]> git.ipfire.org Git - thirdparty/kernel/stable-queue.git/commitdiff
Fixes for 5.15
authorSasha Levin <sashal@kernel.org>
Mon, 27 Dec 2021 03:37:33 +0000 (22:37 -0500)
committerSasha Levin <sashal@kernel.org>
Mon, 27 Dec 2021 03:37:33 +0000 (22:37 -0500)
Signed-off-by: Sasha Levin <sashal@kernel.org>
13 files changed:
queue-5.15/arm-9160-1-nommu-reload-__secondary_data-after-proci.patch [new file with mode: 0644]
queue-5.15/compiler.h-fix-annotation-macro-misplacement-with-cl.patch [new file with mode: 0644]
queue-5.15/hwmon-lm90-add-basic-support-for-ti-tmp461.patch [new file with mode: 0644]
queue-5.15/hwmon-lm90-drop-critical-attribute-support-for-max66.patch [new file with mode: 0644]
queue-5.15/hwmon-lm90-fix-usage-of-config2-register-in-detect-f.patch [new file with mode: 0644]
queue-5.15/hwmon-lm90-introduce-flag-indicating-extended-temper.patch [new file with mode: 0644]
queue-5.15/hwmon-lm90-prevent-integer-overflow-underflow-in-hys.patch [new file with mode: 0644]
queue-5.15/input-elantech-fix-stack-out-of-bound-access-in-elan.patch [new file with mode: 0644]
queue-5.15/kernel-crash_core-suppress-unknown-crashkernel-param.patch [new file with mode: 0644]
queue-5.15/pinctrl-bcm2835-change-init-order-for-gpio-hogs.patch [new file with mode: 0644]
queue-5.15/platform-x86-intel-remove-x86_platform_drivers_intel.patch [new file with mode: 0644]
queue-5.15/series
queue-5.15/uapi-fix-undefined-__always_inline-on-non-glibc-syst.patch [new file with mode: 0644]

diff --git a/queue-5.15/arm-9160-1-nommu-reload-__secondary_data-after-proci.patch b/queue-5.15/arm-9160-1-nommu-reload-__secondary_data-after-proci.patch
new file mode 100644 (file)
index 0000000..859a63b
--- /dev/null
@@ -0,0 +1,37 @@
+From 29bfc812a9d7603a454111211c27617b6f04d31a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 25 Nov 2021 12:05:19 +0100
+Subject: ARM: 9160/1: NOMMU: Reload __secondary_data after PROCINFO_INITFUNC
+
+From: Vladimir Murzin <vladimir.murzin@arm.com>
+
+[ Upstream commit 7202216a6f34d571a22274e729f841256bf8b1ef ]
+
+__secondary_data used to reside in r7 around call to
+PROCINFO_INITFUNC. After commit 95731b8ee63e ("ARM: 9059/1: cache-v7:
+get rid of mini-stack") r7 is used as a scratch register, so we have
+to reload __secondary_data before we setup the stack pointer.
+
+Fixes: 95731b8ee63e ("ARM: 9059/1: cache-v7: get rid of mini-stack")
+Signed-off-by: Vladimir Murzin <vladimir.murzin@arm.com>
+Signed-off-by: Russell King (Oracle) <rmk+kernel@armlinux.org.uk>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/kernel/head-nommu.S | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/arch/arm/kernel/head-nommu.S b/arch/arm/kernel/head-nommu.S
+index 0fc814bbc34b1..8796a69c78e00 100644
+--- a/arch/arm/kernel/head-nommu.S
++++ b/arch/arm/kernel/head-nommu.S
+@@ -114,6 +114,7 @@ ENTRY(secondary_startup)
+       add     r12, r12, r10
+       ret     r12
+ 1:    bl      __after_proc_init
++      ldr     r7, __secondary_data            @ reload r7
+       ldr     sp, [r7, #12]                   @ set up the stack pointer
+       mov     fp, #0
+       b       secondary_start_kernel
+-- 
+2.34.1
+
diff --git a/queue-5.15/compiler.h-fix-annotation-macro-misplacement-with-cl.patch b/queue-5.15/compiler.h-fix-annotation-macro-misplacement-with-cl.patch
new file mode 100644 (file)
index 0000000..4899b94
--- /dev/null
@@ -0,0 +1,82 @@
+From b65c40a8e2c9347a8edd095a4d58b5fdfa76ca75 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 8 Nov 2021 14:35:59 -0800
+Subject: compiler.h: Fix annotation macro misplacement with Clang
+
+From: Josh Poimboeuf <jpoimboe@redhat.com>
+
+[ Upstream commit dcce50e6cc4d86a63dc0a9a6ee7d4f948ccd53a1 ]
+
+When building with Clang and CONFIG_TRACE_BRANCH_PROFILING, there are a
+lot of unreachable warnings, like:
+
+  arch/x86/kernel/traps.o: warning: objtool: handle_xfd_event()+0x134: unreachable instruction
+
+Without an input to the inline asm, 'volatile' is ignored for some
+reason and Clang feels free to move the reachable() annotation away from
+its intended location.
+
+Fix that by re-adding the counter value to the inputs.
+
+Fixes: f1069a8756b9 ("compiler.h: Avoid using inline asm operand modifiers")
+Fixes: c199f64ff93c ("instrumentation.h: Avoid using inline asm operand modifiers")
+Reported-by: kernel test robot <lkp@intel.com>
+Signed-off-by: Josh Poimboeuf <jpoimboe@redhat.com>
+Link: https://lore.kernel.org/r/0417e96909b97a406323409210de7bf13df0b170.1636410380.git.jpoimboe@redhat.com
+Cc: Peter Zijlstra <peterz@infradead.org>
+Cc: x86@kernel.org
+Cc: Vasily Gorbik <gor@linux.ibm.com>
+Cc: Miroslav Benes <mbenes@suse.cz>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/linux/compiler.h        | 4 ++--
+ include/linux/instrumentation.h | 4 ++--
+ 2 files changed, 4 insertions(+), 4 deletions(-)
+
+diff --git a/include/linux/compiler.h b/include/linux/compiler.h
+index 3d5af56337bdb..429dcebe2b992 100644
+--- a/include/linux/compiler.h
++++ b/include/linux/compiler.h
+@@ -121,7 +121,7 @@ void ftrace_likely_update(struct ftrace_likely_data *f, int val,
+       asm volatile(__stringify_label(c) ":\n\t"                       \
+                    ".pushsection .discard.reachable\n\t"              \
+                    ".long " __stringify_label(c) "b - .\n\t"          \
+-                   ".popsection\n\t");                                \
++                   ".popsection\n\t" : : "i" (c));                    \
+ })
+ #define annotate_reachable() __annotate_reachable(__COUNTER__)
+@@ -129,7 +129,7 @@ void ftrace_likely_update(struct ftrace_likely_data *f, int val,
+       asm volatile(__stringify_label(c) ":\n\t"                       \
+                    ".pushsection .discard.unreachable\n\t"            \
+                    ".long " __stringify_label(c) "b - .\n\t"          \
+-                   ".popsection\n\t");                                \
++                   ".popsection\n\t" : : "i" (c));                    \
+ })
+ #define annotate_unreachable() __annotate_unreachable(__COUNTER__)
+diff --git a/include/linux/instrumentation.h b/include/linux/instrumentation.h
+index fa2cd8c63dcc9..24359b4a96053 100644
+--- a/include/linux/instrumentation.h
++++ b/include/linux/instrumentation.h
+@@ -11,7 +11,7 @@
+       asm volatile(__stringify(c) ": nop\n\t"                         \
+                    ".pushsection .discard.instr_begin\n\t"            \
+                    ".long " __stringify(c) "b - .\n\t"                \
+-                   ".popsection\n\t");                                \
++                   ".popsection\n\t" : : "i" (c));                    \
+ })
+ #define instrumentation_begin() __instrumentation_begin(__COUNTER__)
+@@ -50,7 +50,7 @@
+       asm volatile(__stringify(c) ": nop\n\t"                         \
+                    ".pushsection .discard.instr_end\n\t"              \
+                    ".long " __stringify(c) "b - .\n\t"                \
+-                   ".popsection\n\t");                                \
++                   ".popsection\n\t" : : "i" (c));                    \
+ })
+ #define instrumentation_end() __instrumentation_end(__COUNTER__)
+ #else
+-- 
+2.34.1
+
diff --git a/queue-5.15/hwmon-lm90-add-basic-support-for-ti-tmp461.patch b/queue-5.15/hwmon-lm90-add-basic-support-for-ti-tmp461.patch
new file mode 100644 (file)
index 0000000..3926977
--- /dev/null
@@ -0,0 +1,187 @@
+From 17b46d0055fa248e34ccb0331029414a78039afe Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 18 Oct 2021 20:03:32 -0700
+Subject: hwmon: (lm90) Add basic support for TI TMP461
+
+From: Guenter Roeck <linux@roeck-us.net>
+
+[ Upstream commit f8344f7693a25d9025a59d164450b50c6f5aa3c0 ]
+
+TMP461 is almost identical to TMP451 and was actually detected as TMP451
+with the existing lm90 driver if its I2C address is 0x4c. Add support
+for it to the lm90 driver. At the same time, improve the chip detection
+function to at least try to distinguish between TMP451 and TMP461.
