5 years agoARM64: dts: rk3399: adjust idle-cost-data of EAS with idle state
Chen Liang [Thu, 8 Dec 2016 03:40:13 +0000 (11:40 +0800)]
ARM64: dts: rk3399: adjust idle-cost-data of EAS with idle state

Change-Id: I994371c6a3c2aa99ffd666047a1707754ac96290
Signed-off-by: Chen Liang <>
5 years agoFROMLIST: usb: dwc2: assert phy reset when waking up in rk3288 platform
Jacob Chen [Wed, 7 Dec 2016 09:29:06 +0000 (17:29 +0800)]
FROMLIST: usb: dwc2: assert phy reset when waking up in rk3288 platform

On the rk3288 USB host-only port (the one that's not the OTG-enabled
port) the PHY can get into a bad state when a wakeup is asserted (not
just a wakeup from full system suspend but also a wakeup from

We can get the PHY out of its bad state by asserting its "port reset",
but unfortunately that seems to assert a reset onto the USB bus so it
could confuse things if we don't actually deenumerate / reenumerate the

We can also get the PHY out of its bad state by fully resetting it using
the reset from the CRU (clock reset unit) in chip, which does a more full
reset.  The CRU-based reset appears to actually cause devices on the bus
to be removed and reinserted, which fixes the problem (albeit in a hacky

It's unfortunate that we need to do a full re-enumeration of devices at
wakeup time, but this is better than alternative of letting the bus get

Change-Id: I3120a38a7f646a9d244f04bd2dcfef7474a4a6d1
Signed-off-by: Randy Li <>
Signed-off-by: Jacob Chen <>
(am from

5 years agoFROMLIST: phy: rockchip-usb: use rockchip_usb_phy_reset to reset phy during wakeup
Jacob Chen [Wed, 7 Dec 2016 08:37:42 +0000 (16:37 +0800)]
FROMLIST: phy: rockchip-usb: use rockchip_usb_phy_reset to reset phy during wakeup

It is a hardware bug in RK3288, the only way to solve it is to
reset the phy.

Change-Id: Iad8f52b623df3c4460dc321bb55e9c3111455590
Signed-off-by: Randy Li <>
Acked-by: Rob Herring <>
Signed-off-by: Jacob Chen <>
 (am from

5 years agoFROMLIST: ARM: dts: rockchip: Point rk3288 dwc2 usb at the full PHY reset
Jacob Chen [Wed, 7 Dec 2016 08:34:39 +0000 (16:34 +0800)]
FROMLIST: ARM: dts: rockchip: Point rk3288 dwc2 usb at the full PHY reset

The "host1" port (AKA the dwc2 port that isn't the OTG port) on rk3288
has a hardware errata that causes everything to get confused when we get
a remote wakeup.  We'll use the reset that's in the CRU to reset the
port when it's in a bad state.

Note that we add the reset to both dwc2 controllers even though only one
has the errata in case we find some other use for this reset that's
unrelated to the current hardware errata.  Only the host port gets the
quirk property, though.

Change-Id: I472d33fb1db8b1a6b0c4fcea9ab31fd85b61af40
Signed-off-by: Randy Li <>
Signed-off-by: Jacob Chen <>
(am from

5 years agoarm64: dts: rk3399: add a opp-suspend property for cpu opp table
Finley Xiao [Wed, 30 Nov 2016 03:43:26 +0000 (11:43 +0800)]
arm64: dts: rk3399: add a opp-suspend property for cpu opp table

The opp who contains a opp-suspend property will be configured
during suspend or reboot.

Change-Id: I6b2eede43216435f568db6959127a6e84c8cd4c8
Signed-off-by: Finley Xiao <>
5 years agocpufreq: dt: change frequency to a specific value when cpufreq exits
Finley Xiao [Tue, 29 Nov 2016 12:23:13 +0000 (20:23 +0800)]
cpufreq: dt: change frequency to a specific value when cpufreq exits

Sometimes all cpus of big cluster are closed and its frequency
keep a high value, in order to reduce power and reset normally,
set frequency to a specific value after close all the cpus.

Change-Id: I88bce25812d1b0ff3f78a898cb161642a65cc523
Signed-off-by: Finley Xiao <>
5 years agoarm64: dts: rockchip: rk3399: add dp default mode for rk3399 box discrete vr
Luo wei [Mon, 5 Dec 2016 07:22:16 +0000 (15:22 +0800)]
arm64: dts: rockchip: rk3399: add dp default mode for rk3399 box discrete vr

Change-Id: If1af58e1654786ece68ed24c115ebca78462f62d
Signed-off-by: Luo wei <>
5 years agosoc: rockchip: power-domain: export idle request
Caesar Wang [Fri, 18 Nov 2016 08:24:20 +0000 (16:24 +0800)]
soc: rockchip: power-domain: export idle request

We need to put the power status of HEVC IP into IDLE unless
we can't reset that IP or the SoC would crash down.
rockchip_pmu_idle_request(dev, true)---> enter idle
rockchip_pmu_idle_request(dev, false)---> exit idle

Change-Id: I76733efd2de4f7ee183c1b6bd1545d60038ee31b
Signed-off-by: Caesar Wang <>
Signed-off-by: Jeffy Chen <>
Signed-off-by: Randy Li <>
5 years agoCHROMIUM: drm/rockchip: Respect page offset in IOMMU mmap
Ørjan Eide [Mon, 5 Sep 2016 11:49:12 +0000 (13:49 +0200)]
CHROMIUM: drm/rockchip: Respect page offset in IOMMU mmap

When mapping buffers through the PRIME DMA-buf mmap path we might be
given an offset which has to be respected. The DRM GEM mmap path already
takes care of zeroing out the fake mmap offset, so we can just make the
IOMMU mmap implementation always respect the offset.


Change-Id: Iec83e720b24ddd35a92f3df8312015bc5af798f0
Signed-off-by: rjan Eide <>
Signed-off-by: Tomasz Figa <>
Reviewed-by: Daniel Kurtz <>
Signed-off-by: Randy Li <>
5 years agoCHROMIUM: drm/rockchip: Respect page offset for PRIME mmap calls
Ørjan Eide [Mon, 5 Sep 2016 11:49:12 +0000 (13:49 +0200)]
CHROMIUM: drm/rockchip: Respect page offset for PRIME mmap calls

When mapping external DMA-bufs through the PRIME mmap call, we might be
given an offset which has to be respected. However for the internal DRM
GEM mmap path, we have to ignore the fake mmap offset used to identify
the buffer only. Currently the code always zeroes out vma->vm_pgoff,
which breaks the former.

This patch fixes the problem by moving the vm_pgoff assignment to a
function that is used only for GEM mmap path, so that the PRIME path
retains the original offset.


Change-Id: Iec6e996707b0fe7e95a019423a944d98c80beaab
Signed-off-by: rjan Eide <>
Signed-off-by: Tomasz Figa <>
Reviewed-by: Daniel Kurtz <>
Signed-off-by: Randy Li <>
5 years agoCHROMIUM: drm/rockchip: Call drm_gem_object_release() to destroy GEM base
Tomasz Figa [Wed, 14 Sep 2016 11:50:29 +0000 (20:50 +0900)]
CHROMIUM: drm/rockchip: Call drm_gem_object_release() to destroy GEM base

When converting the driver to use shmem-backed GEMs for IOMMU-enabled
systems, we forgot to add calls to drm_gem_object_release(), which gave
us a quite nice memory leak. This patch adds the missing calls.

Fixes: f11d5f0 ("FROMLIST: drm/rockchip: Do not use DMA mapping API if
attached to IOMMU domain")

TEST=while true; do backlight_dbus_tool --set --percent=0 && sleep 8 &&
 backlight_dbus_tool --set --percent=100 && sleep 3 ; done

Signed-off-by: Tomasz Figa <>
Reviewed-by: Douglas Anderson <>
Reviewed-by: Daniel Kurtz <>

Change-Id: I3c7b21ed22cfb38f512150f76fced3b0cc2b296d
Signed-off-by: Randy Li <>
5 years agoCHROMIUM: drm/rockchip: Fix the call to drm_gem_put_pages()
Tomasz Figa [Thu, 8 Sep 2016 09:52:00 +0000 (18:52 +0900)]
CHROMIUM: drm/rockchip: Fix the call to drm_gem_put_pages()

When freeing the buffer we don't have any means of determining if the
buffer was read or written, so we must assume both and pass true for
both arguments of drm_gem_put_pages(). Let's fix the code which
currently passes false.

TEST=while true; do backlight_dbus_tool --set --percent=0 && sleep 8 &&
 backlight_dbus_tool --set --percent=100 && sleep 3 ; done

Change-Id: I7da2fd81e7e728e0ef242837b70819c4a3aee7bf
Signed-off-by: Tomasz Figa <>
Reviewed-by: Daniel Kurtz <>
Signed-off-by: Randy Li <>
5 years agoFROMLIST: drm/rockchip: Use common IOMMU API to attach devices
Shunqian Zheng [Tue, 21 Jun 2016 04:34:40 +0000 (13:34 +0900)]
FROMLIST: drm/rockchip: Use common IOMMU API to attach devices

Rockchip DRM used the arm special API, arm_iommu_*(), to attach
iommu for ARM32 SoCs. This patch convert to common iommu API
so it would support ARM64 like RK3399.

Since previous patch added support for direct IOMMU address space
management, there is no need to use DMA API anymore and this patch wires
things to use the new method.

