binder_inner_proc_lock(thread->proc) is a spin lock, copy_to_user can't
be called with in this lock.

Copy it as a local variable to fix it.

Fixes: bd32889e ("binder: add BINDER_GET_EXTENDED_ERROR ioctl")
Reported-by: syzbot+46fff6434a7f968ecb39@syzkaller.appspotmail.com
Reviewed-by: Carlos Llamas <cmllamas@google.com>
Signed-off-by: Schspa Shi <schspa@gmail.com>
Link: https://lore.kernel.org/r/20220518011754.49348-1-schspa@gmail.comSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

Commit 9474be34 ("binder: add failed transaction logging info")
dereferences target_{proc,thread} after they have been potentially
freed by binder_proc_dec_tmpref() and binder_thread_dec_tmpref().

This patch delays the release of the two references after their last
usage. Fixes the following two errors reported by smatch:

  drivers/android/binder.c:3562 binder_transaction() error: dereferencing freed memory 'target_proc'
  drivers/android/binder.c:3563 binder_transaction() error: dereferencing freed memory 'target_thread'

Fixes: 9474be34 ("binder: add failed transaction logging info")
Reported-by: Dan Carpenter <dan.carpenter@oracle.com>
Acked-by: Todd Kjos <tkjos@google.com>
Signed-off-by: Carlos Llamas <cmllamas@google.com>
Link: https://lore.kernel.org/r/20220517185817.598872-1-cmllamas@google.comSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

Make sure we use unsigned format specifier %u for binder commands as
most of them are encoded above INT_MAX. This prevents negative values
when logging them as in the following case:

[  211.895781] binder: 8668:8668 BR_REPLY 258949 0:0, cmd -2143260157 size 0-0 ptr 0000006e766a8000-0000006e766a8000
Acked-by: Todd Kjos <tkjos@google.com>
Acked-by: Christian Brauner (Microsoft) <brauner@kernel.org>
Signed-off-by: Carlos Llamas <cmllamas@google.com>
Link: https://lore.kernel.org/r/20220509231901.3852573-1-cmllamas@google.comSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

Merge tag 'lkdtm-next' of https://git.kernel.org/pub/scm/linux/kernel/git/kees/linux into char-misc-next

Kees writes:

lkdtm updates for -next

- Test for new usercopy memory regions
- avoid GCC 12 warnings
- update expected CONFIGs for selftests

* tag 'lkdtm-next' of https://git.kernel.org/pub/scm/linux/kernel/git/kees/linux:
  lkdtm/heap: Hide allocation size from -Warray-bounds
  selftests/lkdtm: Add configs for stackleak and "after free" tests
  lkdtm/usercopy: Check vmalloc and >0-order folios
  lkdtm/usercopy: Rename "heap" to "slab"
  lkdtm: cfi: Fix type width for masking PAC bits

Merge tag 'fpga-for-5.19-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/fpga/linux-fpga into char-misc-next

Moritz writes:

FPGA Manager changes for 5.19-rc1

FPGA Manager

- My change moves the linux-fpga repository to a shared
  location w/ shared responsibilities between maintainers
- Nava's changes fix coding style and kernel-docs

DFL

- Matthew's change allows ports to be linked to FMEs.
- Tianfei's changes clean up some documentation and
  ensure the feature type is checked before parsing IRQs

All patches have been reviewed on the mailing list, and have been in the
last linux-next releases (as part of our for-next branch).
Signed-off-by: Moritz Fischer <mdf@kernel.org>

* tag 'fpga-for-5.19-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/fpga/linux-fpga:
  fpga: dfl: Allow Port to be linked to FME's DFL
  Documentation: fpga: dfl: add link address of feature id table
  fpga: dfl: check feature type before parse irq info
  fpga: fpga-region: fix kernel-doc formatting issues
  fpga: Use tab instead of space indentation
  fpga: fpga-mgr: fix kernel-doc warnings
  fpga: fix for coding style issues
  MAINTAINERS: Update linux-fpga repository location

Merge tag 'coresight-next-v5.19' of gitolite.kernel.org:pub/scm/linux/kernel/git/coresight/linux into char-misc-next

Mathieu writes:

Coresight changes for v5.19

This pull request includes:

- Work to uniformise access to the ETMv4 registers, making it easier to
look for and change register accesses.

- A correction to a probing failure when looking for links between devices.

