--- /dev/null
+From 10134ec3f8cefa6a40fe84987f1795e9e0da9715 Mon Sep 17 00:00:00 2001
+From: Fabrice Gasnier <fabrice.gasnier@st.com>
+Date: Tue, 12 May 2020 15:27:05 +0200
+Subject: iio: adc: stm32-adc: fix a wrong error message when probing interrupts
+
+From: Fabrice Gasnier <fabrice.gasnier@st.com>
+
+commit 10134ec3f8cefa6a40fe84987f1795e9e0da9715 upstream.
+
+A wrong error message is printed out currently, like on STM32MP15:
+- stm32-adc-core 48003000.adc: IRQ index 2 not found.
+
+This is seen since commit 7723f4c5ecdb ("driver core: platform: Add an
+error message to platform_get_irq*()").
+The STM32 ADC core driver wrongly requests up to 3 interrupt lines. It
+should request only the necessary IRQs, based on the compatible:
+- stm32f4/h7 ADCs share a common interrupt
+- stm32mp1, has one interrupt line per ADC.
+So add the number of required interrupts to the compatible data.
+
+Fixes: d58c67d1d851 ("iio: adc: stm32-adc: add support for STM32MP1")
+Signed-off-by: Fabrice Gasnier <fabrice.gasnier@st.com>
+Cc: <Stable@vger.kernel.org>
+Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/iio/adc/stm32-adc-core.c | 34 ++++++++++++++--------------------
+ 1 file changed, 14 insertions(+), 20 deletions(-)
+
+--- a/drivers/iio/adc/stm32-adc-core.c
++++ b/drivers/iio/adc/stm32-adc-core.c
+@@ -65,12 +65,14 @@ struct stm32_adc_priv;
+ * @clk_sel: clock selection routine
+ * @max_clk_rate_hz: maximum analog clock rate (Hz, from datasheet)
+ * @has_syscfg: SYSCFG capability flags
++ * @num_irqs: number of interrupt lines
+ */
+ struct stm32_adc_priv_cfg {
+ const struct stm32_adc_common_regs *regs;
+ int (*clk_sel)(struct platform_device *, struct stm32_adc_priv *);
+ u32 max_clk_rate_hz;
+ unsigned int has_syscfg;
++ unsigned int num_irqs;
+ };
+
+ /**
+@@ -375,21 +377,15 @@ static int stm32_adc_irq_probe(struct pl
+ struct device_node *np = pdev->dev.of_node;
+ unsigned int i;
+
+- for (i = 0; i < STM32_ADC_MAX_ADCS; i++) {
++ /*
++ * Interrupt(s) must be provided, depending on the compatible:
++ * - stm32f4/h7 shares a common interrupt line.
++ * - stm32mp1, has one line per ADC
++ */
++ for (i = 0; i < priv->cfg->num_irqs; i++) {
+ priv->irq[i] = platform_get_irq(pdev, i);
+- if (priv->irq[i] < 0) {
+- /*
+- * At least one interrupt must be provided, make others
+- * optional:
+- * - stm32f4/h7 shares a common interrupt.
+- * - stm32mp1, has one line per ADC (either for ADC1,
+- * ADC2 or both).