Signed-off-by: Shunqian Zheng <>
Signed-off-by: Tomasz Figa <>
(am from

TEST=boot to ui on Gru

Commit-Ready: Tomasz Figa <>
Tested-by: Tomasz Figa <>
Reviewed-by: Tomasz Figa <>

Change-Id: Ide4ce9f74fd431f0b7cd480e38b683f833733b40
Signed-off-by: Randy Li <>
5 years agoUPSTREAM: drm/rockchip: support non-iommu buffer path
Mark Yao [Tue, 19 Apr 2016 02:13:27 +0000 (10:13 +0800)]
UPSTREAM: drm/rockchip: support non-iommu buffer path

Some rockchip vop not support iommu, need use non-iommu
buffer for it. And if we get iommu issues, we can compare
the issues with non-iommu path, that would help the debug.


Change-Id: I843f087281300359b07faac1de156cd648325b45
Signed-off-by: Mark Yao <>
(cherry picked from commit 2d90d477430d3a20df74f2d11c21378e64e1d508)

5 years agoUPSTREAM: drm/rockchip: don't leak iommu mapping
John Keeping [Tue, 5 Apr 2016 13:50:32 +0000 (14:50 +0100)]
UPSTREAM: drm/rockchip: don't leak iommu mapping

arm_iommu_attach_device() takes its own reference to the mapping we give
it.  Since we do not keep a reference to the mapping ourselves, we must
release it before returning.

Also fix the error path, which fails to release the mapping if it has
called arm_iommu_detach_device() since that clears archdata.mapping.


Change-Id: Ia20334afbce08ece5a3238a7b0786547ec0cafb2
Signed-off-by: John Keeping <>
Signed-off-by: Randy Li <>
Signed-off-by: Huang, Tao <>
(cherry picked from commit 69b007968e7519cf1e44920f4578054c9e0fbdc3)

5 years agoUPSTREAM: drm/rockchip: remove redundant statement
John Keeping [Tue, 5 Apr 2016 13:50:31 +0000 (14:50 +0100)]
UPSTREAM: drm/rockchip: remove redundant statement

The call to arm_iommu_detach_device() on the previous line sets
dev->archdata.mapping to NULL so this call is always a no-op.

Change-Id: I09b41c284c61885fb4b989a64839e96bcc316aa6
Signed-off-by: John Keeping <>
Signed-off-by: Huang, Tao <>
(cherry picked from commit aa1ac27f48de0ed94d5a104e15b5ab62b5deb236)

5 years agoCHROMIUM: rockchip: support prime import sg table
Haixia Shi [Fri, 29 Jan 2016 00:23:04 +0000 (16:23 -0800)]
CHROMIUM: rockchip: support prime import sg table

The prime fd to handle ioctl was not used with rockchip before. Support
was added in order to pass graphics_Gbm and to support potential uses
within Chrome OS (e.g. zero-copy video decode, camera).

Difference from kernel 3.14 implementation:
- prime_import_sg_table passes dma-buf as argument instead of size
- need to handle import sg_table for both DMA and IOMMU paths

TEST=test_that graphics_Gbm on kevin

Tested-by: Haixia Shi <>
Commit-Queue: Haixia Shi <>
Trybot-Ready: Haixia Shi <>
Reviewed-by: Haixia Shi <>
Reviewed-by: Stéphane Marchesin <>

Change-Id: I7aae5b0e227de61ac17adf98996152da8db097d2
Signed-off-by: Randy Li <>
5 years agoFROMLIST: drm/rockchip: Do not use DMA mapping API if attached to IOMMU domain
Tomasz Figa [Tue, 21 Jun 2016 04:34:39 +0000 (13:34 +0900)]
FROMLIST: drm/rockchip: Do not use DMA mapping API if attached to IOMMU domain

The API is not suitable for subsystems consisting of multiple devices
and requires severe hacks to use it. To mitigate this, this patch
implements allocation and address space management locally by using
helpers provided by DRM framework, like other DRM drivers do, e.g.

This patch should not introduce any functional changes until the driver
is made to attach subdevices into an IOMMU domain with the generic IOMMU
API, which will happen in following patch. Based heavily on GEM
implementation of Tegra DRM driver.

Signed-off-by: Tomasz Figa <>
Signed-off-by: Shunqian Zheng <>
(am from

TEST=boot to ui on Gru

Commit-Ready: Tomasz Figa <>
Tested-by: Tomasz Figa <>
Reviewed-by: Tomasz Figa <>
Reviewed-by: Daniel Kurtz <>

Change-Id: I599b2551e8e8000024894426e4e19d7543af3b0a
Signed-off-by: Randy Li <>
5 years agoRevert "drm/rockchip: rewrite IOMMU support code"
Jeffy Chen [Fri, 18 Nov 2016 13:04:59 +0000 (21:04 +0800)]
Revert "drm/rockchip: rewrite IOMMU support code"

This reverts commit b435f1a281e8a9ff1f1013318a1147949e55130a.


Change-Id: I15d2d598514c2878a574219fe2268ee8d530d6e2
Signed-off-by: Randy Li <>
5 years agoRevert "drm/rockchip: gem: import dma_buf to gem"
Jeffy Chen [Fri, 18 Nov 2016 13:17:31 +0000 (21:17 +0800)]
Revert "drm/rockchip: gem: import dma_buf to gem"

This reverts commit a05932da07ecc0a214bd24322ffbcec79be5d5e0.

Change-Id: I91f9efb690fe4f82b5bf34debca6f7612bbd9e4e
Signed-off-by: Randy Li <>
5 years agovideo: build rockchip video driver modules independently
Randy Li [Mon, 31 Oct 2016 08:28:42 +0000 (16:28 +0800)]
video: build rockchip video driver modules independently

There is not need to force the video driver dependency in parent

Also there would be too many entries in a menu, I create a submenu
for them.

Change-Id: Id3bd54fa6274b1311ff6b20f95ffeb0d1851d9f9
Signed-off-by: Randy Li <>
5 years agoARM: dts: rockchip: switch to vpu-service in asus miniarm
Randy Li [Thu, 24 Nov 2016 02:23:17 +0000 (10:23 +0800)]
ARM: dts: rockchip: switch to vpu-service in asus miniarm

We decide to offer the video support in old way.

Change-Id: I0b30f7b2b559596ee124b8558cd54e0ff090ab79
Signed-off-by: Randy Li <>
5 years agoARM: dts: rockchip: rk3288 hevc using same clk freqs as android
Randy Li [Wed, 30 Nov 2016 03:21:51 +0000 (11:21 +0800)]
ARM: dts: rockchip: rk3288 hevc using same clk freqs as android

If you meet a performance issue, I would suggest you to set
500MHZ for ACLK_HEVC at rk3288. It could solve the decoding quite
slow for some video resources.

Change-Id: Iedc2bc90fb13ae89d204dc6b5f5d897acae6812d
Signed-off-by: Randy Li <>
5 years agoMerge branch 'linux-linaro-lsk-v4.4-android' of git://
Huang, Tao [Tue, 6 Dec 2016 12:58:56 +0000 (20:58 +0800)]
Merge branch 'linux-linaro-lsk-v4.4-android' of git://

* linux-linaro-lsk-v4.4-android: (61 commits)
  Linux 4.4.36
  scsi: mpt3sas: Unblock device after controller reset
  flow_dissect: call init_default_flow_dissectors() earlier
  mei: fix return value on disconnection
  mei: me: fix place for kaby point device ids.
  mei: me: disable driver on SPT SPS firmware
  drm/radeon: Ensure vblank interrupt is enabled on DPMS transition to on
  mpi: Fix NULL ptr dereference in mpi_powm() [ver #3]
  parisc: Also flush data TLB in flush_icache_page_asm
  parisc: Fix race in pci-dma.c
  parisc: Fix races in parisc_setup_cache_timing()
  NFSv4.x: hide array-bounds warning
  apparmor: fix change_hat not finding hat after policy replacement
  cfg80211: limit scan results cache size
  tile: avoid using clocksource_cyc2ns with absolute cycle count
  scsi: mpt3sas: Fix secure erase premature termination
  Fix USB CB/CBI storage devices with CONFIG_VMAP_STACK=y
  USB: serial: ftdi_sio: add support for TI CC3200 LaunchPad
  USB: serial: cp210x: add ID for the Zone DPMX
  usb: chipidea: move the lock initialization to core file

5 years agoUPSTREAM: iommu/dma: Implement scatterlist segment merging
Robin Murphy [Mon, 11 Apr 2016 11:32:31 +0000 (12:32 +0100)]
UPSTREAM: iommu/dma: Implement scatterlist segment merging

Stop wasting IOVA space by over-aligning scatterlist segments for a
theoretical worst-case segment boundary mask, and instead take the real
limits into account to merge consecutive segments wherever appropriate,
so our callers can benefit from getting back nicely simplified lists.

This also represents the last piece of functionality wanted by users of
the current arch/arm implementation, thus brings us a small step closer
to converting that over to the common code.

