20 Jan, 2021

5 commits

  • This is the 5.10.9 stable release

    * tag 'v5.10.9': (153 commits)
    Linux 5.10.9
    netfilter: nf_nat: Fix memleak in nf_nat_init
    netfilter: conntrack: fix reading nf_conntrack_buckets
    ...

    Signed-off-by: Jason Liu

    Jason Liu
     
  • This is the 5.10.8 stable release

    * tag 'v5.10.8': (104 commits)
    Linux 5.10.8
    tools headers UAPI: Sync linux/fscrypt.h with the kernel sources
    drm/panfrost: Remove unused variables in panfrost_job_close()
    ...

    Signed-off-by: Jason Liu

    Jason Liu
     
  • This is the 5.10.5 stable release

    * tag 'v5.10.5': (63 commits)
    Linux 5.10.5
    device-dax: Fix range release
    ext4: avoid s_mb_prefetch to be zero in individual scenarios
    ...

    Signed-off-by: Jason Liu

    Jason Liu
     
  • [ Upstream commit 6170d077bf92c5b3dfbe1021688d3c0404f7c9e9 ]

    The xfer waiting time is the result of xfer->len / xfer->speed_hz. This
    patch makes the assumption of 100khz xfer speed if the xfer->speed_hz is
    not assigned and stays 0. This avoids the divide by 0 issue and ensures
    a reasonable tolerant waiting time.

    Signed-off-by: Xu Yilun
    Link: https://lore.kernel.org/r/1609723749-3557-1-git-send-email-yilun.xu@intel.com
    Signed-off-by: Mark Brown
    Signed-off-by: Sasha Levin

    Xu Yilun
     
  • [ Upstream commit ede090f5a438e97d0586f64067bbb956e30a2a31 ]

    This patch fixes the return value for altera_spi_txrx. It should return
    1 for interrupt transfer mode, and return 0 for polling transfer mode.

    The altera_spi_txrx() implements the spi_controller.transfer_one
    callback. According to the spi-summary.rst, the transfer_one should
    return 0 when transfer is finished, return 1 when transfer is still in
    progress.

    Signed-off-by: Xu Yilun
    Link: https://lore.kernel.org/r/1609219662-27057-2-git-send-email-yilun.xu@intel.com
    Signed-off-by: Mark Brown
    Signed-off-by: Sasha Levin

    Xu Yilun
     

17 Jan, 2021

3 commits

  • commit a590370d918fc66c62df6620445791fbe840344a upstream.

    if cur_bpw < 4 then the value of fthlv will be 1 and
    SPI registers content may have been lost.

    * If SPI data register is accessed as a 16-bit register and DSIZE 8bit,
    better to select FTHLV = 2, 4, 6 etc, while if DSIZE
    Fixes: dcbe0d84dfa5 ("spi: add driver for STM32 SPI controller")
    Reviewed-by: Marek Vasut
    Link: https://lore.kernel.org/r/20201221123532.27272-1-rguskov@dh-electronics.com
    Signed-off-by: Mark Brown
    Signed-off-by: Greg Kroah-Hartman

    Roman Guskov
     
  • commit 4aa1464acbe3697710279a4bd65cb4801ed30425 upstream.

    In commit 7ba9bdcb91f6 ("spi: spi-geni-qcom: Don't keep a local state
    variable") we changed handle_fifo_timeout() so that we set
    "mas->cur_xfer" to NULL to make absolutely sure that we don't mess
    with the buffers from the previous transfer in the timeout case.

    Unfortunately, this caused the IRQ handler to dereference NULL in some
    cases. One case:

    CPU0 CPU1
    ---- ----
    setup_fifo_xfer()
    geni_se_setup_m_cmd()



    ...
    handle_fifo_timeout()
    spin_lock_irq(mas->lock)
    mas->cur_xfer = NULL
    geni_se_cancel_m_cmd()
    spin_unlock_irq(mas->lock)

    geni_spi_isr()
    spin_lock(mas->lock)
    if (m_irq & M_RX_FIFO_WATERMARK_EN)
    geni_spi_handle_rx()
    mas->cur_xfer NULL dereference!

    tl;dr: Seriously delayed interrupts for RX/TX can lead to timeout
    handling setting mas->cur_xfer to NULL.

    Let's check for the NULL transfer in the TX and RX cases and reset the
    watermark or clear out the fifo respectively to put the hardware back
    into a sane state.

    NOTE: things still could get confused if we get timeouts all the way
    through handle_fifo_timeout() and then start a new transfer because
    interrupts from the old transfer / cancel / abort could still be
    pending. A future patch will help this corner case.

    Fixes: 561de45f72bd ("spi: spi-geni-qcom: Add SPI driver support for GENI based QUP")
    Signed-off-by: Douglas Anderson
    Reviewed-by: Stephen Boyd
    Link: https://lore.kernel.org/r/20201217142842.v3.1.I99ee04f0cb823415df59bd4f550d6ff5756e43d6@changeid
    Signed-off-by: Mark Brown
    Signed-off-by: Greg Kroah-Hartman

    Douglas Anderson
     
  • commit 690d8b917bbe64772cb0b652311bcd50908aea6b upstream.

