UPSTREAM: mmc: dw_mmc: The "clock-freq-min-max" property was deprecated

The "clock-freq-min-max" property was deprecated.
There is "max-frequency" property in drivers/mmc/core/host.c
"max-frequency" can be replaced with "clock-freq-min-max".
Minimum clock value might be set to 100K by default.
Then MMC core should try to find the correct value from 400K to 100K.
So it just needs to set Maximum clock value.

Change-Id: I1c72a891c8afd221b0c395c32c7adf8696cc46f1
Signed-off-by: Jaehoon Chung <jh80.chung@samsung.com>
Reviewed-by: Shawn Lin <shawn.lin@rock-chips.com>
Acked-by: Rob Herring <robh@kernel.org>
Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
Signed-off-by: Huang, Tao <huangtao@rock-chips.com>
(cherry picked from commit b023030f10573de738bbe8df63d43acab64c9f7b)

UPSTREAM: mmc: dw_mmc: change the DW_MCI_FREQ_MIN from 400K to 100K

If there is no property "clock-freq-min-max", mmc->f_min should be set
to 400K by default. But Some SoC can be used 100K.
When 100K is used, MMC core will try to check from 400K to 100K.

Change-Id: I059c994f1654c212bcff9b85dbffd9697d800eaf
Reported-by: Shawn Lin <shawn.lin@rock-chips.com>
Signed-off-by: Jaehoon Chung <jh80.chung@samsung.com>
Tested-by: Heiko Stuebner <heiko@sntech.de>
Reviewed-by: Shawn Lin <shawn.lin@rock-chips.com>
Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
Signed-off-by: Huang, Tao <huangtao@rock-chips.com>
(cherry picked from commit 72e83577bc5bc02a92c7fd47d108de11c04dcbf0)

FROMLIST: drm: Parse HDMI 2.0 YCbCr 4:2:0 VDB and VCB

HDMI 2.0 introduces a new sampling mode called YCbCr 4:2:0.
According to the spec the EDID may contain two blocks that
signal this sampling mode:
- YCbCr 4:2:0 Video Data Block
- YCbCr 4:2:0 Video Capability Map Data Block

The video data block contains the list of vic's were
only YCbCr 4:2:0 sampling mode shall be used while the
video capability map data block contains a mask were
YCbCr 4:2:0 sampling mode may be used.

This RFC patch adds support for parsing these two new blocks
and introduces new flags to signal the drivers if the
mode is 4:2:0'only or 4:2:0'able.

The reason this is still a RFC is because there is no
reference in kernel for this new sampling mode (specially in
AVI infoframe part), so, I was hoping to hear some feedback
first.

Tested in a HDMI 2.0 compliance scenario.

Signed-off-by: Jose Abreu <joabreu@synopsys.com>
Cc: Carlos Palminha <palminha@synopsys.com>
Cc: Daniel Vetter <daniel.vetter@intel.com>
Cc: Jani Nikula <jani.nikula@linux.intel.com>
Cc: Sean Paul <seanpaul@chromium.org>
Cc: David Airlie <airlied@linux.ie>
Cc: dri-devel@lists.freedesktop.org
Cc: linux-kernel@vger.kernel.org
(am from https://patchwork.kernel.org/patch/9495175)
Change-Id: I7c9e331b5bf5f1fbcefd4368bc4b82ff180eb91e
Signed-off-by: Zheng Yang <zhengyang@rock-chips.com>

FROMLIST: drm/edid: Complete CEA modedb(VIC 1-107)

CEA-861-F specs defines new 4k video modes to be used with
HDMI 2.0 EDIDs. These modes start at VIC=93 and go all the
way till VIC=107.

Our existing CEA modedb contains only 64 modes (VIC=1 to VIC=64). Now
to be able to parse 4k modes using the existing techniques, we have
to complete the modedb (VIC=65 onwards).

This patch adds:
- Timings for existing CEA video modes (from VIC=65 till VIC=92)
- Newly added 4k modes (from VIC=93 to VIC=107).

Cc: Jose Abreu <Jose.Abreu@synopsys.com>
Cc: Alex Deucher <alexander.deucher@amd.com>
Cc: Andrzej Hajda <a.hajda@samsung.com>
V2: Addressed review comments from Jose:
- fix the timings for VIC 83, 90 and 91
- fix formatting for VIC 93-107

V3: Rebase on drm-tip

Signed-off-by: Shashank Sharma <shashank.sharma@intel.com>
Signed-off-by: Sonika Jindal <sonika.jindal@intel.com>
Reviewed-by: Jose Abreu <Jose.Abreu@synopsys.com>
Reviewed-by: Alex Deucher <alexander.deucher@amd.com>
(am from https://patchwork.kernel.org/patch/9543865/)
Change-Id: I3708db9a06a1d57c4714aed67fb7ef3711ea0d1e
Signed-off-by: Zheng Yang <zhengyang@rock-chips.com>

UPSTREAM: video: Add new aspect ratios for HDMI 2.0

HDMI 2.0/CEA-861-F introduces two new aspect ratios:
- 64:27
- 256:135

This patch adds enumeration for the new aspect ratios
in the existing aspect ratio list.

V2: rebase
V3: rebase
V4: Added r-b from Jose, Ack by Tomi

Signed-off-by: Shashank Sharma <shashank.sharma@intel.com>
Reviewed-by: Sean Paul <seanpaul@chromium.org>
Reviewed-by: Jose Abreu <Jose.Abreu@synopsys.com>
Acked-by: Tomi Valkeinen <tomi.valkeinen@ti.com>
Cc: Daniel Vetter <daniel.vetter@ffwll.ch>
Cc: Emil Velikov <emil.l.velikov@gmail.com>
Signed-off-by: Daniel Vetter <daniel.vetter@ffwll.ch>
Link: http://patchwork.freedesktop.org/patch/msgid/1476705880-15600-4-git-send-email-shashank.sharma@intel.com
Change-Id: Ia0f63835c5ab44482baaf08c6f498d30997814d5
(cherry picked from commit a6e78b3e1406575323b30b65890ee3c29930fb27)
Signed-off-by: Zheng Yang <zhengyang@rock-chips.com>

UPSTREAM: drm/edid: index CEA/HDMI mode tables using the VIC

Add a dummy entry to CEA/HDMI mode tables so they can be indexed
directly using the VIC, avoiding a +1/-1 dance here and there. This adds
clarity to the error checking for various functions that return the VIC
on success and zero on failure; we can now explicitly check for 0
instead of just subtracting one from an unsigned type.

Also add drm_valid_cea_vic() and drm_valid_hdmi_vic() helpers for
checking valid VICs.

v2: add drm_valid_cea_vic and drm_valid_hdmi_vic helpers (Ville)
    use { } instead of { 0 } for initializing the dummy modes

Cc: Ville Syrjälä <ville.syrjala@linux.intel.com>
Cc: Alex Deucher <alexander.deucher@amd.com>
Signed-off-by: Jani Nikula <jani.nikula@intel.com>
Reviewed-by: Ville Syrjälä <ville.syrjala@linux.intel.com>
Link: http://patchwork.freedesktop.org/patch/msgid/1452252111-6439-1-git-send-email-jani.nikula@intel.com
Signed-off-by: Daniel Vetter <daniel.vetter@ffwll.ch>
Change-Id: Id47deb7a806b896c047317ca8924ef73abb01095
(cherry picked from commit d9278b4c2c31603474eec19d9ea1dea6b3a81087)
Signed-off-by: Zheng Yang <zhengyang@rock-chips.com>

UPSTREAM: drm/edid: Make the detailed timing CEA/HDMI mode fixup accept up to 5kHz clock difference

Rather than using drm_match_cea_mode() to see if the EDID detailed
timings are supposed to represent one of the CEA/HDMI modes, add a
special version of that function that takes in an explicit clock
tolerance value (in kHz). When looking at the detailed timings specify
the tolerance as 5kHz due to the 10kHz clock resolution limit inherent
in detailed timings.

drm_match_cea_mode() uses the normal KHZ2PICOS() matching of clocks,
which only allows smaller errors for lower clocks (eg. for 25200 it
won't allow any error) and a bigger error for higher clocks (eg. for
297000 it actually matches 296913-297000). So it doesn't really match
what we want for the fixup. Using the explicit +-5kHz is much better
for this use case.