- The replacement of a call to mutex_lock() with a mutex_trylock() in the panic
notifier of the cpu-debug infrastructure to avoid a possible deadlock.
Signed-off-by: Mathieu Poirier <mathieu.poirier@linaro.org>

* tag 'coresight-next-v5.19' of gitolite.kernel.org:pub/scm/linux/kernel/git/coresight/linux:
  coresight: cpu-debug: Replace mutex with mutex_trylock on panic notifier
  coresight: core: Fix coresight device probe failure issue
  coresight: etm4x: Cleanup TRCRSCTLRn register accesses
  coresight: etm4x: Cleanup TRCBBCTLR register accesses
  coresight: etm4x: Cleanup TRCSSPCICRn register accesses
  coresight: etm4x: Cleanup TRCSSCCRn and TRCSSCSRn register accesses
  coresight: etm4x: Cleanup TRCACATRn register accesses
  coresight: etm3x: Cleanup ETMTECR1 register accesses
  coresight: etm4x: Cleanup TRCVICTLR register accesses
  coresight: etm4x: Cleanup TRCSTALLCTLR register accesses
  coresight: etm4x: Cleanup TRCEVENTCTL1R register accesses
  coresight: etm4x: Cleanup TRCCONFIGR register accesses
  coresight: etm4x: Cleanup TRCIDR5 register accesses
  coresight: etm4x: Cleanup TRCIDR4 register accesses
  coresight: etm4x: Cleanup TRCIDR3 register accesses
  coresight: etm4x: Cleanup TRCIDR2 register accesses
  coresight: etm4x: Cleanup TRCIDR0 register accesses

Merge tag 'extcon-next-for-5.19' of git://git.kernel.org/pub/scm/linux/kernel/git/chanwoo/extcon into char-misc-next

Chanwoo writes:

Update extcon next for v5.19

Detailed description for this pull request:
1. update extcon core driver
- extcon_get_extcon_dev() has been almost used to get the extcon device
on booting time. If extcon provider driver is probed at late time,
the extcon consumer driver get the -EPROBE_DEFER return value.
It requires the inefficient handling code of -EPROBE_DEFER.
Instead, extcon_get_extcon_dev() will return -EPROBE_DEFER
if the required extcon device is none. It makes the extcon consumer driver
to be simplified when getting extcon device.
- Register device after dev_set_drvdata because of accessing
the sysfs attributes at timing of between drv_set_data and device_register.
- Fix some kernel-doc comments of extcon functions.

2. update extcon provider driver
- Update extcon-intel-int3496.c
: Add support for controlling vbus power via regulator and support
to the extcon-intel-int3496.c driver to bind to devices without
an ACPi companion. And fix the minor clean-up.
- Use struct_size() helper on extcon-usbc-cros-ec.c
- Remove the disable irq operation in system sleep for using vbus/id
gpio as the wakeup source on extcon-usb-gpio.c
- Add support of SM5703 device by using existing extcon-sm5502.c
and rename i2c_devic_id from sm5703 to sm5703-muic to reduce confusion
between SM5703 MFD device and extcon device.
- Add usb role class support and add queue work sync before driver release
on extcon-ptn5150.c

* tag 'extcon-next-for-5.19' of git://git.kernel.org/pub/scm/linux/kernel/git/chanwoo/extcon:
  extcon: Modify extcon device to be created after driver data is set
  extcon: sm5502: Clarify SM5703's i2c device ID
  extcon: ptn5150: Add usb role class support
  extcon: ptn5150: Add queue work sync before driver release
  extcon: sm5502: Add support for SM5703
  dt-bindings: extcon: bindings for SM5703
  extcon: usb-gpio: Remove disable irq operation in system sleep
  extcon: Fix some kernel-doc comments
  extcon: usbc-cros-ec: Use struct_size() helper in kzalloc()
  extcon: int3496: Add support for controlling Vbus through a regulator
  extcon: int3496: Add support for binding to plain platform devices
  extcon: int3496: Request non-exclusive access to the ID GPIO
  extcon: int3496: Make the driver a bit less verbose
  extcon: Fix extcon_get_extcon_dev() error handling

Merge tag 'soundwire-5.19-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/vkoul/soundwire into char-misc-next

Vinod writes:

soundwire updates for 5.19-rc1

 - Support for v1.6.0 Qualcomm controllers
 - Bunch of pm updates by Intel for peripheral attachment and system pm
   etc

* tag 'soundwire-5.19-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/vkoul/soundwire:
  soundwire: qcom: adjust autoenumeration timeout
  soundwire: qcom: use pm_runtime_resume_and_get()
  soundwire: intel: use pm_runtime_resume_and_get()
  soundwire: cadence: use pm_runtime_resume_and_get()
  soundwire: bus: use pm_runtime_resume_and_get()
  soundwire: qcom: return error when pm_runtime_get_sync fails
  soundwire: bus: pm_runtime_request_resume on peripheral attachment
  soundwire: intel: disable WAKEEN in pm_runtime resume
  soundwire: intel: prevent pm_runtime resume prior to system suspend
  soundwire: cadence: recheck device0 attachment after status change
  dt-bindings: soundwire: qcom: Add bindings for audio clock reset control property
  soundwire: qcom: Add compatible name for v1.6.0
  soundwire: stream: Fix error return code in do_bank_switch()
  soundwire: qcom: fix an error message in swrm_wait_for_frame_gen_enabled()