+- */
+- if (i && priv->irq[i] == -ENXIO)
+- continue;
+-
++ if (priv->irq[i] < 0)
+ return priv->irq[i];
+- }
+ }
+
+ priv->domain = irq_domain_add_simple(np, STM32_ADC_MAX_ADCS, 0,
+@@ -400,9 +396,7 @@ static int stm32_adc_irq_probe(struct pl
+ return -ENOMEM;
+ }
+
+- for (i = 0; i < STM32_ADC_MAX_ADCS; i++) {
+- if (priv->irq[i] < 0)
+- continue;
++ for (i = 0; i < priv->cfg->num_irqs; i++) {
+ irq_set_chained_handler(priv->irq[i], stm32_adc_irq_handler);
+ irq_set_handler_data(priv->irq[i], priv);
+ }
+@@ -420,11 +414,8 @@ static void stm32_adc_irq_remove(struct
+ irq_dispose_mapping(irq_find_mapping(priv->domain, hwirq));
+ irq_domain_remove(priv->domain);
+
+- for (i = 0; i < STM32_ADC_MAX_ADCS; i++) {
+- if (priv->irq[i] < 0)
+- continue;
++ for (i = 0; i < priv->cfg->num_irqs; i++)
+ irq_set_chained_handler(priv->irq[i], NULL);
+- }
+ }
+
+ static int stm32_adc_core_switches_supply_en(struct stm32_adc_priv *priv,
+@@ -817,6 +808,7 @@ static const struct stm32_adc_priv_cfg s
+ .regs = &stm32f4_adc_common_regs,
+ .clk_sel = stm32f4_adc_clk_sel,
+ .max_clk_rate_hz = 36000000,
++ .num_irqs = 1,
+ };
+
+ static const struct stm32_adc_priv_cfg stm32h7_adc_priv_cfg = {
+@@ -824,6 +816,7 @@ static const struct stm32_adc_priv_cfg s
+ .clk_sel = stm32h7_adc_clk_sel,
+ .max_clk_rate_hz = 36000000,
+ .has_syscfg = HAS_VBOOSTER,
++ .num_irqs = 1,
+ };
+
+ static const struct stm32_adc_priv_cfg stm32mp1_adc_priv_cfg = {
+@@ -831,6 +824,7 @@ static const struct stm32_adc_priv_cfg s
+ .clk_sel = stm32h7_adc_clk_sel,
+ .max_clk_rate_hz = 40000000,
+ .has_syscfg = HAS_VBOOSTER | HAS_ANASWVDD,
++ .num_irqs = 2,
+ };
+
+ static const struct of_device_id stm32_adc_of_match[] = {
--- /dev/null
+From 13e945631c2ffb946c0af342812a3cd39227de6e Mon Sep 17 00:00:00 2001
+From: Jonathan Cameron <Jonathan.Cameron@huawei.com>
+Date: Sun, 17 May 2020 18:30:00 +0100
+Subject: iio:chemical:pms7003: Fix timestamp alignment and prevent data leak.
+
+From: Jonathan Cameron <Jonathan.Cameron@huawei.com>
+
+commit 13e945631c2ffb946c0af342812a3cd39227de6e upstream.
+
+One of a class of bugs pointed out by Lars in a recent review.
+iio_push_to_buffers_with_timestamp assumes the buffer used is aligned
+to the size of the timestamp (8 bytes). This is not guaranteed in
+this driver which uses an array of smaller elements on the stack.
+As Lars also noted this anti pattern can involve a leak of data to
+userspace and that indeed can happen here. We close both issues by
+moving to a suitable structure in the iio_priv() data with alignment
+explicitly requested. This data is allocated with kzalloc so no
+data can leak appart from previous readings.
