commit 11ca605653480b2ddc70ec142a0a686796a7fc87 upstream.

The previous bugfix caused a warning on 64-bit builds:

drivers/input/touchscreen/ads7846.c:1126:17: warning: cast to smaller integer type 'u32' (aka 'unsigned int') from 'const void *' [-Wvoid-pointer-to-int-cast]

Change the cast back to something that works on both 32-bit and 64-bit
kernels.

Reported-by: kernel test robot <lkp@intel.com>
Closes: https://lore.kernel.org/oe-kbuild-all/202306100442.jStknDT1-lkp@intel.com/
Fixes: 8f7913c04f6a7 ("Input: ads7846 - Fix usage of match data")
Reviewed-by: Linus Walleij <linus.walleij@linaro.org>
Signed-off-by: Arnd Bergmann <arnd@arndb.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 8f7913c04f6a7b90bcf998ece17395d7090f6d44 upstream.

device_get_match_data() returns the match data directly, fix
this up and fix the probe crash.

Fixes: 767d83361aaa ("Input: ads7846 - Convert to use software nodes")
Reported-by: Guenter Roeck <linux@roeck-us.net>
Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
Acked-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
Link: https://lore.kernel.org/r/20230606191304.3804174-1-linus.walleij@linaro.org
Signed-off-by: Arnd Bergmann <arnd@arndb.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

[ Upstream commit 767d83361aaa6a1ecb4d5b89eeb38a267239917a ]

The Nokia 770 is using GPIOs from the global numberspace on the
CBUS node to pass down to the LCD controller. This regresses when we
let the OMAP GPIO driver use dynamic GPIO base.

The Nokia 770 now has dynamic allocation of IRQ numbers, so this
needs to be fixed for it to work.

As this is the only user of LCD MIPID we can easily augment the
driver to use a GPIO descriptor instead and resolve the issue.

The platform data .shutdown() callback wasn't even used in the
code, but we encode a shutdown asserting RESET in the remove()
callback for completeness sake.

The CBUS also has the ADS7846 touchscreen attached.

Populate the devices on the Nokia 770 CBUS I2C using software
nodes instead of platform data quirks. This includes the LCD
and the ADS7846 touchscreen so the conversion just brings the LCD
along with it as software nodes is an all-or-nothing design
pattern.

The ADS7846 has some limited support for using GPIO descriptors,
let's convert it over completely to using device properties and then
fix all remaining boardfile users to provide all platform data using
software nodes.

Dump the of includes and of_match_ptr() in the ADS7846 driver as part
of the job.

Since we have to move ADS7846 over to obtaining the GPIOs it is
using exclusively from descriptors, we provide descriptor tables
for the two remaining in-kernel boardfiles using ADS7846:

- PXA Spitz
- MIPS Alchemy DB1000 development board

It was too hard for me to include software node conversion of
these two remaining users at this time: the spitz is using a
hscync callback in the platform data that would require further
GPIO descriptor conversion of the Spitz, and moving the hsync
callback down into the driver: it will just become too big of
a job, but it can be done separately.

The MIPS Alchemy DB1000 is simply something I cannot test, so take
the easier approach of just providing some GPIO descriptors in
this case as I don't want the patch to grow too intrusive.

As we see that several device trees have incorrect polarity flags
and just expect to bypass the gpiolib polarity handling, fix up
all device trees too, in a separate patch.

Suggested-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
Fixes: 92bf78b33b0b ("gpio: omap: use dynamic allocation of base")
Acked-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
Reviewed-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>

[ Upstream commit dbe836576f12743a7d2d170ad4ad4fd324c4d47a ]

The watchdog_timer can schedule tx_timeout_task and watchdog_work
can also arm watchdog_timer. The process is shown below:

----------- timer schedules work ------------
cyttsp4_watchdog_timer() //timer handler
  schedule_work(&cd->watchdog_work)

----------- work arms timer ------------
cyttsp4_watchdog_work() //workqueue callback function
  cyttsp4_start_wd_timer()
    mod_timer(&cd->watchdog_timer, ...)

