rk3288: dts: support popmetal opensource board

Change-Id: I42fd55bfa73d25643a9e0435af93e311d3ed3206
Signed-off-by: Mark Yao <mark.yao@rock-chips.com>

lcd: vga: add some vga timing

Change-Id: I6e54d0025b4622cdfcc3a4ceac443e441c7e1742
Signed-off-by: Mark Yao <mark.yao@rock-chips.com>

video: rockchip: lcdc: 312x: output color according to input screen parameter

Change-Id: I3d9b8982a247462ee3a6a0e00636881d35be9b4b
Signed-off-by: Zheng Yang <zhengyang@rock-chips.com>

rk3x: i2c: prevent i2c xfer, when i2c shut down.

if rk818 driver's shutdown func called, it should not do i2c transfer.
And rk818's shutdown func is behind of i2c driver's shutdown func.

Change-Id: Iec96ad4640894f604493d8c764a2f98e75397885
Signed-off-by: David Wu <wdc@rock-chips.com>

rk3228: lcdc: default build-in rk3228 vop

Change-Id: Ia0d9ac5000122d8f782b4eebb21af3f427119978
Signed-off-by: Mark Yao <mark.yao@rock-chips.com>

rk3228-fpga: dts: add series nodes for display

rk_fb display need ion and backlight node,
so add ion and backlight node.

Change-Id: I89ed88e429a2ea56e19bc12bc818ffba71f9e3b2
Signed-off-by: Mark Yao <mark.yao@rock-chips.com>

Documentation: add rockchip,rk3228-lcdc to rockchip_lcdc.txt

Change-Id: I0c81e8d340fd3d714dc1e85e0198bdee7dfd5bd6
Signed-off-by: Mark Yao <mark.yao@rock-chips.com>

rk_fb: video: add rk3228 vop support

Change-Id: Iaa8ea3da4de2746c4cff5e0e820b8f0508c44d55
Signed-off-by: Mark Yao <mark.yao@rock-chips.com>

rk_fb: add output colorspace define

Change-Id: I2507bd1b17e782501fd7b4cb4f67d5ddbb45da90
Signed-off-by: Mark Yao <mark.yao@rock-chips.com>

rk_fb: add bt2020/bt709/bt601 colorspace support

Change-Id: I55177d4e40bb8111787efe654f18e3e21c016491
Signed-off-by: Mark Yao <mark.yao@rock-chips.com>

power_supply: cw2015_battery: Add msleep(200) when recover from sleep mode

Change-Id: I66f0ee349622f24646376822948d331922676ad3
Signed-off-by: Zhangbin Tong <zebulun.tong@rock-chips.com>

dtsi: lcd-F402: CABC lut need the last 128 gray

Change-Id: Iff405b5f377826b6f6369f511b49689155f5acff
Signed-off-by: Huang Jiachai <hjc@rock-chips.com>
(cherry picked from commit c7d371ea3c2485a6b52b3bab51d1f6da5533f229)

video: rockchip: lcdc: 3288: update CABC lut addr

Change-Id: Ifcd0e7c76962fff628c2c372057937809ee850da
Signed-off-by: Huang Jiachai <hjc@rock-chips.com>
(cherry picked from commit 92e3d58d7ffc7d0687e032409de56b93f2e30d51)

power-supply: cw2015_battery: fix incorrect bracketing on a test

Change-Id: Id4910e148852ab64d9396b17d3daf403d1fcb4b2
Signed-off-by: Zhangbin Tong <zebulun.tong@rock-chips.com>

Merge tag 'lsk-v3.10-15.09-android'

LSK Android 15.09 v3.10

power_supply: cw2015_battery: code style fixes

Change-Id: I3cf0af574e11b7fd32adaaecbd6dbe83e72c83c9
Signed-off-by: Zhangbin Tong <zebulun.tong@rock-chips.com>

IEP: add capabilities query interface

add capabilities query interface for userspace to query
iep device feature in current soc.

Change-Id: I377e686b2ce0357aa75445e4e47e9e4883a077ae
Signed-off-by: alpha.lin <alpha.lin@rock-chips.com>

rk_fb: rename yuv444 10bit

HAL_PIXEL_FORMAT_YCrCb_420_SP_10 means yuv444 10bit format, but its
name looks like yuv 420sp 10bit, that is wrong.

Change-Id: I71db8577df6e3d912427ddafe057905870622ab2
Signed-off-by: Mark Yao <mark.yao@rock-chips.com>

IEP: re-caculate the uv address when 4k video input in iommu enable case.

In above case, old code will generate a fault address for
uv address if 4k video input or output.

Change-Id: I22e9793fbaa2da250097ba69a3fd4fdf58585b78
Signed-off-by: Alpha Lin <alpha.lin@rock-chips.com>

VPU: Support both syscon and virtual address while access to grf resource.

If CONFIG_MFD_SYSCON macro define but no grf resource
define in dts will cause a error before this revision.

Change-Id: I70432530fba9c7a5d0b8f5a0c996d67237eb8198
Signed-off-by: alpha.lin <alpha.lin@rock-chips.com>

video: rockchip: lcdc: 3288: update for VOP YUV420 to HDMI

Change-Id: I3dbe2208e10318acf99b66e858d853c3d4efab04
Signed-off-by: Huang Jiachai <hjc@rock-chips.com>

video: rockchip: lcdc: 3288: delele some special config for vop full v1.0

Change-Id: Iec4db13e5cde5567d9c9a96f3e063ceb3656b256
Signed-off-by: Huang Jiachai <hjc@rock-chips.com>

video: rockchip: lcdc: 3288: update CABC config

Change-Id: I88dd84335943580cf81850cffe530ba73190fa7e
Signed-off-by: Huang Jiachai <hjc@rock-chips.com>

usb: gadget: accessory: add compatibility ioctl

Change-Id: I301c1f2f17c906d0a3912248fa16bc20b4a32b3c
Signed-off-by: Wu Liang feng <wulf@rock-chips.com>

video: rockchip: hdmi: 3288/3368: set ddc clock to 50KHz.

