw reply	[flat|nested] 702+ messages in thread

* [PATCH 5.12 087/677] ALSA: hda/realtek: Re-order ALC882 Clevo quirk table entries
  2021-05-12 14:40 [PATCH 5.12 000/677] 5.12.4-rc1 review Greg Kroah-Hartman
                   ` (85 preceding siblings ...)
  2021-05-12 14:42 ` [PATCH 5.12 086/677] ALSA: hda/realtek: Re-order ALC882 Sony " Greg Kroah-Hartman
@ 2021-05-12 14:42 ` Greg Kroah-Hartman
  2021-05-12 14:42 ` [PATCH 5.12 088/677] ALSA: hda/realtek: Re-order ALC269 HP " Greg Kroah-Hartman
                   ` (597 subsequent siblings)
  684 siblings, 0 replies; 702+ messages in thread
From: Greg Kroah-Hartman @ 2021-05-12 14:42 UTC (permalink / raw)
  To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Takashi Iwai

From: Takashi Iwai <tiwai@suse.de>

commit 13e1a4cd490b959a4c72c9f4fb502ef56b190062 upstream.

Just re-order the alc882_fixup_tbl[] entries for Clevo devices for
avoiding the oversight of the duplicated or unapplied item in future.
No functional changes.

Also, user lower hex letters in the entry.

Also Cc-to-stable for the further patch applications.

Cc: <stable@vger.kernel.org>
Link: https://lore.kernel.org/r/20210428112704.23967-4-tiwai@suse.de
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 sound/pci/hda/patch_realtek.c |   22 +++++++++++-----------
 1 file changed, 11 insertions(+), 11 deletions(-)

--- a/sound/pci/hda/patch_realtek.c
+++ b/sound/pci/hda/patch_realtek.c
@@ -2536,9 +2536,19 @@ static const struct snd_pci_quirk alc882
 	SND_PCI_QUIRK(0x1462, 0xda57, "MSI Z270-Gaming", ALC1220_FIXUP_GB_DUAL_CODECS),
 	SND_PCI_QUIRK_VENDOR(0x1462, "MSI", ALC882_FIXUP_GPIO3),
 	SND_PCI_QUIRK(0x147b, 0x107a, "Abit AW9D-MAX", ALC882_FIXUP_ABIT_AW9D_MAX),
+	SND_PCI_QUIRK(0x1558, 0x50d3, "Clevo PC50[ER][CDF]", ALC1220_FIXUP_CLEVO_PB51ED_PINS),
+	SND_PCI_QUIRK(0x1558, 0x65d1, "Clevo PB51[ER][CDF]", ALC1220_FIXUP_CLEVO_PB51ED_PINS),
+	SND_PCI_QUIRK(0x1558, 0x65d2, "Clevo PB51R[CDF]", ALC1220_FIXUP_CLEVO_PB51ED_PINS),
+	SND_PCI_QUIRK(0x1558, 0x65e1, "Clevo PB51[ED][DF]", ALC1220_FIXUP_CLEVO_PB51ED_PINS),
+	SND_PCI_QUIRK(0x1558, 0x65e5, "Clevo PC50D[PRS](?:-D|-G)?", ALC1220_FIXUP_CLEVO_PB51ED_PINS),
+	SND_PCI_QUIRK(0x1558, 0x67d1, "Clevo PB71[ER][CDF]", ALC1220_FIXUP_CLEVO_PB51ED_PINS),
+	SND_PCI_QUIRK(0x1558, 0x67e1, "Clevo PB71[DE][CDF]", ALC1220_FIXUP_CLEVO_PB51ED_PINS),
+	SND_PCI_QUIRK(0x1558, 0x67e5, "Clevo PC70D[PRS](?:-D|-G)?", ALC1220_FIXUP_CLEVO_PB51ED_PINS),
+	SND_PCI_QUIRK(0x1558, 0x70d1, "Clevo PC70[ER][CDF]", ALC1220_FIXUP_CLEVO_PB51ED_PINS),
+	SND_PCI_QUIRK(0x1558, 0x7714, "Clevo X170", ALC1220_FIXUP_CLEVO_PB51ED_PINS),
 	SND_PCI_QUIRK(0x1558, 0x9501, "Clevo P950HR", ALC1220_FIXUP_CLEVO_P950),
 	SND_PCI_QUIRK(0x1558, 0x9506, "Clevo P955HQ", ALC1220_FIXUP_CLEVO_P950),
-	SND_PCI_QUIRK(0x1558, 0x950A, "Clevo P955H[PR]", ALC1220_FIXUP_CLEVO_P950),
+	SND_PCI_QUIRK(0x1558, 0x950a, "Clevo P955H[PR]", ALC1220_FIXUP_CLEVO_P950),
 	SND_PCI_QUIRK(0x1558, 0x95e1, "Clevo P95xER", ALC1220_FIXUP_CLEVO_P950),
 	SND_PCI_QUIRK(0x1558, 0x95e2, "Clevo P950ER", ALC1220_FIXUP_CLEVO_P950),
 	SND_PCI_QUIRK(0x1558, 0x95e3, "Clevo P955[ER]T", ALC1220_FIXUP_CLEVO_P950),
@@ -2548,16 +2558,6 @@ static const struct snd_pci_quirk alc882
 	SND_PCI_QUIRK(0x1558, 0x96e1, "Clevo P960[ER][CDFN]-K", ALC1220_FIXUP_CLEVO_P950),
 	SND_PCI_QUIRK(0x1558, 0x97e1, "Clevo P970[ER][CDFN]", ALC1220_FIXUP_CLEVO_P950),
 	SND_PCI_QUIRK(0x1558, 0x97e2, "Clevo P970RC-M", ALC1220_FIXUP_CLEVO_P950),
-	SND_PCI_QUIRK(0x1558, 0x50d3, "Clevo PC50[ER][CDF]", ALC1220_FIXUP_CLEVO_PB51ED_PINS),
-	SND_PCI_QUIRK(0x1558, 0x65d1, "Clevo PB51[ER][CDF]", ALC1220_FIXUP_CLEVO_PB51ED_PINS),
-	SND_PCI_QUIRK(0x1558, 0x65d2, "Clevo PB51R[CDF]", ALC1220_FIXUP_CLEVO_PB51ED_PINS),
-	SND_PCI_QUIRK(0x1558, 0x65e1, "Clevo PB51[ED][DF]", ALC1220_FIXUP_CLEVO_PB51ED_PINS),
-	SND_PCI_QUIRK(0x1558, 0x65e5, "Clevo PC50D[PRS](?:-D|-G)?", ALC1220_FIXUP_CLEVO_PB51ED_PINS),
-	SND_PCI_QUIRK(0x1558, 0x67d1, "Clevo PB71[ER][CDF]", ALC1220_FIXUP_CLEVO_PB51ED_PINS),
-	SND_PCI_QUIRK(0x1558, 0x67e1, "Clevo PB71[DE][CDF]", ALC1220_FIXUP_CLEVO_PB51ED_PINS),
-	SND_PCI_QUIRK(0x1558, 0x67e5, "Clevo PC70D[PRS](?:-D|-G)?", ALC1220_FIXUP_CLEVO_PB51ED_PINS),
-	SND_PCI_QUIRK(0x1558, 0x70d1, "Clevo PC70[ER][CDF]", ALC1220_FIXUP_CLEVO_PB51ED_PINS),
-	SND_PCI_QUIRK(0x1558, 0x7714, "Clevo X170", ALC1220_FIXUP_CLEVO_PB51ED_PINS),
 	SND_PCI_QUIRK_VENDOR(0x1558, "Clevo laptop", ALC882_FIXUP_EAPD),
 	SND_PCI_QUIRK(0x161f, 0x2054, "Medion laptop", ALC883_FIXUP_EAPD),
 	SND_PCI_QUIRK(0x17aa, 0x3a0d, "Lenovo Y530", ALC882_FIXUP_LENOVO_Y530),



^ permalink raw reply	[flat|nested] 702+ messages in thread

* [PATCH 5.12 088/677] ALSA: hda/realtek: Re-order ALC269 HP quirk table entries
  2021-05-12 14:40 [PATCH 5.12 000/677] 5.12.4-rc1 review Greg Kroah-Hartman
                   ` (86 preceding siblings ...)
  2021-05-12 14:42 ` [PATCH 5.12 087/677] ALSA: hda/realtek: Re-order ALC882 Clevo " Greg Kroah-Hartman
@ 2021-05-12 14:42 ` Greg Kroah-Hartman
  2021-05-12 14:42 ` [PATCH 5.12 089/677] ALSA: hda/realtek: Re-order ALC269 Acer " Greg Kroah-Hartman
                   ` (596 subsequent siblings)
  684 siblings, 0 replies; 702+ messages in thread
From: Greg Kroah-Hartman @ 2021-05-12 14:42 UTC (permalink / raw)
  To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Takashi Iwai

From: Takashi Iwai <tiwai@suse.de>

commit 45461e3b554c75ddff9703539f3711cc3dfb0422 upstream.

Just re-order the alc269_fixup_tbl[] entries for HP devices for
avoiding the oversight of the duplicated or unapplied item in future.
No functional changes.

Formerly, some entries were grouped for the actual codec, but this
doesn't seem reasonable to keep in that way.  So now we simply keep
the PCI SSID order for the whole.

Also Cc-to-stable for the further patch applications.

Cc: <stable@vger.kernel.org>
Link: https://lore.kernel.org/r/20210428112704.23967-5-tiwai@suse.de
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 sound/pci/hda/patch_realtek.c |   44 ++++++++++++++++++++----------------------
 1 file changed, 21 insertions(+), 23 deletions(-)

--- a/sound/pci/hda/patch_realtek.c
+++ b/sound/pci/hda/patch_realtek.c
@@ -8031,35 +8031,18 @@ static const struct snd_pci_quirk alc269
 	SND_PCI_QUIRK(0x103c, 0x1586, "HP", ALC269_FIXUP_HP_MUTE_LED_MIC2),
 	SND_PCI_QUIRK(0x103c, 0x18e6, "HP", ALC269_FIXUP_HP_GPIO_LED),
 	SND_PCI_QUIRK(0x103c, 0x218b, "HP", ALC269_FIXUP_LIMIT_INT_MIC_BOOST_MUTE_LED),
-	SND_PCI_QUIRK(0x103c, 0x225f, "HP", ALC280_FIXUP_HP_GPIO2_MIC_HOTKEY),
-	/* ALC282 */
 	SND_PCI_QUIRK(0x103c, 0x21f9, "HP", ALC269_FIXUP_HP_MUTE_LED_MIC1),
 	SND_PCI_QUIRK(0x103c, 0x2210, "HP", ALC269_FIXUP_HP_MUTE_LED_MIC1),
 	SND_PCI_QUIRK(0x103c, 0x2214, "HP", ALC269_FIXUP_HP_MUTE_LED_MIC1),
+	SND_PCI_QUIRK(0x103c, 0x221b, "HP", ALC269_FIXUP_HP_GPIO_MIC1_LED),
+	SND_PCI_QUIRK(0x103c, 0x221c, "HP EliteBook 755 G2", ALC280_FIXUP_HP_HEADSET_MIC),
+	SND_PCI_QUIRK(0x103c, 0x2221, "HP", ALC269_FIXUP_HP_GPIO_MIC1_LED),
+	SND_PCI_QUIRK(0x103c, 0x2225, "HP", ALC269_FIXUP_HP_GPIO_MIC1_LED),
 	SND_PCI_QUIRK(0x103c, 0x2236, "HP", ALC269_FIXUP_HP_LINE1_MIC1_LED),
 	SND_PCI_QUIRK(0x103c, 0x2237, "HP", ALC269_FIXUP_HP_LINE1_MIC1_LED),
 	SND_PCI_QUIRK(0x103c, 0x2238, "HP", ALC269_FIXUP_HP_LINE1_MIC1_LED),
 	SND_PCI_QUIRK(0x103c, 0x2239, "HP", ALC269_FIXUP_HP_LINE1_MIC1_LED),
 	SND_PCI_QUIRK(0x103c, 0x224b, "HP", ALC269_FIXUP_HP_LINE1_MIC1_LED),
-	SND_PCI_QUIRK(0x103c, 0x2268, "HP", ALC269_FIXUP_HP_MUTE_LED_MIC1),
-	SND_PCI_QUIRK(0x103c, 0x226a, "HP", ALC269_FIXUP_HP_MUTE_LED_MIC1),
-	SND_PCI_QUIRK(0x103c, 0x226b, "HP", ALC269_FIXUP_HP_MUTE_LED_MIC1),
-	SND_PCI_QUIRK(0x103c, 0x226e, "HP", ALC269_FIXUP_HP_MUTE_LED_MIC1),
-	SND_PCI_QUIRK(0x103c, 0x2271, "HP", ALC286_FIXUP_HP_GPIO_LED),
-	SND_PCI_QUIRK(0x103c, 0x2272, "HP", ALC280_FIXUP_HP_DOCK_PINS),
-	SND_PCI_QUIRK(0x103c, 0x2273, "HP", ALC280_FIXUP_HP_DOCK_PINS),
-	SND_PCI_QUIRK(0x103c, 0x229e, "HP", ALC269_FIXUP_HP_MUTE_LED_MIC1),
-	SND_PCI_QUIRK(0x103c, 0x22b2, "HP", ALC269_FIXUP_HP_MUTE_LED_MIC1),
-	SND_PCI_QUIRK(0x103c, 0x22b7, "HP", ALC269_FIXUP_HP_MUTE_LED_MIC1),
-	SND_PCI_QUIRK(0x103c, 0x22bf, "HP", ALC269_FIXUP_HP_MUTE_LED_MIC1),
-	SND_PCI_QUIRK(0x103c, 0x22cf, "HP", ALC269_FIXUP_HP_MUTE_LED_MIC1),
-	SND_PCI_QUIRK(0x103c, 0x22db, "HP", ALC280_FIXUP_HP_9480M),
-	SND_PCI_QUIRK(0x103c, 0x22dc, "HP", ALC269_FIXUP_HP_GPIO_MIC1_LED),
-	SND_PCI_QUIRK(0x103c, 0x22fb, "HP", ALC269_FIXUP_HP_GPIO_MIC1_LED),
-	/* ALC290 */
-	SND_PCI_QUIRK(0x103c, 0x221b, "HP", ALC269_FIXUP_HP_GPIO_MIC1_LED),
-	SND_PCI_QUIRK(0x103c, 0x2221, "HP", ALC269_FIXUP_HP_GPIO_MIC1_LED),
-	SND_PCI_QUIRK(0x103c, 0x2225, "HP", ALC269_FIXUP_HP_GPIO_MIC1_LED),
 	SND_PCI_QUIRK(0x103c, 0x2253, "HP", ALC269_FIXUP_HP_GPIO_MIC1_LED),
 	SND_PCI_QUIRK(0x103c, 0x2254, "HP", ALC269_FIXUP_HP_GPIO_MIC1_LED),
 	SND_PCI_QUIRK(0x103c, 0x2255, "HP", ALC269_FIXUP_HP_GPIO_MIC1_LED),
@@ -8067,26 +8050,41 @@ static const struct snd_pci_quirk alc269
 	SND_PCI_QUIRK(0x103c, 0x2257, "HP", ALC269_FIXUP_HP_GPIO_MIC1_LED),
 	SND_PCI_QUIRK(0x103c, 0x2259, "HP", ALC269_FIXUP_HP_GPIO_MIC1_LED),
 	SND_PCI_QUIRK(0x103c, 0x225a, "HP", ALC269_FIXUP_HP_DOCK_GPIO_MIC1_LED),
+	SND_PCI_QUIRK(0x103c, 0x225f, "HP", ALC280_FIXUP_HP_GPIO2_MIC_HOTKEY),
 	SND_PCI_QUIRK(0x103c, 0x2260, "HP", ALC269_FIXUP_HP_MUTE_LED_MIC1),
 	SND_PCI_QUIRK(0x103c, 0x2263, "HP", ALC269_FIXUP_HP_MUTE_LED_MIC1),
 	SND_PCI_QUIRK(0x103c, 0x2264, "HP", ALC269_FIXUP_HP_MUTE_LED_MIC1),
 	SND_PCI_QUIRK(0x103c, 0x2265, "HP", ALC269_FIXUP_HP_MUTE_LED_MIC1),
+	SND_PCI_QUIRK(0x103c, 0x2268, "HP", ALC269_FIXUP_HP_MUTE_LED_MIC1),
+	SND_PCI_QUIRK(0x103c, 0x226a, "HP", ALC269_FIXUP_HP_MUTE_LED_MIC1),
+	SND_PCI_QUIRK(0x103c, 0x226b, "HP", ALC269_FIXUP_HP_MUTE_LED_MIC1),
+	SND_PCI_QUIRK(0x103c, 0x226e, "HP", ALC269_FIXUP_HP_MUTE_LED_MIC1),
+	SND_PCI_QUIRK(0x103c, 0x2271, "HP", ALC286_FIXUP_HP_GPIO_LED),
 	SND_PCI_QUIRK(0x103c, 0x2272, "HP", ALC269_FIXUP_HP_GPIO_MIC1_LED),
+	SND_PCI_QUIRK(0x103c, 0x2272, "HP", ALC280_FIXUP_HP_DOCK_PINS),
 	SND_PCI_QUIRK(0x103c, 0x2273, "HP", ALC269_FIXUP_HP_GPIO_MIC1_LED),
+	SND_PCI_QUIRK(0x103c, 0x2273, "HP", ALC280_FIXUP_HP_DOCK_PINS),
 	SND_PCI_QUIRK(0x103c, 0x2278, "HP", ALC269_FIXUP_HP_GPIO_MIC1_LED),
 	SND_PCI_QUIRK(0x103c, 0x227f, "HP", ALC269_FIXUP_HP_MUTE_LED_MIC1),
 	SND_PCI_QUIRK(0x103c, 0x2282, "HP", ALC269_FIXUP_HP_MUTE_LED_MIC1),
 	SND_PCI_QUIRK(0x103c, 0x228b, "HP", ALC269_FIXUP_HP_MUTE_LED_MIC1),
 	SND_PCI_QUIRK(0x103c, 0x228e, "HP", ALC269_FIXUP_HP_MUTE_LED_MIC1),
+	SND_PCI_QUIRK(0x103c, 0x229e, "HP", ALC269_FIXUP_HP_MUTE_LED_MIC1),
+	SND_PCI_QUIRK(0x103c, 0x22b2, "HP", ALC269_FIXUP_HP_MUTE_LED_MIC1),
+	SND_PCI_QUIRK(0x103c, 0x22b7, "HP", ALC269_FIXUP_HP_MUTE_LED_MIC1),
+	SND_PCI_QUIRK(0x103c, 0x22bf, "HP", ALC269_FIXUP_HP_MUTE_LED_MIC1),
+	SND_PCI_QUIRK(0x103c, 0x22c4, "HP", ALC269_FIXUP_HP_MUTE_LED_MIC1),
 	SND_PCI_QUIRK(0x103c, 0x22c5, "HP", ALC269_FIXUP_HP_MUTE_LED_MIC1),
 	SND_PCI_QUIRK(0x103c, 0x22c7, "HP", ALC269_FIXUP_HP_MUTE_LED_MIC1),
 	SND_PCI_QUIRK(0x103c, 0x22c8, "HP", ALC269_FIXUP_HP_MUTE_LED_MIC1),
-	SND_PCI_QUIRK(0x103c, 0x22c4, "HP", ALC269_FIXUP_HP_MUTE_LED_MIC1),
+	SND_PCI_QUIRK(0x103c, 0x22cf, "HP", ALC269_FIXUP_HP_MUTE_LED_MIC1),
+	SND_PCI_QUIRK(0x103c, 0x22db, "HP", ALC280_FIXUP_HP_9480M),
+	SND_PCI_QUIRK(0x103c, 0x22dc, "HP", ALC269_FIXUP_HP_GPIO_MIC1_LED),
+	SND_PCI_QUIRK(0x103c, 0x22fb, "HP", ALC269_FIXUP_HP_GPIO_MIC1_LED),
 	SND_PCI_QUIRK(0x103c, 0x2334, "HP", ALC269_FIXUP_HP_MUTE_LED_MIC1),
 	SND_PCI_QUIRK(0x103c, 0x2335, "HP", ALC269_FIXUP_HP_MUTE_LED_MIC1),
 	SND_PCI_QUIRK(0x103c, 0x2336, "HP", ALC269_FIXUP_HP_MUTE_LED_MIC1),
 	SND_PCI_QUIRK(0x103c, 0x2337, "HP", ALC269_FIXUP_HP_MUTE_LED_MIC1),
-	SND_PCI_QUIRK(0x103c, 0x221c, "HP EliteBook 755 G2", ALC280_FIXUP_HP_HEADSET_MIC),
 	SND_PCI_QUIRK(0x103c, 0x802e, "HP Z240 SFF", ALC221_FIXUP_HP_MIC_NO_PRESENCE),
 	SND_PCI_QUIRK(0x103c, 0x802f, "HP Z240", ALC221_FIXUP_HP_MIC_NO_PRESENCE),
 	SND_PCI_QUIRK(0x103c, 0x8077, "HP", ALC256_FIXUP_HP_HEADSET_MIC),



^ permalink raw reply	[flat|nested] 702+ messages in thread

* [PATCH 5.12 089/677] ALSA: hda/realtek: Re-order ALC269 Acer quirk table entries
  2021-05-12 14:40 [PATCH 5.12 000/677] 5.12.4-rc1 review Greg Kroah-Hartman
                   ` (87 preceding siblings ...)
  2021-05-12 14:42 ` [PATCH 5.12 088/677] ALSA: hda/realtek: Re-order ALC269 HP " Greg Kroah-Hartman
@ 2021-05-12 14:42 ` Greg Kroah-Hartman
  2021-05-12 14:42 ` [PATCH 5.12 090/677] ALSA: hda/realtek: Re-order ALC269 Dell " Greg Kroah-Hartman
                   ` (595 subsequent siblings)
  684 siblings, 0 replies; 702+ messages in thread
From: Greg Kroah-Hartman @ 2021-05-12 14:42 UTC (permalink / raw)
  To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Takashi Iwai

From: Takashi Iwai <tiwai@suse.de>

commit 433f894ec7fbd3b4bf1f3187b2ddd566078c4aef upstream.

Just re-order the alc269_fixup_tbl[] entries for Acer devices for
avoiding the oversight of the duplicated or unapplied item in future.
No functional changes.

Also Cc-to-stable for the further patch applications.

Cc: <stable@vger.kernel.org>
Link: https://lore.kernel.org/r/20210428112704.23967-6-tiwai@suse.de
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 sound/pci/hda/patch_realtek.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

--- a/sound/pci/hda/patch_realtek.c
+++ b/sound/pci/hda/patch_realtek.c
@@ -7947,12 +7947,12 @@ static const struct snd_pci_quirk alc269
 	SND_PCI_QUIRK(0x1025, 0x0349, "Acer AOD260", ALC269_FIXUP_INV_DMIC),
 	SND_PCI_QUIRK(0x1025, 0x047c, "Acer AC700", ALC269_FIXUP_ACER_AC700),
 	SND_PCI_QUIRK(0x1025, 0x072d, "Acer Aspire V5-571G", ALC269_FIXUP_ASPIRE_HEADSET_MIC),
-	SND_PCI_QUIRK(0x1025, 0x080d, "Acer Aspire V5-122P", ALC269_FIXUP_ASPIRE_HEADSET_MIC),
 	SND_PCI_QUIRK(0x1025, 0x0740, "Acer AO725", ALC271_FIXUP_HP_GATE_MIC_JACK),
 	SND_PCI_QUIRK(0x1025, 0x0742, "Acer AO756", ALC271_FIXUP_HP_GATE_MIC_JACK),
 	SND_PCI_QUIRK(0x1025, 0x0762, "Acer Aspire E1-472", ALC271_FIXUP_HP_GATE_MIC_JACK_E1_572),
 	SND_PCI_QUIRK(0x1025, 0x0775, "Acer Aspire E1-572", ALC271_FIXUP_HP_GATE_MIC_JACK_E1_572),
 	SND_PCI_QUIRK(0x1025, 0x079b, "Acer Aspire V5-573G", ALC282_FIXUP_ASPIRE_V5_PINS),
+	SND_PCI_QUIRK(0x1025, 0x080d, "Acer Aspire V5-122P", ALC269_FIXUP_ASPIRE_HEADSET_MIC),
 	SND_PCI_QUIRK(0x1025, 0x0840, "Acer Aspire E1", ALC269VB_FIXUP_ASPIRE_E1_COEF),
 	SND_PCI_QUIRK(0x1025, 0x101c, "Acer Veriton N2510G", ALC269_FIXUP_LIFEBOOK),
 	SND_PCI_QUIRK(0x1025, 0x102b, "Acer Aspire C24-860", ALC286_FIXUP_ACER_AIO_MIC_NO_PRESENCE),



^ permalink raw reply	[flat|nested] 702+ messages in thread

* [PATCH 5.12 090/677] ALSA: hda/realtek: Re-order ALC269 Dell quirk table entries
  2021-05-12 14:40 [PATCH 5.12 000/677] 5.12.4-rc1 review Greg Kroah-Hartman
                   ` (88 preceding siblings ...)
  2021-05-12 14:42 ` [PATCH 5.12 089/677] ALSA: hda/realtek: Re-order ALC269 Acer " Greg Kroah-Hartman
@ 2021-05-12 14:42 ` Greg Kroah-Hartman
  2021-05-12 14:42 ` [PATCH 5.12 091/677] ALSA: hda/realtek: Re-order ALC269 ASUS " Greg Kroah-Hartman
                   ` (594 subsequent siblings)
  684 siblings, 0 replies; 702+ messages in thread
From: Greg Kroah-Hartman @ 2021-05-12 14:42 UTC (permalink / raw)
  To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Takashi Iwai

From: Takashi Iwai <tiwai@suse.de>

commit aa143ad39a52d968ac69e426d329bb74f270e6ca upstream.

Just re-order the alc269_fixup_tbl[] entries for Dell devices for
avoiding the oversight of the duplicated or unapplied item in future.
No functional changes.

Also Cc-to-stable for the further patch applications.

Cc: <stable@vger.kernel.org>
Link: https://lore.kernel.org/r/20210428112704.23967-7-tiwai@suse.de
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 sound/pci/hda/patch_realtek.c |    4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

--- a/sound/pci/hda/patch_realtek.c
+++ b/sound/pci/hda/patch_realtek.c
@@ -8008,8 +8008,8 @@ static const struct snd_pci_quirk alc269
 	SND_PCI_QUIRK(0x1028, 0x0738, "Dell Precision 5820", ALC269_FIXUP_NO_SHUTUP),
 	SND_PCI_QUIRK(0x1028, 0x075c, "Dell XPS 27 7760", ALC298_FIXUP_SPK_VOLUME),
 	SND_PCI_QUIRK(0x1028, 0x075d, "Dell AIO", ALC298_FIXUP_SPK_VOLUME),
-	SND_PCI_QUIRK(0x1028, 0x07b0, "Dell Precision 7520", ALC295_FIXUP_DISABLE_DAC3),
 	SND_PCI_QUIRK(0x1028, 0x0798, "Dell Inspiron 17 7000 Gaming", ALC256_FIXUP_DELL_INSPIRON_7559_SUBWOOFER),
+	SND_PCI_QUIRK(0x1028, 0x07b0, "Dell Precision 7520", ALC295_FIXUP_DISABLE_DAC3),
 	SND_PCI_QUIRK(0x1028, 0x080c, "Dell WYSE", ALC225_FIXUP_DELL_WYSE_MIC_NO_PRESENCE),
 	SND_PCI_QUIRK(0x1028, 0x084b, "Dell", ALC274_FIXUP_DELL_AIO_LINEOUT_VERB),
 	SND_PCI_QUIRK(0x1028, 0x084e, "Dell", ALC274_FIXUP_DELL_AIO_LINEOUT_VERB),
@@ -8019,8 +8019,8 @@ static const struct snd_pci_quirk alc269
 	SND_PCI_QUIRK(0x1028, 0x08ad, "Dell WYSE AIO", ALC225_FIXUP_DELL_WYSE_AIO_MIC_NO_PRESENCE),
 	SND_PCI_QUIRK(0x1028, 0x08ae, "Dell WYSE NB", ALC225_FIXUP_DELL1_MIC_NO_PRESENCE),
 	SND_PCI_QUIRK(0x1028, 0x0935, "Dell", ALC274_FIXUP_DELL_AIO_LINEOUT_VERB),
-	SND_PCI_QUIRK(0x1028, 0x097e, "Dell Precision", ALC289_FIXUP_DUAL_SPK),
 	SND_PCI_QUIRK(0x1028, 0x097d, "Dell Precision", ALC289_FIXUP_DUAL_SPK),
+	SND_PCI_QUIRK(0x1028, 0x097e, "Dell Precision", ALC289_FIXUP_DUAL_SPK),
 	SND_PCI_QUIRK(0x1028, 0x098d, "Dell Precision", ALC233_FIXUP_ASUS_MIC_NO_PRESENCE),
 	SND_PCI_QUIRK(0x1028, 0x09bf, "Dell Precision", ALC233_FIXUP_ASUS_MIC_NO_PRESENCE),
 	SND_PCI_QUIRK(0x1028, 0x0a2e, "Dell", ALC236_FIXUP_DELL_AIO_HEADSET_MIC),



^ permalink raw reply	[flat|nested] 702+ messages in thread

* [PATCH 5.12 091/677] ALSA: hda/realtek: Re-order ALC269 ASUS quirk table entries
  2021-05-12 14:40 [PATCH 5.12 000/677] 5.12.4-rc1 review Greg Kroah-Hartman
                   ` (89 preceding siblings ...)
  2021-05-12 14:42 ` [PATCH 5.12 090/677] ALSA: hda/realtek: Re-order ALC269 Dell " Greg Kroah-Hartman
@ 2021-05-12 14:42 ` Greg Kroah-Hartman
  2021-05-12 14:42 ` [PATCH 5.12 092/677] ALSA: hda/realtek: Re-order ALC269 Sony " Greg Kroah-Hartman
                   ` (593 subsequent siblings)
  684 siblings, 0 replies; 702+ messages in thread
From: Greg Kroah-Hartman @ 2021-05-12 14:42 UTC (permalink / raw)
  To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Takashi Iwai

From: Takashi Iwai <tiwai@suse.de>

commit 3cd0ed636dd19e7fbe3ebe8de8476e1718d5a8f1 upstream.

Just re-order the alc269_fixup_tbl[] entries for ASUS devices for
avoiding the oversight of the duplicated or unapplied item in future.
No functional changes.

Also Cc-to-stable for the further patch applications.

Cc: <stable@vger.kernel.org>
Link: https://lore.kernel.org/r/20210428112704.23967-8-tiwai@suse.de
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 sound/pci/hda/patch_realtek.c |    6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

--- a/sound/pci/hda/patch_realtek.c
+++ b/sound/pci/hda/patch_realtek.c
@@ -8126,16 +8126,18 @@ static const struct snd_pci_quirk alc269
 	SND_PCI_QUIRK(0x1043, 0x10d0, "ASUS X540LA/X540LJ", ALC255_FIXUP_ASUS_MIC_NO_PRESENCE),
 	SND_PCI_QUIRK(0x1043, 0x115d, "Asus 1015E", ALC269_FIXUP_LIMIT_INT_MIC_BOOST),
 	SND_PCI_QUIRK(0x1043, 0x11c0, "ASUS X556UR", ALC255_FIXUP_ASUS_MIC_NO_PRESENCE),
+	SND_PCI_QUIRK(0x1043, 0x125e, "ASUS Q524UQK", ALC255_FIXUP_ASUS_MIC_NO_PRESENCE),
 	SND_PCI_QUIRK(0x1043, 0x1271, "ASUS X430UN", ALC256_FIXUP_ASUS_MIC_NO_PRESENCE),
 	SND_PCI_QUIRK(0x1043, 0x1290, "ASUS X441SA", ALC233_FIXUP_EAPD_COEF_AND_MIC_NO_PRESENCE),
 	SND_PCI_QUIRK(0x1043, 0x12a0, "ASUS X441UV", ALC233_FIXUP_EAPD_COEF_AND_MIC_NO_PRESENCE),
-	SND_PCI_QUIRK(0x1043, 0x12f0, "ASUS X541UV", ALC256_FIXUP_ASUS_MIC),
 	SND_PCI_QUIRK(0x1043, 0x12e0, "ASUS X541SA", ALC256_FIXUP_ASUS_MIC),
+	SND_PCI_QUIRK(0x1043, 0x12f0, "ASUS X541UV", ALC256_FIXUP_ASUS_MIC),
 	SND_PCI_QUIRK(0x1043, 0x13b0, "ASUS Z550SA", ALC256_FIXUP_ASUS_MIC),
 	SND_PCI_QUIRK(0x1043, 0x1427, "Asus Zenbook UX31E", ALC269VB_FIXUP_ASUS_ZENBOOK),
 	SND_PCI_QUIRK(0x1043, 0x1517, "Asus Zenbook UX31A", ALC269VB_FIXUP_ASUS_ZENBOOK_UX31A),
 	SND_PCI_QUIRK(0x1043, 0x16e3, "ASUS UX50", ALC269_FIXUP_STEREO_DMIC),
 	SND_PCI_QUIRK(0x1043, 0x17d1, "ASUS UX431FL", ALC294_FIXUP_ASUS_DUAL_SPK),
+	SND_PCI_QUIRK(0x1043, 0x1881, "ASUS Zephyrus S/M", ALC294_FIXUP_ASUS_GX502_PINS),
 	SND_PCI_QUIRK(0x1043, 0x18b1, "Asus MJ401TA", ALC256_FIXUP_ASUS_HEADSET_MIC),
 	SND_PCI_QUIRK(0x1043, 0x18f1, "Asus FX505DT", ALC256_FIXUP_ASUS_HEADSET_MIC),
 	SND_PCI_QUIRK(0x1043, 0x194e, "ASUS UX563FD", ALC294_FIXUP_ASUS_HPE),
@@ -8148,13 +8150,11 @@ static const struct snd_pci_quirk alc269
 	SND_PCI_QUIRK(0x1043, 0x1b13, "Asus U41SV", ALC269_FIXUP_INV_DMIC),
 	SND_PCI_QUIRK(0x1043, 0x1bbd, "ASUS Z550MA", ALC255_FIXUP_ASUS_MIC_NO_PRESENCE),
 	SND_PCI_QUIRK(0x1043, 0x1c23, "Asus X55U", ALC269_FIXUP_LIMIT_INT_MIC_BOOST),
-	SND_PCI_QUIRK(0x1043, 0x125e, "ASUS Q524UQK", ALC255_FIXUP_ASUS_MIC_NO_PRESENCE),
 	SND_PCI_QUIRK(0x1043, 0x1ccd, "ASUS X555UB", ALC256_FIXUP_ASUS_MIC),
 	SND_PCI_QUIRK(0x1043, 0x1d4e, "ASUS TM420", ALC256_FIXUP_ASUS_HPE),
 	SND_PCI_QUIRK(0x1043, 0x1e11, "ASUS Zephyrus G15", ALC289_FIXUP_ASUS_GA502),
 	SND_PCI_QUIRK(0x1043, 0x1e8e, "ASUS Zephyrus G15", ALC289_FIXUP_ASUS_GA401),
 	SND_PCI_QUIRK(0x1043, 0x1f11, "ASUS Zephyrus G14", ALC289_FIXUP_ASUS_GA401),
-	SND_PCI_QUIRK(0x1043, 0x1881, "ASUS Zephyrus S/M", ALC294_FIXUP_ASUS_GX502_PINS),
 	SND_PCI_QUIRK(0x1043, 0x3030, "ASUS ZN270IE", ALC256_FIXUP_ASUS_AIO_GPIO2),
 	SND_PCI_QUIRK(0x1043, 0x831a, "ASUS P901", ALC269_FIXUP_STEREO_DMIC),
 	SND_PCI_QUIRK(0x1043, 0x834a, "ASUS S101", ALC269_FIXUP_STEREO_DMIC),



^ permalink raw reply	[flat|nested] 702+ messages in thread

* [PATCH 5.12 092/677] ALSA: hda/realtek: Re-order ALC269 Sony quirk table entries
  2021-05-12 14:40 [PATCH 5.12 000/677] 5.12.4-rc1 review Greg Kroah-Hartman
                   ` (90 preceding siblings ...)
  2021-05-12 14:42 ` [PATCH 5.12 091/677] ALSA: hda/realtek: Re-order ALC269 ASUS " Greg Kroah-Hartman
@ 2021-05-12 14:42 ` Greg Kroah-Hartman
  2021-05-12 14:42 ` [PATCH 5.12 093/677] ALSA: hda/realtek: Re-order ALC269 Lenovo " Greg Kroah-Hartman
                   ` (592 subsequent siblings)
  684 siblings, 0 replies; 702+ messages in thread
From: Greg Kroah-Hartman @ 2021-05-12 14:42 UTC (permalink / raw)
  To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Takashi Iwai

From: Takashi Iwai <tiwai@suse.de>

commit cab561f8d4bc9b196ae20c960aa5da89fd786ab5 upstream.

Just re-order the alc269_fixup_tbl[] entries for Sony devices for
avoiding the oversight of the duplicated or unapplied item in future.
No functional changes.

Also Cc-to-stable for the further patch applications.

Cc: <stable@vger.kernel.org>
Link: https://lore.kernel.org/r/20210428112704.23967-9-tiwai@suse.de
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 sound/pci/hda/patch_realtek.c |    4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

--- a/sound/pci/hda/patch_realtek.c
+++ b/sound/pci/hda/patch_realtek.c
@@ -8161,12 +8161,12 @@ static const struct snd_pci_quirk alc269
 	SND_PCI_QUIRK(0x1043, 0x8398, "ASUS P1005", ALC269_FIXUP_STEREO_DMIC),
 	SND_PCI_QUIRK(0x1043, 0x83ce, "ASUS P1005", ALC269_FIXUP_STEREO_DMIC),
 	SND_PCI_QUIRK(0x1043, 0x8516, "ASUS X101CH", ALC269_FIXUP_ASUS_X101),
-	SND_PCI_QUIRK(0x104d, 0x90b5, "Sony VAIO Pro 11", ALC286_FIXUP_SONY_MIC_NO_PRESENCE),
-	SND_PCI_QUIRK(0x104d, 0x90b6, "Sony VAIO Pro 13", ALC286_FIXUP_SONY_MIC_NO_PRESENCE),
 	SND_PCI_QUIRK(0x104d, 0x9073, "Sony VAIO", ALC275_FIXUP_SONY_VAIO_GPIO2),
 	SND_PCI_QUIRK(0x104d, 0x907b, "Sony VAIO", ALC275_FIXUP_SONY_HWEQ),
 	SND_PCI_QUIRK(0x104d, 0x9084, "Sony VAIO", ALC275_FIXUP_SONY_HWEQ),
 	SND_PCI_QUIRK(0x104d, 0x9099, "Sony VAIO S13", ALC275_FIXUP_SONY_DISABLE_AAMIX),
+	SND_PCI_QUIRK(0x104d, 0x90b5, "Sony VAIO Pro 11", ALC286_FIXUP_SONY_MIC_NO_PRESENCE),
+	SND_PCI_QUIRK(0x104d, 0x90b6, "Sony VAIO Pro 13", ALC286_FIXUP_SONY_MIC_NO_PRESENCE),
 	SND_PCI_QUIRK(0x10cf, 0x1475, "Lifebook", ALC269_FIXUP_LIFEBOOK),
 	SND_PCI_QUIRK(0x10cf, 0x159f, "Lifebook E780", ALC269_FIXUP_LIFEBOOK_NO_HP_TO_LINEOUT),
 	SND_PCI_QUIRK(0x10cf, 0x15dc, "Lifebook T731", ALC269_FIXUP_LIFEBOOK_HP_PIN),



^ permalink raw reply	[flat|nested] 702+ messages in thread

* [PATCH 5.12 093/677] ALSA: hda/realtek: Re-order ALC269 Lenovo quirk table entries
  2021-05-12 14:40 [PATCH 5.12 000/677] 5.12.4-rc1 review Greg Kroah-Hartman
                   ` (91 preceding siblings ...)
  2021-05-12 14:42 ` [PATCH 5.12 092/677] ALSA: hda/realtek: Re-order ALC269 Sony " Greg Kroah-Hartman
@ 2021-05-12 14:42 ` Greg Kroah-Hartman
  2021-05-12 14:42 ` [PATCH 5.12 094/677] ALSA: hda/realtek: Re-order remaining ALC269 " Greg Kroah-Hartman
                   ` (591 subsequent siblings)
  684 siblings, 0 replies; 702+ messages in thread
From: Greg Kroah-Hartman @ 2021-05-12 14:42 UTC (permalink / raw)
  To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Takashi Iwai

From: Takashi Iwai <tiwai@suse.de>

commit f552ff54c2a700616a02b038e4bf3cbf859f65b7 upstream.

Just re-order the alc269_fixup_tbl[] entries for Lenovo devices for
avoiding the oversight of the duplicated or unapplied item in future.
No functional changes.

Also Cc-to-stable for the further patch applications.

Cc: <stable@vger.kernel.org>
Link: https://lore.kernel.org/r/20210428112704.23967-10-tiwai@suse.de
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 sound/pci/hda/patch_realtek.c |    4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

--- a/sound/pci/hda/patch_realtek.c
+++ b/sound/pci/hda/patch_realtek.c
@@ -8241,9 +8241,9 @@ static const struct snd_pci_quirk alc269
 	SND_PCI_QUIRK(0x17aa, 0x21b8, "Thinkpad Edge 14", ALC269_FIXUP_SKU_IGNORE),
 	SND_PCI_QUIRK(0x17aa, 0x21ca, "Thinkpad L412", ALC269_FIXUP_SKU_IGNORE),
 	SND_PCI_QUIRK(0x17aa, 0x21e9, "Thinkpad Edge 15", ALC269_FIXUP_SKU_IGNORE),
+	SND_PCI_QUIRK(0x17aa, 0x21f3, "Thinkpad T430", ALC269_FIXUP_LENOVO_DOCK),
 	SND_PCI_QUIRK(0x17aa, 0x21f6, "Thinkpad T530", ALC269_FIXUP_LENOVO_DOCK_LIMIT_BOOST),
 	SND_PCI_QUIRK(0x17aa, 0x21fa, "Thinkpad X230", ALC269_FIXUP_LENOVO_DOCK),
-	SND_PCI_QUIRK(0x17aa, 0x21f3, "Thinkpad T430", ALC269_FIXUP_LENOVO_DOCK),
 	SND_PCI_QUIRK(0x17aa, 0x21fb, "Thinkpad T430s", ALC269_FIXUP_LENOVO_DOCK),
 	SND_PCI_QUIRK(0x17aa, 0x2203, "Thinkpad X230 Tablet", ALC269_FIXUP_LENOVO_DOCK),
 	SND_PCI_QUIRK(0x17aa, 0x2208, "Thinkpad T431s", ALC269_FIXUP_LENOVO_DOCK),
@@ -8287,6 +8287,7 @@ static const struct snd_pci_quirk alc269
 	SND_PCI_QUIRK(0x17aa, 0x3902, "Lenovo E50-80", ALC269_FIXUP_DMIC_THINKPAD_ACPI),
 	SND_PCI_QUIRK(0x17aa, 0x3977, "IdeaPad S210", ALC283_FIXUP_INT_MIC),
 	SND_PCI_QUIRK(0x17aa, 0x3978, "Lenovo B50-70", ALC269_FIXUP_DMIC_THINKPAD_ACPI),
+	SND_PCI_QUIRK(0x17aa, 0x3bf8, "Quanta FL1", ALC269_FIXUP_PCM_44K),
 	SND_PCI_QUIRK(0x17aa, 0x5013, "Thinkpad", ALC269_FIXUP_LIMIT_INT_MIC_BOOST),
 	SND_PCI_QUIRK(0x17aa, 0x501a, "Thinkpad", ALC283_FIXUP_INT_MIC),
 	SND_PCI_QUIRK(0x17aa, 0x501e, "Thinkpad L440", ALC292_FIXUP_TPT440_DOCK),
@@ -8305,7 +8306,6 @@ static const struct snd_pci_quirk alc269
 	SND_PCI_QUIRK(0x17aa, 0x5109, "Thinkpad", ALC269_FIXUP_LIMIT_INT_MIC_BOOST),
 	SND_PCI_QUIRK(0x17aa, 0x511e, "Thinkpad", ALC298_FIXUP_TPT470_DOCK),
 	SND_PCI_QUIRK(0x17aa, 0x511f, "Thinkpad", ALC298_FIXUP_TPT470_DOCK),
-	SND_PCI_QUIRK(0x17aa, 0x3bf8, "Quanta FL1", ALC269_FIXUP_PCM_44K),
 	SND_PCI_QUIRK(0x17aa, 0x9e54, "LENOVO NB", ALC269_FIXUP_LENOVO_EAPD),
 	SND_PCI_QUIRK(0x19e5, 0x3204, "Huawei MACH-WX9", ALC256_FIXUP_HUAWEI_MACH_WX9_PINS),
 	SND_PCI_QUIRK(0x1b35, 0x1235, "CZC B20", ALC269_FIXUP_CZC_B20),



^ permalink raw reply	[flat|nested] 702+ messages in thread

* [PATCH 5.12 094/677] ALSA: hda/realtek: Re-order remaining ALC269 quirk table entries
  2021-05-12 14:40 [PATCH 5.12 000/677] 5.12.4-rc1 review Greg Kroah-Hartman
                   ` (92 preceding siblings ...)
  2021-05-12 14:42 ` [PATCH 5.12 093/677] ALSA: hda/realtek: Re-order ALC269 Lenovo " Greg Kroah-Hartman
@ 2021-05-12 14:42 ` Greg Kroah-Hartman
  2021-05-12 14:42 ` [PATCH 5.12 095/677] ALSA: hda/realtek: Re-order ALC662 " Greg Kroah-Hartman
                   ` (590 subsequent siblings)
  684 siblings, 0 replies; 702+ messages in thread
From: Greg Kroah-Hartman @ 2021-05-12 14:42 UTC (permalink / raw)
  To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Takashi Iwai

From: Takashi Iwai <tiwai@suse.de>

commit c656f747df151a0a89756a5312f4ca2116758ba4 upstream.

Just re-order the alc269_fixup_tbl[] entries for FSC, Medion, Samsung
and Lemote devices for avoiding the oversight of the duplicated or
unapplied item in future.
No functional changes.

Also Cc-to-stable for the further patch applications.

Cc: <stable@vger.kernel.org>
Link: https://lore.kernel.org/r/20210428112704.23967-11-tiwai@suse.de
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 sound/pci/hda/patch_realtek.c |   10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

--- a/sound/pci/hda/patch_realtek.c
+++ b/sound/pci/hda/patch_realtek.c
@@ -8170,10 +8170,11 @@ static const struct snd_pci_quirk alc269
 	SND_PCI_QUIRK(0x10cf, 0x1475, "Lifebook", ALC269_FIXUP_LIFEBOOK),
 	SND_PCI_QUIRK(0x10cf, 0x159f, "Lifebook E780", ALC269_FIXUP_LIFEBOOK_NO_HP_TO_LINEOUT),
 	SND_PCI_QUIRK(0x10cf, 0x15dc, "Lifebook T731", ALC269_FIXUP_LIFEBOOK_HP_PIN),
-	SND_PCI_QUIRK(0x10cf, 0x1757, "Lifebook E752", ALC269_FIXUP_LIFEBOOK_HP_PIN),
 	SND_PCI_QUIRK(0x10cf, 0x1629, "Lifebook U7x7", ALC255_FIXUP_LIFEBOOK_U7x7_HEADSET_MIC),
+	SND_PCI_QUIRK(0x10cf, 0x1757, "Lifebook E752", ALC269_FIXUP_LIFEBOOK_HP_PIN),
 	SND_PCI_QUIRK(0x10cf, 0x1845, "Lifebook U904", ALC269_FIXUP_LIFEBOOK_EXTMIC),
 	SND_PCI_QUIRK(0x10ec, 0x10f2, "Intel Reference board", ALC700_FIXUP_INTEL_REFERENCE),
+	SND_PCI_QUIRK(0x10ec, 0x118c, "Medion EE4254 MD62100", ALC256_FIXUP_MEDION_HEADSET_NO_PRESENCE),
 	SND_PCI_QUIRK(0x10ec, 0x1230, "Intel Reference board", ALC295_FIXUP_CHROME_BOOK),
 	SND_PCI_QUIRK(0x10ec, 0x1252, "Intel Reference board", ALC295_FIXUP_CHROME_BOOK),
 	SND_PCI_QUIRK(0x10ec, 0x1254, "Intel Reference board", ALC295_FIXUP_CHROME_BOOK),
@@ -8183,9 +8184,9 @@ static const struct snd_pci_quirk alc269
 	SND_PCI_QUIRK(0x144d, 0xc176, "Samsung Notebook 9 Pro (NP930MBE-K04US)", ALC298_FIXUP_SAMSUNG_HEADPHONE_VERY_QUIET),
 	SND_PCI_QUIRK(0x144d, 0xc189, "Samsung Galaxy Flex Book (NT950QCG-X716)", ALC298_FIXUP_SAMSUNG_HEADPHONE_VERY_QUIET),
 	SND_PCI_QUIRK(0x144d, 0xc18a, "Samsung Galaxy Book Ion (NP930XCJ-K01US)", ALC298_FIXUP_SAMSUNG_HEADPHONE_VERY_QUIET),
-	SND_PCI_QUIRK(0x144d, 0xc830, "Samsung Galaxy Book Ion (NT950XCJ-X716A)", ALC298_FIXUP_SAMSUNG_HEADPHONE_VERY_QUIET),
 	SND_PCI_QUIRK(0x144d, 0xc740, "Samsung Ativ book 8 (NP870Z5G)", ALC269_FIXUP_ATIV_BOOK_8),
 	SND_PCI_QUIRK(0x144d, 0xc812, "Samsung Notebook Pen S (NT950SBE-X58)", ALC298_FIXUP_SAMSUNG_HEADPHONE_VERY_QUIET),
+	SND_PCI_QUIRK(0x144d, 0xc830, "Samsung Galaxy Book Ion (NT950XCJ-X716A)", ALC298_FIXUP_SAMSUNG_HEADPHONE_VERY_QUIET),
 	SND_PCI_QUIRK(0x1458, 0xfa53, "Gigabyte BXBT-2807", ALC283_FIXUP_HEADSET_MIC),
 	SND_PCI_QUIRK(0x1462, 0xb120, "MSI Cubi MS-B120", ALC283_FIXUP_HEADSET_MIC),
 	SND_PCI_QUIRK(0x1462, 0xb171, "Cubi N 8GL (MS-B171)", ALC283_FIXUP_HEADSET_MIC),
@@ -8312,13 +8313,12 @@ static const struct snd_pci_quirk alc269
 	SND_PCI_QUIRK(0x1b35, 0x1236, "CZC TMI", ALC269_FIXUP_CZC_TMI),
 	SND_PCI_QUIRK(0x1b35, 0x1237, "CZC L101", ALC269_FIXUP_CZC_L101),
 	SND_PCI_QUIRK(0x1b7d, 0xa831, "Ordissimo EVE2 ", ALC269VB_FIXUP_ORDISSIMO_EVE2), /* Also known as Malata PC-B1303 */
+	SND_PCI_QUIRK(0x1c06, 0x2013, "Lemote A1802", ALC269_FIXUP_LEMOTE_A1802),
+	SND_PCI_QUIRK(0x1c06, 0x2015, "Lemote A190X", ALC269_FIXUP_LEMOTE_A190X),
 	SND_PCI_QUIRK(0x1d72, 0x1602, "RedmiBook", ALC255_FIXUP_XIAOMI_HEADSET_MIC),
 	SND_PCI_QUIRK(0x1d72, 0x1701, "XiaomiNotebook Pro", ALC298_FIXUP_DELL1_MIC_NO_PRESENCE),
 	SND_PCI_QUIRK(0x1d72, 0x1901, "RedmiBook 14", ALC256_FIXUP_ASUS_HEADSET_MIC),
 	SND_PCI_QUIRK(0x1d72, 0x1947, "RedmiBook Air", ALC255_FIXUP_XIAOMI_HEADSET_MIC),
-	SND_PCI_QUIRK(0x10ec, 0x118c, "Medion EE4254 MD62100", ALC256_FIXUP_MEDION_HEADSET_NO_PRESENCE),
-	SND_PCI_QUIRK(0x1c06, 0x2013, "Lemote A1802", ALC269_FIXUP_LEMOTE_A1802),
-	SND_PCI_QUIRK(0x1c06, 0x2015, "Lemote A190X", ALC269_FIXUP_LEMOTE_A190X),
 	SND_PCI_QUIRK(0x8086, 0x2074, "Intel NUC 8", ALC233_FIXUP_INTEL_NUC8_DMIC),
 	SND_PCI_QUIRK(0x8086, 0x2080, "Intel NUC 8 Rugged", ALC256_FIXUP_INTEL_NUC8_RUGGED),
 	SND_PCI_QUIRK(0x8086, 0x2081, "Intel NUC 10", ALC256_FIXUP_INTEL_NUC10),



^ permalink raw reply	[flat|nested] 702+ messages in thread

* [PATCH 5.12 095/677] ALSA: hda/realtek: Re-order ALC662 quirk table entries
  2021-05-12 14:40 [PATCH 5.12 000/677] 5.12.4-rc1 review Greg Kroah-Hartman
                   ` (93 preceding siblings ...)
  2021-05-12 14:42 ` [PATCH 5.12 094/677] ALSA: hda/realtek: Re-order remaining ALC269 " Greg Kroah-Hartman
@ 2021-05-12 14:42 ` Greg Kroah-Hartman
  2021-05-12 14:42 ` [PATCH 5.12 096/677] ALSA: hda/realtek: Remove redundant entry for ALC861 Haier/Uniwill devices Greg Kroah-Hartman
                   ` (589 subsequent siblings)
  684 siblings, 0 replies; 702+ messages in thread
From: Greg Kroah-Hartman @ 2021-05-12 14:42 UTC (permalink / raw)
  To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Takashi Iwai

From: Takashi Iwai <tiwai@suse.de>

commit 9edeb1109d05953b2f0e24e5b2341a98c3fa78d5 upstream.

Just re-order the alc662_fixup_tbl[] entries for Acer and ASUS devices
for avoiding the oversight of the duplicated or unapplied item in
future.
No functional changes.

Also Cc-to-stable for the further patch applications.

