--- /dev/null
+From 2faff6737a8a684b077264f0aed131526c99eec4 Mon Sep 17 00:00:00 2001
+From: Stefan Wahren <stefan.wahren@i2se.com>
+Date: Sat, 7 Aug 2021 13:06:32 +0200
+Subject: ARM: dts: bcm2711: fix MDIO #address- and #size-cells
+
+From: Stefan Wahren <stefan.wahren@i2se.com>
+
+commit 2faff6737a8a684b077264f0aed131526c99eec4 upstream.
+
+The values of #address-cells and #size-cells are swapped. Fix this
+and avoid the following DT schema warnings for mdio@e14:
+
+ #address-cells:0:0: 1 was expected
+ #size-cells:0:0: 0 was expected
+
+Fixes: be8af7a9e3cc ("ARM: dts: bcm2711-rpi-4: Enable GENET support")
+Signed-off-by: Stefan Wahren <stefan.wahren@i2se.com>
+Link: https://lore.kernel.org/r/1628334401-6577-2-git-send-email-stefan.wahren@i2se.com
+Signed-off-by: Nicolas Saenz Julienne <nsaenz@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ arch/arm/boot/dts/bcm2711.dtsi | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/arch/arm/boot/dts/bcm2711.dtsi
++++ b/arch/arm/boot/dts/bcm2711.dtsi
+@@ -514,8 +514,8 @@
+ compatible = "brcm,genet-mdio-v5";
+ reg = <0xe14 0x8>;
+ reg-names = "mdio";
+- #address-cells = <0x0>;
+- #size-cells = <0x1>;
++ #address-cells = <0x1>;
++ #size-cells = <0x0>;
+ };
+ };
+ };
--- /dev/null
+From 13dbc954b3c9a9de0ad5b7279e8d3b708d31068b Mon Sep 17 00:00:00 2001
+From: Nicolas Saenz Julienne <nsaenz@kernel.org>
+Date: Tue, 31 Aug 2021 14:58:42 +0200
+Subject: ARM: dts: bcm2711-rpi-4-b: Fix pcie0's unit address formatting
+
+From: Nicolas Saenz Julienne <nsaenz@kernel.org>
+
+commit 13dbc954b3c9a9de0ad5b7279e8d3b708d31068b upstream.
+
+dtbs_check currently complains that:
+
+arch/arm/boot/dts/bcm2711-rpi-4-b.dts:220.10-231.4: Warning
+(pci_device_reg): /scb/pcie@7d500000/pci@1,0: PCI unit address format
+error, expected "0,0"
+
+Unsurprisingly pci@0,0 is the right address, as illustrated by its reg
+property:
+
+ &pcie0 {
+ pci@0,0 {
+ /*
+ * As defined in the IEEE Std 1275-1994 document,
+ * reg is a five-cell address encoded as (phys.hi
+ * phys.mid phys.lo size.hi size.lo). phys.hi
+ * should contain the device's BDF as 0b00000000
+ * bbbbbbbb dddddfff 00000000. The other cells
+ * should be zero.
+ */
+ reg = <0 0 0 0 0>;
+ };
+ };
+
+The device is clearly 0. So fix it.
+
+Also add a missing 'device_type = "pci"'.
+
+Fixes: 258f92d2f840 ("ARM: dts: bcm2711: Add reset controller to xHCI node")
+Suggested-by: Rob Herring <robh@kernel.org>
+Reviewed-by: Rob Herring <robh@kernel.org>
+Link: https://lore.kernel.org/r/20210831125843.1233488-1-nsaenzju@redhat.com
+Signed-off-by: Nicolas Saenz Julienne <nsaenz@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ arch/arm/boot/dts/bcm2711-rpi-4-b.dts | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+--- a/arch/arm/boot/dts/bcm2711-rpi-4-b.dts
++++ b/arch/arm/boot/dts/bcm2711-rpi-4-b.dts
+@@ -255,7 +255,8 @@
+ };
+
+ &pcie0 {
+- pci@1,0 {
++ pci@0,0 {
++ device_type = "pci";
+ #address-cells = <3>;
+ #size-cells = <2>;
+ ranges;
--- /dev/null
+From b55ec7528879a822a4d350248daa04bbb27f25fd Mon Sep 17 00:00:00 2001
+From: Stefan Wahren <stefan.wahren@i2se.com>
+Date: Sat, 7 Aug 2021 13:06:33 +0200
+Subject: ARM: dts: bcm2711-rpi-4-b: fix sd_io_1v8_reg regulator states
+
+From: Stefan Wahren <stefan.wahren@i2se.com>
+
+commit b55ec7528879a822a4d350248daa04bbb27f25fd upstream.
+
+DT schema check complains at sd_io_1v8_reg about the following:
+
+ [1800000, 1, 3300000, 0] is too long
+ Additional items are not allowed (3300000, 0 were unexpected)
+
+So fix the states definition.
+
+Fixes: 7dbe8c62ceeb ("ARM: dts: Add minimal Raspberry Pi 4 support")
+Signed-off-by: Stefan Wahren <stefan.wahren@i2se.com>
+Link: https://lore.kernel.org/r/1628334401-6577-3-git-send-email-stefan.wahren@i2se.com
+Signed-off-by: Nicolas Saenz Julienne <nsaenz@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ arch/arm/boot/dts/bcm2711-rpi-4-b.dts | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/arch/arm/boot/dts/bcm2711-rpi-4-b.dts
++++ b/arch/arm/boot/dts/bcm2711-rpi-4-b.dts
+@@ -54,8 +54,8 @@
+ regulator-always-on;
+ regulator-settling-time-us = <5000>;
+ gpios = <&expgpio 4 GPIO_ACTIVE_HIGH>;
+- states = <1800000 0x1
+- 3300000 0x0>;
++ states = <1800000 0x1>,
++ <3300000 0x0>;
+ status = "okay";
+ };
+
--- /dev/null
+From 3f32472854614d6f53b09b4812372dba9fc5c7de Mon Sep 17 00:00:00 2001
+From: Nicolas Saenz Julienne <nsaenz@kernel.org>
+Date: Tue, 31 Aug 2021 14:58:43 +0200
+Subject: ARM: dts: bcm2711-rpi-4-b: Fix usb's unit address
+
+From: Nicolas Saenz Julienne <nsaenz@kernel.org>
+
+commit 3f32472854614d6f53b09b4812372dba9fc5c7de upstream.
+
+The unit address is supposed to represent '<device>,<function>'. Which
+are both 0 for RPi4b's XHCI controller. On top of that although
+OpenFirmware states bus number goes in the high part of the last reg
+parameter, FDT doesn't seem to care for it[1], so remove it.