    If we got a timeout when trying to send an abort command then it means
    that we just got 3 timeouts in a row:

    1. The original timeout that caused handle_fifo_timeout() to be
    called.
    2. A one second timeout waiting for the cancel command to finish.
    3. A one second timeout waiting for the abort command to finish.

    SPI is clocked by the controller, so nothing (aside from a hardware
    fault or a totally broken sequencer) should be causing the actual
    commands to fail in hardware. However, even though the hardware
    itself is not expected to fail (and it'd be hard to predict how we
    should handle things if it did), it's easy to hit the timeout case by
    simply blocking our interrupt handler from running for a long period
    of time. Obviously the system is in pretty bad shape if a interrupt
    handler is blocked for > 2 seconds, but there are certainly bugs (even
    bugs in other unrelated drivers) that can make this happen.

    Let's make things a bit more robust against this case. If we fail to
    abort we'll set a flag and then we'll block all future transfers until
    we have no more interrupts pending.

    Fixes: 561de45f72bd ("spi: spi-geni-qcom: Add SPI driver support for GENI based QUP")
    Signed-off-by: Douglas Anderson
    Reviewed-by: Stephen Boyd
    Link: https://lore.kernel.org/r/20201217142842.v3.2.Ibade998ed587e070388b4bf58801f1107a40eb53@changeid
    Signed-off-by: Mark Brown
    Signed-off-by: Greg Kroah-Hartman

    Douglas Anderson
     

06 Jan, 2021

1 commit

  • commit 7218838109fef61cdec988ff728e902d434c9cc5 upstream.

    I mistakenly added the select attributes to the SPI_DW_BT1_DIRMAP config
    instead of having them defined in SPI_DW_BT1. If the kernel doesn't have
    the MULTIPLEXER and MUX_MMIO configs manually enabled and the
    SPI_DW_BT1_DIRMAP config hasn't been selected, Baikal-T1 SPI device will
    always fail to be probed by the driver. Fix that and the error reported by
    the test robot:

    >> ld.lld: error: undefined symbol: devm_mux_control_get
    >>> referenced by spi-dw-bt1.c
    >>> spi/spi-dw-bt1.o:(dw_spi_bt1_sys_init) in archive drivers/built-in.a

    by moving the MULTIPLEXER/MUX_MMIO configs selection to the SPI_DW_BT1
    config.

    Link: https://lore.kernel.org/lkml/202011161745.uYRlekse-lkp@intel.com/
    Link: https://lore.kernel.org/linux-spi/20201116040721.8001-1-rdunlap@infradead.org/
    Fixes: abf00907538e ("spi: dw: Add Baikal-T1 SPI Controller glue driver")
    Reported-by: kernel test robot
    Signed-off-by: Serge Semin
    Cc: Randy Dunlap
    Cc: Ramil Zaripov
    Link: https://lore.kernel.org/r/20201127144612.4204-1-Sergey.Semin@baikalelectronics.ru
    Signed-off-by: Mark Brown
    Signed-off-by: Greg Kroah-Hartman

    Serge Semin
     

04 Jan, 2021

1 commit

  • This is the 5.10.4 stable release

    * tag 'v5.10.4': (717 commits)
    Linux 5.10.4
    x86/CPU/AMD: Save AMD NodeId as cpu_die_id
    drm/edid: fix objtool warning in drm_cvt_modes()
    ...

    Signed-off-by: Jason Liu

    Conflicts:
    drivers/gpu/drm/imx/dcss/dcss-plane.c
    drivers/media/i2c/ov5640.c

    Jason Liu
     

30 Dec, 2020

30 commits

  • commit cac8c821059639b015586abf61623c62cc549a13 upstream.

    Following error was seen when mounting a 16MByte ubifs:
    UBIFS error (ubi0:0 pid 1893): check_lpt_type.constprop.6: invalid type (15) in LPT node type

    QSPI_IFR.TFRTYP was not set correctly. When data transfer is enabled
    and one wants to access the serial memory through AHB in order to:
    - read in the serial memory, but not a memory data, for example
    a JEDEC-ID, QSPI_IFR.TFRTYP must be written to '0' (both sama5d2
    and sam9x60).
    - read in the serial memory, and particularly a memory data,
    TFRTYP must be written to '1' (both sama5d2 and sam9x60).
    - write in the serial memory, but not a memory data, for example
    writing the configuration or the QSPI_SR, TFRTYP must be written
    to '2' for sama5d2 and to '0' for sam9x60.
    - write in the serial memory in particular to program a memory data,
    TFRTYP must be written to '3' for sama5d2 and to '1' for sam9x60.

    Fix the setting of the QSPI_IFR.TFRTYP field.

