From: Greg Kroah-Hartman Date: Mon, 18 Oct 2021 10:56:30 +0000 (+0200) Subject: 5.10-stable patches X-Git-Tag: v4.14.252~20 X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=66993c12715d37b1a62f62e9f8a616d99d1c5f99;p=thirdparty%2Fkernel%2Fstable-queue.git 5.10-stable patches added patches: arm-dts-bcm2711-fix-mdio-address-and-size-cells.patch arm-dts-bcm2711-rpi-4-b-fix-pcie0-s-unit-address-formatting.patch arm-dts-bcm2711-rpi-4-b-fix-sd_io_1v8_reg-regulator-states.patch arm-dts-bcm2711-rpi-4-b-fix-usb-s-unit-address.patch driver-core-reject-pointless-sync_state_only-device-links.patch drivers-bus-simple-pm-bus-add-support-for-probing-simple-bus-only-devices.patch iio-adc-ad7192-add-irq-flag.patch iio-adc-ad7780-fix-irq-flag.patch iio-adc-ad7793-fix-irq-flag.patch iio-adc-aspeed-set-driver-data-when-adc-probe.patch iio-adc-max1027-fix-the-number-of-max1x31-channels.patch iio-adc-max1027-fix-wrong-shift-with-12-bit-devices.patch iio-adc128s052-fix-the-error-handling-path-of-adc128_probe.patch iio-dac-ti-dac5571-fix-an-error-code-in-probe.patch iio-light-opt3001-fixed-timeout-error-when-0-lux.patch iio-mtk-auxadc-fix-case-iio_chan_info_processed.patch iio-ssp_sensors-add-more-range-checking-in-ssp_parse_dataframe.patch iio-ssp_sensors-fix-error-code-in-ssp_print_mcu_debug.patch kvm-ppc-book3s-hv-fix-stack-handling-in-idle_kvm_start_guest.patch kvm-ppc-book3s-hv-make-idle_kvm_start_guest-return-0-if-it-went-to-guest.patch powerpc-xive-discard-disabled-interrupts-in-get_irqchip_state.patch tee-optee-fix-missing-devices-unregister-during-optee_remove.patch x86-kconfig-do-not-enable-amd_mem_encrypt_active_by_default-automatically.patch --- diff --git a/queue-5.10/arm-dts-bcm2711-fix-mdio-address-and-size-cells.patch b/queue-5.10/arm-dts-bcm2711-fix-mdio-address-and-size-cells.patch new file mode 100644 index 00000000000..c99218dca19 --- /dev/null +++ b/queue-5.10/arm-dts-bcm2711-fix-mdio-address-and-size-cells.patch @@ -0,0 +1,37 @@ +From 2faff6737a8a684b077264f0aed131526c99eec4 Mon Sep 17 00:00:00 2001 +From: Stefan Wahren +Date: Sat, 7 Aug 2021 13:06:32 +0200 +Subject: ARM: dts: bcm2711: fix MDIO #address- and #size-cells + +From: Stefan Wahren + +commit 2faff6737a8a684b077264f0aed131526c99eec4 upstream. + +The values of #address-cells and #size-cells are swapped. Fix this +and avoid the following DT schema warnings for mdio@e14: + + #address-cells:0:0: 1 was expected + #size-cells:0:0: 0 was expected + +Fixes: be8af7a9e3cc ("ARM: dts: bcm2711-rpi-4: Enable GENET support") +Signed-off-by: Stefan Wahren +Link: https://lore.kernel.org/r/1628334401-6577-2-git-send-email-stefan.wahren@i2se.com +Signed-off-by: Nicolas Saenz Julienne +Signed-off-by: Greg Kroah-Hartman +--- + arch/arm/boot/dts/bcm2711.dtsi | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/arch/arm/boot/dts/bcm2711.dtsi ++++ b/arch/arm/boot/dts/bcm2711.dtsi +@@ -514,8 +514,8 @@ + compatible = "brcm,genet-mdio-v5"; + reg = <0xe14 0x8>; + reg-names = "mdio"; +- #address-cells = <0x0>; +- #size-cells = <0x1>; ++ #address-cells = <0x1>; ++ #size-cells = <0x0>; + }; + }; + }; diff --git a/queue-5.10/arm-dts-bcm2711-rpi-4-b-fix-pcie0-s-unit-address-formatting.patch b/queue-5.10/arm-dts-bcm2711-rpi-4-b-fix-pcie0-s-unit-address-formatting.patch new file mode 100644 index 00000000000..c0e3f469d69 --- /dev/null +++ b/queue-5.10/arm-dts-bcm2711-rpi-4-b-fix-pcie0-s-unit-address-formatting.patch @@ -0,0 +1,58 @@ +From 13dbc954b3c9a9de0ad5b7279e8d3b708d31068b Mon Sep 17 00:00:00 2001 +From: Nicolas Saenz Julienne +Date: Tue, 31 Aug 2021 14:58:42 +0200 +Subject: ARM: dts: bcm2711-rpi-4-b: Fix pcie0's unit address formatting + +From: Nicolas Saenz Julienne + +commit 13dbc954b3c9a9de0ad5b7279e8d3b708d31068b upstream. + +dtbs_check currently complains that: + +arch/arm/boot/dts/bcm2711-rpi-4-b.dts:220.10-231.4: Warning +(pci_device_reg): /scb/pcie@7d500000/pci@1,0: PCI unit address format +error, expected "0,0" + +Unsurprisingly pci@0,0 is the right address, as illustrated by its reg +property: + + &pcie0 { + pci@0,0 { + /* + * As defined in the IEEE Std 1275-1994 document, + * reg is a five-cell address encoded as (phys.hi + * phys.mid phys.lo size.hi size.lo). phys.hi + * should contain the device's BDF as 0b00000000 + * bbbbbbbb dddddfff 00000000. The other cells + * should be zero. + */ + reg = <0 0 0 0 0>; + }; + }; + +The device is clearly 0. So fix it. + +Also add a missing 'device_type = "pci"'. + +Fixes: 258f92d2f840 ("ARM: dts: bcm2711: Add reset controller to xHCI node") +Suggested-by: Rob Herring +Reviewed-by: Rob Herring +Link: https://lore.kernel.org/r/20210831125843.1233488-1-nsaenzju@redhat.com +Signed-off-by: Nicolas Saenz Julienne +Signed-off-by: Greg Kroah-Hartman +--- + arch/arm/boot/dts/bcm2711-rpi-4-b.dts | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +--- a/arch/arm/boot/dts/bcm2711-rpi-4-b.dts ++++ b/arch/arm/boot/dts/bcm2711-rpi-4-b.dts +@@ -255,7 +255,8 @@ + }; + + &pcie0 { +- pci@1,0 { ++ pci@0,0 { ++ device_type = "pci"; + #address-cells = <3>; + #size-cells = <2>; + ranges; diff --git a/queue-5.10/arm-dts-bcm2711-rpi-4-b-fix-sd_io_1v8_reg-regulator-states.patch b/queue-5.10/arm-dts-bcm2711-rpi-4-b-fix-sd_io_1v8_reg-regulator-states.patch new file mode 100644 index 00000000000..750f25f60d0 --- /dev/null +++ b/queue-5.10/arm-dts-bcm2711-rpi-4-b-fix-sd_io_1v8_reg-regulator-states.patch @@ -0,0 +1,38 @@ +From b55ec7528879a822a4d350248daa04bbb27f25fd Mon Sep 17 00:00:00 2001 +From: Stefan Wahren +Date: Sat, 7 Aug 2021 13:06:33 +0200 +Subject: ARM: dts: bcm2711-rpi-4-b: fix sd_io_1v8_reg regulator states + +From: Stefan Wahren + +commit b55ec7528879a822a4d350248daa04bbb27f25fd upstream. + +DT schema check complains at sd_io_1v8_reg about the following: + + [1800000, 1, 3300000, 0] is too long + Additional items are not allowed (3300000, 0 were unexpected) + +So fix the states definition. + +Fixes: 7dbe8c62ceeb ("ARM: dts: Add minimal Raspberry Pi 4 support") +Signed-off-by: Stefan Wahren +Link: https://lore.kernel.org/r/1628334401-6577-3-git-send-email-stefan.wahren@i2se.com +Signed-off-by: Nicolas Saenz Julienne +Signed-off-by: Greg Kroah-Hartman +--- + arch/arm/boot/dts/bcm2711-rpi-4-b.dts | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/arch/arm/boot/dts/bcm2711-rpi-4-b.dts ++++ b/arch/arm/boot/dts/bcm2711-rpi-4-b.dts +@@ -54,8 +54,8 @@ + regulator-always-on; + regulator-settling-time-us = <5000>; + gpios = <&expgpio 4 GPIO_ACTIVE_HIGH>; +- states = <1800000 0x1 +- 3300000 0x0>; ++ states = <1800000 0x1>, ++ <3300000 0x0>; + status = "okay"; + }; + diff --git a/queue-5.10/arm-dts-bcm2711-rpi-4-b-fix-usb-s-unit-address.patch b/queue-5.10/arm-dts-bcm2711-rpi-4-b-fix-usb-s-unit-address.patch new file mode 100644 index 00000000000..77cda2232ac --- /dev/null +++ b/queue-5.10/arm-dts-bcm2711-rpi-4-b-fix-usb-s-unit-address.patch @@ -0,0 +1,38 @@ +From 3f32472854614d6f53b09b4812372dba9fc5c7de Mon Sep 17 00:00:00 2001 +From: Nicolas Saenz Julienne +Date: Tue, 31 Aug 2021 14:58:43 +0200 +Subject: ARM: dts: bcm2711-rpi-4-b: Fix usb's unit address + +From: Nicolas Saenz Julienne + +commit 3f32472854614d6f53b09b4812372dba9fc5c7de upstream. + +The unit address is supposed to represent ','. Which +are both 0 for RPi4b's XHCI controller. On top of that although +OpenFirmware states bus number goes in the high part of the last reg +parameter, FDT doesn't seem to care for it[1], so remove it. + +[1] https://patchwork.kernel.org/project/linux-arm-kernel/patch/20210830103909.323356-1-nsaenzju@redhat.com/#24414633 +Fixes: 258f92d2f840 ("ARM: dts: bcm2711: Add reset controller to xHCI node") +Suggested-by: Rob Herring +Reviewed-by: Rob Herring +Link: https://lore.kernel.org/r/20210831125843.1233488-2-nsaenzju@redhat.com +Signed-off-by: Nicolas Saenz Julienne +Signed-off-by: Greg Kroah-Hartman +--- + arch/arm/boot/dts/bcm2711-rpi-4-b.dts | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/arch/arm/boot/dts/bcm2711-rpi-4-b.dts ++++ b/arch/arm/boot/dts/bcm2711-rpi-4-b.dts +@@ -262,8 +262,8 @@ + + reg = <0 0 0 0 0>; + +- usb@1,0 { +- reg = <0x10000 0 0 0 0>; ++ usb@0,0 { ++ reg = <0 0 0 0 0>; + resets = <&reset RASPBERRYPI_FIRMWARE_RESET_ID_USB>; + }; + }; diff --git a/queue-5.10/driver-core-reject-pointless-sync_state_only-device-links.patch b/queue-5.10/driver-core-reject-pointless-sync_state_only-device-links.patch new file mode 100644 index 00000000000..2976043eb9e --- /dev/null +++ b/queue-5.10/driver-core-reject-pointless-sync_state_only-device-links.patch @@ -0,0 +1,43 @@ +From f729a592adb6760013c3e48622a5bf256b992452 Mon Sep 17 00:00:00 2001 +From: Saravana Kannan +Date: Wed, 29 Sep 2021 12:05:49 -0700 +Subject: driver core: Reject pointless SYNC_STATE_ONLY device links + +From: Saravana Kannan + +commit f729a592adb6760013c3e48622a5bf256b992452 upstream. + +SYNC_STATE_ONLY device links intentionally allow cycles because cyclic +sync_state() dependencies are valid and necessary. + +However a SYNC_STATE_ONLY device link where the consumer and the supplier +are the same device is pointless because the device link would be deleted +as soon as the device probes (because it's also the consumer) and won't +affect when the sync_state() callback is called. It's a waste of CPU cycles +and memory to create this device link. So reject any attempts to create +such a device link. + +Fixes: 05ef983e0d65 ("driver core: Add device link support for SYNC_STATE_ONLY flag") +Cc: stable +Reported-by: Ulf Hansson +Reviewed-by: Rafael J. Wysocki +Reviewed-by: Ulf Hansson +Signed-off-by: Saravana Kannan +Link: https://lore.kernel.org/r/20210929190549.860541-1-saravanak@google.com +Signed-off-by: Greg Kroah-Hartman +--- + drivers/base/core.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +--- a/drivers/base/core.c ++++ b/drivers/base/core.c +@@ -549,7 +549,8 @@ struct device_link *device_link_add(stru + { + struct device_link *link; + +- if (!consumer || !supplier || flags & ~DL_ADD_VALID_FLAGS || ++ if (!consumer || !supplier || consumer == supplier || ++ flags & ~DL_ADD_VALID_FLAGS || + (flags & DL_FLAG_STATELESS && flags & DL_MANAGED_LINK_FLAGS) || + (flags & DL_FLAG_SYNC_STATE_ONLY && + flags != DL_FLAG_SYNC_STATE_ONLY) || diff --git a/queue-5.10/drivers-bus-simple-pm-bus-add-support-for-probing-simple-bus-only-devices.patch b/queue-5.10/drivers-bus-simple-pm-bus-add-support-for-probing-simple-bus-only-devices.patch new file mode 100644 index 00000000000..e3cde8189d1 --- /dev/null +++ b/queue-5.10/drivers-bus-simple-pm-bus-add-support-for-probing-simple-bus-only-devices.patch @@ -0,0 +1,100 @@ +From 98e96cf80045a383fcc47c58dd4e87b3ae587b3e Mon Sep 17 00:00:00 2001 +From: Saravana Kannan +Date: Tue, 28 Sep 2021 17:07:33 -0700 +Subject: drivers: bus: simple-pm-bus: Add support for probing simple bus only devices + +From: Saravana Kannan + +commit 98e96cf80045a383fcc47c58dd4e87b3ae587b3e upstream. + +fw_devlink could end up creating device links for bus only devices. +However, bus only devices don't get probed and can block probe() or +sync_state() [1] call backs of other devices. To avoid this, probe these +devices using the simple-pm-bus driver. + +However, there are instances of devices that are not simple buses (they get +probed by their specific drivers) that also list the "simple-bus" (or other +bus only compatible strings) in their compatible property to automatically +populate their child devices. We still want these devices to get probed by +their specific drivers. So, we make sure this driver only probes devices +that are only buses. + +[1] - https://lore.kernel.org/lkml/CAPDyKFo9Bxremkb1dDrr4OcXSpE0keVze94Cm=zrkOVxHHxBmQ@mail.gmail.com/ + +Fixes: c442a0d18744 ("driver core: Set fw_devlink to "permissive" behavior by default") +Cc: stable +Cc: Rob Herring +Tested-by: Saravana Kannan +Tested-by: Ulf Hansson +Tested-by: Geert Uytterhoeven +Tested-by: Damien Le Moal +Signed-off-by: Saravana Kannan +Link: https://lore.kernel.org/r/20210929000735.585237-2-saravanak@google.com +Signed-off-by: Greg Kroah-Hartman +--- + drivers/bus/simple-pm-bus.c | 39 ++++++++++++++++++++++++++++++++++++++- + 1 file changed, 38 insertions(+), 1 deletion(-) + +--- a/drivers/bus/simple-pm-bus.c ++++ b/drivers/bus/simple-pm-bus.c +@@ -16,7 +16,33 @@ + + static int simple_pm_bus_probe(struct platform_device *pdev) + { +- struct device_node *np = pdev->dev.of_node; ++ const struct device *dev = &pdev->dev; ++ struct device_node *np = dev->of_node; ++ const struct of_device_id *match; ++ ++ /* ++ * Allow user to use driver_override to bind this driver to a ++ * transparent bus device which has a different compatible string ++ * that's not listed in simple_pm_bus_of_match. We don't want to do any ++ * of the simple-pm-bus tasks for these devices, so