Merge tag 'phy-for-5.19' of git://git.kernel.org/pub/scm/linux/kernel/git/phy/linux-phy into char-work-next

Vinod writes:

phy-for-5.19

  - New support:
        - LVDS configuration support and implementation in fsl driver
	- Qualcomm UFS phy support for SM6350 and USB PHY for SDX65
	- Allwinner D-PHY Rx mode support
	- Yamilfy Mixel mipi-dsi-phy

  - Updates:
	- Documentation for phy ops order
        - Can transceiver mux support
	- Qualcomm QMP phy updates
	- Uniphier phy updates

* tag 'phy-for-5.19' of git://git.kernel.org/pub/scm/linux/kernel/git/phy/linux-phy: (40 commits)
  phy: qcom-qmp: rename error labels
  phy: qcom-qmp: fix pipe-clock imbalance on power-on failure
  phy: qcom-qmp: switch to explicit reset helpers
  phy: qcom-qmp: fix reset-controller leak on probe errors
  phy: qcom-qmp: fix struct clk leak on probe errors
  dt-bindings: phy: renesas,usb2-phy: Document RZ/G2UL phy bindings
  dt-bindings: phy: marvell,armada-3700-utmi-host-phy: Fix incorrect compatible in example
  phy: qcom-qmp: fix phy-descriptor kernel-doc typo
  phy: rockchip-inno-usb2: Clean up some inconsistent indenting
  phy: freescale: imx8m-pcie: Handle IMX8_PCIE_REFCLK_PAD_UNUSED
  phy: core: Warn when phy_power_on is called before phy_init
  phy: core: Update documentation syntax
  phy: core: Add documentation of phy operation order
  phy: rockchip-inno-usb2: Handle ID IRQ
  phy: rockchip-inno-usb2: Handle bvalid falling
  phy: rockchip-inno-usb2: Support multi-bit mask properties
  phy: rockchip-inno-usb2: Do not lock in bvalid IRQ handler
  phy: rockchip-inno-usb2: Do not check bvalid twice
  phy: rockchip-inno-usb2: Fix muxed interrupt support
  phy: allwinner: phy-sun6i-mipi-dphy: Support D-PHY Rx mode for MIPI CSI-2
  ...

Merge tag 'mhi-for-v5.19' of git://git.kernel.org/pub/scm/linux/kernel/git/mani/mhi into char-work-next

Manivannan writes:

MHI changes for v5.19

MHI Host
--------

Support for new modems:

 - Foxconn Cinterion MV32-WA/MV32-WB based on SDX62/SDX65
 - Telit FN980 v1 based on SDX55
 - Telit FN990 based on SDX65
 - Foxconn T99W373/T99W368 based on SDX62/SDX65

Core changes:

 - During the recycle of event ring elements, compute the ctxt_wp based on the
   local cached value instead of reading from shared memory. This is to prevent
   the possible corruption of the ctxt_wp as some of the endpoint devices could
   modify the value in shared memory.

 - Add sysfs support for resetting the endpoint based on the MHI spec. The MHI
   spec allows the host to hard reset the device in the case of an unrecoverable
   error and all other reset mechanisms have failed.

 - During MHI shutdown, wait for the endpoint device to enter the ready state
   post reset before proceeding. This is to avoid a possible race where host
   would remove the interrupt handler and device will send ready state
   interrupt, resulting in IOMMU fault.

 - Bail out updating the MHI register if the read has failed during
   read/modify/write.

 - Use mhi_write_reg() instead of mhi_write_reg_field() for writing the whole
   register fields in mhi_init_mmio().

MAINTAINERS change:

 - Since Qualcomm has moved the email domain for its employess from codeaurora
   domain to quicinc, update the same for Hemant.

* tag 'mhi-for-v5.19' of git://git.kernel.org/pub/scm/linux/kernel/git/mani/mhi: (29 commits)
  bus: mhi: host: Add support for Foxconn T99W373 and T99W368
  bus: mhi: host: pci_generic: add Telit FN990
  bus: mhi: host: pci_generic: add Telit FN980 v1 hardware revision
  bus: mhi: host: Add support for Cinterion MV32-WA/MV32-WB
  bus: mhi: host: Optimize and update MMIO register write method
  bus: mhi: host: Bail on writing register fields if read fails
  bus: mhi: host: Wait for ready state after reset
  bus: mhi: host: Add soc_reset sysfs
  bus: mhi: host: pci_generic: Sort mhi_pci_id_table based on the PID
  bus: mhi: host: Use cached values for calculating the shared write pointer
  MAINTAINERS: Update Hemant's email id
  bus: mhi: ep: Add uevent support for module autoloading
  bus: mhi: ep: Add support for suspending and resuming channels
  bus: mhi: ep: Add support for queueing SKBs to the host
  bus: mhi: ep: Add support for processing channel rings
  bus: mhi: ep: Add support for reading from the host
  bus: mhi: ep: Add support for processing command rings
  bus: mhi: ep: Add support for handling SYS_ERR condition
  bus: mhi: ep: Add support for handling MHI_RESET
  bus: mhi: ep: Add support for powering down the MHI endpoint stack
  ...