Not sure if we should change the normal mode matching to also use
something else besides KHZ2PICOS() since it allows a different
proportion of error depending on the clock. I believe VESA CVT
allows a maximum deviation of .5%, so using that for normal mode
matching might be a good idea?

Change-Id: I824ec50368ddf152c9daa747ba92aaba1ef50f4b
Cc: Adam Jackson <ajax@redhat.com>
Tested-by: nathan.d.ciobanu@linux.intel.com
Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=92217
Fixes: fa3a7340eaa1 ("drm/edid: Fix up clock for CEA/HDMI modes specified via detailed timings")
Signed-off-by: Ville Syrjälä <ville.syrjala@linux.intel.com>
Reviewed-by: Adam Jackson <ajax@redhat.com>
Signed-off-by: Daniel Vetter <daniel.vetter@ffwll.ch>
(cherry picked from commit 4c6bcf44549907cb50b67f98eb13717a4adc6b33)
Signed-off-by: Zheng Yang <zhengyang@rock-chips.com>

arm64: dts: rk3399: use hdmi-ddc for hdmi ddc bus in android

Change-Id: I8d90207d8899c09ed424d939a4a80d7f46b63163
Signed-off-by: Zheng Yang <zhengyang@rock-chips.com>

arm64: dts: rockchip: move more common nodes to rk3368-android

Also fix io_domains and pmu_io_domains on rk3368-tb.dtsi

Change-Id: I90867a839079f67c68b8588304e06f7566749a3d
Signed-off-by: Huang, Tao <huangtao@rock-chips.com>

regulator: rk818: fix of_regulator_match table boost id missing

Change-Id: I9703deb0cef7b6e721fb7e5f68ffbea5803bdc5a
Signed-off-by: chenjh <chenjh@rock-chips.com>

ARM: dts: rockchip: use hdmi-ddc for ddc bus in miniarm

Using the builtin I2C controller in dw_hdmi is better than using the
normal RK3288 I2C controller(I2C5).

TEST: work normally when switch mode between 4K@60hz|4K@30hz|1080P..
Change-Id: Ic7287f9a87f0d701a10cbb94f6ae9f11f981739c
Signed-off-by: Nickey Yang <nickey.yang@rock-chips.com>

drm: bridge/dw_hdmi: Add scdc operations for HDMI2.0

This patch do the following operation with scdc:

1、TMDS Configuration
   set TMDS_Bit_Clock_Ratio bit when supports TMDS Bit Rates
   above 3.4 Gbps
   (details see HDMI2.0 Specification Section 6.1.3.2)

2、Scrambling Control
   set Scrambling_Enable bit when it needs.
   (details see HDMI2.0 Specification Section 6.1.3.1)

Change-Id: Ibd4428bdf752d767caf9dd4e03f3c8d240f18f6b
Signed-off-by: Nickey Yang <nickey.yang@rock-chips.com>

FROMLIST: mmc: core: Fix access to HS400-ES devices

HS400-ES devices fail to initialize with the following error messages.

mmc1: power class selection to bus width 8 ddr 0 failed
mmc1: error -110 whilst initialising MMC card

This was seen on Samsung Chromebook Plus. Code analysis points to
commit 3d4ef329757c ("mmc: core: fix multi-bit bus width without
high-speed mode"), which attempts to set the bus width for all but
HS200 devices unconditionally. However, for HS400-ES, the bus width
is already selected.

Change-Id: I877b225a2ab9da623061288b2f908e956754107a
Cc: Anssi Hannula <anssi.hannula@bitwise.fi>
Cc: Douglas Anderson <dianders@chromium.org>
Cc: Brian Norris <briannorris@chromium.org>
Fixes: 3d4ef329757c ("mmc: core: fix multi-bit bus width ...")
Signed-off-by: Guenter Roeck <linux@roeck-us.net>
Reviewed-by: Douglas Anderson <dianders@chromium.org>
Reviewed-by: Shawn Lin <shawn.lin@rock-chip.com>
Signed-off-by: Shawn Lin <shawn.lin@rock-chips.com>

arm64: rockchip_defconfig: update by savedefconfig

Change-Id: I09275a9a494d9c7c13f800ddf0b5b30eb3c2e761
Signed-off-by: Huang, Tao <huangtao@rock-chips.com>

Merge branch 'linux-linaro-lsk-v4.4-android' of git://git.linaro.org/kernel/linux-linaro-stable.git

* linux-linaro-lsk-v4.4-android: (434 commits)
  Linux 4.4.52
  kvm: vmx: ensure VMCS is current while enabling PML
  Revert "usb: chipidea: imx: enable CI_HDRC_SET_NON_ZERO_TTHA"
  rtlwifi: rtl_usb: Fix for URB leaking when doing ifconfig up/down
  block: fix double-free in the failure path of cgwb_bdi_init()
  goldfish: Sanitize the broken interrupt handler
  x86/platform/goldfish: Prevent unconditional loading
  USB: serial: ark3116: fix register-accessor error handling
  USB: serial: opticon: fix CTS retrieval at open
  USB: serial: spcp8x5: fix modem-status handling
  USB: serial: ftdi_sio: fix line-status over-reporting
  USB: serial: ftdi_sio: fix extreme low-latency setting
  USB: serial: ftdi_sio: fix modem-status error handling
  USB: serial: cp210x: add new IDs for GE Bx50v3 boards
  USB: serial: mos7840: fix another NULL-deref at open
  tty: serial: msm: Fix module autoload
  net: socket: fix recvmmsg not returning error from sock_error
  ip: fix IP_CHECKSUM handling
  irda: Fix lockdep annotations in hashbin_delete().
  dccp: fix freeing skb too early for IPV6_RECVPKTINFO
  ...

Conflicts:
drivers/mmc/core/mmc.c
drivers/usb/dwc3/ep0.c
drivers/usb/host/xhci.h

Change-Id: Icf331a68162ab686d01996a3f43fa2e97543f62e

UPSTREAM: PCI: rockchip: Set vendor ID from local core config space

The TRM says the vendor ID in the RC's configure space can be rewritten
and the value must be the same as the value read from the local core
configure space.  But we misread that and didn't notice it before.  Actually
we should only able to rewrite it from the local core configure space.

Fix that issue to make lspci show the correct IP vendor infomation.

Change-Id: Ia33bc0c10970649cc86bd02136f0ee997f18246d
Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
Signed-off-by: Shawn Lin <shawn.lin@rock-chips.com>
(cherry picked from 5800790a925b0aefb621ae3da86668c3a2867750)

phy: rockchip-emmc: enable internal pull-down for strobe line

We enable it by default as we could see the usage of PCB layout
will not stuff this registor. For currently boards which soldered
it already, there should be no harmful.

Change-Id: I913d6412d9e4589ded5ca012e46fe3e93075cc0d
Signed-off-by: Shawn Lin <shawn.lin@rock-chips.com>
Signed-off-by: xiaoyao <xiaoyao@rock-chips.com>

arm64: dts: rockchip: add rk3368-android.dtsi

Move some Android only nodes to rk3368-android.dtsi

Change-Id: I6fe283d4c247479945fbc3396cc65392268a2731
Signed-off-by: Huang, Tao <huangtao@rock-chips.com>

drm: scdc: correct Makefile mistake

Change-Id: Ibf4e1de4c5f398366c991b6bea0cafdbdaf8ab48
Signed-off-by: Nickey Yang <nickey.yang@rock-chips.com>

arm64: dts: rockchip: reorder pinctrl of pwm nodes for rk3368

keep order as upstream.

Change-Id: I069ec407292922a72900c34b32c3d67f5cdf0a3b
Signed-off-by: Huang, Tao <huangtao@rock-chips.com>

UPSTREAM: arm64: dts: rockchip: add rk3368-r88 iodomains

Add the supply-links according to the R88 schematics.