+
+[1] https://patchwork.kernel.org/project/linux-arm-kernel/patch/20210830103909.323356-1-nsaenzju@redhat.com/#24414633
+Fixes: 258f92d2f840 ("ARM: dts: bcm2711: Add reset controller to xHCI node")
+Suggested-by: Rob Herring <robh@kernel.org>
+Reviewed-by: Rob Herring <robh@kernel.org>
+Link: https://lore.kernel.org/r/20210831125843.1233488-2-nsaenzju@redhat.com
+Signed-off-by: Nicolas Saenz Julienne <nsaenz@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ arch/arm/boot/dts/bcm2711-rpi-4-b.dts | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/arch/arm/boot/dts/bcm2711-rpi-4-b.dts
++++ b/arch/arm/boot/dts/bcm2711-rpi-4-b.dts
+@@ -262,8 +262,8 @@
+
+ reg = <0 0 0 0 0>;
+
+- usb@1,0 {
+- reg = <0x10000 0 0 0 0>;
++ usb@0,0 {
++ reg = <0 0 0 0 0>;
+ resets = <&reset RASPBERRYPI_FIRMWARE_RESET_ID_USB>;
+ };
+ };
--- /dev/null
+From f729a592adb6760013c3e48622a5bf256b992452 Mon Sep 17 00:00:00 2001
+From: Saravana Kannan <saravanak@google.com>
+Date: Wed, 29 Sep 2021 12:05:49 -0700
+Subject: driver core: Reject pointless SYNC_STATE_ONLY device links
+
+From: Saravana Kannan <saravanak@google.com>
+
+commit f729a592adb6760013c3e48622a5bf256b992452 upstream.
+
+SYNC_STATE_ONLY device links intentionally allow cycles because cyclic
+sync_state() dependencies are valid and necessary.
+
+However a SYNC_STATE_ONLY device link where the consumer and the supplier
+are the same device is pointless because the device link would be deleted
+as soon as the device probes (because it's also the consumer) and won't
+affect when the sync_state() callback is called. It's a waste of CPU cycles
+and memory to create this device link. So reject any attempts to create
+such a device link.
+
+Fixes: 05ef983e0d65 ("driver core: Add device link support for SYNC_STATE_ONLY flag")
+Cc: stable <stable@vger.kernel.org>
+Reported-by: Ulf Hansson <ulf.hansson@linaro.org>
+Reviewed-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Reviewed-by: Ulf Hansson <ulf.hansson@linaro.org>
+Signed-off-by: Saravana Kannan <saravanak@google.com>
+Link: https://lore.kernel.org/r/20210929190549.860541-1-saravanak@google.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/base/core.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+--- a/drivers/base/core.c
++++ b/drivers/base/core.c
+@@ -549,7 +549,8 @@ struct device_link *device_link_add(stru
+ {
+ struct device_link *link;
+
+- if (!consumer || !supplier || flags & ~DL_ADD_VALID_FLAGS ||
++ if (!consumer || !supplier || consumer == supplier ||
++ flags & ~DL_ADD_VALID_FLAGS ||
+ (flags & DL_FLAG_STATELESS && flags & DL_MANAGED_LINK_FLAGS) ||
+ (flags & DL_FLAG_SYNC_STATE_ONLY &&
+ flags != DL_FLAG_SYNC_STATE_ONLY) ||
--- /dev/null
+From 98e96cf80045a383fcc47c58dd4e87b3ae587b3e Mon Sep 17 00:00:00 2001
+From: Saravana Kannan <saravanak@google.com>
+Date: Tue, 28 Sep 2021 17:07:33 -0700
+Subject: drivers: bus: simple-pm-bus: Add support for probing simple bus only devices
+
+From: Saravana Kannan <saravanak@google.com>
+
+commit 98e96cf80045a383fcc47c58dd4e87b3ae587b3e upstream.
+
+fw_devlink could end up creating device links for bus only devices.
+However, bus only devices don't get probed and can block probe() or
+sync_state() [1] call backs of other devices. To avoid this, probe these
+devices using the simple-pm-bus driver.
+
+However, there are instances of devices that are not simple buses (they get
+probed by their specific drivers) that also list the "simple-bus" (or other
+bus only compatible strings) in their compatible property to automatically
+populate their child devices. We still want these devices to get probed by
+their specific drivers. So, we make sure this driver only probes devices
+that are only buses.
+
+[1] - https://lore.kernel.org/lkml/CAPDyKFo9Bxremkb1dDrr4OcXSpE0keVze94Cm=zrkOVxHHxBmQ@mail.gmail.com/
+
+Fixes: c442a0d18744 ("driver core: Set fw_devlink to "permissive" behavior by default")
+Cc: stable <stable@vger.kernel.org>
+Cc: Rob Herring <robh+dt@kernel.org>
+Tested-by: Saravana Kannan <saravanak@google.com>
+Tested-by: Ulf Hansson <ulf.hansson@linaro.org>
+Tested-by: Geert Uytterhoeven <geert+renesas@glider.be>
+Tested-by: Damien Le Moal <damien.lemoal@wdc.com>
+Signed-off-by: Saravana Kannan <saravanak@google.com>
+Link: https://lore.kernel.org/r/20210929000735.585237-2-saravanak@google.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/bus/simple-pm-bus.c | 39 ++++++++++++++++++++++++++++++++++++++-
+ 1 file changed, 38 insertions(+), 1 deletion(-)
+
+--- a/drivers/bus/simple-pm-bus.c
++++ b/drivers/bus/simple-pm-bus.c
+@@ -16,7 +16,33 @@
+
+ static int simple_pm_bus_probe(struct platform_device *pdev)
+ {
+- struct device_node *np = pdev->dev.of_node;
++ const struct device *dev = &pdev->dev;
++ struct device_node *np = dev->of_node;
++ const struct of_device_id *match;
++
++ /*
++ * Allow user to use driver_override to bind this driver to a
++ * transparent bus device which has a different compatible string
++ * that's not listed in simple_pm_bus_of_match. We don't want to do any
++ * of the simple-pm-bus tasks for these devices, so return early.
++ */
++ if (pdev->driver_override)
++ return 0;
++
++ match = of_match_device(dev->driver->of_match_table, dev);
++ /*
++ * These are transparent bus devices (not simple-pm-bus matches) that
++ * have their child nodes populated automatically. So, don't need to
++ * do anything more. We only match with the device if this driver is
++ * the most specific match because we don't want to incorrectly bind to
++ * a device that has a more specific driver.