+
+As a side effect, this fixes commit 24333ac26d01 ("hwmon: (tmp401) use
+smb word operations instead of 2 smb byte operations"). TMP461 does not
+support word operations on temperature registers, which causes bad
+temperature readings with the tmp401 driver. The lm90 driver does not
+perform word operations on temperature registers and thus does not have
+this problem.
+
+Support is listed as basic because TMP461 supports a sensor resolution
+of 0.0625 degrees C, while the lm90 driver assumes a resolution of 0.125
+degrees C. Also, the TMP461 supports negative temperatures with its
+default temperature range, which is not the case for similar chips
+supported by the lm90 and the tmp401 drivers. Those limitations will be
+addressed with follow-up patches.
+
+Fixes: 24333ac26d01 ("hwmon: (tmp401) use smb word operations instead of 2 smb byte operations")
+Reported-by: David T. Wilson <david.wilson@nasa.gov>
+Cc: David T. Wilson <david.wilson@nasa.gov>
+Signed-off-by: Guenter Roeck <linux@roeck-us.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ Documentation/hwmon/lm90.rst | 10 +++++++
+ drivers/hwmon/Kconfig        |  2 +-
+ drivers/hwmon/lm90.c         | 54 ++++++++++++++++++++++++++----------
+ 3 files changed, 50 insertions(+), 16 deletions(-)
+
+diff --git a/Documentation/hwmon/lm90.rst b/Documentation/hwmon/lm90.rst
+index 3da8c6e06a365..05391fb4042d9 100644
+--- a/Documentation/hwmon/lm90.rst
++++ b/Documentation/hwmon/lm90.rst
+@@ -265,6 +265,16 @@ Supported chips:
+              https://www.ti.com/litv/pdf/sbos686
++  * Texas Instruments TMP461
++
++    Prefix: 'tmp461'
++
++    Addresses scanned: I2C 0x48 through 0x4F
++
++    Datasheet: Publicly available at TI website
++
++             https://www.ti.com/lit/gpn/tmp461
++
+ Author: Jean Delvare <jdelvare@suse.de>
+diff --git a/drivers/hwmon/Kconfig b/drivers/hwmon/Kconfig
+index c4578e8f34bb5..ccdaeafed0bb7 100644
+--- a/drivers/hwmon/Kconfig
++++ b/drivers/hwmon/Kconfig
+@@ -1317,7 +1317,7 @@ config SENSORS_LM90
+         Maxim MAX6646, MAX6647, MAX6648, MAX6649, MAX6654, MAX6657, MAX6658,
+         MAX6659, MAX6680, MAX6681, MAX6692, MAX6695, MAX6696,
+         ON Semiconductor NCT1008, Winbond/Nuvoton W83L771W/G/AWG/ASG,
+-        Philips SA56004, GMT G781, and Texas Instruments TMP451
++        Philips SA56004, GMT G781, Texas Instruments TMP451 and TMP461
+         sensor chips.
+         This driver can also be built as a module. If so, the module
+diff --git a/drivers/hwmon/lm90.c b/drivers/hwmon/lm90.c
+index 0463179be5504..72969ea83d82e 100644
+--- a/drivers/hwmon/lm90.c
++++ b/drivers/hwmon/lm90.c
+@@ -69,10 +69,10 @@
+  * This driver also supports the G781 from GMT. This device is compatible
+  * with the ADM1032.
+  *
+- * This driver also supports TMP451 from Texas Instruments. This device is
+- * supported in both compatibility and extended mode. It's mostly compatible
+- * with ADT7461 except for local temperature low byte register and max
+- * conversion rate.
++ * This driver also supports TMP451 and TMP461 from Texas Instruments.
++ * Those devices are supported in both compatibility and extended mode.
++ * They are mostly compatible with ADT7461 except for local temperature
++ * low byte register and max conversion rate.
+  *
+  * Since the LM90 was the first chipset supported by this driver, most
+  * comments will refer to this chipset, but are actually general and
+@@ -112,7 +112,7 @@ static const unsigned short normal_i2c[] = {
+       0x4d, 0x4e, 0x4f, I2C_CLIENT_END };
+ enum chips { lm90, adm1032, lm99, lm86, max6657, max6659, adt7461, max6680,
+-      max6646, w83l771, max6696, sa56004, g781, tmp451, max6654 };
++      max6646, w83l771, max6696, sa56004, g781, tmp451, tmp461, max6654 };
+ /*
+  * The LM90 registers
+@@ -168,8 +168,12 @@ enum chips { lm90, adm1032, lm99, lm86, max6657, max6659, adt7461, max6680,
+ #define LM90_MAX_CONVRATE_MS  16000   /* Maximum conversion rate in ms */
+-/* TMP451 registers */
++/* TMP451/TMP461 registers */
+ #define TMP451_REG_R_LOCAL_TEMPL      0x15
++#define TMP451_REG_CONALERT           0x22
++
++#define TMP461_REG_CHEN                       0x16
++#define TMP461_REG_DFC                        0x24
+ /*
+  * Device flags
+@@ -230,6 +234,7 @@ static const struct i2c_device_id lm90_id[] = {
+       { "w83l771", w83l771 },
+       { "sa56004", sa56004 },
+       { "tmp451", tmp451 },
++      { "tmp461", tmp461 },
+       { }
+ };
+ MODULE_DEVICE_TABLE(i2c, lm90_id);
+@@ -327,6 +332,10 @@ static const struct of_device_id __maybe_unused lm90_of_match[] = {
+               .compatible = "ti,tmp451",
+               .data = (void *)tmp451
+       },
++      {
++              .compatible = "ti,tmp461",
++              .data = (void *)tmp461
++      },
+       { },
+ };
+ MODULE_DEVICE_TABLE(of, lm90_of_match);
+@@ -428,6 +437,13 @@ static const struct lm90_params lm90_params[] = {
+               .max_convrate = 9,
+               .reg_local_ext = TMP451_REG_R_LOCAL_TEMPL,
+       },
++      [tmp461] = {
++              .flags = LM90_HAVE_OFFSET | LM90_HAVE_REM_LIMIT_EXT
++                | LM90_HAVE_BROKEN_ALERT | LM90_HAVE_EXTENDED_TEMP,
++              .alert_alarms = 0x7c,
++              .max_convrate = 9,
++              .reg_local_ext = TMP451_REG_R_LOCAL_TEMPL,
++      },
+ };
+ /*
+@@ -1627,18 +1643,26 @@ static int lm90_detect(struct i2c_client *client,
+                && convrate <= 0x08)
+                       name = "g781";
+       } else
+-      if (address == 0x4C
+-       && man_id == 0x55) { /* Texas Instruments */
+-              int local_ext;
++      if (man_id == 0x55 && chip_id == 0x00 &&
++          (config1 & 0x1B) == 0x00 && convrate <= 0x09) {
++              int local_ext, conalert, chen, dfc;
+               local_ext = i2c_smbus_read_byte_data(client,
+                                                    TMP451_REG_R_LOCAL_TEMPL);
+-
+-              if (chip_id == 0x00 /* TMP451 */
+-               && (config1 & 0x1B) == 0x00
+-               && convrate <= 0x09
+-               && (local_ext & 0x0F) == 0x00)
+-                      name = "tmp451";
++              conalert = i2c_smbus_read_byte_data(client,
++                                                  TMP451_REG_CONALERT);
++              chen = i2c_smbus_read_byte_data(client, TMP461_REG_CHEN);
++              dfc = i2c_smbus_read_byte_data(client, TMP461_REG_DFC);
++
++              if ((local_ext & 0x0F) == 0x00 &&
++                  (conalert & 0xf1) == 0x01 &&
++                  (chen & 0xfc) == 0x00 &&
++                  (dfc & 0xfc) == 0x00) {
++                      if (address == 0x4c && !(chen & 0x03))
++                              name = "tmp451";
++                      else if (address >= 0x48 && address <= 0x4f)
++                              name = "tmp461";
++              }
+       }
+       if (!name) { /* identification failed */
+-- 
+2.34.1
+
diff --git a/queue-5.15/hwmon-lm90-drop-critical-attribute-support-for-max66.patch b/queue-5.15/hwmon-lm90-drop-critical-attribute-support-for-max66.patch
new file mode 100644 (file)
index 0000000..db21254
--- /dev/null
@@ -0,0 +1,224 @@
+From c65a122f668665d440d287b291523372d5a7af8b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 13 Nov 2021 08:55:06 -0800
+Subject: hwmon: (lm90) Drop critical attribute support for MAX6654
+
+From: Guenter Roeck <linux@roeck-us.net>
+
+[ Upstream commit 16ba51b5dcd3f6dde2e51d5ccc86313119dcf889 ]
+
+Tests with a real chip and a closer look into the datasheet show that
+MAX6654 does not support CRIT/THERM/OVERTEMP limits, so drop support
+of the respective attributes for this chip.