Merge tag 'iio-for-5.19a' of https://git.kernel.org/pub/scm/linux/kernel/git/jic23/iio into char-misc-next

Jonathan writes:

First set of IIO new device support, features and cleanup for 5.19

Usual mixed bag. Stand out this time is Andy Shevchenko's continuing
effort to move drivers over the generic firmware interfaces.

Device support
* sprd,sc2720
  - upm9620 binding addition.
  - Refactor and support for sc2720, sc2721 and sc2730.
* ti,ads1015
  - Refactor driver and add support for TLA2024.

Device support (IDs only)
* invensense,mpu6050
  - Add ID for ICM-20608-D.
* st,accel:
  -  Add ID for lis302dl.
* st,lsm6dsx
  - Add support for ASM330LHHX (can fallback to LSM6DSR.)

Features
* convert drivers to device properties
  - IIO core
  - adi,ad7266
  - adi,adis16480
  - adi,adxl355
  - bosch,bmi160
  - domintech,dmard06
  - fsl,fxas21002c
  - invensense,mpu3050
  - linear,ltc2983
  - linear,ltc2632
  - maxbotix,mb1232
  - maxim,max31856
  - maxim,max31865
  - multiplexer
  - ping
  - rescale
  - taos,tsl2772
* core
  - Add runtime check on whether realbits fit in storagebits for each
    channel.
* adi,ad_sigma_delta
  - Add sequencer support and relevant update_scan_mode callbacks for
    adi,ad7192 and adi,ad7124.

Cleanup and minor fixes
* MAINTAINERS
  - Update Lorenzo Bianconi's email address for IIO drivers.
  - Add entry for ad3552r and update maintainer in dt-binding doc.
* tree-wide
  - Replace strtobool() with kstrtobool().
  - Drop false OF dependencies.
* core
  - Tidy up and document IIO modes.
  - Take iio_buffer_enabled() out of header allowing current_mode to be
    moved to the opaque structure.
  - As all kfifo buffers use the same mode value, drop that parameter
    and set it unconditionally.
  - White space fixes and similar.
  - Drop use of list iterator variable for
    list_for_each_entry_continue_reverse and use list_prepare_entry to
    restart.
* sysfs-trigger
  - Replace use of 'found' variable with dedicate list iterator variable.
* adi,ad7124
  - Drop misleading shift.
* adi,ad2s1210
  - Remove redundant local variable assignment.
* adi,adis16480
  - Use local device pointer to reduce repetition.
  - Improve handling of clocks.
* domintech,dmard09
  - White space.
* dummy driver
  - Improve error handling.
* fsl,mma8452
  - Add missing documentation of name element.
* invensense,mpu3050
  - Stop remove() returning non 0.
* kionix,kxsd9
  - White space.
* linear,ltc2688
  - Use local variable for struct device.
  - Combine of_node_put() error handling paths.
* linear,ltc2983
  - Avoid use of constants in messages where a define is available.
* microchip,mcp4131
  - Fix compatible in dt example.
* pni,rm3100
  - Stop directly accessing iio_dev->current_mode just to find out
    if the buffer is enabled.
* renesas,rzg2l
  - Relax kconfig constraint to include newer devices.
* sprd,sc27xx
  - Fix wrong scaling mask.
  - Improve the calibration values.
* samsung,ssp
  - Replace a 'found' variable in favor of an explicit value that was
    found.
* sensortek,stk3xx
  - Add proximity-near-level binding and driver support.
* st,st_sensors:
  - Drop unused accel_type enum.
  - Return early in *_write_raw()
  - Drop unnecessary locking in _avail functions.
  - Add local lock to protect odr against concurrent updates allowing
    mlock to no longer be used outside of the core.
  - Use iio_device_claim_direct_mode() rather than racy checking of
    the current mode.
* st,stmpe-adc
  - Fix checks on wait_for_completion_timeout().
  - Allow use of of_device_id for matching.
* st,stm32-dfsdm
  - Stop accessing iio_dev->current_mode to find out if the buffer
    is enabled (so we can hide that variable in the opaque structure)
* st,vl53l0x
  - Fix checks on wait_for_completion_timeout.
* ti,ads1015
  - Add missing ID for ti,ads1115 in binding doc.
  - Convert from repeated chip ID look up to selecting static const
    data.
  - Switch to read_avail() callback.
* ti,ads8688
  - Use of_device_id for driver matching.
* ti,palmas-adc
  - Drop a warning on minor calibration mismatch leading to slightly
    negative values after applying the calibration.