Change-Id: I00ba32eb9115fe63606b6ccb441ca3b7e3378880
Signed-off-by: Zheng Yang <zhengyang@rock-chips.com>

dtsi: lcd-F402: update cabc gamma lut

Change-Id: I799d6f607b953912755a4a6517b89a0bd659e6cc
Signed-off-by: Huang Jiachai <hjc@rock-chips.com>

video: rockchip: fb: vop driver struct select depend on lcdc id from extent screen

Change-Id: Ied1a53b86ee2e524707a017ba65cd5e648e93bae
Signed-off-by: Huang Jiachai <hjc@rock-chips.com>

video: rockchip: fbsys: add node to display a picture

    1. su & stop;
    2. copy the picture bin to /data/fb0.bin;
    3. echo "n xsize ysize format" > /sys/class/graphics/fb0/dsp_buf;

    ps:
a. n is the number of picture
b. xsize and ysize is the picture resolution
c. format:
     RGBA=1,RGBX=2,RGB=3,YUV420_SP=17

Change-Id: Id256bee73958b6ab6250a17a723b0b73e7197874
Signed-off-by: Huang Jiachai <hjc@rock-chips.com>

rk3228: add dts file for sdk

Change-Id: I628f67408e84974d88645363140f77b887143658
Signed-off-by: Chen Liang <cl@rock-chips.com>

rk3368.dtsi: fiq debug baud rate comment, change 115000 to 115200

Change-Id: I55fe0e8f5cae2d5aa16952e9612331ecc928335d
Signed-off-by: Huibin Hong <huibin.hong@rock-chips.com>

rk3228: initialize platform data

Change-Id: Id7fd0d98ef70641a62bd8520b72214141b5cf199
Signed-off-by: Chen Liang <cl@rock-chips.com>

video: rockchip: lcdc: 3288: add support yuv420 output

Change-Id: Id1cdc222774b37594eec3ed15633f9c138e6e9b1
Signed-off-by: Huang Jiachai <hjc@rock-chips.com>

fiq debugger: driver update

1. Change fiq debugger trigger mode, enter “fiq” instead of
F5 with SecureCRT

Change-Id: I3b52ad435af3211675a8416c6e016147886def8d
Signed-off-by: Huibin Hong <huibin.hong@rock-chips.com>

video: rockchip: fb: recalculate logo offset to match new screen size

Change-Id: I9f62088f4d0868a9284d1794718da8f5a044f24a
Signed-off-by: Zheng Yang <zhengyang@rock-chips.com>

video: rockchip: lcdc: 3288/3368: read screen regs in uboot mode

Change-Id: I36db50471140d041fd0220283bc4e6ce59ec9d74
Signed-off-by: Zheng Yang <zhengyang@rock-chips.com>

rk3368 ddr: add configure ddr timing function

1.add the function of configure ddr timing such us sr_idle, pd_idle, odt
disable frequency, dll bypass frequency, odt strength, driver strength in dts.
2.make sure commit 8be554a50237051e45e ("rk3368 dts: add ddr timing node in
rk3368.dtsi" add ddr timing node in dts that user can configure ddr timing in
dts file.) was merged.
3.bl30 must update to rk3368bl30_v2.11.bin.

Change-Id: Ie8ae559c8128eb01788271a4333c465e21954ab1
Signed-off-by: Tang Yun ping <typ@rock-chips.com>

dvfs: rockchip: modify the pvtm_info of RK3368_v0

Change-Id: If3216b4d8d220411e0c54a657357187315a5d4b5
Signed-off-by: Xiao Feng <xf@rock-chips.com>

pmic: rk808: slove set voltage error

rk808 setting voltage had a overshoot question
so we set voltage must step by step.
support 12.5mv/step.

Change-Id: Idfce7b57d6717e51afaff2c170eff7bd16de23af
Signed-off-by: zhangqing <zhangqing@rock-chips.com>

ARM: dts: fix some code style issues

Change-Id: I3f1f5637729171079ca7d108ba59521018c9561d
Signed-off-by: Chris Zhong <zyw@rock-chips.com>

video: rockchip: hdmi: 3368: support vesa dmt mode

Change-Id: Ic2a910cd50beb9b49baff7bd732f6c1bdd78790f
Signed-off-by: Zheng Yang <zhengyang@rock-chips.com>

video: rockchip: hdmi: 3288/3368: phy pll support more vesa dmt clock

Change-Id: I7382e5554664f2014bb5aa579a2524bf1738d971
Signed-off-by: Zheng Yang <zhengyang@rock-chips.com>

video: rockchip: hdmi: support some vesa dmt mode

Change-Id: I28e935c717ae69fb2b48a7c243f8ce3cc7101a86
Signed-off-by: Zheng Yang <zhengyang@rock-chips.com>

ARM: dts: add a alias for rockchip_suspend

Since we need overwrite this rockchip_suspend node in sub dts file,
sometimes. Add a alias for before it.

Change-Id: I6d951d1c0bfff1cde619906eb9f11256d057a9fe
Signed-off-by: Chris Zhong <zyw@rock-chips.com>

media: camsys_soc_priv: use cpu_is_rk3288 instead of soc_is_rk3288

Change-Id: If54087f71e0b6c923a11a6a37a4420ba86211070
Signed-off-by: Huang, Tao <huangtao@rock-chips.com>

video: fbdev: Add additional vesa modes

Change-Id: I485601d679687db9a655f06b48929e66883bdadd
Signed-off-by: Zheng Yang <zhengyang@rock-chips.com>

Merge branch 'linux-linaro-lsk-v3.10' into linux-linaro-lsk-v3.10-android

Merge tag 'v3.10.88' of git://git./linux/kernel/git/stable/linux-stable into linux-linaro-lsk-v3.10