Change-Id: Ie583142efece02dfa6678d5e8607b5bc7266f50c
Signed-off-by: Robin Murphy <>
Signed-off-by: Joerg Roedel <>
Signed-off-by: Huang, Tao <>
(cherry picked from commit 809eac54cdd62c67afea1e17080e681dfa33dc09)

5 years agocamera: rockchip: camsys driver v0.0x21.8
dalong.zhang [Mon, 5 Dec 2016 10:10:09 +0000 (18:10 +0800)]
camera: rockchip: camsys driver v0.0x21.8

Change-Id: Ib0fed5df3edfe4dae042999e71c50d67a490f88e
Signed-off-by: dalong.zhang <>
5 years agoARM64: dts: rk3399: sapphire: add uboot logo support for android next
Mark Yao [Tue, 6 Dec 2016 10:18:08 +0000 (18:18 +0800)]
ARM64: dts: rk3399: sapphire: add uboot logo support for android next

Change-Id: If206ba4d67f3609e56fe0bfe1f4063e0616ba50a
Signed-off-by: Mark Yao <>
5 years agoARM: dts: rockchip: rk3288: add qos node
Elaine Zhang [Mon, 5 Dec 2016 07:27:59 +0000 (15:27 +0800)]
ARM: dts: rockchip: rk3288: add qos node

when pd power on/off, the qos regs need to save and restore.

Change-Id: Idd6854022fb25538e82238f25a650a687e918a56
Signed-off-by: Elaine Zhang <>
5 years agoMerge branch 'linux-linaro-lsk-v4.4' into linux-linaro-lsk-v4.4-android
Alex Shi [Tue, 6 Dec 2016 05:01:29 +0000 (13:01 +0800)]
Merge branch 'linux-linaro-lsk-v4.4' into linux-linaro-lsk-v4.4-android

keep low scan freq in android in net/wireless/scan.c

5 years agoarm64: dts: rk3399-sapphire-excavator-linux: add fiq_debugger node
Zorro Liu [Mon, 5 Dec 2016 01:55:29 +0000 (09:55 +0800)]
arm64: dts: rk3399-sapphire-excavator-linux: add fiq_debugger node

Change-Id: I6d2c97a06a7c252eec47ab3b1e686b1799780171
Signed-off-by: Zorro Liu <>
5 years agohid: rkvr: add 0x110 key event used for touchpad
Luo wei [Mon, 5 Dec 2016 06:25:54 +0000 (14:25 +0800)]
hid: rkvr: add 0x110 key event used for touchpad

Change-Id: I8a57bbddcf1115414c1567aa05c4c19ecb1ce02c
Signed-off-by: Luo wei <>
5 years agoarm64: dts: rockchip: enable isp node for rk3399-mid-818-android-next
Bin Yang [Mon, 5 Dec 2016 02:21:56 +0000 (10:21 +0800)]
arm64: dts: rockchip: enable isp node for rk3399-mid-818-android-next

Change-Id: Ic6d489ab7a65cf9ec3c7d03b00541f946cb57b84
Signed-off-by: Bin Yang <>
5 years agoarm64: dts: rockchip: Add RK3399 Excavator dts for drm
Bin Yang [Thu, 1 Dec 2016 01:25:19 +0000 (09:25 +0800)]
arm64: dts: rockchip: Add RK3399 Excavator dts for drm

Change-Id: I8da4f4bc4a903e4e3702f6e5dbedb72cd5ee627f
Signed-off-by: Cody Xie <>
Signed-off-by: Bin Yang <>
5 years agoUPSTREAM: PCI: rockchip: Indent an if statement
Dan Carpenter [Wed, 12 Oct 2016 10:54:09 +0000 (13:54 +0300)]
UPSTREAM: PCI: rockchip: Indent an if statement

The if statement wasn't intended.  Add a tab.

Change-Id: I33e4fce2cc2052dc45c3c7a2617586cdd6a6b664
Signed-off-by: Dan Carpenter <>
Acked-by: Shawn Lin <>
Signed-off-by: Bjorn Helgaas <>
Signed-off-by: Shawn Lin <>
(cherry picked from commit 08015ee0ff8a221bdc9ee66cfcc7e3379e9bcd28)

5 years ago Merge tag 'v4.4.36' into linux-linaro-lsk-v4.4
Alex Shi [Mon, 5 Dec 2016 04:01:22 +0000 (12:01 +0800)]
 Merge tag 'v4.4.36' into linux-linaro-lsk-v4.4

 This is the 4.4.36 stable release

5 years agoMerge branch 'linux-linaro-lsk-v4.4-android' of git://
Huang, Tao [Fri, 2 Dec 2016 12:27:31 +0000 (20:27 +0800)]
Merge branch 'linux-linaro-lsk-v4.4-android' of git://

* linux-linaro-lsk-v4.4-android: (315 commits)
  Linux 4.4.35
  netfilter: nft_dynset: fix element timeout for HZ != 1000
  IB/cm: Mark stale CM id's whenever the mad agent was unregistered
  IB/uverbs: Fix leak of XRC target QPs
  IB/core: Avoid unsigned int overflow in sg_alloc_table
  IB/mlx5: Fix fatal error dispatching
  IB/mlx5: Use cache line size to select CQE stride
  IB/mlx4: Fix create CQ error flow
  IB/mlx4: Check gid_index return value
  PM / sleep: don't suspend parent when async child suspend_{noirq, late} fails
  PM / sleep: fix device reference leak in test_suspend
  uwb: fix device reference leaks
  mfd: core: Fix device reference leak in mfd_clone_cell
  iwlwifi: pcie: fix SPLC structure parsing
  rtc: omap: Fix selecting external osc
  clk: mmp: mmp2: fix return value check in mmp2_clk_init()
  clk: mmp: pxa168: fix return value check in pxa168_clk_init()
  clk: mmp: pxa910: fix return value check in pxa910_clk_init()
  drm/amdgpu: Attach exclusive fence to prime exported bo's. (v5)
  crypto: caam - do not register AES-XTS mode on LP units

Change-Id: Ic14c01a22a5e8a0356d6c0ef6bcca7bc6cad6b4b

5 years agoRevert "FROMLIST: PM / sleep: don't suspend parent when async child suspend_{noirq...
Huang, Tao [Fri, 2 Dec 2016 11:53:55 +0000 (19:53 +0800)]
Revert "FROMLIST: PM / sleep: don't suspend parent when async child suspend_{noirq,late} fails"

This reverts commit 11b2dcefd88e8ae01a11c6df55d91206ac226c52.
Fixed by 04c0800c73b2 ("PM / sleep: don't suspend parent when
async child suspend_{noirq, late} fails").

5 years agorockchip/vcodec: drop needless devm_clk_put
Huang, Tao [Fri, 2 Dec 2016 08:18:33 +0000 (16:18 +0800)]
rockchip/vcodec: drop needless devm_clk_put

Also make sure clk is NULL if get failed.

Change-Id: I102175a108c6e7a91948d82cce97c1a1d88a071e
Signed-off-by: Huang, Tao <>
5 years agoARM64: dts: rk3399-android-next: default use vopb for primary display
Mark Yao [Fri, 2 Dec 2016 11:09:58 +0000 (19:09 +0800)]
ARM64: dts: rk3399-android-next: default use vopb for primary display

Change-Id: I2655905aa3f63e19c8367701af36f462d399d2f3
Signed-off-by: Mark Yao <>
5 years agodrm/rockchip: vop: skip config timing on vblank
Mark Yao [Fri, 2 Dec 2016 09:34:53 +0000 (17:34 +0800)]
drm/rockchip: vop: skip config timing on vblank

Change-Id: I7aace5e26f6c9889c9e216f7b7233ec7e5530776
Signed-off-by: Mark Yao <>
5 years agodrm/rockchip: vop: fix display logo flash with line flag
Mark Yao [Fri, 2 Dec 2016 03:27:13 +0000 (11:27 +0800)]
drm/rockchip: vop: fix display logo flash with line flag

Use standy with dsp_hold intr would effect display timing,
Some display controller can't not allow this, such as edp,
edp panel would flash with it.

Use line flag instead it seems good.

Change-Id: Iecf818c0dbd5a7833e6cec0da60fe3e693b3dc9d
Signed-off-by: Mark Yao <>
5 years agoCHROMIUM: drm/rockchip: Clear interrupt status bits before enabling
Tomasz Figa [Thu, 8 Sep 2016 06:32:54 +0000 (15:32 +0900)]
CHROMIUM: drm/rockchip: Clear interrupt status bits before enabling

The enable register only masks the raw status bits to signal CPU
interrupt only for enabled interrupts. The status bits are activated
regardless of the enable register. This means that we might have an old
interrupt event queued, which we are not interested in. To avoid getting
a spurious interrupt signalled, we have to clear the old bit before we
update the enable register.

TEST=while true; do backlight_dbus_tool --set --percent=0 && sleep 8 && backlight_dbus_tool --set --percent=100 && sleep 3 ; done

Change-Id: I1b8286097f3ba102663ee3a7566fd96492e12d26
Signed-off-by: Tomasz Figa <>
Reviewed-by: Daniel Kurtz <>
Signed-off-by: Mark Yao <>
5 years agoFROMLIST: drm/rockchip: vop: export line flag function
Yakir Yang [Thu, 2 Jun 2016 12:16:22 +0000 (20:16 +0800)]
FROMLIST: drm/rockchip: vop: export line flag function

VOP have integrated a hardware counter which indicate the exact display
line that vop is scanning. And if we're interested in a specific line,
we can set the line number to vop line_flag register, and then vop would
generate a line_flag interrupt for it.

For example eDP PSR function is interested in the vertical blanking
period, then driver could set the line number to zero.