Cc: <stable@vger.kernel.org>
Link: https://lore.kernel.org/r/20210428112704.23967-12-tiwai@suse.de
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 sound/pci/hda/patch_realtek.c |    4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

--- a/sound/pci/hda/patch_realtek.c
+++ b/sound/pci/hda/patch_realtek.c
@@ -10060,6 +10060,7 @@ static const struct snd_pci_quirk alc662
 	SND_PCI_QUIRK(0x1025, 0x0349, "eMachines eM250", ALC662_FIXUP_INV_DMIC),
 	SND_PCI_QUIRK(0x1025, 0x034a, "Gateway LT27", ALC662_FIXUP_INV_DMIC),
 	SND_PCI_QUIRK(0x1025, 0x038b, "Acer Aspire 8943G", ALC662_FIXUP_ASPIRE),
+	SND_PCI_QUIRK(0x1025, 0x0566, "Acer Aspire Ethos 8951G", ALC669_FIXUP_ACER_ASPIRE_ETHOS),
 	SND_PCI_QUIRK(0x1025, 0x123c, "Acer Nitro N50-600", ALC662_FIXUP_ACER_NITRO_HEADSET_MODE),
 	SND_PCI_QUIRK(0x1025, 0x124e, "Acer 2660G", ALC662_FIXUP_ACER_X2660G_HEADSET_MODE),
 	SND_PCI_QUIRK(0x1028, 0x05d8, "Dell", ALC668_FIXUP_DELL_MIC_NO_PRESENCE),
@@ -10076,9 +10077,9 @@ static const struct snd_pci_quirk alc662
 	SND_PCI_QUIRK(0x103c, 0x873e, "HP", ALC671_FIXUP_HP_HEADSET_MIC2),
 	SND_PCI_QUIRK(0x1043, 0x1080, "Asus UX501VW", ALC668_FIXUP_HEADSET_MODE),
 	SND_PCI_QUIRK(0x1043, 0x11cd, "Asus N550", ALC662_FIXUP_ASUS_Nx50),
-	SND_PCI_QUIRK(0x1043, 0x13df, "Asus N550JX", ALC662_FIXUP_BASS_1A),
 	SND_PCI_QUIRK(0x1043, 0x129d, "Asus N750", ALC662_FIXUP_ASUS_Nx50),
 	SND_PCI_QUIRK(0x1043, 0x12ff, "ASUS G751", ALC668_FIXUP_ASUS_G751),
+	SND_PCI_QUIRK(0x1043, 0x13df, "Asus N550JX", ALC662_FIXUP_BASS_1A),
 	SND_PCI_QUIRK(0x1043, 0x1477, "ASUS N56VZ", ALC662_FIXUP_BASS_MODE4_CHMAP),
 	SND_PCI_QUIRK(0x1043, 0x15a7, "ASUS UX51VZH", ALC662_FIXUP_BASS_16),
 	SND_PCI_QUIRK(0x1043, 0x177d, "ASUS N551", ALC668_FIXUP_ASUS_Nx51),
@@ -10098,7 +10099,6 @@ static const struct snd_pci_quirk alc662
 	SND_PCI_QUIRK(0x1b0a, 0x01b8, "ACER Veriton", ALC662_FIXUP_ACER_VERITON),
 	SND_PCI_QUIRK(0x1b35, 0x1234, "CZC ET26", ALC662_FIXUP_CZC_ET26),
 	SND_PCI_QUIRK(0x1b35, 0x2206, "CZC P10T", ALC662_FIXUP_CZC_P10T),
-	SND_PCI_QUIRK(0x1025, 0x0566, "Acer Aspire Ethos 8951G", ALC669_FIXUP_ACER_ASPIRE_ETHOS),
 
 #if 0
 	/* Below is a quirk table taken from the old code.



^ permalink raw reply	[flat|nested] 702+ messages in thread

* [PATCH 5.12 096/677] ALSA: hda/realtek: Remove redundant entry for ALC861 Haier/Uniwill devices
  2021-05-12 14:40 [PATCH 5.12 000/677] 5.12.4-rc1 review Greg Kroah-Hartman
                   ` (94 preceding siblings ...)
  2021-05-12 14:42 ` [PATCH 5.12 095/677] ALSA: hda/realtek: Re-order ALC662 " Greg Kroah-Hartman
@ 2021-05-12 14:42 ` Greg Kroah-Hartman
  2021-05-12 14:42 ` [PATCH 5.12 097/677] ALSA: hda/realtek: ALC285 Thinkpad jack pin quirk is unreachable Greg Kroah-Hartman
                   ` (588 subsequent siblings)
  684 siblings, 0 replies; 702+ messages in thread
From: Greg Kroah-Hartman @ 2021-05-12 14:42 UTC (permalink / raw)
  To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Takashi Iwai

From: Takashi Iwai <tiwai@suse.de>

commit defce244b01ee12534910a4544e11be5eb927d25 upstream.

The quirk entry for Uniwill ECS M31EI is with the PCI SSID device 0,
which means matching with all.  That is, it's essentially equivalent
with SND_PCI_QUIRK_VENDOR(0x1584), which also matches with the
previous entry for Haier W18 applying the very same quirk.

Let's unify them with the single vendor-quirk entry.

Cc: <stable@vger.kernel.org>
Link: https://lore.kernel.org/r/20210428112704.23967-13-tiwai@suse.de
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 sound/pci/hda/patch_realtek.c |    3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

--- a/sound/pci/hda/patch_realtek.c
+++ b/sound/pci/hda/patch_realtek.c
@@ -9264,8 +9264,7 @@ static const struct snd_pci_quirk alc861
 	SND_PCI_QUIRK(0x1043, 0x1393, "ASUS A6Rp", ALC861_FIXUP_ASUS_A6RP),
 	SND_PCI_QUIRK_VENDOR(0x1043, "ASUS laptop", ALC861_FIXUP_AMP_VREF_0F),
 	SND_PCI_QUIRK(0x1462, 0x7254, "HP DX2200", ALC861_FIXUP_NO_JACK_DETECT),
-	SND_PCI_QUIRK(0x1584, 0x2b01, "Haier W18", ALC861_FIXUP_AMP_VREF_0F),
-	SND_PCI_QUIRK(0x1584, 0x0000, "Uniwill ECS M31EI", ALC861_FIXUP_AMP_VREF_0F),
+	SND_PCI_QUIRK_VENDOR(0x1584, "Haier/Uniwill", ALC861_FIXUP_AMP_VREF_0F),
 	SND_PCI_QUIRK(0x1734, 0x10c7, "FSC Amilo Pi1505", ALC861_FIXUP_FSC_AMILO_PI1505),
 	{}
 };



^ permalink raw reply	[flat|nested] 702+ messages in thread

* [PATCH 5.12 097/677] ALSA: hda/realtek: ALC285 Thinkpad jack pin quirk is unreachable
  2021-05-12 14:40 [PATCH 5.12 000/677] 5.12.4-rc1 review Greg Kroah-Hartman
                   ` (95 preceding siblings ...)
  2021-05-12 14:42 ` [PATCH 5.12 096/677] ALSA: hda/realtek: Remove redundant entry for ALC861 Haier/Uniwill devices Greg Kroah-Hartman
@ 2021-05-12 14:42 ` Greg Kroah-Hartman
  2021-05-12 14:42 ` [PATCH 5.12 098/677] ALSA: hda/realtek: Fix speaker amp on HP Envy AiO 32 Greg Kroah-Hartman
                   ` (587 subsequent siblings)
  684 siblings, 0 replies; 702+ messages in thread
From: Greg Kroah-Hartman @ 2021-05-12 14:42 UTC (permalink / raw)
  To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Sami Loone, Takashi Iwai

From: Sami Loone <sami@loone.fi>

commit 266fd994b2b0ab7ba3e5541868838ce30775964b upstream.

In 9bbb94e57df1 ("ALSA: hda/realtek: fix static noise on ALC285 Lenovo
laptops") an existing Lenovo quirk was made more generic by removing a
0x12 pin requirement from the entry. This made the second chance table
Thinkpad jack entry unreachable as the pin configurations became
identical.

Revert the 0x12 pin requirement removal and move Thinkpad jack pin quirk
back to the primary pin table as they can co-exist when more specific
configurations come first.

Add a more targeted pin quirk for Lenovo devices that have 0x12 as
0x40000000.

Tested on Yoga 6 (AMD) laptop.

[ Corrected the commit ID -- tiwai ]

Fixes: 9bbb94e57df1 ("ALSA: hda/realtek: fix static noise on ALC285 Lenovo laptops")
Signed-off-by: Sami Loone <sami@loone.fi>
Cc: <stable@vger.kernel.org>
Link: https://lore.kernel.org/r/YI0oefvTYn8URYDb@yoga
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 sound/pci/hda/patch_realtek.c |   14 ++++++++++----
 1 file changed, 10 insertions(+), 4 deletions(-)

--- a/sound/pci/hda/patch_realtek.c
+++ b/sound/pci/hda/patch_realtek.c
@@ -8775,6 +8775,16 @@ static const struct snd_hda_pin_quirk al
 		{0x19, 0x03a11020},
 		{0x21, 0x0321101f}),
 	SND_HDA_PIN_QUIRK(0x10ec0285, 0x17aa, "Lenovo", ALC285_FIXUP_LENOVO_PC_BEEP_IN_NOISE,
+		{0x12, 0x90a60130},
+		{0x14, 0x90170110},
+		{0x19, 0x04a11040},
+		{0x21, 0x04211020}),
+	SND_HDA_PIN_QUIRK(0x10ec0285, 0x17aa, "Lenovo", ALC285_FIXUP_LENOVO_PC_BEEP_IN_NOISE,
+		{0x14, 0x90170110},
+		{0x19, 0x04a11040},
+		{0x1d, 0x40600001},
+		{0x21, 0x04211020}),
+	SND_HDA_PIN_QUIRK(0x10ec0285, 0x17aa, "Lenovo", ALC285_FIXUP_THINKPAD_NO_BASS_SPK_HEADSET_JACK,
 		{0x14, 0x90170110},
 		{0x19, 0x04a11040},
 		{0x21, 0x04211020}),
@@ -8945,10 +8955,6 @@ static const struct snd_hda_pin_quirk al
 	SND_HDA_PIN_QUIRK(0x10ec0274, 0x1028, "Dell", ALC274_FIXUP_DELL_AIO_LINEOUT_VERB,
 		{0x19, 0x40000000},
 		{0x1a, 0x40000000}),
-	SND_HDA_PIN_QUIRK(0x10ec0285, 0x17aa, "Lenovo", ALC285_FIXUP_THINKPAD_NO_BASS_SPK_HEADSET_JACK,
-		{0x14, 0x90170110},
-		{0x19, 0x04a11040},
-		{0x21, 0x04211020}),
 	{}
 };
 



^ permalink raw reply	[flat|nested] 702+ messages in thread

* [PATCH 5.12 098/677] ALSA: hda/realtek: Fix speaker amp on HP Envy AiO 32
  2021-05-12 14:40 [PATCH 5.12 000/677] 5.12.4-rc1 review Greg Kroah-Hartman
                   ` (96 preceding siblings ...)
  2021-05-12 14:42 ` [PATCH 5.12 097/677] ALSA: hda/realtek: ALC285 Thinkpad jack pin quirk is unreachable Greg Kroah-Hartman
@ 2021-05-12 14:42 ` Greg Kroah-Hartman
  2021-05-12 14:42 ` [PATCH 5.12 099/677] KVM: s390: VSIE: correctly handle MVPG when in VSIE Greg Kroah-Hartman
                   ` (586 subsequent siblings)
  684 siblings, 0 replies; 702+ messages in thread
From: Greg Kroah-Hartman @ 2021-05-12 14:42 UTC (permalink / raw)
  To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Takashi Iwai

From: Takashi Iwai <tiwai@suse.de>

commit 622464c893142f7beac89f5ba8c9773bca5e5004 upstream.

HP Envy AiO 32-a12xxx has an external amp that is controlled via GPIO
bit 0x04.  However, unlike other devices, this amp seems to shut down
itself after the certain period, hence the OS needs to up/down the bit
dynamically only during the actual playback.

This patch adds the control of the GPIO bit via the existing pcm_hook
mechanism.  Ideally it should be triggered at the actual stream start,
but we have only the state change at prepare/cleanup, so use those for
switching the GPIO bit on/off.  This should be good enough for the
purpose, and was actually confirmed to work fine.

BugLink: https://bugzilla.kernel.org/show_bug.cgi?id=212873
Cc: <stable@vger.kernel.org>
Link: https://lore.kernel.org/r/20210504091802.13200-1-tiwai@suse.de
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 sound/pci/hda/patch_realtek.c |   35 +++++++++++++++++++++++++++++++++++
 1 file changed, 35 insertions(+)

--- a/sound/pci/hda/patch_realtek.c
+++ b/sound/pci/hda/patch_realtek.c
@@ -4331,6 +4331,35 @@ static void alc245_fixup_hp_x360_amp(str
 	}
 }
 
+/* toggle GPIO2 at each time stream is started; we use PREPARE state instead */
+static void alc274_hp_envy_pcm_hook(struct hda_pcm_stream *hinfo,
+				    struct hda_codec *codec,
+				    struct snd_pcm_substream *substream,
+				    int action)
+{
+	switch (action) {
+	case HDA_GEN_PCM_ACT_PREPARE:
+		alc_update_gpio_data(codec, 0x04, true);
+		break;
+	case HDA_GEN_PCM_ACT_CLEANUP:
+		alc_update_gpio_data(codec, 0x04, false);
+		break;
+	}
+}
+
+static void alc274_fixup_hp_envy_gpio(struct hda_codec *codec,
+				      const struct hda_fixup *fix,
+				      int action)
+{
+	struct alc_spec *spec = codec->spec;
+
+	if (action == HDA_FIXUP_ACT_PROBE) {
+		spec->gpio_mask |= 0x04;
+		spec->gpio_dir |= 0x04;
+		spec->gen.pcm_playback_hook = alc274_hp_envy_pcm_hook;
+	}
+}
+
 static void alc_update_coef_led(struct hda_codec *codec,
 				struct alc_coef_led *led,
 				bool polarity, bool on)
@@ -6443,6 +6472,7 @@ enum {
 	ALC255_FIXUP_XIAOMI_HEADSET_MIC,
 	ALC274_FIXUP_HP_MIC,
 	ALC274_FIXUP_HP_HEADSET_MIC,
+	ALC274_FIXUP_HP_ENVY_GPIO,
 	ALC256_FIXUP_ASUS_HPE,
 	ALC285_FIXUP_THINKPAD_NO_BASS_SPK_HEADSET_JACK,
 	ALC287_FIXUP_HP_GPIO_LED,
@@ -7882,6 +7912,10 @@ static const struct hda_fixup alc269_fix
 		.chained = true,
 		.chain_id = ALC274_FIXUP_HP_MIC
 	},
+	[ALC274_FIXUP_HP_ENVY_GPIO] = {
+		.type = HDA_FIXUP_FUNC,
+		.v.func = alc274_fixup_hp_envy_gpio,
+	},
 	[ALC256_FIXUP_ASUS_HPE] = {
 		.type = HDA_FIXUP_VERBS,
 		.v.verbs = (const struct hda_verb[]) {
@@ -8099,6 +8133,7 @@ static const struct snd_pci_quirk alc269
 	SND_PCI_QUIRK(0x103c, 0x8497, "HP Envy x360", ALC269_FIXUP_HP_MUTE_LED_MIC3),
 	SND_PCI_QUIRK(0x103c, 0x84e7, "HP Pavilion 15", ALC269_FIXUP_HP_MUTE_LED_MIC3),
 	SND_PCI_QUIRK(0x103c, 0x869d, "HP", ALC236_FIXUP_HP_MUTE_LED),
+	SND_PCI_QUIRK(0x103c, 0x86c7, "HP Envy AiO 32", ALC274_FIXUP_HP_ENVY_GPIO),
 	SND_PCI_QUIRK(0x103c, 0x8724, "HP EliteBook 850 G7", ALC285_FIXUP_HP_GPIO_LED),
 	SND_PCI_QUIRK(0x103c, 0x8729, "HP", ALC285_FIXUP_HP_GPIO_LED),
 	SND_PCI_QUIRK(0x103c, 0x8730, "HP ProBook 445 G7", ALC236_FIXUP_HP_MUTE_LED_MICMUTE_VREF),



^ permalink raw reply	[flat|nested] 702+ messages in thread

* [PATCH 5.12 099/677] KVM: s390: VSIE: correctly handle MVPG when in VSIE
  2021-05-12 14:40 [PATCH 5.12 000/677] 5.12.4-rc1 review Greg Kroah-Hartman
                   ` (97 preceding siblings ...)
  2021-05-12 14:42 ` [PATCH 5.12 098/677] ALSA: hda/realtek: Fix speaker amp on HP Envy AiO 32 Greg Kroah-Hartman
@ 2021-05-12 14:42 ` Greg Kroah-Hartman
  2021-05-12 14:42 ` [PATCH 5.12 100/677] KVM: s390: split kvm_s390_logical_to_effective Greg Kroah-Hartman
                   ` (585 subsequent siblings)
  684 siblings, 0 replies; 702+ messages in thread
From: Greg Kroah-Hartman @ 2021-05-12 14:42 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Claudio Imbrenda, Janosch Frank,
	David Hildenbrand, Christian Borntraeger

From: Claudio Imbrenda <imbrenda@linux.ibm.com>

commit bdf7509bbefa20855d5f6bacdc5b62a8489477c9 upstream.

Correctly handle the MVPG instruction when issued by a VSIE guest.

Fixes: a3508fbe9dc6d ("KVM: s390: vsie: initial support for nested virtualization")
Cc: stable@vger.kernel.org # f85f1baaa189: KVM: s390: split kvm_s390_logical_to_effective
Signed-off-by: Claudio Imbrenda <imbrenda@linux.ibm.com>
Acked-by: Janosch Frank <frankja@linux.ibm.com>
Reviewed-by: David Hildenbrand <david@redhat.com>
Acked-by: Christian Borntraeger <borntraeger@de.ibm.com>
Link: https://lore.kernel.org/r/20210302174443.514363-4-imbrenda@linux.ibm.com
[borntraeger@de.ibm.com: apply fixup from Claudio]
Signed-off-by: Christian Borntraeger <borntraeger@de.ibm.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 arch/s390/kvm/vsie.c |   98 ++++++++++++++++++++++++++++++++++++++++++++++++---
 1 file changed, 93 insertions(+), 5 deletions(-)

--- a/arch/s390/kvm/vsie.c
+++ b/arch/s390/kvm/vsie.c
@@ -417,11 +417,6 @@ static void unshadow_scb(struct kvm_vcpu
 		memcpy((void *)((u64)scb_o + 0xc0),
 		       (void *)((u64)scb_s + 0xc0), 0xf0 - 0xc0);
 		break;
-	case ICPT_PARTEXEC:
-		/* MVPG only */
-		memcpy((void *)((u64)scb_o + 0xc0),
-		       (void *)((u64)scb_s + 0xc0), 0xd0 - 0xc0);
-		break;
 	}
 
 	if (scb_s->ihcpu != 0xffffU)
@@ -984,6 +979,95 @@ static int handle_stfle(struct kvm_vcpu
 }
 
 /*
+ * Get a register for a nested guest.
+ * @vcpu the vcpu of the guest
+ * @vsie_page the vsie_page for the nested guest
+ * @reg the register number, the upper 4 bits are ignored.
+ * returns: the value of the register.
+ */
+static u64 vsie_get_register(struct kvm_vcpu *vcpu, struct vsie_page *vsie_page, u8 reg)
+{
+	/* no need to validate the parameter and/or perform error handling */
+	reg &= 0xf;
+	switch (reg) {
+	case 15:
+		return vsie_page->scb_s.gg15;
+	case 14:
+		return vsie_page->scb_s.gg14;
+	default:
+		return vcpu->run->s.regs.gprs[reg];
+	}
+}
+
+static int vsie_handle_mvpg(struct kvm_vcpu *vcpu, struct vsie_page *vsie_page)
+{
+	struct kvm_s390_sie_block *scb_s = &vsie_page->scb_s;
+	unsigned long pei_dest, pei_src, src, dest, mask;
+	u64 *pei_block = &vsie_page->scb_o->mcic;
+	int edat, rc_dest, rc_src;
+	union ctlreg0 cr0;
+
+	cr0.val = vcpu->arch.sie_block->gcr[0];
+	edat = cr0.edat && test_kvm_facility(vcpu->kvm, 8);
+	mask = _kvm_s390_logical_to_effective(&scb_s->gpsw, PAGE_MASK);
+
+	dest = vsie_get_register(vcpu, vsie_page, scb_s->ipb >> 20) & mask;
+	src = vsie_get_register(vcpu, vsie_page, scb_s->ipb >> 16) & mask;
+
+	rc_dest = kvm_s390_shadow_fault(vcpu, vsie_page->gmap, dest, &pei_dest);
+	rc_src = kvm_s390_shadow_fault(vcpu, vsie_page->gmap, src, &pei_src);
+	/*
+	 * Either everything went well, or something non-critical went wrong
+	 * e.g. because of a race. In either case, simply retry.
+	 */
+	if (rc_dest == -EAGAIN || rc_src == -EAGAIN || (!rc_dest && !rc_src)) {
+		retry_vsie_icpt(vsie_page);
+		return -EAGAIN;
+	}
+	/* Something more serious went wrong, propagate the error */
+	if (rc_dest < 0)
+		return rc_dest;
+	if (rc_src < 0)
+		return rc_src;
+
+	/* The only possible suppressing exception: just deliver it */
+	if (rc_dest == PGM_TRANSLATION_SPEC || rc_src == PGM_TRANSLATION_SPEC) {
+		clear_vsie_icpt(vsie_page);
+		rc_dest = kvm_s390_inject_program_int(vcpu, PGM_TRANSLATION_SPEC);
+		WARN_ON_ONCE(rc_dest);
+		return 1;
+	}
+
+	/*
+	 * Forward the PEI intercept to the guest if it was a page fault, or
+	 * also for segment and region table faults if EDAT applies.
+	 */
+	if (edat) {
+		rc_dest = rc_dest == PGM_ASCE_TYPE ? rc_dest : 0;
+		rc_src = rc_src == PGM_ASCE_TYPE ? rc_src : 0;
+	} else {
+		rc_dest = rc_dest != PGM_PAGE_TRANSLATION ? rc_dest : 0;
+		rc_src = rc_src != PGM_PAGE_TRANSLATION ? rc_src : 0;
+	}
+	if (!rc_dest && !rc_src) {
+		pei_block[0] = pei_dest;
+		pei_block[1] = pei_src;
+		return 1;
+	}
+
+	retry_vsie_icpt(vsie_page);
+
+	/*
+	 * The host has edat, and the guest does not, or it was an ASCE type
+	 * exception. The host needs to inject the appropriate DAT interrupts
+	 * into the guest.
+	 */
+	if (rc_dest)
+		return inject_fault(vcpu, rc_dest, dest, 1);
+	return inject_fault(vcpu, rc_src, src, 0);
+}
+
+/*
  * Run the vsie on a shadow scb and a shadow gmap, without any further
  * sanity checks, handling SIE faults.
  *
@@ -1071,6 +1155,10 @@ static int do_vsie_run(struct kvm_vcpu *
 		if ((scb_s->ipa & 0xf000) != 0xf000)
 			scb_s->ipa += 0x1000;
 		break;
+	case ICPT_PARTEXEC:
+		if (scb_s->ipa == 0xb254)
+			rc = vsie_handle_mvpg(vcpu, vsie_page);
+		break;
 	}
 	return rc;
 }



^ permalink raw reply	[flat|nested] 702+ messages in thread

* [PATCH 5.12 100/677] KVM: s390: split kvm_s390_logical_to_effective
  2021-05-12 14:40 [PATCH 5.12 000/677] 5.12.4-rc1 review Greg Kroah-Hartman
                   ` (98 preceding siblings ...)
  2021-05-12 14:42 ` [PATCH 5.12 099/677] KVM: s390: VSIE: correctly handle MVPG when in VSIE Greg Kroah-Hartman
@ 2021-05-12 14:42 ` Greg Kroah-Hartman
  2021-05-12 14:42 ` [PATCH 5.12 101/677] KVM: s390: fix guarded storage control register handling Greg Kroah-Hartman
                   ` (584 subsequent siblings)
  684 siblings, 0 replies; 702+ messages in thread
From: Greg Kroah-Hartman @ 2021-05-12 14:42 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Claudio Imbrenda, Christian Borntraeger

From: Claudio Imbrenda <imbrenda@linux.ibm.com>

commit f85f1baaa18932a041fd2b1c2ca6cfd9898c7d2b upstream.

Split kvm_s390_logical_to_effective to a generic function called
_kvm_s390_logical_to_effective. The new function takes a PSW and an address
and returns the address with the appropriate bits masked off. The old
function now calls the new function with the appropriate PSW from the vCPU.

This is needed to avoid code duplication for vSIE.

Signed-off-by: Claudio Imbrenda <imbrenda@linux.ibm.com>
Reviewed-by: Christian Borntraeger <borntraeger@de.ibm.com>
Cc: stable@vger.kernel.org # for VSIE: correctly handle MVPG when in VSIE
Link: https://lore.kernel.org/r/20210302174443.514363-2-imbrenda@linux.ibm.com
Signed-off-by: Christian Borntraeger <borntraeger@de.ibm.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 arch/s390/kvm/gaccess.h |   31 ++++++++++++++++++++++++-------
 1 file changed, 24 insertions(+), 7 deletions(-)

--- a/arch/s390/kvm/gaccess.h
+++ b/arch/s390/kvm/gaccess.h
@@ -37,6 +37,29 @@ static inline unsigned long kvm_s390_rea
 }
 
 /**
+ * _kvm_s390_logical_to_effective - convert guest logical to effective address
+ * @psw: psw of the guest
+ * @ga: guest logical address
+ *
+ * Convert a guest logical address to an effective address by applying the
+ * rules of the addressing mode defined by bits 31 and 32 of the given PSW
+ * (extendended/basic addressing mode).
+ *
+ * Depending on the addressing mode, the upper 40 bits (24 bit addressing
+ * mode), 33 bits (31 bit addressing mode) or no bits (64 bit addressing
+ * mode) of @ga will be zeroed and the remaining bits will be returned.
+ */
+static inline unsigned long _kvm_s390_logical_to_effective(psw_t *psw,
+							   unsigned long ga)
+{
+	if (psw_bits(*psw).eaba == PSW_BITS_AMODE_64BIT)
+		return ga;
+	if (psw_bits(*psw).eaba == PSW_BITS_AMODE_31BIT)
+		return ga & ((1UL << 31) - 1);
+	return ga & ((1UL << 24) - 1);
+}
+
+/**
  * kvm_s390_logical_to_effective - convert guest logical to effective address
  * @vcpu: guest virtual cpu
  * @ga: guest logical address
@@ -52,13 +75,7 @@ static inline unsigned long kvm_s390_rea
 static inline unsigned long kvm_s390_logical_to_effective(struct kvm_vcpu *vcpu,
 							  unsigned long ga)
 {
-	psw_t *psw = &vcpu->arch.sie_block->gpsw;
-
-	if (psw_bits(*psw).eaba == PSW_BITS_AMODE_64BIT)
-		return ga;
-	if (psw_bits(*psw).eaba == PSW_BITS_AMODE_31BIT)
-		return ga & ((1UL << 31) - 1);
-	return ga & ((1UL << 24) - 1);
+	return _kvm_s390_logical_to_effective(&vcpu->arch.sie_block->gpsw, ga);
 }
 
 /*



^ permalink raw reply	[flat|nested] 702+ messages in thread

* [PATCH 5.12 101/677] KVM: s390: fix guarded storage control register handling
  2021-05-12 14:40 [PATCH 5.12 000/677] 5.12.4-rc1 review Greg Kroah-Hartman
                   ` (99 preceding siblings ...)
  2021-05-12 14:42 ` [PATCH 5.12 100/677] KVM: s390: split kvm_s390_logical_to_effective Greg Kroah-Hartman
@ 2021-05-12 14:42 ` Greg Kroah-Hartman
  2021-05-12 14:42 ` [PATCH 5.12 102/677] s390: fix detection of vector enhancements facility 1 vs. vector packed decimal facility Greg Kroah-Hartman
                   ` (583 subsequent siblings)
  684 siblings, 0 replies; 702+ messages in thread
From: Greg Kroah-Hartman @ 2021-05-12 14:42 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Heiko Carstens,
	Christian Borntraeger, David Hildenbrand, Janosch Frank,
	Cornelia Huck

From: Heiko Carstens <hca@linux.ibm.com>

commit 44bada28219031f9e8e86b84460606efa57b871e upstream.

store_regs_fmt2() has an ordering problem: first the guarded storage
facility is enabled on the local cpu, then preemption disabled, and
then the STGSC (store guarded storage controls) instruction is
executed.

If the process gets scheduled away between enabling the guarded
storage facility and before preemption is disabled, this might lead to
a special operation exception and therefore kernel crash as soon as
the process is scheduled back and the STGSC instruction is executed.

Fixes: 4e0b1ab72b8a ("KVM: s390: gs support for kvm guests")
Signed-off-by: Heiko Carstens <hca@linux.ibm.com>
Reviewed-by: Christian Borntraeger <borntraeger@de.ibm.com>
Reviewed-by: David Hildenbrand <david@redhat.com>
Reviewed-by: Janosch Frank <frankja@linux.ibm.com>
Reviewed-by: Cornelia Huck <cohuck@redhat.com>
Cc: <stable@vger.kernel.org> # 4.12
Link: https://lore.kernel.org/r/20210415080127.1061275-1-hca@linux.ibm.com
Signed-off-by: Christian Borntraeger <borntraeger@de.ibm.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 arch/s390/kvm/kvm-s390.c |    4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

--- a/arch/s390/kvm/kvm-s390.c
+++ b/arch/s390/kvm/kvm-s390.c
@@ -4307,16 +4307,16 @@ static void store_regs_fmt2(struct kvm_v
 	kvm_run->s.regs.bpbc = (vcpu->arch.sie_block->fpf & FPF_BPBC) == FPF_BPBC;
 	kvm_run->s.regs.diag318 = vcpu->arch.diag318_info.val;
 	if (MACHINE_HAS_GS) {
+		preempt_disable();
 		__ctl_set_bit(2, 4);
 		if (vcpu->arch.gs_enabled)
 			save_gs_cb(current->thread.gs_cb);
-		preempt_disable();
 		current->thread.gs_cb = vcpu->arch.host_gscb;
 		restore_gs_cb(vcpu->arch.host_gscb);
-		preempt_enable();
 		if (!vcpu->arch.host_gscb)
 			__ctl_clear_bit(2, 4);
 		vcpu->arch.host_gscb = NULL;
+		preempt_enable();
 	}
 	/* SIE will save etoken directly into SDNX and therefore kvm_run */
 }



^ permalink raw reply	[flat|nested] 702+ messages in thread

* [PATCH 5.12 102/677] s390: fix detection of vector enhancements facility 1 vs. vector packed decimal facility
  2021-05-12 14:40 [PATCH 5.12 000/677] 5.12.4-rc1 review Greg Kroah-Hartman
                   ` (100 preceding siblings ...)
  2021-05-12 14:42 ` [PATCH 5.12 101/677] KVM: s390: fix guarded storage control register handling Greg Kroah-Hartman
@ 2021-05-12 14:42 ` Greg Kroah-Hartman
  2021-05-12 14:42 ` [PATCH 5.12 103/677] KVM: s390: VSIE: fix MVPG handling for prefixing and MSO Greg Kroah-Hartman
                   ` (582 subsequent siblings)
  684 siblings, 0 replies; 702+ messages in thread
From: Greg Kroah-Hartman @ 2021-05-12 14:42 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Vasily Gorbik, David Hildenbrand,
	Christian Borntraeger, Cornelia Huck, Janosch Frank,
	Heiko Carstens

From: David Hildenbrand <david@redhat.com>

commit b208108638c4bd3215792415944467c36f5dfd97 upstream.

The PoP documents:
	134: The vector packed decimal facility is installed in the
	     z/Architecture architectural mode. When bit 134 is
	     one, bit 129 is also one.
	135: The vector enhancements facility 1 is installed in
	     the z/Architecture architectural mode. When bit 135
	     is one, bit 129 is also one.

Looks like we confuse the vector enhancements facility 1 ("EXT") with the
Vector packed decimal facility ("BCD"). Let's fix the facility checks.

Detected while working on QEMU/tcg z14 support and only unlocking
the vector enhancements facility 1, but not the vector packed decimal
facility.

Fixes: 2583b848cad0 ("s390: report new vector facilities")
Cc: Vasily Gorbik <gor@linux.ibm.com>
Signed-off-by: David Hildenbrand <david@redhat.com>
Reviewed-by: Christian Borntraeger <borntraeger@de.ibm.com>
Reviewed-by: Cornelia Huck <cohuck@redhat.com>
Reviewed-by: Janosch Frank <frankja@linux.ibm.com>
Link: https://lore.kernel.org/r/20210503121244.25232-1-david@redhat.com
Signed-off-by: Heiko Carstens <hca@linux.ibm.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 arch/s390/kernel/setup.c |    4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

--- a/arch/s390/kernel/setup.c
+++ b/arch/s390/kernel/setup.c
@@ -937,9 +937,9 @@ static int __init setup_hwcaps(void)
 	if (MACHINE_HAS_VX) {
 		elf_hwcap |= HWCAP_S390_VXRS;
 		if (test_facility(134))
-			elf_hwcap |= HWCAP_S390_VXRS_EXT;
-		if (test_facility(135))
 			elf_hwcap |= HWCAP_S390_VXRS_BCD;
+		if (test_facility(135))
+			elf_hwcap |= HWCAP_S390_VXRS_EXT;
 		if (test_facility(148))
 			elf_hwcap |= HWCAP_S390_VXRS_EXT2;
 		if (test_facility(152))



^ permalink raw reply	[flat|nested] 702+ messages in thread

* [PATCH 5.12 103/677] KVM: s390: VSIE: fix MVPG handling for prefixing and MSO
  2021-05-12 14:40 [PATCH 5.12 000/677] 5.12.4-rc1 review Greg Kroah-Hartman
                   ` (101 preceding siblings ...)
  2021-05-12 14:42 ` [PATCH 5.12 102/677] s390: fix detection of vector enhancements facility 1 vs. vector packed decimal facility Greg Kroah-Hartman
@ 2021-05-12 14:42 ` Greg Kroah-Hartman
  2021-05-12 14:42 ` [PATCH 5.12 104/677] KVM: s390: split kvm_s390_real_to_abs Greg Kroah-Hartman
                   ` (581 subsequent siblings)
  684 siblings, 0 replies; 702+ messages in thread
From: Greg Kroah-Hartman @ 2021-05-12 14:42 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Janosch Frank, Claudio Imbrenda,
	David Hildenbrand, Christian Borntraeger

From: Claudio Imbrenda <imbrenda@linux.ibm.com>

commit c3171e94cc1cdcc3229565244112e869f052b8d9 upstream.

Prefixing needs to be applied to the guest real address to translate it
into a guest absolute address.

The value of MSO needs to be added to a guest-absolute address in order to
obtain the host-virtual.

Fixes: bdf7509bbefa ("s390/kvm: VSIE: correctly handle MVPG when in VSIE")
Reported-by: Janosch Frank <frankja@linux.ibm.com>
Signed-off-by: Claudio Imbrenda <imbrenda@linux.ibm.com>
Reviewed-by: David Hildenbrand <david@redhat.com>
Cc: stable@vger.kernel.org
Link: https://lore.kernel.org/r/20210322140559.500716-3-imbrenda@linux.ibm.com
[borntraeger@de.ibm.com simplify mso]
Signed-off-by: Christian Borntraeger <borntraeger@de.ibm.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 arch/s390/kvm/vsie.c |    5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

--- a/arch/s390/kvm/vsie.c
+++ b/arch/s390/kvm/vsie.c
@@ -1002,7 +1002,7 @@ static u64 vsie_get_register(struct kvm_
 static int vsie_handle_mvpg(struct kvm_vcpu *vcpu, struct vsie_page *vsie_page)
 {
 	struct kvm_s390_sie_block *scb_s = &vsie_page->scb_s;
-	unsigned long pei_dest, pei_src, src, dest, mask;
+	unsigned long pei_dest, pei_src, src, dest, mask, prefix;
 	u64 *pei_block = &vsie_page->scb_o->mcic;
 	int edat, rc_dest, rc_src;
 	union ctlreg0 cr0;
@@ -1010,9 +1010,12 @@ static int vsie_handle_mvpg(struct kvm_v
 	cr0.val = vcpu->arch.sie_block->gcr[0];
 	edat = cr0.edat && test_kvm_facility(vcpu->kvm, 8);
 	mask = _kvm_s390_logical_to_effective(&scb_s->gpsw, PAGE_MASK);
+	prefix = scb_s->prefix << GUEST_PREFIX_SHIFT;
 
 	dest = vsie_get_register(vcpu, vsie_page, scb_s->ipb >> 20) & mask;
+	dest = _kvm_s390_real_to_abs(prefix, dest) + scb_s->mso;
 	src = vsie_get_register(vcpu, vsie_page, scb_s->ipb >> 16) & mask;
+	src = _kvm_s390_real_to_abs(prefix, src) + scb_s->mso;
 
 	rc_dest = kvm_s390_shadow_fault(vcpu, vsie_page->gmap, dest, &pei_dest);
 	rc_src = kvm_s390_shadow_fault(vcpu, vsie_page->gmap, src, &pei_src);



^ permalink raw reply	[flat|nested] 702+ messages in thread

* [PATCH 5.12 104/677] KVM: s390: split kvm_s390_real_to_abs
  2021-05-12 14:40 [PATCH 5.12 000/677] 5.12.4-rc1 review Greg Kroah-Hartman
                   ` (102 preceding siblings ...)
  2021-05-12 14:42 ` [PATCH 5.12 103/677] KVM: s390: VSIE: fix MVPG handling for prefixing and MSO Greg Kroah-Hartman
@ 2021-05-12 14:42 ` Greg Kroah-Hartman
  2021-05-12 14:42 ` [PATCH 5.12 105/677] KVM: s390: extend kvm_s390_shadow_fault to return entry pointer Greg Kroah-Hartman
                   ` (580 subsequent siblings)
  684 siblings, 0 replies; 702+ messages in thread
From: Greg Kroah-Hartman @ 2021-05-12 14:42 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Claudio Imbrenda, David Hildenbrand,
	Thomas Huth, Christian Borntraeger

From: Claudio Imbrenda <imbrenda@linux.ibm.com>

commit c5d1f6b531e68888cbe6718b3f77a60115d58b9c upstream.

A new function _kvm_s390_real_to_abs will apply prefixing to a real address
with a given prefix value.

The old kvm_s390_real_to_abs becomes now a wrapper around the new function.

This is needed to avoid code duplication in vSIE.

Signed-off-by: Claudio Imbrenda <imbrenda@linux.ibm.com>
Reviewed-by: David Hildenbrand <david@redhat.com>
Reviewed-by: Thomas Huth <thuth@redhat.com>
Cc: stable@vger.kernel.org
Link: https://lore.kernel.org/r/20210322140559.500716-2-imbrenda@linux.ibm.com
Signed-off-by: Christian Borntraeger <borntraeger@de.ibm.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 arch/s390/kvm/gaccess.h |   23 +++++++++++++++++------
 1 file changed, 17 insertions(+), 6 deletions(-)

--- a/arch/s390/kvm/gaccess.h
+++ b/arch/s390/kvm/gaccess.h
@@ -18,17 +18,14 @@
 
 /**
  * kvm_s390_real_to_abs - convert guest real address to guest absolute address
- * @vcpu - guest virtual cpu
+ * @prefix - guest prefix
  * @gra - guest real address
  *
  * Returns the guest absolute address that corresponds to the passed guest real
- * address @gra of a virtual guest cpu by applying its prefix.
+ * address @gra of by applying the given prefix.
  */
-static inline unsigned long kvm_s390_real_to_abs(struct kvm_vcpu *vcpu,
-						 unsigned long gra)
+static inline unsigned long _kvm_s390_real_to_abs(u32 prefix, unsigned long gra)
 {
-	unsigned long prefix  = kvm_s390_get_prefix(vcpu);
-
 	if (gra < 2 * PAGE_SIZE)
 		gra += prefix;
 	else if (gra >= prefix && gra < prefix + 2 * PAGE_SIZE)
@@ -37,6 +34,20 @@ static inline unsigned long kvm_s390_rea
 }
 
 /**
+ * kvm_s390_real_to_abs - convert guest real address to guest absolute address
+ * @vcpu - guest virtual cpu
+ * @gra - guest real address
+ *
+ * Returns the guest absolute address that corresponds to the passed guest real
+ * address @gra of a virtual guest cpu by applying its prefix.
+ */
+static inline unsigned long kvm_s390_real_to_abs(struct kvm_vcpu *vcpu,
+						 unsigned long gra)
+{
+	return _kvm_s390_real_to_abs(kvm_s390_get_prefix(vcpu), gra);
+}
+
+/**
  * _kvm_s390_logical_to_effective - convert guest logical to effective address
  * @psw: psw of the guest
  * @ga: guest logical address



^ permalink raw reply	[flat|nested] 702+ messages in thread

* [PATCH 5.12 105/677] KVM: s390: extend kvm_s390_shadow_fault to return entry pointer
  2021-05-12 14:40 [PATCH 5.12 000/677] 5.12.4-rc1 review Greg Kroah-Hartman
                   ` (103 preceding siblings ...)
  2021-05-12 14:42 ` [PATCH 5.12 104/677] KVM: s390: split kvm_s390_real_to_abs Greg Kroah-Hartman
@ 2021-05-12 14:42 ` Greg Kroah-Hartman
  2021-05-12 14:42 ` [PATCH 5.12 106/677] KVM: x86/mmu: Alloc page for PDPTEs when shadowing 32-bit NPT with 64-bit Greg Kroah-Hartman
                   ` (579 subsequent siblings)
  684 siblings, 0 replies; 702+ messages in thread
From: Greg Kroah-Hartman @ 2021-05-12 14:42 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Claudio Imbrenda, Janosch Frank,
	David Hildenbrand, Christian Borntraeger

From: Claudio Imbrenda <imbrenda@linux.ibm.com>

commit 5ac14bac08ae827b619f21bcceaaac3b8c497e31 upstream.

Extend kvm_s390_shadow_fault to return the pointer to the valid leaf
DAT table entry, or to the invalid entry.

Also return some flags in the lower bits of the address:
PEI_DAT_PROT: indicates that DAT protection applies because of the
              protection bit in the segment (or, if EDAT, region) tables.
PEI_NOT_PTE: indicates that the address of the DAT table entry returned
             does not refer to a PTE, but to a segment or region table.

Signed-off-by: Claudio Imbrenda <imbrenda@linux.ibm.com>
Cc: stable@vger.kernel.org
Reviewed-by: Janosch Frank <frankja@de.ibm.com>
Reviewed-by: David Hildenbrand <david@redhat.com>
Reviewed-by: Christian Borntraeger <borntraeger@de.ibm.com>
Link: https://lore.kernel.org/r/20210302174443.514363-3-imbrenda@linux.ibm.com
[borntraeger@de.ibm.com: fold in a fix from Claudio]
Signed-off-by: Christian Borntraeger <borntraeger@de.ibm.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 arch/s390/kvm/gaccess.c |   30 +++++++++++++++++++++++++-----
 arch/s390/kvm/gaccess.h |    6 +++++-
 arch/s390/kvm/vsie.c    |    8 ++++----
 3 files changed, 34 insertions(+), 10 deletions(-)

--- a/arch/s390/kvm/gaccess.c
+++ b/arch/s390/kvm/gaccess.c
@@ -976,7 +976,9 @@ int kvm_s390_check_low_addr_prot_real(st
  * kvm_s390_shadow_tables - walk the guest page table and create shadow tables
  * @sg: pointer to the shadow guest address space structure
  * @saddr: faulting address in the shadow gmap
- * @pgt: pointer to the page table address result
+ * @pgt: pointer to the beginning of the page table for the given address if
+ *	 successful (return value 0), or to the first invalid DAT entry in
+ *	 case of exceptions (return value > 0)
  * @fake: pgt references contiguous guest memory block, not a pgtable
  */
 static int kvm_s390_shadow_tables(struct gmap *sg, unsigned long saddr,
@@ -1034,6 +1036,7 @@ static int kvm_s390_shadow_tables(struct
 			rfte.val = ptr;
 			goto shadow_r2t;
 		}
+		*pgt = ptr + vaddr.rfx * 8;
 		rc = gmap_read_table(parent, ptr + vaddr.rfx * 8, &rfte.val);
 		if (rc)
 			return rc;
@@ -1060,6 +1063,7 @@ shadow_r2t:
 			rste.val = ptr;
 			goto shadow_r3t;
 		}
+		*pgt = ptr + vaddr.rsx * 8;
 		rc = gmap_read_table(parent, ptr + vaddr.rsx * 8, &rste.val);
 		if (rc)
 			return rc;
@@ -1087,6 +1091,7 @@ shadow_r3t:
 			rtte.val = ptr;
 			goto shadow_sgt;
 		}
+		*pgt = ptr + vaddr.rtx * 8;
 		rc = gmap_read_table(parent, ptr + vaddr.rtx * 8, &rtte.val);
 		if (rc)
 			return rc;
@@ -1123,6 +1128,7 @@ shadow_sgt:
 			ste.val = ptr;
 			goto shadow_pgt;
 		}
+		*pgt = ptr + vaddr.sx * 8;
 		rc = gmap_read_table(parent, ptr + vaddr.sx * 8, &ste.val);
 		if (rc)
 			return rc;
@@ -1157,6 +1163,8 @@ shadow_pgt:
  * @vcpu: virtual cpu
  * @sg: pointer to the shadow guest address space structure
  * @saddr: faulting address in the shadow gmap
+ * @datptr: will contain the address of the faulting DAT table entry, or of
+ *	    the valid leaf, plus some flags
  *
  * Returns: - 0 if the shadow fault was successfully resolved
  *	    - > 0 (pgm exception code) on exceptions while faulting
@@ -1165,11 +1173,11 @@ shadow_pgt:
  *	    - -ENOMEM if out of memory
  */
 int kvm_s390_shadow_fault(struct kvm_vcpu *vcpu, struct gmap *sg,
-			  unsigned long saddr)
+			  unsigned long saddr, unsigned long *datptr)
 {
 	union vaddress vaddr;
 	union page_table_entry pte;
-	unsigned long pgt;
+	unsigned long pgt = 0;
 	int dat_protection, fake;
 	int rc;
 
@@ -1191,8 +1199,20 @@ int kvm_s390_shadow_fault(struct kvm_vcp
 		pte.val = pgt + vaddr.px * PAGE_SIZE;
 		goto shadow_page;
 	}
-	if (!rc)
-		rc = gmap_read_table(sg->parent, pgt + vaddr.px * 8, &pte.val);
+
+	switch (rc) {
+	case PGM_SEGMENT_TRANSLATION:
+	case PGM_REGION_THIRD_TRANS:
+	case PGM_REGION_SECOND_TRANS:
+	case PGM_REGION_FIRST_TRANS:
+		pgt |= PEI_NOT_PTE;
+		break;
+	case 0:
+		pgt += vaddr.px * 8;
+		rc = gmap_read_table(sg->parent, pgt, &pte.val);
+	}
+	if (datptr)
+		*datptr = pgt | dat_protection * PEI_DAT_PROT;
 	if (!rc && pte.i)
 		rc = PGM_PAGE_TRANSLATION;
 	if (!rc && pte.z)
--- a/arch/s390/kvm/gaccess.h
+++ b/arch/s390/kvm/gaccess.h
@@ -387,7 +387,11 @@ void ipte_unlock(struct kvm_vcpu *vcpu);
 int ipte_lock_held(struct kvm_vcpu *vcpu);
 int kvm_s390_check_low_addr_prot_real(struct kvm_vcpu *vcpu, unsigned long gra);
 
+/* MVPG PEI indication bits */
+#define PEI_DAT_PROT 2
+#define PEI_NOT_PTE 4
+
 int kvm_s390_shadow_fault(struct kvm_vcpu *vcpu, struct gmap *shadow,
-			  unsigned long saddr);
+			  unsigned long saddr, unsigned long *datptr);
 
 #endif /* __KVM_S390_GACCESS_H */
--- a/arch/s390/kvm/vsie.c
+++ b/arch/s390/kvm/vsie.c
@@ -615,10 +615,10 @@ static int map_prefix(struct kvm_vcpu *v
 	/* with mso/msl, the prefix lies at offset *mso* */
 	prefix += scb_s->mso;
 
-	rc = kvm_s390_shadow_fault(vcpu, vsie_page->gmap, prefix);
+	rc = kvm_s390_shadow_fault(vcpu, vsie_page->gmap, prefix, NULL);
 	if (!rc && (scb_s->ecb & ECB_TE))
 		rc = kvm_s390_shadow_fault(vcpu, vsie_page->gmap,
-					   prefix + PAGE_SIZE);
+					   prefix + PAGE_SIZE, NULL);
 	/*
 	 * We don't have to mprotect, we will be called for all unshadows.
 	 * SIE will detect if protection applies and trigger a validity.
@@ -909,7 +909,7 @@ static int handle_fault(struct kvm_vcpu
 				    current->thread.gmap_addr, 1);
 
 	rc = kvm_s390_shadow_fault(vcpu, vsie_page->gmap,
-				   current->thread.gmap_addr);
+				   current->thread.gmap_addr, NULL);
 	if (rc > 0) {
 		rc = inject_fault(vcpu, rc,
 				  current->thread.gmap_addr,
@@ -931,7 +931,7 @@ static void handle_last_fault(struct kvm
 {
 	if (vsie_page->fault_addr)
 		kvm_s390_shadow_fault(vcpu, vsie_page->gmap,
-				      vsie_page->fault_addr);
+				      vsie_page->fault_addr, NULL);
 	vsie_page->fault_addr = 0;
 }
 



^ permalink raw reply	[flat|nested] 702+ messages in thread

* [PATCH 5.12 106/677] KVM: x86/mmu: Alloc page for PDPTEs when shadowing 32-bit NPT with 64-bit
  2021-05-12 14:40 [PATCH 5.12 000/677] 5.12.4-rc1 review Greg Kroah-Hartman
                   ` (104 preceding siblings ...)
  2021-05-12 14:42 ` [PATCH 5.12 105/677] KVM: s390: extend kvm_s390_shadow_fault to return entry pointer Greg Kroah-Hartman
@ 2021-05-12 14:42 ` Greg Kroah-Hartman
  2021-05-12 14:42 ` [PATCH 5.12 107/677] KVM: x86/xen: Drop RAX[63:32] when processing hypercall Greg Kroah-Hartman
                   ` (578 subsequent siblings)
  684 siblings, 0 replies; 702+ messages in thread
From: Greg Kroah-Hartman @ 2021-05-12 14:42 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Ben Gardon, Sean Christopherson,
	Paolo Bonzini

From: Sean Christopherson <seanjc@google.com>

commit 04d45551a1eefbea42655da52f56e846c0af721a upstream.

Allocate the so called pae_root page on-demand, along with the lm_root
page, when shadowing 32-bit NPT with 64-bit NPT, i.e. when running a
32-bit L1.  KVM currently only allocates the page when NPT is disabled,
or when L0 is 32-bit (using PAE paging).

Note, there is an existing memory leak involving the MMU roots, as KVM
fails to free the PAE roots on failure.  This will be addressed in a
future commit.

Fixes: ee6268ba3a68 ("KVM: x86: Skip pae_root shadow allocation if tdp enabled")
Fixes: b6b80c78af83 ("KVM: x86/mmu: Allocate PAE root array when using SVM's 32-bit NPT")
Cc: stable@vger.kernel.org
Reviewed-by: Ben Gardon <bgardon@google.com>
Signed-off-by: Sean Christopherson <seanjc@google.com>
Message-Id: <20210305011101.3597423-3-seanjc@google.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 arch/x86/kvm/mmu/mmu.c |   44 +++++++++++++++++++++++++++++---------------
 1 file changed, 29 insertions(+), 15 deletions(-)

--- a/arch/x86/kvm/mmu/mmu.c
+++ b/arch/x86/kvm/mmu/mmu.c
@@ -3193,14 +3193,14 @@ void kvm_mmu_free_roots(struct kvm_vcpu
 		if (mmu->shadow_root_level >= PT64_ROOT_4LEVEL &&
 		    (mmu->root_level >= PT64_ROOT_4LEVEL || mmu->direct_map)) {
 			mmu_free_root_page(kvm, &mmu->root_hpa, &invalid_list);
-		} else {
+		} else if (mmu->pae_root) {
 			for (i = 0; i < 4; ++i)
 				if (mmu->pae_root[i] != 0)
 					mmu_free_root_page(kvm,
 							   &mmu->pae_root[i],
 							   &invalid_list);
-			mmu->root_hpa = INVALID_PAGE;
 		}
+		mmu->root_hpa = INVALID_PAGE;
 		mmu->root_pgd = 0;
 	}
 
@@ -3312,9 +3312,23 @@ static int mmu_alloc_shadow_roots(struct
 	 * the shadow page table may be a PAE or a long mode page table.
 	 */
 	pm_mask = PT_PRESENT_MASK;
-	if (vcpu->arch.mmu->shadow_root_level == PT64_ROOT_4LEVEL)
+	if (vcpu->arch.mmu->shadow_root_level == PT64_ROOT_4LEVEL) {
 		pm_mask |= PT_ACCESSED_MASK | PT_WRITABLE_MASK | PT_USER_MASK;
 
+		/*
+		 * Allocate the page for the PDPTEs when shadowing 32-bit NPT
+		 * with 64-bit only when needed.  Unlike 32-bit NPT, it doesn't
+		 * need to be in low mem.  See also lm_root below.
+		 */
+		if (!vcpu->arch.mmu->pae_root) {
+			WARN_ON_ONCE(!tdp_enabled);
+
+			vcpu->arch.mmu->pae_root = (void *)get_zeroed_page(GFP_KERNEL_ACCOUNT);
+			if (!vcpu->arch.mmu->pae_root)
+				return -ENOMEM;
+		}
+	}
+
 	for (i = 0; i < 4; ++i) {
 		MMU_WARN_ON(VALID_PAGE(vcpu->arch.mmu->pae_root[i]));
 		if (vcpu->arch.mmu->root_level == PT32E_ROOT_LEVEL) {
@@ -3337,21 +3351,19 @@ static int mmu_alloc_shadow_roots(struct
 	vcpu->arch.mmu->root_hpa = __pa(vcpu->arch.mmu->pae_root);
 
 	/*
-	 * If we shadow a 32 bit page table with a long mode page
-	 * table we enter this path.
+	 * When shadowing 32-bit or PAE NPT with 64-bit NPT, the PML4 and PDP
+	 * tables are allocated and initialized at MMU creation as there is no
+	 * equivalent level in the guest's NPT to shadow.  Allocate the tables
+	 * on demand, as running a 32-bit L1 VMM is very rare.  The PDP is
+	 * handled above (to share logic with PAE), deal with the PML4 here.
 	 */
 	if (vcpu->arch.mmu->shadow_root_level == PT64_ROOT_4LEVEL) {
 		if (vcpu->arch.mmu->lm_root == NULL) {
-			/*
-			 * The additional page necessary for this is only
-			 * allocated on demand.
-			 */
-
 			u64 *lm_root;
 
 			lm_root = (void*)get_zeroed_page(GFP_KERNEL_ACCOUNT);
-			if (lm_root == NULL)
-				return 1;
+			if (!lm_root)
+				return -ENOMEM;
 
 			lm_root[0] = __pa(vcpu->arch.mmu->pae_root) | pm_mask;
 
@@ -5240,9 +5252,11 @@ static int __kvm_mmu_create(struct kvm_v
 	 * while the PDP table is a per-vCPU construct that's allocated at MMU
 	 * creation.  When emulating 32-bit mode, cr3 is only 32 bits even on
 	 * x86_64.  Therefore we need to allocate the PDP table in the first
-	 * 4GB of memory, which happens to fit the DMA32 zone.  Except for
-	 * SVM's 32-bit NPT support, TDP paging doesn't use PAE paging and can
-	 * skip allocating the PDP table.
+	 * 4GB of memory, which happens to fit the DMA32 zone.  TDP paging
+	 * generally doesn't use PAE paging and can skip allocating the PDP
+	 * table.  The main exception, handled here, is SVM's 32-bit NPT.  The
+	 * other exception is for shadowing L1's 32-bit or PAE NPT on 64-bit
+	 * KVM; that horror is handled on-demand by mmu_alloc_shadow_roots().
 	 */
 	if (tdp_enabled && kvm_mmu_get_tdp_level(vcpu) > PT32E_ROOT_LEVEL)
 		return 0;



^ permalink raw reply	[flat|nested] 702+ messages in thread

* [PATCH 5.12 107/677] KVM: x86/xen: Drop RAX[63:32] when processing hypercall
  2021-05-12 14:40 [PATCH 5.12 000/677] 5.12.4-rc1 review Greg Kroah-Hartman
                   ` (105 preceding siblings ...)
  2021-05-12 14:42 ` [PATCH 5.12 106/677] KVM: x86/mmu: Alloc page for PDPTEs when shadowing 32-bit NPT with 64-bit Greg Kroah-Hartman
@ 2021-05-12 14:42 ` Greg Kroah-Hartman
  2021-05-12 14:42 ` [PATCH 5.12 108/677] KVM: X86: Fix failure to boost kernel lock holder candidate in SEV-ES guests Greg Kroah-Hartman
                   ` (577 subsequent siblings)
  684 siblings, 0 replies; 702+ messages in thread
From: Greg Kroah-Hartman @ 2021-05-12 14:42 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Joao Martins, David Woodhouse,
	Sean Christopherson, Paolo Bonzini

From: Sean Christopherson <seanjc@google.com>

commit 6b48fd4cb206485c357420d91ea766ef81b20dc3 upstream.