* tag 'iio-for-5.19a' of https://git.kernel.org/pub/scm/linux/kernel/git/jic23/iio: (95 commits)
  iio: ti-ads8688: use of_device_id for OF matching
  iio: stmpe-adc: use of_device_id for OF matching
  dt-bindings: iio: Fix incorrect compatible strings in examples
  iio: gyro: mpu3050: Make mpu3050_common_remove() return void
  iio: dac: ltc2632: Make use of device properties
  iio: temperature: max31865: Make use of device properties
  iio: proximity: mb1232: Switch to use fwnode_irq_get()
  iio: imu: adis16480: Improve getting the optional clocks
  iio: imu: adis16480: Use temporary variable for struct device
  iio: imu: adis16480: Make use of device properties
  staging: iio: ad2s1210: remove redundant assignment to variable negative
  iio: adc: sc27xx: add support for PMIC sc2730
  iio: adc: sc27xx: add support for PMIC sc2720 and sc2721
  iio: adc: sc27xx: refactor some functions for support more PMiCs
  iio: adc: sc27xx: structure adjustment and optimization
  iio: adc: sc27xx: Fine tune the scale calibration values
  iio: adc: sc27xx: fix read big scale voltage not right
  dt-bindings:iio:adc: add sprd,ump9620-adc dt-binding
  iio: proximity: stk3310: Export near level property for proximity sensor
  dt-bindings: iio: light: stk33xx: Add proximity-near-level
  ...

With the kmalloc() size annotations, GCC is smart enough to realize that
LKDTM is intentionally writing past the end of the buffer. This is on
purpose, of course, so hide the buffer from the optimizer. Silences:

../drivers/misc/lkdtm/heap.c: In function 'lkdtm_SLAB_LINEAR_OVERFLOW':
../drivers/misc/lkdtm/heap.c:59:13: warning: array subscript 256 is outside array bounds of 'void[1020]' [-Warray-bounds]
   59 |         data[1024 / sizeof(u32)] = 0x12345678;
      |         ~~~~^~~~~~~~~~~~~~~~~~~~
In file included from ../drivers/misc/lkdtm/heap.c:7:
In function 'kmalloc',
    inlined from 'lkdtm_SLAB_LINEAR_OVERFLOW' at ../drivers/misc/lkdtm/heap.c:54:14:
../include/linux/slab.h:581:24: note: at offset 1024 into object of size 1020 allocated by 'kmem_cache_alloc_trace'
  581 |                 return kmem_cache_alloc_trace(
      |                        ^~~~~~~~~~~~~~~~~~~~~~~
  582 |                                 kmalloc_caches[kmalloc_type(flags)][index],
      |                                 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
  583 |                                 flags, size);
      |                                 ~~~~~~~~~~~~

Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Cc: Arnd Bergmann <arnd@arndb.de>
Signed-off-by: Kees Cook <keescook@chromium.org>

Add config options which are needed for LKDTM sub-tests:
STACKLEAK_ERASING test needs GCC_PLUGIN_STACKLEAK config.
READ_AFTER_FREE and READ_BUDDY_AFTER_FREE tests need
INIT_ON_FREE_DEFAULT_ON config.
Signed-off-by: Muhammad Usama Anjum <usama.anjum@collabora.com>
Signed-off-by: Kees Cook <keescook@chromium.org>
Link: https://lore.kernel.org/r/20220517132932.1484719-1-usama.anjum@collabora.com

Add coverage for the recently added usercopy checks for vmalloc and
folios, via USERCOPY_VMALLOC and USERCOPY_FOLIO respectively.

Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Cc: Matthew Wilcox (Oracle) <willy@infradead.org>
Cc: Arnd Bergmann <arnd@arndb.de>
Signed-off-by: Kees Cook <keescook@chromium.org>

Currently, someone can invoke the sysfs such as state_show()
intermittently before dev_set_drvdata() is done.
And it can be a cause of kernel Oops because of edev is Null at that time.
So modified the driver registration to after setting drviver data.

- Oops's backtrace.

Backtrace:
[<c067865c>] (state_show) from [<c05222e8>] (dev_attr_show)
[<c05222c0>] (dev_attr_show) from [<c02c66e0>] (sysfs_kf_seq_show)
[<c02c6648>] (sysfs_kf_seq_show) from [<c02c496c>] (kernfs_seq_show)
[<c02c4938>] (kernfs_seq_show) from [<c025e2a0>] (seq_read)
[<c025e11c>] (seq_read) from [<c02c50a0>] (kernfs_fop_read)
[<c02c5064>] (kernfs_fop_read) from [<c0231cac>] (__vfs_read)
[<c0231c5c>] (__vfs_read) from [<c0231ee0>] (vfs_read)
[<c0231e34>] (vfs_read) from [<c0232464>] (ksys_read)
[<c02323f0>] (ksys_read) from [<c02324fc>] (sys_read)
[<c02324e4>] (sys_read) from [<c00091d0>] (__sys_trace_return)
Signed-off-by: bumwoo lee <bw365.lee@samsung.com>
Signed-off-by: Chanwoo Choi <cw00.choi@samsung.com>