This patch have exported a symbol that allow other driver to listen the
line flag event with given timeout limit:
- rockchip_drm_wait_line_flag()

TEST=Success to call rockchip_drm_wait_line_flag()

Change-Id: Id7605bada87c8ead0e549d4ff113ee49d29ad126
Signed-off-by: Yakir Yang <>
(am from
Signed-off-by: Mark Yao <>
Commit-Ready: Sean Paul <>
Tested-by: Sean Paul <>
Reviewed-by: Sean Paul <>
5 years agodrm/rockchip: add loader protect ops to drm connector
Mark Yao [Thu, 1 Dec 2016 02:25:49 +0000 (10:25 +0800)]
drm/rockchip: add loader protect ops to drm connector

Change-Id: Iae26ac5c994727b98db045ae00c62d641f31c4b1
Signed-off-by: Mark Yao <>
5 years agoLinux 4.4.36
Greg Kroah-Hartman [Fri, 2 Dec 2016 08:09:18 +0000 (09:09 +0100)]
Linux 4.4.36

5 years agoscsi: mpt3sas: Unblock device after controller reset
Suganath Prabu S [Thu, 17 Nov 2016 10:45:58 +0000 (16:15 +0530)]
scsi: mpt3sas: Unblock device after controller reset

commit 7ff723ad0f87feba43dda45fdae71206063dd7d4 upstream.

While issuing any ATA passthrough command to firmware the driver will
block the device. But it will unblock the device only if the I/O
completes through the ISR path. If a controller reset occurs before
command completion the device will remain in blocked state.

Make sure we unblock the device following a controller reset if an ATA
passthrough command was queued.

[mkp: clarified patch description]

Fixes: ac6c2a93bd07 ("mpt3sas: Fix for SATA drive in blocked state, after diag reset")
Signed-off-by: Suganath Prabu S <>
Signed-off-by: Martin K. Petersen <>
Signed-off-by: Greg Kroah-Hartman <>
5 years agoflow_dissect: call init_default_flow_dissectors() earlier
Eric Dumazet [Tue, 22 Nov 2016 19:17:30 +0000 (11:17 -0800)]
flow_dissect: call init_default_flow_dissectors() earlier

commit c9b8af1330198ae241cd545e1f040019010d44d9 upstream.

Andre Noll reported panics after my recent fix (commit 34fad54c2537
"net: __skb_flow_dissect() must cap its return value")

After some more headaches, Alexander root caused the problem to
init_default_flow_dissectors() being called too late, in case
a network driver like IGB is not a module and receives DHCP message
very early.

Fix is to call init_default_flow_dissectors() much earlier,
as it is a core infrastructure and does not depend on another
kernel service.

Fixes: 06635a35d13d4 ("flow_dissect: use programable dissector in skb_flow_dissect and friends")
Signed-off-by: Eric Dumazet <>
Reported-by: Andre Noll <>
Diagnosed-by: Alexander Duyck <>
Signed-off-by: David S. Miller <>
Signed-off-by: Greg Kroah-Hartman <>
5 years agomei: fix return value on disconnection
Tomas Winkler [Wed, 22 Jun 2016 21:25:31 +0000 (00:25 +0300)]
mei: fix return value on disconnection

commit 2d4d5481e2d6f93b25fcfb13a9f20bbfbf54266a upstream.

Correct errno on client disconnection is -ENODEV not -EBUSY

Signed-off-by: Tomas Winkler <>
Signed-off-by: Alexander Usyskin <>
Signed-off-by: Greg Kroah-Hartman <>
5 years agomei: me: fix place for kaby point device ids.
Tomas Winkler [Tue, 29 Nov 2016 12:44:45 +0000 (14:44 +0200)]
mei: me: fix place for kaby point device ids.

This is fix of the backported patch only, it places
KBL DIDs on correct place to easy on backporting of
further DIDs.

Fixes: 5c99f32c461c ('mei: me: add kaby point device ids')
Signed-off-by: Tomas Winkler <>
Signed-off-by: Greg Kroah-Hartman <>
5 years agomei: me: disable driver on SPT SPS firmware
Tomas Winkler [Wed, 20 Jul 2016 07:24:02 +0000 (10:24 +0300)]
mei: me: disable driver on SPT SPS firmware

commit 8c57cac1457f3125a5d13dc03635c0708c61bff0 upstream.

Sunrise Point PCH with SPS Firmware doesn't expose working
MEI interface, we need to quirk it out.
The SPS Firmware is identifiable only on the first PCI function
of the device.

Tested-by: Sujith Pandel <>
Signed-off-by: Tomas Winkler <>
Signed-off-by: Greg Kroah-Hartman <>
5 years agodrm/radeon: Ensure vblank interrupt is enabled on DPMS transition to on
Michel Dänzer [Tue, 29 Nov 2016 09:40:20 +0000 (18:40 +0900)]
drm/radeon: Ensure vblank interrupt is enabled on DPMS transition to on

NOTE: This patch only applies to 4.5.y or older kernels. With newer
kernels, this problem cannot happen because the driver now uses
drm_crtc_vblank_on/off instead of drm_vblank_pre/post_modeset[0]. I
consider this patch safer for older kernels than backporting the API
change, because drm_crtc_vblank_on/off had various issues in older
kernels, and I'm not sure all fixes for those have been backported to
all stable branches where this patch could be applied.


Fixes the vblank interrupt being disabled when it should be on, which
can cause at least the following symptoms:

* Hangs when running 'xset dpms force off' in a GNOME session with
  gnome-shell using DRI2.
* RandR 1.4 slave outputs freezing with garbage displayed using
  xf86-video-ati 7.8.0 or newer.

[0] See upstream commit:

commit 777e3cbc791f131806d9bf24b3325637c7fc228d
Author: Daniel Vetter <>
Date:   Thu Jan 21 11:08:57 2016 +0100

    drm/radeon: Switch to drm_vblank_on/off

Reported-and-Tested-by: Max Staudt <>
Reviewed-by: Daniel Vetter <>
Reviewed-by: Alex Deucher <>
Signed-off-by: Michel Dänzer <>
5 years agompi: Fix NULL ptr dereference in mpi_powm() [ver #3]
Andrey Ryabinin [Thu, 24 Nov 2016 13:23:10 +0000 (13:23 +0000)]
mpi: Fix NULL ptr dereference in mpi_powm() [ver #3]

commit f5527fffff3f002b0a6b376163613b82f69de073 upstream.

This fixes CVE-2016-8650.

If mpi_powm() is given a zero exponent, it wants to immediately return
either 1 or 0, depending on the modulus.  However, if the result was
initalised with zero limb space, no limbs space is allocated and a
NULL-pointer exception ensues.

Fix this by allocating a minimal amount of limb space for the result when
the 0-exponent case when the result is 1 and not touching the limb space
when the result is 0.

This affects the use of RSA keys and X.509 certificates that carry them.

BUG: unable to handle kernel NULL pointer dereference at           (null)
IP: [<ffffffff8138ce5d>] mpi_powm+0x32/0x7e6
Oops: 0002 [#1] SMP
Modules linked in:
CPU: 3 PID: 3014 Comm: keyctl Not tainted 4.9.0-rc6-fscache+ #278
Hardware name: ASUS All Series/H97-PLUS, BIOS 2306 10/09/2014
task: ffff8804011944c0 task.stack: ffff880401294000
RIP: 0010:[<ffffffff8138ce5d>]  [<ffffffff8138ce5d>] mpi_powm+0x32/0x7e6
RSP: 0018:ffff880401297ad8  EFLAGS: 00010212
RAX: 0000000000000000 RBX: ffff88040868bec0 RCX: ffff88040868bba0
RDX: ffff88040868b260 RSI: ffff88040868bec0 RDI: ffff88040868bee0
RBP: ffff880401297ba8 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000047 R11: ffffffff8183b210 R12: 0000000000000000
R13: ffff8804087c7600 R14: 000000000000001f R15: ffff880401297c50
FS:  00007f7a7918c700(0000) GS:ffff88041fb80000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000000000000000 CR3: 0000000401250000 CR4: 00000000001406e0
 ffff88040868bec0 0000000000000020 ffff880401297b00 ffffffff81376cd4
 0000000000000100 ffff880401297b10 ffffffff81376d12 ffff880401297b30
 ffffffff81376f37 0000000000000100 0000000000000000 ffff880401297ba8
Call Trace:
 [<ffffffff81376cd4>] ? __sg_page_iter_next+0x43/0x66
 [<ffffffff81376d12>] ? sg_miter_get_next_page+0x1b/0x5d
 [<ffffffff81376f37>] ? sg_miter_next+0x17/0xbd
 [<ffffffff8138ba3a>] ? mpi_read_raw_from_sgl+0xf2/0x146
 [<ffffffff8132a95c>] rsa_verify+0x9d/0xee
 [<ffffffff8132acca>] ? pkcs1pad_sg_set_buf+0x2e/0xbb
 [<ffffffff8132af40>] pkcs1pad_verify+0xc0/0xe1
 [<ffffffff8133cb5e>] public_key_verify_signature+0x1b0/0x228
 [<ffffffff8133d974>] x509_check_for_self_signed+0xa1/0xc4
 [<ffffffff8133cdde>] x509_cert_parse+0x167/0x1a1
 [<ffffffff8133d609>] x509_key_preparse+0x21/0x1a1
 [<ffffffff8133c3d7>] asymmetric_key_preparse+0x34/0x61
 [<ffffffff812fc9f3>] key_create_or_update+0x145/0x399
 [<ffffffff812fe227>] SyS_add_key+0x154/0x19e
 [<ffffffff81001c2b>] do_syscall_64+0x80/0x191
 [<ffffffff816825e4>] entry_SYSCALL64_slow_path+0x25/0x25
Code: 56 41 55 41 54 53 48 81 ec a8 00 00 00 44 8b 71 04 8b 42 04 4c 8b 67 18 45 85 f6 89 45 80 0f 84 b4 06 00 00 85 c0 75 2f 41 ff ce <49> c7 04 24 01 00 00 00 b0 01 75 0b 48 8b 41 18 48 83 38 01 0f
RIP  [<ffffffff8138ce5d>] mpi_powm+0x32/0x7e6
 RSP <ffff880401297ad8>
CR2: 0000000000000000
---[ end trace d82015255d4a5d8d ]---