++ */
++ if (match && match->data) {
++ if (of_property_match_string(np, "compatible", match->compatible) == 0)
++ return 0;
++ else
++ return -ENODEV;
++ }
+
+ dev_dbg(&pdev->dev, "%s\n", __func__);
+
+@@ -30,14 +56,25 @@ static int simple_pm_bus_probe(struct pl
+
+ static int simple_pm_bus_remove(struct platform_device *pdev)
+ {
++ const void *data = of_device_get_match_data(&pdev->dev);
++
++ if (pdev->driver_override || data)
++ return 0;
++
+ dev_dbg(&pdev->dev, "%s\n", __func__);
+
+ pm_runtime_disable(&pdev->dev);
+ return 0;
+ }
+
++#define ONLY_BUS ((void *) 1) /* Match if the device is only a bus. */
++
+ static const struct of_device_id simple_pm_bus_of_match[] = {
+ { .compatible = "simple-pm-bus", },
++ { .compatible = "simple-bus", .data = ONLY_BUS },
++ { .compatible = "simple-mfd", .data = ONLY_BUS },
++ { .compatible = "isa", .data = ONLY_BUS },
++ { .compatible = "arm,amba-bus", .data = ONLY_BUS },
+ { /* sentinel */ }
+ };
+ MODULE_DEVICE_TABLE(of, simple_pm_bus_of_match);
--- /dev/null
+From 89a86da5cb8e0ee153111fb68a719d31582c206b Mon Sep 17 00:00:00 2001
+From: Alexandru Tachici <alexandru.tachici@analog.com>
+Date: Mon, 6 Sep 2021 09:56:28 +0300
+Subject: iio: adc: ad7192: Add IRQ flag
+
+From: Alexandru Tachici <alexandru.tachici@analog.com>
+
+commit 89a86da5cb8e0ee153111fb68a719d31582c206b upstream.
+
+IRQ type in ad_sigma_delta_info struct was missing.
+
+In Sigma-Delta devices the SDO line is also used as an interrupt.
+Leaving IRQ on level instead of falling might trigger a sample read
+when the IRQ is enabled, as the SDO line is already low. Not sure
+if SDO line will always immediately go high in ad_sd_buffer_postenable
+before the IRQ is enabled.
+
+Also the datasheet seem to explicitly say the falling edge of the SDO
+should be used as an interrupt:
+>From the AD7192 datasheet: "The DOUT/RDY falling edge can be used
+as an interrupt to a processor,"
+
+Fixes: da4d3d6bb9f6 ("iio: adc: ad-sigma-delta: Allow custom IRQ flags")
+Signed-off-by: Alexandru Tachici <alexandru.tachici@analog.com>
+Cc: <Stable@vger.kernel.org>
+Link: https://lore.kernel.org/r/20210906065630.16325-2-alexandru.tachici@analog.com
+Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/iio/adc/ad7192.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/drivers/iio/adc/ad7192.c
++++ b/drivers/iio/adc/ad7192.c
+@@ -293,6 +293,7 @@ static const struct ad_sigma_delta_info
+ .has_registers = true,
+ .addr_shift = 3,
+ .read_mask = BIT(6),
++ .irq_flags = IRQF_TRIGGER_FALLING,
+ };
+
+ static const struct ad_sd_calib_data ad7192_calib_arr[8] = {
--- /dev/null
+From e081102f3077aa716974ccebec97003c890d5641 Mon Sep 17 00:00:00 2001
+From: Alexandru Tachici <alexandru.tachici@analog.com>
+Date: Mon, 6 Sep 2021 09:56:29 +0300
+Subject: iio: adc: ad7780: Fix IRQ flag
+
+From: Alexandru Tachici <alexandru.tachici@analog.com>
+
+commit e081102f3077aa716974ccebec97003c890d5641 upstream.
+
+Correct IRQ flag here is falling.
+
+In Sigma-Delta devices the SDO line is also used as an interrupt.
+Leaving IRQ on level instead of falling might trigger a sample read
+when the IRQ is enabled, as the SDO line is already low. Not sure
+if SDO line will always immediately go high in ad_sd_buffer_postenable
+before the IRQ is enabled.
+
+Also the datasheet seem to explicitly say the falling edge of the SDO
+should be used as an interrupt:
+>From the AD7780 datasheet: " The DOUT/Figure 22 RDY falling edge
+can be used as an interrupt to a processor"
+
+Fixes: da4d3d6bb9f6 ("iio: adc: ad-sigma-delta: Allow custom IRQ flags")
+Signed-off-by: Alexandru Tachici <alexandru.tachici@analog.com>
+Cc: <Stable@vger.kernel.org>
+Link: https://lore.kernel.org/r/20210906065630.16325-3-alexandru.tachici@analog.com
+Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/iio/adc/ad7780.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/iio/adc/ad7780.c
++++ b/drivers/iio/adc/ad7780.c
+@@ -203,7 +203,7 @@ static const struct ad_sigma_delta_info
+ .set_mode = ad7780_set_mode,
+ .postprocess_sample = ad7780_postprocess_sample,
+ .has_registers = false,
+- .irq_flags = IRQF_TRIGGER_LOW,
++ .irq_flags = IRQF_TRIGGER_FALLING,
+ };
+
+ #define _AD7780_CHANNEL(_bits, _wordsize, _mask_all) \
--- /dev/null
+From 1a913270e57a8e7f1e3789802f1f64e6d0654626 Mon Sep 17 00:00:00 2001
+From: Alexandru Tachici <alexandru.tachici@analog.com>
+Date: Mon, 6 Sep 2021 09:56:30 +0300
+Subject: iio: adc: ad7793: Fix IRQ flag
+
+From: Alexandru Tachici <alexandru.tachici@analog.com>
+
+commit 1a913270e57a8e7f1e3789802f1f64e6d0654626 upstream.
+
+In Sigma-Delta devices the SDO line is also used as an interrupt.
+Leaving IRQ on level instead of falling might trigger a sample read
+when the IRQ is enabled, as the SDO line is already low. Not sure
+if SDO line will always immediately go high in ad_sd_buffer_postenable
+before the IRQ is enabled.
+
+Also the datasheet seem to explicitly say the falling edge of the SDO
+should be used as an interrupt:
+>From the AD7793 datasheet: " The DOUT/RDY falling edge can be
+used as an interrupt to a processor"
+
+Fixes: da4d3d6bb9f6 ("iio: adc: ad-sigma-delta: Allow custom IRQ flags")
+Signed-off-by: Alexandru Tachici <alexandru.tachici@analog.com>
+Cc: <Stable@vger.kernel.org>
+Link: https://lore.kernel.org/r/20210906065630.16325-4-alexandru.tachici@analog.com
+Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/iio/adc/ad7793.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/iio/adc/ad7793.c
++++ b/drivers/iio/adc/ad7793.c
+@@ -206,7 +206,7 @@ static const struct ad_sigma_delta_info
+ .has_registers = true,
+ .addr_shift = 3,
+ .read_mask = BIT(6),
+- .irq_flags = IRQF_TRIGGER_LOW,
++ .irq_flags = IRQF_TRIGGER_FALLING,
+ };
+
+ static const struct ad_sd_calib_data ad7793_calib_arr[6] = {
--- /dev/null
+From eb795cd97365a3d3d9da3926d234a7bc32a3bb15 Mon Sep 17 00:00:00 2001
+From: Billy Tsai <billy_tsai@aspeedtech.com>
+Date: Tue, 31 Aug 2021 15:14:44 +0800
+Subject: iio: adc: aspeed: set driver data when adc probe.
+
+From: Billy Tsai <billy_tsai@aspeedtech.com>
+
+commit eb795cd97365a3d3d9da3926d234a7bc32a3bb15 upstream.
+
+Fix the issue when adc remove will get the null driver data.
