drm/rockchip: logo: use unique plane property logo mirror

The logo framework use state->rotation may conflict to common drm
update, cause display abnormal

Change-Id: I09b6b898a7606cd05371af1f4b25254945923d0d
Signed-off-by: Mark Yao <mark.yao@rock-chips.com>

UPSTREAM: clk: rockchip: mark some special clk as critical on rk3368

The jtag clk no driver to handle them.
But this clk need enable,so make it as critical.

The ddrphy/ddrupctl clks no driver to handle them,
Chip design requirements for these clock to always on,

The pmu_hclk_otg0 is Chip design defect, must be always on,

Signed-off-by: Elaine Zhang <zhangqing@rock-chips.com>
Signed-off-by: Heiko Stuebner <heiko@sntech.de>
(cherry picked from git.kernel.org mmind/linux-rockchip.git v4.13-clk/next
 commit 223c24be740d293519ef8e03f5c075fab5512fd2)

Conflicts:
drivers/clk/rockchip/clk-rk3368.c

Change-Id: I31c1c7efb7a83652501a7f53ff5931d9f308f736
Signed-off-by: Elaine Zhang <zhangqing@rock-chips.com>

UPSTREAM: clk: rockchip: mark noc and some special clk as critical on rk3288

The atclk/dbg/jtag/hsic-xin12m/pclk_core clks no driver to handle them.
But this clks need enable,so make it as ignore_unused for now.

The ddrupctl0/ddrupctl1/publ0/publ1 clks no driver to handle them,
Chip design requirements for these clock to always on,

The pmu_hclk_otg0 is Chip design defect, must be always on,

Signed-off-by: Elaine Zhang <zhangqing@rock-chips.com>
Signed-off-by: Heiko Stuebner <heiko@sntech.de>
(cherry picked from git.kernel.org mmind/linux-rockchip.git v4.13-clk/next
 commit 55bb6a633c33caf68ab470907ecf945289cb733d)

Conflicts:
drivers/clk/rockchip/clk-rk3288.c

Change-Id: I6271a903deb9ca21b5e74fd2c1ad4cf69f7021e1
Signed-off-by: Elaine Zhang <zhangqing@rock-chips.com>

UPSTREAM: clk: rockchip: mark pclk_ddrupctl as critical_clock on rk3036

No driver to handle this clk yet, but chip design requiress for this clock
supplying the ddr controller to be always on.

Signed-off-by: Elaine Zhang <zhangqing@rock-chips.com>
Signed-off-by: Heiko Stuebner <heiko@sntech.de>
(cherry picked from git.kernel.org mmind/linux-rockchip.git v4.13-clk/next
 commit f2893aaba435fcb55b86dc1be8c6f64f8d60e64b)

Change-Id: I3cd9578f73a69eb0f09d1f40c22ee55b393149aa
Signed-off-by: Elaine Zhang <zhangqing@rock-chips.com>

UPSTREAM: clk: rockchip: Make uartpll a child of the gpll on rk3036

The shared uart-pll is on boot a child of the apll that can get changed
by cpu frequency scaling. So move it away to the more stable gpll to
make sure the uart doesn't break on cpu frequency changes.

This turned up during the 4.11 merge-window when commit
6a171b299379 ("serial: 8250_dw: Allow hardware flow control to be used")
added general termios enablement making the uart on rk3036 change
frequency and thus making it susceptible for the frequency scaling issue.

Signed-off-by: Heiko Stuebner <heiko@sntech.de>
Signed-off-by: Stephen Boyd <sboyd@codeaurora.org>
(cherry picked from git.kernel.org mmind/linux-rockchip.git v4.13-clk/next
 commit f8ba2d68e54fbca340ad0fce97397291ba9637bc)

Change-Id: Ia8683d7b49523284043457727665d7e58d1551ec
Signed-off-by: Elaine Zhang <zhangqing@rock-chips.com>

UPSTREAM: clk: rockchip: add "," to mux_pll_src_apll_dpll_gpll_usb480m_p on rk3036

The mux_pll_src_apll_dpll_gpll_usb480m_p parent list was missing a ","
between the 3rd and 4th parent names, making them fall together and thus
lookups fail. Fix that.

Fixes: 5190c08b2989 ("clk: rockchip: add clock controller for rk3036")
Signed-off-by: Heiko Stuebner <heiko@sntech.de>
Signed-off-by: Stephen Boyd <sboyd@codeaurora.org>
(cherry picked from git.kernel.org mmind/linux-rockchip.git v4.13-clk/next
 commit 9b1b23f03abdd25ffde8bbfe5824b89bc0448c28)

Change-Id: I535b64fc7c902a4e9c64b4b803bb03126b7ba110
Signed-off-by: Elaine Zhang <zhangqing@rock-chips.com>

UPSTREAM: clk: rockchip: mark noc and some special clk as critical on rk3228

The jtag/bus/peri/initmem/rom/stimer/phy clks no driver to handle them.
But this clks need enable,so make it as critical.

The ddrupctl/ddrmon/ddrphy clks no driver to handle them,
Chip design requirements for these clock to always on,

The hclk_otg_pmu is Chip design defect, must be always on,
The new document will update the description of this clock.

All these non-noc/non-arbi clocks,IC suggest always on,
Because it's have some order limitation, between the NOC clock switch
and bus IDLE(or pd on/off).

The software is not very good to solve this constraint.
Always on these clocks, has no effect on the system power consumption.
The new document will update the description of these clock.

Signed-off-by: Elaine Zhang <zhangqing@rock-chips.com>
Signed-off-by: Heiko Stuebner <heiko@sntech.de>
(cherry picked from git.kernel.org mmind/linux-rockchip.git v4.13-clk/next
 commit f18c0994cda54dc21d3b0ce2ba130b5ea8f58666)

Conflicts:
drivers/clk/rockchip/clk-rk3228.c

Change-Id: Ie2c4c8d2c73a62efe96e64a3ec638970e82051d1
Signed-off-by: Elaine Zhang <zhangqing@rock-chips.com>

arm: rockchip_defconfig: support dtb appended and bootargs extended

This patch support using appended device tree blob to zImage and
supplementing the appended DTB with traditional ATAG information.

Change-Id: I8e8e63513c17544fdafd9107fda425740c63220e
Signed-off-by: Frank Wang <frank.wang@rock-chips.com>

rk: gcc-wrapper.py ignore atags_to_fdt.c:98

Change-Id: Ie7d1c5b7ba5d1147c1996d73f19d5e0d768998ec
Signed-off-by: Huang, Tao <huangtao@rock-chips.com>

UPSTREAM: ARM: 8500/1: fix atags_to_fdt with stack-protector-strong

Building with CONFIG_CC_STACKPROTECTOR_STRONG triggers protection code
generation under CONFIG_ARM_ATAG_DTB_COMPAT but this is too early for
being able to use any of the stack_chk code. Explicitly disable it for
only the atags_to_fdt bits.

Change-Id: Ib1f66cc4083b4f04d713c3c70610b8a337a6b0ff
Suggested-by: zhxihu <zhxihu@marvell.com>
Signed-off-by: Kees Cook <keescook@chromium.org>
Acked-by: Arnd Bergmann <arnd@arndb.de>
Signed-off-by: Russell King <rmk+kernel@arm.linux.org.uk>
Signed-off-by: Frank Wang <frank.wang@rock-chips.com>
(cherry picked from commit 7f66cd3f5420e7d11abd234033e7cb7a9738fc38)

UPSTREAM: clk: rockchip: add clock controller for rk3128

Add the clock tree definition for the new rk3128 SoC.
And it also applies to the RK3126 SoC.

Signed-off-by: Elaine Zhang <zhangqing@rock-chips.com>
Signed-off-by: Heiko Stuebner <heiko@sntech.de>
(cherry picked from git.kernel.org mmind/linux-rockchip.git v4.13-clk/next
 commit f6022e88faca1a6a21cbd0f009b477bc530b9cc7)

Change-Id: Ib933e398bc8e40d8659bc1cdc419116f48f6ae30
Signed-off-by: Elaine Zhang <zhangqing@rock-chips.com>

UPSTREAM: clk: rockchip: add dt-binding header for rk3128

Add the dt-bindings header for the rk3128,
that gets shared between the clock controller and
the clock references in the dts.
Add softreset ID for rk3128.
And it also applies to the RK3126 SoC.

Signed-off-by: Elaine Zhang <zhangqing@rock-chips.com>
Acked-by: Rob Herring <robh@kernel.org>
Signed-off-by: Heiko Stuebner <heiko@sntech.de>
(cherry picked from git.kernel.org mmind/linux-rockchip.git v4.13-clk/next
 commit b20841b9e0d730206de6ee95f4d00e3f8815ad50)

Change-Id: I70c055570319abe4547ac2a42b9139c7248abb13
Signed-off-by: Elaine Zhang <zhangqing@rock-chips.com>

UPSTREAM: dt-bindings: add bindings for rk3128 clock controller

Add devicetree bindings for Rockchip cru which found on
Rockchip SoCs.

Signed-off-by: Elaine Zhang <zhangqing@rock-chips.com>
Acked-by: Rob Herring <robh@kernel.org>
Signed-off-by: Heiko Stuebner <heiko@sntech.de>
(cherry picked from git.kernel.org mmind/linux-rockchip.git v4.13-clk/next
 commit de2ddc3b694d4594d922534db19e15fc39a3fcee)

Change-Id: I7ee66379d024020a9f8bcc98c3d9c4341391cccd
Signed-off-by: Elaine Zhang <zhangqing@rock-chips.com>

OP-TEE: fix warning when LPAE is activated on ARM

When LPAE is activated, the dma_addr_t type is u64,
but pointer is still 32bit on arm32 platform.
1. %pad is used to print dma_addr_t type in log.
2. The member paddr(dma_addr_t type) in struct shm is cast
to unsigned long when it needs to be cast to a pointer. The cast
is fine as the value of paddr in struct shm is always less than 4G.