Although del_timer_sync() and cancel_work_sync() are called in
cyttsp4_remove(), the timer and workqueue could still be rearmed.
As a result, the possible use after free bugs could happen. The
process is shown below:

  (cleanup routine)           |  (timer and workqueue routine)
cyttsp4_remove()              | cyttsp4_watchdog_timer() //timer
  cyttsp4_stop_wd_timer()     |   schedule_work()
    del_timer_sync()          |
                              | cyttsp4_watchdog_work() //worker
                              |   cyttsp4_start_wd_timer()
                              |     mod_timer()
    cancel_work_sync()        |
                              | cyttsp4_watchdog_timer() //timer
                              |   schedule_work()
    del_timer_sync()          |
  kfree(cd) //FREE            |
                              | cyttsp4_watchdog_work() // reschedule!
                              |   cd-> //USE

This patch changes del_timer_sync() to timer_shutdown_sync(),
which could prevent rearming of the timer from the workqueue.

Fixes: 17fb1563d69b ("Input: cyttsp4 - add core driver for Cypress TMA4XX touchscreen devices")
Signed-off-by: Duoming Zhou <duoming@zju.edu.cn>
Link: https://lore.kernel.org/r/20230421082919.8471-1-duoming@zju.edu.cn
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>

Pull input fixes from Dmitry Torokhov:

 - a fix for unbalanced open count for inhibited input devices

 - fixups in Elantech PS/2 and Cyppress TTSP v5 drivers

 - a quirk to soc_button_array driver to make it work with Lenovo
   Yoga Book X90F / X90L

 - a removal of erroneous entry from xpad driver

* tag 'input-for-v6.4-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/dtor/input:
  Input: xpad - delete a Razer DeathAdder mouse VID/PID entry
  Input: psmouse - fix OOB access in Elantech protocol
  Input: soc_button_array - add invalid acpi_index DMI quirk handling
  Input: fix open count when closing inhibited device
  Input: cyttsp5 - fix array length

The cmd array should be initialized with the proper command size and not
with the actual command value that is sent to the touchscreen.

Signed-off-by: Maximilian Weigand <mweigand@mweigand.net>
Reviewed-by: Alistair Francis <alistair@alistair23.me>
Link: https://lore.kernel.org/r/20230501113010.891786-2-mweigand@mweigand.net
Fixes: 5b0c03e24a06 ("Input: Add driver for Cypress Generation 5 touchscreen")
Cc: stable@vger.kernel.org
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>

Pull input updates from Dmitry Torokhov:

 - a new driver for Novatek touch controllers

 - a new driver for power button for NXP BBNSM

 - a skeleton KUnit tests for the input core

 - improvements to Xpad game controller driver to support more devices

 - improvements to edt-ft5x06, hideep and other drivers

* tag 'input-for-v6.4-rc0' of git://git.kernel.org/pub/scm/linux/kernel/git/dtor/input: (42 commits)
  Revert "Input: xpad - fix support for some third-party controllers"
  dt-bindings: input: pwm-beeper: convert to dt schema
  Input: xpad - fix PowerA EnWired Controller guide button
  Input: xpad - add constants for GIP interface numbers
  Input: synaptics-rmi4 - fix function name in kerneldoc
  Input: raspberrypi-ts - fix refcount leak in rpi_ts_probe
  Input: edt-ft5x06 - select REGMAP_I2C
  Input: melfas_mip4 - report palm touches
  Input: cma3000_d0x - remove unneeded code
  Input: edt-ft5x06 - calculate points data length only once
  Input: edt-ft5x06 - unify the crc check
  Input: edt-ft5x06 - convert to use regmap API
  Input: edt-ft5x06 - don't print error messages with dev_dbg()
  Input: edt-ft5x06 - remove code duplication
  Input: edt-ft5x06 - don't recalculate the CRC
  Input: edt-ft5x06 - add spaces to ensure format specification
  Input: edt-ft5x06 - remove unnecessary blank lines
  Input: edt-ft5x06 - fix indentation
  Input: tsc2007 - enable cansleep pendown GPIO
  Input: Add KUnit tests for some of the input core helper functions
  ...

Prepare input updates for 6.4 merge window.