    Fixes: 2d30ac5ed633 ("mtd: spi-nor: atmel-quadspi: Use spi-mem interface for atmel-quadspi driver")
    Cc: # v5.0+
    Reported-by: Tom Burkart
    Signed-off-by: Tudor Ambarus
    Link: https://lore.kernel.org/r/20201207135959.154124-2-tudor.ambarus@microchip.com
    Signed-off-by: Mark Brown
    Signed-off-by: Greg Kroah-Hartman

    Tudor Ambarus
     
  • commit 0e685017c7ba1a2fe9f6f1e7a9302890747d934c upstream.

    If the call to of_device_get_match_data() fails on probe of the Atmel
    QuadSPI driver, the clock "aq->pclk" is erroneously not unprepared and
    disabled. Fix it.

    Fixes: 2e5c88887358 ("spi: atmel-quadspi: add support for sam9x60 qspi controller")
    Signed-off-by: Lukas Wunner
    Cc: # v5.1+
    Cc: Tudor Ambarus
    Cc: Boris Brezillon
    Reviewed-by: Tudor Ambarus
    Link: https://lore.kernel.org/r/8f8dc2815aa97b2378528f08f923bf81e19611f0.1604874488.git.lukas@wunner.de
    Signed-off-by: Mark Brown
    Signed-off-by: Greg Kroah-Hartman

    Lukas Wunner
     
  • commit 46b5c4fb87ce8211e0f9b0383dbde72c3652d2ba upstream.

    If the calls to device_reset() or devm_spi_register_controller() fail on
    probe of the MediaTek MT7621 SPI driver, the spi_controller struct is
    erroneously not freed. Fix by switching over to the new
    devm_spi_alloc_master() helper.

    Additionally, there's an ordering issue in mt7621_spi_remove() wherein
    the spi_controller is unregistered after disabling the SYS clock.
    The correct order is to call spi_unregister_controller() *before* this
    teardown step because bus accesses may still be ongoing until that
    function returns.

    All of these bugs have existed since the driver was first introduced,
    so it seems fair to fix them together in a single commit.

    Fixes: 1ab7f2a43558 ("staging: mt7621-spi: add mt7621 support")
    Signed-off-by: Lukas Wunner
    Reviewed-by: Stefan Roese
    Cc: # v4.17+: 5e844cc37a5c: spi: Introduce device-managed SPI controller allocation
    Cc: # v4.17+
    Link: https://lore.kernel.org/r/72b680796149f5fcda0b3f530ffb7ee73b04f224.1607286887.git.lukas@wunner.de
    Signed-off-by: Mark Brown
    Signed-off-by: Greg Kroah-Hartman

    Lukas Wunner
     
  • commit 24f7033405abe195224ec793dbc3d7a27dec0b98 upstream.

    Commit 702b15cb9712 ("spi: mt7621: fix missing clk_disable_unprepare()
    on error in mt7621_spi_probe") sought to disable the SYS clock on probe
    errors, but only did so for 2 of 3 potentially failing calls: The clock
    needs to be disabled on failure of devm_spi_register_controller() as
    well.

    Moreover, the commit purports to fix a bug in commit cbd66c626e16 ("spi:
    mt7621: Move SPI driver out of staging") but in reality the bug has
    existed since the driver was first introduced.

    Fixes: 1ab7f2a43558 ("staging: mt7621-spi: add mt7621 support")
    Signed-off-by: Lukas Wunner
    Cc: # v4.17+: 702b15cb9712: spi: mt7621: fix missing clk_disable_unprepare() on error in mt7621_spi_probe
    Cc: # v4.17+
    Cc: Qinglang Miao
    Link: https://lore.kernel.org/r/36ad42760087952fb7c10aae7d2628547c26a7ec.1607286887.git.lukas@wunner.de
    Signed-off-by: Mark Brown
    Signed-off-by: Greg Kroah-Hartman

    Lukas Wunner
     
  • commit 8853b2503014aca5c793d2c7f0aabc990b32bdad upstream.

    If the calls to platform_get_irq() or devm_request_irq() fail on probe
    of the SynQuacer SPI driver, the clock "sspi->clk" is erroneously not
    unprepared and disabled.

    If the clock rate "master->max_speed_hz" cannot be determined, the same
    happens and in addition the spi_master struct is not freed.

    Fix it.

    Fixes: b0823ee35cf9 ("spi: Add spi driver for Socionext SynQuacer platform")
    Signed-off-by: Lukas Wunner
    Cc: # v5.3+
    Cc: Masahisa Kojima
    Link: https://lore.kernel.org/r/232281df1ab91d8f0f553a62d5f97fc264ace4da.1604874488.git.lukas@wunner.de
    Signed-off-by: Mark Brown
    Signed-off-by: Greg Kroah-Hartman

    Lukas Wunner
     
  • commit 5ef76dac0f2c26aeae4ee79eb830280f16d5aceb upstream.