Change-Id: Ia5119019d9d8b3d2d1990119f0947eaa0b901586
Signed-off-by: Heiko Stuebner <heiko@sntech.de>
Signed-off-by: Huang, Tao <huangtao@rock-chips.com>
(cherry picked from commit 39e5f7bb98c979f563e08e8e4cd70989e5369da3)

UPSTREAM: arm64: dts: rockchip: add rk3368 io-domain core nodes

Add the core io-domain nodes to grf and pmugrf which individual
boards than just have to enable and add the necessary supplies to.

Signed-off-by: Heiko Stuebner <heiko@sntech.de>
(cherry picked from commit d1ab05aba954ec02f087f6908d4e060655bde92c)

Change-Id: Ib70f0195544466b089866ac31eb9ea6fe73c5d59
Signed-off-by: Huang, Tao <huangtao@rock-chips.com>

UPSTREAM: arm64: dts: rockchip: make rk3368 grf syscons simple-mfds

The general register files do contain a lot of separate functions and
while some really are only registers with a lot of different 1-bit
settings, there are also a lot of them containing some bigger function
blocks. To be able to define these as sub-devices, make them simple-mfds.

Change-Id: I666e4fe9e6239a91ccaa70154883128be34f17c6
Signed-off-by: Heiko Stuebner <heiko@sntech.de>
Tested-by: David Wu <david.wu@rock-chips.com>
Signed-off-by: Huang, Tao <huangtao@rock-chips.com>
(cherry picked from commit 4cca3d9448bcc18b607dce2f962a614a415ddaae)

UPSTREAM: arm64: dts: rockchip: move the rk3368 thermal data into rk3368.dtsi

In order to be standard to manage for rockchip SoCs,  move the thermal
data into rk3368 dtsi, we needn't to add a new file for thermal.

Change-Id: I4cadb8742fb103f5642a8d122ebb5970eb140d30
Signed-off-by: Caesar Wang <wxt@rock-chips.com>
Cc: Zhang Rui <rui.zhang@intel.com>
Cc: Eduardo Valentin <edubezval@gmail.com>
Cc: Heiko Stuebner <heiko@sntech.de>
Signed-off-by: Heiko Stuebner <heiko@sntech.de>
(cherry picked from commit 6ddf93e05e67f81b6a95840c35e1aa6e042196a8)

UPSTREAM: Documentation: devicetree: rockchip: Document rk3368-GeekBox

Use "geekbuying,geekbox" compatible string.

Signed-off-by: Andreas Färber <afaerber@suse.de>
Acked-by: Rob Herring <robh@kernel.org>
Signed-off-by: Heiko Stuebner <heiko@sntech.de>
(cherry picked from commit 40ac568d0ef07b60ba8cc0f2e88ccdd4dd0e176a)

Change-Id: Ib73b858a68753f77fe60cf4afea51151590e4585
Signed-off-by: Huang, Tao <huangtao@rock-chips.com>

UPSTREAM: arm64: dts: rockchip: Add rk3368 GeekBox dts

The GeekBox contains an MXM3 module with a Rockchip RK3368 SoC.
Some connectors are available directly on the module.

This adds initial support, namely serial, USB, GMAC, eMMC, IR and TSADC.

Change-Id: Ic9956b3b935467e3492bdab274579d4cd038d4e6
Signed-off-by: Andreas Färber <afaerber@suse.de>
Signed-off-by: Heiko Stuebner <heiko@sntech.de>
Signed-off-by: Huang, Tao <huangtao@rock-chips.com>
(cherry picked from commit fd7b980c9e1e52d41589c41ae166b0cfae32b210)

UPSTREAM: arm64: dts: rockchip: Add rk3368 mailbox device nodes

This adds mailbox device nodes in dts.

Mailbox is used by the Rockchip CPU cores to communicate
requests to MCU processor.

Signed-off-by: Caesar Wang <wxt@rock-chips.com>
Signed-off-by: Heiko Stuebner <heiko@sntech.de>
(cherry picked from commit 6e7f9f5ad552327fcc1151e2dca141075f3e160a)

Change-Id: I9b93b2b3c28ca686c297d839077df5d725436f2f

UPSTREAM: arm64: dts: rockchip: fix the incorrect otp-out pin on rk3368

This patch fixes the incorrect Over-temperature protection pin.
since the rk3368 io list said the otp pin is gpio0a3.

Anyway, that should be fixed in here.

Change-Id: I0b868b6a2e1aac3eea21d6de4787b169a53ade5e
Signed-off-by: Caesar Wang <wxt@rock-chips.com>
Signed-off-by: Heiko Stuebner <heiko@sntech.de>
(cherry picked from commit 04317584ff1ad6977ba37acf38d2c6b841ce20a4)

UPSTREAM: arm64: dts: rockchip: add rk3368 tuning clk for emmc and sdmmc

Add tuning clk for emmc and sdmmc, otherwise I get
the following failure while enabling mmc-hs200-1_8v.

dwmmc_rockchip ff0f0000.dwmmc: Tuning clock (sample_clk) not defined.
mmc0: tuning execution failed
mmc0: error -5 whilst initialising MMC card

With it
dwmmc_rockchip ff0f0000.dwmmc: Successfully tuned phase to 170
mmc0: new HS200 MMC card at address 0001
mmcblk0: mmc0:0001 M8G1GC 7.28 GiB

Change-Id: I14534f43249edecbb8239f4a86c808ebb7f0a959
Signed-off-by: Shawn Lin <shawn.lin@rock-chips.com>
Signed-off-by: Heiko Stuebner <heiko@sntech.de>
(cherry picked from commit 90191625ec0d075ac0748181ae1b947b0b30297e)

UPSTREAM: dt-bindings: rockchip-dw-mshc: add RK3368 dw-mshc description

rk3368 dtsi file add dw-mshc compatible "rockchip,rk3368-dw-mshc"
but didn't add it into rockchip-dw-mshc.txt.

Signed-off-by: Shawn Lin <shawn.lin@rock-chips.com>
Acked-by: Rob Herring <robh@kernel.org>
Signed-off-by: Heiko Stuebner <heiko@sntech.de>
(cherry picked from commit b662f6d03aeeb20c0f795f469341778f4577a6bf)

Change-Id: I2e97ad3a8701ab2391e421248595092b9a22569d

UPSTREAM: arm64: dts: rockchip: Add the broadcast-timer for RK3368 SoC

There is a need of a broadcast timer in this case to ensure proper
wakeup when the cpus are in sleep mode and a timer expires.

Change-Id: I8ab0e5506420e2650acc1dac4d5667f40c0d3b4f
Signed-off-by: Caesar Wang <wxt@rock-chips.com>
Signed-off-by: Heiko Stuebner <heiko@sntech.de>
(cherry picked from commit b8084e5b34e83875846053bf9cd951b7640e40fe)

UPSTREAM: arm64: dts: rockchip: Fix typo in rk3368 sdmmc card detect pin name

The card detect pin is currently called sdmcc-cd.
This patch fixes the typo and renames the pin to sdmmc-cd.

Change-Id: I47ac2767ea442764bf71411ebd66de56e9c1e934
Signed-off-by: Matthias Brugger <mbrugger@suse.com>
Signed-off-by: Heiko Stuebner <heiko@sntech.de>
Signed-off-by: Huang, Tao <huangtao@rock-chips.com>
(cherry picked from commit 8fc5abd40efadf57ca43189c9c14c4de3db6300e)

UPSTREAM: arm64: dts: rockchip: correct voltage range for rk3368-evb-act8846 board

In general, the logic voltage is affected by ddr frequency factors.
We should fix the correct voltage range since assuemd that we have the
ddr frequency driver in mainline.

AFAIK, the 1.8v voltage is used by the SD3.0 card.