This is the 3.10.88 stable release

* tag 'v3.10.88' of git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable: (48 commits)
  Linux 3.10.88
  arm64/mm: Remove hack in mmap randomize layout
  crypto: caam - fix memory corruption in ahash_final_ctx
  libfc: Fix fc_fcp_cleanup_each_cmd()
  drm/radeon: add new OLAND pci id
  EDAC, ppc4xx: Access mci->csrows array elements properly
  localmodconfig: Use Kbuild files too
  dm thin metadata: delete btrees when releasing metadata snapshot
  perf: Fix fasync handling on inherited events
  mm/hwpoison: fix page refcount of unknown non LRU page
  ipc/sem.c: update/correct memory barriers
  ipc,sem: fix use after free on IPC_RMID after a task using same semaphore set exits
  Linux 3.10.87
  mm, vmscan: Do not wait for page writeback for GFP_NOFS allocations
  md/bitmap: return an error when bitmap superblock is corrupt.
  kvm: x86: fix kvm_apic_has_events to check for NULL pointer
  signal: fix information leak in copy_siginfo_from_user32
  signal: fix information leak in copy_siginfo_to_user
  signalfd: fix information leak in signalfd_copyinfo
  ARM: 7819/1: fiq: Cast the first argument of flush_icache_range()
  ...

pinctrl: rockchip: fix rk3288 gpio0 configuration

On rk3288, for gpio bank 0, the registers which configure pull-up,
iomux, and drive strength don't implement the enable bits in the upper
half of the register, unlike the other gpio configuration registers,
and so the kernel must perform a read-modify-write of the register to
update a particular gpio in that bank.

Change-Id: I4a6953839307e3a75b2ac554aac3dc865583617d
Signed-off-by: Chris Zhong <zyw@rock-chips.com>

video: rockchip: fb: resize uboot logo if screen size is changed

If hdmi is inserted or removed before android is launched, screen
size is changed and uboot logo is showing on wrong screen position.

For example, screen size is 720x576 in uboot, hdmi is inserted during
kernel is booting, screen size is changed to 1920x1080, logo size
is still 720x576 and shown on left-top.

This case is occurred on box, mid has no problem. So we need to resize
uboot logo to new screen size.

Change-Id: I6247bf8e77d181687986815c960ec72d4c59a757
Signed-off-by: Zheng Yang <zhengyang@rock-chips.com>

Linux 3.10.88

arm64/mm: Remove hack in mmap randomize layout

commit d6c763afab142a85e4770b4bc2a5f40f256d5c5d upstream.

Since commit 8a0a9bd4db63 ('random: make get_random_int() more
random'), get_random_int() returns a random value for each call,
so comment and hack introduced in mmap_rnd() as part of commit
1d18c47c735e ('arm64: MMU fault handling and page table management')
are incorrects.

Commit 1d18c47c735e seems to use the same hack introduced by
commit a5adc91a4b44 ('powerpc: Ensure random space between stack
and mmaps'), latter copied in commit 5a0efea09f42 ('sparc64: Sharpen
address space randomization calculations.').

But both architectures were cleaned up as part of commit
fa8cbaaf5a68 ('powerpc+sparc64/mm: Remove hack in mmap randomize
layout') as hack is no more needed since commit 8a0a9bd4db63.

So the present patch removes the comment and the hack around
get_random_int() on AArch64's mmap_rnd().

Cc: David S. Miller <davem@davemloft.net>
Cc: Anton Blanchard <anton@samba.org>
Cc: Benjamin Herrenschmidt <benh@kernel.crashing.org>
Acked-by: Will Deacon <will.deacon@arm.com>
Acked-by: Dan McGee <dpmcgee@gmail.com>
Signed-off-by: Yann Droneaud <ydroneaud@opteya.com>
Signed-off-by: Will Deacon <will.deacon@arm.com>
Cc: Matthias Brugger <mbrugger@suse.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

crypto: caam - fix memory corruption in ahash_final_ctx

commit b310c178e6d897f82abb9da3af1cd7c02b09f592 upstream.

When doing pointer operation for accessing the HW S/G table,
a value representing number of entries (and not number of bytes)
must be used.

Fixes: 045e36780f115 ("crypto: caam - ahash hmac support")
Signed-off-by: Horia Geant? <horia.geanta@freescale.com>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

libfc: Fix fc_fcp_cleanup_each_cmd()

commit 8f2777f53e3d5ad8ef2a176a4463a5c8e1a16431 upstream.

Since fc_fcp_cleanup_cmd() can sleep this function must not
be called while holding a spinlock. This patch avoids that
fc_fcp_cleanup_each_cmd() triggers the following bug:

BUG: scheduling while atomic: sg_reset/1512/0x00000202
1 lock held by sg_reset/1512:
 #0:  (&(&fsp->scsi_pkt_lock)->rlock){+.-...}, at: [<ffffffffc0225cd5>] fc_fcp_cleanup_each_cmd.isra.21+0xa5/0x150 [libfc]
Preemption disabled at:[<ffffffffc0225cd5>] fc_fcp_cleanup_each_cmd.isra.21+0xa5/0x150 [libfc]
Call Trace:
 [<ffffffff816c612c>] dump_stack+0x4f/0x7b
 [<ffffffff810828bc>] __schedule_bug+0x6c/0xd0
 [<ffffffff816c87aa>] __schedule+0x71a/0xa10
 [<ffffffff816c8ad2>] schedule+0x32/0x80
 [<ffffffffc0217eac>] fc_seq_set_resp+0xac/0x100 [libfc]
 [<ffffffffc0218b11>] fc_exch_done+0x41/0x60 [libfc]
 [<ffffffffc0225cff>] fc_fcp_cleanup_each_cmd.isra.21+0xcf/0x150 [libfc]
 [<ffffffffc0225f43>] fc_eh_device_reset+0x1c3/0x270 [libfc]
 [<ffffffff814a2cc9>] scsi_try_bus_device_reset+0x29/0x60
 [<ffffffff814a3908>] scsi_ioctl_reset+0x258/0x2d0
 [<ffffffff814a2650>] scsi_ioctl+0x150/0x440
 [<ffffffff814b3a9d>] sd_ioctl+0xad/0x120
 [<ffffffff8132f266>] blkdev_ioctl+0x1b6/0x810
 [<ffffffff811da608>] block_ioctl+0x38/0x40
 [<ffffffff811b4e08>] do_vfs_ioctl+0x2f8/0x530
 [<ffffffff811b50c1>] SyS_ioctl+0x81/0xa0
 [<ffffffff816cf8b2>] system_call_fastpath+0x16/0x7a

Signed-off-by: Bart Van Assche <bart.vanassche@sandisk.com>
Signed-off-by: Vasu Dev <vasu.dev@intel.com>
Signed-off-by: James Bottomley <JBottomley@Odin.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

drm/radeon: add new OLAND pci id

commit e037239e5e7b61007763984aa35a8329596d8c88 upstream.

Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

EDAC, ppc4xx: Access mci->csrows array elements properly

commit 5c16179b550b9fd8114637a56b153c9768ea06a5 upstream.

The commit

  de3910eb79ac ("edac: change the mem allocation scheme to
 make Documentation/kobject.txt happy")

changed the memory allocation for the csrows member. But ppc4xx_edac was
forgotten in the patch. Fix it.

Signed-off-by: Michael Walle <michael@walle.cc>
Cc: linux-edac <linux-edac@vger.kernel.org>
Cc: Mauro Carvalho Chehab <mchehab@osg.samsung.com>
Link: http://lkml.kernel.org/r/1437469253-8611-1-git-send-email-michael@walle.cc
Signed-off-by: Borislav Petkov <bp@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

localmodconfig: Use Kbuild files too

commit c0ddc8c745b7f89c50385fd7aa03c78dc543fa7a upstream.

In kbuild it is allowed to define objects in files named "Makefile"
and "Kbuild".
Currently localmodconfig reads objects only from "Makefile"s and misses
modules like nouveau.

Link: http://lkml.kernel.org/r/1437948415-16290-1-git-send-email-richard@nod.at
Reported-and-tested-by: Leonidas Spyropoulos <artafinde@gmail.com>
Signed-off-by: Richard Weinberger <richard@nod.at>
Signed-off-by: Steven Rostedt <rostedt@goodmis.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

dm thin metadata: delete btrees when releasing metadata snapshot

commit 7f518ad0a212e2a6fd68630e176af1de395070a7 upstream.

The device details and mapping trees were just being decremented
before.  Now btree_del() is called to do a deep delete.

Signed-off-by: Joe Thornber <ejt@redhat.com>
Signed-off-by: Mike Snitzer <snitzer@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

perf: Fix fasync handling on inherited events

commit fed66e2cdd4f127a43fd11b8d92a99bdd429528c upstream.

Vince reported that the fasync signal stuff doesn't work proper for
inherited events. So fix that.

Installing fasync allocates memory and sets filp->f_flags |= FASYNC,
which upon the demise of the file descriptor ensures the allocation is
freed and state is updated.

Now for perf, we can have the events stick around for a while after the
original FD is dead because of references from child events. So we
cannot copy the fasync pointer around. We can however consistently use
the parent's fasync, as that will be updated.

Reported-and-Tested-by: Vince Weaver <vincent.weaver@maine.edu>
Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
Cc: Arnaldo Carvalho deMelo <acme@kernel.org>
Cc: Linus Torvalds <torvalds@linux-foundation.org>
Cc: Peter Zijlstra <peterz@infradead.org>
Cc: Thomas Gleixner <tglx@linutronix.de>
Cc: eranian@google.com
Link: http://lkml.kernel.org/r/1434011521.1495.71.camel@twins
Signed-off-by: Ingo Molnar <mingo@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

mm/hwpoison: fix page refcount of unknown non LRU page

commit 4f32be677b124a49459e2603321c7a5605ceb9f8 upstream.

After trying to drain pages from pagevec/pageset, we try to get reference
count of the page again, however, the reference count of the page is not
reduced if the page is still not on LRU list.

Fix it by adding the put_page() to drop the page reference which is from
__get_any_page().

Signed-off-by: Wanpeng Li <wanpeng.li@hotmail.com>
Acked-by: Naoya Horiguchi <n-horiguchi@ah.jp.nec.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

ipc/sem.c: update/correct memory barriers

commit 3ed1f8a99d70ea1cd1508910eb107d0edcae5009 upstream.

sem_lock() did not properly pair memory barriers:

!spin_is_locked() and spin_unlock_wait() are both only control barriers.
The code needs an acquire barrier, otherwise the cpu might perform read
operations before the lock test.

As no primitive exists inside <include/spinlock.h> and since it seems
noone wants another primitive, the code creates a local primitive within
ipc/sem.c.

With regards to -stable:

The change of sem_wait_array() is a bugfix, the change to sem_lock() is a
nop (just a preprocessor redefinition to improve the readability).  The
bugfix is necessary for all kernels that use sem_wait_array() (i.e.:
starting from 3.10).

Signed-off-by: Manfred Spraul <manfred@colorfullife.com>
Reported-by: Oleg Nesterov <oleg@redhat.com>
Acked-by: Peter Zijlstra (Intel) <peterz@infradead.org>
Cc: "Paul E. McKenney" <paulmck@linux.vnet.ibm.com>
Cc: Kirill Tkhai <ktkhai@parallels.com>
Cc: Ingo Molnar <mingo@redhat.com>
Cc: Josh Poimboeuf <jpoimboe@redhat.com>
Cc: Davidlohr Bueso <dave@stgolabs.net>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

ipc,sem: fix use after free on IPC_RMID after a task using same semaphore set exits

commit 602b8593d2b4138c10e922eeaafe306f6b51817b upstream.

The current semaphore code allows a potential use after free: in
exit_sem we may free the task's sem_undo_list while there is still
another task looping through the same semaphore set and cleaning the
sem_undo list at freeary function (the task called IPC_RMID for the same
semaphore set).