While SM5502 and SM5504 are purely micro USB switching
circuits, SM5703 is a multi-function device which has multiple
modules in it. Change the i2c_device_id of it to avoid conflict
with MFD driver.
Signed-off-by: Markuss Broks <markuss.broks@gmail.com>
Signed-off-by: Chanwoo Choi <cw00.choi@samsung.com>

Some usb controller drivers may not support extcon but use
usb role class as it's the preferred approach, so to support
usb dual role switch with usb role class, add usb role class
consumer support.
Signed-off-by: Li Jun <jun.li@nxp.com>
Reviewed-by: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
Signed-off-by: Chanwoo Choi <cw00.choi@samsung.com>

Add device managed action to sync pending queue work, otherwise
the queued work may run after the work is destroyed.

Fixes: 4ed754de ("extcon: Add support for ptn5150 extcon driver")
Reviewed-by: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
Signed-off-by: Li Jun <jun.li@nxp.com>
Signed-off-by: Chanwoo Choi <cw00.choi@samsung.com>

SM5703 is another MFD from Silicon Mitus which has a very similar MUIC
unit to the one in SM5502. The only difference I've noticed is slightly different
configuration only enables the interrupts which are exactly the same as on SM5502.
If we make use of different interrupts in the future, this can be improved by having
a separate struct for SM5703, but the main functionality (detecting cable or OTG adapter)
is working properly.
Signed-off-by: Markuss Broks <markuss.broks@gmail.com>
Signed-off-by: Chanwoo Choi <cw00.choi@samsung.com>

This patch adds device-tree bindings for Silicon Mitus SM5703 MUIC.
Signed-off-by: Markuss Broks <markuss.broks@gmail.com>
Reviewed-by: Krzysztof Kozlowski <krzk@kernel.org>
Signed-off-by: Chanwoo Choi <cw00.choi@samsung.com>

If disable vbus/id irq, it will lead to wakeup system fail
in unisoc platform. In unisoc platform, Irq enable and irq
wakeup are the same interrupt line. So remove disable vbus/id
irq operation is a way to solve the issue.
Signed-off-by: Bruce Chen <bruce.chen@unisoc.com>
Acked-by: Roger Quadros <rogerq@kernel.org>
Signed-off-by: Chanwoo Choi <cw00.choi@samsung.com>

Add the description of @id in extcon_sync() kernel-doc comment
and @edev, @id, @prop in extcon_set_property_sync() kernel-doc
comment to remove warnings found by running scripts/kernel-doc,
which is caused by using 'make W=1'.
drivers/extcon/extcon.c:409: warning: Function parameter or
member 'id' not described in 'extcon_sync'
drivers/extcon/extcon.c:750: warning: Function parameter or
member 'edev' not described in 'extcon_set_property_sync'
drivers/extcon/extcon.c:750: warning: Function parameter or
member 'id' not described in 'extcon_set_property_sync'
drivers/extcon/extcon.c:750: warning: Function parameter or
member 'prop' not described in 'extcon_set_property_sync'
Reported-by: Abaci Robot <abaci@linux.alibaba.com>
Signed-off-by: Yang Li <yang.lee@linux.alibaba.com>
Signed-off-by: Chanwoo Choi <cw00.choi@samsung.com>

Make use of the struct_size() helper instead of an open-coded version,
in order to avoid any potential type mistakes or integer overflows that,
in the worst scenario, could lead to heap overflows.
Signed-off-by: Gustavo A. R. Silva <gustavoars@kernel.org>
Signed-off-by: Chanwoo Choi <cw00.choi@samsung.com>

On some boards the 5V vboost-regulator for powering devices connected to
the micro USB connector is not controlled through a GPIO. This happens
for example when the 5V vboost-regulator is integrated into the charger IC
and controlled over I2C.

Add support for controlling the 5V vboost-regulator through the regulator
framework for such boards.
Signed-off-by: Hans de Goede <hdegoede@redhat.com>
Signed-off-by: Chanwoo Choi <cw00.choi@samsung.com>

On some X86 Android tablets the DSTD lack the INT3496 ACPI device,
while also not handling micro USB port ID pin events inside the DSDT
(instead the forked factory image kernel has things hardcoded).

The new drivers/platform/x86/x86-android-tablets.c module manually
instantiates an intel-int3496 device for these tablets.

Add support to the extcon-intel-int3496 driver to bind to devices
without an ACPI companion and export a normal platform_device
modalias for automatic module loading.
Signed-off-by: Hans de Goede <hdegoede@redhat.com>
Signed-off-by: Chanwoo Choi <cw00.choi@samsung.com>

Some DSDTs are buggy and do a read from the ID pin during the ACPI
initialization, causing the pin to be marked as owned by:
"ACPI:OpRegion" and causing gpiod_get() to fail with -EBUSY.