    If the calls to devm_platform_ioremap_resource(), irq_of_parse_and_map()
    or devm_request_irq() fail on probe of the ST SSC4 SPI driver, the
    runtime PM disable depth is incremented even though it was not
    decremented before. Fix it.

    Fixes: cd050abeba2a ("spi: st-ssc4: add missed pm_runtime_disable")
    Signed-off-by: Lukas Wunner
    Cc: # v5.5+
    Cc: Chuhong Yuan
    Link: https://lore.kernel.org/r/fbe8768c30dc829e2d77eabe7be062ca22f84024.1604874488.git.lukas@wunner.de
    Signed-off-by: Mark Brown
    Signed-off-by: Greg Kroah-Hartman

    Lukas Wunner
     
  • commit 6cfd39e212dee2e77a0227ce4e0f55fa06d79f46 upstream.

    qcom_qspi_remove() accesses the driver's private data after calling
    spi_unregister_master() even though that function releases the last
    reference on the spi_master and thereby frees the private data.

    Fix by switching over to the new devm_spi_alloc_master() helper which
    keeps the private data accessible until the driver has unbound.

    Fixes: f79a158d37c2 ("spi: spi-qcom-qspi: Use OPP API to set clk/perf state")
    Signed-off-by: Lukas Wunner
    Cc: # v5.9+: 5e844cc37a5c: spi: Introduce device-managed SPI controller allocation
    Cc: # v5.9+
    Cc: Rajendra Nayak
    Link: https://lore.kernel.org/r/b6d3c4dce571d78a532fd74f27def0d5dc8d8a24.1607286887.git.lukas@wunner.de
    Signed-off-by: Mark Brown
    Signed-off-by: Greg Kroah-Hartman

    Lukas Wunner
     
  • commit 8f96c434dfbc85ffa755d6634c8c1cb2233fcf24 upstream.

    spi_geni_remove() accesses the driver's private data after calling
    spi_unregister_master() even though that function releases the last
    reference on the spi_master and thereby frees the private data.

    Moreover, since commit 1a9e489e6128 ("spi: spi-geni-qcom: Use OPP API to
    set clk/perf state"), spi_geni_probe() leaks the spi_master allocation
    if the calls to dev_pm_opp_set_clkname() or dev_pm_opp_of_add_table()
    fail.

    Fix by switching over to the new devm_spi_alloc_master() helper which
    keeps the private data accessible until the driver has unbound and also
    avoids the spi_master leak on probe.

    Fixes: 561de45f72bd ("spi: spi-geni-qcom: Add SPI driver support for GENI based QUP")
    Signed-off-by: Lukas Wunner
    Cc: # v4.20+: 5e844cc37a5c: spi: Introduce device-managed SPI controller allocation
    Cc: # v4.20+
    Cc: Rajendra Nayak
    Cc: Girish Mahadevan
    Link: https://lore.kernel.org/r/dfa1d8c41b8acdfad87ec8654cd124e6e3cb3f31.1607286887.git.lukas@wunner.de
    Signed-off-by: Mark Brown
    Signed-off-by: Greg Kroah-Hartman

    Lukas Wunner
     
  • commit 5b8c88462d83331dacb48aeaec8388117fef82e0 upstream.

    If the call to devm_gpiod_get_optional() fails on probe of the NXP
    SC18IS602/603 SPI driver, the spi_master struct is erroneously not freed.

    Fix by switching over to the new devm_spi_alloc_master() helper.

    Fixes: f99008013e19 ("spi: sc18is602: Add reset control via gpio pin.")
    Signed-off-by: Lukas Wunner
    Cc: # v4.9+: 5e844cc37a5c: spi: Introduce device-managed SPI controller allocation
    Cc: # v4.9+
    Cc: Phil Reid
    Link: https://lore.kernel.org/r/d5f715527b894b91d530fe11a86f51b3184a4e1a.1607286887.git.lukas@wunner.de
    Signed-off-by: Mark Brown
    Signed-off-by: Greg Kroah-Hartman

    Lukas Wunner
     
  • commit 393f981ca5f797b58b882d42b7621fb6e43c7f5b upstream.

    rpcif_spi_remove() accesses the driver's private data after calling
    spi_unregister_controller() even though that function releases the last
    reference on the spi_controller and thereby frees the private data.

    Fix by switching over to the new devm_spi_alloc_master() helper which
    keeps the private data accessible until the driver has unbound.

    Fixes: eb8d6d464a27 ("spi: add Renesas RPC-IF driver")
    Signed-off-by: Lukas Wunner
    Cc: # v5.9+: 5e844cc37a5c: spi: Introduce device-managed SPI controller allocation
    Cc: # v5.9+
    Cc: Sergei Shtylyov
    Link: https://lore.kernel.org/r/c5da472c28021da2f6517441685cef033d40b140.1607286887.git.lukas@wunner.de
    Signed-off-by: Mark Brown
    Signed-off-by: Greg Kroah-Hartman

    Lukas Wunner
     
  • commit a4729c3506c3eb1a6ca5c0289f4e7cafa4115065 upstream.