+
+Fixed: commit 573803234e72 ("iio: Aspeed ADC")
+Signed-off-by: Billy Tsai <billy_tsai@aspeedtech.com>
+Link: https://lore.kernel.org/r/20210831071458.2334-2-billy_tsai@aspeedtech.com
+Cc: <Stable@vger.kernel.org>
+Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/iio/adc/aspeed_adc.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/drivers/iio/adc/aspeed_adc.c
++++ b/drivers/iio/adc/aspeed_adc.c
+@@ -183,6 +183,7 @@ static int aspeed_adc_probe(struct platf
+
+ data = iio_priv(indio_dev);
+ data->dev = &pdev->dev;
++ platform_set_drvdata(pdev, indio_dev);
+
+ data->base = devm_platform_ioremap_resource(pdev, 0);
+ if (IS_ERR(data->base))
--- /dev/null
+From f0cb5fed37ab37f6a6c5463c5fd39b58a45670c8 Mon Sep 17 00:00:00 2001
+From: Miquel Raynal <miquel.raynal@bootlin.com>
+Date: Wed, 18 Aug 2021 13:11:25 +0200
+Subject: iio: adc: max1027: Fix the number of max1X31 channels
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Miquel Raynal <miquel.raynal@bootlin.com>
+
+commit f0cb5fed37ab37f6a6c5463c5fd39b58a45670c8 upstream.
+
+The macro MAX1X29_CHANNELS() already calls MAX1X27_CHANNELS().
+Calling MAX1X27_CHANNELS() before MAX1X29_CHANNELS() in the definition
+of MAX1X31_CHANNELS() declares the first 8 channels twice. So drop this
+extra call from the MAX1X31 channels list definition.
+
+Fixes: 7af5257d8427 ("iio: adc: max1027: Prepare the introduction of different resolutions")
+Cc: stable@vger.kernel.org
+Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com>
+Reviewed-by: Nuno Sá <nuno.sa@analog.com>
+Link: https://lore.kernel.org/r/20210818111139.330636-3-miquel.raynal@bootlin.com
+Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/iio/adc/max1027.c | 1 -
+ 1 file changed, 1 deletion(-)
+
+--- a/drivers/iio/adc/max1027.c
++++ b/drivers/iio/adc/max1027.c
+@@ -142,7 +142,6 @@ MODULE_DEVICE_TABLE(of, max1027_adc_dt_i
+ MAX1027_V_CHAN(11, depth)
+
+ #define MAX1X31_CHANNELS(depth) \
+- MAX1X27_CHANNELS(depth), \
+ MAX1X29_CHANNELS(depth), \
+ MAX1027_V_CHAN(12, depth), \
+ MAX1027_V_CHAN(13, depth), \
--- /dev/null
+From 732ae19ee8f58ecaf30cbc1bbbda5cbee6a45043 Mon Sep 17 00:00:00 2001
+From: Miquel Raynal <miquel.raynal@bootlin.com>
+Date: Wed, 18 Aug 2021 13:11:24 +0200
+Subject: iio: adc: max1027: Fix wrong shift with 12-bit devices
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Miquel Raynal <miquel.raynal@bootlin.com>
+
+commit 732ae19ee8f58ecaf30cbc1bbbda5cbee6a45043 upstream.
+
+10-bit devices must shift the value twice.
+This is not needed anymore on 12-bit devices.
+
+Fixes: ae47d009b508 ("iio: adc: max1027: Introduce 12-bit devices support")
+Cc: stable@vger.kernel.org
+Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com>
+Reviewed-by: Nuno Sá <nuno.sa@analog.com>
+Link: https://lore.kernel.org/r/20210818111139.330636-2-miquel.raynal@bootlin.com
+Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/iio/adc/max1027.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/iio/adc/max1027.c
++++ b/drivers/iio/adc/max1027.c
+@@ -103,7 +103,7 @@ MODULE_DEVICE_TABLE(of, max1027_adc_dt_i
+ .sign = 'u', \
+ .realbits = depth, \
+ .storagebits = 16, \
+- .shift = 2, \
++ .shift = (depth == 10) ? 2 : 0, \
+ .endianness = IIO_BE, \
+ }, \
+ }
--- /dev/null
+From bbcf40816b547b3c37af49168950491d20d81ce1 Mon Sep 17 00:00:00 2001
+From: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
+Date: Sat, 21 Aug 2021 12:37:24 +0200
+Subject: iio: adc128s052: Fix the error handling path of 'adc128_probe()'
+
+From: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
+
+commit bbcf40816b547b3c37af49168950491d20d81ce1 upstream.
+
+A successful 'regulator_enable()' call should be balanced by a
+corresponding 'regulator_disable()' call in the error handling path of the
+probe, as already done in the remove function.
+
+Update the error handling path accordingly.
+
+Fixes: 913b86468674 ("iio: adc: Add TI ADC128S052")
+Signed-off-by: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
+Reviewed-by: Alexandru Ardelean <ardeleanalex@gmail.com>
+Link: https://lore.kernel.org/r/85189f1cfcf6f5f7b42d8730966f2a074b07b5f5.1629542160.git.christophe.jaillet@wanadoo.fr
+Cc: <Stable@vger.kernel.org>
+Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/iio/adc/ti-adc128s052.c | 6 ++++++
+ 1 file changed, 6 insertions(+)
+
+--- a/drivers/iio/adc/ti-adc128s052.c
++++ b/drivers/iio/adc/ti-adc128s052.c
+@@ -171,7 +171,13 @@ static int adc128_probe(struct spi_devic
+ mutex_init(&adc->lock);
+
+ ret = iio_device_register(indio_dev);
++ if (ret)
++ goto err_disable_regulator;
+
++ return 0;
++
++err_disable_regulator:
++ regulator_disable(adc->reg);
+ return ret;
+ }
+
--- /dev/null
+From f7a28df7db84eb3410e9eca37832efa5aed93338 Mon Sep 17 00:00:00 2001
+From: Dan Carpenter <dan.carpenter@oracle.com>
+Date: Mon, 16 Aug 2021 21:39:54 +0300
+Subject: iio: dac: ti-dac5571: fix an error code in probe()
+
+From: Dan Carpenter <dan.carpenter@oracle.com>
+
+commit f7a28df7db84eb3410e9eca37832efa5aed93338 upstream.
+
+If we have an unexpected number of channels then return -EINVAL instead
+of returning success.
+
+Fixes: df38a4a72a3b ("iio: dac: add TI DAC5571 family support")
+Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
+Link: https://lore.kernel.org/r/20210816183954.GB2068@kili
+Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/iio/dac/ti-dac5571.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/drivers/iio/dac/ti-dac5571.c
++++ b/drivers/iio/dac/ti-dac5571.c
+@@ -350,6 +350,7 @@ static int dac5571_probe(struct i2c_clie
+ data->dac5571_pwrdwn = dac5571_pwrdwn_quad;
+ break;
+ default:
++ ret = -EINVAL;
+ goto err;
+ }
+
--- /dev/null
+From 26d90b5590579def54382a2fc34cfbe8518a9851 Mon Sep 17 00:00:00 2001
+From: Jiri Valek - 2N <valek@2n.cz>
+Date: Mon, 20 Sep 2021 14:53:48 +0200
+Subject: iio: light: opt3001: Fixed timeout error when 0 lux
+
+From: Jiri Valek - 2N <valek@2n.cz>
+
+commit 26d90b5590579def54382a2fc34cfbe8518a9851 upstream.