Pull thermal control updates from Rafael Wysocki:
 "These mostly continue to prepare the thermal control subsystem for
  using unified representation of trip points, which includes cleanups,
  code refactoring and similar and update several drivers (for other
  reasons), which includes new hardware support.

  Specifics:

   - Add a thermal zone 'devdata' accessor and modify several drivers to
     use it (Daniel Lezcano)

   - Prevent drivers from using the 'device' internal thermal zone
     structure field directly (Daniel Lezcano)

   - Clean up the hwmon thermal driver (Daniel Lezcano)

   - Add thermal zone id accessor and thermal zone type accessor and
     prevent drivers from using thermal zone fields directly (Daniel
     Lezcano)

   - Clean up the acerhdf and tegra thermal drivers (Daniel Lezcano)

   - Add lower bound check for sysfs input to the x86_pkg_temp_thermal
     Intel thermal driver (Zhang Rui)

   - Add more thermal zone device encapsulation: prevent setting
     structure field directly, access the sensor device instead the
     thermal zone's device for trace, relocate the traces in
     drivers/thermal (Daniel Lezcano)

   - Use the generic trip point for the i.MX and remove the
     get_trip_temp ops (Daniel Lezcano)

   - Use the devm_platform_ioremap_resource() in the Hisilicon driver
     (Yang Li)

   - Remove R-Car H3 ES1.* handling as public has only access to the ES2
     version and the upstream support for the ES1 has been shutdown
     (Wolfram Sang)

   - Add a delay after initializing the bank in order to let the time to
     the hardware to initialze itself before reading the temperature
     (Amjad Ouled-Ameur)

   - Add MT8365 support (Amjad Ouled-Ameur)

   - Preparational cleanup and DT bindings for RK3588 support (Sebastian
     Reichel)

   - Add driver support for RK3588 (Finley Xiao)

   - Use devm_reset_control_array_get_exclusive() for the Rockchip
     driver (Ye Xingchen)

   - Detect power gated thermal zones and return -EAGAIN when reading
     the temperature (Mikko Perttunen)

   - Remove thermal_bind_params structure as it is unused (Zhang Rui)

   - Drop unneeded quotes in DT bindings allowing to run yamllint (Rob
     Herring)

   - Update the power allocator documentation according to the thermal
     trace relocation (Lukas Bulwahn)

   - Fix sensor 1 interrupt status bitmask for the Mediatek LVTS sensor
     (Chen-Yu Tsai)

   - Use the dev_err_probe() helper in the Amlogic driver (Ye Xingchen)

   - Add AP domain support to LVTS thermal controllers for mt8195
     (Balsam CHIHI)

   - Remove buggy call to thermal_of_zone_unregister() (Daniel Lezcano)

   - Make thermal_of_zone_[un]register() private to the thermal OF code
     (Daniel Lezcano)

   - Create a private copy of the thermal zone device parameters
     structure when registering a thermal zone (Daniel Lezcano)

   - Fix a kernel NULL pointer dereference in thermal_hwmon (Zhang Rui)

   - Revert recent message adjustment in thermal_hwmon (Rafael Wysocki)

   - Use of_property_present() for testing DT property presence in
     thermal control code (Rob Herring)

   - Clean up thermal_list_lock locking in the thermal core (Rafael
     Wysocki)

   - Add DLVR support for RFIM control in the int340x Intel thermal
     driver (Srinivas Pandruvada)"