For example, with a test program [1] running which keeps forking a lot
of processes (which then do a semop call with SEM_UNDO flag), and with
the parent right after removing the semaphore set with IPC_RMID, and a
kernel built with CONFIG_SLAB, CONFIG_SLAB_DEBUG and
CONFIG_DEBUG_SPINLOCK, you can easily see something like the following
in the kernel log:

   Slab corruption (Not tainted): kmalloc-64 start=ffff88003b45c1c0, len=64
   000: 6b 6b 6b 6b 6b 6b 6b 6b 00 6b 6b 6b 6b 6b 6b 6b  kkkkkkkk.kkkkkkk
   010: ff ff ff ff 6b 6b 6b 6b ff ff ff ff ff ff ff ff  ....kkkk........
   Prev obj: start=ffff88003b45c180, len=64
   000: 00 00 00 00 ad 4e ad de ff ff ff ff 5a 5a 5a 5a  .....N......ZZZZ
   010: ff ff ff ff ff ff ff ff c0 fb 01 37 00 88 ff ff  ...........7....
   Next obj: start=ffff88003b45c200, len=64
   000: 00 00 00 00 ad 4e ad de ff ff ff ff 5a 5a 5a 5a  .....N......ZZZZ
   010: ff ff ff ff ff ff ff ff 68 29 a7 3c 00 88 ff ff  ........h).<....
   BUG: spinlock wrong CPU on CPU#2, test/18028
   general protection fault: 0000 [#1] SMP
   Modules linked in: 8021q mrp garp stp llc nf_conntrack_ipv4 nf_defrag_ipv4 ip6t_REJECT nf_reject_ipv6 nf_conntrack_ipv6 nf_defrag_ipv6 xt_state nf_conntrack ip6table_filter ip6_tables binfmt_misc ppdev input_leds joydev parport_pc parport floppy serio_raw virtio_balloon virtio_rng virtio_console virtio_net iosf_mbi crct10dif_pclmul crc32_pclmul ghash_clmulni_intel pcspkr qxl ttm drm_kms_helper drm snd_hda_codec_generic i2c_piix4 snd_hda_intel snd_hda_codec snd_hda_core snd_hwdep snd_seq snd_seq_device snd_pcm snd_timer snd soundcore crc32c_intel virtio_pci virtio_ring virtio pata_acpi ata_generic [last unloaded: speedstep_lib]
   CPU: 2 PID: 18028 Comm: test Not tainted 4.2.0-rc5+ #1
   Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.8.1-20150318_183358- 04/01/2014
   RIP: spin_dump+0x53/0xc0
   Call Trace:
     spin_bug+0x30/0x40
     do_raw_spin_unlock+0x71/0xa0
     _raw_spin_unlock+0xe/0x10
     freeary+0x82/0x2a0
     ? _raw_spin_lock+0xe/0x10
     semctl_down.clone.0+0xce/0x160
     ? __do_page_fault+0x19a/0x430
     ? __audit_syscall_entry+0xa8/0x100
     SyS_semctl+0x236/0x2c0
     ? syscall_trace_leave+0xde/0x130
     entry_SYSCALL_64_fastpath+0x12/0x71
   Code: 8b 80 88 03 00 00 48 8d 88 60 05 00 00 48 c7 c7 a0 2c a4 81 31 c0 65 8b 15 eb 40 f3 7e e8 08 31 68 00 4d 85 e4 44 8b 4b 08 74 5e <45> 8b 84 24 88 03 00 00 49 8d 8c 24 60 05 00 00 8b 53 04 48 89
   RIP  [<ffffffff810d6053>] spin_dump+0x53/0xc0
    RSP <ffff88003750fd68>
   ---[ end trace 783ebb76612867a0 ]---
   NMI watchdog: BUG: soft lockup - CPU#3 stuck for 22s! [test:18053]
   Modules linked in: 8021q mrp garp stp llc nf_conntrack_ipv4 nf_defrag_ipv4 ip6t_REJECT nf_reject_ipv6 nf_conntrack_ipv6 nf_defrag_ipv6 xt_state nf_conntrack ip6table_filter ip6_tables binfmt_misc ppdev input_leds joydev parport_pc parport floppy serio_raw virtio_balloon virtio_rng virtio_console virtio_net iosf_mbi crct10dif_pclmul crc32_pclmul ghash_clmulni_intel pcspkr qxl ttm drm_kms_helper drm snd_hda_codec_generic i2c_piix4 snd_hda_intel snd_hda_codec snd_hda_core snd_hwdep snd_seq snd_seq_device snd_pcm snd_timer snd soundcore crc32c_intel virtio_pci virtio_ring virtio pata_acpi ata_generic [last unloaded: speedstep_lib]
   CPU: 3 PID: 18053 Comm: test Tainted: G      D         4.2.0-rc5+ #1
   Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.8.1-20150318_183358- 04/01/2014
   RIP: native_read_tsc+0x0/0x20
   Call Trace:
     ? delay_tsc+0x40/0x70
     __delay+0xf/0x20
     do_raw_spin_lock+0x96/0x140
     _raw_spin_lock+0xe/0x10
     sem_lock_and_putref+0x11/0x70
     SYSC_semtimedop+0x7bf/0x960
     ? handle_mm_fault+0xbf6/0x1880
     ? dequeue_task_fair+0x79/0x4a0
     ? __do_page_fault+0x19a/0x430
     ? kfree_debugcheck+0x16/0x40
     ? __do_page_fault+0x19a/0x430
     ? __audit_syscall_entry+0xa8/0x100
     ? do_audit_syscall_entry+0x66/0x70
     ? syscall_trace_enter_phase1+0x139/0x160
     SyS_semtimedop+0xe/0x10
     SyS_semop+0x10/0x20
     entry_SYSCALL_64_fastpath+0x12/0x71
   Code: 47 10 83 e8 01 85 c0 89 47 10 75 08 65 48 89 3d 1f 74 ff 7e c9 c3 0f 1f 44 00 00 55 48 89 e5 e8 87 17 04 00 66 90 c9 c3 0f 1f 00 <55> 48 89 e5 0f 31 89 c1 48 89 d0 48 c1 e0 20 89 c9 48 09 c8 c9
   Kernel panic - not syncing: softlockup: hung tasks

I wasn't able to trigger any badness on a recent kernel without the
proper config debugs enabled, however I have softlockup reports on some
kernel versions, in the semaphore code, which are similar as above (the
scenario is seen on some servers running IBM DB2 which uses semaphore
syscalls).