Truncate RAX to 32 bits, i.e. consume EAX, when retrieving the hypecall
index for a Xen hypercall.  Per Xen documentation[*], the index is EAX
when the vCPU is not in 64-bit mode.

[*] http://xenbits.xenproject.org/docs/sphinx-unstable/guest-guide/x86/hypercall-abi.html

Fixes: 23200b7a30de ("KVM: x86/xen: intercept xen hypercalls if enabled")
Cc: Joao Martins <joao.m.martins@oracle.com>
Cc: David Woodhouse <dwmw@amazon.co.uk>
Cc: stable@vger.kernel.org
Signed-off-by: Sean Christopherson <seanjc@google.com>
Message-Id: <20210422022128.3464144-8-seanjc@google.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 arch/x86/kvm/xen.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

--- a/arch/x86/kvm/xen.c
+++ b/arch/x86/kvm/xen.c
@@ -673,7 +673,7 @@ int kvm_xen_hypercall(struct kvm_vcpu *v
 	bool longmode;
 	u64 input, params[6];
 
-	input = (u64)kvm_register_read(vcpu, VCPU_REGS_RAX);
+	input = (u64)kvm_register_readl(vcpu, VCPU_REGS_RAX);
 
 	/* Hyper-V hypercalls get bit 31 set in EAX */
 	if ((input & 0x80000000) &&



^ permalink raw reply	[flat|nested] 702+ messages in thread

* [PATCH 5.12 108/677] KVM: X86: Fix failure to boost kernel lock holder candidate in SEV-ES guests
  2021-05-12 14:40 [PATCH 5.12 000/677] 5.12.4-rc1 review Greg Kroah-Hartman
                   ` (106 preceding siblings ...)
  2021-05-12 14:42 ` [PATCH 5.12 107/677] KVM: x86/xen: Drop RAX[63:32] when processing hypercall Greg Kroah-Hartman
@ 2021-05-12 14:42 ` Greg Kroah-Hartman
  2021-05-12 14:42 ` [PATCH 5.12 109/677] KVM: x86: Properly handle APF vs disabled LAPIC situation Greg Kroah-Hartman
                   ` (576 subsequent siblings)
  684 siblings, 0 replies; 702+ messages in thread
From: Greg Kroah-Hartman @ 2021-05-12 14:42 UTC (permalink / raw)
  To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Wanpeng Li, Paolo Bonzini

From: Wanpeng Li <wanpengli@tencent.com>

commit b86bb11e3a79ac0db9a6786b1fe80f74321cb076 upstream.

Commit f1c6366e3043 ("KVM: SVM: Add required changes to support intercepts under
SEV-ES") prevents hypervisor accesses guest register state when the guest is
running under SEV-ES. The initial value of vcpu->arch.guest_state_protected
is false, it will not be updated in preemption notifiers after this commit which
means that the kernel spinlock lock holder will always be skipped to boost. Let's
fix it by always treating preempted is in the guest kernel mode, false positive
is better than skip completely.

Fixes: f1c6366e3043 (KVM: SVM: Add required changes to support intercepts under SEV-ES)
Signed-off-by: Wanpeng Li <wanpengli@tencent.com>
Message-Id: <1619080459-30032-1-git-send-email-wanpengli@tencent.com>
Cc: stable@vger.kernel.org
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 arch/x86/kvm/x86.c |    3 +++
 1 file changed, 3 insertions(+)

--- a/arch/x86/kvm/x86.c
+++ b/arch/x86/kvm/x86.c
@@ -11020,6 +11020,9 @@ bool kvm_arch_dy_runnable(struct kvm_vcp
 
 bool kvm_arch_vcpu_in_kernel(struct kvm_vcpu *vcpu)
 {
+	if (vcpu->arch.guest_state_protected)
+		return true;
+
 	return vcpu->arch.preempted_in_kernel;
 }
 



^ permalink raw reply	[flat|nested] 702+ messages in thread

* [PATCH 5.12 109/677] KVM: x86: Properly handle APF vs disabled LAPIC situation
  2021-05-12 14:40 [PATCH 5.12 000/677] 5.12.4-rc1 review Greg Kroah-Hartman
                   ` (107 preceding siblings ...)
  2021-05-12 14:42 ` [PATCH 5.12 108/677] KVM: X86: Fix failure to boost kernel lock holder candidate in SEV-ES guests Greg Kroah-Hartman
@ 2021-05-12 14:42 ` Greg Kroah-Hartman
  2021-05-12 14:42 ` [PATCH 5.12 110/677] KVM: x86: Check CR3 GPA for validity regardless of vCPU mode Greg Kroah-Hartman
                   ` (575 subsequent siblings)
  684 siblings, 0 replies; 702+ messages in thread
From: Greg Kroah-Hartman @ 2021-05-12 14:42 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Sebastien Boeuf, Vitaly Kuznetsov,
	Paolo Bonzini

From: Vitaly Kuznetsov <vkuznets@redhat.com>

commit 2f15d027c05fac406decdb5eceb9ec0902b68f53 upstream.

Async PF 'page ready' event may happen when LAPIC is (temporary) disabled.
In particular, Sebastien reports that when Linux kernel is directly booted
by Cloud Hypervisor, LAPIC is 'software disabled' when APF mechanism is
initialized. On initialization KVM tries to inject 'wakeup all' event and
puts the corresponding token to the slot. It is, however, failing to inject
an interrupt (kvm_apic_set_irq() -> __apic_accept_irq() -> !apic_enabled())
so the guest never gets notified and the whole APF mechanism gets stuck.
The same issue is likely to happen if the guest temporary disables LAPIC
and a previously unavailable page becomes available.

Do two things to resolve the issue:
- Avoid dequeuing 'page ready' events from APF queue when LAPIC is
  disabled.
- Trigger an attempt to deliver pending 'page ready' events when LAPIC
  becomes enabled (SPIV or MSR_IA32_APICBASE).

Reported-by: Sebastien Boeuf <sebastien.boeuf@intel.com>
Signed-off-by: Vitaly Kuznetsov <vkuznets@redhat.com>
Message-Id: <20210422092948.568327-1-vkuznets@redhat.com>
Cc: stable@vger.kernel.org
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 arch/x86/kvm/lapic.c |    6 ++++++
 arch/x86/kvm/x86.c   |    2 +-
 2 files changed, 7 insertions(+), 1 deletion(-)

--- a/arch/x86/kvm/lapic.c
+++ b/arch/x86/kvm/lapic.c
@@ -296,6 +296,10 @@ static inline void apic_set_spiv(struct
 
 		atomic_set_release(&apic->vcpu->kvm->arch.apic_map_dirty, DIRTY);
 	}
+
+	/* Check if there are APF page ready requests pending */
+	if (enabled)
+		kvm_make_request(KVM_REQ_APF_READY, apic->vcpu);
 }
 
 static inline void kvm_apic_set_xapic_id(struct kvm_lapic *apic, u8 id)
@@ -2261,6 +2265,8 @@ void kvm_lapic_set_base(struct kvm_vcpu
 		if (value & MSR_IA32_APICBASE_ENABLE) {
 			kvm_apic_set_xapic_id(apic, vcpu->vcpu_id);
 			static_branch_slow_dec_deferred(&apic_hw_disabled);
+			/* Check if there are APF page ready requests pending */
+			kvm_make_request(KVM_REQ_APF_READY, vcpu);
 		} else {
 			static_branch_inc(&apic_hw_disabled.key);
 			atomic_set_release(&apic->vcpu->kvm->arch.apic_map_dirty, DIRTY);
--- a/arch/x86/kvm/x86.c
+++ b/arch/x86/kvm/x86.c
@@ -11293,7 +11293,7 @@ bool kvm_arch_can_dequeue_async_page_pre
 	if (!kvm_pv_async_pf_enabled(vcpu))
 		return true;
 	else
-		return apf_pageready_slot_free(vcpu);
+		return kvm_lapic_enabled(vcpu) && apf_pageready_slot_free(vcpu);
 }
 
 void kvm_arch_start_assignment(struct kvm *kvm)



^ permalink raw reply	[flat|nested] 702+ messages in thread

* [PATCH 5.12 110/677] KVM: x86: Check CR3 GPA for validity regardless of vCPU mode
  2021-05-12 14:40 [PATCH 5.12 000/677] 5.12.4-rc1 review Greg Kroah-Hartman
                   ` (108 preceding siblings ...)
  2021-05-12 14:42 ` [PATCH 5.12 109/677] KVM: x86: Properly handle APF vs disabled LAPIC situation Greg Kroah-Hartman
@ 2021-05-12 14:42 ` Greg Kroah-Hartman
  2021-05-12 14:42 ` [PATCH 5.12 111/677] KVM: x86: Remove emulators broken checks on CR0/CR3/CR4 loads Greg Kroah-Hartman
                   ` (574 subsequent siblings)
  684 siblings, 0 replies; 702+ messages in thread
From: Greg Kroah-Hartman @ 2021-05-12 14:42 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Sean Christopherson, Paolo Bonzini

From: Sean Christopherson <seanjc@google.com>

commit 886bbcc7a523b8d4fac60f1015d2e0fcad50db82 upstream.

Check CR3 for an invalid GPA even if the vCPU isn't in long mode.  For
bigger emulation flows, notably RSM, the vCPU mode may not be accurate
if CR0/CR4 are loaded after CR3.  For MOV CR3 and similar flows, the
caller is responsible for truncating the value.

Fixes: 660a5d517aaa ("KVM: x86: save/load state on SMM switch")
Cc: stable@vger.kernel.org
Signed-off-by: Sean Christopherson <seanjc@google.com>
Message-Id: <20210422022128.3464144-3-seanjc@google.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 arch/x86/kvm/x86.c |   11 ++++++++---
 1 file changed, 8 insertions(+), 3 deletions(-)

--- a/arch/x86/kvm/x86.c
+++ b/arch/x86/kvm/x86.c
@@ -1072,10 +1072,15 @@ int kvm_set_cr3(struct kvm_vcpu *vcpu, u
 		return 0;
 	}
 
-	if (is_long_mode(vcpu) && kvm_vcpu_is_illegal_gpa(vcpu, cr3))
+	/*
+	 * Do not condition the GPA check on long mode, this helper is used to
+	 * stuff CR3, e.g. for RSM emulation, and there is no guarantee that
+	 * the current vCPU mode is accurate.
+	 */
+	if (kvm_vcpu_is_illegal_gpa(vcpu, cr3))
 		return 1;
-	else if (is_pae_paging(vcpu) &&
-		 !load_pdptrs(vcpu, vcpu->arch.walk_mmu, cr3))
+
+	if (is_pae_paging(vcpu) && !load_pdptrs(vcpu, vcpu->arch.walk_mmu, cr3))
 		return 1;
 
 	kvm_mmu_new_pgd(vcpu, cr3, skip_tlb_flush, skip_tlb_flush);



^ permalink raw reply	[flat|nested] 702+ messages in thread

* [PATCH 5.12 111/677] KVM: x86: Remove emulators broken checks on CR0/CR3/CR4 loads
  2021-05-12 14:40 [PATCH 5.12 000/677] 5.12.4-rc1 review Greg Kroah-Hartman
                   ` (109 preceding siblings ...)
  2021-05-12 14:42 ` [PATCH 5.12 110/677] KVM: x86: Check CR3 GPA for validity regardless of vCPU mode Greg Kroah-Hartman
@ 2021-05-12 14:42 ` Greg Kroah-Hartman
  2021-05-12 14:42 ` [PATCH 5.12 112/677] KVM: nSVM: Set the shadow root level to the TDP level for nested NPT Greg Kroah-Hartman
                   ` (573 subsequent siblings)
  684 siblings, 0 replies; 702+ messages in thread
From: Greg Kroah-Hartman @ 2021-05-12 14:42 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Babu Moger, Sean Christopherson,
	Paolo Bonzini

From: Sean Christopherson <seanjc@google.com>

commit d0fe7b6404408835ed60232cb3bf28324b2f95db upstream.

Remove the emulator's checks for illegal CR0, CR3, and CR4 values, as
the checks are redundant, outdated, and in the case of SEV's C-bit,
broken.  The emulator manually calculates MAXPHYADDR from CPUID and
neglects to mask off the C-bit.  For all other checks, kvm_set_cr*() are
a superset of the emulator checks, e.g. see CR4.LA57.

Fixes: a780a3ea6282 ("KVM: X86: Fix reserved bits check for MOV to CR3")
Cc: Babu Moger <babu.moger@amd.com>
Signed-off-by: Sean Christopherson <seanjc@google.com>
Message-Id: <20210422022128.3464144-2-seanjc@google.com>
Cc: stable@vger.kernel.org
[Unify check_cr_read and check_cr_write. - Paolo]
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 arch/x86/kvm/emulate.c |   80 +------------------------------------------------
 1 file changed, 3 insertions(+), 77 deletions(-)

--- a/arch/x86/kvm/emulate.c
+++ b/arch/x86/kvm/emulate.c
@@ -4220,7 +4220,7 @@ static bool valid_cr(int nr)
 	}
 }
 
-static int check_cr_read(struct x86_emulate_ctxt *ctxt)
+static int check_cr_access(struct x86_emulate_ctxt *ctxt)
 {
 	if (!valid_cr(ctxt->modrm_reg))
 		return emulate_ud(ctxt);
@@ -4228,80 +4228,6 @@ static int check_cr_read(struct x86_emul
 	return X86EMUL_CONTINUE;
 }
 
-static int check_cr_write(struct x86_emulate_ctxt *ctxt)
-{
-	u64 new_val = ctxt->src.val64;
-	int cr = ctxt->modrm_reg;
-	u64 efer = 0;
-
-	static u64 cr_reserved_bits[] = {
-		0xffffffff00000000ULL,
-		0, 0, 0, /* CR3 checked later */
-		CR4_RESERVED_BITS,
-		0, 0, 0,
-		CR8_RESERVED_BITS,
-	};
-
-	if (!valid_cr(cr))
-		return emulate_ud(ctxt);
-
-	if (new_val & cr_reserved_bits[cr])
-		return emulate_gp(ctxt, 0);
-
-	switch (cr) {
-	case 0: {
-		u64 cr4;
-		if (((new_val & X86_CR0_PG) && !(new_val & X86_CR0_PE)) ||
-		    ((new_val & X86_CR0_NW) && !(new_val & X86_CR0_CD)))
-			return emulate_gp(ctxt, 0);
-
-		cr4 = ctxt->ops->get_cr(ctxt, 4);
-		ctxt->ops->get_msr(ctxt, MSR_EFER, &efer);
-
-		if ((new_val & X86_CR0_PG) && (efer & EFER_LME) &&
-		    !(cr4 & X86_CR4_PAE))
-			return emulate_gp(ctxt, 0);
-
-		break;
-		}
-	case 3: {
-		u64 rsvd = 0;
-
-		ctxt->ops->get_msr(ctxt, MSR_EFER, &efer);
-		if (efer & EFER_LMA) {
-			u64 maxphyaddr;
-			u32 eax, ebx, ecx, edx;
-
-			eax = 0x80000008;
-			ecx = 0;
-			if (ctxt->ops->get_cpuid(ctxt, &eax, &ebx, &ecx,
-						 &edx, true))
-				maxphyaddr = eax & 0xff;
-			else
-				maxphyaddr = 36;
-			rsvd = rsvd_bits(maxphyaddr, 63);
-			if (ctxt->ops->get_cr(ctxt, 4) & X86_CR4_PCIDE)
-				rsvd &= ~X86_CR3_PCID_NOFLUSH;
-		}
-
-		if (new_val & rsvd)
-			return emulate_gp(ctxt, 0);
-
-		break;
-		}
-	case 4: {
-		ctxt->ops->get_msr(ctxt, MSR_EFER, &efer);
-
-		if ((efer & EFER_LMA) && !(new_val & X86_CR4_PAE))
-			return emulate_gp(ctxt, 0);
-
-		break;
-		}
-	}
-
-	return X86EMUL_CONTINUE;
-}
-
 static int check_dr7_gd(struct x86_emulate_ctxt *ctxt)
 {
 	unsigned long dr7;
@@ -4841,10 +4767,10 @@ static const struct opcode twobyte_table
 	D(ImplicitOps | ModRM | SrcMem | NoAccess), /* 8 * reserved NOP */
 	D(ImplicitOps | ModRM | SrcMem | NoAccess), /* NOP + 7 * reserved NOP */
 	/* 0x20 - 0x2F */
-	DIP(ModRM | DstMem | Priv | Op3264 | NoMod, cr_read, check_cr_read),
+	DIP(ModRM | DstMem | Priv | Op3264 | NoMod, cr_read, check_cr_access),
 	DIP(ModRM | DstMem | Priv | Op3264 | NoMod, dr_read, check_dr_read),
 	IIP(ModRM | SrcMem | Priv | Op3264 | NoMod, em_cr_write, cr_write,
-						check_cr_write),
+						check_cr_access),
 	IIP(ModRM | SrcMem | Priv | Op3264 | NoMod, em_dr_write, dr_write,
 						check_dr_write),
 	N, N, N, N,



^ permalink raw reply	[flat|nested] 702+ messages in thread

* [PATCH 5.12 112/677] KVM: nSVM: Set the shadow root level to the TDP level for nested NPT
  2021-05-12 14:40 [PATCH 5.12 000/677] 5.12.4-rc1 review Greg Kroah-Hartman
                   ` (110 preceding siblings ...)
  2021-05-12 14:42 ` [PATCH 5.12 111/677] KVM: x86: Remove emulators broken checks on CR0/CR3/CR4 loads Greg Kroah-Hartman
@ 2021-05-12 14:42 ` Greg Kroah-Hartman
  2021-05-12 14:42 ` [PATCH 5.12 113/677] KVM: SVM: Dont strip the C-bit from CR2 on #PF interception Greg Kroah-Hartman
                   ` (572 subsequent siblings)
  684 siblings, 0 replies; 702+ messages in thread
From: Greg Kroah-Hartman @ 2021-05-12 14:42 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Sean Christopherson, Paolo Bonzini

From: Sean Christopherson <seanjc@google.com>

commit a3322d5cd87fef5ec0037fd1b14068a533f9a60f upstream.

Override the shadow root level in the MMU context when configuring
NPT for shadowing nested NPT.  The level is always tied to the TDP level
of the host, not whatever level the guest happens to be using.

Fixes: 096586fda522 ("KVM: nSVM: Correctly set the shadow NPT root level in its MMU role")
Cc: stable@vger.kernel.org
Signed-off-by: Sean Christopherson <seanjc@google.com>
Message-Id: <20210305011101.3597423-2-seanjc@google.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 arch/x86/kvm/mmu/mmu.c |   11 ++++++++---
 1 file changed, 8 insertions(+), 3 deletions(-)

--- a/arch/x86/kvm/mmu/mmu.c
+++ b/arch/x86/kvm/mmu/mmu.c
@@ -4627,12 +4627,17 @@ void kvm_init_shadow_npt_mmu(struct kvm_
 	struct kvm_mmu *context = &vcpu->arch.guest_mmu;
 	union kvm_mmu_role new_role = kvm_calc_shadow_npt_root_page_role(vcpu);
 
-	context->shadow_root_level = new_role.base.level;
-
 	__kvm_mmu_new_pgd(vcpu, nested_cr3, new_role.base, false, false);
 
-	if (new_role.as_u64 != context->mmu_role.as_u64)
+	if (new_role.as_u64 != context->mmu_role.as_u64) {
 		shadow_mmu_init_context(vcpu, context, cr0, cr4, efer, new_role);
+
+		/*
+		 * Override the level set by the common init helper, nested TDP
+		 * always uses the host's TDP configuration.
+		 */
+		context->shadow_root_level = new_role.base.level;
+	}
 }
 EXPORT_SYMBOL_GPL(kvm_init_shadow_npt_mmu);
 



^ permalink raw reply	[flat|nested] 702+ messages in thread

* [PATCH 5.12 113/677] KVM: SVM: Dont strip the C-bit from CR2 on #PF interception
  2021-05-12 14:40 [PATCH 5.12 000/677] 5.12.4-rc1 review Greg Kroah-Hartman
                   ` (111 preceding siblings ...)
  2021-05-12 14:42 ` [PATCH 5.12 112/677] KVM: nSVM: Set the shadow root level to the TDP level for nested NPT Greg Kroah-Hartman
@ 2021-05-12 14:42 ` Greg Kroah-Hartman
  2021-05-12 14:42 ` [PATCH 5.12 114/677] KVM: SVM: Use online_vcpus, not created_vcpus, to iterate over vCPUs Greg Kroah-Hartman
                   ` (571 subsequent siblings)
  684 siblings, 0 replies; 702+ messages in thread
From: Greg Kroah-Hartman @ 2021-05-12 14:42 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Brijesh Singh, Tom Lendacky,
	Sean Christopherson, Paolo Bonzini

From: Sean Christopherson <seanjc@google.com>

commit 6d1b867d045699d6ce0dfa0ef35d1b87dd36db56 upstream.

Don't strip the C-bit from the faulting address on an intercepted #PF,
the address is a virtual address, not a physical address.

Fixes: 0ede79e13224 ("KVM: SVM: Clear C-bit from the page fault address")
Cc: stable@vger.kernel.org
Cc: Brijesh Singh <brijesh.singh@amd.com>
Cc: Tom Lendacky <thomas.lendacky@amd.com>
Signed-off-by: Sean Christopherson <seanjc@google.com>
Message-Id: <20210305011101.3597423-13-seanjc@google.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 arch/x86/kvm/svm/svm.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

--- a/arch/x86/kvm/svm/svm.c
+++ b/arch/x86/kvm/svm/svm.c
@@ -1898,7 +1898,7 @@ static void svm_set_dr7(struct kvm_vcpu
 
 static int pf_interception(struct vcpu_svm *svm)
 {
-	u64 fault_address = __sme_clr(svm->vmcb->control.exit_info_2);
+	u64 fault_address = svm->vmcb->control.exit_info_2;
 	u64 error_code = svm->vmcb->control.exit_info_1;
 
 	return kvm_handle_page_fault(&svm->vcpu, error_code, fault_address,



^ permalink raw reply	[flat|nested] 702+ messages in thread

* [PATCH 5.12 114/677] KVM: SVM: Use online_vcpus, not created_vcpus, to iterate over vCPUs
  2021-05-12 14:40 [PATCH 5.12 000/677] 5.12.4-rc1 review Greg Kroah-Hartman
                   ` (112 preceding siblings ...)
  2021-05-12 14:42 ` [PATCH 5.12 113/677] KVM: SVM: Dont strip the C-bit from CR2 on #PF interception Greg Kroah-Hartman
@ 2021-05-12 14:42 ` Greg Kroah-Hartman
  2021-05-12 14:42 ` [PATCH 5.12 115/677] KVM: SVM: Do not set sev->es_active until KVM_SEV_ES_INIT completes Greg Kroah-Hartman
                   ` (570 subsequent siblings)
  684 siblings, 0 replies; 702+ messages in thread
From: Greg Kroah-Hartman @ 2021-05-12 14:42 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Brijesh Singh, Tom Lendacky,
	Sean Christopherson, Paolo Bonzini

From: Sean Christopherson <seanjc@google.com>

commit c36b16d29f3af5f32fc1b2a3401bf48f71cabee1 upstream.

Use the kvm_for_each_vcpu() helper to iterate over vCPUs when encrypting
VMSAs for SEV, which effectively switches to use online_vcpus instead of
created_vcpus.  This fixes a possible null-pointer dereference as
created_vcpus does not guarantee a vCPU exists, since it is updated at
the very beginning of KVM_CREATE_VCPU.  created_vcpus exists to allow the
bulk of vCPU creation to run in parallel, while still correctly
restricting the max number of max vCPUs.

Fixes: ad73109ae7ec ("KVM: SVM: Provide support to launch and run an SEV-ES guest")
Cc: stable@vger.kernel.org
Cc: Brijesh Singh <brijesh.singh@amd.com>
Cc: Tom Lendacky <thomas.lendacky@amd.com>
Signed-off-by: Sean Christopherson <seanjc@google.com>
Message-Id: <20210331031936.2495277-2-seanjc@google.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 arch/x86/kvm/svm/sev.c |    5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

--- a/arch/x86/kvm/svm/sev.c
+++ b/arch/x86/kvm/svm/sev.c
@@ -564,6 +564,7 @@ static int sev_launch_update_vmsa(struct
 {
 	struct kvm_sev_info *sev = &to_kvm_svm(kvm)->sev_info;
 	struct sev_data_launch_update_vmsa *vmsa;
+	struct kvm_vcpu *vcpu;
 	int i, ret;
 
 	if (!sev_es_guest(kvm))
@@ -573,8 +574,8 @@ static int sev_launch_update_vmsa(struct
 	if (!vmsa)
 		return -ENOMEM;
 
-	for (i = 0; i < kvm->created_vcpus; i++) {
-		struct vcpu_svm *svm = to_svm(kvm->vcpus[i]);
+	kvm_for_each_vcpu(i, vcpu, kvm) {
+		struct vcpu_svm *svm = to_svm(vcpu);
 
 		/* Perform some pre-encryption checks against the VMSA */
 		ret = sev_es_sync_vmsa(svm);



^ permalink raw reply	[flat|nested] 702+ messages in thread

* [PATCH 5.12 115/677] KVM: SVM: Do not set sev->es_active until KVM_SEV_ES_INIT completes
  2021-05-12 14:40 [PATCH 5.12 000/677] 5.12.4-rc1 review Greg Kroah-Hartman
                   ` (113 preceding siblings ...)
  2021-05-12 14:42 ` [PATCH 5.12 114/677] KVM: SVM: Use online_vcpus, not created_vcpus, to iterate over vCPUs Greg Kroah-Hartman
@ 2021-05-12 14:42 ` Greg Kroah-Hartman
  2021-05-12 14:42 ` [PATCH 5.12 116/677] KVM: SVM: Do not allow SEV/SEV-ES initialization after vCPUs are created Greg Kroah-Hartman
                   ` (569 subsequent siblings)
  684 siblings, 0 replies; 702+ messages in thread
From: Greg Kroah-Hartman @ 2021-05-12 14:42 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Brijesh Singh, Tom Lendacky,
	Sean Christopherson, Paolo Bonzini

From: Sean Christopherson <seanjc@google.com>

commit 9fa1521daafb58d878d03d75f6863a11312fae22 upstream.

Set sev->es_active only after the guts of KVM_SEV_ES_INIT succeeds.  If
the command fails, e.g. because SEV is already active or there are no
available ASIDs, then es_active will be left set even though the VM is
not fully SEV-ES capable.

Refactor the code so that "es_active" is passed on the stack instead of
being prematurely shoved into sev_info, both to avoid having to unwind
sev_info and so that it's more obvious what actually consumes es_active
in sev_guest_init() and its helpers.

Fixes: ad73109ae7ec ("KVM: SVM: Provide support to launch and run an SEV-ES guest")
Cc: stable@vger.kernel.org
Cc: Brijesh Singh <brijesh.singh@amd.com>
Cc: Tom Lendacky <thomas.lendacky@amd.com>
Signed-off-by: Sean Christopherson <seanjc@google.com>
Message-Id: <20210331031936.2495277-3-seanjc@google.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 arch/x86/kvm/svm/sev.c |   29 ++++++++++++-----------------
 1 file changed, 12 insertions(+), 17 deletions(-)

--- a/arch/x86/kvm/svm/sev.c
+++ b/arch/x86/kvm/svm/sev.c
@@ -87,7 +87,7 @@ static bool __sev_recycle_asids(int min_
 	return true;
 }
 
-static int sev_asid_new(struct kvm_sev_info *sev)
+static int sev_asid_new(bool es_active)
 {
 	int pos, min_asid, max_asid;
 	bool retry = true;
@@ -98,8 +98,8 @@ static int sev_asid_new(struct kvm_sev_i
 	 * SEV-enabled guests must use asid from min_sev_asid to max_sev_asid.
 	 * SEV-ES-enabled guest can use from 1 to min_sev_asid - 1.
 	 */
-	min_asid = sev->es_active ? 0 : min_sev_asid - 1;
-	max_asid = sev->es_active ? min_sev_asid - 1 : max_sev_asid;
+	min_asid = es_active ? 0 : min_sev_asid - 1;
+	max_asid = es_active ? min_sev_asid - 1 : max_sev_asid;
 again:
 	pos = find_next_zero_bit(sev_asid_bitmap, max_sev_asid, min_asid);
 	if (pos >= max_asid) {
@@ -179,13 +179,14 @@ static void sev_unbind_asid(struct kvm *
 static int sev_guest_init(struct kvm *kvm, struct kvm_sev_cmd *argp)
 {
 	struct kvm_sev_info *sev = &to_kvm_svm(kvm)->sev_info;
+	bool es_active = argp->id == KVM_SEV_ES_INIT;
 	int asid, ret;
 
 	ret = -EBUSY;
 	if (unlikely(sev->active))
 		return ret;
 
-	asid = sev_asid_new(sev);
+	asid = sev_asid_new(es_active);
 	if (asid < 0)
 		return ret;
 
@@ -194,6 +195,7 @@ static int sev_guest_init(struct kvm *kv
 		goto e_free;
 
 	sev->active = true;
+	sev->es_active = es_active;
 	sev->asid = asid;
 	INIT_LIST_HEAD(&sev->regions_list);
 
@@ -204,16 +206,6 @@ e_free:
 	return ret;
 }
 
-static int sev_es_guest_init(struct kvm *kvm, struct kvm_sev_cmd *argp)
-{
-	if (!sev_es)
-		return -ENOTTY;
-
-	to_kvm_svm(kvm)->sev_info.es_active = true;
-
-	return sev_guest_init(kvm, argp);
-}
-
 static int sev_bind_asid(struct kvm *kvm, unsigned int handle, int *error)
 {
 	struct sev_data_activate *data;
@@ -1128,12 +1120,15 @@ int svm_mem_enc_op(struct kvm *kvm, void
 	mutex_lock(&kvm->lock);
 
 	switch (sev_cmd.id) {
+	case KVM_SEV_ES_INIT:
+		if (!sev_es) {
+			r = -ENOTTY;
+			goto out;
+		}
+		fallthrough;
 	case KVM_SEV_INIT:
 		r = sev_guest_init(kvm, &sev_cmd);
 		break;
-	case KVM_SEV_ES_INIT:
-		r = sev_es_guest_init(kvm, &sev_cmd);
-		break;
 	case KVM_SEV_LAUNCH_START:
 		r = sev_launch_start(kvm, &sev_cmd);
 		break;



^ permalink raw reply	[flat|nested] 702+ messages in thread

* [PATCH 5.12 116/677] KVM: SVM: Do not allow SEV/SEV-ES initialization after vCPUs are created
  2021-05-12 14:40 [PATCH 5.12 000/677] 5.12.4-rc1 review Greg Kroah-Hartman
                   ` (114 preceding siblings ...)
  2021-05-12 14:42 ` [PATCH 5.12 115/677] KVM: SVM: Do not set sev->es_active until KVM_SEV_ES_INIT completes Greg Kroah-Hartman
@ 2021-05-12 14:42 ` Greg Kroah-Hartman
  2021-05-12 14:42 ` [PATCH 5.12 117/677] KVM: SVM: Inject #GP on guest MSR_TSC_AUX accesses if RDTSCP unsupported Greg Kroah-Hartman
                   ` (568 subsequent siblings)
  684 siblings, 0 replies; 702+ messages in thread
From: Greg Kroah-Hartman @ 2021-05-12 14:42 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Brijesh Singh, Tom Lendacky,
	Sean Christopherson, Paolo Bonzini

From: Sean Christopherson <seanjc@google.com>

commit 8727906fde6ea665b52e68ddc58833772537f40a upstream.

Reject KVM_SEV_INIT and KVM_SEV_ES_INIT if they are attempted after one
or more vCPUs have been created.  KVM assumes a VM is tagged SEV/SEV-ES
prior to vCPU creation, e.g. init_vmcb() needs to mark the VMCB as SEV
enabled, and svm_create_vcpu() needs to allocate the VMSA.  At best,
creating vCPUs before SEV/SEV-ES init will lead to unexpected errors
and/or behavior, and at worst it will crash the host, e.g.
sev_launch_update_vmsa() will dereference a null svm->vmsa pointer.

Fixes: 1654efcbc431 ("KVM: SVM: Add KVM_SEV_INIT command")
Fixes: ad73109ae7ec ("KVM: SVM: Provide support to launch and run an SEV-ES guest")
Cc: stable@vger.kernel.org
Cc: Brijesh Singh <brijesh.singh@amd.com>
Cc: Tom Lendacky <thomas.lendacky@amd.com>
Signed-off-by: Sean Christopherson <seanjc@google.com>
Message-Id: <20210331031936.2495277-4-seanjc@google.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 arch/x86/kvm/svm/sev.c |    3 +++
 1 file changed, 3 insertions(+)

--- a/arch/x86/kvm/svm/sev.c
+++ b/arch/x86/kvm/svm/sev.c
@@ -182,6 +182,9 @@ static int sev_guest_init(struct kvm *kv
 	bool es_active = argp->id == KVM_SEV_ES_INIT;
 	int asid, ret;
 
+	if (kvm->created_vcpus)
+		return -EINVAL;
+
 	ret = -EBUSY;
 	if (unlikely(sev->active))
 		return ret;



^ permalink raw reply	[flat|nested] 702+ messages in thread

* [PATCH 5.12 117/677] KVM: SVM: Inject #GP on guest MSR_TSC_AUX accesses if RDTSCP unsupported
  2021-05-12 14:40 [PATCH 5.12 000/677] 5.12.4-rc1 review Greg Kroah-Hartman
                   ` (115 preceding siblings ...)
  2021-05-12 14:42 ` [PATCH 5.12 116/677] KVM: SVM: Do not allow SEV/SEV-ES initialization after vCPUs are created Greg Kroah-Hartman
@ 2021-05-12 14:42 ` Greg Kroah-Hartman
  2021-05-12 14:42 ` [PATCH 5.12 118/677] KVM: nVMX: Defer the MMU reload to the normal path on an EPTP switch Greg Kroah-Hartman
                   ` (567 subsequent siblings)
  684 siblings, 0 replies; 702+ messages in thread
From: Greg Kroah-Hartman @ 2021-05-12 14:42 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Sean Christopherson,
	Vitaly Kuznetsov, Paolo Bonzini

From: Sean Christopherson <seanjc@google.com>

commit 6f2b296aa6432d8274e258cc3220047ca04f5de0 upstream.

Inject #GP on guest accesses to MSR_TSC_AUX if RDTSCP is unsupported in
the guest's CPUID model.

Fixes: 46896c73c1a4 ("KVM: svm: add support for RDTSCP")
Cc: stable@vger.kernel.org
Signed-off-by: Sean Christopherson <seanjc@google.com>
Message-Id: <20210423223404.3860547-2-seanjc@google.com>
Reviewed-by: Vitaly Kuznetsov <vkuznets@redhat.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 arch/x86/kvm/svm/svm.c |    7 +++++++
 1 file changed, 7 insertions(+)

--- a/arch/x86/kvm/svm/svm.c
+++ b/arch/x86/kvm/svm/svm.c
@@ -2738,6 +2738,9 @@ static int svm_get_msr(struct kvm_vcpu *
 	case MSR_TSC_AUX:
 		if (!boot_cpu_has(X86_FEATURE_RDTSCP))
 			return 1;
+		if (!msr_info->host_initiated &&
+		    !guest_cpuid_has(vcpu, X86_FEATURE_RDTSCP))
+			return 1;
 		msr_info->data = svm->tsc_aux;
 		break;
 	/*
@@ -2946,6 +2949,10 @@ static int svm_set_msr(struct kvm_vcpu *
 		if (!boot_cpu_has(X86_FEATURE_RDTSCP))
 			return 1;
 
+		if (!msr->host_initiated &&
+		    !guest_cpuid_has(vcpu, X86_FEATURE_RDTSCP))
+			return 1;
+
 		/*
 		 * This is rare, so we update the MSR here instead of using
 		 * direct_access_msrs.  Doing that would require a rdmsr in



^ permalink raw reply	[flat|nested] 702+ messages in thread

* [PATCH 5.12 118/677] KVM: nVMX: Defer the MMU reload to the normal path on an EPTP switch
  2021-05-12 14:40 [PATCH 5.12 000/677] 5.12.4-rc1 review Greg Kroah-Hartman
                   ` (116 preceding siblings ...)
  2021-05-12 14:42 ` [PATCH 5.12 117/677] KVM: SVM: Inject #GP on guest MSR_TSC_AUX accesses if RDTSCP unsupported Greg Kroah-Hartman
@ 2021-05-12 14:42 ` Greg Kroah-Hartman
  2021-05-12 14:42 ` [PATCH 5.12 119/677] KVM: VMX: Truncate GPR value for DR and CR reads in !64-bit mode Greg Kroah-Hartman
                   ` (566 subsequent siblings)
  684 siblings, 0 replies; 702+ messages in thread
From: Greg Kroah-Hartman @ 2021-05-12 14:42 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Sean Christopherson, Paolo Bonzini

From: Sean Christopherson <seanjc@google.com>

commit c805f5d5585ab5e0cdac6b1ccf7086eb120fb7db upstream.

Defer reloading the MMU after a EPTP successful EPTP switch.  The VMFUNC
instruction itself is executed in the previous EPTP context, any side
effects, e.g. updating RIP, should occur in the old context.  Practically
speaking, this bug is benign as VMX doesn't touch the MMU when skipping
an emulated instruction, nor does queuing a single-step #DB.  No other
post-switch side effects exist.

Fixes: 41ab93727467 ("KVM: nVMX: Emulate EPTP switching for the L1 hypervisor")
Cc: stable@vger.kernel.org
Signed-off-by: Sean Christopherson <seanjc@google.com>
Message-Id: <20210305011101.3597423-14-seanjc@google.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 arch/x86/kvm/vmx/nested.c |    9 ++-------
 1 file changed, 2 insertions(+), 7 deletions(-)

--- a/arch/x86/kvm/vmx/nested.c
+++ b/arch/x86/kvm/vmx/nested.c
@@ -5479,16 +5479,11 @@ static int nested_vmx_eptp_switching(str
 		if (!nested_vmx_check_eptp(vcpu, new_eptp))
 			return 1;
 
-		kvm_mmu_unload(vcpu);
 		mmu->ept_ad = accessed_dirty;
 		mmu->mmu_role.base.ad_disabled = !accessed_dirty;
 		vmcs12->ept_pointer = new_eptp;
-		/*
-		 * TODO: Check what's the correct approach in case
-		 * mmu reload fails. Currently, we just let the next
-		 * reload potentially fail
-		 */
-		kvm_mmu_reload(vcpu);
+
+		kvm_make_request(KVM_REQ_MMU_RELOAD, vcpu);
 	}
 
 	return 0;



^ permalink raw reply	[flat|nested] 702+ messages in thread

* [PATCH 5.12 119/677] KVM: VMX: Truncate GPR value for DR and CR reads in !64-bit mode
  2021-05-12 14:40 [PATCH 5.12 000/677] 5.12.4-rc1 review Greg Kroah-Hartman
                   ` (117 preceding siblings ...)
  2021-05-12 14:42 ` [PATCH 5.12 118/677] KVM: nVMX: Defer the MMU reload to the normal path on an EPTP switch Greg Kroah-Hartman
@ 2021-05-12 14:42 ` Greg Kroah-Hartman
  2021-05-12 14:42 ` [PATCH 5.12 120/677] KVM: nVMX: Truncate bits 63:32 of VMCS field on nested check in !64-bit Greg Kroah-Hartman
                   ` (565 subsequent siblings)
  684 siblings, 0 replies; 702+ messages in thread
From: Greg Kroah-Hartman @ 2021-05-12 14:42 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Sean Christopherson, Paolo Bonzini

From: Sean Christopherson <seanjc@google.com>

commit d8971344f5739a9cc53f91f1f593ddd82265b93b upstream.

Drop bits 63:32 when storing a DR/CR to a GPR when the vCPU is not in
64-bit mode.  Per the SDM:

  The operand size for these instructions is always 32 bits in non-64-bit
  modes, regardless of the operand-size attribute.

CR8 technically isn't affected as CR8 isn't accessible outside of 64-bit
mode, but fix it up for consistency and to allow for future cleanup.

Fixes: 6aa8b732ca01 ("[PATCH] kvm: userspace interface")
Cc: stable@vger.kernel.org
Signed-off-by: Sean Christopherson <seanjc@google.com>
Message-Id: <20210422022128.3464144-5-seanjc@google.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 arch/x86/kvm/vmx/vmx.c |    6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

--- a/arch/x86/kvm/vmx/vmx.c
+++ b/arch/x86/kvm/vmx/vmx.c
@@ -5062,12 +5062,12 @@ static int handle_cr(struct kvm_vcpu *vc
 		case 3:
 			WARN_ON_ONCE(enable_unrestricted_guest);
 			val = kvm_read_cr3(vcpu);
-			kvm_register_write(vcpu, reg, val);
+			kvm_register_writel(vcpu, reg, val);
 			trace_kvm_cr_read(cr, val);
 			return kvm_skip_emulated_instruction(vcpu);
 		case 8:
 			val = kvm_get_cr8(vcpu);
-			kvm_register_write(vcpu, reg, val);
+			kvm_register_writel(vcpu, reg, val);
 			trace_kvm_cr_read(cr, val);
 			return kvm_skip_emulated_instruction(vcpu);
 		}
@@ -5140,7 +5140,7 @@ static int handle_dr(struct kvm_vcpu *vc
 		unsigned long val;
 
 		kvm_get_dr(vcpu, dr, &val);
-		kvm_register_write(vcpu, reg, val);
+		kvm_register_writel(vcpu, reg, val);
 		err = 0;
 	} else {
 		err = kvm_set_dr(vcpu, dr, kvm_register_readl(vcpu, reg));



^ permalink raw reply	[flat|nested] 702+ messages in thread

* [PATCH 5.12 120/677] KVM: nVMX: Truncate bits 63:32 of VMCS field on nested check in !64-bit
  2021-05-12 14:40 [PATCH 5.12 000/677] 5.12.4-rc1 review Greg Kroah-Hartman
                   ` (118 preceding siblings ...)
  2021-05-12 14:42 ` [PATCH 5.12 119/677] KVM: VMX: Truncate GPR value for DR and CR reads in !64-bit mode Greg Kroah-Hartman
@ 2021-05-12 14:42 ` Greg Kroah-Hartman
  2021-05-12 14:42 ` [PATCH 5.12 121/677] KVM: nVMX: Truncate base/index GPR value on address calc " Greg Kroah-Hartman
                   ` (564 subsequent siblings)
  684 siblings, 0 replies; 702+ messages in thread
From: Greg Kroah-Hartman @ 2021-05-12 14:42 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Sean Christopherson, Paolo Bonzini

From: Sean Christopherson <seanjc@google.com>

commit ee050a577523dfd5fac95e6cc182ebe0293ead59 upstream.

Drop bits 63:32 of the VMCS field encoding when checking for a nested
VM-Exit on VMREAD/VMWRITE in !64-bit mode.  VMREAD and VMWRITE always
use 32-bit operands outside of 64-bit mode.

The actual emulation of VMREAD/VMWRITE does the right thing, this bug is
purely limited to incorrectly causing a nested VM-Exit if a GPR happens
to have bits 63:32 set outside of 64-bit mode.

Fixes: a7cde481b6e8 ("KVM: nVMX: Do not forward VMREAD/VMWRITE VMExits to L1 if required so by vmcs12 vmread/vmwrite bitmaps")
Cc: stable@vger.kernel.org
Signed-off-by: Sean Christopherson <seanjc@google.com>
Message-Id: <20210422022128.3464144-6-seanjc@google.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 arch/x86/kvm/vmx/nested.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

--- a/arch/x86/kvm/vmx/nested.c
+++ b/arch/x86/kvm/vmx/nested.c
@@ -5712,7 +5712,7 @@ static bool nested_vmx_exit_handled_vmcs
 
 	/* Decode instruction info and find the field to access */
 	vmx_instruction_info = vmcs_read32(VMX_INSTRUCTION_INFO);
-	field = kvm_register_read(vcpu, (((vmx_instruction_info) >> 28) & 0xf));
+	field = kvm_register_readl(vcpu, (((vmx_instruction_info) >> 28) & 0xf));
 
 	/* Out-of-range fields always cause a VM exit from L2 to L1 */
 	if (field >> 15)



^ permalink raw reply	[flat|nested] 702+ messages in thread

* [PATCH 5.12 121/677] KVM: nVMX: Truncate base/index GPR value on address calc in !64-bit
  2021-05-12 14:40 [PATCH 5.12 000/677] 5.12.4-rc1 review Greg Kroah-Hartman
                   ` (119 preceding siblings ...)
  2021-05-12 14:42 ` [PATCH 5.12 120/677] KVM: nVMX: Truncate bits 63:32 of VMCS field on nested check in !64-bit Greg Kroah-Hartman
@ 2021-05-12 14:42 ` Greg Kroah-Hartman
  2021-05-12 14:42 ` [PATCH 5.12 122/677] KVM: arm/arm64: Fix KVM_VGIC_V3_ADDR_TYPE_REDIST read Greg Kroah-Hartman
                   ` (563 subsequent siblings)
  684 siblings, 0 replies; 702+ messages in thread
From: Greg Kroah-Hartman @ 2021-05-12 14:42 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Sean Christopherson, Paolo Bonzini

From: Sean Christopherson <seanjc@google.com>

commit 82277eeed65eed6c6ee5b8f97bd978763eab148f upstream.

Drop bits 63:32 of the base and/or index GPRs when calculating the
effective address of a VMX instruction memory operand.  Outside of 64-bit
mode, memory encodings are strictly limited to E*X and below.

Fixes: 064aea774768 ("KVM: nVMX: Decoding memory operands of VMX instructions")
Cc: stable@vger.kernel.org
Signed-off-by: Sean Christopherson <seanjc@google.com>
Message-Id: <20210422022128.3464144-7-seanjc@google.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 arch/x86/kvm/vmx/nested.c |    4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

--- a/arch/x86/kvm/vmx/nested.c
+++ b/arch/x86/kvm/vmx/nested.c
@@ -4601,9 +4601,9 @@ int get_vmx_mem_address(struct kvm_vcpu
 	else if (addr_size == 0)
 		off = (gva_t)sign_extend64(off, 15);
 	if (base_is_valid)
-		off += kvm_register_read(vcpu, base_reg);
+		off += kvm_register_readl(vcpu, base_reg);
 	if (index_is_valid)
-		off += kvm_register_read(vcpu, index_reg) << scaling;
+		off += kvm_register_readl(vcpu, index_reg) << scaling;
 	vmx_get_segment(vcpu, &s, seg_reg);
 
 	/*



^ permalink raw reply	[flat|nested] 702+ messages in thread

* [PATCH 5.12 122/677] KVM: arm/arm64: Fix KVM_VGIC_V3_ADDR_TYPE_REDIST read
  2021-05-12 14:40 [PATCH 5.12 000/677] 5.12.4-rc1 review Greg Kroah-Hartman
                   ` (120 preceding siblings ...)
  2021-05-12 14:42 ` [PATCH 5.12 121/677] KVM: nVMX: Truncate base/index GPR value on address calc " Greg Kroah-Hartman
@ 2021-05-12 14:42 ` Greg Kroah-Hartman
  2021-05-12 14:42 ` [PATCH 5.12 123/677] KVM: Destroy I/O bus devices on unregister failure _after_ syncing SRCU Greg Kroah-Hartman
                   ` (562 subsequent siblings)
  684 siblings, 0 replies; 702+ messages in thread
From: Greg Kroah-Hartman @ 2021-05-12 14:42 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Eric Auger, Gavin Shan, Marc Zyngier, Stable

From: Eric Auger <eric.auger@redhat.com>

commit 94ac0835391efc1a30feda6fc908913ec012951e upstream.

When reading the base address of the a REDIST region
through KVM_VGIC_V3_ADDR_TYPE_REDIST we expect the
redistributor region list to be populated with a single
element.

However list_first_entry() expects the list to be non empty.
Instead we should use list_first_entry_or_null which effectively
returns NULL if the list is empty.

Fixes: dbd9733ab674 ("KVM: arm/arm64: Replace the single rdist region by a list")
Cc: <Stable@vger.kernel.org> # v4.18+
Signed-off-by: Eric Auger <eric.auger@redhat.com>
Reported-by: Gavin Shan <gshan@redhat.com>
Signed-off-by: Marc Zyngier <maz@kernel.org>
Link: https://lore.kernel.org/r/20210412150034.29185-1-eric.auger@redhat.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 arch/arm64/kvm/vgic/vgic-kvm-device.c |    4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

--- a/arch/arm64/kvm/vgic/vgic-kvm-device.c
+++ b/arch/arm64/kvm/vgic/vgic-kvm-device.c
@@ -87,8 +87,8 @@ int kvm_vgic_addr(struct kvm *kvm, unsig
 			r = vgic_v3_set_redist_base(kvm, 0, *addr, 0);
 			goto out;
 		}
-		rdreg = list_first_entry(&vgic->rd_regions,
-					 struct vgic_redist_region, list);
+		rdreg = list_first_entry_or_null(&vgic->rd_regions,
+						 struct vgic_redist_region, list);
 		if (!rdreg)
 			addr_ptr = &undef_value;
 		else



^ permalink raw reply	[flat|nested] 702+ messages in thread

* [PATCH 5.12 123/677] KVM: Destroy I/O bus devices on unregister failure _after_ syncing SRCU
  2021-05-12 14:40 [PATCH 5.12 000/677] 5.12.4-rc1 review Greg Kroah-Hartman
                   ` (121 preceding siblings ...)
  2021-05-12 14:42 ` [PATCH 5.12 122/677] KVM: arm/arm64: Fix KVM_VGIC_V3_ADDR_TYPE_REDIST read Greg Kroah-Hartman
@ 2021-05-12 14:42 ` Greg Kroah-Hartman
  2021-05-12 14:42 ` [PATCH 5.12 124/677] KVM: Stop looking for coalesced MMIO zones if the bus is destroyed Greg Kroah-Hartman
                   ` (561 subsequent siblings)
  684 siblings, 0 replies; 702+ messages in thread
From: Greg Kroah-Hartman @ 2021-05-12 14:42 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Sean Christopherson, Paolo Bonzini

From: Sean Christopherson <seanjc@google.com>

commit 2ee3757424be7c1cd1d0bbfa6db29a7edd82a250 upstream.

If allocating a new instance of an I/O bus fails when unregistering a
device, wait to destroy the device until after all readers are guaranteed
to see the new null bus.  Destroying devices before the bus is nullified
could lead to use-after-free since readers expect the devices on their
reference of the bus to remain valid.

Fixes: f65886606c2d ("KVM: fix memory leak in kvm_io_bus_unregister_dev()")
Cc: stable@vger.kernel.org
Signed-off-by: Sean Christopherson <seanjc@google.com>
Message-Id: <20210412222050.876100-2-seanjc@google.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 virt/kvm/kvm_main.c |   10 +++++++---
 1 file changed, 7 insertions(+), 3 deletions(-)

--- a/virt/kvm/kvm_main.c
+++ b/virt/kvm/kvm_main.c
@@ -4511,7 +4511,13 @@ void kvm_io_bus_unregister_dev(struct kv
 		new_bus->dev_count--;
 		memcpy(new_bus->range + i, bus->range + i + 1,
 				flex_array_size(new_bus, range, new_bus->dev_count - i));
-	} else {
+	}
+
+	rcu_assign_pointer(kvm->buses[bus_idx], new_bus);
+	synchronize_srcu_expedited(&kvm->srcu);
+
+	/* Destroy the old bus _after_ installing the (null) bus. */
+	if (!new_bus) {
 		pr_err("kvm: failed to shrink bus, removing it completely\n");
 		for (j = 0; j < bus->dev_count; j++) {
 			if (j == i)
@@ -4520,8 +4526,6 @@ void kvm_io_bus_unregister_dev(struct kv
 		}
 	}
 
-	rcu_assign_pointer(kvm->buses[bus_idx], new_bus);
-	synchronize_srcu_expedited(&kvm->srcu);
 	kfree(bus);
 	return;
 }



^ permalink raw reply	[flat|nested] 702+ messages in thread

* [PATCH 5.12 124/677] KVM: Stop looking for coalesced MMIO zones if the bus is destroyed
  2021-05-12 14:40 [PATCH 5.12 000/677] 5.12.4-rc1 review Greg Kroah-Hartman
                   ` (122 preceding siblings ...)
  2021-05-12 14:42 ` [PATCH 5.12 123/677] KVM: Destroy I/O bus devices on unregister failure _after_ syncing SRCU Greg Kroah-Hartman
@ 2021-05-12 14:42 ` Greg Kroah-Hartman
  2021-05-12 14:42 ` [PATCH 5.12 125/677] KVM: arm64: Support PREL/PLT relocs in EL2 code Greg Kroah-Hartman
                   ` (560 subsequent siblings)
  684 siblings, 0 replies; 702+ messages in thread
From: Greg Kroah-Hartman @ 2021-05-12 14:42 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Hao Sun, Sean Christopherson, Paolo Bonzini

From: Sean Christopherson <seanjc@google.com>

commit 5d3c4c79384af06e3c8e25b7770b6247496b4417 upstream.