+
+Introduce LM90_HAVE_CRIT flag and use it to instantiate critical limit
+attributes to solve the problem.
+
+Cc: Josh Lehan <krellan@google.com>
+Fixes: 229d495d8189 ("hwmon: (lm90) Add max6654 support to lm90 driver")
+Signed-off-by: Guenter Roeck <linux@roeck-us.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/hwmon/lm90.c | 86 +++++++++++++++++++++++++-------------------
+ 1 file changed, 49 insertions(+), 37 deletions(-)
+
+diff --git a/drivers/hwmon/lm90.c b/drivers/hwmon/lm90.c
+index 72969ea83d82e..6597d055e09d8 100644
+--- a/drivers/hwmon/lm90.c
++++ b/drivers/hwmon/lm90.c
+@@ -35,13 +35,14 @@
+  * explicitly as max6659, or if its address is not 0x4c.
+  * These chips lack the remote temperature offset feature.
+  *
+- * This driver also supports the MAX6654 chip made by Maxim. This chip can
+- * be at 9 different addresses, similar to MAX6680/MAX6681. The MAX6654 is
+- * otherwise similar to MAX6657/MAX6658/MAX6659. Extended range is available
+- * by setting the configuration register accordingly, and is done during
+- * initialization. Extended precision is only available at conversion rates
+- * of 1 Hz and slower. Note that extended precision is not enabled by
+- * default, as this driver initializes all chips to 2 Hz by design.
++ * This driver also supports the MAX6654 chip made by Maxim. This chip can be
++ * at 9 different addresses, similar to MAX6680/MAX6681. The MAX6654 is similar
++ * to MAX6657/MAX6658/MAX6659, but does not support critical temperature
++ * limits. Extended range is available by setting the configuration register
++ * accordingly, and is done during initialization. Extended precision is only
++ * available at conversion rates of 1 Hz and slower. Note that extended
++ * precision is not enabled by default, as this driver initializes all chips
++ * to 2 Hz by design.
+  *
+  * This driver also supports the MAX6646, MAX6647, MAX6648, MAX6649 and
+  * MAX6692 chips made by Maxim.  These are again similar to the LM86,
+@@ -188,6 +189,7 @@ enum chips { lm90, adm1032, lm99, lm86, max6657, max6659, adt7461, max6680,
+ #define LM90_HAVE_BROKEN_ALERT        (1 << 7) /* Broken alert                */
+ #define LM90_HAVE_EXTENDED_TEMP       (1 << 8) /* extended temperature support*/
+ #define LM90_PAUSE_FOR_CONFIG (1 << 9) /* Pause conversion for config */
++#define LM90_HAVE_CRIT                (1 << 10)/* Chip supports CRIT/OVERT register   */
+ /* LM90 status */
+ #define LM90_STATUS_LTHRM     (1 << 0) /* local THERM limit tripped */
+@@ -354,38 +356,43 @@ struct lm90_params {
+ static const struct lm90_params lm90_params[] = {
+       [adm1032] = {
+               .flags = LM90_HAVE_OFFSET | LM90_HAVE_REM_LIMIT_EXT
+-                | LM90_HAVE_BROKEN_ALERT,
++                | LM90_HAVE_BROKEN_ALERT | LM90_HAVE_CRIT,
+               .alert_alarms = 0x7c,
+               .max_convrate = 10,
+       },
+       [adt7461] = {
+               .flags = LM90_HAVE_OFFSET | LM90_HAVE_REM_LIMIT_EXT
+-                | LM90_HAVE_BROKEN_ALERT | LM90_HAVE_EXTENDED_TEMP,
++                | LM90_HAVE_BROKEN_ALERT | LM90_HAVE_EXTENDED_TEMP
++                | LM90_HAVE_CRIT,
+               .alert_alarms = 0x7c,
+               .max_convrate = 10,
+       },
+       [g781] = {
+               .flags = LM90_HAVE_OFFSET | LM90_HAVE_REM_LIMIT_EXT
+-                | LM90_HAVE_BROKEN_ALERT,
++                | LM90_HAVE_BROKEN_ALERT | LM90_HAVE_CRIT,
+               .alert_alarms = 0x7c,
+               .max_convrate = 8,
+       },
+       [lm86] = {
+-              .flags = LM90_HAVE_OFFSET | LM90_HAVE_REM_LIMIT_EXT,
++              .flags = LM90_HAVE_OFFSET | LM90_HAVE_REM_LIMIT_EXT
++                | LM90_HAVE_CRIT,
+               .alert_alarms = 0x7b,
+               .max_convrate = 9,
+       },
+       [lm90] = {
+-              .flags = LM90_HAVE_OFFSET | LM90_HAVE_REM_LIMIT_EXT,
++              .flags = LM90_HAVE_OFFSET | LM90_HAVE_REM_LIMIT_EXT
++                | LM90_HAVE_CRIT,
+               .alert_alarms = 0x7b,
+               .max_convrate = 9,
+       },
+       [lm99] = {
+-              .flags = LM90_HAVE_OFFSET | LM90_HAVE_REM_LIMIT_EXT,
++              .flags = LM90_HAVE_OFFSET | LM90_HAVE_REM_LIMIT_EXT
++                | LM90_HAVE_CRIT,
+               .alert_alarms = 0x7b,
+               .max_convrate = 9,
+       },
+       [max6646] = {
++              .flags = LM90_HAVE_CRIT,
+               .alert_alarms = 0x7c,
+               .max_convrate = 6,
+               .reg_local_ext = MAX6657_REG_R_LOCAL_TEMPL,
+@@ -396,50 +403,50 @@ static const struct lm90_params lm90_params[] = {
+               .reg_local_ext = MAX6657_REG_R_LOCAL_TEMPL,
+       },
+       [max6657] = {
+-              .flags = LM90_PAUSE_FOR_CONFIG,
++              .flags = LM90_PAUSE_FOR_CONFIG | LM90_HAVE_CRIT,
+               .alert_alarms = 0x7c,
+               .max_convrate = 8,
+               .reg_local_ext = MAX6657_REG_R_LOCAL_TEMPL,
+       },
+       [max6659] = {
+-              .flags = LM90_HAVE_EMERGENCY,
++              .flags = LM90_HAVE_EMERGENCY | LM90_HAVE_CRIT,
+               .alert_alarms = 0x7c,
+               .max_convrate = 8,
+               .reg_local_ext = MAX6657_REG_R_LOCAL_TEMPL,
+       },
+       [max6680] = {
+-              .flags = LM90_HAVE_OFFSET,
++              .flags = LM90_HAVE_OFFSET | LM90_HAVE_CRIT,
+               .alert_alarms = 0x7c,
+               .max_convrate = 7,
+       },
+       [max6696] = {
+               .flags = LM90_HAVE_EMERGENCY
+-                | LM90_HAVE_EMERGENCY_ALARM | LM90_HAVE_TEMP3,
++                | LM90_HAVE_EMERGENCY_ALARM | LM90_HAVE_TEMP3 | LM90_HAVE_CRIT,
+               .alert_alarms = 0x1c7c,
+               .max_convrate = 6,
+               .reg_local_ext = MAX6657_REG_R_LOCAL_TEMPL,
+       },
+       [w83l771] = {
+-              .flags = LM90_HAVE_OFFSET | LM90_HAVE_REM_LIMIT_EXT,
++              .flags = LM90_HAVE_OFFSET | LM90_HAVE_REM_LIMIT_EXT | LM90_HAVE_CRIT,
+               .alert_alarms = 0x7c,
+               .max_convrate = 8,
+       },
+       [sa56004] = {
+-              .flags = LM90_HAVE_OFFSET | LM90_HAVE_REM_LIMIT_EXT,
++              .flags = LM90_HAVE_OFFSET | LM90_HAVE_REM_LIMIT_EXT | LM90_HAVE_CRIT,