    If the calls to devm_clk_get(), devm_spi_register_master() or
    clk_prepare_enable() fail on probe of the Mikrotik RB4xx SPI driver,
    the spi_master struct is erroneously not freed.

    Fix by switching over to the new devm_spi_alloc_master() helper.

    Fixes: 05aec357871f ("spi: Add SPI driver for Mikrotik RB4xx series boards")
    Signed-off-by: Lukas Wunner
    Cc: # v4.2+: 5e844cc37a5c: spi: Introduce device-managed SPI controller allocation
    Cc: # v4.2+
    Cc: Bert Vermeulen
    Link: https://lore.kernel.org/r/369bf26d71927f60943b1d9d8f51810f00b0237d.1607286887.git.lukas@wunner.de
    Signed-off-by: Mark Brown
    Signed-off-by: Greg Kroah-Hartman

    Lukas Wunner
     
  • commit c575e9113bff5e024d75481613faed5ef9d465b2 upstream.

    If the calls to devm_request_irq() or devm_spi_register_master() fail
    on probe of the PIC32 SPI driver, the DMA channels requested by
    pic32_spi_dma_prep() are erroneously not released. Plug the leak.

    Fixes: 1bcb9f8ceb67 ("spi: spi-pic32: Add PIC32 SPI master driver")
    Signed-off-by: Lukas Wunner
    Cc: # v4.7+
    Cc: Purna Chandra Mandal
    Link: https://lore.kernel.org/r/9624250e3a7aa61274b38219a62375bac1def637.1604874488.git.lukas@wunner.de
    Signed-off-by: Mark Brown
    Signed-off-by: Greg Kroah-Hartman

    Lukas Wunner
     
  • commit 234266a5168bbe8220d263e3aa7aa80cf921c483 upstream.

    If the call to devm_spi_register_master() fails on probe of the NPCM FIU
    SPI driver, the clock "fiu->clk" is erroneously not unprepared and
    disabled. Fix it.

    Fixes: ace55c411b11 ("spi: npcm-fiu: add NPCM FIU controller driver")
    Signed-off-by: Lukas Wunner
    Cc: # v5.4+
    Cc: Tomer Maimon
    Link: https://lore.kernel.org/r/9ae62f4e1cfe542bec57ac2743e6fca9f9548f55.1607286887.git.lukas@wunner.de
    Signed-off-by: Mark Brown
    Signed-off-by: Greg Kroah-Hartman

    Lukas Wunner
     
  • commit cc53711b2191cf3b3210283ae89bf0abb98c70a3 upstream.

    If the calls to devm_clk_get() or devm_ioremap_resource() fail on probe
    of the Macronix SPI driver, the spi_master struct is erroneously not freed.

    Fix by switching over to the new devm_spi_alloc_master() helper.

    Fixes: b942d80b0a39 ("spi: Add MXIC controller driver")
    Signed-off-by: Lukas Wunner
    Cc: # v5.0+: 5e844cc37a5c: spi: Introduce device-managed SPI controller allocation
    Cc: # v5.0+
    Cc: Mason Yang
    Link: https://lore.kernel.org/r/4fa6857806e7e75741c05d057ac9df3564460114.1607286887.git.lukas@wunner.de
    Signed-off-by: Mark Brown
    Signed-off-by: Greg Kroah-Hartman

    Lukas Wunner
     
  • commit 7174dc655ef0578877b0b4598e69619d2be28b4d upstream.

    If the call to devm_spi_register_master() fails on probe of the GPIO SPI
    driver, the spi_master struct is erroneously not freed:

    After allocating the spi_master, its reference count is 1. The driver
    unconditionally decrements the reference count on unbind using a devm
    action. Before calling devm_spi_register_master(), the driver
    unconditionally increments the reference count because on success,
    that function will decrement the reference count on unbind. However on
    failure, devm_spi_register_master() does *not* decrement the reference
    count, so the spi_master is leaked.

    The issue was introduced by commits 8b797490b4db ("spi: gpio: Make sure
    spi_master_put() is called in every error path") and 79567c1a321e ("spi:
    gpio: Use devm_spi_register_master()"), which sought to plug leaks
    introduced by 9b00bc7b901f ("spi: spi-gpio: Rewrite to use GPIO
    descriptors") but missed this remaining leak.

    The situation was later aggravated by commit d3b0ffa1d75d ("spi: gpio:
    prevent memory leak in spi_gpio_probe"), which introduced a
    use-after-free because it releases a reference on the spi_master if
    devm_add_action_or_reset() fails even though the function already
    does that.

    Fix by switching over to the new devm_spi_alloc_master() helper.