Change-Id: I1e2112796f657759dfa845258ea19558cb84c4ec
Signed-off-by: Zhang Zhijie <zhangzj@rock-chips.com>

fiq debugger: rockchip: fix crash because of invalid sp_el0

(1) use cpu id from bl31 delivers;
(2) sp_el0 should point to kernel address in EL1 mode.

On ARM64, kernel uses sp_el0 to store current_thread_info(),
we see a problem: when fiq occurs, cpu is EL1 mode but sp_el0
point to userspace address. At this moment, if we read
'current_thread_info()->cpu' or other, it leads an error.

We find above situation happens when save/restore cpu context
between system mode and user mode under heavy load.
Like 'ret_fast_syscall()', kernel restore context of user mode,
but fiq occurs before the instruction 'eret', so this causes the
above situation.

Assembly code:

ffffff80080826c8 <ret_fast_syscall>:

...skipping...

ffffff80080826fc:       d503201f        nop
ffffff8008082700:       d5384100        mrs     x0, sp_el0
ffffff8008082704:       f9400c00        ldr     x0, [x0,#24]
ffffff8008082708:       d5182000        msr     ttbr0_el1, x0
ffffff800808270c:       d5033fdf        isb
ffffff8008082710:       f9407ff7        ldr     x23, [sp,#248]
ffffff8008082714:       d5184117        msr     sp_el0, x23
ffffff8008082718:       d503201f        nop
ffffff800808271c:       d503201f        nop
ffffff8008082720:       d5184035        msr     elr_el1, x21
ffffff8008082724:       d5184016        msr     spsr_el1, x22
ffffff8008082728:       a94007e0        ldp     x0, x1, [sp]
ffffff800808272c:       a9410fe2        ldp     x2, x3, [sp,#16]
ffffff8008082730:       a94217e4        ldp     x4, x5, [sp,#32]
ffffff8008082734:       a9431fe6        ldp     x6, x7, [sp,#48]
ffffff8008082738:       a94427e8        ldp     x8, x9, [sp,#64]
ffffff800808273c:       a9452fea        ldp     x10, x11, [sp,#80]
ffffff8008082740:       a94637ec        ldp     x12, x13, [sp,#96]
ffffff8008082744:       a9473fee        ldp     x14, x15, [sp,#112]
ffffff8008082748:       a94847f0        ldp     x16, x17, [sp,#128]
ffffff800808274c:       a9494ff2        ldp     x18, x19, [sp,#144]
ffffff8008082750:       a94a57f4        ldp     x20, x21, [sp,#160]
ffffff8008082754:       a94b5ff6        ldp     x22, x23, [sp,#176]
ffffff8008082758:       a94c67f8        ldp     x24, x25, [sp,#192]
ffffff800808275c:       a94d6ffa        ldp     x26, x27, [sp,#208]
ffffff8008082760:       a94e77fc        ldp     x28, x29, [sp,#224]
ffffff8008082764:       f9407bfe        ldr     x30, [sp,#240]
ffffff8008082768:       9104c3ff        add     sp, sp, #0x130
ffffff800808276c:       d69f03e0        eret

Change-Id: I071e899f8a407764e166ca0403199c9d87d6ce78
Signed-off-by: chenjh <chenjh@rock-chips.com>

firmware: rockchip: use sp_el1 from bl31 delivers

we think 'if (fiq_pt_regs.pstate & 0x10)' doesn't make any
sense, use sp_el1 from bl31 delivers is ok.

Change-Id: I0792d76e39912b4ca5484b029761daac05cd719b
Signed-off-by: chenjh <chenjh@rock-chips.com>

ARM64: dts: rk3328-evb: enable hdmi

Change-Id: I42b74009d0ddded9afc10b24e453ca26808bd18e
Signed-off-by: Zheng Yang <zhengyang@rock-chips.com>

ARM64: dts: rk3328: add hdmi display node

Change-Id: Ie4821b0c5e49c7b4ee083a2250a71f8ee3edb4e1
Signed-off-by: xuhuicong <xhc@rock-chips.com>
Signed-off-by: Zheng Yang <zhengyang@rock-chips.com>

arm64: rockchip_linux_defconfig: update by savedefconfig

Change-Id: I9fc62405d5fad1979d35ada78249a388b0a547dd
Signed-off-by: Huang, Tao <huangtao@rock-chips.com>

ARM: rockchip_linux_defconfig: update by savedefconfig

Change-Id: I2b1de1cd8ee600e593d41cdad0516703d6c94558
Signed-off-by: Huang, Tao <huangtao@rock-chips.com>

ARM: rockchip_defconfig: update by savedefconfig

Change-Id: I5503f37643bd7b9cd0b80a3afbd9e0293608d0cd
Signed-off-by: Huang, Tao <huangtao@rock-chips.com>

arm64: rockchip_defconfig: update by savedefconfig

ROCKCHIP_CPUINFO is default y now.

Change-Id: I4d56e98265ceac3dc071c440a61fbffc736120c6
Signed-off-by: Huang, Tao <huangtao@rock-chips.com>

drm/rockchip: hdmi: support RK3328

Change-Id: I7d93f0d494f6824b0b6e2f82c2c1a57342ea551e
Signed-off-by: Hans Yang <yhx@rock-chips.com>
Signed-off-by: Zheng Yang <zhengyang@rock-chips.com>

clk: rockchip: rk3328: add more flags for dclk_lcdc

Add CLK_SET_RATE_PARENT and CLK_SET_RATE_NO_REPARENT
for dclk_lcdc.

Change-Id: I19a4a8e5f9e2cc5fda8b70f1b632dccd538e02a0
Signed-off-by: Zheng Yang <zhengyang@rock-chips.com>

ARM64: dts: rockchip: add cpu version in cpuinfo for rk3328

Change-Id: Ief9dd80db35b7b55285b6773f270893a66da5f9d
Signed-off-by: Liang Chen <cl@rock-chips.com>

soc: rockchip: cpuinfo: read cpu version from eFuse

Change-Id: Ia18ff4e745f09fa04690bb7bc6d95169c389b9d2
Signed-off-by: Liang Chen <cl@rock-chips.com>

optee: fix mutex_unlock after mutex_lock

Change-Id: Ic5a4b5b4691b11083e5fd9e327fc4be82d626bfb
Signed-off-by: sean.huang <sean.huang@rock-chips.com>

drm: bridge: dw-hdmi: fixup kernel crash when reboot with hdmi connected

when other devices bind failed,drm will unbind and re-bind all devices.
if don't cancel the delayed work but flush and destroy workqueue directly,
kernel point is likely to become NULL.

Change-Id: Ib48704186ee298cbd4daac1cdbbac5fb3906b6bb
Signed-off-by: algea.cao <algea.cao@rock-chips.com>

usb: dwc_otg_310: pcd: fix force device mode issue

When tested usb device through force device mode method,
we found that usb device failed to connect to usb host
in the following case.

1. Use micro usb 2.0 OTG interface.
2. Plug in otg cable, and the id pin was pulled down
   to Ground.
3. User space force usb to enter device mode through
   'echo 2 > /sys/bus/platform/drivers/usb20_otg/force_usb_mode'
4. Use usb 2.0 Standard-A to Standard-A cable assembly,
   plug into otg cable receptor on one side, and connect
   to PC on the other side.
5. PC fail to enumerate our device, because of usb driver
   logical issue.

This is because that the dwc_otg_pcd_check_vbus_work()
only enable usb to start connecting if check the bvalid
and iddig is high. But in the above test case, the iddig
is low, so fail to start connection work. In this patch,
we enable usb to connect if iddig is high or usb is in
force device mode.

In addition, fix some coding style to increase the readability.

Change-Id: I08f1a4e6e7e5fb246b1716a20d4572d8b866f238
Signed-off-by: William Wu <william.wu@rock-chips.com>

ARM: rockchip: select ARCH_DMA_ADDR_T_64BIT for LPAE

Rockchip RK3288 has some 64-bit capable DMA and therefore needs
dma_addr_t to be a 64-bit size. One user is the Mali GPU.

Change-Id: I47335415fb101b377c408a2631ce211cb3ae3bd8
Signed-off-by: Huang, Tao <huangtao@rock-chips.com>

ARM: rockchip: enable ZONE_DMA for non 64-bit capable peripherals

Most IP cores on ARM Rockchip platforms can only address 32 bits of
physical memory for DMA. Thus ZONE_DMA should be enabled when LPAE
is activated.