+               .alert_alarms = 0x7b,
+               .max_convrate = 9,
+               .reg_local_ext = SA56004_REG_R_LOCAL_TEMPL,
+       },
+       [tmp451] = {
+               .flags = LM90_HAVE_OFFSET | LM90_HAVE_REM_LIMIT_EXT
+-                | LM90_HAVE_BROKEN_ALERT | LM90_HAVE_EXTENDED_TEMP,
++                | LM90_HAVE_BROKEN_ALERT | LM90_HAVE_EXTENDED_TEMP | LM90_HAVE_CRIT,
+               .alert_alarms = 0x7c,
+               .max_convrate = 9,
+               .reg_local_ext = TMP451_REG_R_LOCAL_TEMPL,
+       },
+       [tmp461] = {
+               .flags = LM90_HAVE_OFFSET | LM90_HAVE_REM_LIMIT_EXT
+-                | LM90_HAVE_BROKEN_ALERT | LM90_HAVE_EXTENDED_TEMP,
++                | LM90_HAVE_BROKEN_ALERT | LM90_HAVE_EXTENDED_TEMP | LM90_HAVE_CRIT,
+               .alert_alarms = 0x7c,
+               .max_convrate = 9,
+               .reg_local_ext = TMP451_REG_R_LOCAL_TEMPL,
+@@ -668,20 +675,22 @@ static int lm90_update_limits(struct device *dev)
+       struct i2c_client *client = data->client;
+       int val;
+-      val = lm90_read_reg(client, LM90_REG_R_LOCAL_CRIT);
+-      if (val < 0)
+-              return val;
+-      data->temp8[LOCAL_CRIT] = val;
++      if (data->flags & LM90_HAVE_CRIT) {
++              val = lm90_read_reg(client, LM90_REG_R_LOCAL_CRIT);
++              if (val < 0)
++                      return val;
++              data->temp8[LOCAL_CRIT] = val;
+-      val = lm90_read_reg(client, LM90_REG_R_REMOTE_CRIT);
+-      if (val < 0)
+-              return val;
+-      data->temp8[REMOTE_CRIT] = val;
++              val = lm90_read_reg(client, LM90_REG_R_REMOTE_CRIT);
++              if (val < 0)
++                      return val;
++              data->temp8[REMOTE_CRIT] = val;
+-      val = lm90_read_reg(client, LM90_REG_R_TCRIT_HYST);
+-      if (val < 0)
+-              return val;
+-      data->temp_hyst = val;
++              val = lm90_read_reg(client, LM90_REG_R_TCRIT_HYST);
++              if (val < 0)
++                      return val;
++              data->temp_hyst = val;
++      }
+       val = lm90_read_reg(client, LM90_REG_R_REMOTE_LOWH);
+       if (val < 0)
+@@ -1902,11 +1911,14 @@ static int lm90_probe(struct i2c_client *client)
+       info->config = data->channel_config;
+       data->channel_config[0] = HWMON_T_INPUT | HWMON_T_MIN | HWMON_T_MAX |
+-              HWMON_T_CRIT | HWMON_T_CRIT_HYST | HWMON_T_MIN_ALARM |
+-              HWMON_T_MAX_ALARM | HWMON_T_CRIT_ALARM;
++              HWMON_T_MIN_ALARM | HWMON_T_MAX_ALARM;
+       data->channel_config[1] = HWMON_T_INPUT | HWMON_T_MIN | HWMON_T_MAX |
+-              HWMON_T_CRIT | HWMON_T_CRIT_HYST | HWMON_T_MIN_ALARM |
+-              HWMON_T_MAX_ALARM | HWMON_T_CRIT_ALARM | HWMON_T_FAULT;
++              HWMON_T_MIN_ALARM | HWMON_T_MAX_ALARM | HWMON_T_FAULT;
++
++      if (data->flags & LM90_HAVE_CRIT) {
++              data->channel_config[0] |= HWMON_T_CRIT | HWMON_T_CRIT_ALARM | HWMON_T_CRIT_HYST;
++              data->channel_config[1] |= HWMON_T_CRIT | HWMON_T_CRIT_ALARM | HWMON_T_CRIT_HYST;
++      }
+       if (data->flags & LM90_HAVE_OFFSET)
+               data->channel_config[1] |= HWMON_T_OFFSET;
+-- 
+2.34.1
+
diff --git a/queue-5.15/hwmon-lm90-fix-usage-of-config2-register-in-detect-f.patch b/queue-5.15/hwmon-lm90-fix-usage-of-config2-register-in-detect-f.patch
new file mode 100644 (file)
index 0000000..ac4fe7b
--- /dev/null
@@ -0,0 +1,50 @@
+From b8d36324047697fdcf9eb8232d491c9d3971186e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 6 Nov 2021 10:02:44 -0700
+Subject: hwmon: (lm90) Fix usage of CONFIG2 register in detect function
+
+From: Guenter Roeck <linux@roeck-us.net>
+
+[ Upstream commit fce15c45d3fbd9fc1feaaf3210d8e3f8b33dfd3a ]
+
+The detect function had a comment "Make compiler happy" when id did not
+read the second configuration register. As it turns out, the code was
+checking the contents of this register for manufacturer ID 0xA1 (NXP
+Semiconductor/Philips), but never actually read the register. So it
+wasn't surprising that the compiler complained, and it indeed had a point.
+Fix the code to read the register contents for manufacturer ID 0xa1.
+
+At the same time, the code was reading the register for manufacturer ID
+0x41 (Analog Devices), but it was not using the results. In effect it was
+just checking if reading the register returned an error. That doesn't
+really add much if any value, so stop doing that.
+
+Fixes: f90be42fb383 ("hwmon: (lm90) Refactor reading of config2 register")
+Signed-off-by: Guenter Roeck <linux@roeck-us.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/hwmon/lm90.c | 5 ++---
+ 1 file changed, 2 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/hwmon/lm90.c b/drivers/hwmon/lm90.c
+index 567b7c521f388..d40e3bb801d07 100644
+--- a/drivers/hwmon/lm90.c
++++ b/drivers/hwmon/lm90.c
+@@ -1448,12 +1448,11 @@ static int lm90_detect(struct i2c_client *client,
+       if (man_id < 0 || chip_id < 0 || config1 < 0 || convrate < 0)
+               return -ENODEV;
+-      if (man_id == 0x01 || man_id == 0x5C || man_id == 0x41) {
++      if (man_id == 0x01 || man_id == 0x5C || man_id == 0xA1) {
+               config2 = i2c_smbus_read_byte_data(client, LM90_REG_R_CONFIG2);
+               if (config2 < 0)
+                       return -ENODEV;
+-      } else
+-              config2 = 0;            /* Make compiler happy */
++      }
+       if ((address == 0x4C || address == 0x4D)
+        && man_id == 0x01) { /* National Semiconductor */
+-- 
+2.34.1
+
diff --git a/queue-5.15/hwmon-lm90-introduce-flag-indicating-extended-temper.patch b/queue-5.15/hwmon-lm90-introduce-flag-indicating-extended-temper.patch
new file mode 100644 (file)
index 0000000..00234bc
--- /dev/null
@@ -0,0 +1,117 @@
+From 16459f470f009f3609d7002f2d56c4413ebbaf7b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 21 Oct 2021 01:49:50 -0700
+Subject: hwmon: (lm90) Introduce flag indicating extended temperature support
+
+From: Guenter Roeck <linux@roeck-us.net>
+
+[ Upstream commit f347e249fcf920ad6974cbd898e2ec0b366a1c34 ]
+
+A flag indicating extended temperature support makes it easier
+to add support for additional chips with this functionality.