Pass the GPIOD_FLAGS_BIT_NONEXCLUSIVE flag to the gpiod_get() call
to work around this.
Signed-off-by: Hans de Goede <hdegoede@redhat.com>
Signed-off-by: Chanwoo Choi <cw00.choi@samsung.com>

On all devices which I have with an INT3496 ACPI device,
there is only an ID pin defined.

Change the log-messages about not being able to get GPIOs for
"VBUS EN" and "USB MUX" to use dev_dbg().
Signed-off-by: Hans de Goede <hdegoede@redhat.com>
Signed-off-by: Chanwoo Choi <cw00.choi@samsung.com>

The extcon_get_extcon_dev() function returns error pointers on error,
NULL when it's a -EPROBE_DEFER defer situation, and ERR_PTR(-ENODEV)
when the CONFIG_EXTCON option is disabled.  This is very complicated for
the callers to handle and a number of them had bugs that would lead to
an Oops.

In real life, there are two things which prevented crashes.  First,
error pointers would only be returned if there was bug in the caller
where they passed a NULL "extcon_name" and none of them do that.
Second, only two out of the eight drivers will build when CONFIG_EXTCON
is disabled.

The normal way to write this would be to return -EPROBE_DEFER directly
when appropriate and return NULL when CONFIG_EXTCON is disabled.  Then
the error handling is simple and just looks like:

	dev->edev = extcon_get_extcon_dev(acpi_dev_name(adev));
	if (IS_ERR(dev->edev))
		return PTR_ERR(dev->edev);

For the two drivers which can build with CONFIG_EXTCON disabled, then
extcon_get_extcon_dev() will now return NULL which is not treated as an
error and the probe will continue successfully.  Those two drivers are
"typec_fusb302" and "max8997-battery".  In the original code, the
typec_fusb302 driver had an 800ms hang in tcpm_get_current_limit() but
now that function is a no-op.  For the max8997-battery driver everything
should continue working as is.
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Reviewed-by: Hans de Goede <hdegoede@redhat.com>
Reviewed-by: Heikki Krogerus <heikki.krogerus@linux.intel.com>
Reviewed-by: Guenter Roeck <linux@roeck-us.net>
Acked-by: Sebastian Reichel <sebastian.reichel@collabora.com>
Signed-off-by: Chanwoo Choi <cw00.choi@samsung.com>

To more clearly distinguish between the various heap types, rename the
slab tests to "slab".

Cc: Arnd Bergmann <arnd@arndb.de>
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Cc: Shuah Khan <shuah@kernel.org>
Cc: linux-kselftest@vger.kernel.org
Signed-off-by: Kees Cook <keescook@chromium.org>

Currently we use PORTn_OFFSET to locate PORT DFLs, and PORT DFLs are not
connected FME DFL. But for some cases (e.g. Intel Open FPGA Stack device),
PORT DFLs are connected to FME DFL directly, so we don't need to search
PORT DFLs via PORTn_OFFSET again. If BAR value of PORTn_OFFSET is 0x7
(FME_PORT_OFST_BAR_SKIP) then driver will skip searching the DFL for that
port. If BAR value is invalid, return -EINVAL.
Signed-off-by: Matthew Gerlach <matthew.gerlach@linux.intel.com>
Signed-off-by: Tianfei Zhang <tianfei.zhang@intel.com>
Acked-by: Wu Hao <hao.wu@intel.com>
Link: https://lore.kernel.org/r/20220505100617.703672-1-tianfei.zhang@intel.comSigned-off-by: Xu Yilun <yilun.xu@intel.com>

This patch adds the link address of feature id table in documentation.
Signed-off-by: Tianfei zhang <tianfei.zhang@intel.com>
Reviewed-by: Matthew Gerlach <matthew.gerlach@linux.intel.com>
Acked-by: Moritz Fischer <mdf@kernel.org>
Acked-by: Wu Hao <hao.wu@intel.com>
Link: https://lore.kernel.org/r/20220419032942.427429-3-tianfei.zhang@intel.comSigned-off-by: Xu Yilun <yilun.xu@intel.com>

Previously the feature IDs defined are unique, no matter
which feature type. But currently we want to extend its
usage to have a per-type feature ID space, so this patch
adds feature type checking as well just before look into
feature ID for different features which have irq info.
Signed-off-by: Tianfei zhang <tianfei.zhang@intel.com>
Reviewed-by: Matthew Gerlach <matthew.gerlach@linux.intel.com>
Acked-by: Wu Hao <hao.wu@intel.com>
Acked-by: Moritz Fischer <mdf@kernel.org>
Link: https://lore.kernel.org/r/20220419032942.427429-2-tianfei.zhang@intel.comSigned-off-by: Xu Yilun <yilun.xu@intel.com>

To fix below kernel-doc warnings this patch does the following
->Replaced Return\Returns with 'Return:' keyword.
->Added 'Return' description For __init of_fpga_region_init()' API.
->Added description for 'child_regions_with_firmware()' API.