+
+Fixes: a1d642266c14 ("iio: chemical: add support for Plantower PMS7003 sensor")
+Reported-by: Lars-Peter Clausen <lars@metafoo.de>
+Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
+Cc: <Stable@vger.kernel.org>
+Acked-by: Tomasz Duszynski <tomasz.duszynski@octakon.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/iio/chemical/pms7003.c | 17 ++++++++++++-----
+ 1 file changed, 12 insertions(+), 5 deletions(-)
+
+--- a/drivers/iio/chemical/pms7003.c
++++ b/drivers/iio/chemical/pms7003.c
+@@ -73,6 +73,11 @@ struct pms7003_state {
+ struct pms7003_frame frame;
+ struct completion frame_ready;
+ struct mutex lock; /* must be held whenever state gets touched */
++ /* Used to construct scan to push to the IIO buffer */
++ struct {
++ u16 data[3]; /* PM1, PM2P5, PM10 */
++ s64 ts;
++ } scan;
+ };
+
+ static int pms7003_do_cmd(struct pms7003_state *state, enum pms7003_cmd cmd)
+@@ -104,7 +109,6 @@ static irqreturn_t pms7003_trigger_handl
+ struct iio_dev *indio_dev = pf->indio_dev;
+ struct pms7003_state *state = iio_priv(indio_dev);
+ struct pms7003_frame *frame = &state->frame;
+- u16 data[3 + 1 + 4]; /* PM1, PM2P5, PM10, padding, timestamp */
+ int ret;
+
+ mutex_lock(&state->lock);
+@@ -114,12 +118,15 @@ static irqreturn_t pms7003_trigger_handl
+ goto err;
+ }
+
+- data[PM1] = pms7003_get_pm(frame->data + PMS7003_PM1_OFFSET);
+- data[PM2P5] = pms7003_get_pm(frame->data + PMS7003_PM2P5_OFFSET);
+- data[PM10] = pms7003_get_pm(frame->data + PMS7003_PM10_OFFSET);
++ state->scan.data[PM1] =
++ pms7003_get_pm(frame->data + PMS7003_PM1_OFFSET);
++ state->scan.data[PM2P5] =
++ pms7003_get_pm(frame->data + PMS7003_PM2P5_OFFSET);
++ state->scan.data[PM10] =
++ pms7003_get_pm(frame->data + PMS7003_PM10_OFFSET);
+ mutex_unlock(&state->lock);
+
+- iio_push_to_buffers_with_timestamp(indio_dev, data,
++ iio_push_to_buffers_with_timestamp(indio_dev, &state->scan,
+ iio_get_time_ns(indio_dev));
+ err:
+ iio_trigger_notify_done(indio_dev->trig);
--- /dev/null
+From a5bf6fdd19c327bcfd9073a8740fa19ca4525fd4 Mon Sep 17 00:00:00 2001
+From: Jonathan Cameron <Jonathan.Cameron@huawei.com>
+Date: Sun, 17 May 2020 18:29:59 +0100
+Subject: iio:chemical:sps30: Fix timestamp alignment
+
+From: Jonathan Cameron <Jonathan.Cameron@huawei.com>
+
+commit a5bf6fdd19c327bcfd9073a8740fa19ca4525fd4 upstream.
+
+One of a class of bugs pointed out by Lars in a recent review.
+iio_push_to_buffers_with_timestamp assumes the buffer used is aligned
+to the size of the timestamp (8 bytes). This is not guaranteed in
+this driver which uses an array of smaller elements on the stack.
+
+Fixes: 232e0f6ddeae ("iio: chemical: add support for Sensirion SPS30 sensor")
+Reported-by: Lars-Peter Clausen <lars@metafoo.de>
+Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
+Cc: <Stable@vger.kernel.org>
+Acked-by: Tomasz Duszynski <tomasz.duszynski@octakon.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/iio/chemical/sps30.c | 9 ++++++---
+ 1 file changed, 6 insertions(+), 3 deletions(-)
+
+--- a/drivers/iio/chemical/sps30.c
++++ b/drivers/iio/chemical/sps30.c
+@@ -230,15 +230,18 @@ static irqreturn_t sps30_trigger_handler
+ struct iio_dev *indio_dev = pf->indio_dev;
+ struct sps30_state *state = iio_priv(indio_dev);
+ int ret;
+- s32 data[4 + 2]; /* PM1, PM2P5, PM4, PM10, timestamp */
++ struct {
++ s32 data[4]; /* PM1, PM2P5, PM4, PM10 */
++ s64 ts;
++ } scan;
+
+ mutex_lock(&state->lock);
+- ret = sps30_do_meas(state, data, 4);
++ ret = sps30_do_meas(state, scan.data, ARRAY_SIZE(scan.data));
+ mutex_unlock(&state->lock);
+ if (ret)
+ goto err;
+
+- iio_push_to_buffers_with_timestamp(indio_dev, data,
++ iio_push_to_buffers_with_timestamp(indio_dev, &scan,
+ iio_get_time_ns(indio_dev));
+ err:
+ iio_trigger_notify_done(indio_dev->trig);
--- /dev/null
+From 18dfb5326370991c81a6d1ed6d1aeee055cb8c05 Mon Sep 17 00:00:00 2001
+From: Mathieu Othacehe <m.othacehe@gmail.com>
+Date: Sun, 3 May 2020 11:29:55 +0200
+Subject: iio: vcnl4000: Fix i2c swapped word reading.