+
+Cc: David T. Wilson <david.wilson@nasa.gov>
+Signed-off-by: Guenter Roeck <linux@roeck-us.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/hwmon/lm90.c | 21 +++++++++++----------
+ 1 file changed, 11 insertions(+), 10 deletions(-)
+
+diff --git a/drivers/hwmon/lm90.c b/drivers/hwmon/lm90.c
+index f6e6c7c6c73f8..0463179be5504 100644
+--- a/drivers/hwmon/lm90.c
++++ b/drivers/hwmon/lm90.c
+@@ -182,7 +182,8 @@ enum chips { lm90, adm1032, lm99, lm86, max6657, max6659, adt7461, max6680,
+ #define LM90_HAVE_EMERGENCY_ALARM (1 << 5)/* emergency alarm          */
+ #define LM90_HAVE_TEMP3               (1 << 6) /* 3rd temperature sensor      */
+ #define LM90_HAVE_BROKEN_ALERT        (1 << 7) /* Broken alert                */
+-#define LM90_PAUSE_FOR_CONFIG (1 << 8) /* Pause conversion for config */
++#define LM90_HAVE_EXTENDED_TEMP       (1 << 8) /* extended temperature support*/
++#define LM90_PAUSE_FOR_CONFIG (1 << 9) /* Pause conversion for config */
+ /* LM90 status */
+ #define LM90_STATUS_LTHRM     (1 << 0) /* local THERM limit tripped */
+@@ -350,7 +351,7 @@ static const struct lm90_params lm90_params[] = {
+       },
+       [adt7461] = {
+               .flags = LM90_HAVE_OFFSET | LM90_HAVE_REM_LIMIT_EXT
+-                | LM90_HAVE_BROKEN_ALERT,
++                | LM90_HAVE_BROKEN_ALERT | LM90_HAVE_EXTENDED_TEMP,
+               .alert_alarms = 0x7c,
+               .max_convrate = 10,
+       },
+@@ -422,7 +423,7 @@ static const struct lm90_params lm90_params[] = {
+       },
+       [tmp451] = {
+               .flags = LM90_HAVE_OFFSET | LM90_HAVE_REM_LIMIT_EXT
+-                | LM90_HAVE_BROKEN_ALERT,
++                | LM90_HAVE_BROKEN_ALERT | LM90_HAVE_EXTENDED_TEMP,
+               .alert_alarms = 0x7c,
+               .max_convrate = 9,
+               .reg_local_ext = TMP451_REG_R_LOCAL_TEMPL,
+@@ -998,7 +999,7 @@ static int lm90_get_temp11(struct lm90_data *data, int index)
+       s16 temp11 = data->temp11[index];
+       int temp;
+-      if (data->kind == adt7461 || data->kind == tmp451)
++      if (data->flags & LM90_HAVE_EXTENDED_TEMP)
+               temp = temp_from_u16_adt7461(data, temp11);
+       else if (data->kind == max6646)
+               temp = temp_from_u16(temp11);
+@@ -1035,7 +1036,7 @@ static int lm90_set_temp11(struct lm90_data *data, int index, long val)
+               val -= 16000;
+       }
+-      if (data->kind == adt7461 || data->kind == tmp451)
++      if (data->flags & LM90_HAVE_EXTENDED_TEMP)
+               data->temp11[index] = temp_to_u16_adt7461(data, val);
+       else if (data->kind == max6646)
+               data->temp11[index] = temp_to_u8(val) << 8;
+@@ -1062,7 +1063,7 @@ static int lm90_get_temp8(struct lm90_data *data, int index)
+       s8 temp8 = data->temp8[index];
+       int temp;
+-      if (data->kind == adt7461 || data->kind == tmp451)
++      if (data->flags & LM90_HAVE_EXTENDED_TEMP)
+               temp = temp_from_u8_adt7461(data, temp8);
+       else if (data->kind == max6646)
+               temp = temp_from_u8(temp8);
+@@ -1098,7 +1099,7 @@ static int lm90_set_temp8(struct lm90_data *data, int index, long val)
+               val -= 16000;
+       }
+-      if (data->kind == adt7461 || data->kind == tmp451)
++      if (data->flags & LM90_HAVE_EXTENDED_TEMP)
+               data->temp8[index] = temp_to_u8_adt7461(data, val);
+       else if (data->kind == max6646)
+               data->temp8[index] = temp_to_u8(val);
+@@ -1116,7 +1117,7 @@ static int lm90_get_temphyst(struct lm90_data *data, int index)
+ {
+       int temp;
+-      if (data->kind == adt7461 || data->kind == tmp451)
++      if (data->flags & LM90_HAVE_EXTENDED_TEMP)
+               temp = temp_from_u8_adt7461(data, data->temp8[index]);
+       else if (data->kind == max6646)
+               temp = temp_from_u8(data->temp8[index]);
+@@ -1136,7 +1137,7 @@ static int lm90_set_temphyst(struct lm90_data *data, long val)
+       int temp;
+       int err;
+-      if (data->kind == adt7461 || data->kind == tmp451)
++      if (data->flags & LM90_HAVE_EXTENDED_TEMP)
+               temp = temp_from_u8_adt7461(data, data->temp8[LOCAL_CRIT]);
+       else if (data->kind == max6646)
+               temp = temp_from_u8(data->temp8[LOCAL_CRIT]);
+@@ -1684,7 +1685,7 @@ static int lm90_init_client(struct i2c_client *client, struct lm90_data *data)
+       lm90_set_convrate(client, data, 500); /* 500ms; 2Hz conversion rate */
+       /* Check Temperature Range Select */
+-      if (data->kind == adt7461 || data->kind == tmp451) {
++      if (data->flags & LM90_HAVE_EXTENDED_TEMP) {
+               if (config & 0x04)
+                       data->flags |= LM90_FLAG_ADT7461_EXT;
+       }
+-- 
+2.34.1
+
diff --git a/queue-5.15/hwmon-lm90-prevent-integer-overflow-underflow-in-hys.patch b/queue-5.15/hwmon-lm90-prevent-integer-overflow-underflow-in-hys.patch
new file mode 100644 (file)
index 0000000..0fea7e7
--- /dev/null
@@ -0,0 +1,46 @@
+From 7e0adc361d0a687c753a2278f8d41b303da591c3 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 17 Nov 2021 09:51:47 -0800
+Subject: hwmon: (lm90) Prevent integer overflow/underflow in hysteresis
+ calculations
+
+From: Guenter Roeck <linux@roeck-us.net>
+
+[ Upstream commit 55840b9eae5367b5d5b29619dc2fb7e4596dba46 ]
+
+Commit b50aa49638c7 ("hwmon: (lm90) Prevent integer underflows of
+temperature calculations") addressed a number of underflow situations
+when writing temperature limits. However, it missed one situation, seen
+when an attempt is made to set the hysteresis value to MAX_LONG and the
+critical temperature limit is negative.
+
+Use clamp_val() when setting the hysteresis temperature to ensure that
+the provided value can never overflow or underflow.