+
+Reading from sensor returned timeout error under
+zero light conditions.
+
+Signed-off-by: Jiri Valek - 2N <valek@2n.cz>
+Fixes: ac663db3678a ("iio: light: opt3001: enable operation w/o IRQ")
+Link: https://lore.kernel.org/r/20210920125351.6569-1-valek@2n.cz
+Cc: <Stable@vger.kernel.org>
+Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/iio/light/opt3001.c | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+--- a/drivers/iio/light/opt3001.c
++++ b/drivers/iio/light/opt3001.c
+@@ -276,6 +276,8 @@ static int opt3001_get_lux(struct opt300
+ ret = wait_event_timeout(opt->result_ready_queue,
+ opt->result_ready,
+ msecs_to_jiffies(OPT3001_RESULT_READY_LONG));
++ if (ret == 0)
++ return -ETIMEDOUT;
+ } else {
+ /* Sleep for result ready time */
+ timeout = (opt->int_time == OPT3001_INT_TIME_SHORT) ?
+@@ -312,9 +314,7 @@ err:
+ /* Disallow IRQ to access the device while lock is active */
+ opt->ok_to_ignore_lock = false;
+
+- if (ret == 0)
+- return -ETIMEDOUT;
+- else if (ret < 0)
++ if (ret < 0)
+ return ret;
+
+ if (opt->use_irq) {
--- /dev/null
+From c2980c64c7fd4585d684574c92d1624d44961edd Mon Sep 17 00:00:00 2001
+From: Hui Liu <hui.liu@mediatek.com>
+Date: Sun, 26 Sep 2021 15:30:28 +0800
+Subject: iio: mtk-auxadc: fix case IIO_CHAN_INFO_PROCESSED
+
+From: Hui Liu <hui.liu@mediatek.com>
+
+commit c2980c64c7fd4585d684574c92d1624d44961edd upstream.
+
+The previous driver does't apply the necessary scaling to take the
+voltage range into account.
+We change readback value from raw data to input voltage to fix case
+IIO_CHAN_INFO_PROCESSED.
+
+Fixes: ace4cdfe67be ("iio: adc: mt2701: Add Mediatek auxadc driver for mt2701.")
+Signed-off-by: Hui Liu <hui.liu@mediatek.com>
+Link: https://lore.kernel.org/r/20210926073028.11045-2-hui.liu@mediatek.com
+Cc: <Stable@vger.kernel.org>
+Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/iio/adc/mt6577_auxadc.c | 8 ++++++++
+ 1 file changed, 8 insertions(+)
+
+--- a/drivers/iio/adc/mt6577_auxadc.c
++++ b/drivers/iio/adc/mt6577_auxadc.c
+@@ -82,6 +82,10 @@ static const struct iio_chan_spec mt6577
+ MT6577_AUXADC_CHANNEL(15),
+ };
+
++/* For Voltage calculation */
++#define VOLTAGE_FULL_RANGE 1500 /* VA voltage */
++#define AUXADC_PRECISE 4096 /* 12 bits */
++
+ static int mt_auxadc_get_cali_data(int rawdata, bool enable_cali)
+ {
+ return rawdata;
+@@ -191,6 +195,10 @@ static int mt6577_auxadc_read_raw(struct
+ }
+ if (adc_dev->dev_comp->sample_data_cali)
+ *val = mt_auxadc_get_cali_data(*val, true);
++
++ /* Convert adc raw data to voltage: 0 - 1500 mV */
++ *val = *val * VOLTAGE_FULL_RANGE / AUXADC_PRECISE;
++
+ return IIO_VAL_INT;
+
+ default:
--- /dev/null
+From 8167c9a375ccceed19048ad9d68cb2d02ed276e0 Mon Sep 17 00:00:00 2001
+From: Dan Carpenter <dan.carpenter@oracle.com>
+Date: Thu, 9 Sep 2021 12:13:36 +0300
+Subject: iio: ssp_sensors: add more range checking in ssp_parse_dataframe()
+
+From: Dan Carpenter <dan.carpenter@oracle.com>
+
+commit 8167c9a375ccceed19048ad9d68cb2d02ed276e0 upstream.
+
+The "idx" is validated at the start of the loop but it gets incremented
+during the iteration so it needs to be checked again.
+
+Fixes: 50dd64d57eee ("iio: common: ssp_sensors: Add sensorhub driver")
+Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
+Link: https://lore.kernel.org/r/20210909091336.GA26312@kili
+Cc: <Stable@vger.kernel.org>
+Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/iio/common/ssp_sensors/ssp_spi.c | 9 ++++++++-
+ 1 file changed, 8 insertions(+), 1 deletion(-)
+
+--- a/drivers/iio/common/ssp_sensors/ssp_spi.c
++++ b/drivers/iio/common/ssp_sensors/ssp_spi.c
+@@ -273,6 +273,8 @@ static int ssp_parse_dataframe(struct ss
+ for (idx = 0; idx < len;) {
+ switch (dataframe[idx++]) {
+ case SSP_MSG2AP_INST_BYPASS_DATA:
++ if (idx >= len)
++ return -EPROTO;
+ sd = dataframe[idx++];
+ if (sd < 0 || sd >= SSP_SENSOR_MAX) {
+ dev_err(SSP_DEV,
+@@ -282,10 +284,13 @@ static int ssp_parse_dataframe(struct ss
+
+ if (indio_devs[sd]) {
+ spd = iio_priv(indio_devs[sd]);
+- if (spd->process_data)
++ if (spd->process_data) {
++ if (idx >= len)
++ return -EPROTO;
+ spd->process_data(indio_devs[sd],
+ &dataframe[idx],
+ data->timestamp);
++ }
+ } else {
+ dev_err(SSP_DEV, "no client for frame\n");
+ }
+@@ -293,6 +298,8 @@ static int ssp_parse_dataframe(struct ss
+ idx += ssp_offset_map[sd];
+ break;
+ case SSP_MSG2AP_INST_DEBUG_DATA:
++ if (idx >= len)
++ return -EPROTO;
+ sd = ssp_print_mcu_debug(dataframe, &idx, len);
+ if (sd) {
+ dev_err(SSP_DEV,
--- /dev/null
+From 4170d3dd1467e9d78cb9af374b19357dc324b328 Mon Sep 17 00:00:00 2001
+From: Dan Carpenter <dan.carpenter@oracle.com>
+Date: Tue, 14 Sep 2021 13:53:33 +0300
+Subject: iio: ssp_sensors: fix error code in ssp_print_mcu_debug()
+
+From: Dan Carpenter <dan.carpenter@oracle.com>
+
+commit 4170d3dd1467e9d78cb9af374b19357dc324b328 upstream.