+
+From: Mathieu Othacehe <m.othacehe@gmail.com>
+
+commit 18dfb5326370991c81a6d1ed6d1aeee055cb8c05 upstream.
+
+The bytes returned by the i2c reading need to be swapped
+unconditionally. Otherwise, on be16 platforms, an incorrect value will be
+returned.
+
+Taking the slow path via next merge window as its been around a while
+and we have a patch set dependent on this which would be held up.
+
+Fixes: 62a1efb9f868 ("iio: add vcnl4000 combined ALS and proximity sensor")
+Signed-off-by: Mathieu Othacehe <m.othacehe@gmail.com>
+Cc: <Stable@vger.kernel.org>
+Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/iio/light/vcnl4000.c | 6 ++----
+ 1 file changed, 2 insertions(+), 4 deletions(-)
+
+--- a/drivers/iio/light/vcnl4000.c
++++ b/drivers/iio/light/vcnl4000.c
+@@ -219,7 +219,6 @@ static int vcnl4000_measure(struct vcnl4
+ u8 rdy_mask, u8 data_reg, int *val)
+ {
+ int tries = 20;
+- __be16 buf;
+ int ret;
+
+ mutex_lock(&data->vcnl4000_lock);
+@@ -246,13 +245,12 @@ static int vcnl4000_measure(struct vcnl4
+ goto fail;
+ }
+
+- ret = i2c_smbus_read_i2c_block_data(data->client,
+- data_reg, sizeof(buf), (u8 *) &buf);
++ ret = i2c_smbus_read_word_swapped(data->client, data_reg);
+ if (ret < 0)
+ goto fail;
+
+ mutex_unlock(&data->vcnl4000_lock);
+- *val = be16_to_cpu(buf);
++ *val = ret;
+
+ return 0;
+
--- /dev/null
+From 15a3f03d5ec0118f1e5db3fc1018686e72744e37 Mon Sep 17 00:00:00 2001
+From: Josh Triplett <josh@joshtriplett.org>
+Date: Tue, 26 May 2020 09:13:57 -0700
+Subject: serial: 8250: Enable 16550A variants by default on non-x86
+
+From: Josh Triplett <josh@joshtriplett.org>
+
+commit 15a3f03d5ec0118f1e5db3fc1018686e72744e37 upstream.
+
+Some embedded devices still use these serial ports; make sure they're
+still enabled by default on architectures more likely to have them, to
+avoid rendering someone's console unavailable.
+
+Reported-by: Vladimir Oltean <vladimir.oltean@nxp.com>
+Reported-by: Maxim Kochetkov <fido_max@inbox.ru>
+Fixes: dc56ecb81a0a ("serial: 8250: Support disabling mdelay-filled probes of 16550A variants")
+Cc: stable <stable@vger.kernel.org>
+Signed-off-by: Josh Triplett <josh@joshtriplett.org>
+Link: https://lore.kernel.org/r/a20b5fb7dd295cfb48160eecf4bdebd76332d67d.1590509426.git.josh@joshtriplett.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/tty/serial/8250/Kconfig | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/drivers/tty/serial/8250/Kconfig
++++ b/drivers/tty/serial/8250/Kconfig
+@@ -63,6 +63,7 @@ config SERIAL_8250_PNP
+ config SERIAL_8250_16550A_VARIANTS
+ bool "Support for variants of the 16550A serial port"
+ depends on SERIAL_8250
++ default !X86
+ help
+ The 8250 driver can probe for many variants of the venerable 16550A
+ serial port. Doing so takes additional time at boot.