Basically, this is a backport of a libgcrypt patch:;a=patch;h=6e1adb05d290aeeb1c230c763970695f4a538526

Fixes: cdec9cb5167a ("crypto: GnuPG based MPI lib - source files (part 1)")
Signed-off-by: Andrey Ryabinin <>
Signed-off-by: David Howells <>
cc: Dmitry Kasatkin <>
Signed-off-by: James Morris <>
Signed-off-by: Greg Kroah-Hartman <>
5 years agoparisc: Also flush data TLB in flush_icache_page_asm
John David Anglin [Fri, 25 Nov 2016 01:18:14 +0000 (20:18 -0500)]
parisc: Also flush data TLB in flush_icache_page_asm

commit 5035b230e7b67ac12691ed3b5495bbb617027b68 upstream.

This is the second issue I noticed in reviewing the parisc TLB code.

The fic instruction may use either the instruction or data TLB in
flushing the instruction cache.  Thus, on machines with a split TLB, we
should also flush the data TLB after setting up the temporary alias

Although this has no functional impact, I changed the pdtlb and pitlb
instructions to consistently use the index register %r0.  These
instructions do not support integer displacements.

Tested on rp3440 and c8000.

Signed-off-by: John David Anglin <>
Signed-off-by: Helge Deller <>
Signed-off-by: Greg Kroah-Hartman <>
5 years agoparisc: Fix race in pci-dma.c
John David Anglin [Fri, 25 Nov 2016 01:06:32 +0000 (20:06 -0500)]
parisc: Fix race in pci-dma.c

commit c0452fb9fb8f49c7d68ab9fa0ad092016be7b45f upstream.

We are still troubled by occasional random segmentation faults and
memory memory corruption on SMP machines.  The causes quite a few
package builds to fail on the Debian buildd machines for parisc.  When
gcc-6 failed to build three times in a row, I looked again at the TLB
related code.  I found a couple of issues.  This is the first.

In general, we need to ensure page table updates and corresponding TLB
purges are atomic.  The attached patch fixes an instance in pci-dma.c
where the page table update was not guarded by the TLB lock.

Tested on rp3440 and c8000.  So far, no further random segmentation
faults have been observed.

Signed-off-by: John David Anglin <>
Signed-off-by: Helge Deller <>
Signed-off-by: Greg Kroah-Hartman <>
5 years agoparisc: Fix races in parisc_setup_cache_timing()
John David Anglin [Mon, 21 Nov 2016 02:12:36 +0000 (21:12 -0500)]
parisc: Fix races in parisc_setup_cache_timing()

commit 741dc7bf1c7c7d93b853bb55efe77baa27e1b0a9 upstream.

Helge reported to me the following startup crash:

[    0.000000] Linux version 4.8.0-1-parisc64-smp ( (gcc version 5.4.1 20161019 (GCC) ) #1 SMP Debian 4.8.7-1 (2016-11-13)
[    0.000000] The 64-bit Kernel has started...
[    0.000000] Kernel default page size is 4 KB. Huge pages enabled with 1 MB physical and 2 MB virtual size.
[    0.000000] Determining PDC firmware type: System Map.
[    0.000000] model 9000/785/J5000
[    0.000000] Total Memory: 2048 MB
[    0.000000] Memory: 2018528K/2097152K available (9272K kernel code, 3053K rwdata, 1319K rodata, 1024K init, 840K bss, 78624K reserved, 0K cma-reserved)
[    0.000000] virtual kernel memory layout:
[    0.000000]     vmalloc : 0x0000000000008000 - 0x000000003f000000   (1007 MB)
[    0.000000]     memory  : 0x0000000040000000 - 0x00000000c0000000   (2048 MB)
[    0.000000]       .init : 0x0000000040100000 - 0x0000000040200000   (1024 kB)
[    0.000000]       .data : 0x0000000040b0e000 - 0x0000000040f533e0   (4372 kB)
[    0.000000]       .text : 0x0000000040200000 - 0x0000000040b0e000   (9272 kB)
[    0.768910] Brought up 1 CPUs
[    0.992465] NET: Registered protocol family 16
[    2.429981] Releasing cpu 1 now, hpa=fffffffffffa2000
[    2.635751] CPU(s): 2 out of 2 PA8500 (PCX-W) at 440.000000 MHz online
[    2.726692] Setting cache flush threshold to 1024 kB
[    2.729932] Not-handled unaligned insn 0x43ffff80
[    2.798114] Setting TLB flush threshold to 140 kB
[    2.928039] Unaligned handler failed, ret = -1
[    3.000419]       _______________________________
[    3.000419]      < Your System ate a SPARC! Gah! >
[    3.000419]       -------------------------------
[    3.000419]              \   ^__^
[    3.000419]                  (__)\       )\/\
[    3.000419]                   U  ||----w |
[    3.000419]                      ||     ||
[    9.340055] CPU: 1 PID: 0 Comm: swapper/1 Not tainted 4.8.0-1-parisc64-smp #1 Debian 4.8.7-1
[    9.448082] task: 00000000bfd48060 task.stack: 00000000bfd50000
[    9.528040]
[   10.760029] IASQ: 0000000000000000 0000000000000000 IAOQ: 000000004025d154 000000004025d158
[   10.868052]  IIR: 43ffff80    ISR: 0000000000340000  IOR: 000001ff54150960
[   10.960029]  CPU:        1   CR30: 00000000bfd50000 CR31: 0000000011111111
[   11.052057]  ORIG_R28: 000000004021e3b4
[   11.100045]  IAOQ[0]: irq_exit+0x94/0x120
[   11.152062]  IAOQ[1]: irq_exit+0x98/0x120
[   11.208031]  RP(r2): irq_exit+0xb8/0x120
[   11.256074] Backtrace:
[   11.288067]  [<00000000402cd944>] cpu_startup_entry+0x1e4/0x598
[   11.368058]  [<0000000040109528>] smp_callin+0x2c0/0x2f0
[   11.436308]  [<00000000402b53fc>] update_curr+0x18c/0x2d0
[   11.508055]  [<00000000402b73b8>] dequeue_entity+0x2c0/0x1030
[   11.584040]  [<00000000402b3cc0>] set_next_entity+0x80/0xd30
[   11.660069]  [<00000000402c1594>] pick_next_task_fair+0x614/0x720
[   11.740085]  [<000000004020dd34>] __schedule+0x394/0xa60
[   11.808054]  [<000000004020e488>] schedule+0x88/0x118
[   11.876039]  [<0000000040283d3c>] rescuer_thread+0x4d4/0x5b0
[   11.948090]  [<000000004028fc4c>] kthread+0x1ec/0x248
[   12.016053]  [<0000000040205020>] end_fault_vector+0x20/0xc0
[   12.092239]  [<00000000402050c0>] _switch_to_ret+0x0/0xf40
[   12.164044]
[   12.184036] CPU: 1 PID: 0 Comm: swapper/1 Not tainted 4.8.0-1-parisc64-smp #1 Debian 4.8.7-1
[   12.244040] Backtrace:
[   12.244040]  [<000000004021c480>] show_stack+0x68/0x80
[   12.244040]  [<00000000406f332c>] dump_stack+0xec/0x168
[   12.244040]  [<000000004021c74c>] die_if_kernel+0x25c/0x430
[   12.244040]  [<000000004022d320>] handle_unaligned+0xb48/0xb50
[   12.244040]
[   12.632066] ---[ end trace 9ca05a7215c7bbb2 ]---
[   12.692036] Kernel panic - not syncing: Attempted to kill the idle task!

We have the insn 0x43ffff80 in IIR but from IAOQ we should have:
   4025d150:   0f f3 20 df     ldd,s r19(r31),r31
   4025d154:   0f 9f 00 9c     ldw r31(ret0),ret0
   4025d158:   bf 80 20 58     cmpb,*<> r0,ret0,4025d18c <irq_exit+0xcc>

Cpu0 has just completed running parisc_setup_cache_timing:

[    2.429981] Releasing cpu 1 now, hpa=fffffffffffa2000
[    2.635751] CPU(s): 2 out of 2 PA8500 (PCX-W) at 440.000000 MHz online
[    2.726692] Setting cache flush threshold to 1024 kB
[    2.729932] Not-handled unaligned insn 0x43ffff80
[    2.798114] Setting TLB flush threshold to 140 kB
[    2.928039] Unaligned handler failed, ret = -1

From the backtrace, cpu1 is in smp_callin:

void __init smp_callin(void)
       int slave_id = cpu_now_booting;


       flush_cache_all_local(); /* start with known state */

       local_irq_enable();  /* Interrupts have been off until now */


So, it has just flushed its caches and the TLB. It would seem either the
flushes in parisc_setup_cache_timing or smp_callin have corrupted kernel

The attached patch reworks parisc_setup_cache_timing to remove the races
in setting the cache and TLB flush thresholds. It also corrects the
number of bytes flushed in the TLB calculation.