The patch here fixes the race against freeary, by acquiring or waiting
on the sem_undo_list lock as necessary (exit_sem can race with freeary,
while freeary sets un->semid to -1 and removes the same sem_undo from
list_proc or when it removes the last sem_undo).

After the patch I'm unable to reproduce the problem using the test case
[1].

[1] Test case used below:

    #include <stdio.h>
    #include <sys/types.h>
    #include <sys/ipc.h>
    #include <sys/sem.h>
    #include <sys/wait.h>
    #include <stdlib.h>
    #include <time.h>
    #include <unistd.h>
    #include <errno.h>

    #define NSEM 1
    #define NSET 5

    int sid[NSET];

    void thread()
    {
            struct sembuf op;
            int s;
            uid_t pid = getuid();

            s = rand() % NSET;
            op.sem_num = pid % NSEM;
            op.sem_op = 1;
            op.sem_flg = SEM_UNDO;

            semop(sid[s], &op, 1);
            exit(EXIT_SUCCESS);
    }

    void create_set()
    {
            int i, j;
            pid_t p;
            union {
                    int val;
                    struct semid_ds *buf;
                    unsigned short int *array;
                    struct seminfo *__buf;
            } un;

            /* Create and initialize semaphore set */
            for (i = 0; i < NSET; i++) {
                    sid[i] = semget(IPC_PRIVATE , NSEM, 0644 | IPC_CREAT);
                    if (sid[i] < 0) {
                            perror("semget");
                            exit(EXIT_FAILURE);
                    }
            }
            un.val = 0;
            for (i = 0; i < NSET; i++) {
                    for (j = 0; j < NSEM; j++) {
                            if (semctl(sid[i], j, SETVAL, un) < 0)
                                    perror("semctl");
                    }
            }

            /* Launch threads that operate on semaphore set */
            for (i = 0; i < NSEM * NSET * NSET; i++) {
                    p = fork();
                    if (p < 0)
                            perror("fork");
                    if (p == 0)
                            thread();
            }

            /* Free semaphore set */
            for (i = 0; i < NSET; i++) {
                    if (semctl(sid[i], NSEM, IPC_RMID))
                            perror("IPC_RMID");
            }

            /* Wait for forked processes to exit */
            while (wait(NULL)) {
                    if (errno == ECHILD)
                            break;
            };
    }

    int main(int argc, char **argv)
    {
            pid_t p;

            srand(time(NULL));

            while (1) {
                    p = fork();
                    if (p < 0) {
                            perror("fork");
                            exit(EXIT_FAILURE);
                    }
                    if (p == 0) {
                            create_set();
                            goto end;
                    }

                    /* Wait for forked processes to exit */
                    while (wait(NULL)) {
                            if (errno == ECHILD)
                                    break;
                    };
            }
    end:
            return 0;
    }

[akpm@linux-foundation.org: use normal comment layout]
Signed-off-by: Herton R. Krzesinski <herton@redhat.com>
Acked-by: Manfred Spraul <manfred@colorfullife.com>
Cc: Davidlohr Bueso <dave@stgolabs.net>
Cc: Rafael Aquini <aquini@redhat.com>
CC: Aristeu Rozanski <aris@redhat.com>
Cc: David Jeffery <djeffery@redhat.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

ddrfreq: rockchip: read the parameters of auto-freq from dts

Change-Id: I50ff96bc66d929009da99b53c39d4b95567ad100
Signed-off-by: Xiao Feng <xf@rock-chips.com>

arm64: rockchip: rk3368: dts: add the parameters of auto-freq in dts

Change-Id: I8b19961a8a93b1ceb4378b1100d3f4cc8a5a9baa
Signed-off-by: Xiao Feng <xf@rock-chips.com>

ARM: dts: rk3368 box add xz3216 dcdc support

Change-Id: I91fab0816784bbdec36b2347f3e911fd402bc83e
Signed-off-by: Huang zhibao <hzb@rock-chips.com>

dcdc: add xz3216 dcdc support

Change-Id: I887e96c981af0cfffdb1c08784c52c774bb16fab
Signed-off-by: Huang zhibao <hzb@rock-chips.com>

video: rockchip: rb: return error value to user when an exception is configed

Change-Id: I81697f24c6914f07f8facad4e23ad4fb6824190c
Signed-off-by: Huang Jiachai <hjc@rock-chips.com>

of/device: Fix platform_device.name point to an freed memory after
dev_set_name()

When we use of_device_add() to create platform_device and add it to device
hierarchy, the platform_device.name and device's name will point to the same
memory.

Later we use dev_set_name() to change the device's name, it will alloc new
memory to store name and free old device's name. After it, the
platform_device.name will point to an freed memory, access platform_device.name
 maybe lead to unpredictable exceptions.

So, we alloc new memory for platform_device.name in of_device_add()

Change-Id: I59bf0941ee4e094053971d41d386206e47fddcaa
Signed-off-by: Meiyou Chen <cmy@rock-chips.com>

rk3368 dts: add ddr timing node in rk3368.dtsi

Change-Id: Ib1887e65567c76fc93b0a23ba143f9ad7e80b99f
Signed-off-by: Tang Yun ping <typ@rock-chips.com>

rk312x ddr: fix get bandwidth error

1.Using 64bit width variable to cached the read and write data bandwidth
because it may overflow when calculating read and write data bandwidth.
2.Get ddr burst length to calculating bandwidth because lpddr2's burst
length may be bl4 or bl8.