+
+Fixes: b50aa49638c7 ("hwmon: (lm90) Prevent integer underflows of temperature calculations")
+Cc: Dmitry Osipenko <digetx@gmail.com>
+Reviewed-by: Dmitry Osipenko <digetx@gmail.com>
+Signed-off-by: Guenter Roeck <linux@roeck-us.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/hwmon/lm90.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/hwmon/lm90.c b/drivers/hwmon/lm90.c
+index d40e3bb801d07..f6e6c7c6c73f8 100644
+--- a/drivers/hwmon/lm90.c
++++ b/drivers/hwmon/lm90.c
+@@ -1143,8 +1143,8 @@ static int lm90_set_temphyst(struct lm90_data *data, long val)
+       else
+               temp = temp_from_s8(data->temp8[LOCAL_CRIT]);
+-      /* prevent integer underflow */
+-      val = max(val, -128000l);
++      /* prevent integer overflow/underflow */
++      val = clamp_val(val, -128000l, 255000l);
+       data->temp_hyst = hyst_to_reg(temp - val);
+       err = i2c_smbus_write_byte_data(client, LM90_REG_W_TCRIT_HYST,
+-- 
+2.34.1
+
diff --git a/queue-5.15/input-elantech-fix-stack-out-of-bound-access-in-elan.patch b/queue-5.15/input-elantech-fix-stack-out-of-bound-access-in-elan.patch
new file mode 100644 (file)
index 0000000..e8e244f
--- /dev/null
@@ -0,0 +1,139 @@
+From 9e8d42c2e2794d0c09044d97cc0e35d06bdb4a26 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 29 Nov 2021 00:08:13 -0800
+Subject: Input: elantech - fix stack out of bound access in
+ elantech_change_report_id()
+
+From: Andrea Righi <andrea.righi@canonical.com>
+
+[ Upstream commit 1d72d9f960ccf1052a0630a68c3d358791dbdaaa ]
+
+The array param[] in elantech_change_report_id() must be at least 3
+bytes, because elantech_read_reg_params() is calling ps2_command() with
+PSMOUSE_CMD_GETINFO, that is going to access 3 bytes from param[], but
+it's defined in the stack as an array of 2 bytes, therefore we have a
+potential stack out-of-bounds access here, also confirmed by KASAN:
+
+[    6.512374] BUG: KASAN: stack-out-of-bounds in __ps2_command+0x372/0x7e0
+[    6.512397] Read of size 1 at addr ffff8881024d77c2 by task kworker/2:1/118
+
+[    6.512416] CPU: 2 PID: 118 Comm: kworker/2:1 Not tainted 5.13.0-22-generic #22+arighi20211110
+[    6.512428] Hardware name: LENOVO 20T8000QGE/20T8000QGE, BIOS R1AET32W (1.08 ) 08/14/2020
+[    6.512436] Workqueue: events_long serio_handle_event
+[    6.512453] Call Trace:
+[    6.512462]  show_stack+0x52/0x58
+[    6.512474]  dump_stack+0xa1/0xd3
+[    6.512487]  print_address_description.constprop.0+0x1d/0x140
+[    6.512502]  ? __ps2_command+0x372/0x7e0
+[    6.512516]  __kasan_report.cold+0x7d/0x112
+[    6.512527]  ? _raw_write_lock_irq+0x20/0xd0
+[    6.512539]  ? __ps2_command+0x372/0x7e0
+[    6.512552]  kasan_report+0x3c/0x50
+[    6.512564]  __asan_load1+0x6a/0x70
+[    6.512575]  __ps2_command+0x372/0x7e0
+[    6.512589]  ? ps2_drain+0x240/0x240
+[    6.512601]  ? dev_printk_emit+0xa2/0xd3
+[    6.512612]  ? dev_vprintk_emit+0xc5/0xc5
+[    6.512621]  ? __kasan_check_write+0x14/0x20
+[    6.512634]  ? mutex_lock+0x8f/0xe0
+[    6.512643]  ? __mutex_lock_slowpath+0x20/0x20
+[    6.512655]  ps2_command+0x52/0x90
+[    6.512670]  elantech_ps2_command+0x4f/0xc0 [psmouse]
+[    6.512734]  elantech_change_report_id+0x1e6/0x256 [psmouse]
+[    6.512799]  ? elantech_report_trackpoint.constprop.0.cold+0xd/0xd [psmouse]
+[    6.512863]  ? ps2_command+0x7f/0x90
+[    6.512877]  elantech_query_info.cold+0x6bd/0x9ed [psmouse]
+[    6.512943]  ? elantech_setup_ps2+0x460/0x460 [psmouse]
+[    6.513005]  ? psmouse_reset+0x69/0xb0 [psmouse]
+[    6.513064]  ? psmouse_attr_set_helper+0x2a0/0x2a0 [psmouse]
+[    6.513122]  ? phys_pmd_init+0x30e/0x521
+[    6.513137]  elantech_init+0x8a/0x200 [psmouse]
+[    6.513200]  ? elantech_init_ps2+0xf0/0xf0 [psmouse]
+[    6.513249]  ? elantech_query_info+0x440/0x440 [psmouse]
+[    6.513296]  ? synaptics_send_cmd+0x60/0x60 [psmouse]
+[    6.513342]  ? elantech_query_info+0x440/0x440 [psmouse]
+[    6.513388]  ? psmouse_try_protocol+0x11e/0x170 [psmouse]
+[    6.513432]  psmouse_extensions+0x65d/0x6e0 [psmouse]
+[    6.513476]  ? psmouse_try_protocol+0x170/0x170 [psmouse]
+[    6.513519]  ? mutex_unlock+0x22/0x40
+[    6.513526]  ? ps2_command+0x7f/0x90
+[    6.513536]  ? psmouse_probe+0xa3/0xf0 [psmouse]
+[    6.513580]  psmouse_switch_protocol+0x27d/0x2e0 [psmouse]
+[    6.513624]  psmouse_connect+0x272/0x530 [psmouse]
+[    6.513669]  serio_driver_probe+0x55/0x70
+[    6.513679]  really_probe+0x190/0x720
+[    6.513689]  driver_probe_device+0x160/0x1f0
+[    6.513697]  device_driver_attach+0x119/0x130
+[    6.513705]  ? device_driver_attach+0x130/0x130
+[    6.513713]  __driver_attach+0xe7/0x1a0
+[    6.513720]  ? device_driver_attach+0x130/0x130
+[    6.513728]  bus_for_each_dev+0xfb/0x150
+[    6.513738]  ? subsys_dev_iter_exit+0x10/0x10
+[    6.513748]  ? _raw_write_unlock_bh+0x30/0x30
+[    6.513757]  driver_attach+0x2d/0x40
+[    6.513764]  serio_handle_event+0x199/0x3d0
+[    6.513775]  process_one_work+0x471/0x740
+[    6.513785]  worker_thread+0x2d2/0x790
+[    6.513794]  ? process_one_work+0x740/0x740
+[    6.513802]  kthread+0x1b4/0x1e0
+[    6.513809]  ? set_kthread_struct+0x80/0x80
+[    6.513816]  ret_from_fork+0x22/0x30
+
+[    6.513832] The buggy address belongs to the page:
+[    6.513838] page:00000000bc35e189 refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x1024d7
+[    6.513847] flags: 0x17ffffc0000000(node=0|zone=2|lastcpupid=0x1fffff)
+[    6.513860] raw: 0017ffffc0000000 dead000000000100 dead000000000122 0000000000000000
+[    6.513867] raw: 0000000000000000 0000000000000000 00000000ffffffff 0000000000000000
+[    6.513872] page dumped because: kasan: bad access detected
+
+[    6.513879] addr ffff8881024d77c2 is located in stack of task kworker/2:1/118 at offset 34 in frame:
+[    6.513887]  elantech_change_report_id+0x0/0x256 [psmouse]
+
+[    6.513941] this frame has 1 object:
+[    6.513947]  [32, 34) 'param'
+
+[    6.513956] Memory state around the buggy address:
+[    6.513962]  ffff8881024d7680: f2 f2 f2 f2 f2 00 00 f3 f3 00 00 00 00 00 00 00
+[    6.513969]  ffff8881024d7700: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
+[    6.513976] >ffff8881024d7780: 00 00 00 00 f1 f1 f1 f1 02 f3 f3 f3 00 00 00 00
+[    6.513982]                                            ^
+[    6.513988]  ffff8881024d7800: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
+[    6.513995]  ffff8881024d7880: 00 f1 f1 f1 f1 03 f2 03 f2 03 f3 f3 f3 00 00 00
+[    6.514000] ==================================================================
+
+Define param[] in elantech_change_report_id() as an array of 3 bytes to
+prevent the out-of-bounds access in the stack.
+
+Fixes: e4c9062717fe ("Input: elantech - fix protocol errors for some trackpoints in SMBus mode")
+BugLink: https://bugs.launchpad.net/bugs/1945590
+Signed-off-by: Andrea Righi <andrea.righi@canonical.com>
+Reviewed-by: Wolfram Sang <wsa@kernel.org>
+Link: https://lore.kernel.org/r/20211116095559.24395-1-andrea.righi@canonical.com
+Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/input/mouse/elantech.c | 8 +++++++-
+ 1 file changed, 7 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/input/mouse/elantech.c b/drivers/input/mouse/elantech.c
+index 956d9cd347964..ece97f8c6a3e3 100644
+--- a/drivers/input/mouse/elantech.c
++++ b/drivers/input/mouse/elantech.c
+@@ -1588,7 +1588,13 @@ static const struct dmi_system_id no_hw_res_dmi_table[] = {
+  */
+ static int elantech_change_report_id(struct psmouse *psmouse)
+ {
+-      unsigned char param[2] = { 0x10, 0x03 };
++      /*
++       * NOTE: the code is expecting to receive param[] as an array of 3
++       * items (see __ps2_command()), even if in this case only 2 are
++       * actually needed. Make sure the array size is 3 to avoid potential
++       * stack out-of-bound accesses.