Abort the walk of coalesced MMIO zones if kvm_io_bus_unregister_dev()
fails to allocate memory for the new instance of the bus.  If it can't
instantiate a new bus, unregister_dev() destroys all devices _except_ the
target device.   But, it doesn't tell the caller that it obliterated the
bus and invoked the destructor for all devices that were on the bus.  In
the coalesced MMIO case, this can result in a deleted list entry
dereference due to attempting to continue iterating on coalesced_zones
after future entries (in the walk) have been deleted.

Opportunistically add curly braces to the for-loop, which encompasses
many lines but sneaks by without braces due to the guts being a single
if statement.

Fixes: f65886606c2d ("KVM: fix memory leak in kvm_io_bus_unregister_dev()")
Cc: stable@vger.kernel.org
Reported-by: Hao Sun <sunhao.th@gmail.com>
Signed-off-by: Sean Christopherson <seanjc@google.com>
Message-Id: <20210412222050.876100-3-seanjc@google.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 include/linux/kvm_host.h  |    4 ++--
 virt/kvm/coalesced_mmio.c |   19 +++++++++++++++++--
 virt/kvm/kvm_main.c       |   10 +++++-----
 3 files changed, 24 insertions(+), 9 deletions(-)

--- a/include/linux/kvm_host.h
+++ b/include/linux/kvm_host.h
@@ -192,8 +192,8 @@ int kvm_io_bus_read(struct kvm_vcpu *vcp
 		    int len, void *val);
 int kvm_io_bus_register_dev(struct kvm *kvm, enum kvm_bus bus_idx, gpa_t addr,
 			    int len, struct kvm_io_device *dev);
-void kvm_io_bus_unregister_dev(struct kvm *kvm, enum kvm_bus bus_idx,
-			       struct kvm_io_device *dev);
+int kvm_io_bus_unregister_dev(struct kvm *kvm, enum kvm_bus bus_idx,
+			      struct kvm_io_device *dev);
 struct kvm_io_device *kvm_io_bus_get_dev(struct kvm *kvm, enum kvm_bus bus_idx,
 					 gpa_t addr);
 
--- a/virt/kvm/coalesced_mmio.c
+++ b/virt/kvm/coalesced_mmio.c
@@ -174,21 +174,36 @@ int kvm_vm_ioctl_unregister_coalesced_mm
 					   struct kvm_coalesced_mmio_zone *zone)
 {
 	struct kvm_coalesced_mmio_dev *dev, *tmp;
+	int r;
 
 	if (zone->pio != 1 && zone->pio != 0)
 		return -EINVAL;
 
 	mutex_lock(&kvm->slots_lock);
 
-	list_for_each_entry_safe(dev, tmp, &kvm->coalesced_zones, list)
+	list_for_each_entry_safe(dev, tmp, &kvm->coalesced_zones, list) {
 		if (zone->pio == dev->zone.pio &&
 		    coalesced_mmio_in_range(dev, zone->addr, zone->size)) {
-			kvm_io_bus_unregister_dev(kvm,
+			r = kvm_io_bus_unregister_dev(kvm,
 				zone->pio ? KVM_PIO_BUS : KVM_MMIO_BUS, &dev->dev);
 			kvm_iodevice_destructor(&dev->dev);
+
+			/*
+			 * On failure, unregister destroys all devices on the
+			 * bus _except_ the target device, i.e. coalesced_zones
+			 * has been modified.  No need to restart the walk as
+			 * there aren't any zones left.
+			 */
+			if (r)
+				break;
 		}
+	}
 
 	mutex_unlock(&kvm->slots_lock);
 
+	/*
+	 * Ignore the result of kvm_io_bus_unregister_dev(), from userspace's
+	 * perspective, the coalesced MMIO is most definitely unregistered.
+	 */
 	return 0;
 }
--- a/virt/kvm/kvm_main.c
+++ b/virt/kvm/kvm_main.c
@@ -4486,15 +4486,15 @@ int kvm_io_bus_register_dev(struct kvm *
 }
 
 /* Caller must hold slots_lock. */
-void kvm_io_bus_unregister_dev(struct kvm *kvm, enum kvm_bus bus_idx,
-			       struct kvm_io_device *dev)
+int kvm_io_bus_unregister_dev(struct kvm *kvm, enum kvm_bus bus_idx,
+			      struct kvm_io_device *dev)
 {
 	int i, j;
 	struct kvm_io_bus *new_bus, *bus;
 
 	bus = kvm_get_bus(kvm, bus_idx);
 	if (!bus)
-		return;
+		return 0;
 
 	for (i = 0; i < bus->dev_count; i++)
 		if (bus->range[i].dev == dev) {
@@ -4502,7 +4502,7 @@ void kvm_io_bus_unregister_dev(struct kv
 		}
 
 	if (i == bus->dev_count)
-		return;
+		return 0;
 
 	new_bus = kmalloc(struct_size(bus, range, bus->dev_count - 1),
 			  GFP_KERNEL_ACCOUNT);
@@ -4527,7 +4527,7 @@ void kvm_io_bus_unregister_dev(struct kv
 	}
 
 	kfree(bus);
-	return;
+	return new_bus ? 0 : -ENOMEM;
 }
 
 struct kvm_io_device *kvm_io_bus_get_dev(struct kvm *kvm, enum kvm_bus bus_idx,



^ permalink raw reply	[flat|nested] 702+ messages in thread

* [PATCH 5.12 125/677] KVM: arm64: Support PREL/PLT relocs in EL2 code
  2021-05-12 14:40 [PATCH 5.12 000/677] 5.12.4-rc1 review Greg Kroah-Hartman
                   ` (123 preceding siblings ...)
  2021-05-12 14:42 ` [PATCH 5.12 124/677] KVM: Stop looking for coalesced MMIO zones if the bus is destroyed Greg Kroah-Hartman
@ 2021-05-12 14:42 ` Greg Kroah-Hartman
  2021-05-12 14:42 ` [PATCH 5.12 126/677] KVM: arm64: Fully zero the vcpu state on reset Greg Kroah-Hartman
                   ` (559 subsequent siblings)
  684 siblings, 0 replies; 702+ messages in thread
From: Greg Kroah-Hartman @ 2021-05-12 14:42 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Will Deacon, David Brazdil, Marc Zyngier

From: David Brazdil <dbrazdil@google.com>

commit 77e06b300161d41d65950be9c77a785c142b381d upstream.

gen-hyprel tool parses object files of the EL2 portion of KVM
and generates runtime relocation data. While only filtering for
R_AARCH64_ABS64 relocations in the input object files, it has an
allow-list of relocation types that are used for relative
addressing. Other, unexpected, relocation types are rejected and
cause the build to fail.

This allow-list did not include the position-relative relocation
types R_AARCH64_PREL64/32/16 and the recently introduced _PLT32.
While not seen used by toolchains in the wild, add them to the
allow-list for completeness.

Fixes: 8c49b5d43d4c ("KVM: arm64: Generate hyp relocation data")
Cc: <stable@vger.kernel.org>
Reported-by: Will Deacon <will@kernel.org>
Signed-off-by: David Brazdil <dbrazdil@google.com>
Signed-off-by: Marc Zyngier <maz@kernel.org>
Link: https://lore.kernel.org/r/20210331133048.63311-1-dbrazdil@google.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 arch/arm64/kvm/hyp/nvhe/gen-hyprel.c |   18 ++++++++++++++++++
 1 file changed, 18 insertions(+)

--- a/arch/arm64/kvm/hyp/nvhe/gen-hyprel.c
+++ b/arch/arm64/kvm/hyp/nvhe/gen-hyprel.c
@@ -50,6 +50,18 @@
 #ifndef R_AARCH64_ABS64
 #define R_AARCH64_ABS64			257
 #endif
+#ifndef R_AARCH64_PREL64
+#define R_AARCH64_PREL64		260
+#endif
+#ifndef R_AARCH64_PREL32
+#define R_AARCH64_PREL32		261
+#endif
+#ifndef R_AARCH64_PREL16
+#define R_AARCH64_PREL16		262
+#endif
+#ifndef R_AARCH64_PLT32
+#define R_AARCH64_PLT32			314
+#endif
 #ifndef R_AARCH64_LD_PREL_LO19
 #define R_AARCH64_LD_PREL_LO19		273
 #endif
@@ -371,6 +383,12 @@ static void emit_rela_section(Elf64_Shdr
 		case R_AARCH64_ABS64:
 			emit_rela_abs64(rela, sh_orig_name);
 			break;
+		/* Allow position-relative data relocations. */
+		case R_AARCH64_PREL64:
+		case R_AARCH64_PREL32:
+		case R_AARCH64_PREL16:
+		case R_AARCH64_PLT32:
+			break;
 		/* Allow relocations to generate PC-relative addressing. */
 		case R_AARCH64_LD_PREL_LO19:
 		case R_AARCH64_ADR_PREL_LO21:



^ permalink raw reply	[flat|nested] 702+ messages in thread

* [PATCH 5.12 126/677] KVM: arm64: Fully zero the vcpu state on reset
  2021-05-12 14:40 [PATCH 5.12 000/677] 5.12.4-rc1 review Greg Kroah-Hartman
                   ` (124 preceding siblings ...)
  2021-05-12 14:42 ` [PATCH 5.12 125/677] KVM: arm64: Support PREL/PLT relocs in EL2 code Greg Kroah-Hartman
@ 2021-05-12 14:42 ` Greg Kroah-Hartman
  2021-05-12 14:42 ` [PATCH 5.12 127/677] KVM: arm64: Fix KVM_VGIC_V3_ADDR_TYPE_REDIST_REGION read Greg Kroah-Hartman
                   ` (558 subsequent siblings)
  684 siblings, 0 replies; 702+ messages in thread
From: Greg Kroah-Hartman @ 2021-05-12 14:42 UTC (permalink / raw)
  To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Marc Zyngier

From: Marc Zyngier <maz@kernel.org>

commit 85d703746154cdc6794b6654b587b0b0354c97e9 upstream.

On vcpu reset, we expect all the registers to be brought back
to their initial state, which happens to be a bunch of zeroes.

However, some recent commit broke this, and is now leaving a bunch
of registers (such as the FP state) with whatever was left by the
guest. My bad.

Zero the reset of the state (32bit SPSRs and FPSIMD state).

Cc: stable@vger.kernel.org
Fixes: e47c2055c68e ("KVM: arm64: Make struct kvm_regs userspace-only")
Signed-off-by: Marc Zyngier <maz@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 arch/arm64/kvm/reset.c |    5 +++++
 1 file changed, 5 insertions(+)

--- a/arch/arm64/kvm/reset.c
+++ b/arch/arm64/kvm/reset.c
@@ -242,6 +242,11 @@ int kvm_reset_vcpu(struct kvm_vcpu *vcpu
 
 	/* Reset core registers */
 	memset(vcpu_gp_regs(vcpu), 0, sizeof(*vcpu_gp_regs(vcpu)));
+	memset(&vcpu->arch.ctxt.fp_regs, 0, sizeof(vcpu->arch.ctxt.fp_regs));
+	vcpu->arch.ctxt.spsr_abt = 0;
+	vcpu->arch.ctxt.spsr_und = 0;
+	vcpu->arch.ctxt.spsr_irq = 0;
+	vcpu->arch.ctxt.spsr_fiq = 0;
 	vcpu_gp_regs(vcpu)->pstate = pstate;
 
 	/* Reset system registers */



^ permalink raw reply	[flat|nested] 702+ messages in thread

* [PATCH 5.12 127/677] KVM: arm64: Fix KVM_VGIC_V3_ADDR_TYPE_REDIST_REGION read
  2021-05-12 14:40 [PATCH 5.12 000/677] 5.12.4-rc1 review Greg Kroah-Hartman
                   ` (125 preceding siblings ...)
  2021-05-12 14:42 ` [PATCH 5.12 126/677] KVM: arm64: Fully zero the vcpu state on reset Greg Kroah-Hartman
@ 2021-05-12 14:42 ` Greg Kroah-Hartman
  2021-05-12 14:42 ` [PATCH 5.12 128/677] KVM: selftests: Sync data verify of dirty logging with guest sync Greg Kroah-Hartman
                   ` (557 subsequent siblings)
  684 siblings, 0 replies; 702+ messages in thread
From: Greg Kroah-Hartman @ 2021-05-12 14:42 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Eric Auger, Alexandru Elisei, Marc Zyngier

From: Eric Auger <eric.auger@redhat.com>

commit 53b16dd6ba5cf64ed147ac3523ec34651d553cb0 upstream.

The doc says:
"The characteristics of a specific redistributor region can
 be read by presetting the index field in the attr data.
 Only valid for KVM_DEV_TYPE_ARM_VGIC_V3"

Unfortunately the existing code fails to read the input attr data.

Fixes: 04c110932225 ("KVM: arm/arm64: Implement KVM_VGIC_V3_ADDR_TYPE_REDIST_REGION")
Cc: stable@vger.kernel.org#v4.17+
Signed-off-by: Eric Auger <eric.auger@redhat.com>
Reviewed-by: Alexandru Elisei <alexandru.elisei@arm.com>
Signed-off-by: Marc Zyngier <maz@kernel.org>
Link: https://lore.kernel.org/r/20210405163941.510258-3-eric.auger@redhat.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 arch/arm64/kvm/vgic/vgic-kvm-device.c |    3 +++
 1 file changed, 3 insertions(+)

--- a/arch/arm64/kvm/vgic/vgic-kvm-device.c
+++ b/arch/arm64/kvm/vgic/vgic-kvm-device.c
@@ -226,6 +226,9 @@ static int vgic_get_common_attr(struct k
 		u64 addr;
 		unsigned long type = (unsigned long)attr->attr;
 
+		if (copy_from_user(&addr, uaddr, sizeof(addr)))
+			return -EFAULT;
+
 		r = kvm_vgic_addr(dev->kvm, type, &addr, false);
 		if (r)
 			return (r == -ENODEV) ? -ENXIO : r;



^ permalink raw reply	[flat|nested] 702+ messages in thread

* [PATCH 5.12 128/677] KVM: selftests: Sync data verify of dirty logging with guest sync
  2021-05-12 14:40 [PATCH 5.12 000/677] 5.12.4-rc1 review Greg Kroah-Hartman
                   ` (126 preceding siblings ...)
  2021-05-12 14:42 ` [PATCH 5.12 127/677] KVM: arm64: Fix KVM_VGIC_V3_ADDR_TYPE_REDIST_REGION read Greg Kroah-Hartman
@ 2021-05-12 14:42 ` Greg Kroah-Hartman
  2021-05-12 14:42 ` [PATCH 5.12 129/677] KVM: selftests: Always run vCPU thread with blocked SIG_IPI Greg Kroah-Hartman
                   ` (556 subsequent siblings)
  684 siblings, 0 replies; 702+ messages in thread
From: Greg Kroah-Hartman @ 2021-05-12 14:42 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Paolo Bonzini, Sean Christopherson,
	Andrew Jones, Peter Xu

From: Peter Xu <peterx@redhat.com>

commit 016ff1a442d9a8f36dcb3beca0bcdfc35e281e18 upstream.

This fixes a bug that can trigger with e.g. "taskset -c 0 ./dirty_log_test" or
when the testing host is very busy.

A similar previous attempt is done [1] but that is not enough, the reason is
stated in the reply [2].

As a summary (partly quotting from [2]):

The problem is I think one guest memory write operation (of this specific test)
contains a few micro-steps when page is during kvm dirty tracking (here I'm
only considering write-protect rather than pml but pml should be similar at
least when the log buffer is full):

  (1) Guest read 'iteration' number into register, prepare to write, page fault
  (2) Set dirty bit in either dirty bitmap or dirty ring
  (3) Return to guest, data written

When we verify the data, we assumed that all these steps are "atomic", say,
when (1) happened for this page, we assume (2) & (3) must have happened.  We
had some trick to workaround "un-atomicity" of above three steps, as previous
version of this patch wanted to fix atomicity of step (2)+(3) by explicitly
letting the main thread wait for at least one vmenter of vcpu thread, which
should work.  However what I overlooked is probably that we still have race
when (1) and (2) can be interrupted.

One example calltrace when it could happen that we read an old interation, got
interrupted before even setting the dirty bit and flushing data:

    __schedule+1742
    __cond_resched+52
    __get_user_pages+530
    get_user_pages_unlocked+197
    hva_to_pfn+206
    try_async_pf+132
    direct_page_fault+320
    kvm_mmu_page_fault+103
    vmx_handle_exit+288
    vcpu_enter_guest+2460
    kvm_arch_vcpu_ioctl_run+325
    kvm_vcpu_ioctl+526
    __x64_sys_ioctl+131
    do_syscall_64+51
    entry_SYSCALL_64_after_hwframe+68

It means iteration number cached in vcpu register can be very old when dirty
bit set and data flushed.

So far I don't see an easy way to guarantee all steps 1-3 atomicity but to sync
at the GUEST_SYNC() point of guest code when we do verification of the dirty
bits as what this patch does.

[1] https://lore.kernel.org/lkml/20210413213641.23742-1-peterx@redhat.com/
[2] https://lore.kernel.org/lkml/20210417140956.GV4440@xz-x1/

Cc: Paolo Bonzini <pbonzini@redhat.com>
Cc: Sean Christopherson <seanjc@google.com>
Cc: Andrew Jones <drjones@redhat.com>
Cc: stable@vger.kernel.org
Signed-off-by: Peter Xu <peterx@redhat.com>
Message-Id: <20210417143602.215059-2-peterx@redhat.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 tools/testing/selftests/kvm/dirty_log_test.c |   60 ++++++++++++++++++++++-----
 1 file changed, 50 insertions(+), 10 deletions(-)

--- a/tools/testing/selftests/kvm/dirty_log_test.c
+++ b/tools/testing/selftests/kvm/dirty_log_test.c
@@ -17,6 +17,7 @@
 #include <linux/bitmap.h>
 #include <linux/bitops.h>
 #include <asm/barrier.h>
+#include <linux/atomic.h>
 
 #include "kvm_util.h"
 #include "test_util.h"
@@ -137,12 +138,20 @@ static uint64_t host_clear_count;
 static uint64_t host_track_next_count;
 
 /* Whether dirty ring reset is requested, or finished */
-static sem_t dirty_ring_vcpu_stop;
-static sem_t dirty_ring_vcpu_cont;
+static sem_t sem_vcpu_stop;
+static sem_t sem_vcpu_cont;
+/*
+ * This is only set by main thread, and only cleared by vcpu thread.  It is
+ * used to request vcpu thread to stop at the next GUEST_SYNC, since GUEST_SYNC
+ * is the only place that we'll guarantee both "dirty bit" and "dirty data"
+ * will match.  E.g., SIG_IPI won't guarantee that if the vcpu is interrupted
+ * after setting dirty bit but before the data is written.
+ */
+static atomic_t vcpu_sync_stop_requested;
 /*
  * This is updated by the vcpu thread to tell the host whether it's a
  * ring-full event.  It should only be read until a sem_wait() of
- * dirty_ring_vcpu_stop and before vcpu continues to run.
+ * sem_vcpu_stop and before vcpu continues to run.
  */
 static bool dirty_ring_vcpu_ring_full;
 /*
@@ -234,6 +243,17 @@ static void clear_log_collect_dirty_page
 	kvm_vm_clear_dirty_log(vm, slot, bitmap, 0, num_pages);
 }
 
+/* Should only be called after a GUEST_SYNC */
+static void vcpu_handle_sync_stop(void)
+{
+	if (atomic_read(&vcpu_sync_stop_requested)) {
+		/* It means main thread is sleeping waiting */
+		atomic_set(&vcpu_sync_stop_requested, false);
+		sem_post(&sem_vcpu_stop);
+		sem_wait_until(&sem_vcpu_cont);
+	}
+}
+
 static void default_after_vcpu_run(struct kvm_vm *vm, int ret, int err)
 {
 	struct kvm_run *run = vcpu_state(vm, VCPU_ID);
@@ -244,6 +264,8 @@ static void default_after_vcpu_run(struc
 	TEST_ASSERT(get_ucall(vm, VCPU_ID, NULL) == UCALL_SYNC,
 		    "Invalid guest sync status: exit_reason=%s\n",
 		    exit_reason_str(run->exit_reason));
+
+	vcpu_handle_sync_stop();
 }
 
 static bool dirty_ring_supported(void)
@@ -301,13 +323,13 @@ static void dirty_ring_wait_vcpu(void)
 {
 	/* This makes sure that hardware PML cache flushed */
 	vcpu_kick();
-	sem_wait_until(&dirty_ring_vcpu_stop);
+	sem_wait_until(&sem_vcpu_stop);
 }
 
 static void dirty_ring_continue_vcpu(void)
 {
 	pr_info("Notifying vcpu to continue\n");
-	sem_post(&dirty_ring_vcpu_cont);
+	sem_post(&sem_vcpu_cont);
 }
 
 static void dirty_ring_collect_dirty_pages(struct kvm_vm *vm, int slot,
@@ -361,11 +383,11 @@ static void dirty_ring_after_vcpu_run(st
 		/* Update the flag first before pause */
 		WRITE_ONCE(dirty_ring_vcpu_ring_full,
 			   run->exit_reason == KVM_EXIT_DIRTY_RING_FULL);
-		sem_post(&dirty_ring_vcpu_stop);
+		sem_post(&sem_vcpu_stop);
 		pr_info("vcpu stops because %s...\n",
 			dirty_ring_vcpu_ring_full ?
 			"dirty ring is full" : "vcpu is kicked out");
-		sem_wait_until(&dirty_ring_vcpu_cont);
+		sem_wait_until(&sem_vcpu_cont);
 		pr_info("vcpu continues now.\n");
 	} else {
 		TEST_ASSERT(false, "Invalid guest sync status: "
@@ -377,7 +399,7 @@ static void dirty_ring_after_vcpu_run(st
 static void dirty_ring_before_vcpu_join(void)
 {
 	/* Kick another round of vcpu just to make sure it will quit */
-	sem_post(&dirty_ring_vcpu_cont);
+	sem_post(&sem_vcpu_cont);
 }
 
 struct log_mode {
@@ -768,7 +790,25 @@ static void run_test(enum vm_guest_mode
 		usleep(p->interval * 1000);
 		log_mode_collect_dirty_pages(vm, TEST_MEM_SLOT_INDEX,
 					     bmap, host_num_pages);
+
+		/*
+		 * See vcpu_sync_stop_requested definition for details on why
+		 * we need to stop vcpu when verify data.
+		 */
+		atomic_set(&vcpu_sync_stop_requested, true);
+		sem_wait_until(&sem_vcpu_stop);
+		/*
+		 * NOTE: for dirty ring, it's possible that we didn't stop at
+		 * GUEST_SYNC but instead we stopped because ring is full;
+		 * that's okay too because ring full means we're only missing
+		 * the flush of the last page, and since we handle the last
+		 * page specially verification will succeed anyway.
+		 */
+		assert(host_log_mode == LOG_MODE_DIRTY_RING ||
+		       atomic_read(&vcpu_sync_stop_requested) == false);
 		vm_dirty_log_verify(mode, bmap);
+		sem_post(&sem_vcpu_cont);
+
 		iteration++;
 		sync_global_to_guest(vm, iteration);
 	}
@@ -819,8 +859,8 @@ int main(int argc, char *argv[])
 	};
 	int opt, i;
 
-	sem_init(&dirty_ring_vcpu_stop, 0, 0);
-	sem_init(&dirty_ring_vcpu_cont, 0, 0);
+	sem_init(&sem_vcpu_stop, 0, 0);
+	sem_init(&sem_vcpu_cont, 0, 0);
 
 	guest_modes_append_default();
 



^ permalink raw reply	[flat|nested] 702+ messages in thread

* [PATCH 5.12 129/677] KVM: selftests: Always run vCPU thread with blocked SIG_IPI
  2021-05-12 14:40 [PATCH 5.12 000/677] 5.12.4-rc1 review Greg Kroah-Hartman
                   ` (127 preceding siblings ...)
  2021-05-12 14:42 ` [PATCH 5.12 128/677] KVM: selftests: Sync data verify of dirty logging with guest sync Greg Kroah-Hartman
@ 2021-05-12 14:42 ` Greg Kroah-Hartman
  2021-05-12 14:42 ` [PATCH 5.12 130/677] Revert "drivers/net/wan/hdlc_fr: Fix a double free in pvc_xmit" Greg Kroah-Hartman
                   ` (555 subsequent siblings)
  684 siblings, 0 replies; 702+ messages in thread
From: Greg Kroah-Hartman @ 2021-05-12 14:42 UTC (permalink / raw)
  To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Peter Xu, Paolo Bonzini

From: Paolo Bonzini <pbonzini@redhat.com>

commit bf1e15a82e3b74ee86bb119d6038b41e1ed2b319 upstream.

The main thread could start to send SIG_IPI at any time, even before signal
blocked on vcpu thread.  Therefore, start the vcpu thread with the signal
blocked.

Without this patch, on very busy cores the dirty_log_test could fail directly
on receiving a SIGUSR1 without a handler (when vcpu runs far slower than main).

Reported-by: Peter Xu <peterx@redhat.com>
Cc: stable@vger.kernel.org
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 tools/testing/selftests/kvm/dirty_log_test.c |    9 +++++++--
 1 file changed, 7 insertions(+), 2 deletions(-)

--- a/tools/testing/selftests/kvm/dirty_log_test.c
+++ b/tools/testing/selftests/kvm/dirty_log_test.c
@@ -527,9 +527,8 @@ static void *vcpu_worker(void *data)
 	 */
 	sigmask->len = 8;
 	pthread_sigmask(0, NULL, sigset);
+	sigdelset(sigset, SIG_IPI);
 	vcpu_ioctl(vm, VCPU_ID, KVM_SET_SIGNAL_MASK, sigmask);
-	sigaddset(sigset, SIG_IPI);
-	pthread_sigmask(SIG_BLOCK, sigset, NULL);
 
 	sigemptyset(sigset);
 	sigaddset(sigset, SIG_IPI);
@@ -858,6 +857,7 @@ int main(int argc, char *argv[])
 		.interval = TEST_HOST_LOOP_INTERVAL,
 	};
 	int opt, i;
+	sigset_t sigset;
 
 	sem_init(&sem_vcpu_stop, 0, 0);
 	sem_init(&sem_vcpu_cont, 0, 0);
@@ -916,6 +916,11 @@ int main(int argc, char *argv[])
 
 	srandom(time(0));
 
+	/* Ensure that vCPU threads start with SIG_IPI blocked.  */
+	sigemptyset(&sigset);
+	sigaddset(&sigset, SIG_IPI);
+	pthread_sigmask(SIG_BLOCK, &sigset, NULL);
+
 	if (host_log_mode_option == LOG_MODE_ALL) {
 		/* Run each log mode */
 		for (i = 0; i < LOG_MODE_NUM; i++) {



^ permalink raw reply	[flat|nested] 702+ messages in thread

* [PATCH 5.12 130/677] Revert "drivers/net/wan/hdlc_fr: Fix a double free in pvc_xmit"
  2021-05-12 14:40 [PATCH 5.12 000/677] 5.12.4-rc1 review Greg Kroah-Hartman
                   ` (128 preceding siblings ...)
  2021-05-12 14:42 ` [PATCH 5.12 129/677] KVM: selftests: Always run vCPU thread with blocked SIG_IPI Greg Kroah-Hartman
@ 2021-05-12 14:42 ` Greg Kroah-Hartman
  2021-05-12 14:42 ` [PATCH 5.12 131/677] Revert "i3c master: fix missing destroy_workqueue() on error in i3c_master_register" Greg Kroah-Hartman
                   ` (554 subsequent siblings)
  684 siblings, 0 replies; 702+ messages in thread
From: Greg Kroah-Hartman @ 2021-05-12 14:42 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Lv Yunlong, Xie He, David S. Miller

From: Xie He <xie.he.0141@gmail.com>

commit d362fd0be456dba2d3d58a90b7a193962776562b upstream.

This reverts commit 1b479fb80160
("drivers/net/wan/hdlc_fr: Fix a double free in pvc_xmit").

1. This commit is incorrect. "__skb_pad" will NOT free the skb on
failure when its "free_on_error" parameter is "false".

2. This commit claims to fix my commit. But it didn't CC me??

Fixes: 1b479fb80160 ("drivers/net/wan/hdlc_fr: Fix a double free in pvc_xmit")
Cc: Lv Yunlong <lyl2019@mail.ustc.edu.cn>
Signed-off-by: Xie He <xie.he.0141@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/net/wan/hdlc_fr.c |    5 ++---
 1 file changed, 2 insertions(+), 3 deletions(-)

--- a/drivers/net/wan/hdlc_fr.c
+++ b/drivers/net/wan/hdlc_fr.c
@@ -415,7 +415,7 @@ static netdev_tx_t pvc_xmit(struct sk_bu
 
 		if (pad > 0) { /* Pad the frame with zeros */
 			if (__skb_pad(skb, pad, false))
-				goto out;
+				goto drop;
 			skb_put(skb, pad);
 		}
 	}
@@ -448,9 +448,8 @@ static netdev_tx_t pvc_xmit(struct sk_bu
 	return NETDEV_TX_OK;
 
 drop:
-	kfree_skb(skb);
-out:
 	dev->stats.tx_dropped++;
+	kfree_skb(skb);
 	return NETDEV_TX_OK;
 }
 



^ permalink raw reply	[flat|nested] 702+ messages in thread

* [PATCH 5.12 131/677] Revert "i3c master: fix missing destroy_workqueue() on error in i3c_master_register"
  2021-05-12 14:40 [PATCH 5.12 000/677] 5.12.4-rc1 review Greg Kroah-Hartman
                   ` (129 preceding siblings ...)
  2021-05-12 14:42 ` [PATCH 5.12 130/677] Revert "drivers/net/wan/hdlc_fr: Fix a double free in pvc_xmit" Greg Kroah-Hartman
@ 2021-05-12 14:42 ` Greg Kroah-Hartman
  2021-05-12 14:42 ` [PATCH 5.12 132/677] mfd: stmpe: Revert "Constify static struct resource" Greg Kroah-Hartman
                   ` (553 subsequent siblings)
  684 siblings, 0 replies; 702+ messages in thread
From: Greg Kroah-Hartman @ 2021-05-12 14:42 UTC (permalink / raw)
  To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Jae Hyun Yoo, Alexandre Belloni

From: Jae Hyun Yoo <jae.hyun.yoo@linux.intel.com>

commit 0d95f41ebde40d552bb4fea64b1d618607915fd6 upstream.

Adding the destroy_workqueue call in i3c_master_register introduced below
kernel warning because it makes duplicate destroy_workqueue calls when
i3c_master_register fails after allocating the workqueue. The workqueue will
be destroyed by i3c_masterdev_release which is called by put_device at the
end of the i3c_master_register function eventually in failure cases so the
workqueue doesn't need to be destroyed in i3c_master_register.

[    6.972952] WARNING: CPU: 1 PID: 1 at lib/list_debug.c:48 __list_del_entry_valid+0x9c/0xf4
[    6.982205] list_del corruption, 8fe03c08->prev is LIST_POISON2 (00000122)
[    6.989910] CPU: 1 PID: 1 Comm: swapper/0 Tainted: G        W         5.10.23-c12838a-dirty-31dc772 #1
[    7.000295] Hardware name: Generic DT based system
[    7.005638] Backtrace:
[    7.008369] [<809133f0>] (dump_backtrace) from [<80913644>] (show_stack+0x20/0x24)
[    7.016819]  r7:00000030 r6:60000013 r5:00000000 r4:813b5d40
[    7.023137] [<80913624>] (show_stack) from [<8091e1a0>] (dump_stack+0x9c/0xb0)
[    7.031201] [<8091e104>] (dump_stack) from [<8011fa30>] (__warn+0xf8/0x154)
[    7.038972]  r7:00000030 r6:00000009 r5:804fa1c8 r4:80b6eca4
[    7.045289] [<8011f938>] (__warn) from [<80913d14>] (warn_slowpath_fmt+0x8c/0xc0)
[    7.053641]  r7:00000030 r6:80b6eca4 r5:80b6ed74 r4:818cc000
[    7.059960] [<80913c8c>] (warn_slowpath_fmt) from [<804fa1c8>] (__list_del_entry_valid+0x9c/0xf4)
[    7.069866]  r9:96becf8c r8:818cc000 r7:8fe03c10 r6:8fe03c00 r5:8fe03ba0 r4:ff7ead4c
[    7.078513] [<804fa12c>] (__list_del_entry_valid) from [<8013f0b4>] (destroy_workqueue+0x1c4/0x23c)
[    7.088615] [<8013eef0>] (destroy_workqueue) from [<806aa124>] (i3c_masterdev_release+0x40/0xb0)
[    7.098421]  r7:00000000 r6:81a43b80 r5:8fe65360 r4:8fe65048
[    7.104740] [<806aa0e4>] (i3c_masterdev_release) from [<805f3f04>] (device_release+0x40/0xb0)
[    7.114254]  r5:00000000 r4:8fe65048
[    7.118245] [<805f3ec4>] (device_release) from [<808fe754>] (kobject_put+0xc8/0x204)
[    7.126885]  r5:813978dc r4:8fe65048
[    7.130877] [<808fe68c>] (kobject_put) from [<805f5fbc>] (put_device+0x20/0x24)
[    7.139037]  r7:8fe65358 r6:8fe65368 r5:8fe65358 r4:8fe65048
[    7.145355] [<805f5f9c>] (put_device) from [<806abac4>] (i3c_master_register+0x338/0xb00)
[    7.154487] [<806ab78c>] (i3c_master_register) from [<806ae084>] (dw_i3c_probe+0x224/0x24c)
[    7.163811]  r10:00000000 r9:8fe7a100 r8:00000032 r7:819fa810 r6:819fa800 r5:8fe65040
[    7.172547]  r4:00000000
[    7.175376] [<806ade60>] (dw_i3c_probe) from [<805fdc14>] (platform_drv_probe+0x44/0x80)
[    7.184409]  r9:813a25c0 r8:00000000 r7:815ec114 r6:00000000 r5:813a25c0 r4:819fa810
[    7.193053] [<805fdbd0>] (platform_drv_probe) from [<805fb83c>] (really_probe+0x108/0x50c)
[    7.202275]  r5:815ec004 r4:819fa810
[    7.206265] [<805fb734>] (really_probe) from [<805fc180>] (driver_probe_device+0xb4/0x190)
[    7.215492]  r10:813dc000 r9:80c4385c r8:000000d9 r7:813a25c0 r6:819fa810 r5:00000000
[    7.224228]  r4:813a25c0
[    7.227055] [<805fc0cc>] (driver_probe_device) from [<805fc5cc>] (device_driver_attach+0xb8/0xc0)
[    7.236959]  r9:80c4385c r8:000000d9 r7:813a25c0 r6:819fa854 r4:819fa810
[    7.244439] [<805fc514>] (device_driver_attach) from [<805fc65c>] (__driver_attach+0x88/0x16c)
[    7.254051]  r7:00000000 r6:819fa810 r5:00000000 r4:813a25c0
[    7.260369] [<805fc5d4>] (__driver_attach) from [<805f954c>] (bus_for_each_dev+0x88/0xc8)
[    7.269489]  r7:00000000 r6:818cc000 r5:805fc5d4 r4:813a25c0
[    7.275806] [<805f94c4>] (bus_for_each_dev) from [<805fc76c>] (driver_attach+0x2c/0x30)
[    7.284739]  r7:81397c98 r6:00000000 r5:8fe7db80 r4:813a25c0
[    7.291057] [<805fc740>] (driver_attach) from [<805f9eec>] (bus_add_driver+0x120/0x200)
[    7.299984] [<805f9dcc>] (bus_add_driver) from [<805fce44>] (driver_register+0x98/0x128)
[    7.309005]  r7:80c4383c r6:00000000 r5:00000000 r4:813a25c0
[    7.315323] [<805fcdac>] (driver_register) from [<805fedb4>] (__platform_driver_register+0x50/0x58)
[    7.325410]  r5:818cc000 r4:81397c98
[    7.329404] [<805fed64>] (__platform_driver_register) from [<80c23398>] (dw_i3c_driver_init+0x24/0x28)
[    7.339790]  r5:818cc000 r4:80c23374
[    7.343784] [<80c23374>] (dw_i3c_driver_init) from [<80c01300>] (do_one_initcall+0xac/0x1d0)
[    7.353206] [<80c01254>] (do_one_initcall) from [<80c01630>] (kernel_init_freeable+0x1a8/0x204)
[    7.362916]  r8:000000d9 r7:80c4383c r6:00000007 r5:819ca2c0 r4:80c67680
[    7.370398] [<80c01488>] (kernel_init_freeable) from [<8091eb18>] (kernel_init+0x18/0x12c)
[    7.379616]  r10:00000000 r9:00000000 r8:00000000 r7:00000000 r6:00000000 r5:8091eb00
[    7.388343]  r4:00000000
[    7.391170] [<8091eb00>] (kernel_init) from [<80100148>] (ret_from_fork+0x14/0x2c)
[    7.399607] Exception stack(0x818cdfb0 to 0x818cdff8)
[    7.405243] dfa0:                                     00000000 00000000 00000000 00000000
[    7.414371] dfc0: 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000
[    7.423499] dfe0: 00000000 00000000 00000000 00000000 00000013 00000000
[    7.430879]  r5:8091eb00 r4:00000000

This reverts commit 59165d16c699182b86b5c65181013f1fd88feb62.

Fixes: 59165d16c699 ("i3c master: fix missing destroy_workqueue() on error in i3c_master_register")
Signed-off-by: Jae Hyun Yoo <jae.hyun.yoo@linux.intel.com>
Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
Link: https://lore.kernel.org/r/20210408172803.24599-1-jae.hyun.yoo@linux.intel.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/i3c/master.c |    5 +----
 1 file changed, 1 insertion(+), 4 deletions(-)

--- a/drivers/i3c/master.c
+++ b/drivers/i3c/master.c
@@ -2535,7 +2535,7 @@ int i3c_master_register(struct i3c_maste
 
 	ret = i3c_master_bus_init(master);
 	if (ret)
-		goto err_destroy_wq;
+		goto err_put_dev;
 
 	ret = device_add(&master->dev);
 	if (ret)
@@ -2566,9 +2566,6 @@ err_del_dev:
 err_cleanup_bus:
 	i3c_master_bus_cleanup(master);
 
-err_destroy_wq:
-	destroy_workqueue(master->wq);
-
 err_put_dev:
 	put_device(&master->dev);
 



^ permalink raw reply	[flat|nested] 702+ messages in thread

* [PATCH 5.12 132/677] mfd: stmpe: Revert "Constify static struct resource"
  2021-05-12 14:40 [PATCH 5.12 000/677] 5.12.4-rc1 review Greg Kroah-Hartman
                   ` (130 preceding siblings ...)
  2021-05-12 14:42 ` [PATCH 5.12 131/677] Revert "i3c master: fix missing destroy_workqueue() on error in i3c_master_register" Greg Kroah-Hartman
@ 2021-05-12 14:42 ` Greg Kroah-Hartman
  2021-05-12 14:42 ` [PATCH 5.12 133/677] ovl: fix missing revert_creds() on error path Greg Kroah-Hartman
                   ` (552 subsequent siblings)
  684 siblings, 0 replies; 702+ messages in thread
From: Greg Kroah-Hartman @ 2021-05-12 14:42 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Andy Shevchenko, Rikard Falkeborn, Lee Jones

From: Rikard Falkeborn <rikard.falkeborn@gmail.com>

commit cb9e880a797a77c21c0f0e7ccd553da8eb4870af upstream.

In stmpe_devices_init(), the start and end field of these structs are
modified, so they can not be const. Add a comment to those structs that
lacked it to reduce the risk that this happens again.

This reverts commit 8d7b3a6dac4eae22c58b0853696cbd256966741b.

Fixes: 8d7b3a6dac4e ("mfd: stmpe: Constify static struct resource")
Reported-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
Signed-off-by: Rikard Falkeborn <rikard.falkeborn@gmail.com>
Reviewed-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
Signed-off-by: Lee Jones <lee.jones@linaro.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/mfd/stmpe.c |   14 +++++++++-----
 1 file changed, 9 insertions(+), 5 deletions(-)

--- a/drivers/mfd/stmpe.c
+++ b/drivers/mfd/stmpe.c
@@ -312,7 +312,7 @@ EXPORT_SYMBOL_GPL(stmpe_set_altfunc);
  * GPIO (all variants)
  */
 
-static const struct resource stmpe_gpio_resources[] = {
+static struct resource stmpe_gpio_resources[] = {
 	/* Start and end filled dynamically */
 	{
 		.flags	= IORESOURCE_IRQ,
@@ -336,7 +336,8 @@ static const struct mfd_cell stmpe_gpio_
  * Keypad (1601, 2401, 2403)
  */
 
-static const struct resource stmpe_keypad_resources[] = {
+static struct resource stmpe_keypad_resources[] = {
+	/* Start and end filled dynamically */
 	{
 		.name	= "KEYPAD",
 		.flags	= IORESOURCE_IRQ,
@@ -357,7 +358,8 @@ static const struct mfd_cell stmpe_keypa
 /*
  * PWM (1601, 2401, 2403)
  */
-static const struct resource stmpe_pwm_resources[] = {
+static struct resource stmpe_pwm_resources[] = {
+	/* Start and end filled dynamically */
 	{
 		.name	= "PWM0",
 		.flags	= IORESOURCE_IRQ,
@@ -445,7 +447,8 @@ static struct stmpe_variant_info stmpe80
  * Touchscreen (STMPE811 or STMPE610)
  */
 
-static const struct resource stmpe_ts_resources[] = {
+static struct resource stmpe_ts_resources[] = {
+	/* Start and end filled dynamically */
 	{
 		.name	= "TOUCH_DET",
 		.flags	= IORESOURCE_IRQ,
@@ -467,7 +470,8 @@ static const struct mfd_cell stmpe_ts_ce
  * ADC (STMPE811)
  */
 
-static const struct resource stmpe_adc_resources[] = {
+static struct resource stmpe_adc_resources[] = {
+	/* Start and end filled dynamically */
 	{
 		.name	= "STMPE_TEMP_SENS",
 		.flags	= IORESOURCE_IRQ,



^ permalink raw reply	[flat|nested] 702+ messages in thread

* [PATCH 5.12 133/677] ovl: fix missing revert_creds() on error path
  2021-05-12 14:40 [PATCH 5.12 000/677] 5.12.4-rc1 review Greg Kroah-Hartman
                   ` (131 preceding siblings ...)
  2021-05-12 14:42 ` [PATCH 5.12 132/677] mfd: stmpe: Revert "Constify static struct resource" Greg Kroah-Hartman
@ 2021-05-12 14:42 ` Greg Kroah-Hartman
  2021-05-12 14:43 ` [PATCH 5.12 134/677] Revert "drm/qxl: do not run release if qxl failed to init" Greg Kroah-Hartman
                   ` (551 subsequent siblings)
  684 siblings, 0 replies; 702+ messages in thread
From: Greg Kroah-Hartman @ 2021-05-12 14:42 UTC (permalink / raw)
  To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Dan Carpenter, Miklos Szeredi

From: Dan Carpenter <dan.carpenter@oracle.com>

commit 7b279bbfd2b230c7a210ff8f405799c7e46bbf48 upstream.

Smatch complains about missing that the ovl_override_creds() doesn't
have a matching revert_creds() if the dentry is disconnected.  Fix this
by moving the ovl_override_creds() until after the disconnected check.

Fixes: aa3ff3c152ff ("ovl: copy up of disconnected dentries")
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Miklos Szeredi <mszeredi@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 fs/overlayfs/copy_up.c |    3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

--- a/fs/overlayfs/copy_up.c
+++ b/fs/overlayfs/copy_up.c
@@ -932,7 +932,7 @@ static int ovl_copy_up_one(struct dentry
 static int ovl_copy_up_flags(struct dentry *dentry, int flags)
 {
 	int err = 0;
-	const struct cred *old_cred = ovl_override_creds(dentry->d_sb);
+	const struct cred *old_cred;
 	bool disconnected = (dentry->d_flags & DCACHE_DISCONNECTED);
 
 	/*
@@ -943,6 +943,7 @@ static int ovl_copy_up_flags(struct dent
 	if (WARN_ON(disconnected && d_is_dir(dentry)))
 		return -EIO;
 
+	old_cred = ovl_override_creds(dentry->d_sb);
 	while (!err) {
 		struct dentry *next;
 		struct dentry *parent = NULL;



^ permalink raw reply	[flat|nested] 702+ messages in thread

* [PATCH 5.12 134/677] Revert "drm/qxl: do not run release if qxl failed to init"
  2021-05-12 14:40 [PATCH 5.12 000/677] 5.12.4-rc1 review Greg Kroah-Hartman
                   ` (132 preceding siblings ...)
  2021-05-12 14:42 ` [PATCH 5.12 133/677] ovl: fix missing revert_creds() on error path Greg Kroah-Hartman
@ 2021-05-12 14:43 ` Greg Kroah-Hartman
  2021-05-12 14:43 ` [PATCH 5.12 135/677] usb: gadget: pch_udc: Revert d3cb25a12138 completely Greg Kroah-Hartman
                   ` (550 subsequent siblings)
  684 siblings, 0 replies; 702+ messages in thread
From: Greg Kroah-Hartman @ 2021-05-12 14:43 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Tong Zhang, Gerd Hoffmann, Thomas Zimmermann

From: Gerd Hoffmann <kraxel@redhat.com>

commit 93d8da8d7efbf690c0a9eaca798acc0c625245e6 upstream.

This reverts commit b91907a6241193465ca92e357adf16822242296d.

Patch is broken, it effectively makes qxl_drm_release() a nop
because on normal driver shutdown qxl_drm_release() is called
*after* drm_dev_unregister().

Fixes: b91907a62411 ("drm/qxl: do not run release if qxl failed to init")
Cc: Tong Zhang <ztong0001@gmail.com>
Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
Acked-by: Thomas Zimmermann <tzimmermann@suse.de>
Link: http://patchwork.freedesktop.org/patch/msgid/20210204145712.1531203-3-kraxel@redhat.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/gpu/drm/qxl/qxl_drv.c |    2 --
 1 file changed, 2 deletions(-)

--- a/drivers/gpu/drm/qxl/qxl_drv.c
+++ b/drivers/gpu/drm/qxl/qxl_drv.c
@@ -144,8 +144,6 @@ static void qxl_drm_release(struct drm_d
 	 * reordering qxl_modeset_fini() + qxl_device_fini() calls is
 	 * non-trivial though.
 	 */
-	if (!dev->registered)
-		return;
 	qxl_modeset_fini(qdev);
 	qxl_device_fini(qdev);
 }



^ permalink raw reply	[flat|nested] 702+ messages in thread

* [PATCH 5.12 135/677] usb: gadget: pch_udc: Revert d3cb25a12138 completely
  2021-05-12 14:40 [PATCH 5.12 000/677] 5.12.4-rc1 review Greg Kroah-Hartman
                   ` (133 preceding siblings ...)
  2021-05-12 14:43 ` [PATCH 5.12 134/677] Revert "drm/qxl: do not run release if qxl failed to init" Greg Kroah-Hartman
@ 2021-05-12 14:43 ` Greg Kroah-Hartman
  2021-05-12 14:43 ` [PATCH 5.12 136/677] Revert "tools/power turbostat: adjust for temperature offset" Greg Kroah-Hartman
                   ` (549 subsequent siblings)
  684 siblings, 0 replies; 702+ messages in thread
From: Greg Kroah-Hartman @ 2021-05-12 14:43 UTC (permalink / raw)
  To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Iago Abal, Andy Shevchenko

From: Andy Shevchenko <andriy.shevchenko@linux.intel.com>

commit 50a318cc9b54a36f00beadf77e578a50f3620477 upstream.

The commit d3cb25a12138 ("usb: gadget: udc: fix spin_lock in pch_udc")
obviously was not thought through and had made the situation even worse
than it was before. Two changes after almost reverted it. but a few
leftovers have been left as it. With this revert d3cb25a12138 completely.

While at it, narrow down the scope of unlocked section to prevent
potential race when prot_stall is assigned.

Fixes: d3cb25a12138 ("usb: gadget: udc: fix spin_lock in pch_udc")
Fixes: 9903b6bedd38 ("usb: gadget: pch-udc: fix lock")
Fixes: 1d23d16a88e6 ("usb: gadget: pch_udc: reorder spin_[un]lock to avoid deadlock")
Cc: Iago Abal <mail@iagoabal.eu>
Signed-off-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
Link: https://lore.kernel.org/r/20210323153626.54908-5-andriy.shevchenko@linux.intel.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/usb/gadget/udc/pch_udc.c |   17 +++++++++++++----
 1 file changed, 13 insertions(+), 4 deletions(-)

--- a/drivers/usb/gadget/udc/pch_udc.c
+++ b/drivers/usb/gadget/udc/pch_udc.c
@@ -596,18 +596,22 @@ static void pch_udc_reconnect(struct pch
 static inline void pch_udc_vbus_session(struct pch_udc_dev *dev,
 					  int is_active)
 {
+	unsigned long		iflags;
+
+	spin_lock_irqsave(&dev->lock, iflags);
 	if (is_active) {
 		pch_udc_reconnect(dev);
 		dev->vbus_session = 1;
 	} else {
 		if (dev->driver && dev->driver->disconnect) {
-			spin_lock(&dev->lock);
+			spin_unlock_irqrestore(&dev->lock, iflags);
 			dev->driver->disconnect(&dev->gadget);
-			spin_unlock(&dev->lock);
+			spin_lock_irqsave(&dev->lock, iflags);
 		}
 		pch_udc_set_disconnect(dev);
 		dev->vbus_session = 0;
 	}
+	spin_unlock_irqrestore(&dev->lock, iflags);
 }
 
 /**
@@ -1166,20 +1170,25 @@ static int pch_udc_pcd_selfpowered(struc
 static int pch_udc_pcd_pullup(struct usb_gadget *gadget, int is_on)
 {
 	struct pch_udc_dev	*dev;
+	unsigned long		iflags;
 
 	if (!gadget)
 		return -EINVAL;
+
 	dev = container_of(gadget, struct pch_udc_dev, gadget);
+
+	spin_lock_irqsave(&dev->lock, iflags);
 	if (is_on) {
 		pch_udc_reconnect(dev);
 	} else {
 		if (dev->driver && dev->driver->disconnect) {
-			spin_lock(&dev->lock);
+			spin_unlock_irqrestore(&dev->lock, iflags);
 			dev->driver->disconnect(&dev->gadget);
-			spin_unlock(&dev->lock);
+			spin_lock_irqsave(&dev->lock, iflags);
 		}
 		pch_udc_set_disconnect(dev);
 	}
+	spin_unlock_irqrestore(&dev->lock, iflags);
 
 	return 0;
 }



^ permalink raw reply	[flat|nested] 702+ messages in thread

* [PATCH 5.12 136/677] Revert "tools/power turbostat: adjust for temperature offset"
  2021-05-12 14:40 [PATCH 5.12 000/677] 5.12.4-rc1 review Greg Kroah-Hartman
                   ` (134 preceding siblings ...)
  2021-05-12 14:43 ` [PATCH 5.12 135/677] usb: gadget: pch_udc: Revert d3cb25a12138 completely Greg Kroah-Hartman
@ 2021-05-12 14:43 ` Greg Kroah-Hartman
  2021-05-12 14:43 ` [PATCH 5.12 137/677] firmware: xilinx: Fix dereferencing freed memory Greg Kroah-Hartman
                   ` (548 subsequent siblings)
  684 siblings, 0 replies; 702+ messages in thread
From: Greg Kroah-Hartman @ 2021-05-12 14:43 UTC (permalink / raw)
  To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Len Brown

From: Len Brown <len.brown@intel.com>

commit b2b94be787bf47eedd5890a249f3318bf9f1f1d5 upstream.

This reverts commit 6ff7cb371c4bea3dba03a56d774da925e78a5087.

Apparently the TCC offset should not be used to adjust what temperature
we show the user after all.