Change-Id: I3fce3e01ba31270f066f49bc14fc2078c70d83ea
Signed-off-by: Huang, Tao <huangtao@rock-chips.com>

usb: dwc_otg_310: fix compile warning

When build with CONFIG_ARCH_DMA_ADDR_T_64BIT enabled:
drivers/usb/dwc_otg_310/dwc_otg_hcd.c: In function 'assign_and_init_hc':
drivers/usb/dwc_otg_310/dwc_otg_hcd.c:1093:19: warning: cast to pointer from integer of different size [-Wint-to-pointer-cast]
drivers/usb/dwc_otg_310/dwc_otg_hcd.c:1131:21: warning: cast to pointer from integer of different size [-Wint-to-pointer-cast]
drivers/usb/dwc_otg_310/dwc_otg_hcd.c:1161:21: warning: cast to pointer from integer of different size [-Wint-to-pointer-cast]
drivers/usb/dwc_otg_310/dwc_otg_hcd.c:1189:21: warning: cast to pointer from integer of different size [-Wint-to-pointer-cast]
drivers/usb/dwc_otg_310/dwc_otg_hcd_ddma.c: In function 'init_non_isoc_dma_desc':
drivers/usb/dwc_otg_310/dwc_otg_hcd_ddma.c:632:8: warning: cast to pointer from integer of different size [-Wint-to-pointer-cast]
drivers/usb/dwc_otg_310/dwc_otg_hcd_intr.c: In function 'handle_hc_ahberr_intr':
drivers/usb/dwc_otg_310/dwc_otg_hcd_intr.c:1699:14: warning: cast to pointer from integer of different size [-Wint-to-pointer-cast]

Change-Id: I4159d1d66ce24c97cc8085ee6e0fc4abde8c7423
Signed-off-by: William Wu <wulf@rock-chips.com>
Signed-off-by: Huang, Tao <huangtao@rock-chips.com>
(cherry picked from commit b001ce5aa46de28c1f52c82d1e3c111e172bd5e4)
(cherry picked from commit 4952c8819aa0f0902ae620bf5de18f7a19f85e17)

dmaengine: pl330: make transfer run infinitely without CPU intervention

this patch is based on "https://patchwork.kernel.org/patch/8349321/"

Change-Id: I377d1590186ce6e17983b931ad035d58a9e69e85
Signed-off-by: Sugar Zhang <sugar.zhang@rock-chips.com>

drm/rockchip: Don't r-b swap for 32bit logo

Change-Id: Id664731fc92fe4b770b49b4c2772e14bdf276cf2
Signed-off-by: Mark Yao <mark.yao@rock-chips.com>

drm/rockchip: vop: round_up pitches to word align

VOP pitch register is word align, need align to word.

VOP_WIN0_VIR:
  bit[31:16] win0_vir_stride_uv
    Number of words of Win0 uv Virtual width
  bit[15:0] win0_vir_width
    Number of words of Win0 yrgb Virtual width
    ARGB888 : win0_vir_width
    RGB888 : (win0_vir_width*3/4) + (win0_vir_width%3)
    RGB565 : ceil(win0_vir_width/2)
    YUV : ceil(win0_vir_width/4)

Change-Id: I89a74fae725e88cf618c5b02c45538419feba28f
Signed-off-by: Mark Yao <mark.yao@rock-chips.com>

UPSTREAM: pinctrl: rockchip: Add iomux-route switching support for rk3399

There are 2 IP blocks pin routes need to be switched, that are
uart2dbg, pcie_clkreq.

Signed-off-by: David Wu <david.wu@rock-chips.com>
Reviewed-by: Heiko Stuebner <heiko@sntech.de>
Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
(cherry picked from git.kernel.org/pub/scm/linux/kernel/git/linusw/linux-pinctrl.git for-next
 commit accc1ce7d2ffc6419a8eaf8c0190d9240df0c43f)

Signed-off-by: David Wu <david.wu@rock-chips.com>
Change-Id: I940fbec4869f1395e66c8e693b838f58aa84a7a1

UPSTREAM: pinctrl: rockchip: Add iomux-route switching support for rk3328

There are 8 IP blocks pin routes need to be switched, that are
uart2dbg, gmac-m1-optimized, pdm, spi, i2s2, card, tsp, cif.

Signed-off-by: David Wu <david.wu@rock-chips.com>
Reviewed-by: Heiko Stuebner <heiko@sntech.de>
Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
(cherry picked from git.kernel.org/pub/scm/linux/kernel/git/linusw/linux-pinctrl.git for-next
 commit cedc964a59d48c793ddc0884b2f72a68fc234ae4)

Signed-off-by: David Wu <david.wu@rock-chips.com>
Change-Id: I48fb4e8aa73930068b9ff6e8e547db267534b04d

UPSTREAM: pinctrl: rockchip: Add iomux-route switching support for rk3228

There are 9 IP blocks pin routes need to be switched, that are
pwm-0, pwm-1, pwm-2, pwm-3, sdio, spi, emmc, uart2, uart1.

Signed-off-by: David Wu <david.wu@rock-chips.com>
Reviewed-by: Heiko Stuebner <heiko@sntech.de>
Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
(cherry picked from git.kernel.org/pub/scm/linux/kernel/git/linusw/linux-pinctrl.git for-next
 commit d4970ee076f9aed396c322b41f56443a617116df)

Signed-off-by: David Wu <david.wu@rock-chips.com>
Change-Id: I9e4fbfb22f37add2ba5941b2b2ae9e55ed2d28b8

UPSTREAM: pinctrl: rockchip: Add iomux-route switching support

On the some rockchip SOCS, some things like rk3399 specific uart2 can use
multiple pins. Somewhere between the pin io-cells and the uart it seems
to have some sort of switch to decide to which pin to actually route the
data.

+-------+    +--------+  /- GPIO4_B0 (pinmux 2)

| uart2 | -- | switch | --- GPIO4_C0 (pinmux 2)

+-------+    +--------+  \- GPIO4_C3 (pinmux 2)
(switch selects one of the 3 pins base on the GRF_SOC_CON7[BIT0, BIT1])

The routing switch is determined by one pin of a specific group to be set
to its special pinmux function. If the pinmux setting is wrong for that
pin the ip block won't work correctly anyway.

Change-Id: I4de8dbe8a9183dd866b7dd8289f00c6e14f83dac
Signed-off-by: David Wu <david.wu@rock-chips.com>
Reviewed-by: Heiko Stuebner <heiko@sntech.de>
Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
(cherry picked from git.kernel.org/pub/scm/linux/kernel/git/linusw/linux-pinctrl.git for-next
 commit bd35b9bf8284338db35b3ff0d391b95d67b90444)

Signed-off-by: David Wu <david.wu@rock-chips.com>
Change-Id: I4de8dbe8a9183dd866b7dd8289f00c6e14f83dac

UPSTREAM: pinctrl: rockchip: avoid hardirq-unsafe functions in irq_chip

With real-time preemption, regmap functions cannot be used in the
implementation of irq_chip since they use spinlocks which may sleep.

Move the setting of the mux for IRQs to an irq_bus_sync_unlock handler
where we are allowed to sleep.

Signed-off-by: John Keeping <john@metanate.com>
Reviewed-by: Heiko Stuebner <heiko@sntech.de>
Tested-by: Heiko Stuebner <heiko@sntech.de>
Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
Signed-off-by: David Wu <david.wu@rock-chips.com>
(cherry picked from commit 88bb94216f59e10802aaf78c858a4146085faf18)

Signed-off-by: David Wu <david.wu@rock-chips.com>
Change-Id: I94ae59be60c34022fdfdf67cd5b3059d852a5969

UPSTREAM: pinctrl: rockchip: split out verification of mux settings

We need to avoid calling regmap functions from irq handlers, so the next
commit is going to move the call to rockchip_set_mux() into an
irq_bus_sync_unlock handler.  But we can't return an error from there so
we still need to check the settings from rockchip_irq_set_type() and we
will use this new rockchip_verify_mux() function from there.

Signed-off-by: John Keeping <john@metanate.com>
Reviewed-by: Heiko Stuebner <heiko@sntech.de>
Tested-by: Heiko Stuebner <heiko@sntech.de>
Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
Signed-off-by: David Wu <david.wu@rock-chips.com>
(cherry picked from git.kernel.org thierry.reding/linux-pwm.git for-next
 commit 05709c3e88f5f0adb7889facbfd546c998f65d59)

Signed-off-by: David Wu <david.wu@rock-chips.com>
Change-Id: I421f9c2faf835ca821c574602d6b4a66cdde9769

UPSTREAM: pinctrl: rockchip: convert to raw spinlock

This lock is used from rockchip_irq_set_type() which is part of the
irq_chip implementation and thus must use raw_spinlock_t as documented
in Documentation/gpio/driver.txt.

Signed-off-by: John Keeping <john@metanate.com>
Reviewed-by: Heiko Stuebner <heiko@sntech.de>
Tested-by: Heiko Stuebner <heiko@sntech.de>
Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
Signed-off-by: David Wu <david.wu@rock-chips.com>
(cherry picked from commit 70b7aa7a87b4593f50f634dc721e18bd1f9e5448)

Signed-off-by: David Wu <david.wu@rock-chips.com>
Change-Id: I039ee4067832026f564989a05503e7507d178ee1

UPSTREAM: pinctrl: rockchip: remove unnecessary locking

regmap_update_bits does its own locking and everything else accessed
here is a local variable so there is no need to lock around it.

Signed-off-by: John Keeping <john@metanate.com>
Reviewed-by: Heiko Stuebner <heiko@sntech.de>
Tested-by: Heiko Stuebner <heiko@sntech.de>
Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
(cherry picked from commit f07bedc37f3cfb7b182e1337fe7c8acce71e3a25)

Change-Id: Id15c7ed10f32202c986c951ef328a84be5798af4
Signed-off-by: David Wu <david.wu@rock-chips.com>

UPSTREAM: pinctrl: rockchip: Add input schmitt support for rk3328

Signed-off-by: David Wu <david.wu@rock-chips.com>
Reviewed-by: Heiko Stuebner <heiko@sntech.de>
Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
(cherry picked from git.kernel.org thierry.reding/linux-pwm.git for-next
 commit 728d3f5afd991a44b4ec9d019d8556d8cb68db3f)

Signed-off-by: David Wu <david.wu@rock-chips.com>
Change-Id: I15202d4fdd2fc35906d25e04cee63109d872405d

UPSTREAM: pinctrl: rockchip: Add input schmitt support

To prevent external signal crosstalk, some pins need to
enable input schmitt, like i2c pins, 32k-input pin and so on.