++       */
++      unsigned char param[3] = { 0x10, 0x03 };
+       if (elantech_write_reg_params(psmouse, 0x7, param) ||
+           elantech_read_reg_params(psmouse, 0x7, param) ||
+-- 
+2.34.1
+
diff --git a/queue-5.15/kernel-crash_core-suppress-unknown-crashkernel-param.patch b/queue-5.15/kernel-crash_core-suppress-unknown-crashkernel-param.patch
new file mode 100644 (file)
index 0000000..dd05097
--- /dev/null
@@ -0,0 +1,69 @@
+From 0238da7eb34a4f2f7f70f1d29717bb89b1d93d25 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 24 Dec 2021 21:12:39 -0800
+Subject: kernel/crash_core: suppress unknown crashkernel parameter warning
+
+From: Philipp Rudo <prudo@redhat.com>
+
+[ Upstream commit 71d2bcec2d4d69ff109c497e6611d6c53c8926d4 ]
+
+When booting with crashkernel= on the kernel command line a warning
+similar to
+
+    Kernel command line: ro console=ttyS0 crashkernel=256M
+    Unknown kernel command line parameters "crashkernel=256M", will be passed to user space.
+
+is printed.
+
+This comes from crashkernel= being parsed independent from the kernel
+parameter handling mechanism.  So the code in init/main.c doesn't know
+that crashkernel= is a valid kernel parameter and prints this incorrect
+warning.
+
+Suppress the warning by adding a dummy early_param handler for
+crashkernel=.
+
+Link: https://lkml.kernel.org/r/20211208133443.6867-1-prudo@redhat.com
+Fixes: 86d1919a4fb0 ("init: print out unknown kernel parameters")
+Signed-off-by: Philipp Rudo <prudo@redhat.com>
+Acked-by: Baoquan He <bhe@redhat.com>
+Cc: Andrew Halaney <ahalaney@redhat.com>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ kernel/crash_core.c | 11 +++++++++++
+ 1 file changed, 11 insertions(+)
+
+diff --git a/kernel/crash_core.c b/kernel/crash_core.c
+index eb53f5ec62c90..256cf6db573cd 100644
+--- a/kernel/crash_core.c
++++ b/kernel/crash_core.c
+@@ -6,6 +6,7 @@
+ #include <linux/buildid.h>
+ #include <linux/crash_core.h>
++#include <linux/init.h>
+ #include <linux/utsname.h>
+ #include <linux/vmalloc.h>
+@@ -295,6 +296,16 @@ int __init parse_crashkernel_low(char *cmdline,
+                               "crashkernel=", suffix_tbl[SUFFIX_LOW]);
+ }
++/*
++ * Add a dummy early_param handler to mark crashkernel= as a known command line
++ * parameter and suppress incorrect warnings in init/main.c.
++ */
++static int __init parse_crashkernel_dummy(char *arg)
++{
++      return 0;
++}
++early_param("crashkernel", parse_crashkernel_dummy);
++
+ Elf_Word *append_elf_note(Elf_Word *buf, char *name, unsigned int type,
+                         void *data, size_t data_len)
+ {
+-- 
+2.34.1
+
diff --git a/queue-5.15/pinctrl-bcm2835-change-init-order-for-gpio-hogs.patch b/queue-5.15/pinctrl-bcm2835-change-init-order-for-gpio-hogs.patch
new file mode 100644 (file)
index 0000000..141e7f2
--- /dev/null
@@ -0,0 +1,95 @@
+From 528d1ef7b541545c9f6fc2944507a9a90a5fc545 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 6 Dec 2021 09:22:36 +0000
+Subject: pinctrl: bcm2835: Change init order for gpio hogs
+
+From: Phil Elwell <phil@raspberrypi.com>
+
+[ Upstream commit 266423e60ea1b953fcc0cd97f3dad85857e434d1 ]
+
+...and gpio-ranges
+
+pinctrl-bcm2835 is a combined pinctrl/gpio driver. Currently the gpio
+side is registered first, but this breaks gpio hogs (which are
+configured during gpiochip_add_data). Part of the hog initialisation
+is a call to pinctrl_gpio_request, and since the pinctrl driver hasn't
+yet been registered this results in an -EPROBE_DEFER from which it can
+never recover.
+
+Change the initialisation sequence to register the pinctrl driver
+first.
+
+This also solves a similar problem with the gpio-ranges property, which
+is required in order for released pins to be returned to inputs.
+
+Fixes: 73345a18d464b ("pinctrl: bcm2835: Pass irqchip when adding gpiochip")
+Signed-off-by: Phil Elwell <phil@raspberrypi.com>
+Reviewed-by: Florian Fainelli <f.fainelli@gmail.com>
+Link: https://lore.kernel.org/r/20211206092237.4105895-2-phil@raspberrypi.com
+Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pinctrl/bcm/pinctrl-bcm2835.c | 29 +++++++++++++++------------
+ 1 file changed, 16 insertions(+), 13 deletions(-)
+
+diff --git a/drivers/pinctrl/bcm/pinctrl-bcm2835.c b/drivers/pinctrl/bcm/pinctrl-bcm2835.c
+index 6e6fefeb21ead..cc39c0e18b474 100644
+--- a/drivers/pinctrl/bcm/pinctrl-bcm2835.c
++++ b/drivers/pinctrl/bcm/pinctrl-bcm2835.c
+@@ -1243,6 +1243,18 @@ static int bcm2835_pinctrl_probe(struct platform_device *pdev)
+               raw_spin_lock_init(&pc->irq_lock[i]);
+       }
++      pc->pctl_desc = *pdata->pctl_desc;
++      pc->pctl_dev = devm_pinctrl_register(dev, &pc->pctl_desc, pc);
++      if (IS_ERR(pc->pctl_dev)) {
++              gpiochip_remove(&pc->gpio_chip);
++              return PTR_ERR(pc->pctl_dev);
++      }
++
++      pc->gpio_range = *pdata->gpio_range;
++      pc->gpio_range.base = pc->gpio_chip.base;
++      pc->gpio_range.gc = &pc->gpio_chip;
++      pinctrl_add_gpio_range(pc->pctl_dev, &pc->gpio_range);
++
+       girq = &pc->gpio_chip.irq;
+       girq->chip = &bcm2835_gpio_irq_chip;
+       girq->parent_handler = bcm2835_gpio_irq_handler;
+@@ -1250,8 +1262,10 @@ static int bcm2835_pinctrl_probe(struct platform_device *pdev)
+       girq->parents = devm_kcalloc(dev, BCM2835_NUM_IRQS,
+                                    sizeof(*girq->parents),
+                                    GFP_KERNEL);
+-      if (!girq->parents)
++      if (!girq->parents) {
++              pinctrl_remove_gpio_range(pc->pctl_dev, &pc->gpio_range);
+               return -ENOMEM;
++      }
+       if (is_7211) {
+               pc->wake_irq = devm_kcalloc(dev, BCM2835_NUM_IRQS,
+@@ -1306,21 +1320,10 @@ static int bcm2835_pinctrl_probe(struct platform_device *pdev)
+       err = gpiochip_add_data(&pc->gpio_chip, pc);
+       if (err) {
+               dev_err(dev, "could not add GPIO chip\n");
++              pinctrl_remove_gpio_range(pc->pctl_dev, &pc->gpio_range);
+               return err;
+       }
+-      pc->pctl_desc = *pdata->pctl_desc;
+-      pc->pctl_dev = devm_pinctrl_register(dev, &pc->pctl_desc, pc);
+-      if (IS_ERR(pc->pctl_dev)) {
+-              gpiochip_remove(&pc->gpio_chip);
+-              return PTR_ERR(pc->pctl_dev);
+-      }
+-
+-      pc->gpio_range = *pdata->gpio_range;
+-      pc->gpio_range.base = pc->gpio_chip.base;
+-      pc->gpio_range.gc = &pc->gpio_chip;
+-      pinctrl_add_gpio_range(pc->pctl_dev, &pc->gpio_range);
+-
+       return 0;
+ }
+-- 
+2.34.1
+
diff --git a/queue-5.15/platform-x86-intel-remove-x86_platform_drivers_intel.patch b/queue-5.15/platform-x86-intel-remove-x86_platform_drivers_intel.patch
new file mode 100644 (file)
index 0000000..f6f2890
--- /dev/null
@@ -0,0 +1,75 @@
+From 2fc19d854520ddefd9bdeff67aa3c63bd4dac4b0 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 22 Dec 2021 21:49:41 +0200
+Subject: platform/x86/intel: Remove X86_PLATFORM_DRIVERS_INTEL
+
+From: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
+
+[ Upstream commit 4f6c131c3c31b9f68470ebd01320d5403d8719bb ]
+
+While introduction of this menu brings a nice view in the configuration tools,
+it brought more issues than solves, i.e. it prevents to locate files in the
+intel/ subfolder without touching non-related Kconfig dependencies elsewhere.