The patch flushes the cache and TLB on cpu0 before starting the
secondary processors so that they are started from a known state.

Tested with a few reboots on c8000.

Signed-off-by: John David Anglin <>
Signed-off-by: Helge Deller <>
Signed-off-by: Greg Kroah-Hartman <>
5 years agoNFSv4.x: hide array-bounds warning
Arnd Bergmann [Tue, 22 Nov 2016 20:50:52 +0000 (21:50 +0100)]
NFSv4.x: hide array-bounds warning

commit d55b352b01bc78fbc3d1bb650140668b87e58bf9 upstream.

A correct bugfix introduced a harmless warning that shows up with gcc-7:

fs/nfs/callback.c: In function 'nfs_callback_up':
fs/nfs/callback.c:214:14: error: array subscript is outside array bounds [-Werror=array-bounds]

What happens here is that the 'minorversion == 0' check tells the
compiler that we assume minorversion can be something other than 0,
but when CONFIG_NFS_V4_1 is disabled that would be invalid and
result in an out-of-bounds access.

The added check for IS_ENABLED(CONFIG_NFS_V4_1) tells gcc that this
really can't happen, which makes the code slightly smaller and also
avoids the warning.

The bugfix that introduced the warning is marked for stable backports,
we want this one backported to the same releases.

Fixes: 98b0f80c2396 ("NFSv4.x: Fix a refcount leak in nfs_callback_up_net")
Signed-off-by: Arnd Bergmann <>
Signed-off-by: Anna Schumaker <>
Signed-off-by: Greg Kroah-Hartman <>
5 years agoapparmor: fix change_hat not finding hat after policy replacement
John Johansen [Thu, 1 Sep 2016 04:10:06 +0000 (21:10 -0700)]
apparmor: fix change_hat not finding hat after policy replacement

commit 3d40658c977769ce2138f286cf131537bf68bdfe upstream.

After a policy replacement, the task cred may be out of date and need
to be updated. However change_hat is using the stale profiles from
the out of date cred resulting in either: a stale profile being applied
or, incorrect failure when searching for a hat profile as it has been
migrated to the new parent profile.

Fixes: 01e2b670aa898a39259bc85c78e3d74820f4d3b6 (failure to find hat)
Fixes: 898127c34ec03291c86f4ff3856d79e9e18952bc (stale policy being applied)
Signed-off-by: John Johansen <>
Signed-off-by: James Morris <>
Signed-off-by: Greg Kroah-Hartman <>
5 years agocfg80211: limit scan results cache size
Johannes Berg [Tue, 15 Nov 2016 11:05:11 +0000 (12:05 +0100)]
cfg80211: limit scan results cache size

commit 9853a55ef1bb66d7411136046060bbfb69c714fa upstream.

It's possible to make scanning consume almost arbitrary amounts
of memory, e.g. by sending beacon frames with random BSSIDs at
high rates while somebody is scanning.

Limit the number of BSS table entries we're willing to cache to
1000, limiting maximum memory usage to maybe 4-5MB, but lower
in practice - that would be the case for having both full-sized
beacon and probe response frames for each entry; this seems not
possible in practice, so a limit of 1000 entries will likely be
closer to 0.5 MB.

Signed-off-by: Johannes Berg <>
Signed-off-by: Greg Kroah-Hartman <>
5 years agotile: avoid using clocksource_cyc2ns with absolute cycle count
Chris Metcalf [Wed, 16 Nov 2016 16:18:05 +0000 (11:18 -0500)]
tile: avoid using clocksource_cyc2ns with absolute cycle count

commit e658a6f14d7c0243205f035979d0ecf6c12a036f upstream.

For large values of "mult" and long uptimes, the intermediate
result of "cycles * mult" can overflow 64 bits.  For example,
the tile platform calls clocksource_cyc2ns with a 1.2 GHz clock;
we have mult = 853, and after 208.5 days, we overflow 64 bits.

Since clocksource_cyc2ns() is intended to be used for relative
cycle counts, not absolute cycle counts, performance is more
importance than accepting a wider range of cycle values.  So,
just use mult_frac() directly in tile's sched_clock().

Commit 4cecf6d401a0 ("sched, x86: Avoid unnecessary overflow
in sched_clock") by Salman Qazi results in essentially the same
generated code for x86 as this change does for tile.  In fact,
a follow-on change by Salman introduced mult_frac() and switched
to using it, so the C code was largely identical at that point too.

Peter Zijlstra then added mul_u64_u32_shr() and switched x86
to use it.  This is, in principle, better; by optimizing the
64x64->64 multiplies to be 32x32->64 multiplies we can potentially
save some time.  However, the compiler piplines the 64x64->64
multiplies pretty well, and the conditional branch in the generic
mul_u64_u32_shr() causes some bubbles in execution, with the
result that it's pretty much a wash.  If tilegx provided its own
implementation of mul_u64_u32_shr() without the conditional branch,
we could potentially save 3 cycles, but that seems like small gain
for a fair amount of additional build scaffolding; no other platform
currently provides a mul_u64_u32_shr() override, and tile doesn't
currently have an <asm/div64.h> header to put the override in.

Additionally, gcc currently has an optimization bug that prevents
it from recognizing the opportunity to use a 32x32->64 multiply,
and so the result would be no better than the existing mult_frac()
until such time as the compiler is fixed.

For now, just using mult_frac() seems like the right answer.

Signed-off-by: Chris Metcalf <>
Signed-off-by: Greg Kroah-Hartman <>
5 years agoscsi: mpt3sas: Fix secure erase premature termination
Andrey Grodzovsky [Thu, 10 Nov 2016 14:35:27 +0000 (09:35 -0500)]
scsi: mpt3sas: Fix secure erase premature termination

commit 18f6084a989ba1b38702f9af37a2e4049a924be6 upstream.

This is a work around for a bug with LSI Fusion MPT SAS2 when perfoming
secure erase. Due to the very long time the operation takes, commands
issued during the erase will time out and will trigger execution of the
abort hook. Even though the abort hook is called for the specific
command which timed out, this leads to entire device halt
(scsi_state terminated) and premature termination of the secure erase.

Set device state to busy while ATA passthrough commands are in progress.

[mkp: hand applied to 4.9/scsi-fixes, tweaked patch description]

Signed-off-by: Andrey Grodzovsky <>
Acked-by: Sreekanth Reddy <>
Cc: <>
Cc: Sathya Prakash <>
Cc: Chaitra P B <>
Cc: Suganath Prabu Subramani <>
Cc: Sreekanth Reddy <>
Cc: Hannes Reinecke <>
Signed-off-by: Martin K. Petersen <>
Signed-off-by: Greg Kroah-Hartman <>
5 years agoFix USB CB/CBI storage devices with CONFIG_VMAP_STACK=y
Petr Vandrovec [Thu, 10 Nov 2016 21:57:14 +0000 (13:57 -0800)]
Fix USB CB/CBI storage devices with CONFIG_VMAP_STACK=y

commit 2ce9d2272b98743b911196c49e7af5841381c206 upstream.

Some code (all error handling) submits CDBs that are allocated
on the stack.  This breaks with CB/CBI code that tries to create
URB directly from SCSI command buffer - which happens to be in
vmalloced memory with vmalloced kernel stacks.

Let's make copy of the command in usb_stor_CB_transport.

Signed-off-by: Petr Vandrovec <>
Acked-by: Alan Stern <>
Signed-off-by: Greg Kroah-Hartman <>
5 years agoUSB: serial: ftdi_sio: add support for TI CC3200 LaunchPad
Doug Brown [Sat, 5 Nov 2016 04:18:20 +0000 (21:18 -0700)]
USB: serial: ftdi_sio: add support for TI CC3200 LaunchPad

commit 9bfef729a3d11f04d12788d749a3ce6b47645734 upstream.

This patch adds support for the TI CC3200 LaunchPad board, which uses a
custom USB vendor ID and product ID. Channel A is used for JTAG, and
channel B is used for a UART.

Signed-off-by: Doug Brown <>
Signed-off-by: Johan Hovold <>
Signed-off-by: Greg Kroah-Hartman <>
5 years agoUSB: serial: cp210x: add ID for the Zone DPMX
Paul Jakma [Wed, 16 Nov 2016 10:13:49 +0000 (10:13 +0000)]
USB: serial: cp210x: add ID for the Zone DPMX

commit 2ab13292d7a314fa45de0acc808e41aaad31989c upstream.

The BRIM Brothers Zone DPMX is a bicycle powermeter. This ID is for the USB
serial interface in its charging dock for the control pods, via which some
settings for the pods can be modified.

Signed-off-by: Paul Jakma <>
Cc: Barry Redmond <>
Signed-off-by: Johan Hovold <>
Signed-off-by: Greg Kroah-Hartman <>
5 years agousb: chipidea: move the lock initialization to core file
Peter Chen [Tue, 15 Nov 2016 10:05:33 +0000 (18:05 +0800)]
usb: chipidea: move the lock initialization to core file

commit a5d906bb261cde5f881a949d3b0fbaa285dcc574 upstream.

This can fix below dump when the lock is accessed at host
mode due to it is not initialized.