Change-Id: I2465e9df8abab3d8f46924e76a9084cda76a5a85
Signed-off-by: David Wu <david.wu@rock-chips.com>
Reviewed-by: Heiko Stuebner <heiko@sntech.de>
Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
(cherry picked from commit e3b357d7dfe6b38a6064562bacf5c912b3443ac0)

Signed-off-by: David Wu <david.wu@rock-chips.com>
Change-Id: I2465e9df8abab3d8f46924e76a9084cda76a5a85

pinctrl: rockchip: sync with upstream for iomux recalculation

Change-Id: I795e2490e88203e8fb3d457cf293d70e34ab47e0
Signed-off-by: David Wu <david.wu@rock-chips.com>

optee: add res of cpumask_to_cpu0 and restore

if res is error,break;

Change-Id: I4c8a11ae02fef2aa30849a94afcce3af5569bbeb
Signed-off-by: sean.huang <sean.huang@rock-chips.com>
(cherry picked from commit 36bc4c52281bb9f476dc22f8bbd6e35183fa7863)
Signed-off-by: Zhang Zhijie <zhangzj@rock-chips.com>

camera: rockchip: camsys driver v0.0x22.0

delete node in irqpool list when thread disconnect

Change-Id: I5602e138ab9bce751e24f6dc0a0f7348755be97a
Signed-off-by: zhangyunlong <dalon.zhang@rock-chips.com>

ARM: dts: phycore-rk3288: update

Change-Id: I4aa3ffd456040c9787871096b3483995be701da5
Signed-off-by: Wadim Egorov <w.egorov@phytec.de>
Signed-off-by: Jacob Chen <jacob2.chen@rock-chips.com>

net: phy: dp83867: Check if the phy is in an internal testing mode

The DP83867 seems to be always in an internal mode on our Board.
This mode can cause connection problems. We disable this mode.

Unfortunately, Register 0x31 Bit 7 is not documented and marked as reserved.
If Bit 7 is set, phy is in the internal testing mode.

Change-Id: I5d3435fcfea0e1af7c4d5ee510c249f41211f223
Signed-off-by: Wadim Egorov <w.egorov@phytec.de>
Signed-off-by: Jacob Chen <jacob2.chen@rock-chips.com>

net: phy: dp83867: Disable FORCE_LINK_GOOD in PHYCTRL

With FORCE_LINK_GOOD we are not able to get a link.
According to the TRM this bit should be 0 (Normal operation) in default.

Set FORCE_LINK_GOOD to default.

Change-Id: Iaa30bef20fc6f8313c018d18646879f62db49004
Signed-off-by: Wadim Egorov <w.egorov@phytec.de>
Signed-off-by: Jacob Chen <jacob2.chen@rock-chips.com>

net: phy: dp83867: Add documentation for CLK_OUT pin muxing

Add documentation of ti,clk-output-sel which can be used to select
a specific clock for CLK_OUT.

Change-Id: I5d341cac64581cd39ced0703054a70fd1eacc4a6
Signed-off-by: Wadim Egorov <w.egorov@phytec.de>
Signed-off-by: Jacob Chen <jacob2.chen@rock-chips.com>

BACKPORT: net: phy: dp83867: allow RGMII_TXID/RGMII_RXID interface types

Currently dp83867 driver returns error if phy interface type
PHY_INTERFACE_MODE_RGMII_RXID is used to set the rx only internal
delay. Similarly issue happens for PHY_INTERFACE_MODE_RGMII_TXID.
Fix this by checking also the interface type if a particular delay
value is missing in the phy dt bindings. Also update the DT document
accordingly.

Signed-off-by: Murali Karicheri <m-karicheri2@ti.com>
Signed-off-by: Sekhar Nori <nsekhar@ti.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
(cherry picked from commit 34c55cf2fc75f8bf6ba87df321038c064cf2d426)
Signed-off-by: Wadim Egorov <w.egorov@phytec.de>
Change-Id: Ideca1aae2512f0ee2944bc751e47436d8d1746b6

UPSTREAM: net: phy: dp83867: Add documentation for optional impedance control

Add documention of ti,min-output-impedance and ti,max-output-impedance
which can be used to correct MAC impedance mismatch using phy extended
registers.

Signed-off-by: Mugunthan V N <mugunthanvnm@ti.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
(cherry picked from commit d6081de7e011327af089475bb60593423963526a)
Change-Id: I5e1f90caff7fee13369302a84d1dac370cb75f5e
Signed-off-by: Jacob Chen <jacob2.chen@rock-chips.com>

net: phy: dp83867: Add binding for the CLK_OUT pin muxing option

The DP83867 has a muxing option for the CLK_OUT pin. It is possible
to set CLK_OUT for different channels.
Create a binding to select a specific clock for CLK_OUT pin.

Change-Id: I416afa8ef29d9a684068fa880f99ca7b720cfd14
Signed-off-by: Wadim Egorov <w.egorov@phytec.de>
Signed-off-by: Jacob Chen <jacob2.chen@rock-chips.com>

UPSTREAM: net: phy: dp83867: Recover from "port mirroring" N/A MODE4

The DP83867 when not properly bootstrapped - especially with LED_0 pin -
can enter N/A MODE4 for "port mirroring" feature.

To provide normal operation of the PHY, one needs not only to explicitly
disable the port mirroring feature, but as well stop some IC internal
testing (which disables RGMII communication).

To do that the STRAP_STS1 (0x006E) register must be read and RESERVED bit
11 examined. When it is set, the another RESERVED bit (11) at PHYCR
(0x0010) register must be clear to disable testing mode and enable RGMII
communication.

Thorough explanation of the problem can be found at following e2e thread:
"DP83867IR: Problem with RESERVED bits in PHY Control Register (PHYCR) -
Linux driver"

https://e2e.ti.com/support/interface/ethernet/f/903/p/571313/2096954#2096954

Signed-off-by: Lukasz Majewski <lukma@denx.de>
Reviewed-by: Andrew Lunn <andrew@lunn.ch>
Signed-off-by: David S. Miller <davem@davemloft.net>
(cherry picked from commit ac6e058b75be71208e98a5808453aae9a17be480)
Change-Id: I1b17b6c88e76230fde3fd1c93c3bb09ee0c2790d
Signed-off-by: Jacob Chen <jacob2.chen@rock-chips.com>

UPSTREAM: net: phy: dp83867: Add lane swapping support in the DP83867 TI's PHY driver

This patch adds support for enabling or disabling the lane swapping (called
"port mirroring" in PHY's CFG4 register) feature of the DP83867 TI's PHY
device.

One use case is when bootstrap configuration enables this feature (because
of e.g. LED_0 wrong wiring) so then one needs to disable it in software
(at u-boot/Linux).

Signed-off-by: Lukasz Majewski <lukma@denx.de>
Reviewed-by: Andrew Lunn <andrew@lunn.ch>
Signed-off-by: David S. Miller <davem@davemloft.net>
(cherry picked from commit fc6d39c39581f3c12c95f166ce95ef8beb2047e8)
Change-Id: Iea19a3e02a5072e5b3ab2b4ee33befd5805100e2
Signed-off-by: Jacob Chen <jacob2.chen@rock-chips.com>

UPSTREAM: net: phy: dp83867: fix irq generation

For proper IRQ generation by DP83867 phy the INT/PWDN pin has to be
programmed as an interrupt output instead of a Powerdown input in
Configuration Register 3 (CFG3), Address 0x001E, bit 7 INT_OE = 1. The
current driver doesn't do this and as result IRQs will not be generated by
DP83867 phy even if they are properly configured in DT.

Hence, fix IRQ generation by properly configuring CFG3.INT_OE bit and
ensure that Link Status Change (LINK_STATUS_CHNG_INT) and Auto-Negotiation
Complete (AUTONEG_COMP_INT) interrupt are enabled. After this the DP83867
driver will work properly in interrupt enabled mode.

Signed-off-by: Grygorii Strashko <grygorii.strashko@ti.com>
Reviewed-by: Florian Fainelli <f.fainelli@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
(cherry picked from commit 5ca7d1ca77dc23934504b95a96d2660d345f83c2)
Change-Id: Ic4fd8e84a2e41f217850230699e00f603ea3f086
Signed-off-by: Jacob Chen <jacob2.chen@rock-chips.com>

UPSTREAM: net: phy: dp83867: add support for MAC impedance configuration

Add support for programmable MAC impedance configuration

Signed-off-by: Mugunthan V N <mugunthanvnm@ti.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
(cherry picked from commit ed838fe937dbcdcf7c0444a5b62edfec6ecd753c)
Change-Id: I189307e95ccb4f71a245ec69df6f4ab0b32130ec
Signed-off-by: Jacob Chen <jacob2.chen@rock-chips.com>

UPSTREAM: net: phy: dp83867: Fix initialization of PHYCR register

When initializing the PHY control register, the FIFO depth bits are
written without reading the previous register value, i.e. all other
bits are overwritten with zero. This disables automatic MDI-X
configuration, which is enabled by default. Fix initialization by doing
a read/modify/write operation.

Signed-off-by: Stefan Hauser <stefan@shauser.net>
Reviewed-by: Florian Fainelli <f.fainelli@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
(cherry picked from commit b291c418172f2cfbe009d81cd9a92f7a2de7c579)
Change-Id: If14021286ff6e8b770f6cfe0f4026e29414e75d8
Signed-off-by: Jacob Chen <jacob2.chen@rock-chips.com>

UPSTREAM: phy: phy_{read|write}_mmd_indirect: get addr from phydev

The address of the device can be determined from the phydev structure,
rather than passing it as a parameter.