Change-Id: Id0ae87c7ec6d3d757fdde0b85caf1f535d200222
Signed-off-by: Caesar Wang <wxt@rock-chips.com>
Signed-off-by: Heiko Stuebner <heiko@sntech.de>
(cherry picked from commit 87ac9de3b44fd6dc8d95a59e67b086c3e57285f8)

UPSTREAM: arm64: dts: rockchip: add rk3368 evaluation board

This board is similar with the rk3288 evb board but the rk3368 top
board. There exist the act8846 as the pmic.

Moment, add the balight/thermal/emmc/usb.. stuff,
Let the board can happy work.

Signed-off-by: Caesar Wang <wxt@rock-chips.com>
Signed-off-by: Heiko Stuebner <heiko@sntech.de>
(cherry picked from commit 5378e28c9776fbab6065cfb54417acff3ea5f1fd)

Change-Id: I78f39fa080d221e06849285b6a0c52bc04d5d1a9

UPSTREAM: arm64: dts: rockchip: Add main thermal info to rk3368.dtsi

This patch add the thermal needed info on RK3368.
Meanwhile, support the trips to throttle for thermal.

Signed-off-by: Caesar Wang <wxt@rock-chips.com>
Acked-by: Eduardo Valentin <edubezval@gmail.com>
Signed-off-by: Heiko Stuebner <heiko@sntech.de>
(cherry picked from commit f990238f859e95841ecd151da258ea999555f609)

Change-Id: I76ba5230b1a334562ce7607aa02fec445612070c

UPSTREAM: arm64: dts: rockchip: Setup rk3368 ethernet0 alias for u-boot

Add an ethernet0 alias for the RK3368 mac interface so
that u-boot can find the device-node and fill in the mac address on
boards that support a wired network interface.

Change-Id: I2f82939290a0807ed84a3e93f6b0eef879cce076
Signed-off-by: Heiko Stuebner <heiko@sntech.de>
Signed-off-by: Huang, Tao <huangtao@rock-chips.com>
(cherry picked from commit ff08868ef0154cef01d3a50ae1f19dc968fc95f3)

drm: export drm_get_connector_name to fix compile problem

Fix compile error:
ERROR: "drm_get_connector_name" [drivers/gpu/drm/rockchip/rockchipdrm.ko] undefined!

Change-Id: If1ad322319bf4c20fa6b56be62024472a8272431
Signed-off-by: Mark Yao <mark.yao@rock-chips.com>

UPSTREAM: regulator: rk808: Use rdev_get_id() to access id of regulator

RK808_ID_DCDC1 is 0, no need to do subtract RK808_ID_DCDC1.

Change-Id: I395c30866aeb5c4c285dd083109a70bfef24bfca
Signed-off-by: Axel Lin <axel.lin@ingics.com>
Signed-off-by: Mark Brown <broonie@kernel.org>
(cherry picked from commit bf8e27621effb49da525fb92a1f192db685d39bd)
Signed-off-by: Elaine Zhang <zhangqing@rock-chips.com>

UPSTREAM: regulator: rk808: Add regulator driver for RK818

Add support for the rk818 regulator. The regulator module consists
of 4 DCDCs, 9 LDOs, 1 switch and 1 BOOST converter which is used to
power OTG and HDMI5V.

The output voltages are configurable and are meant to supply power
to the main processor and other components.

Change-Id: I129a1f22c65684615e9ae792efaa880555f0235e
Signed-off-by: Wadim Egorov <w.egorov@phytec.de>
Acked-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Lee Jones <lee.jones@linaro.org>
(cherry picked from commit 11375293530bb8434946c8c043f1adf5ffb6be10)
Signed-off-by: Elaine Zhang <zhangqing@rock-chips.com>

UPSTREAM: regulator: rk808: Delete owner assignment

The field "owner" is set by core. Thus delete an extra initialisation.

Generated by: scripts/coccinelle/api/platform_no_drv_owner.cocci
Signed-off-by: Markus Elfring <elfring@users.sourceforge.net>
Signed-off-by: Mark Brown <broonie@kernel.org>
Change-Id: I7a2e347e07943c7eb5b2c9cae4eae2358a613e0e
(cherry picked from commit 556ae220ac64b6564be8d76d855e26b65fcf75bf)
Signed-off-by: Elaine Zhang <zhangqing@rock-chips.com>

UPSTREAM: regulator: rk808: Migrate to regulator core's simplified DT parsing code

A common simplified DT parsing code for regulators was introduced in
commit a0c7b164ad11 ("regulator: of: Provide simplified DT parsing
method")

While at it also added RK8XX_DESC and RK8XX_DESC_SWITCH macros for the
regulator_desc struct initialization. This just makes the driver more compact.

Change-Id: I5c1211decf37d27a68167be9b6354834532cc87b
Signed-off-by: Wadim Egorov <w.egorov@phytec.de>
Acked-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Mark Brown <broonie@kernel.org>
(cherry picked from commit 9e9daa0a67d59df432664cdca1cf4659057fd00c)
Signed-off-by: Elaine Zhang <zhangqing@rock-chips.com>

UPSTREAM: regulator: rk808: Add rk808_reg_ops_ranges for LDO3

LDO_REG3 descriptor is using linear_ranges.
Add and use proper ops for LDO_REG3.

Change-Id: Iad515fd23e7b3bca6248739a54335a71eed01238
Signed-off-by: Wadim Egorov <w.egorov@phytec.de>
Signed-off-by: Mark Brown <broonie@kernel.org>
(cherry picked from commit 129d7cf98f5c739014ae5aa0311e48f6a64b0758)
Signed-off-by: Elaine Zhang <zhangqing@rock-chips.com>

UPSTREAM: regulator: rk808: remove unused rk808_reg_ops_ranges

After removing all uses of the range operations in a recent patch,
we get a warning about the symbol not being referenced anywhere:

drivers/regulator/rk808-regulator.c:306:29: 'rk808_reg_ops_ranges' defined but not used

This removes the now-unused structure along with the
rk808_set_suspend_voltage_range function that is only referenced from
rk808_reg_ops_ranges.

Fixes: afcd666d9db0 ("regulator: rk808: remove linear range definitions with a single range")
Change-Id: I565c91186ab5d7457a62b3bc4b4896a08f39dd2e
Signed-off-by: Arnd Bergmann <arnd@arndb.de>
Signed-off-by: Mark Brown <broonie@kernel.org>
(cherry picked from commit 4a5ed8c1adc39f86a2887183c71b007bc962fdce)
Signed-off-by: Elaine Zhang <zhangqing@rock-chips.com>

UPSTREAM: regulator: rk808: remove linear range definitions with a single range

The driver was using only linear ranges. Now we remove linear range
definitions with a single range. So we have to add an ops struct for
ranges and adjust all other ops functions accordingly.

Change-Id: I6b2dd5e035832f9460ec8a24b5214204f7a930b7
Signed-off-by: Wadim Egorov <w.egorov@phytec.de>
Signed-off-by: Mark Brown <broonie@kernel.org>
(cherry picked from commit afcd666d9db0ebfbf2751cce1e07b548547ca82e)
Signed-off-by: Elaine Zhang <zhangqing@rock-chips.com>

arm64: dts: rockchip: add dts file for rk3399-evb-rev3-android

Change-Id: I63306691f6b99243bec6289acda7abe303c70266
Signed-off-by: Huang, Tao <huangtao@rock-chips.com>

arm64: dts: rockchip: cleanup rk3399-android.dtsi

default enable rkvdec and vpu.
rga is default on, remove duplicate configuration.

Change-Id: I8375b2202a81977238e8120e1c2d60f2130844b5
Signed-off-by: Huang, Tao <huangtao@rock-chips.com>

drm/rockchip: dw_hdmi: add default 594Mhz clk for 4K@60hz

add 594Mhz configuration parameters in rockchip_phy_config

Change-Id: Iaa335cdd90059817fd9892877e574f8b84f2b5dc
Signed-off-by: Nickey Yang <nickey.yang@rock-chips.com>

drm/edid: Add 3840x2160@60hz modes

Add 3840x2160@60hz modes in edid_4k_modes[] array.