warning: No description found for return value of
'of_fpga_region_find'.
warning: No description found for return value of
'of_fpga_region_get_bridges'.
warning: missing initial short description on line:
* child_regions_with_firmware
warning: No description found for return value of
'child_regions_with_firmware'.
warning: No description found for return value of
'of_fpga_region_notify_pre_apply'.
warning: No description found for return value of
'of_fpga_region_notify'.
warning: No description found for return value of
'of_fpga_region_init'.
Signed-off-by: Nava kishore Manne <nava.manne@xilinx.com>
Link: https://lore.kernel.org/r/20220423170235.2115479-6-nava.manne@xilinx.comSigned-off-by: Xu Yilun <yilun.xu@intel.com>

In FPGA Makefile has both space and tab indentation, to
make them align use tab instead of space indentation.
Signed-off-by: Nava kishore Manne <nava.manne@xilinx.com>
Link: https://lore.kernel.org/r/20220423170235.2115479-5-nava.manne@xilinx.comSigned-off-by: Xu Yilun <yilun.xu@intel.com>

warnings: No description found for return value of 'xxx'

In-order to fix the above kernel-doc warnings added the
'Return' description for 'devm_fpga_mgr_register_full()'
and 'devm_fpga_mgr_register()' APIs.
Signed-off-by: Nava kishore Manne <nava.manne@xilinx.com>
Link: https://lore.kernel.org/r/20220423170235.2115479-4-nava.manne@xilinx.comSigned-off-by: Xu Yilun <yilun.xu@intel.com>

fixes the below checks reported by checkpatch.pl:
- Lines should not end with a '('
- Alignment should match open parenthesis
Signed-off-by: Nava kishore Manne <nava.manne@xilinx.com>
Link: https://lore.kernel.org/r/20220423170235.2115479-3-nava.manne@xilinx.comSigned-off-by: Xu Yilun <yilun.xu@intel.com>

Product's enumeration align with previous Foxconn
SDX55, so T99W373(SDX62)/T99W368(SDX65) would use
 the same config as Foxconn SDX55.
Remove fw and edl for this new commit.
Signed-off-by: Slark Xiao <slark_xiao@163.com>
Reviewed-by: Manivannan Sadhasivam <mani@kernel.org>
Reviewed-by: Loic Poulain <loic.poulain@linaro.org>
Link: https://lore.kernel.org/r/20220503024349.4486-1-slark_xiao@163.comSigned-off-by: Manivannan Sadhasivam <manivannan.sadhasivam@linaro.org>

Add Telit FN990:

01:00.0 Unassigned class [ff00]: Qualcomm Device 0308
        Subsystem: Device 1c5d:2010
Signed-off-by: Daniele Palmas <dnlplm@gmail.com>
Reviewed-by: Manivannan Sadhasivam <mani@kernel.org>
Link: https://lore.kernel.org/r/20220502112036.443618-1-dnlplm@gmail.com
[mani: Added "host" to the subject]
Signed-off-by: Manivannan Sadhasivam <manivannan.sadhasivam@linaro.org>

Add Telit FN980 v1 hardware revision:

01:00.0 Unassigned class [ff00]: Qualcomm Device [17cb:0306]
        Subsystem: Device [1c5d:2000]
Signed-off-by: Daniele Palmas <dnlplm@gmail.com>
Reviewed-by: Manivannan Sadhasivam <mani@kernel.org>
Link: https://lore.kernel.org/r/20220427072648.17635-1-dnlplm@gmail.com
[mani: Added "host" to the subject]
Signed-off-by: Manivannan Sadhasivam <manivannan.sadhasivam@linaro.org>

The panic notifier infrastructure executes registered callbacks when
a panic event happens - such callbacks are executed in atomic context,
with interrupts and preemption disabled in the running CPU and all other
CPUs disabled. That said, mutexes in such context are not a good idea.

This patch replaces a regular mutex with a mutex_trylock safer approach;
given the nature of the mutex used in the driver, it should be pretty
uncommon being unable to acquire such mutex in the panic path, hence
no functional change should be observed (and if it is, that would be
likely a deadlock with the regular mutex).

Fixes: 2227b7c7 ("coresight: add support for CPU debug module")
Cc: Leo Yan <leo.yan@linaro.org>
Cc: Mathieu Poirier <mathieu.poirier@linaro.org>
Cc: Mike Leach <mike.leach@linaro.org>
Cc: Suzuki K Poulose <suzuki.poulose@arm.com>
Signed-off-by: Guilherme G. Piccoli <gpiccoli@igalia.com>
Reviewed-by: Suzuki K Poulose <suzuki.poulose@arm.com>
Signed-off-by: Suzuki K Poulose <suzuki.poulose@arm.com>
Link: https://lore.kernel.org/r/20220427224924.592546-10-gpiccoli@igalia.com