Signed-off-by: Andrew Lunn <andrew@lunn.ch>
Reviewed-by: Florian Fainelli <f.fainelli@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
(cherry picked from commit 053e7e169229adebbc27fc176c5369398e9f5eba)
Change-Id: Ib0f855bb2f6ad38e37c030343d6ccb1cc8848178
Signed-off-by: Jacob Chen <jacob2.chen@rock-chips.com>

UPSTREAM: PHY: DP83867: Remove looking in parent device for OF properties

Device tree properties for a phy device are expected to be in the phy
node. The current code for the DP83867 also tries to look in the
parent node. The devices binding documentation does not mention this,
no current device tree file makes use of this, and it is not behaviour
we want. So remove looking in the parent device.

Signed-off-by: Andrew Lunn <andrew@lunn.ch>
Acked-by: Florian Fainelli <f.fainelli@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
(cherry picked from commit 7bf9ae016efc0cf08263fbee5ac708c23b90792e)
Change-Id: Ia0b9f5fbe15b3c042880b8c8712c1b72f994029e
Signed-off-by: Jacob Chen <jacob2.chen@rock-chips.com>

UPSTREAM: leds: pca9532: Add device tree support

This patch adds basic device tree support for the pca9532 LEDs.

Signed-off-by: Phil Reid <preid@electromag.com.au>
Signed-off-by: Jacek Anaszewski <j.anaszewski@samsung.com>
(cherry picked from commit fa4191a609f219262a18dd8b02ab7dc30896b707)
Change-Id: I4daef4193eef8c4cad883224048fa0b9ef03558f
Signed-off-by: Jacob Chen <jacob2.chen@rock-chips.com>

ARM: dts: rockchip: add eDP panel support for Firefly

This patch adds the supporting to the eDP panel sold by
the T-CHIP for the Firefly RK3288. I assign the VOP lite
for the eDP panel and VOP big to HDMI, as the HDMI supports
4K resolution. With a different VOP device, eDP panel
and HDMI could display a different contents.

The InvenSense MPU6050 sensor at the botton of the panel
is also enabled.

The Firefly RK3288 Reload use a different GPIO pin to enable
the power of the eDP panel.

Change-Id: Id78249f001d171ede79fe835d24c40a75ff8a0df
Signed-off-by: Randy Li <ayaka@soulik.info>
Signed-off-by: Randy Li <randy.li@rock-chips.com>

UPSTREAM: net: stmmac: dwmac-rk: Add handling for RGMII_ID/RXID/TXID

ATM dwmac-rk will always set and enable it's internal delay lines.
Using PHY internal delays in combination with the phy-mode
rgmii-id/rxid/txid was not possible. Only rgmii was supported.

Now we can disable rockchip's gmac delay lines and also use
rgmii-id/rxid/txid.

Tested only with a RK3288 based board.

Signed-off-by: Wadim Egorov <w.egorov@phytec.de>
Signed-off-by: David S. Miller <davem@davemloft.net>
(cherry picked from commit eaf70ad14cbbb99d46b78b1307628a16a3f6075d)
Change-Id: Id0152a9f048cbc810b62c252d4105594ed1895df
Signed-off-by: Jacob Chen <jacob2.chen@rock-chips.com>

FROMLIST: usb: dwc2: resume root hub to handle disconnect of device

When handle disconnect of the hcd during bus_suspend, hcd
needs to resume its root hub, otherwise the root hub will
not disconnect the existing devices under its port.

This issue always happens when connecting with usb devices
which support auto-suspend function (e.g. usb hub).

(am from https://patchwork.kernel.org/patch/9751469/)
Change-Id: I663fdea73f36e89130d9a250612363968cbff941
Signed-off-by: William Wu <william.wu@rock-chips.com>

usb: dwc_otg_310: fix reboot test fail in otg host mode

When do reboot test with otg cable plugging in, it may
casue two issues: 1. system hung when access grstctl reg
in dwc_otg_core_reset(); 2. kernel panic when remove the
host channel from the free list in assign_and_init_hc().

This patch adds 1.5~2ms delay afer resume USB2 PHY, the
time for utmi_clk provided from USB2 PHY to stabilize,
and then we can access the usb core registers safely, it
can avoid system hung.

Also, we avoid to call otg20_hcd_connect_detect() if dwc2
is host mode except force host mode during probe, because
we will do the same work in check_id_work() later. This can
fix the issue that init usb core and host twice when boot
with otg cable and usb device, which may cause kernel panic
because of hc list is NULL.

Change-Id: I35aa36762c64b14b580b493d213610379676ab56
Signed-off-by: William Wu <william.wu@rock-chips.com>

BACKPORT: mm/slab: clean up DEBUG_PAGEALLOC processing code

Currently, open code for checking DEBUG_PAGEALLOC cache is spread to
some sites.  It makes code unreadable and hard to change.

This patch cleans up this code.  The following patch will change the
criteria for DEBUG_PAGEALLOC cache so this clean-up will help it, too.

[akpm@linux-foundation.org: fix build with CONFIG_DEBUG_PAGEALLOC=n]
Signed-off-by: Joonsoo Kim <iamjoonsoo.kim@lge.com>
Cc: Christoph Lameter <cl@linux.com>
Cc: Pekka Enberg <penberg@kernel.org>
Cc: David Rientjes <rientjes@google.com>
Cc: Joonsoo Kim <iamjoonsoo.kim@lge.com>
Cc: Jesper Dangaard Brouer <brouer@redhat.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
[AmitP: fix build with CONFIG_DEBUG_PAGEALLOC=n]
(cherry picked from commit 40b44137971c2e5865a78f9f7de274449983ccb5)
Signed-off-by: Amit Pundir <amit.pundir@linaro.org>

Merge branch 'linux-linaro-lsk-v4.4' into linux-linaro-lsk-v4.4-android

 Merge tag 'v4.4.70' into linux-linaro-lsk-v4.4

 This is the 4.4.70 stable release

i2c: rk3x: Make sure the i2c transfer to be finished before system reboot

If the system rebooted, there might be i2c transfer at the
same time, it will make something unpredictable, because
the i2c host was reseted, but the slave device wasn't, such
as rk808 pmic, so make sure the i2c transfer to be finished
before system shutdown at the reset mode.

Change-Id: I3c09f3acbe86595c295edc191aa38351adb7d5dc
Signed-off-by: David Wu <david.wu@rock-chips.com>
Signed-off-by: Jianqun Xu <jay.xu@rock-chips.com>

ARM: rockchip: pm: fix compile warning

When build with ARM_LPAE enabled:
arch/arm/mach-rockchip/pm.c: In function 'rk3288_init_pmu_sram':
arch/arm/mach-rockchip/pm.c:85:23: warning: cast to pointer from
integer of different size [-Wint-to-pointer-cast]

Change-Id: I526f13439c3c7edde77a27419d488a8f79081661
Signed-off-by: Huang, Tao <huangtao@rock-chips.com>

Linux 4.4.70

UPSTREAM: arm64: hibernate: Support DEBUG_PAGEALLOC

DEBUG_PAGEALLOC removes the valid bit of page table entries to prevent
any access to unallocated memory. Hibernate uses this as a hint that those
pages don't need to be saved/restored. This patch adds the
kernel_page_present() function it uses.

hibernate.c copies the resume kernel's linear map for use during restore.
Add _copy_pte() to fill-in the holes made by DEBUG_PAGEALLOC in the resume
kernel, so we can restore data the original kernel had at these addresses.

Finally, DEBUG_PAGEALLOC means the linear-map alias of KERNEL_START to
KERNEL_END may have holes in it, so we can't lazily clean this whole
area to the PoC. Only clean the new mmuoff region, and the kernel/kvm
idmaps.

This reverts commit da24eb1f3f9e2c7b75c5f8c40d8e48e2c4789596.

Reported-by: Will Deacon <will.deacon@arm.com>
Signed-off-by: James Morse <james.morse@arm.com>
Cc: Catalin Marinas <catalin.marinas@arm.com>
Reviewed-by: Catalin Marinas <catalin.marinas@arm.com>
Signed-off-by: Will Deacon <will.deacon@arm.com>
(cherry picked from commit 5ebe3a44cc744d11cb60d8438106a9322b7c04dc)
Signed-off-by: Amit Pundir <amit.pundir@linaro.org>

BACKPORT: arm64: vmlinux.ld: Add mmuoff data sections and move mmuoff text into idmap

Resume from hibernate needs to clean any text executed by the kernel with
the MMU off to the PoC. Collect these functions together into the
.idmap.text section as all this code is tightly coupled and also needs
the same cleaning after resume.

Data is more complicated, secondary_holding_pen_release is written with
the MMU on, clean and invalidated, then read with the MMU off. In contrast
__boot_cpu_mode is written with the MMU off, the corresponding cache line
is invalidated, so when we read it with the MMU on we don't get stale data.
These cache maintenance operations conflict with each other if the values
are within a Cache Writeback Granule (CWG) of each other.
Collect the data into two sections .mmuoff.data.read and .mmuoff.data.write,
the linker script ensures mmuoff.data.write section is aligned to the
architectural maximum CWG of 2KB.

Signed-off-by: James Morse <james.morse@arm.com>
Cc: Ard Biesheuvel <ard.biesheuvel@linaro.org>
Cc: Mark Rutland <mark.rutland@arm.com>
Reviewed-by: Catalin Marinas <catalin.marinas@arm.com>
Signed-off-by: Will Deacon <will.deacon@arm.com>
(cherry picked from commit b61130381120398876b86282082ad9f24976dfcf)
Signed-off-by: Amit Pundir <amit.pundir@linaro.org>

BACKPORT: arm64: Create sections.h

Each time new section markers are added, kernel/vmlinux.ld.S is updated,
and new extern char __start_foo[] definitions are scattered through the
tree.