* tag 'thermal-6.4-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm: (55 commits)
  thermal: intel: int340x: Add DLVR support for RFIM control
  thermal/core: Alloc-copy-free the thermal zone parameters structure
  thermal/of: Unexport unused OF functions
  thermal/drivers/bcm2835: Remove buggy call to thermal_of_zone_unregister
  thermal/drivers/mediatek/lvts_thermal: Add AP domain for mt8195
  dt-bindings: thermal: mediatek: Add AP domain to LVTS thermal controllers for mt8195
  thermal: amlogic: Use dev_err_probe()
  thermal/drivers/mediatek/lvts_thermal: Fix sensor 1 interrupt status bitmask
  MAINTAINERS: adjust entry in THERMAL/POWER_ALLOCATOR after header movement
  dt-bindings: thermal: Drop unneeded quotes
  thermal/core: Remove thermal_bind_params structure
  thermal/drivers/tegra-bpmp: Handle offline zones
  thermal/drivers/rockchip: use devm_reset_control_array_get_exclusive()
  dt-bindings: rockchip-thermal: Support the RK3588 SoC compatible
  thermal/drivers/rockchip: Support RK3588 SoC in the thermal driver
  thermal/drivers/rockchip: Support dynamic sized sensor array
  thermal/drivers/rockchip: Simplify channel id logic
  thermal/drivers/rockchip: Use dev_err_probe
  thermal/drivers/rockchip: Simplify clock logic
  thermal/drivers/rockchip: Simplify getting match data
  ...

Pull gpio updates from Bartosz Golaszewski:
 "We have some new drivers, significant refactoring of existing intel
  platforms, lots of improvements all around, mass conversion to using
  immutable irqchips by drivers that had not been converted individually
  yet and some changes in the core library code.

  Summary:

  New drivers:
   - add a driver for the Loongson GPIO controller
   - add a driver for the fxl6408 I2C GPIO expander
   - add a GPIO module containing code common for Intel Elkhart Lake and
     Merrifield platforms
   - add a driver for the Intel Elkhart Lake platform reusing the code
     from the intel tangier library

  GPIOLIB core:
   - GPIO ACPI improvements
   - simplify gpiochip_add_data_with_keys() fwnode handling
   - cleanup header inclusions (remove unneeded ones, order the rest
     alphabetically)
   - remove duplicate code (reuse krealloc() instead of open-coding it,
     drop a duplicated check in gpiod_find_and_request())
   - reshuffle the code to remove unnecessary forward declarations
   - coding style cleanups and improvements
   - add a helper for accessing device fwnodes
   - small updates in docs

  Driver improvements:
   - convert all remaining GPIO irqchip drivers to using immutable
     irqchips
   - drop unnecessary of_match_ptr() macro expansions
   - shrink the code in gpio-merrifield significantly by reusing the
     code from gpio-tangier + minor tweaks to the driver code
   - remove MODULE_LICENSE() from drivers that can only be built-in
   - add device-tree support to gpio-loongson1
   - use new regmap features in gpio-104-dio-48e and gpio-pcie-idio-24
   - minor tweaks and fixes to gpio-xra1403, gpio-sim, gpio-tegra194,
     gpio-omap, gpio-aspeed, gpio-raspberrypi-exp
   - shrink code in gpio-ich and gpio-pxa
   - Kconfig tweak for gpio-pmic-eic-sprd"

* tag 'gpio-updates-for-v6.4' of git://git.kernel.org/pub/scm/linux/kernel/git/brgl/linux: (99 commits)
  gpio: gpiolib: Simplify gpiochip_add_data_with_key() fwnode
  gpiolib: Add gpiochip_set_data() helper
  gpiolib: Move gpiochip_get_data() higher in the code
  gpiolib: Check array_info for NULL only once in gpiod_get_array()
  gpiolib: Replace open coded krealloc()
  gpiolib: acpi: Add a ignore wakeup quirk for Clevo NL5xNU
  gpiolib: acpi: Move ACPI device NULL check to acpi_get_driver_gpio_data()
  gpiolib: acpi: use the fwnode in acpi_gpiochip_find()
  gpio: mm-lantiq: Fix typo in the newly added header filename
  sh: mach-x3proto: Add missing #include <linux/gpio/driver.h>
  powerpc/40x: Add missing select OF_GPIO_MM_GPIOCHIP
  gpio: xlp: Convert to immutable irq_chip
  gpio: xilinx: Convert to immutable irq_chip
  gpio: xgs-iproc: Convert to immutable irq_chip
  gpio: visconti: Convert to immutable irq_chip
  gpio: tqmx86: Convert to immutable irq_chip
  gpio: thunderx: Convert to immutable irq_chip
  gpio: stmpe: Convert to immutable irq_chip
  gpio: siox: Convert to immutable irq_chip
  gpio: rda: Convert to immutable irq_chip
  ...