+
+The ssp_print_mcu_debug() function should return negative error codes on
+error. Returning "length" is meaningless. This change does not affect
+runtime because the callers only care about zero/non-zero.
+
+Reported-by: Jonathan Cameron <jic23@kernel.org>
+Fixes: 50dd64d57eee ("iio: common: ssp_sensors: Add sensorhub driver")
+Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
+Link: https://lore.kernel.org/r/20210914105333.GA11657@kili
+Cc: <Stable@vger.kernel.org>
+Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/iio/common/ssp_sensors/ssp_spi.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/iio/common/ssp_sensors/ssp_spi.c
++++ b/drivers/iio/common/ssp_sensors/ssp_spi.c
+@@ -137,7 +137,7 @@ static int ssp_print_mcu_debug(char *dat
+ if (length > received_len - *data_index || length <= 0) {
+ ssp_dbg("[SSP]: MSG From MCU-invalid debug length(%d/%d)\n",
+ length, received_len);
+- return length ? length : -EPROTO;
++ return -EPROTO;
+ }
+
+ ssp_dbg("[SSP]: MSG From MCU - %s\n", &data_frame[*data_index]);
--- /dev/null
+From 9b4416c5095c20e110c82ae602c254099b83b72f Mon Sep 17 00:00:00 2001
+From: Michael Ellerman <mpe@ellerman.id.au>
+Date: Fri, 15 Oct 2021 23:01:48 +1100
+Subject: KVM: PPC: Book3S HV: Fix stack handling in idle_kvm_start_guest()
+
+From: Michael Ellerman <mpe@ellerman.id.au>
+
+commit 9b4416c5095c20e110c82ae602c254099b83b72f upstream.
+
+In commit 10d91611f426 ("powerpc/64s: Reimplement book3s idle code in
+C") kvm_start_guest() became idle_kvm_start_guest(). The old code
+allocated a stack frame on the emergency stack, but didn't use the
+frame to store anything, and also didn't store anything in its caller's
+frame.
+
+idle_kvm_start_guest() on the other hand is written more like a normal C
+function, it creates a frame on entry, and also stores CR/LR into its
+callers frame (per the ABI). The problem is that there is no caller
+frame on the emergency stack.
+
+The emergency stack for a given CPU is allocated with:
+
+ paca_ptrs[i]->emergency_sp = alloc_stack(limit, i) + THREAD_SIZE;
+
+So emergency_sp actually points to the first address above the emergency
+stack allocation for a given CPU, we must not store above it without
+first decrementing it to create a frame. This is different to the
+regular kernel stack, paca->kstack, which is initialised to point at an
+initial frame that is ready to use.
+
+idle_kvm_start_guest() stores the backchain, CR and LR all of which
+write outside the allocation for the emergency stack. It then creates a
+stack frame and saves the non-volatile registers. Unfortunately the
+frame it creates is not large enough to fit the non-volatiles, and so
+the saving of the non-volatile registers also writes outside the
+emergency stack allocation.
+
+The end result is that we corrupt whatever is at 0-24 bytes, and 112-248
+bytes above the emergency stack allocation.
+
+In practice this has gone unnoticed because the memory immediately above
+the emergency stack happens to be used for other stack allocations,
+either another CPUs mc_emergency_sp or an IRQ stack. See the order of
+calls to irqstack_early_init() and emergency_stack_init().
+
+The low addresses of another stack are the top of that stack, and so are
+only used if that stack is under extreme pressue, which essentially
+never happens in practice - and if it did there's a high likelyhood we'd
+crash due to that stack overflowing.
+
+Still, we shouldn't be corrupting someone else's stack, and it is purely
+luck that we aren't corrupting something else.
+
+To fix it we save CR/LR into the caller's frame using the existing r1 on
+entry, we then create a SWITCH_FRAME_SIZE frame (which has space for
+pt_regs) on the emergency stack with the backchain pointing to the
+existing stack, and then finally we switch to the new frame on the
+emergency stack.
+
+Fixes: 10d91611f426 ("powerpc/64s: Reimplement book3s idle code in C")
+Cc: stable@vger.kernel.org # v5.2+
+Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
+Link: https://lore.kernel.org/r/20211015133929.832061-1-mpe@ellerman.id.au
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ arch/powerpc/kvm/book3s_hv_rmhandlers.S | 19 ++++++++++---------
+ 1 file changed, 10 insertions(+), 9 deletions(-)
+
+--- a/arch/powerpc/kvm/book3s_hv_rmhandlers.S
++++ b/arch/powerpc/kvm/book3s_hv_rmhandlers.S
+@@ -292,13 +292,15 @@ kvm_novcpu_exit:
+ * r3 contains the SRR1 wakeup value, SRR1 is trashed.
+ */
+ _GLOBAL(idle_kvm_start_guest)
+- ld r4,PACAEMERGSP(r13)
+ mfcr r5
+ mflr r0
+- std r1,0(r4)
+- std r5,8(r4)
+- std r0,16(r4)
+- subi r1,r4,STACK_FRAME_OVERHEAD
++ std r5, 8(r1) // Save CR in caller's frame
++ std r0, 16(r1) // Save LR in caller's frame
++ // Create frame on emergency stack
++ ld r4, PACAEMERGSP(r13)
++ stdu r1, -SWITCH_FRAME_SIZE(r4)
++ // Switch to new frame on emergency stack
++ mr r1, r4
+ SAVE_NVGPRS(r1)
+
+ /*
+@@ -444,10 +446,9 @@ kvm_no_guest:
+ /* set up r3 for return */
+ mfspr r3,SPRN_SRR1
+ REST_NVGPRS(r1)
+- addi r1, r1, STACK_FRAME_OVERHEAD
+- ld r0, 16(r1)
+- ld r5, 8(r1)
+- ld r1, 0(r1)
++ ld r1, 0(r1) // Switch back to caller stack
++ ld r0, 16(r1) // Reload LR
++ ld r5, 8(r1) // Reload CR
+ mtlr r0
+ mtcr r5
+ blr
--- /dev/null
+From cdeb5d7d890e14f3b70e8087e745c4a6a7d9f337 Mon Sep 17 00:00:00 2001
+From: Michael Ellerman <mpe@ellerman.id.au>
+Date: Fri, 15 Oct 2021 23:02:08 +1100
+Subject: KVM: PPC: Book3S HV: Make idle_kvm_start_guest() return 0 if it went to guest
+
+From: Michael Ellerman <mpe@ellerman.id.au>
+
+commit cdeb5d7d890e14f3b70e8087e745c4a6a7d9f337 upstream.
+
+We call idle_kvm_start_guest() from power7_offline() if the thread has
+been requested to enter KVM. We pass it the SRR1 value that was returned
+from power7_idle_insn() which tells us what sort of wakeup we're
+processing.