[   46.119638] INFO: trying to register non-static key.
[   46.124643] the code is fine but needs lockdep annotation.
[   46.130144] turning off the locking correctness validator.
[   46.135659] CPU: 0 PID: 690 Comm: cat Not tainted 4.9.0-rc3-00079-g4b75f1d #1210
[   46.143075] Hardware name: Freescale i.MX6 SoloX (Device Tree)
[   46.148923] Backtrace:
[   46.151448] [<c010c460>] (dump_backtrace) from [<c010c658>] (show_stack+0x18/0x1c)
[   46.159038]  r7:edf52000
[   46.161412]  r6:60000193
[   46.163967]  r5:00000000
[   46.165035]  r4:c0e25c2c

[   46.169109] [<c010c640>] (show_stack) from [<c03f58a4>] (dump_stack+0xb4/0xe8)
[   46.176362] [<c03f57f0>] (dump_stack) from [<c016d690>] (register_lock_class+0x4fc/0x56c)
[   46.184554]  r10:c0e25d24
[   46.187014]  r9:edf53e70
[   46.189569]  r8:c1642444
[   46.190637]  r7:ee9da024
[   46.193191]  r6:00000000
[   46.194258]  r5:00000000
[   46.196812]  r4:00000000
[   46.199185]  r3:00000001

[   46.203259] [<c016d194>] (register_lock_class) from [<c0171294>] (__lock_acquire+0x80/0x10f0)
[   46.211797]  r10:c0e25d24
[   46.214257]  r9:edf53e70
[   46.216813]  r8:ee9da024
[   46.217880]  r7:c1642444
[   46.220435]  r6:edcd1800
[   46.221502]  r5:60000193
[   46.224057]  r4:00000000

[   46.227953] [<c0171214>] (__lock_acquire) from [<c01726c0>] (lock_acquire+0x74/0x94)
[   46.235710]  r10:00000001
[   46.238169]  r9:edf53e70
[   46.240723]  r8:edf53f80
[   46.241790]  r7:00000001
[   46.244344]  r6:00000001
[   46.245412]  r5:60000193
[   46.247966]  r4:00000000

[   46.251866] [<c017264c>] (lock_acquire) from [<c096c8fc>] (_raw_spin_lock_irqsave+0x40/0x54)
[   46.260319]  r7:ee1c6a00
[   46.262691]  r6:c062a570
[   46.265247]  r5:20000113
[   46.266314]  r4:ee9da014

[   46.270393] [<c096c8bc>] (_raw_spin_lock_irqsave) from [<c062a570>] (ci_port_test_show+0x2c/0x70)
[   46.279280]  r6:eebd2000
[   46.281652]  r5:ee9da010
[   46.284207]  r4:ee9da014

[   46.286810] [<c062a544>] (ci_port_test_show) from [<c0248d04>] (seq_read+0x1ac/0x4f8)
[   46.294655]  r9:edf53e70
[   46.297028]  r8:edf53f80
[   46.299583]  r7:ee1c6a00
[   46.300650]  r6:00000001
[   46.303205]  r5:00000000
[   46.304273]  r4:eebd2000
[   46.306850] [<c0248b58>] (seq_read) from [<c039e864>] (full_proxy_read+0x54/0x6c)
[   46.314348]  r10:00000000
[   46.316808]  r9:c0a6ad30
[   46.319363]  r8:edf53f80
[   46.320430]  r7:00020000
[   46.322986]  r6:b6de3000
[   46.324053]  r5:ee1c6a00
[   46.326607]  r4:c0248b58

[   46.330505] [<c039e810>] (full_proxy_read) from [<c021ec98>] (__vfs_read+0x34/0x118)
[   46.338262]  r9:edf52000
[   46.340635]  r8:c0107fc4
[   46.343190]  r7:00020000
[   46.344257]  r6:edf53f80
[   46.346812]  r5:c039e810
[   46.347879]  r4:ee1c6a00
[   46.350447] [<c021ec64>] (__vfs_read) from [<c021fbd0>] (vfs_read+0x8c/0x11c)
[   46.357597]  r9:edf52000
[   46.359969]  r8:c0107fc4
[   46.362524]  r7:edf53f80
[   46.363592]  r6:b6de3000
[   46.366147]  r5:ee1c6a00
[   46.367214]  r4:00020000
[   46.369782] [<c021fb44>] (vfs_read) from [<c0220a4c>] (SyS_read+0x4c/0xa8)
[   46.376672]  r8:c0107fc4
[   46.379045]  r7:00020000
[   46.381600]  r6:b6de3000
[   46.382667]  r5:ee1c6a00
[   46.385222]  r4:ee1c6a00

[   46.387817] [<c0220a00>] (SyS_read) from [<c0107e20>] (ret_fast_syscall+0x0/0x1c)
[   46.395314]  r7:00000003
[   46.397687]  r6:b6de3000
[   46.400243]  r5:00020000
[   46.401310]  r4:00020000

Fixes: 26c696c678c4 ("USB: Chipidea: rename struct ci13xxx variables from udc to ci")
Signed-off-by: Peter Chen <>
Signed-off-by: Greg Kroah-Hartman <>
5 years agoKVM: x86: check for pic and ioapic presence before use
Radim Krčmář [Wed, 23 Nov 2016 20:25:48 +0000 (21:25 +0100)]
KVM: x86: check for pic and ioapic presence before use

commit df492896e6dfb44fd1154f5402428d8e52705081 upstream.

Split irqchip allows pic and ioapic routes to be used without them being
created, which results in NULL access.  Check for NULL and avoid it.
(The setup is too racy for a nicer solutions.)

Found by syzkaller:

  general protection fault: 0000 [#1] SMP DEBUG_PAGEALLOC KASAN
  Dumping ftrace buffer:
     (ftrace buffer empty)
  Modules linked in:
  CPU: 3 PID: 11923 Comm: kworker/3:2 Not tainted 4.9.0-rc5+ #27
  Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Bochs 01/01/2011
  Workqueue: events irqfd_inject
  task: ffff88006a06c7c0 task.stack: ffff880068638000
  RIP: 0010:[...]  [...] __lock_acquire+0xb35/0x3380 kernel/locking/lockdep.c:3221
  RSP: 0000:ffff88006863ea20  EFLAGS: 00010006
  RAX: dffffc0000000000 RBX: dffffc0000000000 RCX: 0000000000000000
  RDX: 0000000000000039 RSI: 0000000000000000 RDI: 1ffff1000d0c7d9e
  RBP: ffff88006863ef58 R08: 0000000000000001 R09: 0000000000000000
  R10: 00000000000001c8 R11: 0000000000000000 R12: ffff88006a06c7c0
  R13: 0000000000000001 R14: ffffffff8baab1a0 R15: 0000000000000001
  FS:  0000000000000000(0000) GS:ffff88006d100000(0000) knlGS:0000000000000000
  CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
  CR2: 00000000004abdd0 CR3: 000000003e2f2000 CR4: 00000000000026e0
   ffffffff894d0098 1ffff1000d0c7d56 ffff88006863ecd0 dffffc0000000000
   ffff88006a06c7c0 0000000000000000 ffff88006863ecf8 0000000000000082
   0000000000000000 ffffffff815dd7c1 ffffffff00000000 ffffffff00000000
  Call Trace:
   [...] lock_acquire+0x2a2/0x790 kernel/locking/lockdep.c:3746
   [...] __raw_spin_lock include/linux/spinlock_api_smp.h:144
   [...] _raw_spin_lock+0x38/0x50 kernel/locking/spinlock.c:151
   [...] spin_lock include/linux/spinlock.h:302
   [...] kvm_ioapic_set_irq+0x4c/0x100 arch/x86/kvm/ioapic.c:379
   [...] kvm_set_ioapic_irq+0x8f/0xc0 arch/x86/kvm/irq_comm.c:52
   [...] kvm_set_irq+0x239/0x640 arch/x86/kvm/../../../virt/kvm/irqchip.c:101
   [...] irqfd_inject+0xb4/0x150 arch/x86/kvm/../../../virt/kvm/eventfd.c:60
   [...] process_one_work+0xb40/0x1ba0 kernel/workqueue.c:2096
   [...] worker_thread+0x214/0x18a0 kernel/workqueue.c:2230
   [...] kthread+0x328/0x3e0 kernel/kthread.c:209
   [...] ret_from_fork+0x2a/0x40 arch/x86/entry/entry_64.S:433

Reported-by: Dmitry Vyukov <>
Fixes: 49df6397edfc ("KVM: x86: Split the APIC from the rest of IRQCHIP.")
Signed-off-by: Radim Krčmář <>
Signed-off-by: Greg Kroah-Hartman <>
5 years agoKVM: x86: drop error recovery in em_jmp_far and em_ret_far
Radim Krčmář [Wed, 23 Nov 2016 20:15:00 +0000 (21:15 +0100)]
KVM: x86: drop error recovery in em_jmp_far and em_ret_far

commit 2117d5398c81554fbf803f5fd1dc55eb78216c0c upstream.

em_jmp_far and em_ret_far assumed that setting IP can only fail in 64
bit mode, but syzkaller proved otherwise (and SDM agrees).
Code segment was restored upon failure, but it was left uninitialized
outside of long mode, which could lead to a leak of host kernel stack.
We could have fixed that by always saving and restoring the CS, but we
take a simpler approach and just break any guest that manages to fail
as the error recovery is error-prone and modern CPUs don't need emulator
for this.