Create asm/include/sections.h to collect these definitions (and include
the existing asm-generic version).

Signed-off-by: James Morse <james.morse@arm.com>
Reviewed-by: Mark Rutland <mark.rutland@arm.com>
Tested-by: Mark Rutland <mark.rutland@arm.com>
Reviewed-by: Catalin Marinas <catalin.marinas@arm.com>
Signed-off-by: Will Deacon <will.deacon@arm.com>
(cherry picked from commit ee78fdc71db1ce9a437b9ca17e31063996b71ec1)
Signed-off-by: Amit Pundir <amit.pundir@linaro.org>

ANDROID: uid_sys_stats: defer io stats calulation for dead tasks

Store sum of dead task io stats in uid_entry and defer uid io
calulation until next uid proc stat change or dumpsys.

Bug: 37754877
Change-Id: I970f010a4c841c5ca26d0efc7e027414c3c952e0
Signed-off-by: Jin Qian <jinqian@google.com>

ANDROID: AVB: Fix linter errors.

Various other kernel trees complained about style problems with
dm-verity-avb.c, specifically some lines being wider than 80
characters and spaces being used instead of tabs. With these changes
checkpatch.pl is happy:

 $ scripts/checkpatch.pl --file drivers/md/dm-verity-avb.c
 total: 0 errors, 0 warnings, 229 lines checked

 drivers/md/dm-verity-avb.c has no obvious style problems and is ready for submission.

Bug: None
Test: Compiles.
Change-Id: I08913adf61c5bf2b0f78f7d9e18dbe93feaba9f7
Signed-off-by: David Zeuthen <zeuthen@google.com>

ANDROID: AVB: Fix invalidate_vbmeta_submit().

On some boards with newer kernels the invalidate_vbmeta_submit()
function failed likely because it's using a hard-coded size of
512. Use PAGE_SIZE and also use bio_add_page(). Also print out if the
I/O actually fails.

Additionally, print major:minor of the device we're acting on since
another subset of boards get this wrong by passing the wrong GUID to
libavb in the bootloader. Having this information printed out makes it
a lot easier to pinpoint such mistakes.

Test: Manually tested.
Bug: 38451312
Change-Id: Ib58548953a3375a3c79acf74aa745be9420b8216
Signed-off-by: David Zeuthen <zeuthen@google.com>

drivers: char: mem: Check for address space wraparound with mmap()

commit b299cde245b0b76c977f4291162cf668e087b408 upstream.

/dev/mem currently allows mmap() mappings that wrap around the end of
the physical address space, which should probably be illegal. It
circumvents the existing STRICT_DEVMEM permission check because the loop
immediately terminates (as the start address is already higher than the
end address). On the x86_64 architecture it will then cause a panic
(from the BUG(start >= end) in arch/x86/mm/pat.c:reserve_memtype()).

This patch adds an explicit check to make sure offset + size will not
wrap around in the physical address type.

Signed-off-by: Julius Werner <jwerner@chromium.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

nfsd: encoders mustn't use unitialized values in error cases

commit f961e3f2acae94b727380c0b74e2d3954d0edf79 upstream.

In error cases, lgp->lg_layout_type may be out of bounds; so we
shouldn't be using it until after the check of nfserr.

This was seen to crash nfsd threads when the server receives a LAYOUTGET
request with a large layout type.

GETDEVICEINFO has the same problem.

Reported-by: Ari Kauppi <Ari.Kauppi@synopsys.com>
Reviewed-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: J. Bruce Fields <bfields@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

drm/edid: Add 10 bpc quirk for LGD 764 panel in HP zBook 17 G2

commit e345da82bd6bdfa8492f80b3ce4370acfd868d95 upstream.

The builtin eDP panel in the HP zBook 17 G2 supports 10 bpc,
as advertised by the Laptops product specs and verified via
injecting a fixed edid + photometer measurements, but edid
reports unknown depth, so drivers fall back to 6 bpc.

Add a quirk to get the full 10 bpc.

Signed-off-by: Mario Kleiner <mario.kleiner.de@gmail.com>
Acked-by: Harry Wentland <harry.wentland@amd.com>
Signed-off-by: Daniel Vetter <daniel.vetter@ffwll.ch>
Link: http://patchwork.freedesktop.org/patch/msgid/1492787108-23959-1-git-send-email-mario.kleiner.de@gmail.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

PCI: Freeze PME scan before suspending devices

commit ea00353f36b64375518662a8ad15e39218a1f324 upstream.

Laurent Pinchart reported that the Renesas R-Car H2 Lager board (r8a7790)
crashes during suspend tests.  Geert Uytterhoeven managed to reproduce the
issue on an M2-W Koelsch board (r8a7791):

  It occurs when the PME scan runs, once per second.  During PME scan, the
  PCI host bridge (rcar-pci) registers are accessed while its module clock
  has already been disabled, leading to the crash.

One reproducer is to configure s2ram to use "s2idle" instead of "deep"
suspend:

  # echo 0 > /sys/module/printk/parameters/console_suspend
  # echo s2idle > /sys/power/mem_sleep
  # echo mem > /sys/power/state

Another reproducer is to write either "platform" or "processors" to
/sys/power/pm_test.  It does not (or is less likely) to happen during full
system suspend ("core" or "none") because system suspend also disables
timers, and thus the workqueue handling PME scans no longer runs.  Geert
believes the issue may still happen in the small window between disabling
module clocks and disabling timers:

  # echo 0 > /sys/module/printk/parameters/console_suspend
  # echo platform > /sys/power/pm_test    # Or "processors"
  # echo mem > /sys/power/state

(Make sure CONFIG_PCI_RCAR_GEN2 and CONFIG_USB_OHCI_HCD_PCI are enabled.)

Rafael Wysocki agrees that PME scans should be suspended before the host
bridge registers become inaccessible.  To that end, queue the task on a
workqueue that gets frozen before devices suspend.

Rafael notes however that as a result, some wakeup events may be missed if
they are delivered via PME from a device without working IRQ (which hence
must be polled) and occur after the workqueue has been frozen.  If that
turns out to be an issue in practice, it may be possible to solve it by
calling pci_pme_list_scan() once directly from one of the host bridge's
pm_ops callbacks.

Stacktrace for posterity:

  PM: Syncing filesystems ... [   38.566237] done.
  PM: Preparing system for sleep (mem)
  Freezing user space processes ... [   38.579813] (elapsed 0.001 seconds) done.
  Freezing remaining freezable tasks ... (elapsed 0.001 seconds) done.
  PM: Suspending system (mem)
  PM: suspend of devices complete after 152.456 msecs
  PM: late suspend of devices complete after 2.809 msecs
  PM: noirq suspend of devices complete after 29.863 msecs
  suspend debug: Waiting for 5 second(s).
  Unhandled fault: asynchronous external abort (0x1211) at 0x00000000
  pgd = c0003000
  [00000000] *pgd=80000040004003, *pmd=00000000
  Internal error: : 1211 [#1] SMP ARM
  Modules linked in:
  CPU: 1 PID: 20 Comm: kworker/1:1 Not tainted
  4.9.0-rc1-koelsch-00011-g68db9bc814362e7f #3383
  Hardware name: Generic R8A7791 (Flattened Device Tree)
  Workqueue: events pci_pme_list_scan
  task: eb56e140 task.stack: eb58e000
  PC is at pci_generic_config_read+0x64/0x6c
  LR is at rcar_pci_cfg_base+0x64/0x84
  pc : [<c041d7b4>]    lr : [<c04309a0>]    psr: 600d0093
  sp : eb58fe98  ip : c041d750  fp : 00000008
  r10: c0e2283c  r9 : 00000000  r8 : 600d0013
  r7 : 00000008  r6 : eb58fed6  r5 : 00000002  r4 : eb58feb4
  r3 : 00000000  r2 : 00000044  r1 : 00000008  r0 : 00000000
  Flags: nZCv  IRQs off  FIQs on  Mode SVC_32  ISA ARM  Segment user
  Control: 30c5387d  Table: 6a9f6c80  DAC: 55555555
  Process kworker/1:1 (pid: 20, stack limit = 0xeb58e210)
  Stack: (0xeb58fe98 to 0xeb590000)
  fe80:                                                       00000002 00000044
  fea0: eb6f5800 c041d9b0 eb58feb4 00000008 00000044 00000000 eb78a000 eb78a000
  fec0: 00000044 00000000 eb9aff00 c0424bf0 eb78a000 00000000 eb78a000 c0e22830
  fee0: ea8a6fc0 c0424c5c eaae79c0 c0424ce0 eb55f380 c0e22838 eb9a9800 c0235fbc
  ff00: eb55f380 c0e22838 eb55f380 eb9a9800 eb9a9800 eb58e000 eb9a9824 c0e02100
  ff20: eb55f398 c02366c4 eb56e140 eb5631c0 00000000 eb55f380 c023641c 00000000
  ff40: 00000000 00000000 00000000 c023a928 cd105598 00000000 40506a34 eb55f380
  ff60: 00000000 00000000 dead4ead ffffffff ffffffff eb58ff74 eb58ff74 00000000
  ff80: 00000000 dead4ead ffffffff ffffffff eb58ff90 eb58ff90 eb58ffac eb5631c0
  ffa0: c023a844 00000000 00000000 c0206d68 00000000 00000000 00000000 00000000
  ffc0: 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000
  ffe0: 00000000 00000000 00000000 00000000 00000013 00000000 3a81336c 10ccd1dd
  [<c041d7b4>] (pci_generic_config_read) from [<c041d9b0>]
  (pci_bus_read_config_word+0x58/0x80)
  [<c041d9b0>] (pci_bus_read_config_word) from [<c0424bf0>]
  (pci_check_pme_status+0x34/0x78)
  [<c0424bf0>] (pci_check_pme_status) from [<c0424c5c>] (pci_pme_wakeup+0x28/0x54)
  [<c0424c5c>] (pci_pme_wakeup) from [<c0424ce0>] (pci_pme_list_scan+0x58/0xb4)
  [<c0424ce0>] (pci_pme_list_scan) from [<c0235fbc>]
  (process_one_work+0x1bc/0x308)
  [<c0235fbc>] (process_one_work) from [<c02366c4>] (worker_thread+0x2a8/0x3e0)
  [<c02366c4>] (worker_thread) from [<c023a928>] (kthread+0xe4/0xfc)
  [<c023a928>] (kthread) from [<c0206d68>] (ret_from_fork+0x14/0x2c)
  Code: ea000000 e5903000 f57ff04f e3a00000 (e5843000)
  ---[ end trace 667d43ba3aa9e589 ]---