return early. ++ */ ++ if (pdev->driver_override) ++ return 0; ++ ++ match = of_match_device(dev->driver->of_match_table, dev); ++ /* ++ * These are transparent bus devices (not simple-pm-bus matches) that ++ * have their child nodes populated automatically. So, don't need to ++ * do anything more. We only match with the device if this driver is ++ * the most specific match because we don't want to incorrectly bind to ++ * a device that has a more specific driver. ++ */ ++ if (match && match->data) { ++ if (of_property_match_string(np, "compatible", match->compatible) == 0) ++ return 0; ++ else ++ return -ENODEV; ++ } + + dev_dbg(&pdev->dev, "%s\n", __func__); + +@@ -30,14 +56,25 @@ static int simple_pm_bus_probe(struct pl + + static int simple_pm_bus_remove(struct platform_device *pdev) + { ++ const void *data = of_device_get_match_data(&pdev->dev); ++ ++ if (pdev->driver_override || data) ++ return 0; ++ + dev_dbg(&pdev->dev, "%s\n", __func__); + + pm_runtime_disable(&pdev->dev); + return 0; + } + ++#define ONLY_BUS ((void *) 1) /* Match if the device is only a bus. */ ++ + static const struct of_device_id simple_pm_bus_of_match[] = { + { .compatible = "simple-pm-bus", }, ++ { .compatible = "simple-bus", .data = ONLY_BUS }, ++ { .compatible = "simple-mfd", .data = ONLY_BUS }, ++ { .compatible = "isa", .data = ONLY_BUS }, ++ { .compatible = "arm,amba-bus", .data = ONLY_BUS }, + { /* sentinel */ } + }; + MODULE_DEVICE_TABLE(of, simple_pm_bus_of_match); diff --git a/queue-5.10/iio-adc-ad7192-add-irq-flag.patch b/queue-5.10/iio-adc-ad7192-add-irq-flag.patch new file mode 100644 index 00000000000..365272a6a8b --- /dev/null +++ b/queue-5.10/iio-adc-ad7192-add-irq-flag.patch @@ -0,0 +1,42 @@ +From 89a86da5cb8e0ee153111fb68a719d31582c206b Mon Sep 17 00:00:00 2001 +From: Alexandru Tachici +Date: Mon, 6 Sep 2021 09:56:28 +0300 +Subject: iio: adc: ad7192: Add IRQ flag + +From: Alexandru Tachici + +commit 89a86da5cb8e0ee153111fb68a719d31582c206b upstream. + +IRQ type in ad_sigma_delta_info struct was missing. + +In Sigma-Delta devices the SDO line is also used as an interrupt. +Leaving IRQ on level instead of falling might trigger a sample read +when the IRQ is enabled, as the SDO line is already low. Not sure +if SDO line will always immediately go high in ad_sd_buffer_postenable +before the IRQ is enabled. + +Also the datasheet seem to explicitly say the falling edge of the SDO +should be used as an interrupt: +>From the AD7192 datasheet: "The DOUT/RDY falling edge can be used +as an interrupt to a processor," + +Fixes: da4d3d6bb9f6 ("iio: adc: ad-sigma-delta: Allow custom IRQ flags") +Signed-off-by: Alexandru Tachici +Cc: +Link: https://lore.kernel.org/r/20210906065630.16325-2-alexandru.tachici@analog.com +Signed-off-by: Jonathan Cameron +Signed-off-by: Greg Kroah-Hartman +--- + drivers/iio/adc/ad7192.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/drivers/iio/adc/ad7192.c ++++ b/drivers/iio/adc/ad7192.c +@@ -293,6 +293,7 @@ static const struct ad_sigma_delta_info + .has_registers = true, + .addr_shift = 3, + .read_mask = BIT(6), ++ .irq_flags = IRQF_TRIGGER_FALLING, + }; + + static const struct ad_sd_calib_data ad7192_calib_arr[8] = { diff --git a/queue-5.10/iio-adc-ad7780-fix-irq-flag.patch b/queue-5.10/iio-adc-ad7780-fix-irq-flag.patch new file mode 100644 index 00000000000..3b7d3b96e63 --- /dev/null +++ b/queue-5.10/iio-adc-ad7780-fix-irq-flag.patch @@ -0,0 +1,43 @@ +From e081102f3077aa716974ccebec97003c890d5641 Mon Sep 17 00:00:00 2001 +From: Alexandru Tachici +Date: Mon, 6 Sep 2021 09:56:29 +0300 +Subject: iio: adc: ad7780: Fix IRQ flag + +From: Alexandru Tachici + +commit e081102f3077aa716974ccebec97003c890d5641 upstream. + +Correct IRQ flag here is falling. + +In Sigma-Delta devices the SDO line is also used as an interrupt. +Leaving IRQ on level instead of falling might trigger a sample read +when the IRQ is enabled, as the SDO line is already low. Not sure +if SDO line will always immediately go high in ad_sd_buffer_postenable +before the IRQ is enabled. + +Also the datasheet seem to explicitly say the falling edge of the SDO +should be used as an interrupt: +>From the AD7780 datasheet: " The DOUT/Figure 22 RDY falling edge +can be used as an interrupt to a processor" + +Fixes: da4d3d6bb9f6 ("iio: adc: ad-sigma-delta: Allow custom IRQ flags") +Signed-off-by: Alexandru Tachici +Cc: +Link: https://lore.kernel.org/r/20210906065630.16325-3-alexandru.tachici@analog.com +Signed-off-by: Jonathan Cameron +Signed-off-by: Greg Kroah-Hartman +--- + drivers/iio/adc/ad7780.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/iio/adc/ad7780.c ++++ b/drivers/iio/adc/ad7780.c +@@ -203,7 +203,7 @@ static const struct ad_sigma_delta_info + .set_mode = ad7780_set_mode, + .postprocess_sample = ad7780_postprocess_sample, + .has_registers = false, +- .irq_flags = IRQF_TRIGGER_LOW, ++ .irq_flags = IRQF_TRIGGER_FALLING, + }; + + #define _AD7780_CHANNEL(_bits, _wordsize, _mask_all) \ diff --git a/queue-5.10/iio-adc-ad7793-fix-irq-flag.patch b/queue-5.10/iio-adc-ad7793-fix-irq-flag.patch new file mode 100644 index 00000000000..824839f2e20 --- /dev/null +++ b/queue-5.10/iio-adc-ad7793-fix-irq-flag.patch @@ -0,0 +1,41 @@ +From 1a913270e57a8e7f1e3789802f1f64e6d0654626 Mon Sep 17 00:00:00 2001 +From: Alexandru Tachici +Date: Mon, 6 Sep 2021 09:56:30 +0300 +Subject: iio: adc: ad7793: Fix IRQ flag + +From: Alexandru Tachici + +commit 1a913270e57a8e7f1e3789802f1f64e6d0654626 upstream. + +In Sigma-Delta devices the SDO line is also used as an interrupt. +Leaving IRQ on level instead of falling might trigger a sample read +when the IRQ is enabled, as the SDO line is already low. Not sure +if SDO line will always immediately go high in ad_sd_buffer_postenable +before the IRQ is enabled. + +Also the datasheet seem to explicitly say the falling edge of the SDO +should be used as an interrupt: +>From the AD7793 datasheet: " The DOUT/RDY falling edge can be +used as an interrupt to a processor" + +Fixes: da4d3d6bb9f6 ("iio: adc: ad-sigma-delta: Allow custom IRQ flags") +Signed-off-by: Alexandru Tachici +Cc: +Link: https://lore.kernel.org/r/20210906065630.16325-4-alexandru.tachici@analog.com +Signed-off-by: Jonathan Cameron +Signed-off-by: Greg Kroah-Hartman +--- + drivers/iio/adc/ad7793.