+
+Depending on the SRR1 value we pass in, the KVM code might enter the
+guest, or it might return to us to do some host action if the wakeup
+requires it.
+
+If idle_kvm_start_guest() is able to handle the wakeup, and enter the
+guest it is supposed to indicate that by returning a zero SRR1 value to
+us.
+
+That was the behaviour prior to commit 10d91611f426 ("powerpc/64s:
+Reimplement book3s idle code in C"), however in that commit the
+handling of SRR1 was reworked, and the zeroing behaviour was lost.
+
+Returning from idle_kvm_start_guest() without zeroing the SRR1 value can
+confuse the host offline code, causing the guest to crash and other
+weirdness.
+
+Fixes: 10d91611f426 ("powerpc/64s: Reimplement book3s idle code in C")
+Cc: stable@vger.kernel.org # v5.2+
+Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
+Link: https://lore.kernel.org/r/20211015133929.832061-2-mpe@ellerman.id.au
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ arch/powerpc/kvm/book3s_hv_rmhandlers.S | 9 +++++++--
+ 1 file changed, 7 insertions(+), 2 deletions(-)
+
+--- a/arch/powerpc/kvm/book3s_hv_rmhandlers.S
++++ b/arch/powerpc/kvm/book3s_hv_rmhandlers.S
+@@ -301,6 +301,7 @@ _GLOBAL(idle_kvm_start_guest)
+ stdu r1, -SWITCH_FRAME_SIZE(r4)
+ // Switch to new frame on emergency stack
+ mr r1, r4
++ std r3, 32(r1) // Save SRR1 wakeup value
+ SAVE_NVGPRS(r1)
+
+ /*
+@@ -352,6 +353,10 @@ kvm_unsplit_wakeup:
+
+ kvm_secondary_got_guest:
+
++ // About to go to guest, clear saved SRR1
++ li r0, 0
++ std r0, 32(r1)
++
+ /* Set HSTATE_DSCR(r13) to something sensible */
+ ld r6, PACA_DSCR_DEFAULT(r13)
+ std r6, HSTATE_DSCR(r13)
+@@ -443,8 +448,8 @@ kvm_no_guest:
+ mfspr r4, SPRN_LPCR
+ rlwimi r4, r3, 0, LPCR_PECE0 | LPCR_PECE1
+ mtspr SPRN_LPCR, r4
+- /* set up r3 for return */
+- mfspr r3,SPRN_SRR1
++ // Return SRR1 wakeup value, or 0 if we went into the guest
++ ld r3, 32(r1)
+ REST_NVGPRS(r1)
+ ld r1, 0(r1) // Switch back to caller stack
+ ld r0, 16(r1) // Reload LR
--- /dev/null
+From 6f779e1d359b8d5801f677c1d49dcfa10bf95674 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?C=C3=A9dric=20Le=20Goater?= <clg@kaod.org>
+Date: Mon, 11 Oct 2021 09:02:03 +0200
+Subject: powerpc/xive: Discard disabled interrupts in get_irqchip_state()
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Cédric Le Goater <clg@kaod.org>
+
+commit 6f779e1d359b8d5801f677c1d49dcfa10bf95674 upstream.
+
+When an interrupt is passed through, the KVM XIVE device calls the
+set_vcpu_affinity() handler which raises the P bit to mask the
+interrupt and to catch any in-flight interrupts while routing the
+interrupt to the guest.
+
+On the guest side, drivers (like some Intels) can request at probe
+time some MSIs and call synchronize_irq() to check that there are no
+in flight interrupts. This will call the XIVE get_irqchip_state()
+handler which will always return true as the interrupt P bit has been
+set on the host side and lock the CPU in an infinite loop.
+
+Fix that by discarding disabled interrupts in get_irqchip_state().
+
+Fixes: da15c03b047d ("powerpc/xive: Implement get_irqchip_state method for XIVE to fix shutdown race")
+Cc: stable@vger.kernel.org #v5.4+
+Signed-off-by: Cédric Le Goater <clg@kaod.org>
+Tested-by: seeteena <s1seetee@linux.vnet.ibm.com>
+Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
+Link: https://lore.kernel.org/r/20211011070203.99726-1-clg@kaod.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ arch/powerpc/sysdev/xive/common.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+--- a/arch/powerpc/sysdev/xive/common.c
++++ b/arch/powerpc/sysdev/xive/common.c
+@@ -997,7 +997,8 @@ static int xive_get_irqchip_state(struct
+ * interrupt to be inactive in that case.
+ */
+ *state = (pq != XIVE_ESB_INVALID) && !xd->stale_p &&
+- (xd->saved_p || !!(pq & XIVE_ESB_VAL_P));
++ (xd->saved_p || (!!(pq & XIVE_ESB_VAL_P) &&
++ !irqd_irq_disabled(data)));
+ return 0;
+ default:
+ return -EINVAL;
virtio-write-back-f_version_1-before-validate.patch
edac-armada-xp-fix-output-of-uncorrectable-error-counter.patch
nvmem-fix-shift-out-of-bound-ubsan-with-byte-size-cells.patch
+kvm-ppc-book3s-hv-fix-stack-handling-in-idle_kvm_start_guest.patch
+kvm-ppc-book3s-hv-make-idle_kvm_start_guest-return-0-if-it-went-to-guest.patch
+x86-kconfig-do-not-enable-amd_mem_encrypt_active_by_default-automatically.patch
+powerpc-xive-discard-disabled-interrupts-in-get_irqchip_state.patch
+iio-adc-aspeed-set-driver-data-when-adc-probe.patch
+drivers-bus-simple-pm-bus-add-support-for-probing-simple-bus-only-devices.patch
+driver-core-reject-pointless-sync_state_only-device-links.patch
+iio-adc-ad7192-add-irq-flag.patch
+iio-adc-ad7780-fix-irq-flag.patch
+iio-adc-ad7793-fix-irq-flag.patch
+iio-adc128s052-fix-the-error-handling-path-of-adc128_probe.patch
+iio-adc-max1027-fix-wrong-shift-with-12-bit-devices.patch
+iio-mtk-auxadc-fix-case-iio_chan_info_processed.patch
+iio-light-opt3001-fixed-timeout-error-when-0-lux.patch
+iio-adc-max1027-fix-the-number-of-max1x31-channels.patch
+iio-ssp_sensors-add-more-range-checking-in-ssp_parse_dataframe.patch
+iio-ssp_sensors-fix-error-code-in-ssp_print_mcu_debug.patch
+iio-dac-ti-dac5571-fix-an-error-code-in-probe.patch
+tee-optee-fix-missing-devices-unregister-during-optee_remove.patch
+arm-dts-bcm2711-rpi-4-b-fix-usb-s-unit-address.patch
+arm-dts-bcm2711-fix-mdio-address-and-size-cells.patch
+arm-dts-bcm2711-rpi-4-b-fix-sd_io_1v8_reg-regulator-states.patch
+arm-dts-bcm2711-rpi-4-b-fix-pcie0-s-unit-address-formatting.patch
--- /dev/null
+From 7f565d0ead264329749c0da488de9c8dfa2f18ce Mon Sep 17 00:00:00 2001
+From: Sumit Garg <sumit.garg@linaro.org>
+Date: Tue, 12 Oct 2021 13:01:16 +0530
+Subject: tee: optee: Fix missing devices unregister during optee_remove
+
+From: Sumit Garg <sumit.garg@linaro.org>
+
+commit 7f565d0ead264329749c0da488de9c8dfa2f18ce upstream.