Change-Id: I28db1793e411fc3e18edc3b6421ab3d397d92aa5
Signed-off-by: Tang Yun ping <typ@rock-chips.com>

Pmic: rk808: Move regulator init parameters from rk808.dtsi to board dts

Move rk808 regulator init parameters to the rk3xx-xx.dts
Convenient for different products setting and modify

Change-Id: I03673f4dbd478df0630e6b982e72597ade14d810
Signed-off-by: zhangqing <zhangqing@rock-chips.com>

video: rockchip: hdmi: 3368: enable detect phy pll lock status

Phy PLL may be unlock under electro-static test. The higher the
electro-static voltage, the more likely the PLL will be lost.
If PLL is unlock and irq is triggered, we will reset registers
to make it lock on correct frequency.

Change-Id: I86eaa660e837e8c2e59c8e39e3ce083bb89c1bac
Signed-off-by: Zheng Yang <zhengyang@rock-chips.com>

rk808: fix a err when no sleep pin in dts

Rk808 will data abort if it has not sleep gpio in dts, and there is no
pmic_sleep_gpio for some board, add a validity checking before
gpio_request can fix this data abort.

Change-Id: Ic2b40f7bfb00e95d283dce72a33dd844cc2c7e27
Signed-off-by: Chris Zhong <zyw@rock-chips.com>

tve: rk1000: modify process, make it more reasonable

Change-Id: I021682c0da4e3096ceadf7b8e320a7391c55208b
Signed-off-by: Shen Zhenyi <szy@rock-chips.com>

rk3368 DDR: using unified smc call and get trust firmware version function

Change-Id: I81d5fae0a3679081d35d137500e20d5dd705eb15
Signed-off-by: Tang Yun ping <typ@rock-chips.com>

rk3288: pwm: rkpwm use same interrupt, voppwm would not use capture mode

Change-Id: Ic4d27adeb800406efa1efa5b34fc78677b4def72
Signed-off-by: David Wu <wdc@rock-chips.com>

dtsi: rk312x-sdk: update rk818 battery node

Change-Id: I1d0dd1b005e94281cff0792e6380deb3f02efaaf
Signed-off-by: Jianhong Chen <chenjh@rock-chips.com>

dts: rk3288-tb: update rk818 battery node

Change-Id: I4a76e7ac0ff3af791839ab5e5f9656ce72612dd1
Signed-off-by: Jianhong Chen <chenjh@rock-chips.com>

power: rk81x-battery: fix charge termination voltage define error

the charge termination voltage configration is like bellow:

000: 4.05v, 001: 4.10v, 010: 4.15v
011: 4.20v, 100: 4.25v, 101: 4.30v
110: 4.35v, 111: 4.35v

Change-Id: I17c7df5952c3913eaf509ae2603f2d96d7ea96c8
Signed-off-by: Jianhong Chen <chenjh@rock-chips.com>

usb: dwc_otg_310: gadget: stop current transfer on dequeue

If the request being dequeued is already started, disable endpoint
to stop the transfer and then call dwc_otg_request_done().
Endpoint will be re-enabled on next call to dwc_otg_ep_start_transfer().

TEST=use RK3128/RK3288/RK3368 board, adb root and then adb reboot,
check if usb_req->buf is used after free.

Change-Id: I8c9304f29c578f679ad0841350920f1350bd32df
Signed-off-by: Wu Liang feng <wulf@rock-chips.com>

video: rockchip: hdmi: introduce vic flag HDMI_UBOOT_NOT_INIT

If uboot_vic has HDMI_UBOOT_NOT_INIT flag, it means uboot just
pass the preset vic value, registers has not been set in uboot.
If not, hdmi has been power up in uboot, should not operate phy
register again.

Change-Id: I64f48bd878ec124a94f25a752a74dc9bae502b2b
Signed-off-by: Zheng Yang <zhengyang@rock-chips.com>

rk3368 tb: enable fiq debugger and disable the original uart console

Change the device from ttyS2 to ttyFIQ0

Change-Id: Ibc2ab1c9adf1dd5d1718c3c2d80fe578725b409a
Signed-off-by: Huibin Hong <huibin.hong@rock-chips.com>

rk3368: add fiq debugger node in rk3368.dtsi

Change-Id: Iecbfd409d18b5a963bacbbc277e4d7157fe20fb7
Signed-off-by: Huibin Hong <huibin.hong@rock-chips.com>

rk3368: add fiq debugger config, and enabled default

Change-Id: Idc36f89d82e739e37153117bea20ecca1f5d516c
Signed-off-by: Huibin Hong <huibin.hong@rock-chips.com>

rk3368: add fiq debugger for rk3368

It is also for the later soc based on arch v8

Change-Id: I5e4fef1fa4176ea371b1653ead8cef87e4ac0e6f
Signed-off-by: Huibin Hong <huibin.hong@rock-chips.com>

rockchip: add psci interfaces for other modules

Change-Id: I000e3033305f695a8929fbab98a87eea608e76cd
Signed-off-by: Huibin Hong <huibin.hong@rock-chips.com>

rockchip: add dts spec for fiq debugger

Documentation/devicetree/bindings/serial/rockchip_fiq_debugger.txt

Change-Id: Iab6cd308aed816ad614006a155816cd3e32df6f6
Signed-off-by: Huibin Hong <huibin.hong@rock-chips.com>

ASoC: rockchip: spdif: increase dma burst size

increase dma burst size from 4 to 16 to optimize dma transfer.

Change-Id: I1a9112e6b89ed1f29d24a3e4b5f42bf4201a9e71
Signed-off-by: Sugar Zhang <sugar.zhang@rock-chips.com>

video: rockchip: fb: close rk_fb_iommu_debug default

Change-Id: I285c091fe2932906070eb861ce98943b4605e101
Signed-off-by: Huang Jiachai <hjc@rock-chips.com>

ARM: dts: rk3288: move the remote-ctrl of PWM into box dts

Thinking about the PWM remote-ctrl is used by box, we should
put this into box dts.

Meanwhile, that PWM configure will break the normal PWM driver.
This patch will fix it.