Change-Id: I6d14cecebb68ccfaf4e92109a44bde0eb132f73b
Signed-off-by: Nickey Yang <nickey.yang@rock-chips.com>

FROMLIST: drm: edid: HDMI 2.0 HF-VSDB block parsing

Adds parsing for HDMI 2.0 'HDMI Forum Vendor
Specific Data Block'. This block is present in
some HDMI 2.0 EDID's and gives information about
scrambling support, SCDC, 3D Views, and others.

Parsed parameters are stored in drm_connector
structure.
(am from: https://patchwork.kernel.org/patch/9273645)

Signed-off-by: Jose Abreu <joabreu@synopsys.com>
Change-Id: I5a1485b79a407fd27ac4754827de318175bb8f6a
Signed-off-by: Nickey Yang <nickey.yang@rock-chips.com>

FROMLIST: drm: Add SCDC helpers

SCDC is a mechanism defined in the HDMI 2.0 specification that allows
the source and sink devices to communicate.

This commit introduces helpers to access the SCDC and provides the
symbolic names for the various registers defined in the specification.

(am from: https://patchwork.kernel.org/patch/7258251/)

Change-Id: I378bc2b465a720ccfede35a93bce0d9371e78f78
Signed-off-by: Thierry Reding <treding@nvidia.com>
Signed-off-by: Nickey Yang <nickey.yang@rock-chips.com>

dt-bindings: rockchip: add missing vop document

Change-Id: Idd86084787216bc835d9e3e8cf4e9d04975da68c
Signed-off-by: Mark Yao <mark.yao@rock-chips.com>

ARM64: dts: rk3328: add vop display node

Change-Id: I60322993b782a6d04ca7e46fdc114a0fbc43778a
Signed-off-by: Mark Yao <mark.yao@rock-chips.com>

drm/rockchip: support rk3328 vop

Change-Id: Ic8c1073a22b62fc9a1b2e758429298538727c20e
Signed-off-by: Mark Yao <mark.yao@rock-chips.com>

drm/rockchip: vop: get rid of max_output_fb

max_output_fb is similar to max_display_output

Change-Id: I2045dd1ca5f7c99d723122d1b6c9dbf600db9c61
Signed-off-by: Mark Yao <mark.yao@rock-chips.com>

drm/rockchip: vop: improve and add more info to vop sysfs

cat /sys/kernel/debug/dri/0/summary:

VOP [ff900000.vop]: ACTIVE
    Connector: DSI
        bus_format[0] output_mode[0]
    Display mode: 1200x1920p60
        clk[159390] real_clk[159390] type[8] flag[a]
        H: 1200 1280 1281 1341
        V: 1920 1955 1956 1981
    win0-0: DISABLED
    win1-0: DISABLED
    win2-0: ACTIVE
        format: XB24 little-endian (0x34324258)
        zpos: 0
        src: pos[0x0] rect[1200x1920]
        dst: pos[0x0] rect[1200x1920]
        buf[0]: addr: 0x0000000002d3a000 pitch: 4800 offset: 0
    win2-0: DISABLED
    win2-1: DISABLED
    win2-2: DISABLED
    win3-0: DISABLED
    win3-0: DISABLED
    win3-1: DISABLED
    win3-2: DISABLED
VOP [ff8f0000.vop]: DISABLED

Change-Id: I7811b2411bd9d2d52059d15645de399b0de5a49b
Signed-off-by: Mark Yao <mark.yao@rock-chips.com>

drm: support drm_get_connector_name

Change-Id: I075d948afc2baa47fb147f9a967844a872171397
Signed-off-by: Mark Yao <mark.yao@rock-chips.com>

arm64: dts: rockchip: add cpu's power coefficient for rk3328

Change-Id: I33112b21b8f92482ba8e337d622e51948ec923a0
Signed-off-by: Rocky Hao <rocky.hao@rock-chips.com>

arm64: dts: rockchip: add tsadc and thermal basic config for rk3328

Change-Id: Ic0d417093c54fea5948fd79cab276ebe7aea0f2e
Signed-off-by: Rocky Hao <rocky.hao@rock-chips.com>

thermal: rockchip: add rk3328 support

Change-Id: I31f87741a874657fb7caf494ebafd53b6c0ef3b1
Signed-off-by: Rocky Hao <rocky.hao@rock-chips.com>

arm64: dts: rockchip: complete cpufreq config data for rk3328

Change-Id: I422ec388ab6d66e1ba669028d7b88525569e88d5
Signed-off-by: Rocky Hao <rocky.hao@rock-chips.com>

Merge branch 'linux-linaro-lsk-v4.4' into linux-linaro-lsk-v4.4-android

 Merge tag 'v4.4.52' into linux-linaro-lsk-v4.4

 This is the 4.4.52 stable release

Linux 4.4.52

kvm: vmx: ensure VMCS is current while enabling PML

commit 4e59516a12a6ef6dcb660cb3a3f70c64bd60cfec upstream.

Between loading the new VMCS and enabling PML, the CPU was unpinned.
If the vCPU thread were migrated to another CPU in the interim (e.g.,
due to preemption or sleeping alloc_page), then the VMWRITEs to enable
PML would target the wrong VMCS -- or no VMCS at all:

  [ 2087.266950] vmwrite error: reg 200e value 3fe1d52000 (err -506126336)
  [ 2087.267062] vmwrite error: reg 812 value 1ff (err 511)
  [ 2087.267125] vmwrite error: reg 401e value 12229c00 (err 304258048)

This patch ensures that the VMCS remains current while enabling PML by
doing the VMWRITEs while the CPU is pinned. Allocation of the PML buffer
is hoisted out of the critical section.

Signed-off-by: Peter Feiner <pfeiner@google.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
Cc: "Herongguang (Stephen)" <herongguang.he@huawei.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

Revert "usb: chipidea: imx: enable CI_HDRC_SET_NON_ZERO_TTHA"

commit 1bc7da87c7410c6990c3251589e3854e64c55af2 upstream.

This reverts commit e765bfb73ff7.

In the most of cases, we only use one transaction per frame and the
frame rate may be high, If the platforms want to support multiple
transactions but less frame rate cases like [1] and [2], it can set
"non-zero-ttctrl-ttha" at dts.

[1] http://www.spinics.net/lists/linux-usb/msg123125.html
[2] http://www.spinics.net/lists/linux-usb/msg118679.html

Signed-off-by: Peter Chen <peter.chen@nxp.com>
Cc: Martin Fuzzey <mfuzzey@parkeon.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

rtlwifi: rtl_usb: Fix for URB leaking when doing ifconfig up/down

commit 575ddce0507789bf9830d089557d2199d2f91865 upstream.

In the function rtl_usb_start we pre-allocate a certain number of urbs
for RX path but they will not be freed when calling rtl_usb_stop. This
results in leaking urbs when doing ifconfig up and down. Eventually,
the system has no available urbs.

Signed-off-by: Michael Schenk <michael.schenk@albis-elcon.com>
Signed-off-by: Larry Finger <Larry.Finger@lwfinger.net>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

block: fix double-free in the failure path of cgwb_bdi_init()

commit 5f478e4ea5c5560b4e40eb136991a09f9389f331 upstream.

When !CONFIG_CGROUP_WRITEBACK, bdi has single bdi_writeback_congested
at bdi->wb_congested.  cgwb_bdi_init() allocates it with kzalloc() and
doesn't do further initialization.  This usually works fine as the
reference count gets bumped to 1 by wb_init() and the put from
wb_exit() releases it.

However, when wb_init() fails, it puts the wb base ref automatically
freeing the wb and the explicit kfree() in cgwb_bdi_init() error path
ends up trying to free the same pointer the second time causing a
double-free.

Fix it by explicitly initilizing the refcnt to 1 and putting the base
ref from cgwb_bdi_destroy().