(on most systems, TCC offset is 0, FWIW)

Fixes: 6ff7cb371c4b

Signed-off-by: Len Brown <len.brown@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 tools/power/x86/turbostat/turbostat.c |   62 ++++++++++++++++++----------------
 1 file changed, 33 insertions(+), 29 deletions(-)

--- a/tools/power/x86/turbostat/turbostat.c
+++ b/tools/power/x86/turbostat/turbostat.c
@@ -4822,33 +4822,12 @@ double discover_bclk(unsigned int family
  * below this value, including the Digital Thermal Sensor (DTS),
  * Package Thermal Management Sensor (PTM), and thermal event thresholds.
  */
-int read_tcc_activation_temp()
+int set_temperature_target(struct thread_data *t, struct core_data *c, struct pkg_data *p)
 {
 	unsigned long long msr;
-	unsigned int tcc, target_c, offset_c;
-
-	/* Temperature Target MSR is Nehalem and newer only */
-	if (!do_nhm_platform_info)
-		return 0;
-
-	if (get_msr(base_cpu, MSR_IA32_TEMPERATURE_TARGET, &msr))
-		return 0;
+	unsigned int target_c_local;
+	int cpu;
 
-	target_c = (msr >> 16) & 0xFF;
-
-	offset_c = (msr >> 24) & 0xF;
-
-	tcc = target_c - offset_c;
-
-	if (!quiet)
-		fprintf(outf, "cpu%d: MSR_IA32_TEMPERATURE_TARGET: 0x%08llx (%d C) (%d default - %d offset)\n",
-			base_cpu, msr, tcc, target_c, offset_c);
-
-	return tcc;
-}
-
-int set_temperature_target(struct thread_data *t, struct core_data *c, struct pkg_data *p)
-{
 	/* tcc_activation_temp is used only for dts or ptm */
 	if (!(do_dts || do_ptm))
 		return 0;
@@ -4857,18 +4836,43 @@ int set_temperature_target(struct thread
 	if (!(t->flags & CPU_IS_FIRST_THREAD_IN_CORE) || !(t->flags & CPU_IS_FIRST_CORE_IN_PACKAGE))
 		return 0;
 
+	cpu = t->cpu_id;
+	if (cpu_migrate(cpu)) {
+		fprintf(outf, "Could not migrate to CPU %d\n", cpu);
+		return -1;
+	}
+
 	if (tcc_activation_temp_override != 0) {
 		tcc_activation_temp = tcc_activation_temp_override;
-		fprintf(outf, "Using cmdline TCC Target (%d C)\n", tcc_activation_temp);
+		fprintf(outf, "cpu%d: Using cmdline TCC Target (%d C)\n",
+			cpu, tcc_activation_temp);
 		return 0;
 	}
 
-	tcc_activation_temp = read_tcc_activation_temp();
-	if (tcc_activation_temp)
-		return 0;
+	/* Temperature Target MSR is Nehalem and newer only */
+	if (!do_nhm_platform_info)
+		goto guess;
+
+	if (get_msr(base_cpu, MSR_IA32_TEMPERATURE_TARGET, &msr))
+		goto guess;
+
+	target_c_local = (msr >> 16) & 0xFF;
+
+	if (!quiet)
+		fprintf(outf, "cpu%d: MSR_IA32_TEMPERATURE_TARGET: 0x%08llx (%d C)\n",
+			cpu, msr, target_c_local);
+
+	if (!target_c_local)
+		goto guess;
+
+	tcc_activation_temp = target_c_local;
+
+	return 0;
 
+guess:
 	tcc_activation_temp = TJMAX_DEFAULT;
-	fprintf(outf, "Guessing tjMax %d C, Please use -T to specify\n", tcc_activation_temp);
+	fprintf(outf, "cpu%d: Guessing tjMax %d C, Please use -T to specify\n",
+		cpu, tcc_activation_temp);
 
 	return 0;
 }



^ permalink raw reply	[flat|nested] 702+ messages in thread

* [PATCH 5.12 137/677] firmware: xilinx: Fix dereferencing freed memory
  2021-05-12 14:40 [PATCH 5.12 000/677] 5.12.4-rc1 review Greg Kroah-Hartman
                   ` (135 preceding siblings ...)
  2021-05-12 14:43 ` [PATCH 5.12 136/677] Revert "tools/power turbostat: adjust for temperature offset" Greg Kroah-Hartman
@ 2021-05-12 14:43 ` Greg Kroah-Hartman
  2021-05-12 14:43 ` [PATCH 5.12 138/677] firmware: xilinx: Remove zynqmp_pm_get_eemi_ops() in IS_REACHABLE(CONFIG_ZYNQMP_FIRMWARE) Greg Kroah-Hartman
                   ` (547 subsequent siblings)
  684 siblings, 0 replies; 702+ messages in thread
From: Greg Kroah-Hartman @ 2021-05-12 14:43 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, kernel test robot, Dan Carpenter,
	Tejas Patel, Rajan Vaja, Michal Simek, Sasha Levin

From: Tejas Patel <tejas.patel@xilinx.com>

[ Upstream commit f1f21bece82c76a56a96988ec7d51ccc033d8949 ]

Fix smatch warning:
drivers/firmware/xilinx/zynqmp.c:1288 zynqmp_firmware_remove()
error: dereferencing freed memory 'feature_data'

Use hash_for_each_safe for safe removal of hash entry.

Fixes: acfdd18591ea ("firmware: xilinx: Use hash-table for api feature check")
Reported-by: kernel test robot <lkp@intel.com>
Reported-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Tejas Patel <tejas.patel@xilinx.com>
Signed-off-by: Rajan Vaja <rajan.vaja@xilinx.com>
Link: https://lore.kernel.org/r/1612765883-22018-1-git-send-email-rajan.vaja@xilinx.com
Signed-off-by: Michal Simek <michal.simek@xilinx.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/firmware/xilinx/zynqmp.c | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/drivers/firmware/xilinx/zynqmp.c b/drivers/firmware/xilinx/zynqmp.c
index 7eb9958662dd..83082e2f2e44 100644
--- a/drivers/firmware/xilinx/zynqmp.c
+++ b/drivers/firmware/xilinx/zynqmp.c
@@ -2,7 +2,7 @@
 /*
  * Xilinx Zynq MPSoC Firmware layer
  *
- *  Copyright (C) 2014-2020 Xilinx, Inc.
+ *  Copyright (C) 2014-2021 Xilinx, Inc.
  *
  *  Michal Simek <michal.simek@xilinx.com>
  *  Davorin Mista <davorin.mista@aggios.com>
@@ -1280,12 +1280,13 @@ static int zynqmp_firmware_probe(struct platform_device *pdev)
 static int zynqmp_firmware_remove(struct platform_device *pdev)
 {
 	struct pm_api_feature_data *feature_data;
+	struct hlist_node *tmp;
 	int i;
 
 	mfd_remove_devices(&pdev->dev);
 	zynqmp_pm_api_debugfs_exit();
 
-	hash_for_each(pm_api_features_map, i, feature_data, hentry) {
+	hash_for_each_safe(pm_api_features_map, i, tmp, feature_data, hentry) {
 		hash_del(&feature_data->hentry);
 		kfree(feature_data);
 	}
-- 
2.30.2




^ permalink raw reply related	[flat|nested] 702+ messages in thread

* [PATCH 5.12 138/677] firmware: xilinx: Remove zynqmp_pm_get_eemi_ops() in IS_REACHABLE(CONFIG_ZYNQMP_FIRMWARE)
  2021-05-12 14:40 [PATCH 5.12 000/677] 5.12.4-rc1 review Greg Kroah-Hartman
                   ` (136 preceding siblings ...)
  2021-05-12 14:43 ` [PATCH 5.12 137/677] firmware: xilinx: Fix dereferencing freed memory Greg Kroah-Hartman
@ 2021-05-12 14:43 ` Greg Kroah-Hartman
  2021-05-12 14:43 ` [PATCH 5.12 139/677] x86/vdso: Use proper modifier for lens format specifier in extract() Greg Kroah-Hartman
                   ` (546 subsequent siblings)
  684 siblings, 0 replies; 702+ messages in thread
From: Greg Kroah-Hartman @ 2021-05-12 14:43 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Nobuhiro Iwamatsu, Michal Simek, Sasha Levin

From: Nobuhiro Iwamatsu <iwamatsu@nigauri.org>

[ Upstream commit 79bfe480a0a0b259ab9fddcd2fe52c03542b1196 ]

zynqmp_pm_get_eemi_ops() was removed in commit 4db8180ffe7c: "Firmware: xilinx:
Remove eemi ops for fpga related APIs", but not in IS_REACHABLE(CONFIG_ZYNQMP_FIRMWARE).
Any driver who want to communicate with PMC using EEMI APIs use the functions provided
for each function
This removed zynqmp_pm_get_eemi_ops() in IS_REACHABLE(CONFIG_ZYNQMP_FIRMWARE), and also
modify the documentation for this driver.

Fixes: 4db8180ffe7c ("firmware: xilinx: Remove eemi ops for fpga related APIs")
Signed-off-by: Nobuhiro Iwamatsu <iwamatsu@nigauri.org>
Link: https://lore.kernel.org/r/20210215155849.2425846-1-iwamatsu@nigauri.org
Signed-off-by: Michal Simek <michal.simek@xilinx.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 Documentation/driver-api/xilinx/eemi.rst | 31 ++----------------------
 include/linux/firmware/xlnx-zynqmp.h     |  5 ----
 2 files changed, 2 insertions(+), 34 deletions(-)

diff --git a/Documentation/driver-api/xilinx/eemi.rst b/Documentation/driver-api/xilinx/eemi.rst
index 9dcbc6f18d75..c1bc47b9000d 100644
--- a/Documentation/driver-api/xilinx/eemi.rst
+++ b/Documentation/driver-api/xilinx/eemi.rst
@@ -16,35 +16,8 @@ components running across different processing clusters on a chip or
 device to communicate with a power management controller (PMC) on a
 device to issue or respond to power management requests.
 
-EEMI ops is a structure containing all eemi APIs supported by Zynq MPSoC.
-The zynqmp-firmware driver maintain all EEMI APIs in zynqmp_eemi_ops
-structure. Any driver who want to communicate with PMC using EEMI APIs
-can call zynqmp_pm_get_eemi_ops().
-
-Example of EEMI ops::
-
-	/* zynqmp-firmware driver maintain all EEMI APIs */
-	struct zynqmp_eemi_ops {
-		int (*get_api_version)(u32 *version);
-		int (*query_data)(struct zynqmp_pm_query_data qdata, u32 *out);
-	};
-
-	static const struct zynqmp_eemi_ops eemi_ops = {
-		.get_api_version = zynqmp_pm_get_api_version,
-		.query_data = zynqmp_pm_query_data,
-	};
-
-Example of EEMI ops usage::
-
-	static const struct zynqmp_eemi_ops *eemi_ops;
-	u32 ret_payload[PAYLOAD_ARG_CNT];
-	int ret;
-
-	eemi_ops = zynqmp_pm_get_eemi_ops();
-	if (IS_ERR(eemi_ops))
-		return PTR_ERR(eemi_ops);
-
-	ret = eemi_ops->query_data(qdata, ret_payload);
+Any driver who wants to communicate with PMC using EEMI APIs use the
+functions provided for each function.
 
 IOCTL
 ------
diff --git a/include/linux/firmware/xlnx-zynqmp.h b/include/linux/firmware/xlnx-zynqmp.h
index 71177b17eee5..66e2423d9feb 100644
--- a/include/linux/firmware/xlnx-zynqmp.h
+++ b/include/linux/firmware/xlnx-zynqmp.h
@@ -354,11 +354,6 @@ int zynqmp_pm_read_pggs(u32 index, u32 *value);
 int zynqmp_pm_system_shutdown(const u32 type, const u32 subtype);
 int zynqmp_pm_set_boot_health_status(u32 value);
 #else
-static inline struct zynqmp_eemi_ops *zynqmp_pm_get_eemi_ops(void)
-{
-	return ERR_PTR(-ENODEV);
-}
-
 static inline int zynqmp_pm_get_api_version(u32 *version)
 {
 	return -ENODEV;
-- 
2.30.2




^ permalink raw reply related	[flat|nested] 702+ messages in thread

* [PATCH 5.12 139/677] x86/vdso: Use proper modifier for lens format specifier in extract()
  2021-05-12 14:40 [PATCH 5.12 000/677] 5.12.4-rc1 review Greg Kroah-Hartman
                   ` (137 preceding siblings ...)
  2021-05-12 14:43 ` [PATCH 5.12 138/677] firmware: xilinx: Remove zynqmp_pm_get_eemi_ops() in IS_REACHABLE(CONFIG_ZYNQMP_FIRMWARE) Greg Kroah-Hartman
@ 2021-05-12 14:43 ` Greg Kroah-Hartman
  2021-05-12 14:43 ` [PATCH 5.12 140/677] fpga: fpga-mgr: xilinx-spi: fix error messages on -EPROBE_DEFER Greg Kroah-Hartman
                   ` (545 subsequent siblings)
  684 siblings, 0 replies; 702+ messages in thread
From: Greg Kroah-Hartman @ 2021-05-12 14:43 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Jiri Slaby, Borislav Petkov,
	Jarkko Sakkinen, Sasha Levin

From: Jiri Slaby <jslaby@suse.cz>

[ Upstream commit 70c9d959226b7c5c48c119e2c1cfc1424f87b023 ]

Commit

  8382c668ce4f ("x86/vdso: Add support for exception fixup in vDSO functions")

prints length "len" which is size_t.

Compilers now complain when building on a 32-bit host:

  HOSTCC  arch/x86/entry/vdso/vdso2c
  ...
  In file included from arch/x86/entry/vdso/vdso2c.c:162:
  arch/x86/entry/vdso/vdso2c.h: In function 'extract64':
  arch/x86/entry/vdso/vdso2c.h:38:52: warning: format '%lu' expects argument of \
	type 'long unsigned int', but argument 4 has type 'size_t' {aka 'unsigned int'}

So use proper modifier (%zu) for size_t.

 [ bp: Massage commit message. ]

Fixes: 8382c668ce4f ("x86/vdso: Add support for exception fixup in vDSO functions")
Signed-off-by: Jiri Slaby <jslaby@suse.cz>
Signed-off-by: Borislav Petkov <bp@suse.de>
Acked-by: Jarkko Sakkinen <jarkko@kernel.org>
Link: https://lkml.kernel.org/r/20210303064357.17056-1-jslaby@suse.cz
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/x86/entry/vdso/vdso2c.h | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/arch/x86/entry/vdso/vdso2c.h b/arch/x86/entry/vdso/vdso2c.h
index 1c7cfac7e64a..5264daa8859f 100644
--- a/arch/x86/entry/vdso/vdso2c.h
+++ b/arch/x86/entry/vdso/vdso2c.h
@@ -35,7 +35,7 @@ static void BITSFUNC(extract)(const unsigned char *data, size_t data_len,
 	if (offset + len > data_len)
 		fail("section to extract overruns input data");
 
-	fprintf(outfile, "static const unsigned char %s[%lu] = {", name, len);
+	fprintf(outfile, "static const unsigned char %s[%zu] = {", name, len);
 	BITSFUNC(copy)(outfile, data + offset, len);
 	fprintf(outfile, "\n};\n\n");
 }
-- 
2.30.2




^ permalink raw reply related	[flat|nested] 702+ messages in thread

* [PATCH 5.12 140/677] fpga: fpga-mgr: xilinx-spi: fix error messages on -EPROBE_DEFER
  2021-05-12 14:40 [PATCH 5.12 000/677] 5.12.4-rc1 review Greg Kroah-Hartman
                   ` (138 preceding siblings ...)
  2021-05-12 14:43 ` [PATCH 5.12 139/677] x86/vdso: Use proper modifier for lens format specifier in extract() Greg Kroah-Hartman
@ 2021-05-12 14:43 ` Greg Kroah-Hartman
  2021-05-12 14:43 ` [PATCH 5.12 141/677] crypto: keembay-ocs-hcu - Fix error return code in kmb_ocs_hcu_probe() Greg Kroah-Hartman
                   ` (544 subsequent siblings)
  684 siblings, 0 replies; 702+ messages in thread
From: Greg Kroah-Hartman @ 2021-05-12 14:43 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Luca Ceresoli, Moritz Fischer, Sasha Levin

From: Luca Ceresoli <luca@lucaceresoli.net>

[ Upstream commit 484a58607a808c3721917f5ca5fba7eff809e4df ]

The current code produces an error message on devm_gpiod_get() errors even
when the error is -EPROBE_DEFER, which should be silent.

This has been observed producing a significant amount of messages like:

    xlnx-slave-spi spi1.1: Failed to get PROGRAM_B gpio: -517

Fix and simplify code by using the dev_err_probe() helper function.

Signed-off-by: Luca Ceresoli <luca@lucaceresoli.net>
Fixes: dd2784c01d93 ("fpga manager: xilinx-spi: check INIT_B pin during write_init")
Fixes: 061c97d13f1a ("fpga manager: Add Xilinx slave serial SPI driver")
Signed-off-by: Moritz Fischer <mdf@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/fpga/xilinx-spi.c | 24 +++++++++---------------
 1 file changed, 9 insertions(+), 15 deletions(-)

diff --git a/drivers/fpga/xilinx-spi.c b/drivers/fpga/xilinx-spi.c
index 27defa98092d..fee4d0abf6bf 100644
--- a/drivers/fpga/xilinx-spi.c
+++ b/drivers/fpga/xilinx-spi.c
@@ -233,25 +233,19 @@ static int xilinx_spi_probe(struct spi_device *spi)
 
 	/* PROGRAM_B is active low */
 	conf->prog_b = devm_gpiod_get(&spi->dev, "prog_b", GPIOD_OUT_LOW);
-	if (IS_ERR(conf->prog_b)) {
-		dev_err(&spi->dev, "Failed to get PROGRAM_B gpio: %ld\n",
-			PTR_ERR(conf->prog_b));
-		return PTR_ERR(conf->prog_b);
-	}
+	if (IS_ERR(conf->prog_b))
+		return dev_err_probe(&spi->dev, PTR_ERR(conf->prog_b),
+				     "Failed to get PROGRAM_B gpio\n");
 
 	conf->init_b = devm_gpiod_get_optional(&spi->dev, "init-b", GPIOD_IN);
-	if (IS_ERR(conf->init_b)) {
-		dev_err(&spi->dev, "Failed to get INIT_B gpio: %ld\n",
-			PTR_ERR(conf->init_b));
-		return PTR_ERR(conf->init_b);
-	}
+	if (IS_ERR(conf->init_b))
+		return dev_err_probe(&spi->dev, PTR_ERR(conf->init_b),
+				     "Failed to get INIT_B gpio\n");
 
 	conf->done = devm_gpiod_get(&spi->dev, "done", GPIOD_IN);
-	if (IS_ERR(conf->done)) {
-		dev_err(&spi->dev, "Failed to get DONE gpio: %ld\n",
-			PTR_ERR(conf->done));
-		return PTR_ERR(conf->done);
-	}
+	if (IS_ERR(conf->done))
+		return dev_err_probe(&spi->dev, PTR_ERR(conf->done),
+				     "Failed to get DONE gpio\n");
 
 	mgr = devm_fpga_mgr_create(&spi->dev,
 				   "Xilinx Slave Serial FPGA Manager",
-- 
2.30.2




^ permalink raw reply related	[flat|nested] 702+ messages in thread

* [PATCH 5.12 141/677] crypto: keembay-ocs-hcu - Fix error return code in kmb_ocs_hcu_probe()
  2021-05-12 14:40 [PATCH 5.12 000/677] 5.12.4-rc1 review Greg Kroah-Hartman
                   ` (139 preceding siblings ...)
  2021-05-12 14:43 ` [PATCH 5.12 140/677] fpga: fpga-mgr: xilinx-spi: fix error messages on -EPROBE_DEFER Greg Kroah-Hartman
@ 2021-05-12 14:43 ` Greg Kroah-Hartman
  2021-05-12 14:43 ` [PATCH 5.12 142/677] crypto: keembay-ocs-aes - Fix error return code in kmb_ocs_aes_probe() Greg Kroah-Hartman
                   ` (543 subsequent siblings)
  684 siblings, 0 replies; 702+ messages in thread
From: Greg Kroah-Hartman @ 2021-05-12 14:43 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Hulk Robot, Wei Yongjun,
	Daniele Alessandrelli, Herbert Xu, Sasha Levin

From: Wei Yongjun <weiyongjun1@huawei.com>

[ Upstream commit 662c1c5618aaf71f99ada3105b99668a503605ae ]

Fix to return negative error code -ENOMEM from the error handling
case instead of 0, as done elsewhere in this function.

Fixes: 472b04444cd3 ("crypto: keembay - Add Keem Bay OCS HCU driver")
Reported-by: Hulk Robot <hulkci@huawei.com>
Signed-off-by: Wei Yongjun <weiyongjun1@huawei.com>
Reviewed-by: Daniele Alessandrelli <daniele.alessandrelli@intel.com>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/crypto/keembay/keembay-ocs-hcu-core.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/drivers/crypto/keembay/keembay-ocs-hcu-core.c b/drivers/crypto/keembay/keembay-ocs-hcu-core.c
index c4b97b4160e9..322c51a6936f 100644
--- a/drivers/crypto/keembay/keembay-ocs-hcu-core.c
+++ b/drivers/crypto/keembay/keembay-ocs-hcu-core.c
@@ -1220,8 +1220,10 @@ static int kmb_ocs_hcu_probe(struct platform_device *pdev)
 
 	/* Initialize crypto engine */
 	hcu_dev->engine = crypto_engine_alloc_init(dev, 1);
-	if (!hcu_dev->engine)
+	if (!hcu_dev->engine) {
+		rc = -ENOMEM;
 		goto list_del;
+	}
 
 	rc = crypto_engine_start(hcu_dev->engine);
 	if (rc) {
-- 
2.30.2




^ permalink raw reply related	[flat|nested] 702+ messages in thread

* [PATCH 5.12 142/677] crypto: keembay-ocs-aes - Fix error return code in kmb_ocs_aes_probe()
  2021-05-12 14:40 [PATCH 5.12 000/677] 5.12.4-rc1 review Greg Kroah-Hartman
                   ` (140 preceding siblings ...)
  2021-05-12 14:43 ` [PATCH 5.12 141/677] crypto: keembay-ocs-hcu - Fix error return code in kmb_ocs_hcu_probe() Greg Kroah-Hartman
@ 2021-05-12 14:43 ` Greg Kroah-Hartman
  2021-05-12 14:43 ` [PATCH 5.12 143/677] crypto: sun8i-ss - fix result memory leak on error path Greg Kroah-Hartman
                   ` (542 subsequent siblings)
  684 siblings, 0 replies; 702+ messages in thread
From: Greg Kroah-Hartman @ 2021-05-12 14:43 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Hulk Robot, Wei Yongjun,
	Daniele Alessandrelli, Herbert Xu, Sasha Levin

From: Wei Yongjun <weiyongjun1@huawei.com>

[ Upstream commit 2eee428d8212265af09d349b74746be03513382e ]

Fix to return negative error code -ENOMEM from the error handling
case instead of 0, as done elsewhere in this function.

Fixes: 885743324513 ("crypto: keembay - Add support for Keem Bay OCS AES/SM4")
Reported-by: Hulk Robot <hulkci@huawei.com>
Signed-off-by: Wei Yongjun <weiyongjun1@huawei.com>
Reviewed-by: Daniele Alessandrelli <daniele.alessandrelli@intel.com>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/crypto/keembay/keembay-ocs-aes-core.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/drivers/crypto/keembay/keembay-ocs-aes-core.c b/drivers/crypto/keembay/keembay-ocs-aes-core.c
index b6b25d994af3..2ef312866338 100644
--- a/drivers/crypto/keembay/keembay-ocs-aes-core.c
+++ b/drivers/crypto/keembay/keembay-ocs-aes-core.c
@@ -1649,8 +1649,10 @@ static int kmb_ocs_aes_probe(struct platform_device *pdev)
 
 	/* Initialize crypto engine */
 	aes_dev->engine = crypto_engine_alloc_init(dev, true);
-	if (!aes_dev->engine)
+	if (!aes_dev->engine) {
+		rc = -ENOMEM;
 		goto list_del;
+	}
 
 	rc = crypto_engine_start(aes_dev->engine);
 	if (rc) {
-- 
2.30.2




^ permalink raw reply related	[flat|nested] 702+ messages in thread

* [PATCH 5.12 143/677] crypto: sun8i-ss - fix result memory leak on error path
  2021-05-12 14:40 [PATCH 5.12 000/677] 5.12.4-rc1 review Greg Kroah-Hartman
                   ` (141 preceding siblings ...)
  2021-05-12 14:43 ` [PATCH 5.12 142/677] crypto: keembay-ocs-aes - Fix error return code in kmb_ocs_aes_probe() Greg Kroah-Hartman
@ 2021-05-12 14:43 ` Greg Kroah-Hartman
  2021-05-12 14:43 ` [PATCH 5.12 144/677] memory: gpmc: fix out of bounds read and dereference on gpmc_cs[] Greg Kroah-Hartman
                   ` (541 subsequent siblings)
  684 siblings, 0 replies; 702+ messages in thread
From: Greg Kroah-Hartman @ 2021-05-12 14:43 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, kernel test robot, Dan Carpenter,
	Corentin Labbe, Herbert Xu, Sasha Levin

From: Corentin Labbe <clabbe.montjoie@gmail.com>

[ Upstream commit 1dbc6a1e25be8575d6c4114d1d2b841a796507f7 ]

This patch fixes a memory leak on an error path.

Fixes: d9b45418a917 ("crypto: sun8i-ss - support hash algorithms")
Reported-by: kernel test robot <lkp@intel.com>
Reported-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Corentin Labbe <clabbe.montjoie@gmail.com>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/crypto/allwinner/sun8i-ss/sun8i-ss-hash.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/crypto/allwinner/sun8i-ss/sun8i-ss-hash.c b/drivers/crypto/allwinner/sun8i-ss/sun8i-ss-hash.c
index 11cbcbc83a7b..0b9aa24a5edd 100644
--- a/drivers/crypto/allwinner/sun8i-ss/sun8i-ss-hash.c
+++ b/drivers/crypto/allwinner/sun8i-ss/sun8i-ss-hash.c
@@ -438,8 +438,8 @@ int sun8i_ss_hash_run(struct crypto_engine *engine, void *breq)
 	kfree(pad);
 
 	memcpy(areq->result, result, algt->alg.hash.halg.digestsize);
-	kfree(result);
 theend:
+	kfree(result);
 	crypto_finalize_hash_request(engine, breq, err);
 	return 0;
 }
-- 
2.30.2




^ permalink raw reply related	[flat|nested] 702+ messages in thread

* [PATCH 5.12 144/677] memory: gpmc: fix out of bounds read and dereference on gpmc_cs[]
  2021-05-12 14:40 [PATCH 5.12 000/677] 5.12.4-rc1 review Greg Kroah-Hartman
                   ` (142 preceding siblings ...)
  2021-05-12 14:43 ` [PATCH 5.12 143/677] crypto: sun8i-ss - fix result memory leak on error path Greg Kroah-Hartman
@ 2021-05-12 14:43 ` Greg Kroah-Hartman
  2021-05-12 14:43 ` [PATCH 5.12 145/677] ARM: dts: exynos: correct fuel gauge interrupt trigger level on GT-I9100 Greg Kroah-Hartman
                   ` (540 subsequent siblings)
  684 siblings, 0 replies; 702+ messages in thread
From: Greg Kroah-Hartman @ 2021-05-12 14:43 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Colin Ian King, Tony Lindgren,
	Krzysztof Kozlowski, Sasha Levin

From: Colin Ian King <colin.king@canonical.com>

[ Upstream commit e004c3e67b6459c99285b18366a71af467d869f5 ]

Currently the array gpmc_cs is indexed by cs before it cs is range checked
and the pointer read from this out-of-index read is dereferenced. Fix this
by performing the range check on cs before the read and the following
pointer dereference.

Addresses-Coverity: ("Negative array index read")
Fixes: 9ed7a776eb50 ("ARM: OMAP2+: Fix support for multiple devices on a GPMC chip select")
Signed-off-by: Colin Ian King <colin.king@canonical.com>
Reviewed-by: Tony Lindgren <tony@atomide.com>
Link: https://lore.kernel.org/r/20210223193821.17232-1-colin.king@canonical.com
Signed-off-by: Krzysztof Kozlowski <krzk@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/memory/omap-gpmc.c | 7 +++++--
 1 file changed, 5 insertions(+), 2 deletions(-)

diff --git a/drivers/memory/omap-gpmc.c b/drivers/memory/omap-gpmc.c
index cfa730cfd145..f80c2ea39ca4 100644
--- a/drivers/memory/omap-gpmc.c
+++ b/drivers/memory/omap-gpmc.c
@@ -1009,8 +1009,8 @@ EXPORT_SYMBOL(gpmc_cs_request);
 
 void gpmc_cs_free(int cs)
 {
-	struct gpmc_cs_data *gpmc = &gpmc_cs[cs];
-	struct resource *res = &gpmc->mem;
+	struct gpmc_cs_data *gpmc;
+	struct resource *res;
 
 	spin_lock(&gpmc_mem_lock);
 	if (cs >= gpmc_cs_num || cs < 0 || !gpmc_cs_reserved(cs)) {
@@ -1018,6 +1018,9 @@ void gpmc_cs_free(int cs)
 		spin_unlock(&gpmc_mem_lock);
 		return;
 	}
+	gpmc = &gpmc_cs[cs];
+	res = &gpmc->mem;
+
 	gpmc_cs_disable_mem(cs);
 	if (res->flags)
 		release_resource(res);
-- 
2.30.2




^ permalink raw reply related	[flat|nested] 702+ messages in thread

* [PATCH 5.12 145/677] ARM: dts: exynos: correct fuel gauge interrupt trigger level on GT-I9100
  2021-05-12 14:40 [PATCH 5.12 000/677] 5.12.4-rc1 review Greg Kroah-Hartman
                   ` (143 preceding siblings ...)
  2021-05-12 14:43 ` [PATCH 5.12 144/677] memory: gpmc: fix out of bounds read and dereference on gpmc_cs[] Greg Kroah-Hartman
@ 2021-05-12 14:43 ` Greg Kroah-Hartman
  2021-05-12 14:43 ` [PATCH 5.12 146/677] ARM: dts: exynos: correct fuel gauge interrupt trigger level on P4 Note family Greg Kroah-Hartman
                   ` (539 subsequent siblings)
  684 siblings, 0 replies; 702+ messages in thread
From: Greg Kroah-Hartman @ 2021-05-12 14:43 UTC (permalink / raw)
  To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Krzysztof Kozlowski, Sasha Levin

From: Krzysztof Kozlowski <krzk@kernel.org>

[ Upstream commit 46799802136670e00498f19898f1635fbc85f583 ]

The Maxim fuel gauge datasheets describe the interrupt line as active
low with a requirement of acknowledge from the CPU.  The falling edge
interrupt will mostly work but it's not correct.

Fixes: 8620cc2f99b7 ("ARM: dts: exynos: Add devicetree file for the Galaxy S2")
Signed-off-by: Krzysztof Kozlowski <krzk@kernel.org>
Link: https://lore.kernel.org/r/20201210212534.216197-1-krzk@kernel.org
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/arm/boot/dts/exynos4210-i9100.dts | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/arch/arm/boot/dts/exynos4210-i9100.dts b/arch/arm/boot/dts/exynos4210-i9100.dts
index 304a8ee2364c..d98c78207aaf 100644
--- a/arch/arm/boot/dts/exynos4210-i9100.dts
+++ b/arch/arm/boot/dts/exynos4210-i9100.dts
@@ -136,7 +136,7 @@
 			compatible = "maxim,max17042";
 
 			interrupt-parent = <&gpx2>;
-			interrupts = <3 IRQ_TYPE_EDGE_FALLING>;
+			interrupts = <3 IRQ_TYPE_LEVEL_LOW>;
 
 			pinctrl-0 = <&max17042_fuel_irq>;
 			pinctrl-names = "default";
-- 
2.30.2




^ permalink raw reply related	[flat|nested] 702+ messages in thread

* [PATCH 5.12 146/677] ARM: dts: exynos: correct fuel gauge interrupt trigger level on P4 Note family
  2021-05-12 14:40 [PATCH 5.12 000/677] 5.12.4-rc1 review Greg Kroah-Hartman
                   ` (144 preceding siblings ...)
  2021-05-12 14:43 ` [PATCH 5.12 145/677] ARM: dts: exynos: correct fuel gauge interrupt trigger level on GT-I9100 Greg Kroah-Hartman
@ 2021-05-12 14:43 ` Greg Kroah-Hartman
  2021-05-12 14:43 ` [PATCH 5.12 147/677] ARM: dts: exynos: correct fuel gauge interrupt trigger level on Midas family Greg Kroah-Hartman
                   ` (538 subsequent siblings)
  684 siblings, 0 replies; 702+ messages in thread
From: Greg Kroah-Hartman @ 2021-05-12 14:43 UTC (permalink / raw)
  To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Krzysztof Kozlowski, Sasha Levin

From: Krzysztof Kozlowski <krzk@kernel.org>

[ Upstream commit c731a16e2cf424a462c7d42c33d6acd613576508 ]

The Maxim fuel gauge datasheets describe the interrupt line as active
low with a requirement of acknowledge from the CPU.  The falling edge
interrupt will mostly work but it's not correct.

Fixes: f48b5050c301 ("ARM: dts: exynos: add Samsung's Exynos4412-based P4 Note boards")
Signed-off-by: Krzysztof Kozlowski <krzk@kernel.org>
Link: https://lore.kernel.org/r/20201210212534.216197-2-krzk@kernel.org
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/arm/boot/dts/exynos4412-p4note.dtsi | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/arch/arm/boot/dts/exynos4412-p4note.dtsi b/arch/arm/boot/dts/exynos4412-p4note.dtsi
index b2f9d5448a18..5fe371543cbb 100644
--- a/arch/arm/boot/dts/exynos4412-p4note.dtsi
+++ b/arch/arm/boot/dts/exynos4412-p4note.dtsi
@@ -146,7 +146,7 @@
 			pinctrl-0 = <&fuel_alert_irq>;
 			pinctrl-names = "default";
 			interrupt-parent = <&gpx2>;
-			interrupts = <3 IRQ_TYPE_EDGE_FALLING>;
+			interrupts = <3 IRQ_TYPE_LEVEL_LOW>;
 			maxim,rsns-microohm = <10000>;
 			maxim,over-heat-temp = <600>;
 			maxim,over-volt = <4300>;
-- 
2.30.2




^ permalink raw reply related	[flat|nested] 702+ messages in thread

* [PATCH 5.12 147/677] ARM: dts: exynos: correct fuel gauge interrupt trigger level on Midas family
  2021-05-12 14:40 [PATCH 5.12 000/677] 5.12.4-rc1 review Greg Kroah-Hartman
                   ` (145 preceding siblings ...)
  2021-05-12 14:43 ` [PATCH 5.12 146/677] ARM: dts: exynos: correct fuel gauge interrupt trigger level on P4 Note family Greg Kroah-Hartman
@ 2021-05-12 14:43 ` Greg Kroah-Hartman
  2021-05-12 14:43 ` [PATCH 5.12 148/677] ARM: dts: exynos: correct MUIC " Greg Kroah-Hartman
                   ` (537 subsequent siblings)
  684 siblings, 0 replies; 702+ messages in thread
From: Greg Kroah-Hartman @ 2021-05-12 14:43 UTC (permalink / raw)
  To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Krzysztof Kozlowski, Sasha Levin

From: Krzysztof Kozlowski <krzk@kernel.org>

[ Upstream commit 8a45f33bd36efbb624198cfa9fdf1f66fd1c3d26 ]

The Maxim fuel gauge datasheets describe the interrupt line as active
low with a requirement of acknowledge from the CPU.  The falling edge
interrupt will mostly work but it's not correct.

Fixes: e8614292cd41 ("ARM: dts: Add Maxim 77693 fuel gauge node for exynos4412-trats2")
Signed-off-by: Krzysztof Kozlowski <krzk@kernel.org>
Link: https://lore.kernel.org/r/20201210212534.216197-3-krzk@kernel.org
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/arm/boot/dts/exynos4412-midas.dtsi | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/arch/arm/boot/dts/exynos4412-midas.dtsi b/arch/arm/boot/dts/exynos4412-midas.dtsi
index 111c32bae02c..b8b75dc81aa1 100644
--- a/arch/arm/boot/dts/exynos4412-midas.dtsi
+++ b/arch/arm/boot/dts/exynos4412-midas.dtsi
@@ -221,7 +221,7 @@
 		fuel-gauge@36 {
 			compatible = "maxim,max17047";
 			interrupt-parent = <&gpx2>;
-			interrupts = <3 IRQ_TYPE_EDGE_FALLING>;
+			interrupts = <3 IRQ_TYPE_LEVEL_LOW>;
 			pinctrl-names = "default";
 			pinctrl-0 = <&max77693_fuel_irq>;
 			reg = <0x36>;
-- 
2.30.2




^ permalink raw reply related	[flat|nested] 702+ messages in thread

* [PATCH 5.12 148/677] ARM: dts: exynos: correct MUIC interrupt trigger level on Midas family
  2021-05-12 14:40 [PATCH 5.12 000/677] 5.12.4-rc1 review Greg Kroah-Hartman
                   ` (146 preceding siblings ...)
  2021-05-12 14:43 ` [PATCH 5.12 147/677] ARM: dts: exynos: correct fuel gauge interrupt trigger level on Midas family Greg Kroah-Hartman
@ 2021-05-12 14:43 ` Greg Kroah-Hartman
  2021-05-12 14:43 ` [PATCH 5.12 149/677] ARM: dts: exynos: correct PMIC " Greg Kroah-Hartman
                   ` (536 subsequent siblings)
  684 siblings, 0 replies; 702+ messages in thread
From: Greg Kroah-Hartman @ 2021-05-12 14:43 UTC (permalink / raw)
  To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Krzysztof Kozlowski, Sasha Levin

From: Krzysztof Kozlowski <krzk@kernel.org>

[ Upstream commit 15107e443ab8c6cb35eff10438993e4bc944d9ae ]

The Maxim MUIC datasheets describe the interrupt line as active low
with a requirement of acknowledge from the CPU.  Without specifying the
interrupt type in Devicetree, kernel might apply some fixed
configuration, not necessarily working for this hardware.

Additionally, the interrupt line is shared so using level sensitive
interrupt is here especially important to avoid races.

Fixes: 7eec1266751b ("ARM: dts: Add Maxim 77693 PMIC to exynos4412-trats2")
Signed-off-by: Krzysztof Kozlowski <krzk@kernel.org>
Link: https://lore.kernel.org/r/20201210212534.216197-4-krzk@kernel.org
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/arm/boot/dts/exynos4412-midas.dtsi | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/arch/arm/boot/dts/exynos4412-midas.dtsi b/arch/arm/boot/dts/exynos4412-midas.dtsi
index b8b75dc81aa1..d75f554efde0 100644
--- a/arch/arm/boot/dts/exynos4412-midas.dtsi
+++ b/arch/arm/boot/dts/exynos4412-midas.dtsi
@@ -173,7 +173,7 @@
 		pmic@66 {
 			compatible = "maxim,max77693";
 			interrupt-parent = <&gpx1>;
-			interrupts = <5 IRQ_TYPE_EDGE_FALLING>;
+			interrupts = <5 IRQ_TYPE_LEVEL_LOW>;
 			pinctrl-names = "default";
 			pinctrl-0 = <&max77693_irq>;
 			reg = <0x66>;
-- 
2.30.2




^ permalink raw reply related	[flat|nested] 702+ messages in thread

* [PATCH 5.12 149/677] ARM: dts: exynos: correct PMIC interrupt trigger level on Midas family
  2021-05-12 14:40 [PATCH 5.12 000/677] 5.12.4-rc1 review Greg Kroah-Hartman
                   ` (147 preceding siblings ...)
  2021-05-12 14:43 ` [PATCH 5.12 148/677] ARM: dts: exynos: correct MUIC " Greg Kroah-Hartman
@ 2021-05-12 14:43 ` Greg Kroah-Hartman
  2021-05-12 14:43 ` [PATCH 5.12 150/677] ARM: dts: exynos: correct PMIC interrupt trigger level on Odroid X/U3 family Greg Kroah-Hartman
                   ` (535 subsequent siblings)
  684 siblings, 0 replies; 702+ messages in thread
From: Greg Kroah-Hartman @ 2021-05-12 14:43 UTC (permalink / raw)
  To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Krzysztof Kozlowski, Sasha Levin

From: Krzysztof Kozlowski <krzk@kernel.org>

[ Upstream commit e52dcd6e70fab51f53292e53336ecb007bb60889 ]

The Maxim PMIC datasheets describe the interrupt line as active low
with a requirement of acknowledge from the CPU.  Without specifying the
interrupt type in Devicetree, kernel might apply some fixed
configuration, not necessarily working for this hardware.

Additionally, the interrupt line is shared so using level sensitive
interrupt is here especially important to avoid races.

Fixes: 15dfdfad2d4a ("ARM: dts: Add basic dts for Exynos4412-based Trats 2 board")
Signed-off-by: Krzysztof Kozlowski <krzk@kernel.org>
Link: https://lore.kernel.org/r/20201210212534.216197-5-krzk@kernel.org
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/arm/boot/dts/exynos4412-midas.dtsi | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/arch/arm/boot/dts/exynos4412-midas.dtsi b/arch/arm/boot/dts/exynos4412-midas.dtsi
index d75f554efde0..fc77c1bfd844 100644
--- a/arch/arm/boot/dts/exynos4412-midas.dtsi
+++ b/arch/arm/boot/dts/exynos4412-midas.dtsi
@@ -665,7 +665,7 @@
 	max77686: pmic@9 {
 		compatible = "maxim,max77686";
 		interrupt-parent = <&gpx0>;
-		interrupts = <7 IRQ_TYPE_NONE>;
+		interrupts = <7 IRQ_TYPE_LEVEL_LOW>;
 		pinctrl-0 = <&max77686_irq>;
 		pinctrl-names = "default";
 		reg = <0x09>;
-- 
2.30.2




^ permalink raw reply related	[flat|nested] 702+ messages in thread

* [PATCH 5.12 150/677] ARM: dts: exynos: correct PMIC interrupt trigger level on Odroid X/U3 family
  2021-05-12 14:40 [PATCH 5.12 000/677] 5.12.4-rc1 review Greg Kroah-Hartman
                   ` (148 preceding siblings ...)
  2021-05-12 14:43 ` [PATCH 5.12 149/677] ARM: dts: exynos: correct PMIC " Greg Kroah-Hartman
@ 2021-05-12 14:43 ` Greg Kroah-Hartman
  2021-05-12 14:43 ` [PATCH 5.12 151/677] ARM: dts: exynos: correct PMIC interrupt trigger level on P4 Note family Greg Kroah-Hartman
                   ` (534 subsequent siblings)
  684 siblings, 0 replies; 702+ messages in thread
From: Greg Kroah-Hartman @ 2021-05-12 14:43 UTC (permalink / raw)
  To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Krzysztof Kozlowski, Sasha Levin

From: Krzysztof Kozlowski <krzk@kernel.org>

[ Upstream commit 6503c568e97a52f8b7a3109718db438e52e59485 ]

The Maxim PMIC datasheets describe the interrupt line as active low
with a requirement of acknowledge from the CPU.  Without specifying the
interrupt type in Devicetree, kernel might apply some fixed
configuration, not necessarily working for this hardware.

Additionally, the interrupt line is shared so using level sensitive
interrupt is here especially important to avoid races.

Fixes: eea6653aae7b ("ARM: dts: Enable PMIC interrupts for exynos4412-odroid-common")
Signed-off-by: Krzysztof Kozlowski <krzk@kernel.org>
Link: https://lore.kernel.org/r/20201210212534.216197-6-krzk@kernel.org
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/arm/boot/dts/exynos4412-odroid-common.dtsi | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/arch/arm/boot/dts/exynos4412-odroid-common.dtsi b/arch/arm/boot/dts/exynos4412-odroid-common.dtsi
index 2b20d9095d9f..eebe6a3952ce 100644
--- a/arch/arm/boot/dts/exynos4412-odroid-common.dtsi
+++ b/arch/arm/boot/dts/exynos4412-odroid-common.dtsi
@@ -278,7 +278,7 @@
 	max77686: pmic@9 {
 		compatible = "maxim,max77686";
 		interrupt-parent = <&gpx3>;
-		interrupts = <2 IRQ_TYPE_NONE>;
+		interrupts = <2 IRQ_TYPE_LEVEL_LOW>;
 		pinctrl-names = "default";
 		pinctrl-0 = <&max77686_irq>;
 		reg = <0x09>;
-- 
2.30.2




^ permalink raw reply related	[flat|nested] 702+ messages in thread

* [PATCH 5.12 151/677] ARM: dts: exynos: correct PMIC interrupt trigger level on P4 Note family
  2021-05-12 14:40 [PATCH 5.12 000/677] 5.12.4-rc1 review Greg Kroah-Hartman
                   ` (149 preceding siblings ...)
  2021-05-12 14:43 ` [PATCH 5.12 150/677] ARM: dts: exynos: correct PMIC interrupt trigger level on Odroid X/U3 family Greg Kroah-Hartman
@ 2021-05-12 14:43 ` Greg Kroah-Hartman
  2021-05-12 14:43 ` [PATCH 5.12 152/677] ARM: dts: exynos: correct PMIC interrupt trigger level on SMDK5250 Greg Kroah-Hartman
                   ` (533 subsequent siblings)
  684 siblings, 0 replies; 702+ messages in thread
From: Greg Kroah-Hartman @ 2021-05-12 14:43 UTC (permalink / raw)
  To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Krzysztof Kozlowski, Sasha Levin

From: Krzysztof Kozlowski <krzk@kernel.org>

[ Upstream commit fbe9c9bb2e929865500a0985735f81c0142accad ]

The Maxim PMIC datasheets describe the interrupt line as active low
with a requirement of acknowledge from the CPU.  Without specifying the
interrupt type in Devicetree, kernel might apply some fixed
configuration, not necessarily working for this hardware.

Additionally, the interrupt line is shared so using level sensitive
interrupt is here especially important to avoid races.

Fixes: f48b5050c301 ("ARM: dts: exynos: add Samsung's Exynos4412-based P4 Note boards")
Signed-off-by: Krzysztof Kozlowski <krzk@kernel.org>
Link: https://lore.kernel.org/r/20201210212534.216197-7-krzk@kernel.org
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/arm/boot/dts/exynos4412-p4note.dtsi | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/arch/arm/boot/dts/exynos4412-p4note.dtsi b/arch/arm/boot/dts/exynos4412-p4note.dtsi
index 5fe371543cbb..9e750890edb8 100644
--- a/arch/arm/boot/dts/exynos4412-p4note.dtsi
+++ b/arch/arm/boot/dts/exynos4412-p4note.dtsi
@@ -322,7 +322,7 @@
 	max77686: pmic@9 {
 		compatible = "maxim,max77686";
 		interrupt-parent = <&gpx0>;
-		interrupts = <7 IRQ_TYPE_NONE>;
+		interrupts = <7 IRQ_TYPE_LEVEL_LOW>;
 		pinctrl-0 = <&max77686_irq>;
 		pinctrl-names = "default";
 		reg = <0x09>;
-- 
2.30.2




^ permalink raw reply related	[flat|nested] 702+ messages in thread

* [PATCH 5.12 152/677] ARM: dts: exynos: correct PMIC interrupt trigger level on SMDK5250
  2021-05-12 14:40 [PATCH 5.12 000/677] 5.12.4-rc1 review Greg Kroah-Hartman
                   ` (150 preceding siblings ...)
  2021-05-12 14:43 ` [PATCH 5.12 151/677] ARM: dts: exynos: correct PMIC interrupt trigger level on P4 Note family Greg Kroah-Hartman
@ 2021-05-12 14:43 ` Greg Kroah-Hartman
  2021-05-12 14:43 ` [PATCH 5.12 153/677] ARM: dts: exynos: correct PMIC interrupt trigger level on Snow Greg Kroah-Hartman
                   ` (532 subsequent siblings)
  684 siblings, 0 replies; 702+ messages in thread
From: Greg Kroah-Hartman @ 2021-05-12 14:43 UTC (permalink / raw)
  To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Krzysztof Kozlowski, Sasha Levin

From: Krzysztof Kozlowski <krzk@kernel.org>

[ Upstream commit f6368c60561370e4a92fac22982a3bd656172170 ]

The Maxim PMIC datasheets describe the interrupt line as active low
with a requirement of acknowledge from the CPU.  Without specifying the
interrupt type in Devicetree, kernel might apply some fixed
configuration, not necessarily working for this hardware.

Additionally, the interrupt line is shared so using level sensitive
interrupt is here especially important to avoid races.

Fixes: 47580e8d94c2 ("ARM: dts: Specify MAX77686 pmic interrupt for exynos5250-smdk5250")
Signed-off-by: Krzysztof Kozlowski <krzk@kernel.org>
Link: https://lore.kernel.org/r/20201210212534.216197-8-krzk@kernel.org
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/arm/boot/dts/exynos5250-smdk5250.dts | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/arch/arm/boot/dts/exynos5250-smdk5250.dts b/arch/arm/boot/dts/exynos5250-smdk5250.dts
index 8b5a79a8720c..39bbe18145cf 100644
--- a/arch/arm/boot/dts/exynos5250-smdk5250.dts
+++ b/arch/arm/boot/dts/exynos5250-smdk5250.dts
@@ -134,7 +134,7 @@
 		compatible = "maxim,max77686";
 		reg = <0x09>;
 		interrupt-parent = <&gpx3>;
-		interrupts = <2 IRQ_TYPE_NONE>;
+		interrupts = <2 IRQ_TYPE_LEVEL_LOW>;
 		pinctrl-names = "default";
 		pinctrl-0 = <&max77686_irq>;
 		#clock-cells = <1>;
-- 
2.30.2




^ permalink raw reply related	[flat|nested] 702+ messages in thread

* [PATCH 5.12 153/677] ARM: dts: exynos: correct PMIC interrupt trigger level on Snow
  2021-05-12 14:40 [PATCH 5.12 000/677] 5.12.4-rc1 review Greg Kroah-Hartman
                   ` (151 preceding siblings ...)
  2021-05-12 14:43 ` [PATCH 5.12 152/677] ARM: dts: exynos: correct PMIC interrupt trigger level on SMDK5250 Greg Kroah-Hartman
@ 2021-05-12 14:43 ` Greg Kroah-Hartman
  2021-05-12 14:43 ` [PATCH 5.12 154/677] ARM: dts: s5pv210: correct fuel gauge interrupt trigger level on Fascinate family Greg Kroah-Hartman
                   ` (531 subsequent siblings)
  684 siblings, 0 replies; 702+ messages in thread
From: Greg Kroah-Hartman @ 2021-05-12 14:43 UTC (permalink / raw)
  To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Krzysztof Kozlowski, Sasha Levin

From: Krzysztof Kozlowski <krzk@kernel.org>

[ Upstream commit 8987efbb17c2522be8615085df9a14da2ab53d34 ]

The Maxim PMIC datasheets describe the interrupt line as active low
with a requirement of acknowledge from the CPU.  Without specifying the
interrupt type in Devicetree, kernel might apply some fixed
configuration, not necessarily working for this hardware.

Additionally, the interrupt line is shared so using level sensitive
interrupt is here especially important to avoid races.

Fixes: c61248afa819 ("ARM: dts: Add max77686 RTC interrupt to cros5250-common")
Signed-off-by: Krzysztof Kozlowski <krzk@kernel.org>
Link: https://lore.kernel.org/r/20201210212534.216197-9-krzk@kernel.org
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/arm/boot/dts/exynos5250-snow-common.dtsi | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/arch/arm/boot/dts/exynos5250-snow-common.dtsi b/arch/arm/boot/dts/exynos5250-snow-common.dtsi
index 6635f6184051..2335c4687349 100644
--- a/arch/arm/boot/dts/exynos5250-snow-common.dtsi
+++ b/arch/arm/boot/dts/exynos5250-snow-common.dtsi
@@ -292,7 +292,7 @@
 	max77686: pmic@9 {
 		compatible = "maxim,max77686";
 		interrupt-parent = <&gpx3>;
-		interrupts = <2 IRQ_TYPE_NONE>;
+		interrupts = <2 IRQ_TYPE_LEVEL_LOW>;
 		pinctrl-names = "default";
 		pinctrl-0 = <&max77686_irq>;
 		wakeup-source;
-- 
2.30.2




^ permalink raw reply related	[flat|nested] 702+ messages in thread

* [PATCH 5.12 154/677] ARM: dts: s5pv210: correct fuel gauge interrupt trigger level on Fascinate family
  2021-05-12 14:40 [PATCH 5.12 000/677] 5.12.4-rc1 review Greg Kroah-Hartman
                   ` (152 preceding siblings ...)
  2021-05-12 14:43 ` [PATCH 5.12 153/677] ARM: dts: exynos: correct PMIC interrupt trigger level on Snow Greg Kroah-Hartman
@ 2021-05-12 14:43 ` Greg Kroah-Hartman
  2021-05-12 14:43 ` [PATCH 5.12 155/677] ARM: dts: renesas: Add mmc aliases into R-Car Gen2 board dts files Greg Kroah-Hartman
                   ` (530 subsequent siblings)
  684 siblings, 0 replies; 702+ messages in thread
From: Greg Kroah-Hartman @ 2021-05-12 14:43 UTC (permalink / raw)
  To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Krzysztof Kozlowski, Sasha Levin

From: Krzysztof Kozlowski <krzk@kernel.org>

[ Upstream commit 214e6ec8c9f5a3353d3282b3ff475d3ee86cc21a ]

The Maxim fuel gauge datasheets describe the interrupt line as active
low with a requirement of acknowledge from the CPU.  The falling edge
interrupt will mostly work but it's not correct.

Fixes: 99bb20321f0e ("ARM: dts: s5pv210: Correct fuelgauge definition on Aries")
Signed-off-by: Krzysztof Kozlowski <krzk@kernel.org>
Link: https://lore.kernel.org/r/20201210212534.216197-10-krzk@kernel.org
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/arm/boot/dts/s5pv210-fascinate4g.dts | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/arch/arm/boot/dts/s5pv210-fascinate4g.dts b/arch/arm/boot/dts/s5pv210-fascinate4g.dts
index ca064359dd30..b47d8300e536 100644
--- a/arch/arm/boot/dts/s5pv210-fascinate4g.dts
+++ b/arch/arm/boot/dts/s5pv210-fascinate4g.dts
@@ -115,7 +115,7 @@
 	compatible = "maxim,max77836-battery";
 
 	interrupt-parent = <&gph3>;
-	interrupts = <3 IRQ_TYPE_EDGE_FALLING>;
+	interrupts = <3 IRQ_TYPE_LEVEL_LOW>;
 
 	pinctrl-names = "default";
 	pinctrl-0 = <&fg_irq>;
-- 
2.30.2




^ permalink raw reply related	[flat|nested] 702+ messages in thread

* [PATCH 5.12 155/677] ARM: dts: renesas: Add mmc aliases into R-Car Gen2 board dts files
  2021-05-12 14:40 [PATCH 5.12 000/677] 5.12.4-rc1 review Greg Kroah-Hartman
                   ` (153 preceding siblings ...)
  2021-05-12 14:43 ` [PATCH 5.12 154/677] ARM: dts: s5pv210: correct fuel gauge interrupt trigger level on Fascinate family Greg Kroah-Hartman
@ 2021-05-12 14:43 ` Greg Kroah-Hartman
  2021-05-12 14:43 ` [PATCH 5.12 156/677] arm64: dts: renesas: Add mmc aliases into " Greg Kroah-Hartman
                   ` (529 subsequent siblings)
  684 siblings, 0 replies; 702+ messages in thread
From: Greg Kroah-Hartman @ 2021-05-12 14:43 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Yoshihiro Shimoda,
	Geert Uytterhoeven, Sasha Levin

From: Yoshihiro Shimoda <yoshihiro.shimoda.uh@renesas.com>

[ Upstream commit da926e813fc7f9f0912fa413981a1f5ba63a536d ]

After set PROBE_PREFER_ASYNCHRONOUS flag on the mmc host drivers,
the order of /dev/mmcblkN was not fixed in some SoCs which have
multiple SDHI and/or MMCIF controllers. So, we were hard to use
such a device as rootfs by using the kernel parameter like
"root=/dev/mmcblkNpM".

According to the discussion on a mainling list [1], we can add
mmc aliases to fix the issue. So, add such aliases into R-Car Gen2
board dts files. Note that, since R-Car Gen2 is even more complicated
about SDHI and/or MMCIF channels variations and they share pins,
add the aliases into board dts files instead of SoC dtsi files.