+Drop X86_PLATFORM_DRIVERS_INTEL altogether.
+
+Note, on x86 it's enabled by default and it's quite unlikely anybody wants to
+disable all of the modules in this submenu.
+
+Fixes: 8bd836feb6ca ("platform/x86: intel_skl_int3472: Move to intel/ subfolder")
+Suggested-by: Hans de Goede <hdegoede@redhat.com>
+Signed-off-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
+Link: https://lore.kernel.org/r/20211222194941.76054-1-andriy.shevchenko@linux.intel.com
+Reviewed-by: Hans de Goede <hdegoede@redhat.com>
+Signed-off-by: Hans de Goede <hdegoede@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/platform/x86/Makefile      |  2 +-
+ drivers/platform/x86/intel/Kconfig | 15 ---------------
+ 2 files changed, 1 insertion(+), 16 deletions(-)
+
+diff --git a/drivers/platform/x86/Makefile b/drivers/platform/x86/Makefile
+index 69690e26bb6d4..2734a771d1f00 100644
+--- a/drivers/platform/x86/Makefile
++++ b/drivers/platform/x86/Makefile
+@@ -67,7 +67,7 @@ obj-$(CONFIG_THINKPAD_ACPI)  += thinkpad_acpi.o
+ obj-$(CONFIG_THINKPAD_LMI)    += think-lmi.o
+ # Intel
+-obj-$(CONFIG_X86_PLATFORM_DRIVERS_INTEL)              += intel/
++obj-y                         += intel/
+ # MSI
+ obj-$(CONFIG_MSI_LAPTOP)      += msi-laptop.o
+diff --git a/drivers/platform/x86/intel/Kconfig b/drivers/platform/x86/intel/Kconfig
+index 0b21468e1bd01..02e4481b384e4 100644
+--- a/drivers/platform/x86/intel/Kconfig
++++ b/drivers/platform/x86/intel/Kconfig
+@@ -3,19 +3,6 @@
+ # Intel x86 Platform Specific Drivers
+ #
+-menuconfig X86_PLATFORM_DRIVERS_INTEL
+-      bool "Intel x86 Platform Specific Device Drivers"
+-      default y
+-      help
+-        Say Y here to get to see options for device drivers for
+-        various Intel x86 platforms, including vendor-specific
+-        drivers. This option alone does not add any kernel code.
+-
+-        If you say N, all options in this submenu will be skipped
+-        and disabled.
+-
+-if X86_PLATFORM_DRIVERS_INTEL
+-
+ source "drivers/platform/x86/intel/atomisp2/Kconfig"
+ source "drivers/platform/x86/intel/int1092/Kconfig"
+ source "drivers/platform/x86/intel/int33fe/Kconfig"
+@@ -167,5 +154,3 @@ config INTEL_UNCORE_FREQ_CONTROL
+         To compile this driver as a module, choose M here: the module
+         will be called intel-uncore-frequency.
+-
+-endif # X86_PLATFORM_DRIVERS_INTEL
+-- 
+2.34.1
+
index dd8e95fd7d54aacd91e8c63ee07f5514d009bb24..db91a5995e856a059c56b69ce3e731b627564ed8 100644 (file)
@@ -48,3 +48,15 @@ net-bridge-use-array_size-helper-in-copy_to_user.patch
 net-bridge-fix-ioctl-old_deviceless-bridge-argument.patch
 r8152-fix-the-force-speed-doesn-t-work-for-rtl8156.patch
 net-stmmac-dwmac-visconti-fix-value-of-ether_clk_sel.patch
+input-elantech-fix-stack-out-of-bound-access-in-elan.patch
+pinctrl-bcm2835-change-init-order-for-gpio-hogs.patch
+hwmon-lm90-fix-usage-of-config2-register-in-detect-f.patch
+hwmon-lm90-prevent-integer-overflow-underflow-in-hys.patch
+hwmon-lm90-introduce-flag-indicating-extended-temper.patch
+hwmon-lm90-add-basic-support-for-ti-tmp461.patch
+hwmon-lm90-drop-critical-attribute-support-for-max66.patch
+arm-9160-1-nommu-reload-__secondary_data-after-proci.patch
+uapi-fix-undefined-__always_inline-on-non-glibc-syst.patch
+compiler.h-fix-annotation-macro-misplacement-with-cl.patch
+platform-x86-intel-remove-x86_platform_drivers_intel.patch
+kernel-crash_core-suppress-unknown-crashkernel-param.patch
diff --git a/queue-5.15/uapi-fix-undefined-__always_inline-on-non-glibc-syst.patch b/queue-5.15/uapi-fix-undefined-__always_inline-on-non-glibc-syst.patch
new file mode 100644 (file)
index 0000000..7a85385
--- /dev/null
@@ -0,0 +1,62 @@
+From cc407a2ebe37adcfcd579a7bfb846da646a0ac54 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 15 Nov 2021 14:46:47 +0100
+Subject: uapi: Fix undefined __always_inline on non-glibc systems
+
+From: Ismael Luceno <ismael@iodev.co.uk>
+
+[ Upstream commit cb8747b7d2a9e3d687a19a007575071d4b71cd05 ]
+
+This macro is defined by glibc itself, which makes the issue go unnoticed on
+those systems.  On non-glibc systems it causes build failures on several
+utilities and libraries, like bpftool and objtool.
+
+Fixes: 1d509f2a6ebc ("x86/insn: Support big endian cross-compiles")
+Fixes: 2d7ce0e8a704 ("tools/virtio: more stubs")
+Fixes: 3fb321fde22d ("selftests/net: ipv6 flowlabel")
+Fixes: 50b3ed57dee9 ("selftests/bpf: test bpf flow dissection")
+Fixes: 9cacf81f8161 ("bpf: Remove extra lock_sock for TCP_ZEROCOPY_RECEIVE")
+Fixes: a4b2061242ec ("tools include uapi: Grab a copy of linux/in.h")
+Fixes: b12d6ec09730 ("bpf: btf: add btf print functionality")
+Fixes: c0dd967818a2 ("tools, include: Grab a copy of linux/erspan.h")
+Fixes: c4b6014e8bb0 ("tools: Add copy of perf_event.h to tools/include/linux/")
+
+Signed-off-by: Ismael Luceno <ismael@iodev.co.uk>
+Acked-by: Masami Hiramatsu <mhiramat@kernel.org>
+Signed-off-by: Josh Poimboeuf <jpoimboe@redhat.com>
+Link: https://lore.kernel.org/r/20211115134647.1921-1-ismael@iodev.co.uk
+Cc: Martin Schwidefsky <schwidefsky@de.ibm.com>
+Cc: Vasily Gorbik <gor@linux.ibm.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/uapi/linux/byteorder/big_endian.h    | 1 +
+ include/uapi/linux/byteorder/little_endian.h | 1 +
+ 2 files changed, 2 insertions(+)
+
+diff --git a/include/uapi/linux/byteorder/big_endian.h b/include/uapi/linux/byteorder/big_endian.h
+index 2199adc6a6c20..80aa5c41a7636 100644
+--- a/include/uapi/linux/byteorder/big_endian.h
++++ b/include/uapi/linux/byteorder/big_endian.h
+@@ -9,6 +9,7 @@
+ #define __BIG_ENDIAN_BITFIELD
+ #endif
++#include <linux/stddef.h>
+ #include <linux/types.h>
+ #include <linux/swab.h>
+diff --git a/include/uapi/linux/byteorder/little_endian.h b/include/uapi/linux/byteorder/little_endian.h
+index 601c904fd5cd9..cd98982e7523e 100644
+--- a/include/uapi/linux/byteorder/little_endian.h
++++ b/include/uapi/linux/byteorder/little_endian.h
+@@ -9,6 +9,7 @@
+ #define __LITTLE_ENDIAN_BITFIELD
+ #endif
++#include <linux/stddef.h>
+ #include <linux/types.h>
+ #include <linux/swab.h>
+-- 
+2.34.1
+