Signed-off-by: Tejun Heo <tj@kernel.org>
Reported-by: Dmitry Vyukov <dvyukov@google.com>
Fixes: a13f35e87140 ("writeback: don't embed root bdi_writeback_congested in bdi_writeback")
Signed-off-by: Jens Axboe <axboe@fb.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

goldfish: Sanitize the broken interrupt handler

commit 6cf18e6927c0b224f972e3042fb85770d63cb9f8 upstream.

This interrupt handler is broken in several ways:

  - It loops forever when the op code is not decodeable

  - It never returns IRQ_HANDLED because the only way to exit the loop
    returns IRQ_NONE unconditionally.

The whole concept of this is broken. Creating devices in an interrupt
handler is beyond any point of sanity.

Make it at least behave halfways sane so accidental users do not have to
deal with a hard to debug lockup.

Fixes: e809c22b8fb028 ("goldfish: add the goldfish virtual bus")
Reported-by: Gabriel C <nix.or.die@gmail.com>
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Acked-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

x86/platform/goldfish: Prevent unconditional loading

commit 47512cfd0d7a8bd6ab71d01cd89fca19eb2093eb upstream.

The goldfish platform code registers the platform device unconditionally
which causes havoc in several ways if the goldfish_pdev_bus driver is
enabled:

 - Access to the hardcoded physical memory region, which is either not
   available or contains stuff which is completely unrelated.

 - Prevents that the interrupt of the serial port can be requested

 - In case of a spurious interrupt it goes into a infinite loop in the
   interrupt handler of the pdev_bus driver (which needs to be fixed
   seperately).

Add a 'goldfish' command line option to make the registration opt-in when
the platform is compiled in.

I'm seriously grumpy about this engineering trainwreck, which has seven
SOBs from Intel developers for 50 lines of code. And none of them figured
out that this is broken. Impressive fail!

Fixes: ddd70cf93d78 ("goldfish: platform device for x86")
Reported-by: Gabriel C <nix.or.die@gmail.com>
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Acked-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

USB: serial: ark3116: fix register-accessor error handling

commit 9fef37d7cf170522fb354d6d0ea6de09b9b16678 upstream.

The current implementation failed to detect short transfers, something
which could lead to bits of the uninitialised heap transfer buffer
leaking to user space.

Fixes: 149fc791a452 ("USB: ark3116: Setup some basic infrastructure for new ark3116 driver.")
Fixes: f4c1e8d597d1 ("USB: ark3116: Make existing functions 16450-aware and add close and release functions.")
Reviewed-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Johan Hovold <johan@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

USB: serial: opticon: fix CTS retrieval at open

commit 2eee05020a0e7ee7c04422cbacdb07859e45dce6 upstream.

The opticon driver used a control request at open to trigger a CTS
status notification to be sent over the bulk-in pipe. When the driver
was converted to using the generic read implementation, an inverted test
prevented this request from being sent, something which could lead to
TIOCMGET reporting an incorrect CTS state.

Reported-by: Dan Carpenter <dan.carpenter@oracle.com>
Fixes: 7a6ee2b02751 ("USB: opticon: switch to generic read implementation")
Reviewed-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Johan Hovold <johan@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

USB: serial: spcp8x5: fix modem-status handling

commit 5ed8d41023751bdd3546f2fe4118304357efe8d2 upstream.

Make sure to detect short control transfers and return zero on success
when retrieving the modem status.

This fixes the TIOCMGET implementation which since e1ed212d8593 ("USB:
spcp8x5: add proper modem-status support") has returned TIOCM_LE on
successful retrieval, and avoids leaking bits from the stack on short
transfers.

This also fixes the carrier-detect implementation which since the above
mentioned commit unconditionally has returned true.

Fixes: e1ed212d8593 ("USB: spcp8x5: add proper modem-status support")
Reviewed-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Johan Hovold <johan@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

USB: serial: ftdi_sio: fix line-status over-reporting

commit a6bb1e17a39818b01b55d8e6238b4b5f06d55038 upstream.

FTDI devices use a receive latency timer to periodically empty the
receive buffer and report modem and line status (also when the buffer is
empty).

When a break or error condition is detected the corresponding status
flags will be set on a packet with nonzero data payload and the flags
are not updated until the break is over or further characters are
received.

In order to avoid over-reporting break and error conditions, these flags
must therefore only be processed for packets with payload.

This specifically fixes the case where after an overrun, the error
condition is continuously reported and NULL-characters inserted until
further data is received.

Reported-by: Michael Walle <michael@walle.cc>
Fixes: 72fda3ca6fc1 ("USB: serial: ftd_sio: implement sysrq handling on
break")
Fixes: 166ceb690750 ("USB: ftdi_sio: clean up line-status handling")
Signed-off-by: Johan Hovold <johan@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

USB: serial: ftdi_sio: fix extreme low-latency setting

commit c6dce2626606ef16434802989466636bc28c1419 upstream.

Since commit 557aaa7ffab6 ("ft232: support the ASYNC_LOW_LATENCY
flag") the FTDI driver has been using a receive latency-timer value of
1 ms instead of the device default of 16 ms.

The latency timer is used to periodically empty a non-full receive
buffer, but a status header is always sent when the timer expires
including when the buffer is empty. This means that a two-byte bulk
message is received every millisecond also for an otherwise idle port as
long as it is open.

Let's restore the pre-2009 behaviour which reduces the rate of the
status messages to 1/16th (e.g. interrupt frequency drops from 1 kHz to
62.5 Hz) by not setting ASYNC_LOW_LATENCY by default.

Anyone willing to pay the price for the minimum-latency behaviour should
set the flag explicitly instead using the TIOCSSERIAL ioctl or a tool
such as setserial (e.g. setserial /dev/ttyUSB0 low_latency).

Note that since commit 0cbd81a9f6ba ("USB: ftdi_sio: remove
tty->low_latency") the ASYNC_LOW_LATENCY flag has no other effects but
to set a minimal latency timer.

Reported-by: Antoine Aubert <a.aubert@overkiz.com>
Fixes: 557aaa7ffab6 ("ft232: support the ASYNC_LOW_LATENCY flag")
Signed-off-by: Johan Hovold <johan@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

USB: serial: ftdi_sio: fix modem-status error handling

commit 427c3a95e3e29e65f59d99aaf320d7506f3eed57 upstream.

Make sure to detect short responses when fetching the modem status in
order to avoid parsing uninitialised buffer data and having bits of it
leak to user space.

Note that we still allow for short 1-byte responses.

Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Reviewed-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Johan Hovold <johan@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

USB: serial: cp210x: add new IDs for GE Bx50v3 boards

commit 9a593656def0dc2f6c227851e8e602077267a5f1 upstream.

Add new USB IDs for cp2104/5 devices on Bx50v3 boards due to the design
change.

Signed-off-by: Ken Lin <yungching0725@gmail.com>
Signed-off-by: Johan Hovold <johan@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

USB: serial: mos7840: fix another NULL-deref at open

commit 5182c2cf2a9bfb7f066ef0bdd2bb6330b94dd74e upstream.

Fix another NULL-pointer dereference at open should a malicious device
lack an interrupt-in endpoint.

Note that the driver has a broken check for an interrupt-in endpoint
which means that an interrupt URB has never even been submitted.

Fixes: 3f5429746d91 ("USB: Moschip 7840 USB-Serial Driver")
Reviewed-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Johan Hovold <johan@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

tty: serial: msm: Fix module autoload

commit abe81f3b8ed2996e1712d26d38ff6b73f582c616 upstream.

If the driver is built as a module, autoload won't work because the module
alias information is not filled. So user-space can't match the registered
device with the corresponding module.

Export the module alias information using the MODULE_DEVICE_TABLE() macro.