[1]
https://lore.kernel.org/linux-arm-kernel/CAPDyKFptyEQNJu8cqzMt2WRFZcwEdjDiytMBp96nkoZyprTgmA@mail.gmail.com/

Fixes: 7320915c8861 ("mmc: Set PROBE_PREFER_ASYNCHRONOUS for drivers that existed in v4.14")
Fixes: 21b2cec61c04 ("mmc: Set PROBE_PREFER_ASYNCHRONOUS for drivers that existed in v4.4")
Signed-off-by: Yoshihiro Shimoda <yoshihiro.shimoda.uh@renesas.com>
Link: https://lore.kernel.org/r/1613131316-30994-1-git-send-email-yoshihiro.shimoda.uh@renesas.com
Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/arm/boot/dts/r8a7790-lager.dts   | 3 +++
 arch/arm/boot/dts/r8a7791-koelsch.dts | 3 +++
 arch/arm/boot/dts/r8a7791-porter.dts  | 2 ++
 arch/arm/boot/dts/r8a7793-gose.dts    | 3 +++
 arch/arm/boot/dts/r8a7794-alt.dts     | 3 +++
 arch/arm/boot/dts/r8a7794-silk.dts    | 2 ++
 6 files changed, 16 insertions(+)

diff --git a/arch/arm/boot/dts/r8a7790-lager.dts b/arch/arm/boot/dts/r8a7790-lager.dts
index 09a152b91557..1d6f0c5d02e9 100644
--- a/arch/arm/boot/dts/r8a7790-lager.dts
+++ b/arch/arm/boot/dts/r8a7790-lager.dts
@@ -53,6 +53,9 @@
 		i2c11 = &i2cexio1;
 		i2c12 = &i2chdmi;
 		i2c13 = &i2cpwr;
+		mmc0 = &mmcif1;
+		mmc1 = &sdhi0;
+		mmc2 = &sdhi2;
 	};
 
 	chosen {
diff --git a/arch/arm/boot/dts/r8a7791-koelsch.dts b/arch/arm/boot/dts/r8a7791-koelsch.dts
index f603cba5441f..6af1727b8269 100644
--- a/arch/arm/boot/dts/r8a7791-koelsch.dts
+++ b/arch/arm/boot/dts/r8a7791-koelsch.dts
@@ -53,6 +53,9 @@
 		i2c12 = &i2cexio1;
 		i2c13 = &i2chdmi;
 		i2c14 = &i2cexio4;
+		mmc0 = &sdhi0;
+		mmc1 = &sdhi1;
+		mmc2 = &sdhi2;
 	};
 
 	chosen {
diff --git a/arch/arm/boot/dts/r8a7791-porter.dts b/arch/arm/boot/dts/r8a7791-porter.dts
index c6d563fb7ec7..bf51e29c793a 100644
--- a/arch/arm/boot/dts/r8a7791-porter.dts
+++ b/arch/arm/boot/dts/r8a7791-porter.dts
@@ -28,6 +28,8 @@
 		serial0 = &scif0;
 		i2c9 = &gpioi2c2;
 		i2c10 = &i2chdmi;
+		mmc0 = &sdhi0;
+		mmc1 = &sdhi2;
 	};
 
 	chosen {
diff --git a/arch/arm/boot/dts/r8a7793-gose.dts b/arch/arm/boot/dts/r8a7793-gose.dts
index abf487e8fe0f..2b59a0491350 100644
--- a/arch/arm/boot/dts/r8a7793-gose.dts
+++ b/arch/arm/boot/dts/r8a7793-gose.dts
@@ -49,6 +49,9 @@
 		i2c10 = &gpioi2c4;
 		i2c11 = &i2chdmi;
 		i2c12 = &i2cexio4;
+		mmc0 = &sdhi0;
+		mmc1 = &sdhi1;
+		mmc2 = &sdhi2;
 	};
 
 	chosen {
diff --git a/arch/arm/boot/dts/r8a7794-alt.dts b/arch/arm/boot/dts/r8a7794-alt.dts
index 3f1cc5bbf329..32025986b3b9 100644
--- a/arch/arm/boot/dts/r8a7794-alt.dts
+++ b/arch/arm/boot/dts/r8a7794-alt.dts
@@ -19,6 +19,9 @@
 		i2c10 = &gpioi2c4;
 		i2c11 = &i2chdmi;
 		i2c12 = &i2cexio4;
+		mmc0 = &mmcif0;
+		mmc1 = &sdhi0;
+		mmc2 = &sdhi1;
 	};
 
 	chosen {
diff --git a/arch/arm/boot/dts/r8a7794-silk.dts b/arch/arm/boot/dts/r8a7794-silk.dts
index 677596f6c9c9..af066ee5e275 100644
--- a/arch/arm/boot/dts/r8a7794-silk.dts
+++ b/arch/arm/boot/dts/r8a7794-silk.dts
@@ -31,6 +31,8 @@
 		serial0 = &scif2;
 		i2c9 = &gpioi2c1;
 		i2c10 = &i2chdmi;
+		mmc0 = &mmcif0;
+		mmc1 = &sdhi1;
 	};
 
 	chosen {
-- 
2.30.2




^ permalink raw reply related	[flat|nested] 702+ messages in thread

* [PATCH 5.12 156/677] arm64: dts: renesas: Add mmc aliases into board dts files
  2021-05-12 14:40 [PATCH 5.12 000/677] 5.12.4-rc1 review Greg Kroah-Hartman
                   ` (154 preceding siblings ...)
  2021-05-12 14:43 ` [PATCH 5.12 155/677] ARM: dts: renesas: Add mmc aliases into R-Car Gen2 board dts files Greg Kroah-Hartman
@ 2021-05-12 14:43 ` Greg Kroah-Hartman
  2021-05-12 14:43 ` [PATCH 5.12 157/677] bus: ti-sysc: Fix initializing module_pa for modules without sysc register Greg Kroah-Hartman
                   ` (528 subsequent siblings)
  684 siblings, 0 replies; 702+ messages in thread
From: Greg Kroah-Hartman @ 2021-05-12 14:43 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Yoshihiro Shimoda,
	Geert Uytterhoeven, Sasha Levin

From: Yoshihiro Shimoda <yoshihiro.shimoda.uh@renesas.com>

[ Upstream commit d765a4f302cc046ca23453ba990d21120ceadbbd ]

After the commit 7320915c8861 ("mmc: Set PROBE_PREFER_ASYNCHRONOUS
for drivers that existed in v4.14"), the order of /dev/mmcblkN
was not fixed in some SoCs which have multiple sdhi controllers.
So, we were hard to use an sdhi device as rootfs by using
the kernel parameter like "root=/dev/mmcblkNpM".

According to the discussion on a mainling list [1], we can add
mmc aliases to fix the issue. So, add such aliases into Renesas
arm64 board dts files. Notes that mmc0 is an eMMC channel if
available.

[1]
https://lore.kernel.org/linux-arm-kernel/CAPDyKFptyEQNJu8cqzMt2WRFZcwEdjDiytMBp96nkoZyprTgmA@mail.gmail.com/

Fixes: 7320915c8861 ("mmc: Set PROBE_PREFER_ASYNCHRONOUS for drivers that existed in v4.14")
Signed-off-by: Yoshihiro Shimoda <yoshihiro.shimoda.uh@renesas.com>
Link: https://lore.kernel.org/r/1614596786-22326-1-git-send-email-yoshihiro.shimoda.uh@renesas.com
Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/arm64/boot/dts/renesas/hihope-common.dtsi            | 3 +++
 arch/arm64/boot/dts/renesas/r8a774a1-beacon-rzg2m-kit.dts | 3 +++
 arch/arm64/boot/dts/renesas/r8a774b1-beacon-rzg2n-kit.dts | 3 +++
 arch/arm64/boot/dts/renesas/r8a774c0-cat874.dts           | 2 ++
 arch/arm64/boot/dts/renesas/r8a774e1-beacon-rzg2h-kit.dts | 3 +++
 arch/arm64/boot/dts/renesas/r8a77990-ebisu.dts            | 3 +++
 arch/arm64/boot/dts/renesas/salvator-common.dtsi          | 3 +++
 arch/arm64/boot/dts/renesas/ulcb-kf.dtsi                  | 1 +
 arch/arm64/boot/dts/renesas/ulcb.dtsi                     | 2 ++
 9 files changed, 23 insertions(+)

diff --git a/arch/arm64/boot/dts/renesas/hihope-common.dtsi b/arch/arm64/boot/dts/renesas/hihope-common.dtsi
index 7a3da9b06f67..0c7e6f790590 100644
--- a/arch/arm64/boot/dts/renesas/hihope-common.dtsi
+++ b/arch/arm64/boot/dts/renesas/hihope-common.dtsi
@@ -12,6 +12,9 @@
 	aliases {
 		serial0 = &scif2;
 		serial1 = &hscif0;
+		mmc0 = &sdhi3;
+		mmc1 = &sdhi0;
+		mmc2 = &sdhi2;
 	};
 
 	chosen {
diff --git a/arch/arm64/boot/dts/renesas/r8a774a1-beacon-rzg2m-kit.dts b/arch/arm64/boot/dts/renesas/r8a774a1-beacon-rzg2m-kit.dts
index 501cb05da228..3cf2e076940f 100644
--- a/arch/arm64/boot/dts/renesas/r8a774a1-beacon-rzg2m-kit.dts
+++ b/arch/arm64/boot/dts/renesas/r8a774a1-beacon-rzg2m-kit.dts
@@ -21,6 +21,9 @@
 		serial4 = &hscif2;
 		serial5 = &scif5;
 		ethernet0 = &avb;
+		mmc0 = &sdhi3;
+		mmc1 = &sdhi0;
+		mmc2 = &sdhi2;
 	};
 
 	chosen {
diff --git a/arch/arm64/boot/dts/renesas/r8a774b1-beacon-rzg2n-kit.dts b/arch/arm64/boot/dts/renesas/r8a774b1-beacon-rzg2n-kit.dts
index 71763f4402a7..3c0d59def8ee 100644
--- a/arch/arm64/boot/dts/renesas/r8a774b1-beacon-rzg2n-kit.dts
+++ b/arch/arm64/boot/dts/renesas/r8a774b1-beacon-rzg2n-kit.dts
@@ -22,6 +22,9 @@
 		serial5 = &scif5;
 		serial6 = &scif4;
 		ethernet0 = &avb;
+		mmc0 = &sdhi3;
+		mmc1 = &sdhi0;
+		mmc2 = &sdhi2;
 	};
 
 	chosen {
diff --git a/arch/arm64/boot/dts/renesas/r8a774c0-cat874.dts b/arch/arm64/boot/dts/renesas/r8a774c0-cat874.dts
index ea87cb5a459c..33257c6440b2 100644
--- a/arch/arm64/boot/dts/renesas/r8a774c0-cat874.dts
+++ b/arch/arm64/boot/dts/renesas/r8a774c0-cat874.dts
@@ -17,6 +17,8 @@
 	aliases {
 		serial0 = &scif2;
 		serial1 = &hscif2;
+		mmc0 = &sdhi0;
+		mmc1 = &sdhi3;
 	};
 
 	chosen {
diff --git a/arch/arm64/boot/dts/renesas/r8a774e1-beacon-rzg2h-kit.dts b/arch/arm64/boot/dts/renesas/r8a774e1-beacon-rzg2h-kit.dts
index 273f062f2909..7b6649a3ded0 100644
--- a/arch/arm64/boot/dts/renesas/r8a774e1-beacon-rzg2h-kit.dts
+++ b/arch/arm64/boot/dts/renesas/r8a774e1-beacon-rzg2h-kit.dts
@@ -22,6 +22,9 @@
 		serial5 = &scif5;
 		serial6 = &scif4;
 		ethernet0 = &avb;
+		mmc0 = &sdhi3;
+		mmc1 = &sdhi0;
+		mmc2 = &sdhi2;
 	};
 
 	chosen {
diff --git a/arch/arm64/boot/dts/renesas/r8a77990-ebisu.dts b/arch/arm64/boot/dts/renesas/r8a77990-ebisu.dts
index f74f8b9993f1..6d6cdc4c324b 100644
--- a/arch/arm64/boot/dts/renesas/r8a77990-ebisu.dts
+++ b/arch/arm64/boot/dts/renesas/r8a77990-ebisu.dts
@@ -16,6 +16,9 @@
 	aliases {
 		serial0 = &scif2;
 		ethernet0 = &avb;
+		mmc0 = &sdhi3;
+		mmc1 = &sdhi0;
+		mmc2 = &sdhi1;
 	};
 
 	chosen {
diff --git a/arch/arm64/boot/dts/renesas/salvator-common.dtsi b/arch/arm64/boot/dts/renesas/salvator-common.dtsi
index c22bb38994e8..15bb1eeb6601 100644
--- a/arch/arm64/boot/dts/renesas/salvator-common.dtsi
+++ b/arch/arm64/boot/dts/renesas/salvator-common.dtsi
@@ -36,6 +36,9 @@
 		serial0 = &scif2;
 		serial1 = &hscif1;
 		ethernet0 = &avb;
+		mmc0 = &sdhi2;
+		mmc1 = &sdhi0;
+		mmc2 = &sdhi3;
 	};
 
 	chosen {
diff --git a/arch/arm64/boot/dts/renesas/ulcb-kf.dtsi b/arch/arm64/boot/dts/renesas/ulcb-kf.dtsi
index e9ed2597f1c2..61bd4df09df0 100644
--- a/arch/arm64/boot/dts/renesas/ulcb-kf.dtsi
+++ b/arch/arm64/boot/dts/renesas/ulcb-kf.dtsi
@@ -16,6 +16,7 @@
 	aliases {
 		serial1 = &hscif0;
 		serial2 = &scif1;
+		mmc2 = &sdhi3;
 	};
 
 	clksndsel: clksndsel {
diff --git a/arch/arm64/boot/dts/renesas/ulcb.dtsi b/arch/arm64/boot/dts/renesas/ulcb.dtsi
index a04eae55dd6c..3d88e95c65a5 100644
--- a/arch/arm64/boot/dts/renesas/ulcb.dtsi
+++ b/arch/arm64/boot/dts/renesas/ulcb.dtsi
@@ -23,6 +23,8 @@
 	aliases {
 		serial0 = &scif2;
 		ethernet0 = &avb;
+		mmc0 = &sdhi2;
+		mmc1 = &sdhi0;
 	};
 
 	chosen {
-- 
2.30.2




^ permalink raw reply related	[flat|nested] 702+ messages in thread

* [PATCH 5.12 157/677] bus: ti-sysc: Fix initializing module_pa for modules without sysc register
  2021-05-12 14:40 [PATCH 5.12 000/677] 5.12.4-rc1 review Greg Kroah-Hartman
                   ` (155 preceding siblings ...)
  2021-05-12 14:43 ` [PATCH 5.12 156/677] arm64: dts: renesas: Add mmc aliases into " Greg Kroah-Hartman
@ 2021-05-12 14:43 ` Greg Kroah-Hartman
  2021-05-12 14:43 ` [PATCH 5.12 158/677] x86/platform/uv: Set section block size for hubless architectures Greg Kroah-Hartman
                   ` (527 subsequent siblings)
  684 siblings, 0 replies; 702+ messages in thread
From: Greg Kroah-Hartman @ 2021-05-12 14:43 UTC (permalink / raw)
  To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Tony Lindgren, Sasha Levin

From: Tony Lindgren <tony@atomide.com>

[ Upstream commit 7bad5af826aba00487fed9a3300d3f43f0cba11b ]

We have interconnect target modules with no known registers using only
clocks and resets, but we still want to detect them based on the module
IO range. So let's call sysc_parse_and_check_child_range() earlier so we
have module_pa properly initialized.

Fixes: 2928135c93f8 ("bus: ti-sysc: Support modules without control registers")
Signed-off-by: Tony Lindgren <tony@atomide.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/bus/ti-sysc.c | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/drivers/bus/ti-sysc.c b/drivers/bus/ti-sysc.c
index 9e535336689f..68145e326eb9 100644
--- a/drivers/bus/ti-sysc.c
+++ b/drivers/bus/ti-sysc.c
@@ -901,9 +901,6 @@ static int sysc_map_and_check_registers(struct sysc *ddata)
 	struct device_node *np = ddata->dev->of_node;
 	int error;
 
-	if (!of_get_property(np, "reg", NULL))
-		return 0;
-
 	error = sysc_parse_and_check_child_range(ddata);
 	if (error)
 		return error;
@@ -914,6 +911,9 @@ static int sysc_map_and_check_registers(struct sysc *ddata)
 
 	sysc_check_children(ddata);
 
+	if (!of_get_property(np, "reg", NULL))
+		return 0;
+
 	error = sysc_parse_registers(ddata);
 	if (error)
 		return error;
-- 
2.30.2




^ permalink raw reply related	[flat|nested] 702+ messages in thread

* [PATCH 5.12 158/677] x86/platform/uv: Set section block size for hubless architectures
  2021-05-12 14:40 [PATCH 5.12 000/677] 5.12.4-rc1 review Greg Kroah-Hartman
                   ` (156 preceding siblings ...)
  2021-05-12 14:43 ` [PATCH 5.12 157/677] bus: ti-sysc: Fix initializing module_pa for modules without sysc register Greg Kroah-Hartman
@ 2021-05-12 14:43 ` Greg Kroah-Hartman
  2021-05-12 14:43 ` [PATCH 5.12 159/677] serial: stm32: fix probe and remove order for dma Greg Kroah-Hartman
                   ` (526 subsequent siblings)
  684 siblings, 0 replies; 702+ messages in thread
From: Greg Kroah-Hartman @ 2021-05-12 14:43 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Mike Travis, Borislav Petkov,
	Steve Wahl, Russ Anderson, Sasha Levin

From: Mike Travis <mike.travis@hpe.com>

[ Upstream commit 6840a150b9daf35e4d21ab9780d0a03b4ed74a5b ]

Commit

  bbbd2b51a2aa ("x86/platform/UV: Use new set memory block size function")

added a call to set the block size value that is needed by the kernel
to set the boundaries in the section list. This was done for UV Hubbed
systems but missed in the UV Hubless setup. Fix that mistake by adding
that same set call for hubless systems, which support the same NVRAMs
and Intel BIOS, thus the same problem occurs.

 [ bp: Massage commit message. ]

Fixes: bbbd2b51a2aa ("x86/platform/UV: Use new set memory block size function")
Signed-off-by: Mike Travis <mike.travis@hpe.com>
Signed-off-by: Borislav Petkov <bp@suse.de>
Reviewed-by: Steve Wahl <steve.wahl@hpe.com>
Reviewed-by: Russ Anderson <rja@hpe.com>
Link: https://lkml.kernel.org/r/20210305162853.299892-1-mike.travis@hpe.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/x86/kernel/apic/x2apic_uv_x.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/arch/x86/kernel/apic/x2apic_uv_x.c b/arch/x86/kernel/apic/x2apic_uv_x.c
index 52bc217ca8c3..c9ddd233e32f 100644
--- a/arch/x86/kernel/apic/x2apic_uv_x.c
+++ b/arch/x86/kernel/apic/x2apic_uv_x.c
@@ -1671,6 +1671,9 @@ static __init int uv_system_init_hubless(void)
 	if (rc < 0)
 		return rc;
 
+	/* Set section block size for current node memory */
+	set_block_size();
+
 	/* Create user access node */
 	if (rc >= 0)
 		uv_setup_proc_files(1);
-- 
2.30.2




^ permalink raw reply related	[flat|nested] 702+ messages in thread

* [PATCH 5.12 159/677] serial: stm32: fix probe and remove order for dma
  2021-05-12 14:40 [PATCH 5.12 000/677] 5.12.4-rc1 review Greg Kroah-Hartman
                   ` (157 preceding siblings ...)
  2021-05-12 14:43 ` [PATCH 5.12 158/677] x86/platform/uv: Set section block size for hubless architectures Greg Kroah-Hartman
@ 2021-05-12 14:43 ` Greg Kroah-Hartman
  2021-05-12 14:43 ` [PATCH 5.12 160/677] serial: stm32: fix startup by enabling usart for reception Greg Kroah-Hartman
                   ` (525 subsequent siblings)
  684 siblings, 0 replies; 702+ messages in thread
From: Greg Kroah-Hartman @ 2021-05-12 14:43 UTC (permalink / raw)
  To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Erwan Le Ray, Sasha Levin

From: Erwan Le Ray <erwan.leray@foss.st.com>

[ Upstream commit 87fd0741d6dcf63ebdb14050c2b921ae14c7f307 ]

The probe and remove orders are wrong as the uart_port is registered
before saving device data in the probe, and unregistered after DMA
resource deallocation in the remove. uart_port registering should be
done at the end of probe and unregistering should be done at the begin of
remove to avoid resource allocation issues.

Fix probe and remove orders. This enforce resource allocation occur at
proper time.
Terminate both DMA rx and tx transfers before removing device.

Move pm_runtime after uart_remove_one_port() call in remove() to keep the
probe error path.

Fixes: 3489187204eb ("serial: stm32: adding dma support")
Signed-off-by: Erwan Le Ray <erwan.leray@foss.st.com>
Link: https://lore.kernel.org/r/20210304162308.8984-2-erwan.leray@foss.st.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/tty/serial/stm32-usart.c | 57 ++++++++++++++++++++++++--------
 1 file changed, 44 insertions(+), 13 deletions(-)

diff --git a/drivers/tty/serial/stm32-usart.c b/drivers/tty/serial/stm32-usart.c
index b3675cf25a69..3d58824ac2af 100644
--- a/drivers/tty/serial/stm32-usart.c
+++ b/drivers/tty/serial/stm32-usart.c
@@ -1252,10 +1252,6 @@ static int stm32_usart_serial_probe(struct platform_device *pdev)
 		device_set_wakeup_enable(&pdev->dev, false);
 	}
 
-	ret = uart_add_one_port(&stm32_usart_driver, &stm32port->port);
-	if (ret)
-		goto err_wirq;
-
 	ret = stm32_usart_of_dma_rx_probe(stm32port, pdev);
 	if (ret)
 		dev_info(&pdev->dev, "interrupt mode used for rx (no dma)\n");
@@ -1269,11 +1265,40 @@ static int stm32_usart_serial_probe(struct platform_device *pdev)
 	pm_runtime_get_noresume(&pdev->dev);
 	pm_runtime_set_active(&pdev->dev);
 	pm_runtime_enable(&pdev->dev);
+
+	ret = uart_add_one_port(&stm32_usart_driver, &stm32port->port);
+	if (ret)
+		goto err_port;
+
 	pm_runtime_put_sync(&pdev->dev);
 
 	return 0;
 
-err_wirq:
+err_port:
+	pm_runtime_disable(&pdev->dev);
+	pm_runtime_set_suspended(&pdev->dev);
+	pm_runtime_put_noidle(&pdev->dev);
+
+	if (stm32port->rx_ch) {
+		dmaengine_terminate_async(stm32port->rx_ch);
+		dma_release_channel(stm32port->rx_ch);
+	}
+
+	if (stm32port->rx_dma_buf)
+		dma_free_coherent(&pdev->dev,
+				  RX_BUF_L, stm32port->rx_buf,
+				  stm32port->rx_dma_buf);
+
+	if (stm32port->tx_ch) {
+		dmaengine_terminate_async(stm32port->tx_ch);
+		dma_release_channel(stm32port->tx_ch);
+	}
+
+	if (stm32port->tx_dma_buf)
+		dma_free_coherent(&pdev->dev,
+				  TX_BUF_L, stm32port->tx_buf,
+				  stm32port->tx_dma_buf);
+
 	if (stm32port->wakeirq > 0)
 		dev_pm_clear_wake_irq(&pdev->dev);
 
@@ -1295,11 +1320,20 @@ static int stm32_usart_serial_remove(struct platform_device *pdev)
 	int err;
 
 	pm_runtime_get_sync(&pdev->dev);
+	err = uart_remove_one_port(&stm32_usart_driver, port);
+	if (err)
+		return(err);
+
+	pm_runtime_disable(&pdev->dev);
+	pm_runtime_set_suspended(&pdev->dev);
+	pm_runtime_put_noidle(&pdev->dev);
 
 	stm32_usart_clr_bits(port, ofs->cr3, USART_CR3_DMAR);
 
-	if (stm32_port->rx_ch)
+	if (stm32_port->rx_ch) {
+		dmaengine_terminate_async(stm32_port->rx_ch);
 		dma_release_channel(stm32_port->rx_ch);
+	}
 
 	if (stm32_port->rx_dma_buf)
 		dma_free_coherent(&pdev->dev,
@@ -1308,8 +1342,10 @@ static int stm32_usart_serial_remove(struct platform_device *pdev)
 
 	stm32_usart_clr_bits(port, ofs->cr3, USART_CR3_DMAT);
 
-	if (stm32_port->tx_ch)
+	if (stm32_port->tx_ch) {
+		dmaengine_terminate_async(stm32_port->tx_ch);
 		dma_release_channel(stm32_port->tx_ch);
+	}
 
 	if (stm32_port->tx_dma_buf)
 		dma_free_coherent(&pdev->dev,
@@ -1323,12 +1359,7 @@ static int stm32_usart_serial_remove(struct platform_device *pdev)
 
 	stm32_usart_deinit_port(stm32_port);
 
-	err = uart_remove_one_port(&stm32_usart_driver, port);
-
-	pm_runtime_disable(&pdev->dev);
-	pm_runtime_put_noidle(&pdev->dev);
-
-	return err;
+	return 0;
 }
 
 #ifdef CONFIG_SERIAL_STM32_CONSOLE
-- 
2.30.2




^ permalink raw reply related	[flat|nested] 702+ messages in thread

* [PATCH 5.12 160/677] serial: stm32: fix startup by enabling usart for reception
  2021-05-12 14:40 [PATCH 5.12 000/677] 5.12.4-rc1 review Greg Kroah-Hartman
                   ` (158 preceding siblings ...)
  2021-05-12 14:43 ` [PATCH 5.12 159/677] serial: stm32: fix probe and remove order for dma Greg Kroah-Hartman
@ 2021-05-12 14:43 ` Greg Kroah-Hartman
  2021-05-12 14:43 ` [PATCH 5.12 161/677] serial: stm32: fix incorrect characters on console Greg Kroah-Hartman
                   ` (524 subsequent siblings)
  684 siblings, 0 replies; 702+ messages in thread
From: Greg Kroah-Hartman @ 2021-05-12 14:43 UTC (permalink / raw)
  To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Erwan Le Ray, Sasha Levin

From: Erwan Le Ray <erwan.leray@foss.st.com>

[ Upstream commit f4518a8a75f5be1a121b0c95ad9c6b1eb27d920e ]

RX is configured, but usart is not enabled in startup function.
Kernel documentation specifies that startup should enable the port for
reception.
Fix the startup by enabling usart for reception.

Fixes: 84872dc448fe ("serial: stm32: add RX and TX FIFO flush")
Signed-off-by: Erwan Le Ray <erwan.leray@foss.st.com>
Link: https://lore.kernel.org/r/20210304162308.8984-3-erwan.leray@foss.st.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/tty/serial/stm32-usart.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/drivers/tty/serial/stm32-usart.c b/drivers/tty/serial/stm32-usart.c
index 3d58824ac2af..c6ca8f964c69 100644
--- a/drivers/tty/serial/stm32-usart.c
+++ b/drivers/tty/serial/stm32-usart.c
@@ -634,6 +634,7 @@ static int stm32_usart_startup(struct uart_port *port)
 {
 	struct stm32_port *stm32_port = to_stm32_port(port);
 	const struct stm32_usart_offsets *ofs = &stm32_port->info->ofs;
+	const struct stm32_usart_config *cfg = &stm32_port->info->cfg;
 	const char *name = to_platform_device(port->dev)->name;
 	u32 val;
 	int ret;
@@ -658,7 +659,7 @@ static int stm32_usart_startup(struct uart_port *port)
 	}
 
 	/* RX FIFO enabling */
-	val = stm32_port->cr1_irq | USART_CR1_RE;
+	val = stm32_port->cr1_irq | USART_CR1_RE | BIT(cfg->uart_enable_bit);
 	if (stm32_port->fifoen)
 		val |= USART_CR1_FIFOEN;
 	stm32_usart_set_bits(port, ofs->cr1, val);
-- 
2.30.2




^ permalink raw reply related	[flat|nested] 702+ messages in thread

* [PATCH 5.12 161/677] serial: stm32: fix incorrect characters on console
  2021-05-12 14:40 [PATCH 5.12 000/677] 5.12.4-rc1 review Greg Kroah-Hartman
                   ` (159 preceding siblings ...)
  2021-05-12 14:43 ` [PATCH 5.12 160/677] serial: stm32: fix startup by enabling usart for reception Greg Kroah-Hartman
@ 2021-05-12 14:43 ` Greg Kroah-Hartman
  2021-05-12 14:43 ` [PATCH 5.12 162/677] serial: stm32: fix TX and RX FIFO thresholds Greg Kroah-Hartman
                   ` (523 subsequent siblings)
  684 siblings, 0 replies; 702+ messages in thread
From: Greg Kroah-Hartman @ 2021-05-12 14:43 UTC (permalink / raw)
  To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Erwan Le Ray, Sasha Levin

From: Erwan Le Ray <erwan.leray@foss.st.com>

[ Upstream commit f264c6f6aece81a9f8fbdf912b20bd3feb476a7a ]

Incorrect characters are observed on console during boot. This issue occurs
when init/main.c is modifying termios settings to open /dev/console on the
rootfs.

This patch adds a waiting loop in set_termios to wait for TX shift register
empty (and TX FIFO if any) before stopping serial port.

Fixes: 48a6092fb41f ("serial: stm32-usart: Add STM32 USART Driver")
Signed-off-by: Erwan Le Ray <erwan.leray@foss.st.com>
Link: https://lore.kernel.org/r/20210304162308.8984-4-erwan.leray@foss.st.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/tty/serial/stm32-usart.c | 12 +++++++++++-
 1 file changed, 11 insertions(+), 1 deletion(-)

diff --git a/drivers/tty/serial/stm32-usart.c b/drivers/tty/serial/stm32-usart.c
index c6ca8f964c69..eae54b8cf5e2 100644
--- a/drivers/tty/serial/stm32-usart.c
+++ b/drivers/tty/serial/stm32-usart.c
@@ -738,8 +738,9 @@ static void stm32_usart_set_termios(struct uart_port *port,
 	unsigned int baud, bits;
 	u32 usartdiv, mantissa, fraction, oversampling;
 	tcflag_t cflag = termios->c_cflag;
-	u32 cr1, cr2, cr3;
+	u32 cr1, cr2, cr3, isr;
 	unsigned long flags;
+	int ret;
 
 	if (!stm32_port->hw_flow_control)
 		cflag &= ~CRTSCTS;
@@ -748,6 +749,15 @@ static void stm32_usart_set_termios(struct uart_port *port,
 
 	spin_lock_irqsave(&port->lock, flags);
 
+	ret = readl_relaxed_poll_timeout_atomic(port->membase + ofs->isr,
+						isr,
+						(isr & USART_SR_TC),
+						10, 100000);
+
+	/* Send the TC error message only when ISR_TC is not set. */
+	if (ret)
+		dev_err(port->dev, "Transmission is not complete\n");
+
 	/* Stop serial port and reset value */
 	writel_relaxed(0, port->membase + ofs->cr1);
 
-- 
2.30.2




^ permalink raw reply related	[flat|nested] 702+ messages in thread

* [PATCH 5.12 162/677] serial: stm32: fix TX and RX FIFO thresholds
  2021-05-12 14:40 [PATCH 5.12 000/677] 5.12.4-rc1 review Greg Kroah-Hartman
                   ` (160 preceding siblings ...)
  2021-05-12 14:43 ` [PATCH 5.12 161/677] serial: stm32: fix incorrect characters on console Greg Kroah-Hartman
@ 2021-05-12 14:43 ` Greg Kroah-Hartman
  2021-05-12 14:43 ` [PATCH 5.12 163/677] serial: stm32: fix a deadlock condition with wakeup event Greg Kroah-Hartman
                   ` (522 subsequent siblings)
  684 siblings, 0 replies; 702+ messages in thread
From: Greg Kroah-Hartman @ 2021-05-12 14:43 UTC (permalink / raw)
  To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Erwan Le Ray, Sasha Levin

From: Erwan Le Ray <erwan.leray@foss.st.com>

[ Upstream commit 25a8e7611da5513b388165661b17173c26e12c04 ]

TX and RX FIFO thresholds may be cleared after suspend/resume, depending
on the low power mode.

Those configurations (done in startup) are not effective for UART console,
as:
- the reference manual indicates that FIFOEN bit can only be written when
  the USART is disabled (UE=0)
- a set_termios (where UE is set) is requested firstly for console
  enabling, before the startup.

Fixes: 84872dc448fe ("serial: stm32: add RX and TX FIFO flush")
Signed-off-by: Erwan Le Ray <erwan.leray@foss.st.com>
Link: https://lore.kernel.org/r/20210304162308.8984-5-erwan.leray@foss.st.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/tty/serial/stm32-usart.c | 23 +++++++++--------------
 1 file changed, 9 insertions(+), 14 deletions(-)

diff --git a/drivers/tty/serial/stm32-usart.c b/drivers/tty/serial/stm32-usart.c
index eae54b8cf5e2..223cec70c57c 100644
--- a/drivers/tty/serial/stm32-usart.c
+++ b/drivers/tty/serial/stm32-usart.c
@@ -649,19 +649,8 @@ static int stm32_usart_startup(struct uart_port *port)
 	if (ofs->rqr != UNDEF_REG)
 		stm32_usart_set_bits(port, ofs->rqr, USART_RQR_RXFRQ);
 
-	/* Tx and RX FIFO configuration */
-	if (stm32_port->fifoen) {
-		val = readl_relaxed(port->membase + ofs->cr3);
-		val &= ~(USART_CR3_TXFTCFG_MASK | USART_CR3_RXFTCFG_MASK);
-		val |= USART_CR3_TXFTCFG_HALF << USART_CR3_TXFTCFG_SHIFT;
-		val |= USART_CR3_RXFTCFG_HALF << USART_CR3_RXFTCFG_SHIFT;
-		writel_relaxed(val, port->membase + ofs->cr3);
-	}
-
-	/* RX FIFO enabling */
+	/* RX enabling */
 	val = stm32_port->cr1_irq | USART_CR1_RE | BIT(cfg->uart_enable_bit);
-	if (stm32_port->fifoen)
-		val |= USART_CR1_FIFOEN;
 	stm32_usart_set_bits(port, ofs->cr1, val);
 
 	return 0;
@@ -770,9 +759,15 @@ static void stm32_usart_set_termios(struct uart_port *port,
 	if (stm32_port->fifoen)
 		cr1 |= USART_CR1_FIFOEN;
 	cr2 = 0;
+
+	/* Tx and RX FIFO configuration */
 	cr3 = readl_relaxed(port->membase + ofs->cr3);
-	cr3 &= USART_CR3_TXFTIE | USART_CR3_RXFTCFG_MASK | USART_CR3_RXFTIE
-		| USART_CR3_TXFTCFG_MASK;
+	cr3 &= USART_CR3_TXFTIE | USART_CR3_RXFTIE;
+	if (stm32_port->fifoen) {
+		cr3 &= ~(USART_CR3_TXFTCFG_MASK | USART_CR3_RXFTCFG_MASK);
+		cr3 |= USART_CR3_TXFTCFG_HALF << USART_CR3_TXFTCFG_SHIFT;
+		cr3 |= USART_CR3_RXFTCFG_HALF << USART_CR3_RXFTCFG_SHIFT;
+	}
 
 	if (cflag & CSTOPB)
 		cr2 |= USART_CR2_STOP_2B;
-- 
2.30.2




^ permalink raw reply related	[flat|nested] 702+ messages in thread

* [PATCH 5.12 163/677] serial: stm32: fix a deadlock condition with wakeup event
  2021-05-12 14:40 [PATCH 5.12 000/677] 5.12.4-rc1 review Greg Kroah-Hartman
                   ` (161 preceding siblings ...)
  2021-05-12 14:43 ` [PATCH 5.12 162/677] serial: stm32: fix TX and RX FIFO thresholds Greg Kroah-Hartman
@ 2021-05-12 14:43 ` Greg Kroah-Hartman
  2021-05-12 14:43 ` [PATCH 5.12 164/677] serial: stm32: fix wake-up flag handling Greg Kroah-Hartman
                   ` (521 subsequent siblings)
  684 siblings, 0 replies; 702+ messages in thread
From: Greg Kroah-Hartman @ 2021-05-12 14:43 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Erwan Le Ray, Fabrice Gasnier, Sasha Levin

From: Erwan Le Ray <erwan.leray@foss.st.com>

[ Upstream commit ad7676812437a00a4c6be155fc17926069f99084 ]

Deadlock issue is seen when enabling CONFIG_PROVE_LOCKING=Y, and uart
console as wakeup source. Deadlock occurs when resuming from low power
mode if system is waked up via usart console.
The deadlock is triggered 100% when also disabling console suspend prior
to go to suspend.

Simplified call stack, deadlock condition:
- stm32_console_write <-- spin_lock already held
- print_circular_bug
- pm_wakeup_dev_event <-- triggers lockdep as seen above
- stm32_receive_chars
- stm32_interrupt <-- wakeup via uart console, takes the lock

So, revisit spin_lock in stm32-usart driver:
- there is no need to hold the lock to access ICR (atomic clear of status
  flags)
- only hold the lock inside stm32_receive_chars() routine (no need to
  call pm_wakeup_dev_event with lock held)
- keep stm32_transmit_chars() routine called with lock held

Fixes: 48a6092fb41f ("serial: stm32-usart: Add STM32 USART Driver")
Signed-off-by: Erwan Le Ray <erwan.leray@foss.st.com>
Signed-off-by: Fabrice Gasnier <fabrice.gasnier@foss.st.com>
Link: https://lore.kernel.org/r/20210304162308.8984-6-erwan.leray@foss.st.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/tty/serial/stm32-usart.c | 27 +++++++++++++++------------
 1 file changed, 15 insertions(+), 12 deletions(-)

diff --git a/drivers/tty/serial/stm32-usart.c b/drivers/tty/serial/stm32-usart.c
index 223cec70c57c..370141445780 100644
--- a/drivers/tty/serial/stm32-usart.c
+++ b/drivers/tty/serial/stm32-usart.c
@@ -214,13 +214,18 @@ static void stm32_usart_receive_chars(struct uart_port *port, bool threaded)
 	struct tty_port *tport = &port->state->port;
 	struct stm32_port *stm32_port = to_stm32_port(port);
 	const struct stm32_usart_offsets *ofs = &stm32_port->info->ofs;
-	unsigned long c;
+	unsigned long c, flags;
 	u32 sr;
 	char flag;
 
 	if (irqd_is_wakeup_set(irq_get_irq_data(port->irq)))
 		pm_wakeup_event(tport->tty->dev, 0);
 
+	if (threaded)
+		spin_lock_irqsave(&port->lock, flags);
+	else
+		spin_lock(&port->lock);
+
 	while (stm32_usart_pending_rx(port, &sr, &stm32_port->last_res,
 				      threaded)) {
 		sr |= USART_SR_DUMMY_RX;
@@ -276,9 +281,12 @@ static void stm32_usart_receive_chars(struct uart_port *port, bool threaded)
 		uart_insert_char(port, sr, USART_SR_ORE, c, flag);
 	}
 
-	spin_unlock(&port->lock);
+	if (threaded)
+		spin_unlock_irqrestore(&port->lock, flags);
+	else
+		spin_unlock(&port->lock);
+
 	tty_flip_buffer_push(tport);
-	spin_lock(&port->lock);
 }
 
 static void stm32_usart_tx_dma_complete(void *arg)
@@ -459,8 +467,6 @@ static irqreturn_t stm32_usart_interrupt(int irq, void *ptr)
 	const struct stm32_usart_offsets *ofs = &stm32_port->info->ofs;
 	u32 sr;
 
-	spin_lock(&port->lock);
-
 	sr = readl_relaxed(port->membase + ofs->isr);
 
 	if ((sr & USART_SR_RTOF) && ofs->icr != UNDEF_REG)
@@ -474,10 +480,11 @@ static irqreturn_t stm32_usart_interrupt(int irq, void *ptr)
 	if ((sr & USART_SR_RXNE) && !(stm32_port->rx_ch))
 		stm32_usart_receive_chars(port, false);
 
-	if ((sr & USART_SR_TXE) && !(stm32_port->tx_ch))
+	if ((sr & USART_SR_TXE) && !(stm32_port->tx_ch)) {
+		spin_lock(&port->lock);
 		stm32_usart_transmit_chars(port);
-
-	spin_unlock(&port->lock);
+		spin_unlock(&port->lock);
+	}
 
 	if (stm32_port->rx_ch)
 		return IRQ_WAKE_THREAD;
@@ -490,13 +497,9 @@ static irqreturn_t stm32_usart_threaded_interrupt(int irq, void *ptr)
 	struct uart_port *port = ptr;
 	struct stm32_port *stm32_port = to_stm32_port(port);
 
-	spin_lock(&port->lock);
-
 	if (stm32_port->rx_ch)
 		stm32_usart_receive_chars(port, true);
 
-	spin_unlock(&port->lock);
-
 	return IRQ_HANDLED;
 }
 
-- 
2.30.2




^ permalink raw reply related	[flat|nested] 702+ messages in thread

* [PATCH 5.12 164/677] serial: stm32: fix wake-up flag handling
  2021-05-12 14:40 [PATCH 5.12 000/677] 5.12.4-rc1 review Greg Kroah-Hartman
                   ` (162 preceding siblings ...)
  2021-05-12 14:43 ` [PATCH 5.12 163/677] serial: stm32: fix a deadlock condition with wakeup event Greg Kroah-Hartman
@ 2021-05-12 14:43 ` Greg Kroah-Hartman
  2021-05-12 14:43 ` [PATCH 5.12 165/677] serial: stm32: fix a deadlock in set_termios Greg Kroah-Hartman
                   ` (520 subsequent siblings)
  684 siblings, 0 replies; 702+ messages in thread
From: Greg Kroah-Hartman @ 2021-05-12 14:43 UTC (permalink / raw)
  To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Erwan Le Ray, Sasha Levin

From: Erwan Le Ray <erwan.leray@foss.st.com>

[ Upstream commit 12761869f0efa524348e2ae31827fd52eebf3f0d ]

This patch fixes several issue with wake-up handling:
- the WUF irq is handled several times at wake-up
- the USART is disabled / enabled at suspend to set wake-up flag.
It can cause glitches during RX.

This patch fix those issues:
- clear wake-up flag and disable wake-up irq in WUF irq handling
- enable wake-up from low power on start bit detection at port
configuration
- Unmask the wake-up flag irq at suspend and mask it at resume

In addition, pm_wakeup_event handling is moved from receice_chars to WUF
irq handling.

Fixes: 270e5a74fe4c ("serial: stm32: add wakeup mechanism")
Signed-off-by: Erwan Le Ray <erwan.leray@foss.st.com>
Link: https://lore.kernel.org/r/20210304162308.8984-7-erwan.leray@foss.st.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/tty/serial/stm32-usart.c | 32 +++++++++++++++++++-------------
 1 file changed, 19 insertions(+), 13 deletions(-)

diff --git a/drivers/tty/serial/stm32-usart.c b/drivers/tty/serial/stm32-usart.c
index 370141445780..326f300dd410 100644
--- a/drivers/tty/serial/stm32-usart.c
+++ b/drivers/tty/serial/stm32-usart.c
@@ -218,9 +218,6 @@ static void stm32_usart_receive_chars(struct uart_port *port, bool threaded)
 	u32 sr;
 	char flag;
 
-	if (irqd_is_wakeup_set(irq_get_irq_data(port->irq)))
-		pm_wakeup_event(tport->tty->dev, 0);
-
 	if (threaded)
 		spin_lock_irqsave(&port->lock, flags);
 	else
@@ -463,6 +460,7 @@ static void stm32_usart_transmit_chars(struct uart_port *port)
 static irqreturn_t stm32_usart_interrupt(int irq, void *ptr)
 {
 	struct uart_port *port = ptr;
+	struct tty_port *tport = &port->state->port;
 	struct stm32_port *stm32_port = to_stm32_port(port);
 	const struct stm32_usart_offsets *ofs = &stm32_port->info->ofs;
 	u32 sr;
@@ -473,9 +471,14 @@ static irqreturn_t stm32_usart_interrupt(int irq, void *ptr)
 		writel_relaxed(USART_ICR_RTOCF,
 			       port->membase + ofs->icr);
 
-	if ((sr & USART_SR_WUF) && ofs->icr != UNDEF_REG)
+	if ((sr & USART_SR_WUF) && ofs->icr != UNDEF_REG) {
+		/* Clear wake up flag and disable wake up interrupt */
 		writel_relaxed(USART_ICR_WUCF,
 			       port->membase + ofs->icr);
+		stm32_usart_clr_bits(port, ofs->cr3, USART_CR3_WUFIE);
+		if (irqd_is_wakeup_set(irq_get_irq_data(port->irq)))
+			pm_wakeup_event(tport->tty->dev, 0);
+	}
 
 	if ((sr & USART_SR_RXNE) && !(stm32_port->rx_ch))
 		stm32_usart_receive_chars(port, false);
@@ -901,6 +904,12 @@ static void stm32_usart_set_termios(struct uart_port *port,
 		cr1 &= ~(USART_CR1_DEDT_MASK | USART_CR1_DEAT_MASK);
 	}
 
+	/* Configure wake up from low power on start bit detection */
+	if (stm32_port->wakeirq > 0) {
+		cr3 &= ~USART_CR3_WUS_MASK;
+		cr3 |= USART_CR3_WUS_START_BIT;
+	}
+
 	writel_relaxed(cr3, port->membase + ofs->cr3);
 	writel_relaxed(cr2, port->membase + ofs->cr2);
 	writel_relaxed(cr1, port->membase + ofs->cr1);
@@ -1476,23 +1485,20 @@ static void __maybe_unused stm32_usart_serial_en_wakeup(struct uart_port *port,
 {
 	struct stm32_port *stm32_port = to_stm32_port(port);
 	const struct stm32_usart_offsets *ofs = &stm32_port->info->ofs;
-	const struct stm32_usart_config *cfg = &stm32_port->info->cfg;
-	u32 val;
 
 	if (stm32_port->wakeirq <= 0)
 		return;
 
+	/*
+	 * Enable low-power wake-up and wake-up irq if argument is set to
+	 * "enable", disable low-power wake-up and wake-up irq otherwise
+	 */
 	if (enable) {
-		stm32_usart_clr_bits(port, ofs->cr1, BIT(cfg->uart_enable_bit));
 		stm32_usart_set_bits(port, ofs->cr1, USART_CR1_UESM);
-		val = readl_relaxed(port->membase + ofs->cr3);
-		val &= ~USART_CR3_WUS_MASK;
-		/* Enable Wake up interrupt from low power on start bit */
-		val |= USART_CR3_WUS_START_BIT | USART_CR3_WUFIE;
-		writel_relaxed(val, port->membase + ofs->cr3);
-		stm32_usart_set_bits(port, ofs->cr1, BIT(cfg->uart_enable_bit));
+		stm32_usart_set_bits(port, ofs->cr3, USART_CR3_WUFIE);
 	} else {
 		stm32_usart_clr_bits(port, ofs->cr1, USART_CR1_UESM);
+		stm32_usart_clr_bits(port, ofs->cr3, USART_CR3_WUFIE);
 	}
 }
 
-- 
2.30.2




^ permalink raw reply related	[flat|nested] 702+ messages in thread

* [PATCH 5.12 165/677] serial: stm32: fix a deadlock in set_termios
  2021-05-12 14:40 [PATCH 5.12 000/677] 5.12.4-rc1 review Greg Kroah-Hartman
                   ` (163 preceding siblings ...)
  2021-05-12 14:43 ` [PATCH 5.12 164/677] serial: stm32: fix wake-up flag handling Greg Kroah-Hartman
@ 2021-05-12 14:43 ` Greg Kroah-Hartman
  2021-05-12 14:43 ` [PATCH 5.12 166/677] serial: liteuart: fix return value check in liteuart_probe() Greg Kroah-Hartman
                   ` (519 subsequent siblings)
  684 siblings, 0 replies; 702+ messages in thread
From: Greg Kroah-Hartman @ 2021-05-12 14:43 UTC (permalink / raw)
  To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Erwan Le Ray, Sasha Levin

From: Erwan Le Ray <erwan.leray@foss.st.com>

[ Upstream commit 436c97936001776f16153771ee887f125443e974 ]

CTS/RTS GPIOs support that has been added recently to STM32 UART driver has
introduced scheduled code in a set_termios part protected by a spin lock.
This generates a potential deadlock scenario:

Chain exists of:
&irq_desc_lock_class --> console_owner --> &port_lock_key

Possible unsafe locking scenario:

     CPU0                    CPU1
     ----                    ----
lock(&port_lock_key);
                           lock(console_owner);
                           lock(&port_lock_key);
lock(&irq_desc_lock_class);

*** DEADLOCK ***
4 locks held by stty/766:

Move the scheduled code after the spinlock.

Fixes: 6cf61b9bd7cc ("tty: serial: Add modem control gpio support for STM32 UART")
Signed-off-by: Erwan Le Ray <erwan.leray@foss.st.com>
Link: https://lore.kernel.org/r/20210304162308.8984-8-erwan.leray@foss.st.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/tty/serial/stm32-usart.c | 12 ++++++------
 1 file changed, 6 insertions(+), 6 deletions(-)

diff --git a/drivers/tty/serial/stm32-usart.c b/drivers/tty/serial/stm32-usart.c
index 326f300dd410..a381ee52168a 100644
--- a/drivers/tty/serial/stm32-usart.c
+++ b/drivers/tty/serial/stm32-usart.c
@@ -829,12 +829,6 @@ static void stm32_usart_set_termios(struct uart_port *port,
 		cr3 |= USART_CR3_CTSE | USART_CR3_RTSE;
 	}
 
-	/* Handle modem control interrupts */
-	if (UART_ENABLE_MS(port, termios->c_cflag))
-		stm32_usart_enable_ms(port);
-	else
-		stm32_usart_disable_ms(port);
-
 	usartdiv = DIV_ROUND_CLOSEST(port->uartclk, baud);
 
 	/*
@@ -916,6 +910,12 @@ static void stm32_usart_set_termios(struct uart_port *port,
 
 	stm32_usart_set_bits(port, ofs->cr1, BIT(cfg->uart_enable_bit));
 	spin_unlock_irqrestore(&port->lock, flags);
+
+	/* Handle modem control interrupts */
+	if (UART_ENABLE_MS(port, termios->c_cflag))
+		stm32_usart_enable_ms(port);
+	else
+		stm32_usart_disable_ms(port);
 }
 
 static const char *stm32_usart_type(struct uart_port *port)
-- 
2.30.2




^ permalink raw reply related	[flat|nested] 702+ messages in thread

* [PATCH 5.12 166/677] serial: liteuart: fix return value check in liteuart_probe()
  2021-05-12 14:40 [PATCH 5.12 000/677] 5.12.4-rc1 review Greg Kroah-Hartman
                   ` (164 preceding siblings ...)
  2021-05-12 14:43 ` [PATCH 5.12 165/677] serial: stm32: fix a deadlock in set_termios Greg Kroah-Hartman
@ 2021-05-12 14:43 ` Greg Kroah-Hartman
  2021-05-12 14:43 ` [PATCH 5.12 167/677] serial: stm32: fix tx dma completion, release channel Greg Kroah-Hartman
                   ` (518 subsequent siblings)
  684 siblings, 0 replies; 702+ messages in thread
From: Greg Kroah-Hartman @ 2021-05-12 14:43 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Hulk Robot, Wei Yongjun, Sasha Levin

From: Wei Yongjun <weiyongjun1@huawei.com>

[ Upstream commit cebeddd6d0d9f839b9df2930b6a768b54913a763 ]

In case of error, the function devm_platform_get_and_ioremap_resource()
returns ERR_PTR() and never returns NULL. The NULL test in the return
value check should be replaced with IS_ERR().

Fixes: 1da81e5562fa ("drivers/tty/serial: add LiteUART driver")
Reported-by: Hulk Robot <hulkci@huawei.com>
Signed-off-by: Wei Yongjun <weiyongjun1@huawei.com>
Link: https://lore.kernel.org/r/20210305034929.3234352-1-weiyongjun1@huawei.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/tty/serial/liteuart.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/drivers/tty/serial/liteuart.c b/drivers/tty/serial/liteuart.c
index 64842f3539e1..0b06770642cb 100644
--- a/drivers/tty/serial/liteuart.c
+++ b/drivers/tty/serial/liteuart.c
@@ -270,8 +270,8 @@ static int liteuart_probe(struct platform_device *pdev)
 
 	/* get membase */
 	port->membase = devm_platform_get_and_ioremap_resource(pdev, 0, NULL);
-	if (!port->membase)
-		return -ENXIO;
+	if (IS_ERR(port->membase))
+		return PTR_ERR(port->membase);
 
 	/* values not from device tree */
 	port->dev = &pdev->dev;
-- 
2.30.2




^ permalink raw reply related	[flat|nested] 702+ messages in thread

* [PATCH 5.12 167/677] serial: stm32: fix tx dma completion, release channel
  2021-05-12 14:40 [PATCH 5.12 000/677] 5.12.4-rc1 review Greg Kroah-Hartman
                   ` (165 preceding siblings ...)
  2021-05-12 14:43 ` [PATCH 5.12 166/677] serial: liteuart: fix return value check in liteuart_probe() Greg Kroah-Hartman
@ 2021-05-12 14:43 ` Greg Kroah-Hartman
  2021-05-12 14:43 ` [PATCH 5.12 168/677] serial: stm32: call stm32_transmit_chars locked Greg Kroah-Hartman
                   ` (517 subsequent siblings)
  684 siblings, 0 replies; 702+ messages in thread
From: Greg Kroah-Hartman @ 2021-05-12 14:43 UTC (permalink / raw)
  To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Erwan Le Ray, Sasha Levin

From: Erwan Le Ray <erwan.leray@foss.st.com>

[ Upstream commit fb4f2e04ac13e7c400e6b86afbbd314a5a2a7e8d ]

This patch add a proper release of dma channels when completing dma tx.