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/iio/adc/ad7793.c ++++ b/drivers/iio/adc/ad7793.c +@@ -206,7 +206,7 @@ static const struct ad_sigma_delta_info + .has_registers = true, + .addr_shift = 3, + .read_mask = BIT(6), +- .irq_flags = IRQF_TRIGGER_LOW, ++ .irq_flags = IRQF_TRIGGER_FALLING, + }; + + static const struct ad_sd_calib_data ad7793_calib_arr[6] = { diff --git a/queue-5.10/iio-adc-aspeed-set-driver-data-when-adc-probe.patch b/queue-5.10/iio-adc-aspeed-set-driver-data-when-adc-probe.patch new file mode 100644 index 00000000000..770a9765202 --- /dev/null +++ b/queue-5.10/iio-adc-aspeed-set-driver-data-when-adc-probe.patch @@ -0,0 +1,31 @@ +From eb795cd97365a3d3d9da3926d234a7bc32a3bb15 Mon Sep 17 00:00:00 2001 +From: Billy Tsai +Date: Tue, 31 Aug 2021 15:14:44 +0800 +Subject: iio: adc: aspeed: set driver data when adc probe. + +From: Billy Tsai + +commit eb795cd97365a3d3d9da3926d234a7bc32a3bb15 upstream. + +Fix the issue when adc remove will get the null driver data. + +Fixed: commit 573803234e72 ("iio: Aspeed ADC") +Signed-off-by: Billy Tsai +Link: https://lore.kernel.org/r/20210831071458.2334-2-billy_tsai@aspeedtech.com +Cc: +Signed-off-by: Jonathan Cameron +Signed-off-by: Greg Kroah-Hartman +--- + drivers/iio/adc/aspeed_adc.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/drivers/iio/adc/aspeed_adc.c ++++ b/drivers/iio/adc/aspeed_adc.c +@@ -183,6 +183,7 @@ static int aspeed_adc_probe(struct platf + + data = iio_priv(indio_dev); + data->dev = &pdev->dev; ++ platform_set_drvdata(pdev, indio_dev); + + data->base = devm_platform_ioremap_resource(pdev, 0); + if (IS_ERR(data->base)) diff --git a/queue-5.10/iio-adc-max1027-fix-the-number-of-max1x31-channels.patch b/queue-5.10/iio-adc-max1027-fix-the-number-of-max1x31-channels.patch new file mode 100644 index 00000000000..da8cc146475 --- /dev/null +++ b/queue-5.10/iio-adc-max1027-fix-the-number-of-max1x31-channels.patch @@ -0,0 +1,38 @@ +From f0cb5fed37ab37f6a6c5463c5fd39b58a45670c8 Mon Sep 17 00:00:00 2001 +From: Miquel Raynal +Date: Wed, 18 Aug 2021 13:11:25 +0200 +Subject: iio: adc: max1027: Fix the number of max1X31 channels +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Miquel Raynal + +commit f0cb5fed37ab37f6a6c5463c5fd39b58a45670c8 upstream. + +The macro MAX1X29_CHANNELS() already calls MAX1X27_CHANNELS(). +Calling MAX1X27_CHANNELS() before MAX1X29_CHANNELS() in the definition +of MAX1X31_CHANNELS() declares the first 8 channels twice. So drop this +extra call from the MAX1X31 channels list definition. + +Fixes: 7af5257d8427 ("iio: adc: max1027: Prepare the introduction of different resolutions") +Cc: stable@vger.kernel.org +Signed-off-by: Miquel Raynal +Reviewed-by: Nuno Sá +Link: https://lore.kernel.org/r/20210818111139.330636-3-miquel.raynal@bootlin.com +Signed-off-by: Jonathan Cameron +Signed-off-by: Greg Kroah-Hartman +--- + drivers/iio/adc/max1027.c | 1 - + 1 file changed, 1 deletion(-) + +--- a/drivers/iio/adc/max1027.c ++++ b/drivers/iio/adc/max1027.c +@@ -142,7 +142,6 @@ MODULE_DEVICE_TABLE(of, max1027_adc_dt_i + MAX1027_V_CHAN(11, depth) + + #define MAX1X31_CHANNELS(depth) \ +- MAX1X27_CHANNELS(depth), \ + MAX1X29_CHANNELS(depth), \ + MAX1027_V_CHAN(12, depth), \ + MAX1027_V_CHAN(13, depth), \ diff --git a/queue-5.10/iio-adc-max1027-fix-wrong-shift-with-12-bit-devices.patch b/queue-5.10/iio-adc-max1027-fix-wrong-shift-with-12-bit-devices.patch new file mode 100644 index 00000000000..0a227b8439e --- /dev/null +++ b/queue-5.10/iio-adc-max1027-fix-wrong-shift-with-12-bit-devices.patch @@ -0,0 +1,37 @@ +From 732ae19ee8f58ecaf30cbc1bbbda5cbee6a45043 Mon Sep 17 00:00:00 2001 +From: Miquel Raynal +Date: Wed, 18 Aug 2021 13:11:24 +0200 +Subject: iio: adc: max1027: Fix wrong shift with 12-bit devices +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Miquel Raynal + +commit 732ae19ee8f58ecaf30cbc1bbbda5cbee6a45043 upstream. + +10-bit devices must shift the value twice. +This is not needed anymore on 12-bit devices. + +Fixes: ae47d009b508 ("iio: adc: max1027: Introduce 12-bit devices support") +Cc: stable@vger.kernel.org +Signed-off-by: Miquel Raynal +Reviewed-by: Nuno Sá +Link: https://lore.kernel.org/r/20210818111139.330636-2-miquel.raynal@bootlin.com +Signed-off-by: Jonathan Cameron +Signed-off-by: Greg Kroah-Hartman +--- + drivers/iio/adc/max1027.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/iio/adc/max1027.c ++++ b/drivers/iio/adc/max1027.c +@@ -103,7 +103,7 @@ MODULE_DEVICE_TABLE(of, max1027_adc_dt_i + .sign = 'u', \ + .realbits = depth, \ + .storagebits = 16, \ +- .shift = 2, \ ++ .shift = (depth == 10) ? 2 : 0, \ + .endianness = IIO_BE, \ + }, \ + } diff --git a/queue-5.10/iio-adc128s052-fix-the-error-handling-path-of-adc128_probe.patch b/queue-5.10/iio-adc128s052-fix-the-error-handling-path-of-adc128_probe.patch new file mode 100644 index 00000000000..7c53fea27ef --- /dev/null +++ b/queue-5.10/iio-adc128s052-fix-the-error-handling-path-of-adc128_probe.patch @@ -0,0 +1,42 @@ +From bbcf40816b547b3c37af49168950491d20d81ce1 Mon Sep 17 00:00:00 2001 +From: Christophe JAILLET +Date: Sat, 21 Aug 2021 12:37:24 +0200 +Subject: iio: adc128s052: Fix the error handling path of 'adc128_probe()' + +From: Christophe JAILLET + +commit bbcf40816b547b3c37af49168950491d20d81ce1 upstream. + +A successful 'regulator_enable()' call should be balanced by a +corresponding 'regulator_disable()' call in the error handling path of the +probe, as already done in the remove function. + +Update the error handling path accordingly. + +Fixes: 913b86468674 ("iio: adc: Add TI ADC128S052") +Signed-off-by: Christophe JAILLET +Reviewed-by: Alexandru Ardelean +Link: https://lore.kernel.org/r/85189f1cfcf6f5f7b42d8730966f2a074b07b5f5.1629542160.git.christophe.jaillet@wanadoo.fr +Cc: +Signed-off-by: Jonathan Cameron +Signed-off-by: Greg Kroah-Hartman +--- + drivers/iio/adc/ti-adc128s052.c | 6 ++++++ + 1 file changed, 6 insertions(+) + +--- a/drivers/iio/adc/ti-adc128s052.c ++++ b/drivers/iio/adc/ti-adc128s052.c +@@ -171,7 +171,13 @@ static int adc128_probe(struct spi_devic + mutex_init(&adc->lock); + + ret = iio_device_register(indio_dev); ++ if (ret) ++ goto err_disable_regulator; + ++ return 0; ++ ++err_disable_regulator: ++ regulator_disable(adc->reg); + return ret; + } + diff --git a/queue-5.10/iio-dac-ti-dac5571-fix-an-error-code-in-probe.patch b/queue-5.10/iio-dac-ti-dac5571-fix-an-error-code-in-probe.patch new file mode 100644 index 00000000000..b6add44b4cb --- /dev/null +++ b/queue-5.10/iio-dac-ti-dac5571-fix-an-error-code-in-probe.patch @@ -0,0 +1,31 @@ +From f7a28df7db84eb3410e9eca37832efa5aed93338 Mon Sep 17 00:00:00 2001 +From: Dan Carpenter +Date: Mon, 16 Aug 2021 21:39:54 +0300 +Subject: iio: dac: ti-dac5571: fix an error code in probe() + +From: Dan Carpenter + +commit f7a28df7db84eb3410e9eca37832efa5aed93338 upstream. + +If we have an unexpected number of channels then return -EINVAL instead +of returning success. + +Fixes: df38a4a72a3b ("iio: dac: add TI DAC5571 family support") +Signed-off-by: Dan Carpenter +Link: https://lore.kernel.org/r/20210816183954.GB2068@kili +Signed-off-by: Jonathan Cameron +Signed-off-by: Greg Kroah-Hartman +--- + drivers/iio/dac/ti-dac5571.