usb-serial-option-add-telit-le910c1-eux-compositions.patch
usb-serial-ch341-add-basis-for-quirk-detection.patch
usb-serial-ch341-fix-lockup-of-devices-with-limited-prescaler.patch
+iio-chemical-sps30-fix-timestamp-alignment.patch
+iio-vcnl4000-fix-i2c-swapped-word-reading.patch
+iio-chemical-pms7003-fix-timestamp-alignment-and-prevent-data-leak.patch
+iio-adc-stm32-adc-fix-a-wrong-error-message-when-probing-interrupts.patch
+usb-musb-start-session-in-resume-for-host-port.patch
+usb-musb-fix-runtime-pm-imbalance-on-error.patch
+usb-musb-jz4740-prevent-lockup-when-config_smp-is-set.patch
+serial-8250-enable-16550a-variants-by-default-on-non-x86.patch
--- /dev/null
+From e4befc121df03dc8ed2ac1031c98f9538e244bae Mon Sep 17 00:00:00 2001
+From: Dinghao Liu <dinghao.liu@zju.edu.cn>
+Date: Sun, 24 May 2020 21:50:49 -0500
+Subject: usb: musb: Fix runtime PM imbalance on error
+
+From: Dinghao Liu <dinghao.liu@zju.edu.cn>
+
+commit e4befc121df03dc8ed2ac1031c98f9538e244bae upstream.
+
+When copy_from_user() returns an error code, there
+is a runtime PM usage counter imbalance.
+
+Fix this by moving copy_from_user() to the beginning
+of this function.
+
+Fixes: 7b6c1b4c0e1e ("usb: musb: fix runtime PM in debugfs")
+
+Signed-off-by: Dinghao Liu <dinghao.liu@zju.edu.cn>
+Cc: stable@vger.kernel.org
+Signed-off-by: Bin Liu <b-liu@ti.com>
+Link: https://lore.kernel.org/r/20200525025049.3400-7-b-liu@ti.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/usb/musb/musb_debugfs.c | 10 +++++-----
+ 1 file changed, 5 insertions(+), 5 deletions(-)
+
+--- a/drivers/usb/musb/musb_debugfs.c
++++ b/drivers/usb/musb/musb_debugfs.c
+@@ -168,6 +168,11 @@ static ssize_t musb_test_mode_write(stru
+ u8 test;
+ char buf[24];
+
++ memset(buf, 0x00, sizeof(buf));
++
++ if (copy_from_user(buf, ubuf, min_t(size_t, sizeof(buf) - 1, count)))
++ return -EFAULT;
++
+ pm_runtime_get_sync(musb->controller);
+ test = musb_readb(musb->mregs, MUSB_TESTMODE);
+ if (test) {
+@@ -176,11 +181,6 @@ static ssize_t musb_test_mode_write(stru
+ goto ret;
+ }
+
+- memset(buf, 0x00, sizeof(buf));
+-
+- if (copy_from_user(buf, ubuf, min_t(size_t, sizeof(buf) - 1, count)))
+- return -EFAULT;
+-
+ if (strstarts(buf, "force host full-speed"))
+ test = MUSB_TEST_FORCE_HOST | MUSB_TEST_FORCE_FS;
+
--- /dev/null
+From 685f5f24108a5f3481da70ee75a1b18b9de34257 Mon Sep 17 00:00:00 2001
+From: Paul Cercueil <paul@crapouillou.net>
+Date: Sun, 24 May 2020 21:50:48 -0500
+Subject: usb: musb: jz4740: Prevent lockup when CONFIG_SMP is set
+
+From: Paul Cercueil <paul@crapouillou.net>
+
+commit 685f5f24108a5f3481da70ee75a1b18b9de34257 upstream.