Before this patch:

$ modinfo drivers/tty/serial/msm_serial.ko | grep alias
$

After this patch:

$ modinfo drivers/tty/serial/msm_serial.ko | grep alias
alias:          of:N*T*Cqcom,msm-uartdmC*
alias:          of:N*T*Cqcom,msm-uartdm
alias:          of:N*T*Cqcom,msm-uartC*
alias:          of:N*T*Cqcom,msm-uart

Signed-off-by: Javier Martinez Canillas <javier@osg.samsung.com>
Acked-by: Bjorn Andersson <bjorn.andersson@linaro.org>
Cc: stable <stable@vger.kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

net: socket: fix recvmmsg not returning error from sock_error

[ Upstream commit e623a9e9dec29ae811d11f83d0074ba254aba374 ]

Commit 34b88a68f26a ("net: Fix use after free in the recvmmsg exit path"),
changed the exit path of recvmmsg to always return the datagrams
variable and modified the error paths to set the variable to the error
code returned by recvmsg if necessary.

However in the case sock_error returned an error, the error code was
then ignored, and recvmmsg returned 0.

Change the error path of recvmmsg to correctly return the error code
of sock_error.

The bug was triggered by using recvmmsg on a CAN interface which was
not up. Linux 4.6 and later return 0 in this case while earlier
releases returned -ENETDOWN.

Fixes: 34b88a68f26a ("net: Fix use after free in the recvmmsg exit path")
Signed-off-by: Maxime Jayat <maxime.jayat@mobile-devices.fr>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

ip: fix IP_CHECKSUM handling

[ Upstream commit ca4ef4574f1ee5252e2cd365f8f5d5bafd048f32 ]

The skbs processed by ip_cmsg_recv() are not guaranteed to
be linear e.g. when sending UDP packets over loopback with
MSGMORE.
Using csum_partial() on [potentially] the whole skb len
is dangerous; instead be on the safe side and use skb_checksum().

Thanks to syzkaller team to detect the issue and provide the
reproducer.

v1 -> v2:
 - move the variable declaration in a tighter scope

Fixes: ad6f939ab193 ("ip: Add offset parameter to ip_cmsg_recv")
Reported-by: Andrey Konovalov <andreyknvl@google.com>
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
Acked-by: Eric Dumazet <edumazet@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

irda: Fix lockdep annotations in hashbin_delete().

[ Upstream commit 4c03b862b12f980456f9de92db6d508a4999b788 ]

A nested lock depth was added to the hasbin_delete() code but it
doesn't actually work some well and results in tons of lockdep splats.

Fix the code instead to properly drop the lock around the operation
and just keep peeking the head of the hashbin queue.

Reported-by: Dmitry Vyukov <dvyukov@google.com>
Tested-by: Dmitry Vyukov <dvyukov@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

dccp: fix freeing skb too early for IPV6_RECVPKTINFO

[ Upstream commit 5edabca9d4cff7f1f2b68f0bac55ef99d9798ba4 ]

In the current DCCP implementation an skb for a DCCP_PKT_REQUEST packet
is forcibly freed via __kfree_skb in dccp_rcv_state_process if
dccp_v6_conn_request successfully returns.

However, if IPV6_RECVPKTINFO is set on a socket, the address of the skb
is saved to ireq->pktopts and the ref count for skb is incremented in
dccp_v6_conn_request, so skb is still in use. Nevertheless, it gets freed
in dccp_rcv_state_process.

Fix by calling consume_skb instead of doing goto discard and therefore
calling __kfree_skb.

Similar fixes for TCP:

fb7e2399ec17f1004c0e0ccfd17439f8759ede01 [TCP]: skb is unexpectedly freed.
0aea76d35c9651d55bbaf746e7914e5f9ae5a25d tcp: SYN packets are now
simply consumed

Signed-off-by: Andrey Konovalov <andreyknvl@google.com>
Acked-by: Eric Dumazet <edumazet@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

packet: Do not call fanout_release from atomic contexts

[ Upstream commit 2bd624b4611ffee36422782d16e1c944d1351e98 ]

Commit 6664498280cf ("packet: call fanout_release, while UNREGISTERING a
netdev"), unfortunately, introduced the following issues.

1. calling mutex_lock(&fanout_mutex) (fanout_release()) from inside
rcu_read-side critical section. rcu_read_lock disables preemption, most often,
which prohibits calling sleeping functions.

[  ] include/linux/rcupdate.h:560 Illegal context switch in RCU read-side critical section!
[  ]
[  ] rcu_scheduler_active = 1, debug_locks = 0
[  ] 4 locks held by ovs-vswitchd/1969:
[  ]  #0:  (cb_lock){++++++}, at: [<ffffffff8158a6c9>] genl_rcv+0x19/0x40
[  ]  #1:  (ovs_mutex){+.+.+.}, at: [<ffffffffa04878ca>] ovs_vport_cmd_del+0x4a/0x100 [openvswitch]
[  ]  #2:  (rtnl_mutex){+.+.+.}, at: [<ffffffff81564157>] rtnl_lock+0x17/0x20
[  ]  #3:  (rcu_read_lock){......}, at: [<ffffffff81614165>] packet_notifier+0x5/0x3f0
[  ]
[  ] Call Trace:
[  ]  [<ffffffff813770c1>] dump_stack+0x85/0xc4
[  ]  [<ffffffff810c9077>] lockdep_rcu_suspicious+0x107/0x110
[  ]  [<ffffffff810a2da7>] ___might_sleep+0x57/0x210
[  ]  [<ffffffff810a2fd0>] __might_sleep+0x70/0x90
[  ]  [<ffffffff8162e80c>] mutex_lock_nested+0x3c/0x3a0
[  ]  [<ffffffff810de93f>] ? vprintk_default+0x1f/0x30
[  ]  [<ffffffff81186e88>] ? printk+0x4d/0x4f
[  ]  [<ffffffff816106dd>] fanout_release+0x1d/0xe0
[  ]  [<ffffffff81614459>] packet_notifier+0x2f9/0x3f0

2. calling mutex_lock(&fanout_mutex) inside spin_lock(&po->bind_lock).
"sleeping function called from invalid context"

[  ] BUG: sleeping function called from invalid context at kernel/locking/mutex.c:620
[  ] in_atomic(): 1, irqs_disabled(): 0, pid: 1969, name: ovs-vswitchd
[  ] INFO: lockdep is turned off.
[  ] Call Trace:
[  ]  [<ffffffff813770c1>] dump_stack+0x85/0xc4
[  ]  [<ffffffff810a2f52>] ___might_sleep+0x202/0x210
[  ]  [<ffffffff810a2fd0>] __might_sleep+0x70/0x90
[  ]  [<ffffffff8162e80c>] mutex_lock_nested+0x3c/0x3a0
[  ]  [<ffffffff816106dd>] fanout_release+0x1d/0xe0
[  ]  [<ffffffff81614459>] packet_notifier+0x2f9/0x3f0

3. calling dev_remove_pack(&fanout->prot_hook), from inside
spin_lock(&po->bind_lock) or rcu_read-side critical-section. dev_remove_pack()
-> synchronize_net(), which might sleep.

[  ] BUG: scheduling while atomic: ovs-vswitchd/1969/0x00000002
[  ] INFO: lockdep is turned off.
[  ] Call Trace:
[  ]  [<ffffffff813770c1>] dump_stack+0x85/0xc4
[  ]  [<ffffffff81186274>] __schedule_bug+0x64/0x73
[  ]  [<ffffffff8162b8cb>] __schedule+0x6b/0xd10
[  ]  [<ffffffff8162c5db>] schedule+0x6b/0x80
[  ]  [<ffffffff81630b1d>] schedule_timeout+0x38d/0x410
[  ]  [<ffffffff810ea3fd>] synchronize_sched_expedited+0x53d/0x810
[  ]  [<ffffffff810ea6de>] synchronize_rcu_expedited+0xe/0x10
[  ]  [<ffffffff8154eab5>] synchronize_net+0x35/0x50
[  ]  [<ffffffff8154eae3>] dev_remove_pack+0x13/0x20
[  ]  [<ffffffff8161077e>] fanout_release+0xbe/0xe0
[  ]  [<ffffffff81614459>] packet_notifier+0x2f9/0x3f0

4. fanout_release() races with calls from different CPU.