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/drivers/iio/dac/ti-dac5571.c ++++ b/drivers/iio/dac/ti-dac5571.c +@@ -350,6 +350,7 @@ static int dac5571_probe(struct i2c_clie + data->dac5571_pwrdwn = dac5571_pwrdwn_quad; + break; + default: ++ ret = -EINVAL; + goto err; + } + diff --git a/queue-5.10/iio-light-opt3001-fixed-timeout-error-when-0-lux.patch b/queue-5.10/iio-light-opt3001-fixed-timeout-error-when-0-lux.patch new file mode 100644 index 00000000000..49fa007f102 --- /dev/null +++ b/queue-5.10/iio-light-opt3001-fixed-timeout-error-when-0-lux.patch @@ -0,0 +1,44 @@ +From 26d90b5590579def54382a2fc34cfbe8518a9851 Mon Sep 17 00:00:00 2001 +From: Jiri Valek - 2N +Date: Mon, 20 Sep 2021 14:53:48 +0200 +Subject: iio: light: opt3001: Fixed timeout error when 0 lux + +From: Jiri Valek - 2N + +commit 26d90b5590579def54382a2fc34cfbe8518a9851 upstream. + +Reading from sensor returned timeout error under +zero light conditions. + +Signed-off-by: Jiri Valek - 2N +Fixes: ac663db3678a ("iio: light: opt3001: enable operation w/o IRQ") +Link: https://lore.kernel.org/r/20210920125351.6569-1-valek@2n.cz +Cc: +Signed-off-by: Jonathan Cameron +Signed-off-by: Greg Kroah-Hartman +--- + drivers/iio/light/opt3001.c | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +--- a/drivers/iio/light/opt3001.c ++++ b/drivers/iio/light/opt3001.c +@@ -276,6 +276,8 @@ static int opt3001_get_lux(struct opt300 + ret = wait_event_timeout(opt->result_ready_queue, + opt->result_ready, + msecs_to_jiffies(OPT3001_RESULT_READY_LONG)); ++ if (ret == 0) ++ return -ETIMEDOUT; + } else { + /* Sleep for result ready time */ + timeout = (opt->int_time == OPT3001_INT_TIME_SHORT) ? +@@ -312,9 +314,7 @@ err: + /* Disallow IRQ to access the device while lock is active */ + opt->ok_to_ignore_lock = false; + +- if (ret == 0) +- return -ETIMEDOUT; +- else if (ret < 0) ++ if (ret < 0) + return ret; + + if (opt->use_irq) { diff --git a/queue-5.10/iio-mtk-auxadc-fix-case-iio_chan_info_processed.patch b/queue-5.10/iio-mtk-auxadc-fix-case-iio_chan_info_processed.patch new file mode 100644 index 00000000000..729820dace7 --- /dev/null +++ b/queue-5.10/iio-mtk-auxadc-fix-case-iio_chan_info_processed.patch @@ -0,0 +1,48 @@ +From c2980c64c7fd4585d684574c92d1624d44961edd Mon Sep 17 00:00:00 2001 +From: Hui Liu +Date: Sun, 26 Sep 2021 15:30:28 +0800 +Subject: iio: mtk-auxadc: fix case IIO_CHAN_INFO_PROCESSED + +From: Hui Liu + +commit c2980c64c7fd4585d684574c92d1624d44961edd upstream. + +The previous driver does't apply the necessary scaling to take the +voltage range into account. +We change readback value from raw data to input voltage to fix case +IIO_CHAN_INFO_PROCESSED. + +Fixes: ace4cdfe67be ("iio: adc: mt2701: Add Mediatek auxadc driver for mt2701.") +Signed-off-by: Hui Liu +Link: https://lore.kernel.org/r/20210926073028.11045-2-hui.liu@mediatek.com +Cc: +Signed-off-by: Jonathan Cameron +Signed-off-by: Greg Kroah-Hartman +--- + drivers/iio/adc/mt6577_auxadc.c | 8 ++++++++ + 1 file changed, 8 insertions(+) + +--- a/drivers/iio/adc/mt6577_auxadc.c ++++ b/drivers/iio/adc/mt6577_auxadc.c +@@ -82,6 +82,10 @@ static const struct iio_chan_spec mt6577 + MT6577_AUXADC_CHANNEL(15), + }; + ++/* For Voltage calculation */ ++#define VOLTAGE_FULL_RANGE 1500 /* VA voltage */ ++#define AUXADC_PRECISE 4096 /* 12 bits */ ++ + static int mt_auxadc_get_cali_data(int rawdata, bool enable_cali) + { + return rawdata; +@@ -191,6 +195,10 @@ static int mt6577_auxadc_read_raw(struct + } + if (adc_dev->dev_comp->sample_data_cali) + *val = mt_auxadc_get_cali_data(*val, true); ++ ++ /* Convert adc raw data to voltage: 0 - 1500 mV */ ++ *val = *val * VOLTAGE_FULL_RANGE / AUXADC_PRECISE; ++ + return IIO_VAL_INT; + + default: diff --git a/queue-5.10/iio-ssp_sensors-add-more-range-checking-in-ssp_parse_dataframe.patch b/queue-5.10/iio-ssp_sensors-add-more-range-checking-in-ssp_parse_dataframe.patch new file mode 100644 index 00000000000..48157f462d9 --- /dev/null +++ b/queue-5.10/iio-ssp_sensors-add-more-range-checking-in-ssp_parse_dataframe.patch @@ -0,0 +1,57 @@ +From 8167c9a375ccceed19048ad9d68cb2d02ed276e0 Mon Sep 17 00:00:00 2001 +From: Dan Carpenter +Date: Thu, 9 Sep 2021 12:13:36 +0300 +Subject: iio: ssp_sensors: add more range checking in ssp_parse_dataframe() + +From: Dan Carpenter + +commit 8167c9a375ccceed19048ad9d68cb2d02ed276e0 upstream. + +The "idx" is validated at the start of the loop but it gets incremented +during the iteration so it needs to be checked again. + +Fixes: 50dd64d57eee ("iio: common: ssp_sensors: Add sensorhub driver") +Signed-off-by: Dan Carpenter +Link: https://lore.kernel.org/r/20210909091336.GA26312@kili +Cc: +Signed-off-by: Jonathan Cameron +Signed-off-by: Greg Kroah-Hartman +--- + drivers/iio/common/ssp_sensors/ssp_spi.c | 9 ++++++++- + 1 file changed, 8 insertions(+), 1 deletion(-) + +--- a/drivers/iio/common/ssp_sensors/ssp_spi.c ++++ b/drivers/iio/common/ssp_sensors/ssp_spi.c +@@ -273,6 +273,8 @@ static int ssp_parse_dataframe(struct ss + for (idx = 0; idx < len;) { + switch (dataframe[idx++]) { + case SSP_MSG2AP_INST_BYPASS_DATA: ++ if (idx >= len) ++ return -EPROTO; + sd = dataframe[idx++]; + if (sd < 0 || sd >= SSP_SENSOR_MAX) { + dev_err(SSP_DEV, +@@ -282,10 +284,13 @@ static int ssp_parse_dataframe(struct ss + + if (indio_devs[sd]) { + spd = iio_priv(indio_devs[sd]); +- if (spd->process_data) ++ if (spd->process_data) { ++ if (idx >= len) ++ return -EPROTO; + spd->process_data(indio_devs[sd], + &dataframe[idx], + data->timestamp); ++ } + } else { + dev_err(SSP_DEV, "no client for frame\n"); + } +@@ -293,6 +298,8 @@ static int ssp_parse_dataframe(struct ss + idx += ssp_offset_map[sd]; + break; + case SSP_MSG2AP_INST_DEBUG_DATA: ++ if (idx >= len) ++ return -EPROTO; + sd = ssp_print_mcu_debug(dataframe, &idx, len); + if (sd) { + dev_err(SSP_DEV, diff --git a/queue-5.10/iio-ssp_sensors-fix-error-code-in-ssp_print_mcu_debug.patch b/queue-5.10/iio-ssp_sensors-fix-error-code-in-ssp_print_mcu_debug.patch new file mode 100644 index 00000000000..c4ac7e17250 --- /dev/null +++ b/queue-5.10/iio-ssp_sensors-fix-error-code-in-ssp_print_mcu_debug.patch @@ -0,0 +1,35 @@ +From 4170d3dd1467e9d78cb9af374b19357dc324b328 Mon Sep 17 00:00:00 2001 +From: Dan Carpenter +Date: Tue, 14 Sep 2021 13:53:33 +0300 +Subject: iio: ssp_sensors: fix error code in ssp_print_mcu_debug() + +From: Dan Carpenter + +commit 4170d3dd1467e9d78cb9af374b19357dc324b328 upstream. + +The ssp_print_mcu_debug() function should return negative error codes on +error. Returning "length" is meaningless. This change does not affect +runtime because the callers only care about zero/non-zero. + +Reported-by: Jonathan Cameron +Fixes: 50dd64d57eee ("iio: common: ssp_sensors: Add sensorhub driver") +Signed-off-by: Dan Carpenter +Link: https://lore.kernel.org/r/20210914105333.GA11657@kili +Cc: +Signed-off-by: Jonathan Cameron +Signed-off-by: Greg Kroah-Hartman +--- + drivers/iio/common/ssp_sensors/ssp_spi.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/iio/common/ssp_sensors/ssp_spi.c ++++ b/drivers/iio/common/ssp_sensors/ssp_spi.c +@@ -137,7 +137,7 @@ static int ssp_print_mcu_debug(char *dat + if (length > received_len - *data_index || length <= 0) { + ssp_dbg("[SSP]: MSG From MCU-invalid debug length(%d/%d)\n", + length, received_len); +- return length ? length : -EPROTO; ++ return -EPROTO; + } + + ssp_dbg("[SSP]: MSG From MCU - %s\n", &data_frame[*data_index]); diff --git a/queue-5.10/kvm-ppc-book3s-hv-fix-stack-handling-in-idle_kvm_start_guest.patch b/queue-5.10/kvm-ppc-book3s-hv-fix-stack-handling-in-idle_kvm_start_guest.patch new file mode 100644 index 00000000000..26345499222 --- /dev/null +++ b/queue-5.10/kvm-ppc-book3s-hv-fix-stack-handling-in-idle_kvm_start_guest.patch @@ -0,0 +1,105 @@ +From 9b4416c5095c20e110c82ae602c254099b83b72f Mon Sep 17 00:00:00 2001 +From: Michael Ellerman +Date: Fri, 15 Oct 2021 23:01:48 +1100 +Subject: KVM: PPC: Book3S HV: Fix stack handling in idle_kvm_start_guest() + +From: Michael Ellerman + +commit 9b4416c5095c20e110c82ae602c254099b83b72f upstream. + +In commit 10d91611f426 ("powerpc/64s: Reimplement book3s idle code in +C") kvm_start_guest() became idle_kvm_start_guest(). The old code +allocated a stack frame on the emergency stack, but didn't use the +frame to store anything, and also didn't store anything in its caller's +frame. + +idle_kvm_start_guest() on the other hand is written more like a normal C +function, it creates a frame on entry, and also stores CR/LR into its +callers frame (per the ABI). The problem is that there is no caller +frame on the emergency stack. + +The emergency stack for a given CPU is allocated with: + + paca_ptrs[i]->emergency_sp = alloc_stack(limit, i) + THREAD_SIZE; + +So emergency_sp actually points to the first address above the emergency +stack allocation for a given CPU, we must not store above it without +first decrementing it to create a frame. This is different to the +regular kernel stack, paca->kstack, which is initialised to point at an +initial frame that is ready to use. + +idle_kvm_start_guest() stores the backchain, CR and LR all of which +write outside the allocation for the emergency stack. It then creates a +stack frame and saves the non-volatile registers. Unfortunately the +frame it creates is not large enough to fit the non-volatiles, and so +the saving of the non-volatile registers also writes outside the +emergency stack allocation. + +The end result is that we corrupt whatever is at 0-24 bytes, and 112-248 +bytes above the emergency stack allocation. + +In practice this has gone unnoticed because the memory immediately above +the emergency stack happens to be used for other stack allocations, +either another CPUs mc_emergency_sp or an IRQ stack. See the order of +calls to irqstack_early_init() and emergency_stack_init(). + +The low addresses of another stack are the top of that stack, and so are +only used if that stack is under extreme pressue, which essentially +never happens in practice - and if it did there's a high likelyhood we'd +crash due to that stack overflowing. + +Still, we shouldn't be corrupting someone else's stack, and it is purely +luck that we aren't corrupting something else. + +To fix it we save CR/LR into the caller's frame using the existing r1 on +entry, we then create a SWITCH_FRAME_SIZE frame (which has space for +pt_regs) on the emergency stack with the backchain pointing to the +existing stack, and then finally we switch to the new frame on the +emergency stack. + +Fixes: 10d91611f426 ("powerpc/64s: Reimplement book3s idle code in C") +Cc: stable@vger.kernel.org # v5.2+ +Signed-off-by: Michael Ellerman +Link: https://lore.kernel.org/r/20211015133929.832061-1-mpe@ellerman.id.au +Signed-off-by: Greg Kroah-Hartman +--- + arch/powerpc/kvm/book3s_hv_rmhandlers.S | 19 ++++++++++--------- + 1 file changed, 10 insertions(+), 9 deletions(-) + +--- a/arch/powerpc/kvm/book3s_hv_rmhandlers.S ++++ b/arch/powerpc/kvm/book3s_hv_rmhandlers.S +@@ -292,13 +292,15 @@ kvm_novcpu_exit: + * r3 contains the SRR1 wakeup value, SRR1 is trashed. + */ + _GLOBAL(idle_kvm_start_guest) +- ld r4,PACAEMERGSP(r13) + mfcr r5 + mflr r0 +- std r1,0(r4) +- std r5,8(r4) +- std r0,16(r4) +- subi r1,r4,STACK_FRAME_OVERHEAD ++ std r5, 8(r1) // Save CR in caller's frame ++ std r0, 16(r1) // Save LR in caller's frame ++ // Create frame on emergency stack ++ ld r4, PACAEMERGSP(r13) ++ stdu r1, -SWITCH_FRAME_SIZE(r4) ++ // Switch to new frame on emergency stack ++ mr r1, r4 + SAVE_NVGPRS(r1) + + /* +@@ -444,10 +446,9 @@ kvm_no_guest: + /* set up r3 for return */ + mfspr r3,SPRN_SRR1 + REST_NVGPRS(r1) +- addi r1, r1, STACK_FRAME_OVERHEAD +- ld r0, 16(r1) +- ld r5, 8(r1) +- ld r1, 0(r1) ++ ld r1, 0(r1) // Switch back to caller stack ++ ld r0, 16(r1) // Reload LR ++ ld r5, 8(r1) // Reload CR + mtlr r0 + mtcr r5 + blr diff --git a/queue-5.10/kvm-ppc-book3s-hv-make-idle_kvm_start_guest-return-0-if-it-went-to-guest.patch b/queue-5.10/kvm-ppc-book3s-hv-make-idle_kvm_start_guest-return-0-if-it-went-to-guest.patch