Change-Id: I14878332631f94f512412ced5ceb8689f8bfbe46
Signed-off-by: huang zhibao <hzb@rock-chips.com>
Signed-off-by: Caesar Wang <wxt@rock-chips.com>

ARM: dts: rk3288: add the interrupts property for PWM

We are assuming that PWM need use the property, we can support the
SPI interrupts for PWM.

At the moment, we can find the remotectl pwm is needed on box.
We can add the property for all PWMs. AFAIK, the pwm driver don't use it
but the drivers/input/remotectl/rockchip_pwm_remotectl.c

Change-Id: Ia223e6cc0e882477614b555bd09c86fd4bf8dbd7
Signed-off-by: Caesar Wang <wxt@rock-chips.com>

cpufreq: rockchip: change the frequency of cci400 dynamically

when the frequency of big cluster and little cluster are bigger then
600MHz, set the frequency of cci400 to 576MHz, otherwise set the
frequency of cci400 to 288MHz.

Change-Id: I9e28b51bfdfcaf62464b8511c731fa2cd0ed5d9d
Signed-off-by: Xiao Feng <xf@rock-chips.com>

USB: dwc_otg_310: hcd: modify reboot or shutdown painc

When reboot or shutdown, hcd clean urbs and disable host interrupts. But
there may pending interrupts, so clean them.

Change-Id: Ide34aab5857a790a0912fb56ebe18d43ba228cf0
Signed-off-by: Feng Mingli <fml@rock-chips.com>
Signed-off-by: Yunzhi Li <lyz@rock-chips.com>

USB: dwc_otg_310: release channel for qtd that has been dequeued before

Change-Id: I184ed185074b2ccee24cbbf57c9ff1dad06bd9d7
Signed-off-by: Yunzhi Li <lyz@rock-chips.com>

ANDROID: input: elan_i2c: add elan touchpad driver

SMbus and I2C handling from driver core into separate
transport modules and makes them optional.

This driver pick up from chromium 3.14-kernel
Here is the URL:
https://chromium.googlesource.com/chromiumos/third_party/kernel/+/v3.14

----Note a bit different-----
we can easy replace the reinit_completion(completion);
with "completion->done = 0" in driver.

Change-Id: Idf373a502faea7913889f4a2f14ba71cae0da5b8
Signed-off-by: Caesar Wang <wxt@rock-chips.com>

ANDROID: input: Add "inhibited" property for input devices

Under certain circumstances, we want to disable some input
devices from userspace. In particular, when we detect that the lid of a
laptop is closed, we want to be able to disable touchpad and
touchscreen to avoid bogus input.

To facilitate this, we introduce the "inhibited" sysfs property for
input devices. Using this property, userspace can tell a driver that the
events it can provide are not currently of interest and should be
ignored. We provide hooks so that the driver can take additional
actions, such as powering down the device.

We deliberately keep this limited to input devices for now to keep the
implementation as straightforward as possible.

(cherry-pick from: https://chromium-review.googlesource.com/207989)

verify that touchpad works
echo 1 > /sys/bus/i2c/drivers/elan_i2c/4-0015/input/input0/inhibited
touchpad stops working
echo 0 >  /sys/bus/i2c/drivers/elan_i2c/4-0015/input/input0/inhibited
touchpad works again

Signed-off-by: Patrik Fimml <patrikf@chromium.org>
Reviewed-on: https://chromium-review.googlesource.com/207989
Reviewed-by: Dmitry Torokhov <dtor@chromium.org>
Reviewed-by: Benson Leung <bleung@chromium.org>
Change-Id: I889d37ef7ffc49f3c073b1c283d5c3327c263b7f
Signed-off-by: Caesar Wang <wxt@rock-chips.com>

sysfs: add sysfs_create/remove_groups()

commit 3e9b2bae8369661070622d05570cbcdfa01770e6 upstream

These functions are being open-coded in 3 different places in the driver
core, and other driver subsystems will want to start doing this as well,
so move it to the sysfs core to keep it all in one place, where we know
it is written properly.

Conflicts:
git checkout drivers/base/bus.c, In actul we don't use the interfaces in
drivers/base/bus.c

Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Change-Id: I0046a5572c780a0ea2b175ef753c408f6c10ba85
Signed-off-by: Caesar Wang <wxt@rock-chips.com>

hdmi: rk3288: No need to enable scrambling again in uboot mode

If scrambling mode is enabled in uboot and set again in kernel,
picture will flicker serveral frame.

Change-Id: Ib8fe0b1e2ce2a74eb10fcfbb6c8eb872452cfd20
Signed-off-by: Zheng Yang <zhengyang@rock-chips.com>
Reviewed-on: https://10.10.10.29/30
Tested-by: Huang, Tao <huangtao@rock-chips.com>
Reviewed-by: Huang, Tao <huangtao@rock-chips.com>

Documentation: add rockchip,rk3368-lcdc to rockchip_lcdc.txt

Change-Id: I8a88116f65aff7b594c87e67e5aef25a262e7b8a
Signed-off-by: Huang Jiachai <hjc@rock-chips.com>
Reviewed-on: https://10.10.10.29/27
Reviewed-by: Zheng Yang <zhengyang@rock-chips.com>
Tested-by: Huang, Tao <huangtao@rock-chips.com>
Reviewed-by: Huang, Tao <huangtao@rock-chips.com>

rk3368 lcdc: Update coding style

Change-Id: I84175f75e05d54394ff6eb20495cb89a17292b52
Signed-off-by: Huang Jiachai <hjc@rock-chips.com>
Reviewed-on: https://10.10.10.29/25
Reviewed-by: Zheng Yang <zhengyang@rock-chips.com>
Reviewed-by: Huang, Tao <huangtao@rock-chips.com>
Tested-by: Huang, Tao <huangtao@rock-chips.com>

hdmi:rk3288/rk3368: No need to reset tmdsclk in uboot mode.

If hdcp is enalbed, reset tmdsclk in uboot mode will make hdcp unstable,
which make sink check hdcp failed and show black picture.

Signed-off-by: Zheng Yang <zhengyang@rock-chips.com>