Fixes: 3489187204eb ("serial: stm32: adding dma support")
Signed-off-by: Erwan Le Ray <erwan.leray@foss.st.com>
Link: https://lore.kernel.org/r/20210304162308.8984-9-erwan.leray@foss.st.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/tty/serial/stm32-usart.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/tty/serial/stm32-usart.c b/drivers/tty/serial/stm32-usart.c
index a381ee52168a..74046ae3a412 100644
--- a/drivers/tty/serial/stm32-usart.c
+++ b/drivers/tty/serial/stm32-usart.c
@@ -292,6 +292,7 @@ static void stm32_usart_tx_dma_complete(void *arg)
 	struct stm32_port *stm32port = to_stm32_port(port);
 	const struct stm32_usart_offsets *ofs = &stm32port->info->ofs;
 
+	dmaengine_terminate_async(stm32port->tx_ch);
 	stm32_usart_clr_bits(port, ofs->cr3, USART_CR3_DMAT);
 	stm32port->tx_dma_busy = false;
 
-- 
2.30.2




^ permalink raw reply related	[flat|nested] 702+ messages in thread

* [PATCH 5.12 168/677] serial: stm32: call stm32_transmit_chars locked
  2021-05-12 14:40 [PATCH 5.12 000/677] 5.12.4-rc1 review Greg Kroah-Hartman
                   ` (166 preceding siblings ...)
  2021-05-12 14:43 ` [PATCH 5.12 167/677] serial: stm32: fix tx dma completion, release channel Greg Kroah-Hartman
@ 2021-05-12 14:43 ` Greg Kroah-Hartman
  2021-05-12 14:43 ` [PATCH 5.12 169/677] serial: stm32: fix FIFO flush in startup and set_termios Greg Kroah-Hartman
                   ` (516 subsequent siblings)
  684 siblings, 0 replies; 702+ messages in thread
From: Greg Kroah-Hartman @ 2021-05-12 14:43 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Erwan Le Ray, Fabrice Gasnier, Sasha Levin

From: Erwan Le Ray <erwan.leray@foss.st.com>

[ Upstream commit f16b90c2d9db3e6ac719d1946b9d335ca4ab33f3 ]

stm32_transmit_chars should be called under lock also in tx DMA callback.

Fixes: 3489187204eb ("serial: stm32: adding dma support")
Signed-off-by: Erwan Le Ray <erwan.leray@foss.st.com>
Signed-off-by: Fabrice Gasnier <fabrice.gasnier@foss.st.com>
Link: https://lore.kernel.org/r/20210304162308.8984-10-erwan.leray@foss.st.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/tty/serial/stm32-usart.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/drivers/tty/serial/stm32-usart.c b/drivers/tty/serial/stm32-usart.c
index 74046ae3a412..2bdd04a47f91 100644
--- a/drivers/tty/serial/stm32-usart.c
+++ b/drivers/tty/serial/stm32-usart.c
@@ -291,13 +291,16 @@ static void stm32_usart_tx_dma_complete(void *arg)
 	struct uart_port *port = arg;
 	struct stm32_port *stm32port = to_stm32_port(port);
 	const struct stm32_usart_offsets *ofs = &stm32port->info->ofs;
+	unsigned long flags;
 
 	dmaengine_terminate_async(stm32port->tx_ch);
 	stm32_usart_clr_bits(port, ofs->cr3, USART_CR3_DMAT);
 	stm32port->tx_dma_busy = false;
 
 	/* Let's see if we have pending data to send */
+	spin_lock_irqsave(&port->lock, flags);
 	stm32_usart_transmit_chars(port);
+	spin_unlock_irqrestore(&port->lock, flags);
 }
 
 static void stm32_usart_tx_interrupt_enable(struct uart_port *port)
-- 
2.30.2




^ permalink raw reply related	[flat|nested] 702+ messages in thread

* [PATCH 5.12 169/677] serial: stm32: fix FIFO flush in startup and set_termios
  2021-05-12 14:40 [PATCH 5.12 000/677] 5.12.4-rc1 review Greg Kroah-Hartman
                   ` (167 preceding siblings ...)
  2021-05-12 14:43 ` [PATCH 5.12 168/677] serial: stm32: call stm32_transmit_chars locked Greg Kroah-Hartman
@ 2021-05-12 14:43 ` Greg Kroah-Hartman
  2021-05-12 14:43 ` [PATCH 5.12 170/677] serial: stm32: add FIFO flush when port is closed Greg Kroah-Hartman
                   ` (515 subsequent siblings)
  684 siblings, 0 replies; 702+ messages in thread
From: Greg Kroah-Hartman @ 2021-05-12 14:43 UTC (permalink / raw)
  To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Erwan Le Ray, Sasha Levin

From: Erwan Le Ray <erwan.leray@foss.st.com>

[ Upstream commit 315e2d8a125ad77a1bc28f621162713f3e7aef48 ]

Fifo flush set USART_RQR register by calling stm32_usart_set_bits
routine (Read/Modify/Write). USART_RQR register is a write only
register. So, read before write isn't correct / relevant to flush
the FIFOs.
Replace stm32_usart_set_bits call by writel_relaxed.

Fixes: 84872dc448fe ("serial: stm32: add RX and TX FIFO flush")
Signed-off-by: Erwan Le Ray <erwan.leray@foss.st.com>
Link: https://lore.kernel.org/r/20210304162308.8984-11-erwan.leray@foss.st.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/tty/serial/stm32-usart.c | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/drivers/tty/serial/stm32-usart.c b/drivers/tty/serial/stm32-usart.c
index 2bdd04a47f91..183c76ddb165 100644
--- a/drivers/tty/serial/stm32-usart.c
+++ b/drivers/tty/serial/stm32-usart.c
@@ -657,7 +657,7 @@ static int stm32_usart_startup(struct uart_port *port)
 
 	/* RX FIFO Flush */
 	if (ofs->rqr != UNDEF_REG)
-		stm32_usart_set_bits(port, ofs->rqr, USART_RQR_RXFRQ);
+		writel_relaxed(USART_RQR_RXFRQ, port->membase + ofs->rqr);
 
 	/* RX enabling */
 	val = stm32_port->cr1_irq | USART_CR1_RE | BIT(cfg->uart_enable_bit);
@@ -762,8 +762,8 @@ static void stm32_usart_set_termios(struct uart_port *port,
 
 	/* flush RX & TX FIFO */
 	if (ofs->rqr != UNDEF_REG)
-		stm32_usart_set_bits(port, ofs->rqr,
-				     USART_RQR_TXFRQ | USART_RQR_RXFRQ);
+		writel_relaxed(USART_RQR_TXFRQ | USART_RQR_RXFRQ,
+			       port->membase + ofs->rqr);
 
 	cr1 = USART_CR1_TE | USART_CR1_RE;
 	if (stm32_port->fifoen)
-- 
2.30.2




^ permalink raw reply related	[flat|nested] 702+ messages in thread

* [PATCH 5.12 170/677] serial: stm32: add FIFO flush when port is closed
  2021-05-12 14:40 [PATCH 5.12 000/677] 5.12.4-rc1 review Greg Kroah-Hartman
                   ` (168 preceding siblings ...)
  2021-05-12 14:43 ` [PATCH 5.12 169/677] serial: stm32: fix FIFO flush in startup and set_termios Greg Kroah-Hartman
@ 2021-05-12 14:43 ` Greg Kroah-Hartman
  2021-05-12 14:43 ` [PATCH 5.12 171/677] serial: stm32: fix tx_empty condition Greg Kroah-Hartman
                   ` (514 subsequent siblings)
  684 siblings, 0 replies; 702+ messages in thread
From: Greg Kroah-Hartman @ 2021-05-12 14:43 UTC (permalink / raw)
  To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Erwan Le Ray, Sasha Levin

From: Erwan Le Ray <erwan.leray@foss.st.com>

[ Upstream commit 9f77d19207a0e8ba814c8ceb22e90ce7cb2aef64 ]

Transmission complete error is sent when ISR_TC is not set. If port closure
is requested despite data in TDR / TX FIFO has not been sent (because of
flow control), ISR_TC is not set and error message is sent on port closure
but also when a new port is opened.

Flush the data when port is closed, so the error isn't printed twice upon
next port opening.

Fixes: 64c32eab6603 ("serial: stm32: Add support of TC bit status check")
Signed-off-by: Erwan Le Ray <erwan.leray@foss.st.com>
Link: https://lore.kernel.org/r/20210304162308.8984-12-erwan.leray@foss.st.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/tty/serial/stm32-usart.c | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/drivers/tty/serial/stm32-usart.c b/drivers/tty/serial/stm32-usart.c
index 183c76ddb165..d205fce1950a 100644
--- a/drivers/tty/serial/stm32-usart.c
+++ b/drivers/tty/serial/stm32-usart.c
@@ -691,6 +691,11 @@ static void stm32_usart_shutdown(struct uart_port *port)
 	if (ret)
 		dev_err(port->dev, "Transmission is not complete\n");
 
+	/* flush RX & TX FIFO */
+	if (ofs->rqr != UNDEF_REG)
+		writel_relaxed(USART_RQR_TXFRQ | USART_RQR_RXFRQ,
+			       port->membase + ofs->rqr);
+
 	stm32_usart_clr_bits(port, ofs->cr1, val);
 
 	free_irq(port->irq, port);
-- 
2.30.2




^ permalink raw reply related	[flat|nested] 702+ messages in thread

* [PATCH 5.12 171/677] serial: stm32: fix tx_empty condition
  2021-05-12 14:40 [PATCH 5.12 000/677] 5.12.4-rc1 review Greg Kroah-Hartman
                   ` (169 preceding siblings ...)
  2021-05-12 14:43 ` [PATCH 5.12 170/677] serial: stm32: add FIFO flush when port is closed Greg Kroah-Hartman
@ 2021-05-12 14:43 ` Greg Kroah-Hartman
  2021-05-12 14:43 ` [PATCH 5.12 172/677] usb: typec: tcpm: Wait for vbus discharge to VSAFE0V before toggling Greg Kroah-Hartman
                   ` (513 subsequent siblings)
  684 siblings, 0 replies; 702+ messages in thread
From: Greg Kroah-Hartman @ 2021-05-12 14:43 UTC (permalink / raw)
  To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Erwan Le Ray, Sasha Levin

From: Erwan Le Ray <erwan.leray@foss.st.com>

[ Upstream commit 3db1d52466dc11dca4e47ef12a6e6e97f846af62 ]

In "tx_empty", we should poll TC bit in both DMA and PIO modes (instead of
TXE) to check transmission data register has been transmitted independently
of the FIFO mode. TC indicates that both transmit register and shift
register are empty. When shift register is empty, tx_empty should return
TIOCSER_TEMT instead of TC value.

Cleans the USART_CR_TC TCCF register define (transmission complete clear
flag) as it is duplicate of USART_ICR_TCCF.

Fixes: 48a6092fb41f ("serial: stm32-usart: Add STM32 USART Driver")
Signed-off-by: Erwan Le Ray <erwan.leray@foss.st.com>
Link: https://lore.kernel.org/r/20210304162308.8984-13-erwan.leray@foss.st.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/tty/serial/stm32-usart.c | 5 ++++-
 drivers/tty/serial/stm32-usart.h | 3 ---
 2 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/drivers/tty/serial/stm32-usart.c b/drivers/tty/serial/stm32-usart.c
index d205fce1950a..99dfa884cbef 100644
--- a/drivers/tty/serial/stm32-usart.c
+++ b/drivers/tty/serial/stm32-usart.c
@@ -515,7 +515,10 @@ static unsigned int stm32_usart_tx_empty(struct uart_port *port)
 	struct stm32_port *stm32_port = to_stm32_port(port);
 	const struct stm32_usart_offsets *ofs = &stm32_port->info->ofs;
 
-	return readl_relaxed(port->membase + ofs->isr) & USART_SR_TXE;
+	if (readl_relaxed(port->membase + ofs->isr) & USART_SR_TC)
+		return TIOCSER_TEMT;
+
+	return 0;
 }
 
 static void stm32_usart_set_mctrl(struct uart_port *port, unsigned int mctrl)
diff --git a/drivers/tty/serial/stm32-usart.h b/drivers/tty/serial/stm32-usart.h
index cb4f327c46db..94b568aa46bb 100644
--- a/drivers/tty/serial/stm32-usart.h
+++ b/drivers/tty/serial/stm32-usart.h
@@ -127,9 +127,6 @@ struct stm32_usart_info stm32h7_info = {
 /* Dummy bits */
 #define USART_SR_DUMMY_RX	BIT(16)
 
-/* USART_ICR (F7) */
-#define USART_CR_TC		BIT(6)
-
 /* USART_DR */
 #define USART_DR_MASK		GENMASK(8, 0)
 
-- 
2.30.2




^ permalink raw reply related	[flat|nested] 702+ messages in thread

* [PATCH 5.12 172/677] usb: typec: tcpm: Wait for vbus discharge to VSAFE0V before toggling
  2021-05-12 14:40 [PATCH 5.12 000/677] 5.12.4-rc1 review Greg Kroah-Hartman
                   ` (170 preceding siblings ...)
  2021-05-12 14:43 ` [PATCH 5.12 171/677] serial: stm32: fix tx_empty condition Greg Kroah-Hartman
@ 2021-05-12 14:43 ` Greg Kroah-Hartman
  2021-05-12 14:43 ` [PATCH 5.12 173/677] usb: typec: tcpci: Check ROLE_CONTROL while interpreting CC_STATUS Greg Kroah-Hartman
                   ` (512 subsequent siblings)
  684 siblings, 0 replies; 702+ messages in thread
From: Greg Kroah-Hartman @ 2021-05-12 14:43 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Guenter Roeck, Heikki Krogerus,
	Badhri Jagan Sridharan, Sasha Levin

From: Badhri Jagan Sridharan <badhri@google.com>

[ Upstream commit 3287f58bcba6c6fa6167624b443a668782fac26d ]

When vbus auto discharge is enabled, TCPM can sometimes be faster than
the TCPC i.e. TCPM can go ahead and move the port to unattached state
(involves disabling vbus auto discharge) before TCPC could effectively
discharge vbus to VSAFE0V. This leaves vbus with residual charge and
increases the decay time which prevents tsafe0v from being met.
This change makes TCPM waits for a maximum of tSafe0V(max) for vbus
to discharge to VSAFE0V before transitioning to unattached state
and re-enable toggling. If vbus discharges to vsafe0v sooner, then,
transition to unattached state
happens right away.

Also, while in SNK_READY, when auto discharge is enabled, drive
disconnect based on vbus turning off instead of Rp disappearing on
CC pins. Rp disappearing on CC pins is almost instanteous compared
to vbus decay.

Sink detach:
[  541.703058] CC1: 3 -> 0, CC2: 0 -> 0 [state SNK_READY, polarity 0, disconnected]
[  541.703331] Setting voltage/current limit 5000 mV 0 mA
[  541.727235] VBUS on
[  541.749650] VBUS off
[  541.749653] pending state change SNK_READY -> SNK_UNATTACHED @ 650 ms [rev3 NONE_AMS]
[  541.749944] VBUS VSAFE0V
[  541.749945] state change SNK_READY -> SNK_UNATTACHED [rev3 NONE_AMS]
[  541.750806] Disable vbus discharge ret:0
[  541.907345] Start toggling
[  541.922799] CC1: 0 -> 0, CC2: 0 -> 0 [state TOGGLING, polarity 0, disconnected]

Source detach:
[ 2555.310414] state change SRC_SEND_CAPABILITIES -> SRC_READY [rev3 POWER_NEGOTIATION]
[ 2555.310675] AMS POWER_NEGOTIATION finished
[ 2555.310679] cc:=3
[ 2593.645886] CC1: 0 -> 0, CC2: 2 -> 0 [state SRC_READY, polarity 1, disconnected]
[ 2593.645919] pending state change SRC_READY -> SNK_UNATTACHED @ 650 ms [rev3 NONE_AMS]
[ 2593.648419] VBUS off
[ 2593.648960] VBUS VSAFE0V
[ 2593.648965] state change SRC_READY -> SNK_UNATTACHED [rev3 NONE_AMS]
[ 2593.649962] Disable vbus discharge ret:0
[ 2593.890322] Start toggling
[ 2593.925663] CC1: 0 -> 0, CC2: 0 -> 0 [state TOGGLING, polarity 0,

Fixes: f321a02caebd ("usb: typec: tcpm: Implement enabling Auto Discharge disconnect support")
Reviewed-by: Guenter Roeck <linux@roeck-us.net>
Reviewed-by: Heikki Krogerus <heikki.krogerus@linux.intel.com>
Signed-off-by: Badhri Jagan Sridharan <badhri@google.com>
Link: https://lore.kernel.org/r/20210225101104.1680697-1-badhri@google.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/usb/typec/tcpm/tcpm.c | 75 ++++++++++++++++++++++++++++++-----
 1 file changed, 65 insertions(+), 10 deletions(-)

diff --git a/drivers/usb/typec/tcpm/tcpm.c b/drivers/usb/typec/tcpm/tcpm.c
index de214da4363e..b1040f00c2ba 100644
--- a/drivers/usb/typec/tcpm/tcpm.c
+++ b/drivers/usb/typec/tcpm/tcpm.c
@@ -456,6 +456,9 @@ struct tcpm_port {
 	enum tcpm_ams next_ams;
 	bool in_ams;
 
+	/* Auto vbus discharge status */
+	bool auto_vbus_discharge_enabled;
+
 #ifdef CONFIG_DEBUG_FS
 	struct dentry *dentry;
 	struct mutex logbuffer_lock;	/* log buffer access lock */
@@ -525,6 +528,9 @@ static const char * const pd_rev[] = {
 	(tcpm_port_is_sink(port) && \
 	((port)->cc1 == TYPEC_CC_RP_3_0 || (port)->cc2 == TYPEC_CC_RP_3_0))
 
+#define tcpm_wait_for_discharge(port) \
+	(((port)->auto_vbus_discharge_enabled && !(port)->vbus_vsafe0v) ? PD_T_SAFE_0V : 0)
+
 static enum tcpm_state tcpm_default_state(struct tcpm_port *port)
 {
 	if (port->port_type == TYPEC_PORT_DRP) {
@@ -3439,6 +3445,8 @@ static int tcpm_src_attach(struct tcpm_port *port)
 	if (port->tcpc->enable_auto_vbus_discharge) {
 		ret = port->tcpc->enable_auto_vbus_discharge(port->tcpc, true);
 		tcpm_log_force(port, "enable vbus discharge ret:%d", ret);
+		if (!ret)
+			port->auto_vbus_discharge_enabled = true;
 	}
 
 	ret = tcpm_set_roles(port, true, TYPEC_SOURCE, tcpm_data_role_for_source(port));
@@ -3521,6 +3529,8 @@ static void tcpm_reset_port(struct tcpm_port *port)
 	if (port->tcpc->enable_auto_vbus_discharge) {
 		ret = port->tcpc->enable_auto_vbus_discharge(port->tcpc, false);
 		tcpm_log_force(port, "Disable vbus discharge ret:%d", ret);
+		if (!ret)
+			port->auto_vbus_discharge_enabled = false;
 	}
 	port->in_ams = false;
 	port->ams = NONE_AMS;
@@ -3593,6 +3603,8 @@ static int tcpm_snk_attach(struct tcpm_port *port)
 		tcpm_set_auto_vbus_discharge_threshold(port, TYPEC_PWR_MODE_USB, false, VSAFE5V);
 		ret = port->tcpc->enable_auto_vbus_discharge(port->tcpc, true);
 		tcpm_log_force(port, "enable vbus discharge ret:%d", ret);
+		if (!ret)
+			port->auto_vbus_discharge_enabled = true;
 	}
 
 	ret = tcpm_set_roles(port, true, TYPEC_SINK, tcpm_data_role_for_sink(port));
@@ -4695,9 +4707,9 @@ static void _tcpm_cc_change(struct tcpm_port *port, enum typec_cc_status cc1,
 		if (tcpm_port_is_disconnected(port) ||
 		    !tcpm_port_is_source(port)) {
 			if (port->port_type == TYPEC_PORT_SRC)
-				tcpm_set_state(port, SRC_UNATTACHED, 0);
+				tcpm_set_state(port, SRC_UNATTACHED, tcpm_wait_for_discharge(port));
 			else
-				tcpm_set_state(port, SNK_UNATTACHED, 0);
+				tcpm_set_state(port, SNK_UNATTACHED, tcpm_wait_for_discharge(port));
 		}
 		break;
 	case SNK_UNATTACHED:
@@ -4728,7 +4740,23 @@ static void _tcpm_cc_change(struct tcpm_port *port, enum typec_cc_status cc1,
 			tcpm_set_state(port, SNK_DEBOUNCED, 0);
 		break;
 	case SNK_READY:
-		if (tcpm_port_is_disconnected(port))
+		/*
+		 * EXIT condition is based primarily on vbus disconnect and CC is secondary.
+		 * "A port that has entered into USB PD communications with the Source and
+		 * has seen the CC voltage exceed vRd-USB may monitor the CC pin to detect
+		 * cable disconnect in addition to monitoring VBUS.
+		 *
+		 * A port that is monitoring the CC voltage for disconnect (but is not in
+		 * the process of a USB PD PR_Swap or USB PD FR_Swap) shall transition to
+		 * Unattached.SNK within tSinkDisconnect after the CC voltage remains below
+		 * vRd-USB for tPDDebounce."
+		 *
+		 * When set_auto_vbus_discharge_threshold is enabled, CC pins go
+		 * away before vbus decays to disconnect threshold. Allow
+		 * disconnect to be driven by vbus disconnect when auto vbus
+		 * discharge is enabled.
+		 */
+		if (!port->auto_vbus_discharge_enabled && tcpm_port_is_disconnected(port))
 			tcpm_set_state(port, unattached_state(port), 0);
 		else if (!port->pd_capable &&
 			 (cc1 != old_cc1 || cc2 != old_cc2))
@@ -4827,9 +4855,13 @@ static void _tcpm_cc_change(struct tcpm_port *port, enum typec_cc_status cc1,
 		 * Ignore CC changes here.
 		 */
 		break;
-
 	default:
-		if (tcpm_port_is_disconnected(port))
+		/*
+		 * While acting as sink and auto vbus discharge is enabled, Allow disconnect
+		 * to be driven by vbus disconnect.
+		 */
+		if (tcpm_port_is_disconnected(port) && !(port->pwr_role == TYPEC_SINK &&
+							 port->auto_vbus_discharge_enabled))
 			tcpm_set_state(port, unattached_state(port), 0);
 		break;
 	}
@@ -4993,8 +5025,16 @@ static void _tcpm_pd_vbus_off(struct tcpm_port *port)
 	case SRC_TRANSITION_SUPPLY:
 	case SRC_READY:
 	case SRC_WAIT_NEW_CAPABILITIES:
-		/* Force to unattached state to re-initiate connection */
-		tcpm_set_state(port, SRC_UNATTACHED, 0);
+		/*
+		 * Force to unattached state to re-initiate connection.
+		 * DRP port should move to Unattached.SNK instead of Unattached.SRC if
+		 * sink removed. Although sink removal here is due to source's vbus collapse,
+		 * treat it the same way for consistency.
+		 */
+		if (port->port_type == TYPEC_PORT_SRC)
+			tcpm_set_state(port, SRC_UNATTACHED, tcpm_wait_for_discharge(port));
+		else
+			tcpm_set_state(port, SNK_UNATTACHED, tcpm_wait_for_discharge(port));
 		break;
 
 	case PORT_RESET:
@@ -5013,9 +5053,8 @@ static void _tcpm_pd_vbus_off(struct tcpm_port *port)
 		break;
 
 	default:
-		if (port->pwr_role == TYPEC_SINK &&
-		    port->attached)
-			tcpm_set_state(port, SNK_UNATTACHED, 0);
+		if (port->pwr_role == TYPEC_SINK && port->attached)
+			tcpm_set_state(port, SNK_UNATTACHED, tcpm_wait_for_discharge(port));
 		break;
 	}
 }
@@ -5037,7 +5076,23 @@ static void _tcpm_pd_vbus_vsafe0v(struct tcpm_port *port)
 			tcpm_set_state(port, tcpm_try_snk(port) ? SNK_TRY : SRC_ATTACHED,
 				       PD_T_CC_DEBOUNCE);
 		break;
+	case SRC_STARTUP:
+	case SRC_SEND_CAPABILITIES:
+	case SRC_SEND_CAPABILITIES_TIMEOUT:
+	case SRC_NEGOTIATE_CAPABILITIES:
+	case SRC_TRANSITION_SUPPLY:
+	case SRC_READY:
+	case SRC_WAIT_NEW_CAPABILITIES:
+		if (port->auto_vbus_discharge_enabled) {
+			if (port->port_type == TYPEC_PORT_SRC)
+				tcpm_set_state(port, SRC_UNATTACHED, 0);
+			else
+				tcpm_set_state(port, SNK_UNATTACHED, 0);
+		}
+		break;
 	default:
+		if (port->pwr_role == TYPEC_SINK && port->auto_vbus_discharge_enabled)
+			tcpm_set_state(port, SNK_UNATTACHED, 0);
 		break;
 	}
 }
-- 
2.30.2




^ permalink raw reply related	[flat|nested] 702+ messages in thread

* [PATCH 5.12 173/677] usb: typec: tcpci: Check ROLE_CONTROL while interpreting CC_STATUS
  2021-05-12 14:40 [PATCH 5.12 000/677] 5.12.4-rc1 review Greg Kroah-Hartman
                   ` (171 preceding siblings ...)
  2021-05-12 14:43 ` [PATCH 5.12 172/677] usb: typec: tcpm: Wait for vbus discharge to VSAFE0V before toggling Greg Kroah-Hartman
@ 2021-05-12 14:43 ` Greg Kroah-Hartman
  2021-05-12 14:43 ` [PATCH 5.12 174/677] usb: typec: tps6598x: Fix return value check in tps6598x_probe() Greg Kroah-Hartman
                   ` (511 subsequent siblings)
  684 siblings, 0 replies; 702+ messages in thread
From: Greg Kroah-Hartman @ 2021-05-12 14:43 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Heikki Krogerus,
	Badhri Jagan Sridharan, Sasha Levin

From: Badhri Jagan Sridharan <badhri@google.com>

[ Upstream commit 19c234a14eafca78e0bc14ffb8be3891096ce147 ]

While interpreting CC_STATUS, ROLE_CONTROL has to be read to make
sure that CC1/CC2 is not forced presenting Rp/Rd.

>From the TCPCI spec:

4.4.5.2 ROLE_CONTROL (Normative):
The TCPM shall write B6 (DRP) = 0b and B3..0 (CC1/CC2) if it wishes
to control the Rp/Rd directly instead of having the TCPC perform
DRP toggling autonomously. When controlling Rp/Rd directly, the
TCPM writes to B3..0 (CC1/CC2) each time it wishes to change the
CC1/CC2 values. This control is used for TCPM-TCPC implementing
Source or Sink only as well as when a connection has been detected
via DRP toggling but the TCPM wishes to attempt Try.Src or Try.Snk.

Table 4-22. CC_STATUS Register Definition:
If (ROLE_CONTROL.CC1 = Rd) or ConnectResult=1)
00b: SNK.Open (Below maximum vRa)
01b: SNK.Default (Above minimum vRd-Connect)
10b: SNK.Power1.5 (Above minimum vRd-Connect) Detects Rp-1.5A
11b: SNK.Power3.0 (Above minimum vRd-Connect) Detects Rp-3.0A

If (ROLE_CONTROL.CC2=Rd) or (ConnectResult=1)
00b: SNK.Open (Below maximum vRa)
01b: SNK.Default (Above minimum vRd-Connect)
10b: SNK.Power1.5 (Above minimum vRd-Connect) Detects Rp 1.5A
11b: SNK.Power3.0 (Above minimum vRd-Connect) Detects Rp 3.0A

Fixes: 74e656d6b0551 ("staging: typec: Type-C Port Controller Interface driver (tcpci)")
Acked-by: Heikki Krogerus <heikki.krogerus@linux.intel.com>
Signed-off-by: Badhri Jagan Sridharan <badhri@google.com>
Link: https://lore.kernel.org/r/20210304070931.1947316-1-badhri@google.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/usb/typec/tcpm/tcpci.c | 21 ++++++++++++++++++---
 1 file changed, 18 insertions(+), 3 deletions(-)

diff --git a/drivers/usb/typec/tcpm/tcpci.c b/drivers/usb/typec/tcpm/tcpci.c
index a27deb0b5f03..027afd7dfdce 100644
--- a/drivers/usb/typec/tcpm/tcpci.c
+++ b/drivers/usb/typec/tcpm/tcpci.c
@@ -24,6 +24,15 @@
 #define	AUTO_DISCHARGE_PD_HEADROOM_MV		850
 #define	AUTO_DISCHARGE_PPS_HEADROOM_MV		1250
 
+#define tcpc_presenting_cc1_rd(reg) \
+	(!(TCPC_ROLE_CTRL_DRP & (reg)) && \
+	 (((reg) & (TCPC_ROLE_CTRL_CC1_MASK << TCPC_ROLE_CTRL_CC1_SHIFT)) == \
+	  (TCPC_ROLE_CTRL_CC_RD << TCPC_ROLE_CTRL_CC1_SHIFT)))
+#define tcpc_presenting_cc2_rd(reg) \
+	(!(TCPC_ROLE_CTRL_DRP & (reg)) && \
+	 (((reg) & (TCPC_ROLE_CTRL_CC2_MASK << TCPC_ROLE_CTRL_CC2_SHIFT)) == \
+	  (TCPC_ROLE_CTRL_CC_RD << TCPC_ROLE_CTRL_CC2_SHIFT)))
+
 struct tcpci {
 	struct device *dev;
 
@@ -178,19 +187,25 @@ static int tcpci_get_cc(struct tcpc_dev *tcpc,
 			enum typec_cc_status *cc1, enum typec_cc_status *cc2)
 {
 	struct tcpci *tcpci = tcpc_to_tcpci(tcpc);
-	unsigned int reg;
+	unsigned int reg, role_control;
 	int ret;
 
+	ret = regmap_read(tcpci->regmap, TCPC_ROLE_CTRL, &role_control);
+	if (ret < 0)
+		return ret;
+
 	ret = regmap_read(tcpci->regmap, TCPC_CC_STATUS, &reg);
 	if (ret < 0)
 		return ret;
 
 	*cc1 = tcpci_to_typec_cc((reg >> TCPC_CC_STATUS_CC1_SHIFT) &
 				 TCPC_CC_STATUS_CC1_MASK,
-				 reg & TCPC_CC_STATUS_TERM);
+				 reg & TCPC_CC_STATUS_TERM ||
+				 tcpc_presenting_cc1_rd(role_control));
 	*cc2 = tcpci_to_typec_cc((reg >> TCPC_CC_STATUS_CC2_SHIFT) &
 				 TCPC_CC_STATUS_CC2_MASK,
-				 reg & TCPC_CC_STATUS_TERM);
+				 reg & TCPC_CC_STATUS_TERM ||
+				 tcpc_presenting_cc2_rd(role_control));
 
 	return 0;
 }
-- 
2.30.2




^ permalink raw reply related	[flat|nested] 702+ messages in thread

* [PATCH 5.12 174/677] usb: typec: tps6598x: Fix return value check in tps6598x_probe()
  2021-05-12 14:40 [PATCH 5.12 000/677] 5.12.4-rc1 review Greg Kroah-Hartman
                   ` (172 preceding siblings ...)
  2021-05-12 14:43 ` [PATCH 5.12 173/677] usb: typec: tcpci: Check ROLE_CONTROL while interpreting CC_STATUS Greg Kroah-Hartman
@ 2021-05-12 14:43 ` Greg Kroah-Hartman
  2021-05-12 14:43 ` [PATCH 5.12 175/677] usb: typec: stusb160x: fix return value check in stusb160x_probe() Greg Kroah-Hartman
                   ` (510 subsequent siblings)
  684 siblings, 0 replies; 702+ messages in thread
From: Greg Kroah-Hartman @ 2021-05-12 14:43 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Hulk Robot, Heikki Krogerus,
	Wei Yongjun, Sasha Levin

From: Wei Yongjun <weiyongjun1@huawei.com>

[ Upstream commit 604c75893a01c8a3b5bd6dac55535963cd44c3f5 ]

In case of error, the function device_get_named_child_node() returns
NULL pointer not ERR_PTR(). The IS_ERR() test in the return value check
should be replaced with NULL test.

Fixes: 18a6c866bb19 ("usb: typec: tps6598x: Add USB role switching logic")
Reported-by: Hulk Robot <hulkci@huawei.com>
Reviewed-by: Heikki Krogerus <heikki.krogerus@linux.intel.com>
Signed-off-by: Wei Yongjun <weiyongjun1@huawei.com>
Link: https://lore.kernel.org/r/20210308094841.3587751-1-weiyongjun1@huawei.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/usb/typec/tps6598x.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/drivers/usb/typec/tps6598x.c b/drivers/usb/typec/tps6598x.c
index 29bd1c5a283c..4038104568f5 100644
--- a/drivers/usb/typec/tps6598x.c
+++ b/drivers/usb/typec/tps6598x.c
@@ -614,8 +614,8 @@ static int tps6598x_probe(struct i2c_client *client)
 		return ret;
 
 	fwnode = device_get_named_child_node(&client->dev, "connector");
-	if (IS_ERR(fwnode))
-		return PTR_ERR(fwnode);
+	if (!fwnode)
+		return -ENODEV;
 
 	tps->role_sw = fwnode_usb_role_switch_get(fwnode);
 	if (IS_ERR(tps->role_sw)) {
-- 
2.30.2




^ permalink raw reply related	[flat|nested] 702+ messages in thread

* [PATCH 5.12 175/677] usb: typec: stusb160x: fix return value check in stusb160x_probe()
  2021-05-12 14:40 [PATCH 5.12 000/677] 5.12.4-rc1 review Greg Kroah-Hartman
                   ` (173 preceding siblings ...)
  2021-05-12 14:43 ` [PATCH 5.12 174/677] usb: typec: tps6598x: Fix return value check in tps6598x_probe() Greg Kroah-Hartman
@ 2021-05-12 14:43 ` Greg Kroah-Hartman
  2021-05-12 14:43 ` [PATCH 5.12 176/677] mfd: intel_pmt: Fix nuisance messages and handling of disabled capabilities Greg Kroah-Hartman
                   ` (509 subsequent siblings)
  684 siblings, 0 replies; 702+ messages in thread
From: Greg Kroah-Hartman @ 2021-05-12 14:43 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Hulk Robot, Heikki Krogerus,
	Amelie Delaunay, Wei Yongjun, Sasha Levin

From: Wei Yongjun <weiyongjun1@huawei.com>

[ Upstream commit f2d90e07b5df2c7745ae66d2d48cc350d3f1c7d2 ]

In case of error, the function device_get_named_child_node() returns
NULL pointer not ERR_PTR(). The IS_ERR() test in the return value check
should be replaced with NULL test.

Fixes: da0cb6310094 ("usb: typec: add support for STUSB160x Type-C controller family")
Reported-by: Hulk Robot <hulkci@huawei.com>
Reviewed-by: Heikki Krogerus <heikki.krogerus@linux.intel.com>
Reviewed-by: Amelie Delaunay <amelie.delaunay@foss.st.com>
Signed-off-by: Wei Yongjun <weiyongjun1@huawei.com>
Link: https://lore.kernel.org/r/20210308094839.3586773-1-weiyongjun1@huawei.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/usb/typec/stusb160x.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/drivers/usb/typec/stusb160x.c b/drivers/usb/typec/stusb160x.c
index d21750bbbb44..6eaeba9b096e 100644
--- a/drivers/usb/typec/stusb160x.c
+++ b/drivers/usb/typec/stusb160x.c
@@ -682,8 +682,8 @@ static int stusb160x_probe(struct i2c_client *client)
 	}
 
 	fwnode = device_get_named_child_node(chip->dev, "connector");
-	if (IS_ERR(fwnode))
-		return PTR_ERR(fwnode);
+	if (!fwnode)
+		return -ENODEV;
 
 	/*
 	 * When both VDD and VSYS power supplies are present, the low power
-- 
2.30.2




^ permalink raw reply related	[flat|nested] 702+ messages in thread

* [PATCH 5.12 176/677] mfd: intel_pmt: Fix nuisance messages and handling of disabled capabilities
  2021-05-12 14:40 [PATCH 5.12 000/677] 5.12.4-rc1 review Greg Kroah-Hartman
                   ` (174 preceding siblings ...)
  2021-05-12 14:43 ` [PATCH 5.12 175/677] usb: typec: stusb160x: fix return value check in stusb160x_probe() Greg Kroah-Hartman
@ 2021-05-12 14:43 ` Greg Kroah-Hartman
  2021-05-12 14:43 ` [PATCH 5.12 177/677] regmap: set debugfs_name to NULL after it is freed Greg Kroah-Hartman
                   ` (508 subsequent siblings)
  684 siblings, 0 replies; 702+ messages in thread
From: Greg Kroah-Hartman @ 2021-05-12 14:43 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, David E. Box, Hans de Goede,
	Lee Jones, Sasha Levin

From: David E. Box <david.e.box@linux.intel.com>

[ Upstream commit a1a5c1c3df282dc122508a17500317266ef19e46 ]

Some products will be available that have PMT capabilities that are not
supported. Remove the warnings in this instance to avoid nuisance messages
and confusion.

Also return an error code for capabilities that are disabled by quirk to
prevent them from keeping the driver loaded if only disabled capabilities
are found.

Fixes: 4f8217d5b0ca ("mfd: Intel Platform Monitoring Technology support")
Signed-off-by: David E. Box <david.e.box@linux.intel.com>
Reviewed-by: Hans de Goede <hdegoede@redhat.com>
Signed-off-by: Lee Jones <lee.jones@linaro.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/mfd/intel_pmt.c | 11 +++--------
 1 file changed, 3 insertions(+), 8 deletions(-)

diff --git a/drivers/mfd/intel_pmt.c b/drivers/mfd/intel_pmt.c
index 744b230cdcca..65da2b17a204 100644
--- a/drivers/mfd/intel_pmt.c
+++ b/drivers/mfd/intel_pmt.c
@@ -79,19 +79,18 @@ static int pmt_add_dev(struct pci_dev *pdev, struct intel_dvsec_header *header,
 	case DVSEC_INTEL_ID_WATCHER:
 		if (quirks & PMT_QUIRK_NO_WATCHER) {
 			dev_info(dev, "Watcher not supported\n");
-			return 0;
+			return -EINVAL;
 		}
 		name = "pmt_watcher";
 		break;
 	case DVSEC_INTEL_ID_CRASHLOG:
 		if (quirks & PMT_QUIRK_NO_CRASHLOG) {
 			dev_info(dev, "Crashlog not supported\n");
-			return 0;
+			return -EINVAL;
 		}
 		name = "pmt_crashlog";
 		break;
 	default:
-		dev_err(dev, "Unrecognized PMT capability: %d\n", id);
 		return -EINVAL;
 	}
 
@@ -174,12 +173,8 @@ static int pmt_pci_probe(struct pci_dev *pdev, const struct pci_device_id *id)
 		header.offset = INTEL_DVSEC_TABLE_OFFSET(table);
 
 		ret = pmt_add_dev(pdev, &header, quirks);
-		if (ret) {
-			dev_warn(&pdev->dev,
-				 "Failed to add device for DVSEC id %d\n",
-				 header.id);
+		if (ret)
 			continue;
-		}
 
 		found_devices = true;
 	} while (true);
-- 
2.30.2




^ permalink raw reply related	[flat|nested] 702+ messages in thread

* [PATCH 5.12 177/677] regmap: set debugfs_name to NULL after it is freed
  2021-05-12 14:40 [PATCH 5.12 000/677] 5.12.4-rc1 review Greg Kroah-Hartman
                   ` (175 preceding siblings ...)
  2021-05-12 14:43 ` [PATCH 5.12 176/677] mfd: intel_pmt: Fix nuisance messages and handling of disabled capabilities Greg Kroah-Hartman
@ 2021-05-12 14:43 ` Greg Kroah-Hartman
  2021-05-12 14:43 ` [PATCH 5.12 178/677] spi: rockchip: avoid objtool warning Greg Kroah-Hartman
                   ` (507 subsequent siblings)
  684 siblings, 0 replies; 702+ messages in thread
From: Greg Kroah-Hartman @ 2021-05-12 14:43 UTC (permalink / raw)
  To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Meng Li, Mark Brown, Sasha Levin

From: Meng Li <Meng.Li@windriver.com>

[ Upstream commit e41a962f82e7afb5b1ee644f48ad0b3aee656268 ]

There is a upstream commit cffa4b2122f5("regmap:debugfs:
Fix a memory leak when calling regmap_attach_dev") that
adds a if condition when create name for debugfs_name.
With below function invoking logical, debugfs_name is
freed in regmap_debugfs_exit(), but it is not created again
because of the if condition introduced by above commit.
regmap_reinit_cache()
	regmap_debugfs_exit()
	...
	regmap_debugfs_init()
So, set debugfs_name to NULL after it is freed.

Fixes: cffa4b2122f5 ("regmap: debugfs: Fix a memory leak when calling regmap_attach_dev")
Signed-off-by: Meng Li <Meng.Li@windriver.com>
Link: https://lore.kernel.org/r/20210226021737.7690-1-Meng.Li@windriver.com
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/base/regmap/regmap-debugfs.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/base/regmap/regmap-debugfs.c b/drivers/base/regmap/regmap-debugfs.c
index ff2ee87987c7..211a335a608d 100644
--- a/drivers/base/regmap/regmap-debugfs.c
+++ b/drivers/base/regmap/regmap-debugfs.c
@@ -660,6 +660,7 @@ void regmap_debugfs_exit(struct regmap *map)
 		regmap_debugfs_free_dump_cache(map);
 		mutex_unlock(&map->cache_lock);
 		kfree(map->debugfs_name);
+		map->debugfs_name = NULL;
 	} else {
 		struct regmap_debugfs_node *node, *tmp;
 
-- 
2.30.2




^ permalink raw reply related	[flat|nested] 702+ messages in thread

* [PATCH 5.12 178/677] spi: rockchip: avoid objtool warning
  2021-05-12 14:40 [PATCH 5.12 000/677] 5.12.4-rc1 review Greg Kroah-Hartman
                   ` (176 preceding siblings ...)
  2021-05-12 14:43 ` [PATCH 5.12 177/677] regmap: set debugfs_name to NULL after it is freed Greg Kroah-Hartman
@ 2021-05-12 14:43 ` Greg Kroah-Hartman
  2021-05-12 14:43 ` [PATCH 5.12 179/677] arm64: dts: broadcom: bcm4908: fix switch parent node name Greg Kroah-Hartman
                   ` (506 subsequent siblings)
  684 siblings, 0 replies; 702+ messages in thread
From: Greg Kroah-Hartman @ 2021-05-12 14:43 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Arnd Bergmann, Pratyush Yadav,
	Mark Brown, Sasha Levin

From: Arnd Bergmann <arnd@arndb.de>

[ Upstream commit e50989527faeafb79f45a0f7529ba8e01dff1fff ]

Building this file with clang leads to a an unreachable code path
causing a warning from objtool:

drivers/spi/spi-rockchip.o: warning: objtool: rockchip_spi_transfer_one()+0x2e0: sibling call from callable instruction with modified stack frame

Change the unreachable() into an error return that can be
handled if it ever happens, rather than silently crashing
the kernel.

Fixes: 65498c6ae241 ("spi: rockchip: support 4bit words")
Signed-off-by: Arnd Bergmann <arnd@arndb.de>
Acked-by: Pratyush Yadav <p.yadav@ti.com>
Link: https://lore.kernel.org/r/20210226140109.3477093-1-arnd@kernel.org
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/spi/spi-rockchip.c | 13 ++++++++++---
 1 file changed, 10 insertions(+), 3 deletions(-)

diff --git a/drivers/spi/spi-rockchip.c b/drivers/spi/spi-rockchip.c
index 936ef54e0903..0d75080da648 100644
--- a/drivers/spi/spi-rockchip.c
+++ b/drivers/spi/spi-rockchip.c
@@ -476,7 +476,7 @@ static int rockchip_spi_prepare_dma(struct rockchip_spi *rs,
 	return 1;
 }
 
-static void rockchip_spi_config(struct rockchip_spi *rs,
+static int rockchip_spi_config(struct rockchip_spi *rs,
 		struct spi_device *spi, struct spi_transfer *xfer,
 		bool use_dma, bool slave_mode)
 {
@@ -521,7 +521,9 @@ static void rockchip_spi_config(struct rockchip_spi *rs,
 		 * ctlr->bits_per_word_mask, so this shouldn't
 		 * happen
 		 */
-		unreachable();
+		dev_err(rs->dev, "unknown bits per word: %d\n",
+			xfer->bits_per_word);
+		return -EINVAL;
 	}
 
 	if (use_dma) {
@@ -554,6 +556,8 @@ static void rockchip_spi_config(struct rockchip_spi *rs,
 	 */
 	writel_relaxed(2 * DIV_ROUND_UP(rs->freq, 2 * xfer->speed_hz),
 			rs->regs + ROCKCHIP_SPI_BAUDR);
+
+	return 0;
 }
 
 static size_t rockchip_spi_max_transfer_size(struct spi_device *spi)
@@ -577,6 +581,7 @@ static int rockchip_spi_transfer_one(
 		struct spi_transfer *xfer)
 {
 	struct rockchip_spi *rs = spi_controller_get_devdata(ctlr);
+	int ret;
 	bool use_dma;
 
 	WARN_ON(readl_relaxed(rs->regs + ROCKCHIP_SPI_SSIENR) &&
@@ -596,7 +601,9 @@ static int rockchip_spi_transfer_one(
 
 	use_dma = ctlr->can_dma ? ctlr->can_dma(ctlr, spi, xfer) : false;
 
-	rockchip_spi_config(rs, spi, xfer, use_dma, ctlr->slave);
+	ret = rockchip_spi_config(rs, spi, xfer, use_dma, ctlr->slave);
+	if (ret)
+		return ret;
 
 	if (use_dma)
 		return rockchip_spi_prepare_dma(rs, ctlr, xfer);
-- 
2.30.2




^ permalink raw reply related	[flat|nested] 702+ messages in thread

* [PATCH 5.12 179/677] arm64: dts: broadcom: bcm4908: fix switch parent node name
  2021-05-12 14:40 [PATCH 5.12 000/677] 5.12.4-rc1 review Greg Kroah-Hartman
                   ` (177 preceding siblings ...)
  2021-05-12 14:43 ` [PATCH 5.12 178/677] spi: rockchip: avoid objtool warning Greg Kroah-Hartman
@ 2021-05-12 14:43 ` Greg Kroah-Hartman
  2021-05-12 14:43 ` [PATCH 5.12 180/677] mtd: rawnand: fsmc: Fix error code in fsmc_nand_probe() Greg Kroah-Hartman
                   ` (505 subsequent siblings)
  684 siblings, 0 replies; 702+ messages in thread
From: Greg Kroah-Hartman @ 2021-05-12 14:43 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Rafał Miłecki,
	Florian Fainelli, Sasha Levin

From: Rafał Miłecki <rafal@milecki.pl>

[ Upstream commit a348ff97ffb840b9d74b0e64b3e0e6002187d224 ]

Ethernet switch and MDIO are grouped using "simple-bus". It's not
allowed to use "ethernet-switch" node name as it isn't a switch. Replace
it with "bus".

Fixes: 527a3ac9bdf8 ("arm64: dts: broadcom: bcm4908: describe internal switch")
Signed-off-by: Rafał Miłecki <rafal@milecki.pl>
Signed-off-by: Florian Fainelli <f.fainelli@gmail.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/arm64/boot/dts/broadcom/bcm4908/bcm4908.dtsi | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/arch/arm64/boot/dts/broadcom/bcm4908/bcm4908.dtsi b/arch/arm64/boot/dts/broadcom/bcm4908/bcm4908.dtsi
index 9354077f74cd..9e799328c6db 100644
--- a/arch/arm64/boot/dts/broadcom/bcm4908/bcm4908.dtsi
+++ b/arch/arm64/boot/dts/broadcom/bcm4908/bcm4908.dtsi
@@ -131,7 +131,7 @@
 			status = "disabled";
 		};
 
-		ethernet-switch@80000 {
+		bus@80000 {
 			compatible = "simple-bus";
 			#size-cells = <1>;
 			#address-cells = <1>;
-- 
2.30.2




^ permalink raw reply related	[flat|nested] 702+ messages in thread

* [PATCH 5.12 180/677] mtd: rawnand: fsmc: Fix error code in fsmc_nand_probe()
  2021-05-12 14:40 [PATCH 5.12 000/677] 5.12.4-rc1 review Greg Kroah-Hartman
                   ` (178 preceding siblings ...)
  2021-05-12 14:43 ` [PATCH 5.12 179/677] arm64: dts: broadcom: bcm4908: fix switch parent node name Greg Kroah-Hartman
@ 2021-05-12 14:43 ` Greg Kroah-Hartman
  2021-05-12 14:43 ` [PATCH 5.12 181/677] mtd: rawnand: brcmnand: fix OOB R/W with Hamming ECC Greg Kroah-Hartman
                   ` (504 subsequent siblings)
  684 siblings, 0 replies; 702+ messages in thread
From: Greg Kroah-Hartman @ 2021-05-12 14:43 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Dan Carpenter, Miquel Raynal, Sasha Levin

From: Dan Carpenter <dan.carpenter@oracle.com>

[ Upstream commit e7a97528e3c787802d8c643d6ab2f428511bb047 ]

If dma_request_channel() fails then the probe fails and it should
return a negative error code, but currently it returns success.

fixes: 4774fb0a48aa ("mtd: nand/fsmc: Add DMA support")
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com>
Link: https://lore.kernel.org/linux-mtd/YCqaOZ83OvPOzLwh@mwanda
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/mtd/nand/raw/fsmc_nand.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/drivers/mtd/nand/raw/fsmc_nand.c b/drivers/mtd/nand/raw/fsmc_nand.c
index 0101c0fab50a..a24e2f57fa68 100644
--- a/drivers/mtd/nand/raw/fsmc_nand.c
+++ b/drivers/mtd/nand/raw/fsmc_nand.c
@@ -1077,11 +1077,13 @@ static int __init fsmc_nand_probe(struct platform_device *pdev)
 		host->read_dma_chan = dma_request_channel(mask, filter, NULL);
 		if (!host->read_dma_chan) {
 			dev_err(&pdev->dev, "Unable to get read dma channel\n");
+			ret = -ENODEV;
 			goto disable_clk;
 		}
 		host->write_dma_chan = dma_request_channel(mask, filter, NULL);
 		if (!host->write_dma_chan) {
 			dev_err(&pdev->dev, "Unable to get write dma channel\n");
+			ret = -ENODEV;
 			goto release_dma_read_chan;
 		}
 	}
-- 
2.30.2




^ permalink raw reply related	[flat|nested] 702+ messages in thread

* [PATCH 5.12 181/677] mtd: rawnand: brcmnand: fix OOB R/W with Hamming ECC
  2021-05-12 14:40 [PATCH 5.12 000/677] 5.12.4-rc1 review Greg Kroah-Hartman
                   ` (179 preceding siblings ...)
  2021-05-12 14:43 ` [PATCH 5.12 180/677] mtd: rawnand: fsmc: Fix error code in fsmc_nand_probe() Greg Kroah-Hartman
@ 2021-05-12 14:43 ` Greg Kroah-Hartman
  2021-05-12 14:43 ` [PATCH 5.12 182/677] mtd: Handle possible -EPROBE_DEFER from parse_mtd_partitions() Greg Kroah-Hartman
                   ` (503 subsequent siblings)
  684 siblings, 0 replies; 702+ messages in thread
From: Greg Kroah-Hartman @ 2021-05-12 14:43 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Álvaro Fernández Rojas,
	Brian Norris, Miquel Raynal, Sasha Levin

From: Álvaro Fernández Rojas <noltari@gmail.com>

[ Upstream commit f5200c14242fb8fa4a9b93f7fd4064d237e58785 ]

Hamming ECC doesn't cover the OOB data, so reading or writing OOB shall
always be done without ECC enabled.
This is a problem when adding JFFS2 cleanmarkers to erased blocks. If JFFS2
clenmarkers are added to the OOB with ECC enabled, OOB bytes will be changed
from ff ff ff to 00 00 00, reporting incorrect ECC errors.

Fixes: 27c5b17cd1b1 ("mtd: nand: add NAND driver "library" for Broadcom STB NAND controller")
Signed-off-by: Álvaro Fernández Rojas <noltari@gmail.com>
Acked-by: Brian Norris <computersforpeace@gmail.com>
Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com>
Link: https://lore.kernel.org/linux-mtd/20210224080210.23686-1-noltari@gmail.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/mtd/nand/raw/brcmnand/brcmnand.c | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/drivers/mtd/nand/raw/brcmnand/brcmnand.c b/drivers/mtd/nand/raw/brcmnand/brcmnand.c
index 659eaa6f0980..5ff4291380c5 100644
--- a/drivers/mtd/nand/raw/brcmnand/brcmnand.c
+++ b/drivers/mtd/nand/raw/brcmnand/brcmnand.c
@@ -2688,6 +2688,12 @@ static int brcmnand_attach_chip(struct nand_chip *chip)
 
 	ret = brcmstb_choose_ecc_layout(host);
 
+	/* If OOB is written with ECC enabled it will cause ECC errors */
+	if (is_hamming_ecc(host->ctrl, &host->hwcfg)) {
+		chip->ecc.write_oob = brcmnand_write_oob_raw;
+		chip->ecc.read_oob = brcmnand_read_oob_raw;
+	}
+
 	return ret;
 }
 
-- 
2.30.2




^ permalink raw reply related	[flat|nested] 702+ messages in thread

* [PATCH 5.12 182/677] mtd: Handle possible -EPROBE_DEFER from parse_mtd_partitions()
  2021-05-12 14:40 [PATCH 5.12 000/677] 5.12.4-rc1 review Greg Kroah-Hartman
                   ` (180 preceding siblings ...)
  2021-05-12 14:43 ` [PATCH 5.12 181/677] mtd: rawnand: brcmnand: fix OOB R/W with Hamming ECC Greg Kroah-Hartman
@ 2021-05-12 14:43 ` Greg Kroah-Hartman
  2021-05-12 14:43 ` [PATCH 5.12 183/677] mtd: rawnand: qcom: Return actual error code instead of -ENODEV Greg Kroah-Hartman
                   ` (502 subsequent siblings)
  684 siblings, 0 replies; 702+ messages in thread
From: Greg Kroah-Hartman @ 2021-05-12 14:43 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Manivannan Sadhasivam, Miquel Raynal,
	Sasha Levin

From: Manivannan Sadhasivam <manivannan.sadhasivam@linaro.org>

[ Upstream commit 08608adb520e51403be7592c2214846fa440a23a ]

There are chances that the parse_mtd_partitions() function will return
-EPROBE_DEFER in mtd_device_parse_register(). This might happen when
the dependency is not available for the parser. For instance, on SDX55
the MTD_QCOMSMEM_PARTS parser depends on the QCOM_SMEM driver to parse
the partitions defined in the shared memory region. With the current
flow, the error returned from parse_mtd_partitions() will be discarded
in favor of trying to add the fallback partition.

This will prevent the driver to end up in probe deferred pool and the
partitions won't be parsed even after the QCOM_SMEM driver is available.