+
+When OP-TEE driver is built as a module, OP-TEE client devices
+registered on TEE bus during probe should be unregistered during
+optee_remove. So implement optee_unregister_devices() accordingly.
+
+Fixes: c3fa24af9244 ("tee: optee: add TEE bus device enumeration support")
+Reported-by: Sudeep Holla <sudeep.holla@arm.com>
+Signed-off-by: Sumit Garg <sumit.garg@linaro.org>
+Signed-off-by: Jens Wiklander <jens.wiklander@linaro.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/tee/optee/core.c | 3 +++
+ drivers/tee/optee/device.c | 22 ++++++++++++++++++++++
+ drivers/tee/optee/optee_private.h | 1 +
+ 3 files changed, 26 insertions(+)
+
+--- a/drivers/tee/optee/core.c
++++ b/drivers/tee/optee/core.c
+@@ -585,6 +585,9 @@ static int optee_remove(struct platform_
+ {
+ struct optee *optee = platform_get_drvdata(pdev);
+
++ /* Unregister OP-TEE specific client devices on TEE bus */
++ optee_unregister_devices();
++
+ /*
+ * Ask OP-TEE to free all cached shared memory objects to decrease
+ * reference counters and also avoid wild pointers in secure world
+--- a/drivers/tee/optee/device.c
++++ b/drivers/tee/optee/device.c
+@@ -53,6 +53,13 @@ static int get_devices(struct tee_contex
+ return 0;
+ }
+
++static void optee_release_device(struct device *dev)
++{
++ struct tee_client_device *optee_device = to_tee_client_device(dev);
++
++ kfree(optee_device);
++}
++
+ static int optee_register_device(const uuid_t *device_uuid)
+ {
+ struct tee_client_device *optee_device = NULL;
+@@ -63,6 +70,7 @@ static int optee_register_device(const u
+ return -ENOMEM;
+
+ optee_device->dev.bus = &tee_bus_type;
++ optee_device->dev.release = optee_release_device;
+ if (dev_set_name(&optee_device->dev, "optee-ta-%pUb", device_uuid)) {
+ kfree(optee_device);
+ return -ENOMEM;
+@@ -154,3 +162,17 @@ int optee_enumerate_devices(u32 func)
+ {
+ return __optee_enumerate_devices(func);
+ }
++
++static int __optee_unregister_device(struct device *dev, void *data)
++{
++ if (!strncmp(dev_name(dev), "optee-ta", strlen("optee-ta")))
++ device_unregister(dev);
++
++ return 0;
++}
++
++void optee_unregister_devices(void)
++{
++ bus_for_each_dev(&tee_bus_type, NULL, NULL,
++ __optee_unregister_device);
++}
+--- a/drivers/tee/optee/optee_private.h
++++ b/drivers/tee/optee/optee_private.h
+@@ -184,6 +184,7 @@ void optee_fill_pages_list(u64 *dst, str
+ #define PTA_CMD_GET_DEVICES 0x0
+ #define PTA_CMD_GET_DEVICES_SUPP 0x1
+ int optee_enumerate_devices(u32 func);
++void optee_unregister_devices(void);
+
+ /*
+ * Small helpers
--- /dev/null
+From 711885906b5c2df90746a51f4cd674f1ab9fbb1d Mon Sep 17 00:00:00 2001
+From: Borislav Petkov <bp@suse.de>
+Date: Wed, 6 Oct 2021 19:34:55 +0200
+Subject: x86/Kconfig: Do not enable AMD_MEM_ENCRYPT_ACTIVE_BY_DEFAULT automatically
+
+From: Borislav Petkov <bp@suse.de>
+
+commit 711885906b5c2df90746a51f4cd674f1ab9fbb1d upstream.
+
+This Kconfig option was added initially so that memory encryption is
+enabled by default on machines which support it.
+
+However, devices which have DMA masks that are less than the bit
+position of the encryption bit, aka C-bit, require the use of an IOMMU
+or the use of SWIOTLB.
+
+If the IOMMU is disabled or in passthrough mode, the kernel would switch
+to SWIOTLB bounce-buffering for those transfers.
+
+In order to avoid that,
+
+ 2cc13bb4f59f ("iommu: Disable passthrough mode when SME is active")
+
+disables the default IOMMU passthrough mode so that devices for which the
+default 256K DMA is insufficient, can use the IOMMU instead.
+
+However 2, there are cases where the IOMMU is disabled in the BIOS, etc.
+(think the usual hardware folk "oops, I dropped the ball there" cases) or a
+driver doesn't properly use the DMA APIs or a device has a firmware or
+hardware bug, e.g.:
+
+ ea68573d408f ("drm/amdgpu: Fail to load on RAVEN if SME is active")
+
+However 3, in the above GPU use case, there are APIs like Vulkan and
+some OpenGL/OpenCL extensions which are under the assumption that
+user-allocated memory can be passed in to the kernel driver and both the
+GPU and CPU can do coherent and concurrent access to the same memory.
+That cannot work with SWIOTLB bounce buffers, of course.
+
+So, in order for those devices to function, drop the "default y" for the
+SME by default active option so that users who want to have SME enabled,
+will need to either enable it in their config or use "mem_encrypt=on" on
+the kernel command line.
+
+ [ tlendacky: Generalize commit message. ]
+
+Fixes: 7744ccdbc16f ("x86/mm: Add Secure Memory Encryption (SME) support")
+Reported-by: Paul Menzel <pmenzel@molgen.mpg.de>
+Signed-off-by: Borislav Petkov <bp@suse.de>
+Acked-by: Alex Deucher <alexander.deucher@amd.com>
+Acked-by: Tom Lendacky <thomas.lendacky@amd.com>
+Cc: <stable@vger.kernel.org>
+Link: https://lkml.kernel.org/r/8bbacd0e-4580-3194-19d2-a0ecad7df09c@molgen.mpg.de
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ arch/x86/Kconfig | 1 -
+ 1 file changed, 1 deletion(-)
+
+--- a/arch/x86/Kconfig
++++ b/arch/x86/Kconfig
+@@ -1534,7 +1534,6 @@ config AMD_MEM_ENCRYPT
+
+ config AMD_MEM_ENCRYPT_ACTIVE_BY_DEFAULT
+ bool "Activate AMD Secure Memory Encryption (SME) by default"
+- default y
+ depends on AMD_MEM_ENCRYPT
+ help
+ Say yes to have system memory encrypted by default if running on
projects / thirdparty / kernel / stable-queue.git / commitdiff