+
+The function dma_controller_irq() locks up the exact same spinlock we
+locked before calling it, which obviously resulted in a deadlock when
+CONFIG_SMP was enabled. This flew under the radar as none of the boards
+supported by this driver needs SMP.
+
+Fixes: 57aadb46bd63 ("usb: musb: jz4740: Add support for DMA")
+
+Cc: stable@vger.kernel.org
+Signed-off-by: Paul Cercueil <paul@crapouillou.net>
+Signed-off-by: Bin Liu <b-liu@ti.com>
+Link: https://lore.kernel.org/r/20200525025049.3400-6-b-liu@ti.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/usb/musb/jz4740.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/drivers/usb/musb/jz4740.c
++++ b/drivers/usb/musb/jz4740.c
+@@ -30,11 +30,11 @@ static irqreturn_t jz4740_musb_interrupt
+ irqreturn_t retval = IRQ_NONE, retval_dma = IRQ_NONE;
+ struct musb *musb = __hci;
+
+- spin_lock_irqsave(&musb->lock, flags);
+-
+ if (IS_ENABLED(CONFIG_USB_INVENTRA_DMA) && musb->dma_controller)
+ retval_dma = dma_controller_irq(irq, musb->dma_controller);
+
++ spin_lock_irqsave(&musb->lock, flags);
++
+ musb->int_usb = musb_readb(musb->mregs, MUSB_INTRUSB);
+ musb->int_tx = musb_readw(musb->mregs, MUSB_INTRTX);
+ musb->int_rx = musb_readw(musb->mregs, MUSB_INTRRX);
--- /dev/null
+From 7f88a5ac393f39319f69b8b20cc8d5759878d1a1 Mon Sep 17 00:00:00 2001
+From: Bin Liu <b-liu@ti.com>
+Date: Sun, 24 May 2020 21:50:45 -0500
+Subject: usb: musb: start session in resume for host port
+
+From: Bin Liu <b-liu@ti.com>
+
+commit 7f88a5ac393f39319f69b8b20cc8d5759878d1a1 upstream.
+
+Commit 17539f2f4f0b ("usb: musb: fix enumeration after resume") replaced
+musb_start() in musb_resume() to not override softconnect bit, but it
+doesn't restart the session for host port which was done in musb_start().
+The session could be disabled in musb_suspend(), which leads the host
+port doesn't stay in host mode.
+
+So let's start the session specifically for host port in musb_resume().
+
+Fixes: 17539f2f4f0b ("usb: musb: fix enumeration after resume")
+
+Cc: stable@vger.kernel.org
+Signed-off-by: Bin Liu <b-liu@ti.com>
+Link: https://lore.kernel.org/r/20200525025049.3400-3-b-liu@ti.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/usb/musb/musb_core.c | 7 +++++++
+ 1 file changed, 7 insertions(+)
+
+--- a/drivers/usb/musb/musb_core.c
++++ b/drivers/usb/musb/musb_core.c
+@@ -2877,6 +2877,13 @@ static int musb_resume(struct device *de
+ musb_enable_interrupts(musb);
+ musb_platform_enable(musb);
+
++ /* session might be disabled in suspend */
++ if (musb->port_mode == MUSB_HOST &&
++ !(musb->ops->quirks & MUSB_PRESERVE_SESSION)) {
++ devctl |= MUSB_DEVCTL_SESSION;
++ musb_writeb(musb->mregs, MUSB_DEVCTL, devctl);
++ }
++
+ spin_lock_irqsave(&musb->lock, flags);
+ error = musb_run_resume_work(musb);
+ if (error)
projects / thirdparty / kernel / stable-queue.git / commitdiff