Fixes: df17e62e5bff ("PCI: Add support for polling PME state on suspended legacy PCI devices")
Reported-and-tested-by: Laurent Pinchart <laurent.pinchart+renesas@ideasonboard.com>
Reported-and-tested-by: Geert Uytterhoeven <geert+renesas@glider.be>
Signed-off-by: Lukas Wunner <lukas@wunner.de>
Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
Reviewed-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
Acked-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
Cc: Mika Westerberg <mika.westerberg@linux.intel.com>
Cc: Niklas Söderlund <niklas.soderlund+renesas@ragnatech.se>
Cc: Simon Horman <horms+renesas@verge.net.au>
Cc: Yinghai Lu <yinghai@kernel.org>
Cc: Matthew Garrett <mjg59@srcf.ucam.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

PCI: Fix pci_mmap_fits() for HAVE_PCI_RESOURCE_TO_USER platforms

commit 6bccc7f426abd640f08d8c75fb22f99483f201b4 upstream.

In the PCI_MMAP_PROCFS case when the address being passed by the user is a
'user visible' resource address based on the bus window, and not the actual
contents of the resource, that's what we need to be checking it against.

Signed-off-by: David Woodhouse <dwmw@amazon.co.uk>
Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

tracing/kprobes: Enforce kprobes teardown after testing

commit 30e7d894c1478c88d50ce94ddcdbd7f9763d9cdd upstream.

Enabling the tracer selftest triggers occasionally the warning in
text_poke(), which warns when the to be modified page is not marked
reserved.

The reason is that the tracer selftest installs kprobes on functions marked
__init for testing. These probes are removed after the tests, but that
removal schedules the delayed kprobes_optimizer work, which will do the
actual text poke. If the work is executed after the init text is freed,
then the warning triggers. The bug can be reproduced reliably when the work
delay is increased.

Flush the optimizer work and wait for the optimizing/unoptimizing lists to
become empty before returning from the kprobes tracer selftest. That
ensures that all operations which were queued due to the probes removal
have completed.

Link: http://lkml.kernel.org/r/20170516094802.76a468bb@gandalf.local.home
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Acked-by: Masami Hiramatsu <mhiramat@kernel.org>
Fixes: 6274de498 ("kprobes: Support delayed unoptimizing")
Signed-off-by: Steven Rostedt (VMware) <rostedt@goodmis.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

osf_wait4(): fix infoleak

commit a8c39544a6eb2093c04afd5005b6192bd0e880c6 upstream.

failing sys_wait4() won't fill struct rusage...

Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

genirq: Fix chained interrupt data ordering

commit 2c4569ca26986d18243f282dd727da27e9adae4c upstream.

irq_set_chained_handler_and_data() sets up the chained interrupt and then
stores the handler data.

That's racy against an immediate interrupt which gets handled before the
store of the handler data happened. The handler will dereference a NULL
pointer and crash.

Cure it by storing handler data before installing the chained handler.

Reported-by: Borislav Petkov <bp@alien8.de>
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

uwb: fix device quirk on big-endian hosts

commit 41318a2b82f5d5fe1fb408f6d6e0b22aa557111d upstream.

Add missing endianness conversion when using the USB device-descriptor
idProduct field to apply a hardware quirk.

Fixes: 1ba47da52712 ("uwb: add the i1480 DFU driver")
Signed-off-by: Johan Hovold <johan@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

metag/uaccess: Check access_ok in strncpy_from_user

commit 3a158a62da0673db918b53ac1440845a5b64fd90 upstream.

The metag implementation of strncpy_from_user() doesn't validate the src
pointer, which could allow reading of arbitrary kernel memory. Add a
short access_ok() check to prevent that.

Its still possible for it to read across the user/kernel boundary, but
it will invariably reach a NUL character after only 9 bytes, leaking
only a static kernel address being loaded into D0Re0 at the beginning of
__start, which is acceptable for the immediate fix.

Reported-by: Al Viro <viro@zeniv.linux.org.uk>
Signed-off-by: James Hogan <james.hogan@imgtec.com>
Cc: linux-metag@vger.kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

metag/uaccess: Fix access_ok()

commit 8a8b56638bcac4e64cccc88bf95a0f9f4b19a2fb upstream.

The __user_bad() macro used by access_ok() has a few corner cases
noticed by Al Viro where it doesn't behave correctly:

 - The kernel range check has off by 1 errors which permit access to the
   first and last byte of the kernel mapped range.

 - The kernel range check ends at LINCORE_BASE rather than
   META_MEMORY_LIMIT, which is ineffective when the kernel is in global
   space (an extremely uncommon configuration).

There are a couple of other shortcomings here too:

 - Access to the whole of the other address space is permitted (i.e. the
   global half of the address space when the kernel is in local space).
   This isn't ideal as it could theoretically still contain privileged
   mappings set up by the bootloader.

 - The size argument is unused, permitting user copies which start on
   valid pages at the end of the user address range and cross the
   boundary into the kernel address space (e.g. addr = 0x3ffffff0, size
   > 0x10).

It isn't very convenient to add size checks when disallowing certain
regions, and it seems far safer to be sure and explicit about what
userland is able to access, so invert the logic to allow certain regions
instead, and fix the off by 1 errors and missing size checks. This also
allows the get_fs() == KERNEL_DS check to be more easily optimised into
the user address range case.

We now have 3 such allowed regions:

 - The user address range (incorporating the get_fs() == KERNEL_DS
   check).

 - NULL (some kernel code expects this to work, and we'll always catch
   the fault anyway).

 - The core code memory region.

Fixes: 373cd784d0fc ("metag: Memory handling")
Reported-by: Al Viro <viro@zeniv.linux.org.uk>
Signed-off-by: James Hogan <james.hogan@imgtec.com>
Cc: linux-metag@vger.kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

iommu/vt-d: Flush the IOTLB to get rid of the initial kdump mappings

commit f73a7eee900e95404b61408a23a1df5c5811704c upstream.

Ever since commit 091d42e43d ("iommu/vt-d: Copy translation tables from
old kernel") the kdump kernel copies the IOMMU context tables from the
previous kernel. Each device mappings will be destroyed once the driver
for the respective device takes over.

This unfortunately breaks the workflow of mapping and unmapping a new
context to the IOMMU. The mapping function assumes that either:

1) Unmapping did the proper IOMMU flushing and it only ever flush if the
   IOMMU unit supports caching invalid entries.
2) The system just booted and the initialization code took care of
   flushing all IOMMU caches.

This assumption is not true for the kdump kernel since the context
tables have been copied from the previous kernel and translations could
have been cached ever since. So make sure to flush the IOTLB as well
when we destroy these old copied mappings.

Cc: Joerg Roedel <joro@8bytes.org>
Cc: David Woodhouse <dwmw2@infradead.org>
Cc: David Woodhouse <dwmw@amazon.co.uk>
Cc: Anthony Liguori <aliguori@amazon.com>
Signed-off-by: KarimAllah Ahmed <karahmed@amazon.de>
Acked-by: David Woodhouse <dwmw@amazon.co.uk>
Fixes: 091d42e43d ("iommu/vt-d: Copy translation tables from old kernel")
Signed-off-by: Joerg Roedel <jroedel@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

staging: rtl8192e: rtl92e_get_eeprom_size Fix read size of EPROM_CMD.

commit 90be652c9f157d44b9c2803f902a8839796c090d upstream.

EPROM_CMD is 2 byte aligned on PCI map so calling with rtl92e_readl
will return invalid data so use rtl92e_readw.

The device is unable to select the right eeprom type.

Signed-off-by: Malcolm Priestley <tvboxspy@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

staging: rtl8192e: fix 2 byte alignment of register BSSIDR.

commit 867510bde14e7b7fc6dd0f50b48f6753cfbd227a upstream.

BSSIDR has two byte alignment on PCI ioremap correct the write
by swapping to 16 bits first.

This fixes a problem that the device associates fail because
the filter is not set correctly.

Signed-off-by: Malcolm Priestley <tvboxspy@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

mm/huge_memory.c: respect FOLL_FORCE/FOLL_COW for thp

commit 8310d48b125d19fcd9521d83b8293e63eb1646aa upstream.

In commit 19be0eaffa3a ("mm: remove gup_flags FOLL_WRITE games from
__get_user_pages()"), the mm code was changed from unsetting FOLL_WRITE
after a COW was resolved to setting the (newly introduced) FOLL_COW
instead.  Simultaneously, the check in gup.c was updated to still allow
writes with FOLL_FORCE set if FOLL_COW had also been set.