    Fixes: 9b00bc7b901f ("spi: spi-gpio: Rewrite to use GPIO descriptors")
    Signed-off-by: Lukas Wunner
    Reviewed-by: Linus Walleij
    Cc: # v4.17+: 5e844cc37a5c: spi: Introduce device-managed SPI controller allocation
    Cc: # v5.1-: 8b797490b4db: spi: gpio: Make sure spi_master_put() is called in every error path
    Cc: # v5.1-: 45beec351998: spi: bitbang: Introduce spi_bitbang_init()
    Cc: # v5.1-: 79567c1a321e: spi: gpio: Use devm_spi_register_master()
    Cc: # v5.4-: d3b0ffa1d75d: spi: gpio: prevent memory leak in spi_gpio_probe
    Cc: # v4.17+
    Cc: Navid Emamdoost
    Cc: Andrey Smirnov
    Link: https://lore.kernel.org/r/86eaed27431c3d709e3748eb76ceecbfc790dd37.1607286887.git.lukas@wunner.de
    Signed-off-by: Mark Brown
    Signed-off-by: Greg Kroah-Hartman

    Lukas Wunner
     
  • commit 122541f2b10897b08f7f7e6db5f1eb693e51f0a1 upstream.

    Commit 0f0581b24bd0 ("spi: fsl: Convert to use CS GPIO descriptors")
    broke the use of the SPISEL_BOOT signal as a chip select on the
    MPC8309.

    pdata->max_chipselect, which becomes master->num_chipselect, must be
    initialized to take into account the possibility that there's one more
    chip select in use than the number of GPIO chip selects.

    Cc: stable@vger.kernel.org # v5.4+
    Cc: Christophe Leroy
    Cc: Linus Walleij
    Fixes: 0f0581b24bd0 ("spi: fsl: Convert to use CS GPIO descriptors")
    Signed-off-by: Rasmus Villemoes
    Link: https://lore.kernel.org/r/20201127152947.376-1-rasmus.villemoes@prevas.dk
    Signed-off-by: Mark Brown
    Signed-off-by: Greg Kroah-Hartman

    Rasmus Villemoes
     
  • commit 373afef350a93519b4b8d636b0895da8650b714b upstream.

    davinci_spi_remove() accesses the driver's private data after it's been
    freed with spi_master_put().

    Fix by moving the spi_master_put() to the end of the function.

    Fixes: fe5fd2540947 ("spi: davinci: Use dma_request_chan() for requesting DMA channel")
    Signed-off-by: Lukas Wunner
    Acked-by: Peter Ujfalusi
    Cc: # v4.7+
    Link: https://lore.kernel.org/r/412f7eb1cf8990e0a3a2153f4c577298deab623e.1607286887.git.lukas@wunner.de
    Signed-off-by: Mark Brown
    Signed-off-by: Greg Kroah-Hartman

    Lukas Wunner
     
  • commit 236924ee531d6251c8d10e9177b7742a60534ed5 upstream.

    If the call to devm_spi_register_controller() fails on probe of the
    Qualcomm Atheros AR934x/QCA95xx SPI driver, the spi_controller struct is
    erroneously not freed. Fix by switching over to the new
    devm_spi_alloc_master() helper.

    Moreover, the controller's clock is enabled on probe but not disabled if
    any of the subsequent probe steps fail.

    Finally, there's an ordering issue in ar934x_spi_remove() wherein the
    clock is disabled even though the controller is not yet unregistered.
    It is unregistered after ar934x_spi_remove() by the devres framework.
    As long as it is not unregistered, SPI transfers may still be ongoing
    and disabling the clock may break them. It is not possible to use
    devm_spi_register_controller() in this case, so move to the non-devm
    variant.

    All of these bugs have existed since the driver was first introduced,
    so it seems fair to fix them together in a single commit.

    Fixes: 047980c582af ("spi: add driver for ar934x spi controller")
    Signed-off-by: Lukas Wunner
    Cc: # v5.7+: 5e844cc37a5c: spi: Introduce device-managed SPI controller allocation
    Cc: # v5.7+
    Cc: Chuanhong Guo
    Link: https://lore.kernel.org/r/1d58367d74d55741e0c2730a51a2b65012c8ab33.1607286887.git.lukas@wunner.de
    Signed-off-by: Mark Brown
    Signed-off-by: Greg Kroah-Hartman

    Lukas Wunner
     
  • commit 0f4ad8d59f33b24dd86739f3be23e6af1a86f5a9 upstream.

    If the call to devm_spi_register_controller() fails on probe of the
    MediaTek SPI NOR driver, the spi_controller struct is erroneously not
    freed.

    Since commit a1daaa991ed1 ("spi: spi-mtk-nor: use dma_alloc_coherent()
    for bounce buffer"), the same happens if the call to
    dmam_alloc_coherent() fails.

    Since commit 3bfd9103c7af ("spi: spi-mtk-nor: Add power management
    support"), the same happens if the call to mtk_nor_enable_clk() fails.

    Fix by switching over to the new devm_spi_alloc_master() helper.