Fix this issue by bailing out of mtd_device_parse_register() when
-EPROBE_DEFER error is returned from parse_mtd_partitions() function and
propagate the error code to the driver core for probing later.

Fixes: 5ac67ce36cfe ("mtd: move code adding (registering) partitions to the parse_mtd_partitions()")
Signed-off-by: Manivannan Sadhasivam <manivannan.sadhasivam@linaro.org>
Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/mtd/mtdcore.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/drivers/mtd/mtdcore.c b/drivers/mtd/mtdcore.c
index 2d6423d89a17..d97ddc65b5d4 100644
--- a/drivers/mtd/mtdcore.c
+++ b/drivers/mtd/mtdcore.c
@@ -820,6 +820,9 @@ int mtd_device_parse_register(struct mtd_info *mtd, const char * const *types,
 
 	/* Prefer parsed partitions over driver-provided fallback */
 	ret = parse_mtd_partitions(mtd, types, parser_data);
+	if (ret == -EPROBE_DEFER)
+		goto out;
+
 	if (ret > 0)
 		ret = 0;
 	else if (nr_parts)
-- 
2.30.2




^ permalink raw reply related	[flat|nested] 702+ messages in thread

* [PATCH 5.12 183/677] mtd: rawnand: qcom: Return actual error code instead of -ENODEV
  2021-05-12 14:40 [PATCH 5.12 000/677] 5.12.4-rc1 review Greg Kroah-Hartman
                   ` (181 preceding siblings ...)
  2021-05-12 14:43 ` [PATCH 5.12 182/677] mtd: Handle possible -EPROBE_DEFER from parse_mtd_partitions() Greg Kroah-Hartman
@ 2021-05-12 14:43 ` Greg Kroah-Hartman
  2021-05-12 14:43 ` [PATCH 5.12 184/677] mtd: dont lock when recursively deleting partitions Greg Kroah-Hartman
                   ` (501 subsequent siblings)
  684 siblings, 0 replies; 702+ messages in thread
From: Greg Kroah-Hartman @ 2021-05-12 14:43 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Manivannan Sadhasivam, Miquel Raynal,
	Sasha Levin

From: Manivannan Sadhasivam <manivannan.sadhasivam@linaro.org>

[ Upstream commit 55fbb9ba4f06cb6aff32daca1e1910173c13ec51 ]

In qcom_probe_nand_devices() function, the error code returned by
qcom_nand_host_init_and_register() is converted to -ENODEV in the case
of failure. This poses issue if -EPROBE_DEFER is returned when the
dependency is not available for a component like parser.

So let's restructure the error handling logic a bit and return the
actual error code in case of qcom_nand_host_init_and_register() failure.

Fixes: c76b78d8ec05 ("mtd: nand: Qualcomm NAND controller driver")
Signed-off-by: Manivannan Sadhasivam <manivannan.sadhasivam@linaro.org>
Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/mtd/nand/raw/qcom_nandc.c | 7 ++-----
 1 file changed, 2 insertions(+), 5 deletions(-)

diff --git a/drivers/mtd/nand/raw/qcom_nandc.c b/drivers/mtd/nand/raw/qcom_nandc.c
index fd4c318b520f..87c23bb320bf 100644
--- a/drivers/mtd/nand/raw/qcom_nandc.c
+++ b/drivers/mtd/nand/raw/qcom_nandc.c
@@ -2898,7 +2898,7 @@ static int qcom_probe_nand_devices(struct qcom_nand_controller *nandc)
 	struct device *dev = nandc->dev;
 	struct device_node *dn = dev->of_node, *child;
 	struct qcom_nand_host *host;
-	int ret;
+	int ret = -ENODEV;
 
 	for_each_available_child_of_node(dn, child) {
 		host = devm_kzalloc(dev, sizeof(*host), GFP_KERNEL);
@@ -2916,10 +2916,7 @@ static int qcom_probe_nand_devices(struct qcom_nand_controller *nandc)
 		list_add_tail(&host->node, &nandc->host_list);
 	}
 
-	if (list_empty(&nandc->host_list))
-		return -ENODEV;
-
-	return 0;
+	return ret;
 }
 
 /* parse custom DT properties here */
-- 
2.30.2




^ permalink raw reply related	[flat|nested] 702+ messages in thread

* [PATCH 5.12 184/677] mtd: dont lock when recursively deleting partitions
  2021-05-12 14:40 [PATCH 5.12 000/677] 5.12.4-rc1 review Greg Kroah-Hartman
                   ` (182 preceding siblings ...)
  2021-05-12 14:43 ` [PATCH 5.12 183/677] mtd: rawnand: qcom: Return actual error code instead of -ENODEV Greg Kroah-Hartman
@ 2021-05-12 14:43 ` Greg Kroah-Hartman
  2021-05-12 14:43 ` [PATCH 5.12 185/677] mtd: parsers: qcom: Fix error condition Greg Kroah-Hartman
                   ` (500 subsequent siblings)
  684 siblings, 0 replies; 702+ messages in thread
From: Greg Kroah-Hartman @ 2021-05-12 14:43 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, David Bauer, Miquel Raynal, Sasha Levin

From: David Bauer <mail@david-bauer.net>

[ Upstream commit cb4543054c5c4fd33df960b41d7b483ebca8e786 ]

When recursively deleting partitions, don't acquire the masters
partition lock twice. Otherwise the process ends up in a deadlocked
state.

Fixes: 46b5889cc2c5 ("mtd: implement proper partition handling")
Signed-off-by: David Bauer <mail@david-bauer.net>
Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com>
Link: https://lore.kernel.org/linux-mtd/20210217195320.893253-1-mail@david-bauer.net
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/mtd/mtdpart.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/mtd/mtdpart.c b/drivers/mtd/mtdpart.c
index 12ca4f19cb14..665fd9020b76 100644
--- a/drivers/mtd/mtdpart.c
+++ b/drivers/mtd/mtdpart.c
@@ -331,7 +331,7 @@ static int __del_mtd_partitions(struct mtd_info *mtd)
 
 	list_for_each_entry_safe(child, next, &mtd->partitions, part.node) {
 		if (mtd_has_partitions(child))
-			del_mtd_partitions(child);
+			__del_mtd_partitions(child);
 
 		pr_info("Deleting %s MTD partition\n", child->name);
 		ret = del_mtd_device(child);
-- 
2.30.2




^ permalink raw reply related	[flat|nested] 702+ messages in thread

* [PATCH 5.12 185/677] mtd: parsers: qcom: Fix error condition
  2021-05-12 14:40 [PATCH 5.12 000/677] 5.12.4-rc1 review Greg Kroah-Hartman
                   ` (183 preceding siblings ...)
  2021-05-12 14:43 ` [PATCH 5.12 184/677] mtd: dont lock when recursively deleting partitions Greg Kroah-Hartman
@ 2021-05-12 14:43 ` Greg Kroah-Hartman
  2021-05-12 14:43 ` [PATCH 5.12 186/677] mtd: parsers: qcom: incompatible with spi-nor 4k sectors Greg Kroah-Hartman
                   ` (499 subsequent siblings)
  684 siblings, 0 replies; 702+ messages in thread
From: Greg Kroah-Hartman @ 2021-05-12 14:43 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, kernel test robot, Dan Carpenter,
	Miquel Raynal, Sasha Levin

From: Miquel Raynal <miquel.raynal@bootlin.com>

[ Upstream commit c95310e1b33eae9767af9698aa976d5301f37203 ]

qcom_smem_get() does not return NULL, and even if it did, the NULL
condition is usually not an error but a success condition and should
not trigger an error trace.

Let's replace IS_ERR_OR_NULL() by IS_ERR().

This fixes the following smatch warning:
drivers/mtd/parsers/qcomsmempart.c:109 parse_qcomsmem_part() warn: passing zero to 'PTR_ERR'

Reported-by: kernel test robot <lkp@intel.com>
Reported-by: Dan Carpenter <dan.carpenter@oracle.com>
Fixes: 803eb124e1a6 ("mtd: parsers: Add Qcom SMEM parser")
Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com>
Link: https://lore.kernel.org/linux-mtd/20210303084634.12796-1-miquel.raynal@bootlin.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/mtd/parsers/qcomsmempart.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/mtd/parsers/qcomsmempart.c b/drivers/mtd/parsers/qcomsmempart.c
index 808cb33d71f8..1c8a44d0d6e4 100644
--- a/drivers/mtd/parsers/qcomsmempart.c
+++ b/drivers/mtd/parsers/qcomsmempart.c
@@ -104,7 +104,7 @@ static int parse_qcomsmem_part(struct mtd_info *mtd,
 	 * complete partition table
 	 */
 	ptable = qcom_smem_get(SMEM_APPS, SMEM_AARM_PARTITION_TABLE, &len);
-	if (IS_ERR_OR_NULL(ptable)) {
+	if (IS_ERR(ptable)) {
 		pr_err("Error reading partition table\n");
 		return PTR_ERR(ptable);
 	}
-- 
2.30.2




^ permalink raw reply related	[flat|nested] 702+ messages in thread

* [PATCH 5.12 186/677] mtd: parsers: qcom: incompatible with spi-nor 4k sectors
  2021-05-12 14:40 [PATCH 5.12 000/677] 5.12.4-rc1 review Greg Kroah-Hartman
                   ` (184 preceding siblings ...)
  2021-05-12 14:43 ` [PATCH 5.12 185/677] mtd: parsers: qcom: Fix error condition Greg Kroah-Hartman
@ 2021-05-12 14:43 ` Greg Kroah-Hartman
  2021-05-12 14:43 ` [PATCH 5.12 187/677] mtd: maps: fix error return code of physmap_flash_remove() Greg Kroah-Hartman
                   ` (498 subsequent siblings)
  684 siblings, 0 replies; 702+ messages in thread
From: Greg Kroah-Hartman @ 2021-05-12 14:43 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Manivannan Sadhasivam, Baruch Siach,
	Miquel Raynal, Sasha Levin

From: Baruch Siach <baruch@tkos.co.il>

[ Upstream commit 8f62f59f83c3bc902af91c80732cfcd17e0d7069 ]

Partition size and offset value are in block size units, which is the
same as 'erasesize'. But when 4K sectors are enabled erasesize is set to
4K. Bail out in that case.

Fixes: 803eb124e1a64 ("mtd: parsers: Add Qcom SMEM parser")
Reviewed-by: Manivannan Sadhasivam <manivannan.sadhasivam@linaro.org>
Signed-off-by: Baruch Siach <baruch@tkos.co.il>
Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com>
Link: https://lore.kernel.org/linux-mtd/0a2611f885b894274436ded3ca78bc0440fca74a.1614790096.git.baruch@tkos.co.il
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/mtd/parsers/qcomsmempart.c | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/drivers/mtd/parsers/qcomsmempart.c b/drivers/mtd/parsers/qcomsmempart.c
index 1c8a44d0d6e4..d9083308f6ba 100644
--- a/drivers/mtd/parsers/qcomsmempart.c
+++ b/drivers/mtd/parsers/qcomsmempart.c
@@ -65,6 +65,13 @@ static int parse_qcomsmem_part(struct mtd_info *mtd,
 	int ret, i, numparts;
 	char *name, *c;
 
+	if (IS_ENABLED(CONFIG_MTD_SPI_NOR_USE_4K_SECTORS)
+			&& mtd->type == MTD_NORFLASH) {
+		pr_err("%s: SMEM partition parser is incompatible with 4K sectors\n",
+				mtd->name);
+		return -EINVAL;
+	}
+
 	pr_debug("Parsing partition table info from SMEM\n");
 	ptable = qcom_smem_get(SMEM_APPS, SMEM_AARM_PARTITION_TABLE, &len);
 	if (IS_ERR(ptable)) {
-- 
2.30.2




^ permalink raw reply related	[flat|nested] 702+ messages in thread

* [PATCH 5.12 187/677] mtd: maps: fix error return code of physmap_flash_remove()
  2021-05-12 14:40 [PATCH 5.12 000/677] 5.12.4-rc1 review Greg Kroah-Hartman
                   ` (185 preceding siblings ...)
  2021-05-12 14:43 ` [PATCH 5.12 186/677] mtd: parsers: qcom: incompatible with spi-nor 4k sectors Greg Kroah-Hartman
@ 2021-05-12 14:43 ` Greg Kroah-Hartman
  2021-05-12 14:43 ` [PATCH 5.12 188/677] ARM: dts: stm32: fix usart 2 & 3 pinconf to wake up with flow control Greg Kroah-Hartman
                   ` (497 subsequent siblings)
  684 siblings, 0 replies; 702+ messages in thread
From: Greg Kroah-Hartman @ 2021-05-12 14:43 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, TOTE Robot, Jia-Ju Bai,
	Miquel Raynal, Sasha Levin

From: Jia-Ju Bai <baijiaju1990@gmail.com>

[ Upstream commit 620b90d30c08684dc6ebee07c72755d997f9d1f6 ]

When platform_get_drvdata() returns NULL to info, no error return code
of physmap_flash_remove() is assigned.
To fix this bug, err is assigned with -EINVAL in this case

Fixes: 73566edf9b91 ("[MTD] Convert physmap to platform driver")
Reported-by: TOTE Robot <oslab@tsinghua.edu.cn>
Signed-off-by: Jia-Ju Bai <baijiaju1990@gmail.com>
Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com>
Link: https://lore.kernel.org/linux-mtd/20210308034446.3052-1-baijiaju1990@gmail.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/mtd/maps/physmap-core.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/drivers/mtd/maps/physmap-core.c b/drivers/mtd/maps/physmap-core.c
index 001ed5deb622..4f63b8430c71 100644
--- a/drivers/mtd/maps/physmap-core.c
+++ b/drivers/mtd/maps/physmap-core.c
@@ -69,8 +69,10 @@ static int physmap_flash_remove(struct platform_device *dev)
 	int i, err = 0;
 
 	info = platform_get_drvdata(dev);
-	if (!info)
+	if (!info) {
+		err = -EINVAL;
 		goto out;
+	}
 
 	if (info->cmtd) {
 		err = mtd_device_unregister(info->cmtd);
-- 
2.30.2




^ permalink raw reply related	[flat|nested] 702+ messages in thread

* [PATCH 5.12 188/677] ARM: dts: stm32: fix usart 2 & 3 pinconf to wake up with flow control
  2021-05-12 14:40 [PATCH 5.12 000/677] 5.12.4-rc1 review Greg Kroah-Hartman
                   ` (186 preceding siblings ...)
  2021-05-12 14:43 ` [PATCH 5.12 187/677] mtd: maps: fix error return code of physmap_flash_remove() Greg Kroah-Hartman
@ 2021-05-12 14:43 ` Greg Kroah-Hartman
  2021-05-12 14:43 ` [PATCH 5.12 189/677] arm64: dts: ti: k3-j721e-main: Update the speed modes supported and their itap delay values for MMCSD subsystems Greg Kroah-Hartman
                   ` (496 subsequent siblings)
  684 siblings, 0 replies; 702+ messages in thread
From: Greg Kroah-Hartman @ 2021-05-12 14:43 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Valentin Caron, Alexandre Torgue,
	Sasha Levin

From: Valentin CARON - foss <valentin.caron@foss.st.com>

[ Upstream commit a1429f3d3029b65cd4032f6218d5290911377ce4 ]

Modify usart 2 & 3 pins to allow wake up from low power mode while the
hardware flow control is activated. UART RTS pin need to stay configure
in idle mode to receive characters in order to wake up.

Fixes: 842ed898a757 ("ARM: dts: stm32: add usart2, usart3 and uart7 pins in stm32mp15-pinctrl")

Signed-off-by: Valentin Caron <valentin.caron@foss.st.com>
Signed-off-by: Alexandre Torgue <alexandre.torgue@foss.st.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/arm/boot/dts/stm32mp15-pinctrl.dtsi | 21 ++++++++++++++++++---
 1 file changed, 18 insertions(+), 3 deletions(-)

diff --git a/arch/arm/boot/dts/stm32mp15-pinctrl.dtsi b/arch/arm/boot/dts/stm32mp15-pinctrl.dtsi
index 7b4249ed1983..060baa8b7e9d 100644
--- a/arch/arm/boot/dts/stm32mp15-pinctrl.dtsi
+++ b/arch/arm/boot/dts/stm32mp15-pinctrl.dtsi
@@ -1891,10 +1891,15 @@
 	usart2_idle_pins_c: usart2-idle-2 {
 		pins1 {
 			pinmux = <STM32_PINMUX('D', 5, ANALOG)>, /* USART2_TX */
-				 <STM32_PINMUX('D', 4, ANALOG)>, /* USART2_RTS */
 				 <STM32_PINMUX('D', 3, ANALOG)>; /* USART2_CTS_NSS */
 		};
 		pins2 {
+			pinmux = <STM32_PINMUX('D', 4, AF7)>; /* USART2_RTS */
+			bias-disable;
+			drive-push-pull;
+			slew-rate = <3>;
+		};
+		pins3 {
 			pinmux = <STM32_PINMUX('D', 6, AF7)>; /* USART2_RX */
 			bias-disable;
 		};
@@ -1940,10 +1945,15 @@
 	usart3_idle_pins_b: usart3-idle-1 {
 		pins1 {
 			pinmux = <STM32_PINMUX('B', 10, ANALOG)>, /* USART3_TX */
-				 <STM32_PINMUX('G', 8, ANALOG)>, /* USART3_RTS */
 				 <STM32_PINMUX('I', 10, ANALOG)>; /* USART3_CTS_NSS */
 		};
 		pins2 {
+			pinmux = <STM32_PINMUX('G', 8, AF8)>; /* USART3_RTS */
+			bias-disable;
+			drive-push-pull;
+			slew-rate = <0>;
+		};
+		pins3 {
 			pinmux = <STM32_PINMUX('B', 12, AF8)>; /* USART3_RX */
 			bias-disable;
 		};
@@ -1976,10 +1986,15 @@
 	usart3_idle_pins_c: usart3-idle-2 {
 		pins1 {
 			pinmux = <STM32_PINMUX('B', 10, ANALOG)>, /* USART3_TX */
-				 <STM32_PINMUX('G', 8, ANALOG)>, /* USART3_RTS */
 				 <STM32_PINMUX('B', 13, ANALOG)>; /* USART3_CTS_NSS */
 		};
 		pins2 {
+			pinmux = <STM32_PINMUX('G', 8, AF8)>; /* USART3_RTS */
+			bias-disable;
+			drive-push-pull;
+			slew-rate = <0>;
+		};
+		pins3 {
 			pinmux = <STM32_PINMUX('B', 12, AF8)>; /* USART3_RX */
 			bias-disable;
 		};
-- 
2.30.2




^ permalink raw reply related	[flat|nested] 702+ messages in thread

* [PATCH 5.12 189/677] arm64: dts: ti: k3-j721e-main: Update the speed modes supported and their itap delay values for MMCSD subsystems
  2021-05-12 14:40 [PATCH 5.12 000/677] 5.12.4-rc1 review Greg Kroah-Hartman
                   ` (187 preceding siblings ...)
  2021-05-12 14:43 ` [PATCH 5.12 188/677] ARM: dts: stm32: fix usart 2 & 3 pinconf to wake up with flow control Greg Kroah-Hartman
@ 2021-05-12 14:43 ` Greg Kroah-Hartman
  2021-05-12 14:43 ` [PATCH 5.12 190/677] iio: adis16480: fix pps mode sampling frequency math Greg Kroah-Hartman
                   ` (495 subsequent siblings)
  684 siblings, 0 replies; 702+ messages in thread
From: Greg Kroah-Hartman @ 2021-05-12 14:43 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Aswath Govindraju, Nishanth Menon,
	Kishon Vijay Abraham I, Sasha Levin

From: Aswath Govindraju <a-govindraju@ti.com>

[ Upstream commit eb8f6194e8074d7b00642dd75cf04d13e1b218e4 ]

According to latest errata of J721e [1], HS400 mode is not supported
in MMCSD0 subsystem (i2024) and SDR104 mode is not supported in MMCSD1/2
subsystems (i2090). Therefore, replace mmc-hs400-1_8v with mmc-hs200-1_8v
in MMCSD0 subsystem and add a sdhci mask to disable SDR104 speed mode.

Also, update the itap delay values for all the MMCSD subsystems according
the latest J721e data sheet[2]

[1] - https://www.ti.com/lit/er/sprz455/sprz455.pdf
[2] - https://www.ti.com/lit/ds/symlink/tda4vm.pdf

Fixes: cd48ce86a4d0 ("arm64: dts: ti: k3-j721e-common-proc-board: Add support for SD card UHS modes")
Signed-off-by: Aswath Govindraju <a-govindraju@ti.com>
Signed-off-by: Nishanth Menon <nm@ti.com>
Reviewed-by: Kishon Vijay Abraham I <kishon@ti.com>
Link: https://lore.kernel.org/r/20210305054104.10153-1-a-govindraju@ti.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/arm64/boot/dts/ti/k3-j721e-main.dtsi | 17 ++++++++++++++++-
 1 file changed, 16 insertions(+), 1 deletion(-)

diff --git a/arch/arm64/boot/dts/ti/k3-j721e-main.dtsi b/arch/arm64/boot/dts/ti/k3-j721e-main.dtsi
index 8c84dafb7125..f1e7da3dfa27 100644
--- a/arch/arm64/boot/dts/ti/k3-j721e-main.dtsi
+++ b/arch/arm64/boot/dts/ti/k3-j721e-main.dtsi
@@ -1042,13 +1042,16 @@
 		assigned-clocks = <&k3_clks 91 1>;
 		assigned-clock-parents = <&k3_clks 91 2>;
 		bus-width = <8>;
-		mmc-hs400-1_8v;
+		mmc-hs200-1_8v;
 		mmc-ddr-1_8v;
 		ti,otap-del-sel-legacy = <0xf>;
 		ti,otap-del-sel-mmc-hs = <0xf>;
 		ti,otap-del-sel-ddr52 = <0x5>;
 		ti,otap-del-sel-hs200 = <0x6>;
 		ti,otap-del-sel-hs400 = <0x0>;
+		ti,itap-del-sel-legacy = <0x10>;
+		ti,itap-del-sel-mmc-hs = <0xa>;
+		ti,itap-del-sel-ddr52 = <0x3>;
 		ti,trm-icp = <0x8>;
 		ti,strobe-sel = <0x77>;
 		dma-coherent;
@@ -1069,9 +1072,15 @@
 		ti,otap-del-sel-sdr25 = <0xf>;
 		ti,otap-del-sel-sdr50 = <0xc>;
 		ti,otap-del-sel-ddr50 = <0xc>;
+		ti,itap-del-sel-legacy = <0x0>;
+		ti,itap-del-sel-sd-hs = <0x0>;
+		ti,itap-del-sel-sdr12 = <0x0>;
+		ti,itap-del-sel-sdr25 = <0x0>;
+		ti,itap-del-sel-ddr50 = <0x2>;
 		ti,trm-icp = <0x8>;
 		ti,clkbuf-sel = <0x7>;
 		dma-coherent;
+		sdhci-caps-mask = <0x2 0x0>;
 	};
 
 	main_sdhci2: mmc@4f98000 {
@@ -1089,9 +1098,15 @@
 		ti,otap-del-sel-sdr25 = <0xf>;
 		ti,otap-del-sel-sdr50 = <0xc>;
 		ti,otap-del-sel-ddr50 = <0xc>;
+		ti,itap-del-sel-legacy = <0x0>;
+		ti,itap-del-sel-sd-hs = <0x0>;
+		ti,itap-del-sel-sdr12 = <0x0>;
+		ti,itap-del-sel-sdr25 = <0x0>;
+		ti,itap-del-sel-ddr50 = <0x2>;
 		ti,trm-icp = <0x8>;
 		ti,clkbuf-sel = <0x7>;
 		dma-coherent;
+		sdhci-caps-mask = <0x2 0x0>;
 	};
 
 	usbss0: cdns-usb@4104000 {
-- 
2.30.2




^ permalink raw reply related	[flat|nested] 702+ messages in thread

* [PATCH 5.12 190/677] iio: adis16480: fix pps mode sampling frequency math
  2021-05-12 14:40 [PATCH 5.12 000/677] 5.12.4-rc1 review Greg Kroah-Hartman
                   ` (188 preceding siblings ...)
  2021-05-12 14:43 ` [PATCH 5.12 189/677] arm64: dts: ti: k3-j721e-main: Update the speed modes supported and their itap delay values for MMCSD subsystems Greg Kroah-Hartman
@ 2021-05-12 14:43 ` Greg Kroah-Hartman
  2021-05-12 14:43 ` [PATCH 5.12 191/677] arm64: dts: qcom: sc7180: trogdor: Fix trip point config of charger thermal zone Greg Kroah-Hartman
                   ` (494 subsequent siblings)
  684 siblings, 0 replies; 702+ messages in thread
From: Greg Kroah-Hartman @ 2021-05-12 14:43 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Nuno Sa, Jonathan Cameron, Sasha Levin

From: Nuno Sa <nuno.sa@analog.com>

[ Upstream commit 0463e60f087069adf25a815cd88753946aca2565 ]

When using PPS mode, the input clock needs to be scaled so that we have
an IMU sample rate between (optimally) 4000 and 4250. After this, we can
use the decimation filter to lower the sampling rate in order to get what
the user wants. Optimally, the user sample rate is a multiple of both the
IMU sample rate and the input clock. Hence, calculating the sync_scale
dynamically gives us better chances of achieving a perfect/integer value
for DEC_RATE. The math here is:
 1. lcm of the input clock and the desired output rate.
 2. get the highest multiple of the previous result lower than the adis
    max rate.
 3. The last result becomes the IMU sample rate. Use that to calculate
    SYNC_SCALE and DEC_RATE (to get the user output rate).

Fixes: 326e2357553d3 ("iio: imu: adis16480: Add support for external clock")

Signed-off-by: Nuno Sa <nuno.sa@analog.com>
Link: https://lore.kernel.org/r/20210218114039.216091-2-nuno.sa@analog.com
Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/iio/imu/adis16480.c | 128 ++++++++++++++++++++++++++----------
 1 file changed, 94 insertions(+), 34 deletions(-)

diff --git a/drivers/iio/imu/adis16480.c b/drivers/iio/imu/adis16480.c
index dfe86c589325..c41b8ef1e250 100644
--- a/drivers/iio/imu/adis16480.c
+++ b/drivers/iio/imu/adis16480.c
@@ -10,6 +10,7 @@
 #include <linux/of_irq.h>
 #include <linux/interrupt.h>
 #include <linux/delay.h>
+#include <linux/math.h>
 #include <linux/mutex.h>
 #include <linux/device.h>
 #include <linux/kernel.h>
@@ -17,6 +18,7 @@
 #include <linux/slab.h>
 #include <linux/sysfs.h>
 #include <linux/module.h>
+#include <linux/lcm.h>
 
 #include <linux/iio/iio.h>
 #include <linux/iio/sysfs.h>
@@ -170,6 +172,11 @@ static const char * const adis16480_int_pin_names[4] = {
 	[ADIS16480_PIN_DIO4] = "DIO4",
 };
 
+static bool low_rate_allow;
+module_param(low_rate_allow, bool, 0444);
+MODULE_PARM_DESC(low_rate_allow,
+		 "Allow IMU rates below the minimum advisable when external clk is used in PPS mode (default: N)");
+
 #ifdef CONFIG_DEBUG_FS
 
 static ssize_t adis16480_show_firmware_revision(struct file *file,
@@ -312,7 +319,8 @@ static int adis16480_debugfs_init(struct iio_dev *indio_dev)
 static int adis16480_set_freq(struct iio_dev *indio_dev, int val, int val2)
 {
 	struct adis16480 *st = iio_priv(indio_dev);
-	unsigned int t, reg;
+	unsigned int t, sample_rate = st->clk_freq;
+	int ret;
 
 	if (val < 0 || val2 < 0)
 		return -EINVAL;
@@ -321,28 +329,65 @@ static int adis16480_set_freq(struct iio_dev *indio_dev, int val, int val2)
 	if (t == 0)
 		return -EINVAL;
 
+	mutex_lock(&st->adis.state_lock);
 	/*
-	 * When using PPS mode, the rate of data collection is equal to the
-	 * product of the external clock frequency and the scale factor in the
-	 * SYNC_SCALE register.
-	 * When using sync mode, or internal clock, the output data rate is
-	 * equal with  the clock frequency divided by DEC_RATE + 1.
+	 * When using PPS mode, the input clock needs to be scaled so that we have an IMU
+	 * sample rate between (optimally) 4000 and 4250. After this, we can use the
+	 * decimation filter to lower the sampling rate in order to get what the user wants.
+	 * Optimally, the user sample rate is a multiple of both the IMU sample rate and
+	 * the input clock. Hence, calculating the sync_scale dynamically gives us better
+	 * chances of achieving a perfect/integer value for DEC_RATE. The math here is:
+	 *	1. lcm of the input clock and the desired output rate.
+	 *	2. get the highest multiple of the previous result lower than the adis max rate.
+	 *	3. The last result becomes the IMU sample rate. Use that to calculate SYNC_SCALE
+	 *	   and DEC_RATE (to get the user output rate)
 	 */
 	if (st->clk_mode == ADIS16480_CLK_PPS) {
-		t = t / st->clk_freq;
-		reg = ADIS16495_REG_SYNC_SCALE;
-	} else {
-		t = st->clk_freq / t;
-		reg = ADIS16480_REG_DEC_RATE;
+		unsigned long scaled_rate = lcm(st->clk_freq, t);
+		int sync_scale;
+
+		/*
+		 * If lcm is bigger than the IMU maximum sampling rate there's no perfect
+		 * solution. In this case, we get the highest multiple of the input clock
+		 * lower than the IMU max sample rate.
+		 */
+		if (scaled_rate > st->chip_info->int_clk)
+			scaled_rate = st->chip_info->int_clk / st->clk_freq * st->clk_freq;
+		else
+			scaled_rate = st->chip_info->int_clk / scaled_rate * scaled_rate;
+
+		/*
+		 * This is not an hard requirement but it's not advised to run the IMU
+		 * with a sample rate lower than 4000Hz due to possible undersampling
+		 * issues. However, there are users that might really want to take the risk.
+		 * Hence, we provide a module parameter for them. If set, we allow sample
+		 * rates lower than 4KHz. By default, we won't allow this and we just roundup
+		 * the rate to the next multiple of the input clock bigger than 4KHz. This
+		 * is done like this as in some cases (when DEC_RATE is 0) might give
+		 * us the closest value to the one desired by the user...
+		 */
+		if (scaled_rate < 4000000 && !low_rate_allow)
+			scaled_rate = roundup(4000000, st->clk_freq);
+
+		sync_scale = scaled_rate / st->clk_freq;
+		ret = __adis_write_reg_16(&st->adis, ADIS16495_REG_SYNC_SCALE, sync_scale);
+		if (ret)
+			goto error;
+
+		sample_rate = scaled_rate;
 	}
 
+	t = DIV_ROUND_CLOSEST(sample_rate, t);
+	if (t)
+		t--;
+
 	if (t > st->chip_info->max_dec_rate)
 		t = st->chip_info->max_dec_rate;
 
-	if ((t != 0) && (st->clk_mode != ADIS16480_CLK_PPS))
-		t--;
-
-	return adis_write_reg_16(&st->adis, reg, t);
+	ret = __adis_write_reg_16(&st->adis, ADIS16480_REG_DEC_RATE, t);
+error:
+	mutex_unlock(&st->adis.state_lock);
+	return ret;
 }
 
 static int adis16480_get_freq(struct iio_dev *indio_dev, int *val, int *val2)
@@ -350,34 +395,35 @@ static int adis16480_get_freq(struct iio_dev *indio_dev, int *val, int *val2)
 	struct adis16480 *st = iio_priv(indio_dev);
 	uint16_t t;
 	int ret;
-	unsigned int freq;
-	unsigned int reg;
+	unsigned int freq, sample_rate = st->clk_freq;
 
-	if (st->clk_mode == ADIS16480_CLK_PPS)
-		reg = ADIS16495_REG_SYNC_SCALE;
-	else
-		reg = ADIS16480_REG_DEC_RATE;
+	mutex_lock(&st->adis.state_lock);
+
+	if (st->clk_mode == ADIS16480_CLK_PPS) {
+		u16 sync_scale;
+
+		ret = __adis_read_reg_16(&st->adis, ADIS16495_REG_SYNC_SCALE, &sync_scale);
+		if (ret)
+			goto error;
 
-	ret = adis_read_reg_16(&st->adis, reg, &t);
+		sample_rate = st->clk_freq * sync_scale;
+	}
+
+	ret = __adis_read_reg_16(&st->adis, ADIS16480_REG_DEC_RATE, &t);
 	if (ret)
-		return ret;
+		goto error;
 
-	/*
-	 * When using PPS mode, the rate of data collection is equal to the
-	 * product of the external clock frequency and the scale factor in the
-	 * SYNC_SCALE register.
-	 * When using sync mode, or internal clock, the output data rate is
-	 * equal with  the clock frequency divided by DEC_RATE + 1.
-	 */
-	if (st->clk_mode == ADIS16480_CLK_PPS)
-		freq = st->clk_freq * t;
-	else
-		freq = st->clk_freq / (t + 1);
+	mutex_unlock(&st->adis.state_lock);
+
+	freq = DIV_ROUND_CLOSEST(sample_rate, (t + 1));
 
 	*val = freq / 1000;
 	*val2 = (freq % 1000) * 1000;
 
 	return IIO_VAL_INT_PLUS_MICRO;
+error:
+	mutex_unlock(&st->adis.state_lock);
+	return ret;
 }
 
 enum {
@@ -1278,6 +1324,20 @@ static int adis16480_probe(struct spi_device *spi)
 
 		st->clk_freq = clk_get_rate(st->ext_clk);
 		st->clk_freq *= 1000; /* micro */
+		if (st->clk_mode == ADIS16480_CLK_PPS) {
+			u16 sync_scale;
+
+			/*
+			 * In PPS mode, the IMU sample rate is the clk_freq * sync_scale. Hence,
+			 * default the IMU sample rate to the highest multiple of the input clock
+			 * lower than the IMU max sample rate. The internal sample rate is the
+			 * max...
+			 */
+			sync_scale = st->chip_info->int_clk / st->clk_freq;
+			ret = __adis_write_reg_16(&st->adis, ADIS16495_REG_SYNC_SCALE, sync_scale);
+			if (ret)
+				return ret;
+		}
 	} else {
 		st->clk_freq = st->chip_info->int_clk;
 	}
-- 
2.30.2




^ permalink raw reply related	[flat|nested] 702+ messages in thread

* [PATCH 5.12 191/677] arm64: dts: qcom: sc7180: trogdor: Fix trip point config of charger thermal zone
  2021-05-12 14:40 [PATCH 5.12 000/677] 5.12.4-rc1 review Greg Kroah-Hartman
                   ` (189 preceding siblings ...)
  2021-05-12 14:43 ` [PATCH 5.12 190/677] iio: adis16480: fix pps mode sampling frequency math Greg Kroah-Hartman
@ 2021-05-12 14:43 ` Greg Kroah-Hartman
  2021-05-12 14:43 ` [PATCH 5.12 192/677] arm64: dts: qcom: sm8250: Fix level triggered PMU interrupt polarity Greg Kroah-Hartman
                   ` (493 subsequent siblings)
  684 siblings, 0 replies; 702+ messages in thread
From: Greg Kroah-Hartman @ 2021-05-12 14:43 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Stephen Boyd, Douglas Anderson,
	Matthias Kaehlcke, Bjorn Andersson, Sasha Levin

From: Matthias Kaehlcke <mka@chromium.org>

[ Upstream commit 38f3267def6511171aef0f056ad172686903603f ]

The trip point configuration of the charger thermal zone for trogdor
is missing a node for the critical trip point. Add the missing node.

Reviewed-by: Stephen Boyd <swboyd@chromium.org>
Reviewed-by: Douglas Anderson <dianders@chromium.org>
Fixes: bb06eb3607e9 ("arm64: qcom: sc7180: trogdor: Add ADC nodes and thermal zone for charger thermistor")
Signed-off-by: Matthias Kaehlcke <mka@chromium.org>
Link: https://lore.kernel.org/r/20210225103330.v2.3.Ife7768b6b4765026c9d233ad4982da0e365ddbca@changeid
Signed-off-by: Bjorn Andersson <bjorn.andersson@linaro.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/arm64/boot/dts/qcom/sc7180-trogdor.dtsi | 8 +++++---
 1 file changed, 5 insertions(+), 3 deletions(-)

diff --git a/arch/arm64/boot/dts/qcom/sc7180-trogdor.dtsi b/arch/arm64/boot/dts/qcom/sc7180-trogdor.dtsi
index 07c8b2c926c0..753fd320dfbc 100644
--- a/arch/arm64/boot/dts/qcom/sc7180-trogdor.dtsi
+++ b/arch/arm64/boot/dts/qcom/sc7180-trogdor.dtsi
@@ -22,9 +22,11 @@
 			thermal-sensors = <&pm6150_adc_tm 1>;
 
 			trips {
-				temperature = <125000>;
-				hysteresis = <1000>;
-				type = "critical";
+				charger-crit {
+					temperature = <125000>;
+					hysteresis = <1000>;
+					type = "critical";
+				};
 			};
 		};
 	};
-- 
2.30.2




^ permalink raw reply related	[flat|nested] 702+ messages in thread

* [PATCH 5.12 192/677] arm64: dts: qcom: sm8250: Fix level triggered PMU interrupt polarity
  2021-05-12 14:40 [PATCH 5.12 000/677] 5.12.4-rc1 review Greg Kroah-Hartman
                   ` (190 preceding siblings ...)
  2021-05-12 14:43 ` [PATCH 5.12 191/677] arm64: dts: qcom: sc7180: trogdor: Fix trip point config of charger thermal zone Greg Kroah-Hartman
@ 2021-05-12 14:43 ` Greg Kroah-Hartman
  2021-05-12 14:43 ` [PATCH 5.12 193/677] arm64: dts: qcom: sm8350: " Greg Kroah-Hartman
                   ` (492 subsequent siblings)
  684 siblings, 0 replies; 702+ messages in thread
From: Greg Kroah-Hartman @ 2021-05-12 14:43 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Sai Prakash Ranjan, Bjorn Andersson,
	Sasha Levin

From: Sai Prakash Ranjan <saiprakash.ranjan@codeaurora.org>

[ Upstream commit 93138ef5ac923b10f81575d35dbcb83136cbfc40 ]

As per interrupt documentation for SM8250 SoC, the polarity
for level triggered PMU interrupt is low, fix this.

Fixes: 60378f1a171e ("arm64: dts: qcom: sm8250: Add sm8250 dts file")
Signed-off-by: Sai Prakash Ranjan <saiprakash.ranjan@codeaurora.org>
Link: https://lore.kernel.org/r/96680a1c6488955c9eef7973c28026462b2a4ec0.1613468366.git.saiprakash.ranjan@codeaurora.org
Signed-off-by: Bjorn Andersson <bjorn.andersson@linaro.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/arm64/boot/dts/qcom/sm8250.dtsi | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/arch/arm64/boot/dts/qcom/sm8250.dtsi b/arch/arm64/boot/dts/qcom/sm8250.dtsi
index 947e1accae3a..1864c459a563 100644
--- a/arch/arm64/boot/dts/qcom/sm8250.dtsi
+++ b/arch/arm64/boot/dts/qcom/sm8250.dtsi
@@ -279,7 +279,7 @@
 
 	pmu {
 		compatible = "arm,armv8-pmuv3";
-		interrupts = <GIC_PPI 7 IRQ_TYPE_LEVEL_HIGH>;
+		interrupts = <GIC_PPI 7 IRQ_TYPE_LEVEL_LOW>;
 	};
 
 	psci {
-- 
2.30.2




^ permalink raw reply related	[flat|nested] 702+ messages in thread

* [PATCH 5.12 193/677] arm64: dts: qcom: sm8350: Fix level triggered PMU interrupt polarity
  2021-05-12 14:40 [PATCH 5.12 000/677] 5.12.4-rc1 review Greg Kroah-Hartman
                   ` (191 preceding siblings ...)
  2021-05-12 14:43 ` [PATCH 5.12 192/677] arm64: dts: qcom: sm8250: Fix level triggered PMU interrupt polarity Greg Kroah-Hartman
@ 2021-05-12 14:43 ` Greg Kroah-Hartman
  2021-05-12 14:44 ` [PATCH 5.12 194/677] arm64: dts: qcom: sm8250: Fix timer interrupt to specify EL2 physical timer Greg Kroah-Hartman
                   ` (491 subsequent siblings)
  684 siblings, 0 replies; 702+ messages in thread
From: Greg Kroah-Hartman @ 2021-05-12 14:43 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Sai Prakash Ranjan, Bjorn Andersson,
	Sasha Levin

From: Sai Prakash Ranjan <saiprakash.ranjan@codeaurora.org>

[ Upstream commit 794d3e309e44c99158d0166b1717f297341cf3ab ]

As per interrupt documentation for SM8350 SoC, the polarity
for level triggered PMU interrupt is low, fix this.

Fixes: b7e8f433a673 ("arm64: dts: qcom: Add basic devicetree support for SM8350 SoC")
Signed-off-by: Sai Prakash Ranjan <saiprakash.ranjan@codeaurora.org>
Link: https://lore.kernel.org/r/ca57409198477f7815e32a6a7467dcdc9b93dc4f.1613468366.git.saiprakash.ranjan@codeaurora.org
Signed-off-by: Bjorn Andersson <bjorn.andersson@linaro.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/arm64/boot/dts/qcom/sm8350.dtsi | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/arch/arm64/boot/dts/qcom/sm8350.dtsi b/arch/arm64/boot/dts/qcom/sm8350.dtsi
index 5ef460458f5c..e8bf3f95c674 100644
--- a/arch/arm64/boot/dts/qcom/sm8350.dtsi
+++ b/arch/arm64/boot/dts/qcom/sm8350.dtsi
@@ -153,7 +153,7 @@
 
 	pmu {
 		compatible = "arm,armv8-pmuv3";
-		interrupts = <GIC_PPI 7 IRQ_TYPE_LEVEL_HIGH>;
+		interrupts = <GIC_PPI 7 IRQ_TYPE_LEVEL_LOW>;
 	};
 
 	psci {
-- 
2.30.2




^ permalink raw reply related	[flat|nested] 702+ messages in thread

* [PATCH 5.12 194/677] arm64: dts: qcom: sm8250: Fix timer interrupt to specify EL2 physical timer
  2021-05-12 14:40 [PATCH 5.12 000/677] 5.12.4-rc1 review Greg Kroah-Hartman
                   ` (192 preceding siblings ...)
  2021-05-12 14:43 ` [PATCH 5.12 193/677] arm64: dts: qcom: sm8350: " Greg Kroah-Hartman
@ 2021-05-12 14:44 ` Greg Kroah-Hartman
  2021-05-12 14:44 ` [PATCH 5.12 195/677] arm64: dts: qcom: sc7180: Avoid glitching SPI CS at bootup on trogdor Greg Kroah-Hartman
                   ` (490 subsequent siblings)
  684 siblings, 0 replies; 702+ messages in thread
From: Greg Kroah-Hartman @ 2021-05-12 14:44 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Sai Prakash Ranjan, Bjorn Andersson,
	Sasha Levin

From: Sai Prakash Ranjan <saiprakash.ranjan@codeaurora.org>

[ Upstream commit 29a3349543e4ce3fe4e2a761403cc629e3534c67 ]

ARM architected timer interrupts DT property specifies EL2/HYP
physical interrupt and not EL2/HYP virtual interrupt for the 4th
interrupt property. As per interrupt documentation for SM8250 SoC,
the EL2/HYP physical timer interrupt is 10 and EL2/HYP virtual timer
interrupt is 12, so fix the 4th timer interrupt to be EL2 physical
timer interrupt (10 in this case).

Fixes: 60378f1a171e ("arm64: dts: qcom: sm8250: Add sm8250 dts file")
Signed-off-by: Sai Prakash Ranjan <saiprakash.ranjan@codeaurora.org>
Link: https://lore.kernel.org/r/744e58f725d279eb2b049a7da42b0f09189f4054.1613468366.git.saiprakash.ranjan@codeaurora.org
Signed-off-by: Bjorn Andersson <bjorn.andersson@linaro.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/arm64/boot/dts/qcom/sm8250.dtsi | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/arch/arm64/boot/dts/qcom/sm8250.dtsi b/arch/arm64/boot/dts/qcom/sm8250.dtsi
index 1864c459a563..3232ac6253bb 100644
--- a/arch/arm64/boot/dts/qcom/sm8250.dtsi
+++ b/arch/arm64/boot/dts/qcom/sm8250.dtsi
@@ -3754,7 +3754,7 @@
 				(GIC_CPU_MASK_SIMPLE(8) | IRQ_TYPE_LEVEL_LOW)>,
 			     <GIC_PPI 11
 				(GIC_CPU_MASK_SIMPLE(8) | IRQ_TYPE_LEVEL_LOW)>,
-			     <GIC_PPI 12
+			     <GIC_PPI 10
 				(GIC_CPU_MASK_SIMPLE(8) | IRQ_TYPE_LEVEL_LOW)>;
 	};
 
-- 
2.30.2




^ permalink raw reply related	[flat|nested] 702+ messages in thread

* [PATCH 5.12 195/677] arm64: dts: qcom: sc7180: Avoid glitching SPI CS at bootup on trogdor
  2021-05-12 14:40 [PATCH 5.12 000/677] 5.12.4-rc1 review Greg Kroah-Hartman
                   ` (193 preceding siblings ...)
  2021-05-12 14:44 ` [PATCH 5.12 194/677] arm64: dts: qcom: sm8250: Fix timer interrupt to specify EL2 physical timer Greg Kroah-Hartman
@ 2021-05-12 14:44 ` Greg Kroah-Hartman
  2021-05-12 14:44 ` [PATCH 5.12 196/677] arm64: dts: qcom: sdm845: fix number of pins in gpio-ranges Greg Kroah-Hartman
                   ` (489 subsequent siblings)
  684 siblings, 0 replies; 702+ messages in thread
From: Greg Kroah-Hartman @ 2021-05-12 14:44 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Stephen Boyd, Douglas Anderson,
	Bjorn Andersson, Sasha Levin

From: Douglas Anderson <dianders@chromium.org>

[ Upstream commit e440e30e26dd6b0424002ad0ddcbbcea783efd85 ]

At boot time the following happens:
1. Device core gets ready to probe our SPI driver.
2. Device core applies SPI controller's "default" pinctrl.
3. Device core calls the SPI driver's probe() function which will
   eventually setup the chip select GPIO as "unasserted".

Thinking about the above, we can find:
a) For SPI devices that the BIOS inits (Cr50 and EC), the BIOS would
   have had them configured as "GENI" pins and not as "GPIO" pins.
b) It turns out that our BIOS also happens to init these pins as
   "output" (even though it doesn't need to since they're not muxed as
   GPIO) but leaves them at the default state of "low".
c) As soon as we apply the "default" chip select it'll switch the
   function to GPIO and stop driving the chip select high (which is
   how "GENI" was driving it) and start driving it low.
d) As of commit 9378f46040be ("UPSTREAM: spi: spi-geni-qcom: Use the
   new method of gpio CS control"), when the SPI core inits things it
   inits the GPIO to be "deasserted".  Prior to that commit the GPIO
   was left untouched until first use.
e) When the first transaction happens we'll assert the chip select and
   then deassert it after done.

So before the commit to change us to use gpio descriptors we used to
have a _really long_ assertion of chip select before our first
transaction (because it got pulled down and then the first "assert"
was a no-op).  That wasn't great but (apparently) didn't cause any
real harm.

After the commit to change us to use gpio descriptors we end up
glitching the chip select line during probe.  It would go low and then
high with no data transferred.  The other side ought to be robust
against this, but it certainly could cause some confusion.  It's known
to at least cause an error message on the EC console and it's believed
that, under certain timing conditions, it could be getting the EC into
a confused state causing the EC driver to fail to probe.

Let's fix things to avoid the glitch.  We'll add an extra pinctrl
entry that sets the value of the pin to output high (CS deasserted)
before doing anything else.  We'll do this in its own pinctrl node
that comes before the normal pinctrl entries to ensure that the order
is correct and that this gets applied before the mux change.

This change is in the trogdor board file rather than in the SoC dtsi
file because chip select polarity can be different depending on what's
hooked up and it doesn't feel worth it to spam the SoC dtsi file with
both options.  The board file would need to pick the right one anyway.

Reviewed-by: Stephen Boyd <swboyd@chromium.org>
Fixes: cfbb97fde694 ("arm64: dts: qcom: Switch sc7180-trogdor to control SPI CS via GPIO")
Signed-off-by: Douglas Anderson <dianders@chromium.org>
Link: https://lore.kernel.org/r/20210218145456.1.I1da01a075dd86e005152f993b2d5d82dd9686238@changeid
Signed-off-by: Bjorn Andersson <bjorn.andersson@linaro.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/arm64/boot/dts/qcom/sc7180-trogdor.dtsi | 27 +++++++++++++++++---
 1 file changed, 24 insertions(+), 3 deletions(-)

diff --git a/arch/arm64/boot/dts/qcom/sc7180-trogdor.dtsi b/arch/arm64/boot/dts/qcom/sc7180-trogdor.dtsi
index 753fd320dfbc..b8f7cf5cbdab 100644
--- a/arch/arm64/boot/dts/qcom/sc7180-trogdor.dtsi
+++ b/arch/arm64/boot/dts/qcom/sc7180-trogdor.dtsi
@@ -770,17 +770,17 @@ hp_i2c: &i2c9 {
 };
 
 &spi0 {
-	pinctrl-0 = <&qup_spi0_cs_gpio>;
+	pinctrl-0 = <&qup_spi0_cs_gpio_init_high>, <&qup_spi0_cs_gpio>;
 	cs-gpios = <&tlmm 37 GPIO_ACTIVE_LOW>;
 };
 
 &spi6 {
-	pinctrl-0 = <&qup_spi6_cs_gpio>;
+	pinctrl-0 = <&qup_spi6_cs_gpio_init_high>, <&qup_spi6_cs_gpio>;
 	cs-gpios = <&tlmm 62 GPIO_ACTIVE_LOW>;
 };
 
 ap_spi_fp: &spi10 {
-	pinctrl-0 = <&qup_spi10_cs_gpio>;
+	pinctrl-0 = <&qup_spi10_cs_gpio_init_high>, <&qup_spi10_cs_gpio>;
 	cs-gpios = <&tlmm 89 GPIO_ACTIVE_LOW>;
 
 	cros_ec_fp: ec@0 {
@@ -1341,6 +1341,27 @@ ap_spi_fp: &spi10 {
 		};
 	};
 
+	qup_spi0_cs_gpio_init_high: qup-spi0-cs-gpio-init-high {
+		pinconf {
+			pins = "gpio37";
+			output-high;
+		};
+	};
+
+	qup_spi6_cs_gpio_init_high: qup-spi6-cs-gpio-init-high {
+		pinconf {
+			pins = "gpio62";
+			output-high;
+		};
+	};
+
+	qup_spi10_cs_gpio_init_high: qup-spi10-cs-gpio-init-high {
+		pinconf {
+			pins = "gpio89";
+			output-high;
+		};
+	};
+
 	qup_uart3_sleep: qup-uart3-sleep {
 		pinmux {
 			pins = "gpio38", "gpio39",
-- 
2.30.2




^ permalink raw reply related	[flat|nested] 702+ messages in thread

* [PATCH 5.12 196/677] arm64: dts: qcom: sdm845: fix number of pins in gpio-ranges
  2021-05-12 14:40 [PATCH 5.12 000/677] 5.12.4-rc1 review Greg Kroah-Hartman
                   ` (194 preceding siblings ...)
  2021-05-12 14:44 ` [PATCH 5.12 195/677] arm64: dts: qcom: sc7180: Avoid glitching SPI CS at bootup on trogdor Greg Kroah-Hartman
@ 2021-05-12 14:44 ` Greg Kroah-Hartman
  2021-05-12 14:44 ` [PATCH 5.12 197/677] arm64: dts: qcom: sm8150: " Greg Kroah-Hartman
                   ` (488 subsequent siblings)
  684 siblings, 0 replies; 702+ messages in thread
From: Greg Kroah-Hartman @ 2021-05-12 14:44 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Evan Green, Shawn Guo,
	Bjorn Andersson, Sasha Levin

From: Shawn Guo <shawn.guo@linaro.org>

[ Upstream commit 02058fc3839df65ff64de2a6b1c5de8c9fd705c1 ]

The last cell of 'gpio-ranges' should be number of GPIO pins, and in
case of qcom platform it should match msm_pinctrl_soc_data.ngpio rather
than msm_pinctrl_soc_data.ngpio - 1.

This fixes the problem that when the last GPIO pin in the range is
configured with the following call sequence, it always fails with
-EPROBE_DEFER.

    pinctrl_gpio_set_config()
        pinctrl_get_device_gpio_range()
            pinctrl_match_gpio_range()

Fixes: bc2c806293c6 ("arm64: dts: qcom: sdm845: Add gpio-ranges to TLMM node")
Cc: Evan Green <evgreen@chromium.org>
Signed-off-by: Shawn Guo <shawn.guo@linaro.org>
Link: https://lore.kernel.org/r/20210303033106.549-2-shawn.guo@linaro.org
Signed-off-by: Bjorn Andersson <bjorn.andersson@linaro.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/arm64/boot/dts/qcom/sdm845.dtsi | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/arch/arm64/boot/dts/qcom/sdm845.dtsi b/arch/arm64/boot/dts/qcom/sdm845.dtsi
index 454f794af547..6a2ed02d383d 100644
--- a/arch/arm64/boot/dts/qcom/sdm845.dtsi
+++ b/arch/arm64/boot/dts/qcom/sdm845.dtsi
@@ -2382,7 +2382,7 @@
 			#gpio-cells = <2>;
 			interrupt-controller;
 			#interrupt-cells = <2>;
-			gpio-ranges = <&tlmm 0 0 150>;
+			gpio-ranges = <&tlmm 0 0 151>;
 			wakeup-parent = <&pdc_intc>;
 
 			cci0_default: cci0-default {
-- 
2.30.2




^ permalink raw reply related	[flat|nested] 702+ messages in thread

* [PATCH 5.12 197/677] arm64: dts: qcom: sm8150: fix number of pins in gpio-ranges
  2021-05-12 14:40 [PATCH 5.12 000/677] 5.12.4-rc1 review Greg Kroah-Hartman
                   ` (195 preceding siblings ...)
  2021-05-12 14:44 ` [PATCH 5.12 196/677] arm64: dts: qcom: sdm845: fix number of pins in gpio-ranges Greg Kroah-Hartman
@ 2021-05-12 14:44 ` Greg Kroah-Hartman
  2021-05-12 14:44 ` [PATCH 5.12 198/677] arm64: dts: qcom: sm8250: " Greg Kroah-Hartman
                   `