new file mode 100644 index 00000000000..c23921e2936 --- /dev/null +++ b/queue-5.10/kvm-ppc-book3s-hv-make-idle_kvm_start_guest-return-0-if-it-went-to-guest.patch @@ -0,0 +1,71 @@ +From cdeb5d7d890e14f3b70e8087e745c4a6a7d9f337 Mon Sep 17 00:00:00 2001 +From: Michael Ellerman +Date: Fri, 15 Oct 2021 23:02:08 +1100 +Subject: KVM: PPC: Book3S HV: Make idle_kvm_start_guest() return 0 if it went to guest + +From: Michael Ellerman + +commit cdeb5d7d890e14f3b70e8087e745c4a6a7d9f337 upstream. + +We call idle_kvm_start_guest() from power7_offline() if the thread has +been requested to enter KVM. We pass it the SRR1 value that was returned +from power7_idle_insn() which tells us what sort of wakeup we're +processing. + +Depending on the SRR1 value we pass in, the KVM code might enter the +guest, or it might return to us to do some host action if the wakeup +requires it. + +If idle_kvm_start_guest() is able to handle the wakeup, and enter the +guest it is supposed to indicate that by returning a zero SRR1 value to +us. + +That was the behaviour prior to commit 10d91611f426 ("powerpc/64s: +Reimplement book3s idle code in C"), however in that commit the +handling of SRR1 was reworked, and the zeroing behaviour was lost. + +Returning from idle_kvm_start_guest() without zeroing the SRR1 value can +confuse the host offline code, causing the guest to crash and other +weirdness. + +Fixes: 10d91611f426 ("powerpc/64s: Reimplement book3s idle code in C") +Cc: stable@vger.kernel.org # v5.2+ +Signed-off-by: Michael Ellerman +Link: https://lore.kernel.org/r/20211015133929.832061-2-mpe@ellerman.id.au +Signed-off-by: Greg Kroah-Hartman +--- + arch/powerpc/kvm/book3s_hv_rmhandlers.S | 9 +++++++-- + 1 file changed, 7 insertions(+), 2 deletions(-) + +--- a/arch/powerpc/kvm/book3s_hv_rmhandlers.S ++++ b/arch/powerpc/kvm/book3s_hv_rmhandlers.S +@@ -301,6 +301,7 @@ _GLOBAL(idle_kvm_start_guest) + stdu r1, -SWITCH_FRAME_SIZE(r4) + // Switch to new frame on emergency stack + mr r1, r4 ++ std r3, 32(r1) // Save SRR1 wakeup value + SAVE_NVGPRS(r1) + + /* +@@ -352,6 +353,10 @@ kvm_unsplit_wakeup: + + kvm_secondary_got_guest: + ++ // About to go to guest, clear saved SRR1 ++ li r0, 0 ++ std r0, 32(r1) ++ + /* Set HSTATE_DSCR(r13) to something sensible */ + ld r6, PACA_DSCR_DEFAULT(r13) + std r6, HSTATE_DSCR(r13) +@@ -443,8 +448,8 @@ kvm_no_guest: + mfspr r4, SPRN_LPCR + rlwimi r4, r3, 0, LPCR_PECE0 | LPCR_PECE1 + mtspr SPRN_LPCR, r4 +- /* set up r3 for return */ +- mfspr r3,SPRN_SRR1 ++ // Return SRR1 wakeup value, or 0 if we went into the guest ++ ld r3, 32(r1) + REST_NVGPRS(r1) + ld r1, 0(r1) // Switch back to caller stack + ld r0, 16(r1) // Reload LR diff --git a/queue-5.10/powerpc-xive-discard-disabled-interrupts-in-get_irqchip_state.patch b/queue-5.10/powerpc-xive-discard-disabled-interrupts-in-get_irqchip_state.patch new file mode 100644 index 00000000000..aadada40fd4 --- /dev/null +++ b/queue-5.10/powerpc-xive-discard-disabled-interrupts-in-get_irqchip_state.patch @@ -0,0 +1,48 @@ +From 6f779e1d359b8d5801f677c1d49dcfa10bf95674 Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?C=C3=A9dric=20Le=20Goater?= +Date: Mon, 11 Oct 2021 09:02:03 +0200 +Subject: powerpc/xive: Discard disabled interrupts in get_irqchip_state() +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Cédric Le Goater + +commit 6f779e1d359b8d5801f677c1d49dcfa10bf95674 upstream. + +When an interrupt is passed through, the KVM XIVE device calls the +set_vcpu_affinity() handler which raises the P bit to mask the +interrupt and to catch any in-flight interrupts while routing the +interrupt to the guest. + +On the guest side, drivers (like some Intels) can request at probe +time some MSIs and call synchronize_irq() to check that there are no +in flight interrupts. This will call the XIVE get_irqchip_state() +handler which will always return true as the interrupt P bit has been +set on the host side and lock the CPU in an infinite loop. + +Fix that by discarding disabled interrupts in get_irqchip_state(). + +Fixes: da15c03b047d ("powerpc/xive: Implement get_irqchip_state method for XIVE to fix shutdown race") +Cc: stable@vger.kernel.org #v5.4+ +Signed-off-by: Cédric Le Goater +Tested-by: seeteena +Signed-off-by: Michael Ellerman +Link: https://lore.kernel.org/r/20211011070203.99726-1-clg@kaod.org +Signed-off-by: Greg Kroah-Hartman +--- + arch/powerpc/sysdev/xive/common.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +--- a/arch/powerpc/sysdev/xive/common.c ++++ b/arch/powerpc/sysdev/xive/common.c +@@ -997,7 +997,8 @@ static int xive_get_irqchip_state(struct + * interrupt to be inactive in that case. + */ + *state = (pq != XIVE_ESB_INVALID) && !xd->stale_p && +- (xd->saved_p || !!(pq & XIVE_ESB_VAL_P)); ++ (xd->saved_p || (!!(pq & XIVE_ESB_VAL_P) && ++ !irqd_irq_disabled(data))); + return 0; + default: + return -EINVAL; diff --git a/queue-5.10/series b/queue-5.10/series index 4d729e56bc9..15a5d986496 100644 --- a/queue-5.10/series +++ b/queue-5.10/series @@ -41,3 +41,26 @@ misc-fastrpc-add-missing-lock-before-accessing-find_vma.patch virtio-write-back-f_version_1-before-validate.patch edac-armada-xp-fix-output-of-uncorrectable-error-counter.patch nvmem-fix-shift-out-of-bound-ubsan-with-byte-size-cells.patch +kvm-ppc-book3s-hv-fix-stack-handling-in-idle_kvm_start_guest.patch +kvm-ppc-book3s-hv-make-idle_kvm_start_guest-return-0-if-it-went-to-guest.patch +x86-kconfig-do-not-enable-amd_mem_encrypt_active_by_default-automatically.patch +powerpc-xive-discard-disabled-interrupts-in-get_irqchip_state.patch +iio-adc-aspeed-set-driver-data-when-adc-probe.patch +drivers-bus-simple-pm-bus-add-support-for-probing-simple-bus-only-devices.patch +driver-core-reject-pointless-sync_state_only-device-links.patch +iio-adc-ad7192-add-irq-flag.patch +iio-adc-ad7780-fix-irq-flag.patch +iio-adc-ad7793-fix-irq-flag.patch +iio-adc128s052-fix-the-error-handling-path-of-adc128_probe.patch +iio-adc-max1027-fix-wrong-shift-with-12-bit-devices.patch +iio-mtk-auxadc-fix-case-iio_chan_info_processed.patch +iio-light-opt3001-fixed-timeout-error-when-0-lux.patch +iio-adc-max1027-fix-the-number-of-max1x31-channels.patch +iio-ssp_sensors-add-more-range-checking-in-ssp_parse_dataframe.patch +iio-ssp_sensors-fix-error-code-in-ssp_print_mcu_debug.patch +iio-dac-ti-dac5571-fix-an-error-code-in-probe.patch +tee-optee-fix-missing-devices-unregister-during-optee_remove.patch +arm-dts-bcm2711-rpi-4-b-fix-usb-s-unit-address.patch +arm-dts-bcm2711-fix-mdio-address-and-size-cells.patch +arm-dts-bcm2711-rpi-4-b-fix-sd_io_1v8_reg-regulator-states.patch +arm-dts-bcm2711-rpi-4-b-fix-pcie0-s-unit-address-formatting.patch diff --git a/queue-5.10/tee-optee-fix-missing-devices-unregister-during-optee_remove.patch b/queue-5.10/tee-optee-fix-missing-devices-unregister-during-optee_remove.patch new file mode 100644 index 00000000000..f753fc1f530 --- /dev/null +++ b/queue-5.10/tee-optee-fix-missing-devices-unregister-during-optee_remove.patch @@ -0,0 +1,88 @@ +From 7f565d0ead264329749c0da488de9c8dfa2f18ce Mon Sep 17 00:00:00 2001 +From: Sumit Garg +Date: Tue, 12 Oct 2021 13:01:16 +0530 +Subject: tee: optee: Fix missing devices unregister during optee_remove + +From: Sumit Garg + +commit 7f565d0ead264329749c0da488de9c8dfa2f18ce upstream. + +When OP-TEE driver is built as a module, OP-TEE client devices +registered on TEE bus during probe should be unregistered during +optee_remove. So implement optee_unregister_devices() accordingly. + +Fixes: c3fa24af9244 ("tee: optee: add TEE bus device enumeration support") +Reported-by: Sudeep Holla +Signed-off-by: Sumit Garg +Signed-off-by: Jens Wiklander +Signed-off-by: Greg Kroah-Hartman +--- + drivers/tee/optee/core.c | 3 +++ + drivers/tee/optee/device.c | 22 ++++++++++++++++++++++ + drivers/tee/optee/optee_private.h | 1 + + 3 files changed, 26 insertions(+) + +--- a/drivers/tee/optee/core.c ++++ b/drivers/tee/optee/core.c +@@ -585,6 +585,9 @@ static int optee_remove(struct platform_ + { + struct optee *optee = platform_get_drvdata(pdev); + ++ /* Unregister OP-TEE specific client devices on TEE bus */ ++ optee_unregister_devices(); ++ + /* + * Ask OP-TEE to free all cached shared memory objects to decrease + * reference counters and also avoid wild pointers in secure world +--- a/drivers/tee/optee/device.c ++++ b/drivers/tee/optee/device.c +@@ -53,6 +53,13 @@ static int get_devices(struct tee_contex + return 0; + } + ++static void optee_release_device(struct device *dev) ++{ ++ struct tee_client_device *optee_device = to_tee_client_device(dev); ++ ++ kfree(optee_device); ++} ++ + static int optee_register_device(const uuid_t *device_uuid) + { + struct tee_client_device *optee_device = NULL; +@@ -63,6 +70,7 @@ static int optee_register_device(const u + return -ENOMEM; + + optee_device->dev.bus = &tee_bus_type; ++ optee_device->dev.release = optee_release_device; + if (dev_set_name(&optee_device->dev, "optee-ta-%pUb", device_uuid)) { + kfree(optee_device); + return -ENOMEM; +@@ -154,3 +162,17 @@ int optee_enumerate_devices(u32 func) + { + return __optee_enumerate_devices(func); + } ++ ++static int __optee_unregister_device(struct device *dev, void *data) ++{ ++ if (!strncmp(dev_name(dev), "optee-ta", strlen("optee-ta"))) ++ device_unregister(dev); ++ ++ return 0; ++} ++ ++void optee_unregister_devices(void) ++{ ++ bus_for_each_dev(&tee_bus_type, NULL, NULL, ++ __optee_unregister_device); ++} +--- a/drivers/tee/optee/optee_private.h ++++ b/drivers/tee/optee/optee_private.h +@@ -184,6 +184,7 @@ void optee_fill_pages_list(u64 *dst, str + #define PTA_CMD_GET_DEVICES 0x0 + #define PTA_CMD_GET_DEVICES_SUPP 0x1 + int optee_enumerate_devices(u32 func); ++void optee_unregister_devices(void); + + /* + * Small helpers diff --git a/queue-5.10/x86-kconfig-do-not-enable-amd_mem_encrypt_active_by_default-automatically.patch b/queue-5.10/x86-kconfig-do-not-enable-amd_mem_encrypt_active_by_default-automatically.patch new file mode 100644 index 00000000000..106a3120ca8 --- /dev/null +++ b/queue-5.10/x86-kconfig-do-not-enable-amd_mem_encrypt_active_by_default-automatically.patch @@ -0,0 +1,68 @@ +From 711885906b5c2df90746a51f4cd674f1ab9fbb1d Mon Sep 17 00:00:00 2001 +From: Borislav Petkov +Date: Wed, 6 Oct 2021 19:34:55 +0200 +Subject: x86/Kconfig: Do not enable AMD_MEM_ENCRYPT_ACTIVE_BY_DEFAULT automatically + +From: Borislav Petkov + +commit 711885906b5c2df90746a51f4cd674f1ab9fbb1d upstream. + +This Kconfig option was added initially so that memory encryption is +enabled by default on machines which support it. + +However, devices which have DMA masks that are less than the bit +position of the encryption bit, aka C-bit, require the use of an IOMMU +or the use of SWIOTLB. + +If the IOMMU is disabled or in passthrough mode, the kernel would switch +to SWIOTLB bounce-buffering for those transfers. + +In order to avoid that, + + 2cc13bb4f59f ("iommu: Disable passthrough mode when SME is active") + +disables the default IOMMU passthrough mode so that devices for which the +default 256K DMA is insufficient, can use the IOMMU instead. + +However 2, there are cases where the IOMMU is disabled in the BIOS, etc. +(think the usual hardware folk "oops, I dropped the ball there" cases) or a +driver doesn't properly use the DMA APIs or a device has a firmware or +hardware bug, e.g.: + + ea68573d408f ("drm/amdgpu: Fail to load on RAVEN if SME is active") + +However 3, in the above GPU use case, there are APIs like Vulkan and +some OpenGL/OpenCL extensions which are under the assumption that +user-allocated memory can be passed in to the kernel driver and both the +GPU and CPU can do coherent and concurrent access to the same memory. +That cannot work with SWIOTLB bounce buffers, of course. + +So, in order for those devices to function, drop the "default y" for the +SME by default active option so that users who want to have SME enabled, +will need to either enable it in their config or use "mem_encrypt=on" on +the kernel command line. + + [ tlendacky: Generalize commit message. ] + +Fixes: 7744ccdbc16f ("x86/mm: Add Secure Memory Encryption (SME) support") +Reported-by: Paul Menzel +Signed-off-by: Borislav Petkov +Acked-by: Alex Deucher +Acked-by: Tom Lendacky +Cc: +Link: https://lkml.kernel.org/r/8bbacd0e-4580-3194-19d2-a0ecad7df09c@molgen.mpg.de +Signed-off-by: Greg Kroah-Hartman +--- + arch/x86/Kconfig | 1 - + 1 file changed, 1 deletion(-) + +--- a/arch/x86/Kconfig ++++ b/arch/x86/Kconfig +@@ -1534,7 +1534,6 @@ config AMD_MEM_ENCRYPT + + config AMD_MEM_ENCRYPT_ACTIVE_BY_DEFAULT + bool "Activate AMD Secure Memory Encryption (SME) by default" +- default y + depends on AMD_MEM_ENCRYPT + help + Say yes to have system memory encrypted by default if running on