    Fixes: 881d1ee9fe81 ("spi: add support for mediatek spi-nor controller")
    Signed-off-by: Lukas Wunner
    Reviewed-by: Ikjoon Jang
    Cc: # v5.7+: 5e844cc37a5c: spi: Introduce device-managed SPI controller allocation
    Cc: # v5.7+
    Cc: Chuanhong Guo
    Link: https://lore.kernel.org/r/d5b9f0289465394e73dedb8ec51e180a8f1dffc9.1607286887.git.lukas@wunner.de
    Signed-off-by: Mark Brown
    Signed-off-by: Greg Kroah-Hartman

    Lukas Wunner
     
  • commit c7b884561cb5b641f3dbba950094110794119a6d upstream.

    atmel_qspi_remove() accesses the driver's private data after calling
    spi_unregister_controller() even though that function releases the last
    reference on the spi_controller and thereby frees the private data.

    Fix by switching over to the new devm_spi_alloc_master() helper which
    keeps the private data accessible until the driver has unbound.

    Fixes: 2d30ac5ed633 ("mtd: spi-nor: atmel-quadspi: Use spi-mem interface for atmel-quadspi driver")
    Signed-off-by: Lukas Wunner
    Cc: # v5.0+: 5e844cc37a5c: spi: Introduce device-managed SPI controller allocation
    Cc: # v5.0+
    Cc: Piotr Bugalski
    Link: https://lore.kernel.org/r/4b05c65cf6f1ea3251484fe9a00b4c65478a1ae3.1607286887.git.lukas@wunner.de
    Signed-off-by: Mark Brown
    Signed-off-by: Greg Kroah-Hartman

    Lukas Wunner
     
  • commit e77df3eca12be4b17f13cf9f215cff248c57d98f upstream.

    spi_sh_remove() accesses the driver's private data after calling
    spi_unregister_master() even though that function releases the last
    reference on the spi_master and thereby frees the private data.

    Fix by switching over to the new devm_spi_alloc_master() helper which
    keeps the private data accessible until the driver has unbound.

    Fixes: 680c1305e259 ("spi/spi_sh: use spi_unregister_master instead of spi_master_put in remove path")
    Signed-off-by: Lukas Wunner
    Cc: # v3.0+: 5e844cc37a5c: spi: Introduce device-managed SPI controller allocation
    Cc: # v3.0+
    Cc: Axel Lin
    Link: https://lore.kernel.org/r/6d97628b536baf01d5e3e39db61108f84d44c8b2.1607286887.git.lukas@wunner.de
    Signed-off-by: Mark Brown
    Signed-off-by: Greg Kroah-Hartman

    Lukas Wunner
     
  • commit 5626308bb94d9f930aa5f7c77327df4c6daa7759 upstream.

    pxa2xx_spi_remove() accesses the driver's private data after calling
    spi_unregister_controller() even though that function releases the last
    reference on the spi_controller and thereby frees the private data.

    Fix by switching over to the new devm_spi_alloc_master/slave() helper
    which keeps the private data accessible until the driver has unbound.

    Fixes: 32e5b57232c0 ("spi: pxa2xx: Fix controller unregister order")
    Signed-off-by: Lukas Wunner
    Cc: # v2.6.17+: 5e844cc37a5c: spi: Introduce device-managed SPI controller allocation
    Cc: # v2.6.17+: 32e5b57232c0: spi: pxa2xx: Fix controller unregister order
    Cc: # v2.6.17+
    Link: https://lore.kernel.org/r/5764b04d4a6e43069ebb7808f64c2f774ac6f193.1607286887.git.lukas@wunner.de
    Signed-off-by: Mark Brown
    Signed-off-by: Greg Kroah-Hartman

    Lukas Wunner
     
  • [ Upstream commit e748edd9841306908b4e02dddd0afd1aa1f8b973 ]

    Fix to return a negative error code from the error handling
    case instead of 0, as done elsewhere in this function.

    Fixes: abf00907538e ("spi: dw: Add Baikal-T1 SPI Controller glue driver")
    Reported-by: Hulk Robot
    Signed-off-by: Zhang Changzhong
    Acked-by: Serge Semin
    Link: https://lore.kernel.org/r/1607071357-33378-1-git-send-email-zhangchangzhong@huawei.com
    Signed-off-by: Mark Brown
    Signed-off-by: Sasha Levin

    Zhang Changzhong
     
  • [ Upstream commit 2c2b3ad2c4c801bab1eec7264ea6991b1e4e8f2c ]

    If cs-gpios property is used in devicetree then ctlr->num_chipselect value
    may be changed by spi_get_gpio_descs().
    So use ctlr->max_native_cs instead of ctlr->num_chipselect to set SPI_MCR

    Fixes: 4fcc7c2292de (spi: spi-fsl-dspi: Don't access reserved fields in SPI_MCR)
    Signed-off-by: Maxim Kochetkov
    Link: https://lore.kernel.org/r/20201201085916.63543-1-fido_max@inbox.ru
    Signed-off-by: Mark Brown
    Signed-off-by: Sasha Levin

    Maxim Kochetkov
     
  • [ Upstream commit 440408dbadfe47a615afd0a0a4a402e629be658a ]

    Consider an spi driver with a .probe but without a .remove callback (e.g.
    rtc-ds1347). The function spi_drv_probe() is called to bind a device and
    so dev_pm_domain_attach() is called. As there is no remove callback
    spi_drv_remove() isn't called at unbind time however and so calling
    dev_pm_domain_detach() is missed and the pm domain keeps active.