To fix the above problems, remove the call to fanout_release() under
rcu_read_lock(). Instead, call __dev_remove_pack(&fanout->prot_hook) and
netdev_run_todo will be happy that &dev->ptype_specific list is empty. In order
to achieve this, I moved dev_{add,remove}_pack() out of fanout_{add,release} to
__fanout_{link,unlink}. So, call to {,__}unregister_prot_hook() will make sure
fanout->prot_hook is removed as well.

Fixes: 6664498280cf ("packet: call fanout_release, while UNREGISTERING a netdev")
Reported-by: Eric Dumazet <edumazet@google.com>
Signed-off-by: Anoob Soman <anoob.soman@citrix.com>
Acked-by: Eric Dumazet <edumazet@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

packet: fix races in fanout_add()

[ Upstream commit d199fab63c11998a602205f7ee7ff7c05c97164b ]

Multiple threads can call fanout_add() at the same time.

We need to grab fanout_mutex earlier to avoid races that could
lead to one thread freeing po->rollover that was set by another thread.

Do the same in fanout_release(), for peace of mind, and to help us
finding lockdep issues earlier.

Fixes: dc99f600698d ("packet: Add fanout support.")
Fixes: 0648ab70afe6 ("packet: rollover prepare: per-socket state")
Signed-off-by: Eric Dumazet <edumazet@google.com>
Cc: Willem de Bruijn <willemb@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

net/llc: avoid BUG_ON() in skb_orphan()

[ Upstream commit 8b74d439e1697110c5e5c600643e823eb1dd0762 ]

It seems nobody used LLC since linux-3.12.

Fortunately fuzzers like syzkaller still know how to run this code,
otherwise it would be no fun.

Setting skb->sk without skb->destructor leads to all kinds of
bugs, we now prefer to be very strict about it.

Ideally here we would use skb_set_owner() but this helper does not exist yet,
only CAN seems to have a private helper for that.

Fixes: 376c7311bdb6 ("net: add a temporary sanity check in skb_orphan()")
Signed-off-by: Eric Dumazet <edumazet@google.com>
Reported-by: Andrey Konovalov <andreyknvl@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

blk-mq: really fix plug list flushing for nomerge queues

commit 87c279e613f848c691111b29d49de8df3f4f56da upstream.

Commit 0809e3ac6231 ("block: fix plug list flushing for nomerge queues")
updated blk_mq_make_request() to set request_count even when
blk_queue_nomerges() returns true. However, blk_mq_make_request() only
does limited plugging and doesn't use request_count;
blk_sq_make_request() is the one that should have been fixed. Do that
and get rid of the unnecessary work in the mq version.

Fixes: 0809e3ac6231 ("block: fix plug list flushing for nomerge queues")
Signed-off-by: Omar Sandoval <osandov@fb.com>
Reviewed-by: Ming Lei <tom.leiming@gmail.com>
Reviewed-by: Jeff Moyer <jmoyer@redhat.com>
Signed-off-by: Jens Axboe <axboe@fb.com>
Cc: Sumit Semwal <sumit.semwal@linaro.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

rtc: interface: ignore expired timers when enqueuing new timers

commit 2b2f5ff00f63847d95adad6289bd8b05f5983dd5 upstream.

This patch fixes a RTC wakealarm issue, namely, the event fires during
hibernate and is not cleared from the list, causing hwclock to block.

The current enqueuing does not trigger an alarm if any expired timers
already exist on the timerqueue. This can occur when a RTC wake alarm
is used to wake a machine out of hibernate and the resumed state has
old expired timers that have not been removed from the timer queue.
This fix skips over any expired timers and triggers an alarm if there
are no pending timers on the timerqueue. Note that the skipped expired
timer will get reaped later on, so there is no need to clean it up
immediately.

The issue can be reproduced by putting a machine into hibernate and
waking it with the RTC wakealarm.  Running the example RTC test program
from tools/testing/selftests/timers/rtctest.c after the hibernate will
block indefinitely.  With the fix, it no longer blocks after the
hibernate resume.

BugLink: http://bugs.launchpad.net/bugs/1333569
Signed-off-by: Colin Ian King <colin.king@canonical.com>
Signed-off-by: Alexandre Belloni <alexandre.belloni@free-electrons.com>
Cc: Sumit Semwal <sumit.semwal@linaro.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

rtlwifi: rtl_usb: Fix missing entry in USB driver's private data

commit 60f59ce0278557f7896d5158ae6d12a4855a72cc upstream.

These drivers need to be able to reference "struct ieee80211_hw" from
the driver's private data, and vice versa. The USB driver failed to
store the address of ieee80211_hw in the private data. Although this
bug has been present for a long time, it was not exposed until
commit ba9f93f82aba ("rtlwifi: Fix enter/exit power_save").

Fixes: ba9f93f82aba ("rtlwifi: Fix enter/exit power_save")
Signed-off-by: Larry Finger <Larry.Finger@lwfinger.net>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
Cc: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

drm/rockchip: dw_hdmi: use crtc_clock as vpll clock rate

adjusted_mode.crtc_clock is the real pixel clock rate.

Change-Id: Iac242b89e3144bc53c40170c2cec0c0913ef6ee0
Signed-off-by: Zheng Yang <zhengyang@rock-chips.com>

drm: bridge/dw_hdmi: support DRM_MODE_FLAG_DBLCLK

Change-Id: I66d9456d6bde38fcf17d5cd5f6394517e4308a68
Signed-off-by: Zheng Yang <zhengyang@rock-chips.com>

drm/rockchip: vop: support DRM_MODE_FLAG_DBLCLK

Change-Id: I604e6ba32a2ac3a6569d341d23f9a3368f921120
Signed-off-by: Mark Yao <mark.yao@rock-chips.com>

mfd: rk805: fix submodules node available match error

include: rtc, gpio, pwrkey

Change-Id: I3c91e2ade911017125c80008c122f4bf484767f3
Signed-off-by: chenjh <chenjh@rock-chips.com>

Merge branch 'linux-linaro-lsk-v4.4' into linux-linaro-lsk-v4.4-android

 Merge tag 'v4.4.51' into linux-linaro-lsk-v4.4

 This is the 4.4.51 stable release

arm64: dts: rockchip: Add RK3399 Excavator box dts for drm

Change-Id: Ie3c9cadb3cfbd9d4080ff54c0b65933f347e093a
Signed-off-by: Zhangbin Tong <zebulun.tong@rock-chips.com>

arm64: dts: rockchip: clk: rk3399: support dual pll for drm linux

Change-Id: Ifb38159915939731c3cfc83c7e71000281997cf3
Signed-off-by: Mark Yao <mark.yao@rock-chips.com>

drm: print framebuffer size when plane check fail

Change-Id: Id51f25e407953cf123444cf961da8a0f8f5745e8
Signed-off-by: Mark Yao <mark.yao@rock-chips.com>

Linux 4.4.51

mmc: core: fix multi-bit bus width without high-speed mode

commit 3d4ef329757cfd5e0b23cce97cdeca7e2df89c99 upstream.

Commit 577fb13199b1 ("mmc: rework selection of bus speed mode")
refactored bus width selection code to mmc_select_bus_width().

However, it also altered the behavior to not call the selection code in
non-high-speed modes anymore.

This causes 1-bit mode to always be used when the high-speed mode is not
enabled, even though 4-bit and 8-bit bus are valid bus widths in the
backwards-compatibility (legacy) mode as well (see e.g. 5.3.2 Bus Speed
Modes in JEDEC 84-B50). This results in a significant regression in
transfer speeds.

Fix the code to allow 4-bit and 8-bit widths even without high-speed
mode, as before.

Tested with a Zynq-7000 PicoZed 7020 board.

Fixes: 577fb13199b1 ("mmc: rework selection of bus speed mode")
Signed-off-by: Anssi Hannula <anssi.hannula@bitwise.fi>
Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
[anssi.hannula@bitwise.fi: backported for the different err variable
 check on v4.4 and tested]
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

bcache: Make gc wakeup sane, remove set_task_state()

commit be628be09563f8f6e81929efbd7cf3f45c344416 upstream.

Signed-off-by: Kent Overstreet <kent.overstreet@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>