However, a similar check in huge_memory.c was forgotten.  As a result,
remote memory writes to ro regions of memory backed by transparent huge
pages cause an infinite loop in the kernel (handle_mm_fault sets
FOLL_COW and returns 0 causing a retry, but follow_trans_huge_pmd bails
out immidiately because `(flags & FOLL_WRITE) && !pmd_write(*pmd)` is
true.

While in this state the process is stil SIGKILLable, but little else
works (e.g.  no ptrace attach, no other signals).  This is easily
reproduced with the following code (assuming thp are set to always):

    #include <assert.h>
    #include <fcntl.h>
    #include <stdint.h>
    #include <stdio.h>
    #include <string.h>
    #include <sys/mman.h>
    #include <sys/stat.h>
    #include <sys/types.h>
    #include <sys/wait.h>
    #include <unistd.h>

    #define TEST_SIZE 5 * 1024 * 1024

    int main(void) {
      int status;
      pid_t child;
      int fd = open("/proc/self/mem", O_RDWR);
      void *addr = mmap(NULL, TEST_SIZE, PROT_READ,
                        MAP_ANONYMOUS | MAP_PRIVATE, 0, 0);
      assert(addr != MAP_FAILED);
      pid_t parent_pid = getpid();
      if ((child = fork()) == 0) {
        void *addr2 = mmap(NULL, TEST_SIZE, PROT_READ | PROT_WRITE,
                           MAP_ANONYMOUS | MAP_PRIVATE, 0, 0);
        assert(addr2 != MAP_FAILED);
        memset(addr2, 'a', TEST_SIZE);
        pwrite(fd, addr2, TEST_SIZE, (uintptr_t)addr);
        return 0;
      }
      assert(child == waitpid(child, &status, 0));
      assert(WIFEXITED(status) && WEXITSTATUS(status) == 0);
      return 0;
    }

Fix this by updating follow_trans_huge_pmd in huge_memory.c analogously
to the update in gup.c in the original commit.  The same pattern exists
in follow_devmap_pmd.  However, we should not be able to reach that
check with FOLL_COW set, so add WARN_ONCE to make sure we notice if we
ever do.

[akpm@linux-foundation.org: coding-style fixes]
Link: http://lkml.kernel.org/r/20170106015025.GA38411@juliacomputing.com
Signed-off-by: Keno Fischer <keno@juliacomputing.com>
Acked-by: Kirill A. Shutemov <kirill.shutemov@linux.intel.com>
Cc: Greg Thelen <gthelen@google.com>
Cc: Nicholas Piggin <npiggin@gmail.com>
Cc: Willy Tarreau <w@1wt.eu>
Cc: Oleg Nesterov <oleg@redhat.com>
Cc: Kees Cook <keescook@chromium.org>
Cc: Andy Lutomirski <luto@kernel.org>
Cc: Michal Hocko <mhocko@suse.com>
Cc: Hugh Dickins <hughd@google.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
[AmitP: Minor refactoring of upstream changes for linux-3.18.y,
        where follow_devmap_pmd() doesn't exist.]
Signed-off-by: Amit Pundir <amit.pundir@linaro.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

xc2028: Fix use-after-free bug properly

commit 22a1e7783e173ab3d86018eb590107d68df46c11 upstream.

The commit 8dfbcc4351a0 ("[media] xc2028: avoid use after free") tried
to address the reported use-after-free by clearing the reference.

However, it's clearing the wrong pointer; it sets NULL to
priv->ctrl.fname, but it's anyway overwritten by the next line
memcpy(&priv->ctrl, p, sizeof(priv->ctrl)).

OTOH, the actual code accessing the freed string is the strcmp() call
with priv->fname:
if (!firmware_name[0] && p->fname &&
    priv->fname && strcmp(p->fname, priv->fname))
free_firmware(priv);

where priv->fname points to the previous file name, and this was
already freed by kfree().

For fixing the bug properly, this patch does the following:

- Keep the copy of firmware file name in only priv->fname,
  priv->ctrl.fname isn't changed;
- The allocation is done only when the firmware gets loaded;
- The kfree() is called in free_firmware() commonly

Fixes: commit 8dfbcc4351a0 ('[media] xc2028: avoid use after free')
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
Signed-off-by: Amit Pundir <amit.pundir@linaro.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

arm64: documentation: document tagged pointer stack constraints

commit f0e421b1bf7af97f026e1bb8bfe4c5a7a8c08f42 upstream.

Some kernel features don't currently work if a task puts a non-zero
address tag in its stack pointer, frame pointer, or frame record entries
(FP, LR).

For example, with a tagged stack pointer, the kernel can't deliver
signals to the process, and the task is killed instead. As another
example, with a tagged frame pointer or frame records, perf fails to
generate call graphs or resolve symbols.

For now, just document these limitations, instead of finding and fixing
everything that doesn't work, as it's not known if anyone needs to use
tags in these places anyway.

In addition, as requested by Dave Martin, generalize the limitations
into a general kernel address tag policy, and refactor
tagged-pointers.txt to include it.

Fixes: d50240a5f6ce ("arm64: mm: permit use of tagged pointers at EL0")
Reviewed-by: Dave Martin <Dave.Martin@arm.com>
Acked-by: Will Deacon <will.deacon@arm.com>
Signed-off-by: Kristina Martsenko <kristina.martsenko@arm.com>
Signed-off-by: Catalin Marinas <catalin.marinas@arm.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

arm64: uaccess: ensure extension of access_ok() addr

commit a06040d7a791a9177581dcf7293941bd92400856 upstream.

Our access_ok() simply hands its arguments over to __range_ok(), which
implicitly assummes that the addr parameter is 64 bits wide. This isn't
necessarily true for compat code, which might pass down a 32-bit address
parameter.

In these cases, we don't have a guarantee that the address has been zero
extended to 64 bits, and the upper bits of the register may contain
unknown values, potentially resulting in a suprious failure.

Avoid this by explicitly casting the addr parameter to an unsigned long
(as is done on other architectures), ensuring that the parameter is
widened appropriately.

Fixes: 0aea86a2176c ("arm64: User access library functions")
Acked-by: Will Deacon <will.deacon@arm.com>
Signed-off-by: Mark Rutland <mark.rutland@arm.com>
Signed-off-by: Catalin Marinas <catalin.marinas@arm.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

arm64: xchg: hazard against entire exchange variable

commit fee960bed5e857eb126c4e56dd9ff85938356579 upstream.

The inline assembly in __XCHG_CASE() uses a +Q constraint to hazard
against other accesses to the memory location being exchanged. However,
the pointer passed to the constraint is a u8 pointer, and thus the
hazard only applies to the first byte of the location.

GCC can take advantage of this, assuming that other portions of the
location are unchanged, as demonstrated with the following test case:

union u {
unsigned long l;
unsigned int i[2];
};

unsigned long update_char_hazard(union u *u)
{
unsigned int a, b;

a = u->i[1];
asm ("str %1, %0" : "+Q" (*(char *)&u->l) : "r" (0UL));
b = u->i[1];

return a ^ b;
}

unsigned long update_long_hazard(union u *u)
{
unsigned int a, b;

a = u->i[1];
asm ("str %1, %0" : "+Q" (*(long *)&u->l) : "r" (0UL));
b = u->i[1];

return a ^ b;
}

The linaro 15.08 GCC 5.1.1 toolchain compiles the above as follows when
using -O2 or above:

0000000000000000 <update_char_hazard>:
   0: d2800001  mov x1, #0x0                    // #0
   4: f9000001  str x1, [x0]
   8: d2800000  mov x0, #0x0                    // #0
   c: d65f03c0  ret

0000000000000010 <update_long_hazard>:
  10: b9400401  ldr w1, [x0,#4]
  14: d2800002  mov x2, #0x0                    // #0
  18: f9000002  str x2, [x0]
  1c: b9400400  ldr w0, [x0,#4]
  20: 4a000020  eor w0, w1, w0
  24: d65f03c0  ret

This patch fixes the issue by passing an unsigned long pointer into the
+Q constraint, as we do for our cmpxchg code. This may hazard against
more than is necessary, but this is better than missing a necessary
hazard.

Fixes: 305d454aaa29 ("arm64: atomics: implement native {relaxed, acquire, release} atomics")
Acked-by: Will Deacon <will.deacon@arm.com>
Signed-off-by: Mark Rutland <mark.rutland@arm.com>
Signed-off-by: Catalin Marinas <catalin.marinas@arm.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

ARM: dts: at91: sama5d3_xplained: not all ADC channels are available

commit d3df1ec06353e51fc44563d2e7e18d42811af290 upstream.

Remove ADC channels that are not available by default on the sama5d3_xplained
board (resistor not populated) in order to not create confusion.

Signed-off-by: Ludovic Desroches <ludovic.desroches@microchip.com>
Acked-by: Nicolas Ferre <nicolas.ferre@microchip.com>
Signed-off-by: Alexandre Belloni <alexandre.belloni@free-electrons.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

ARM: dts: at91: sama5d3_xplained: fix ADC vref

commit 9cdd31e5913c1f86dce7e201b086155b3f24896b upstream.

The voltage reference for the ADC is not 3V but 3.3V since it is connected to
VDDANA.

Signed-off-by: Ludovic Desroches <ludovic.desroches@microchip.com>
Acked-by: Nicolas Ferre <nicolas.ferre@microchip.com>
Signed-off-by: Alexandre Belloni <alexandre.belloni@free-electrons.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>