    To fix this always use both spi_drv_probe() and spi_drv_remove() and
    make them handle the respective callback not being set. This has the
    side effect that for a (hypothetical) driver that has neither .probe nor
    remove the clk and pm domain setup is done.

    Fixes: 33cf00e57082 ("spi: attach/detach SPI device to the ACPI power domain")
    Signed-off-by: Uwe Kleine-König
    Link: https://lore.kernel.org/r/20201119161604.2633521-1-u.kleine-koenig@pengutronix.de
    Signed-off-by: Mark Brown
    Signed-off-by: Sasha Levin

    Uwe Kleine-König
     
  • [ Upstream commit 03fc41afaa6549baa2dab7a84e1afaf5cadb5b18 ]

    pm_runtime_get_sync will increment pm usage counter even it
    failed. Forgetting to pm_runtime_put_noidle will result in
    reference leak in mxs_spi_probe, so we should fix it.

    Fixes: b7969caf41a1d ("spi: mxs: implement runtime pm")
    Signed-off-by: Zhang Qilong
    Link: https://lore.kernel.org/r/20201106012421.95420-1-zhangqilong3@huawei.com
    Signed-off-by: Mark Brown
    Signed-off-by: Sasha Levin

    Zhang Qilong
     
  • [ Upstream commit 1241f0787578136ab58f49adc52f2dcd2bbc4bf2 ]

    Fix build error for spi-dw-bt1.o by selecting MULTIPLEXER.

    hppa-linux-ld: drivers/spi/spi-dw-bt1.o: in function `dw_spi_bt1_sys_init':
    (.text+0x1ac): undefined reference to `devm_mux_control_get'

    Fixes: abf00907538e ("spi: dw: Add Baikal-T1 SPI Controller glue driver")
    Reported-by: kernel test robot
    Signed-off-by: Randy Dunlap
    Cc: Serge Semin
    Cc: Ramil Zaripov
    Cc: Mark Brown
    Cc: linux-spi@vger.kernel.org
    Acked-by: Serge Semin
    Link: https://lore.kernel.org/r/20201116040721.8001-1-rdunlap@infradead.org
    Signed-off-by: Mark Brown
    Signed-off-by: Sasha Levin

    Randy Dunlap
     
  • [ Upstream commit e4062765bc2a41e025e29dd56bad798505036427 ]

    pm_runtime_get_sync will increment pm usage counter even it
    failed. Forgetting to pm_runtime_put_noidle will result in
    reference leak in sprd_spi_remove, so we should fix it.

    Fixes: e7d973a31c24b ("spi: sprd: Add SPI driver for Spreadtrum SC9860")
    Signed-off-by: Zhang Qilong
    Acked-by: Chunyan Zhang
    Link: https://lore.kernel.org/r/20201106015035.139574-1-zhangqilong3@huawei.com
    Signed-off-by: Mark Brown
    Signed-off-by: Sasha Levin

    Zhang Qilong
     
  • [ Upstream commit 1dcbdd944824369d4569959f8130336fe6fe5f39 ]

    pm_runtime_get_sync will increment pm usage counter even it
    failed. Forgetting to pm_runtime_put_noidle will result in
    reference leak in callers(spi_imx_prepare_message and
    spi_imx_remove), so we should fix it.

    Fixes: 525c9e5a32bd7 ("spi: imx: enable runtime pm support")
    Signed-off-by: Zhang Qilong
    Link: https://lore.kernel.org/r/20201102145835.4765-1-zhangqilong3@huawei.com
    Signed-off-by: Mark Brown
    Signed-off-by: Sasha Levin

    Zhang Qilong
     
  • [ Upstream commit 9bb9ef2b3e5d9d012876e7e2d7757eb30e865bee ]

    Fix the missing clk_disable_unprepare() before return
    from bcm63xx_hsspi_resume in the error handling case when
    fails to prepare and enable bs->pll_clk.

    Fixes: 0fd85869c2a9 ("spi/bcm63xx-hsspi: keep pll clk enabled")
    Signed-off-by: Qinglang Miao
    Link: https://lore.kernel.org/r/20201103074911.195530-1-miaoqinglang@huawei.com
    Signed-off-by: Mark Brown
    Signed-off-by: Sasha Levin

    Qinglang Miao