Found by syzkaller:

  WARNING: CPU: 2 PID: 3668 at arch/x86/kvm/emulate.c:2217 em_ret_far+0x428/0x480
  Kernel panic - not syncing: panic_on_warn set ...

  CPU: 2 PID: 3668 Comm: syz-executor Not tainted 4.9.0-rc4+ #49
  Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Bochs 01/01/2011
  Call Trace:
   [...] __dump_stack lib/dump_stack.c:15
   [...] dump_stack+0xb3/0x118 lib/dump_stack.c:51
   [...] panic+0x1b7/0x3a3 kernel/panic.c:179
   [...] __warn+0x1c4/0x1e0 kernel/panic.c:542
   [...] warn_slowpath_null+0x2c/0x40 kernel/panic.c:585
   [...] em_ret_far+0x428/0x480 arch/x86/kvm/emulate.c:2217
   [...] em_ret_far_imm+0x17/0x70 arch/x86/kvm/emulate.c:2227
   [...] x86_emulate_insn+0x87a/0x3730 arch/x86/kvm/emulate.c:5294
   [...] x86_emulate_instruction+0x520/0x1ba0 arch/x86/kvm/x86.c:5545
   [...] emulate_instruction arch/x86/include/asm/kvm_host.h:1116
   [...] complete_emulated_io arch/x86/kvm/x86.c:6870
   [...] complete_emulated_mmio+0x4e9/0x710 arch/x86/kvm/x86.c:6934
   [...] kvm_arch_vcpu_ioctl_run+0x3b7a/0x5a90 arch/x86/kvm/x86.c:6978
   [...] kvm_vcpu_ioctl+0x61e/0xdd0 arch/x86/kvm/../../../virt/kvm/kvm_main.c:2557
   [...] vfs_ioctl fs/ioctl.c:43
   [...] do_vfs_ioctl+0x18c/0x1040 fs/ioctl.c:679
   [...] SYSC_ioctl fs/ioctl.c:694
   [...] SyS_ioctl+0x8f/0xc0 fs/ioctl.c:685
   [...] entry_SYSCALL_64_fastpath+0x1f/0xc2

Reported-by: Dmitry Vyukov <>
Fixes: d1442d85cc30 ("KVM: x86: Handle errors when RIP is set during far jumps")
Signed-off-by: Radim Krčmář <>
Signed-off-by: Greg Kroah-Hartman <>
5 years agoiommu/vt-d: Fix IOMMU lookup for SR-IOV Virtual Functions
Ashok Raj [Fri, 21 Oct 2016 22:32:05 +0000 (15:32 -0700)]
iommu/vt-d: Fix IOMMU lookup for SR-IOV Virtual Functions

commit 1c387188c60f53b338c20eee32db055dfe022a9b upstream.

The VT-d specification (§8.3.3) says:
    ‘Virtual Functions’ of a ‘Physical Function’ are under the scope
    of the same remapping unit as the ‘Physical Function’.

The BIOS is not required to list all the possible VFs in the scope
tables, and arguably *shouldn't* make any attempt to do so, since there
could be a huge number of them.

This has been broken basically for ever — the VF is never going to match
against a specific unit's scope, so it ends up being assigned to the
INCLUDE_ALL IOMMU. Which was always actually correct by coincidence, but
now we're looking at Root-Complex integrated devices with SR-IOV support
it's going to start being wrong.

Fix it to simply use pci_physfn() before doing the lookup for PCI devices.

Signed-off-by: Sainath Grandhi <>
Signed-off-by: Ashok Raj <>
Signed-off-by: David Woodhouse <>
Signed-off-by: Greg Kroah-Hartman <>
5 years agoiommu/vt-d: Fix PASID table allocation
David Woodhouse [Mon, 12 Sep 2016 02:49:11 +0000 (10:49 +0800)]
iommu/vt-d: Fix PASID table allocation

commit 910170442944e1f8674fd5ddbeeb8ccd1877ea98 upstream.

Somehow I ended up with an off-by-three error in calculating the size of
the PASID and PASID State tables, which triggers allocations failures as
those tables unfortunately have to be physically contiguous.

In fact, even the *correct* maximum size of 8MiB is problematic and is
wont to lead to allocation failures. Since I have extracted a promise
that this *will* be fixed in hardware, I'm happy to limit it on the
current hardware to a maximum of 0x20000 PASIDs, which gives us 1MiB
tables — still not ideal, but better than before.

Reported by Mika Kuoppala <> and also by
Xunlei Pang <> who submitted a simpler patch to fix
only the allocation (and not the free) to the "correct" limit... which
was still problematic.

Signed-off-by: David Woodhouse <>
Signed-off-by: Greg Kroah-Hartman <>
5 years agodrm/analogix: dp: remove some function which cause loader logo flash
Mark Yao [Thu, 1 Dec 2016 08:59:40 +0000 (16:59 +0800)]
drm/analogix: dp: remove some function which cause loader logo flash

Change-Id: I95c75702a15cd8fb5da0939c7e40a9e08ed362ff
Signed-off-by: Mark Yao <>
5 years agodrm/rockchip: boot_logo: ignore display route when it's not available
Mark Yao [Thu, 1 Dec 2016 06:54:06 +0000 (14:54 +0800)]
drm/rockchip: boot_logo: ignore display route when it's not available

Change-Id: I093b4edeb17c8b1159220618a43f7552070c6001
Signed-off-by: Mark Yao <>
5 years agoARM64: dts: rk3399-android-next: enable uboot charge display
Mark Yao [Thu, 1 Dec 2016 02:29:28 +0000 (10:29 +0800)]
ARM64: dts: rk3399-android-next: enable uboot charge display

Change-Id: I686a0ff43b39206e286fbd9c275c4b2d70f08b63
Signed-off-by: Mark Yao <>
5 years agoARM64: dts: rk3399-android-next: optimize display node
Mark Yao [Thu, 1 Dec 2016 02:28:33 +0000 (10:28 +0800)]
ARM64: dts: rk3399-android-next: optimize display node

Change-Id: Icbbc34bc375f6b7106966b6ea40047cc8469594d
Signed-off-by: Mark Yao <>
5 years agodrm/rockchip: boot_logo: support logo fullscreen or center display
Mark Yao [Thu, 1 Dec 2016 02:25:23 +0000 (10:25 +0800)]
drm/rockchip: boot_logo: support logo fullscreen or center display

Change-Id: I2f688b84172de015eb59187d0d3de06e6764346e
Signed-off-by: Mark Yao <>
5 years agoarm64: rockchip_defconfig: Use ext4 for ext2 file systems
Huang, Tao [Fri, 2 Dec 2016 02:02:53 +0000 (10:02 +0800)]
arm64: rockchip_defconfig: Use ext4 for ext2 file systems

also disable F2FS_FS_POSIX_ACL
save about 40KB size

Change-Id: I2a134966ece2a3f74014c059d2dd5bbccfe52b61
Signed-off-by: Huang, Tao <>
5 years agoarm64: rockchip_defconfig: remove some ramdisks compressed mode
Huang, Tao [Fri, 2 Dec 2016 01:35:56 +0000 (09:35 +0800)]
arm64: rockchip_defconfig: remove some ramdisks compressed mode

for save about 20KB size.

Change-Id: I15614e3a300eca6a40c62da5af2ce5cbd0b6994f
Signed-off-by: Huang, Tao <>
5 years agoarm64: rockchip_defconfig: enable HZ_300
Huang, Tao [Fri, 2 Dec 2016 01:11:18 +0000 (09:11 +0800)]
arm64: rockchip_defconfig: enable HZ_300

Change-Id: I19e780388de746dc8d7b6099663909fb2b20d107
Signed-off-by: Huang, Tao <>
5 years agovideo: rockchip: fb: update mirror for vr
Huang Jiachai [Thu, 1 Dec 2016 06:35:43 +0000 (14:35 +0800)]
video: rockchip: fb: update mirror for vr

Change-Id: Ibdd0e60991490115428ed04027cbaef717951d3b
Signed-off-by: Huang Jiachai <>
5 years agovideo: rockchip: fb: fix warning
Huang Jiachai [Wed, 30 Nov 2016 06:44:38 +0000 (14:44 +0800)]
video: rockchip: fb: fix warning

Change-Id: Id15ac3f4f83fe788c9568f0acc78b8d4260c0579
Signed-off-by: Huang Jiachai <>
5 years agovideo: rockchip: vpu: change the license to GPL v2
Randy Li [Mon, 31 Oct 2016 08:59:51 +0000 (16:59 +0800)]
video: rockchip: vpu: change the license to GPL v2

The proprietary license would make some kernel reasouces and
function unavailable.

Change-Id: Ibaea3e3389ab05dbd60adfcc0d7e3bba787415c4
Signed-off-by: Randy Li <>
5 years agovideo: rockchip: vpu: fix the makefile
Randy Li [Mon, 31 Oct 2016 08:31:22 +0000 (16:31 +0800)]
video: rockchip: vpu: fix the makefile

Keeping the build result as a single module.

Change-Id: I9f33851d9f309c344804a81375a9417daab152f9
Signed-off-by: Randy Li <>
5 years agovideo: rockchip: vpu: use device tree to find out target SoC
Randy Li [Mon, 31 Oct 2016 08:14:32 +0000 (16:14 +0800)]
video: rockchip: vpu: use device tree to find out target SoC

Although the SoCs before RK3288 may not support device tree,
but it could keep forward compatible.

Change-Id: Id0e4ae3ee29ce7f45c6840cf6db5eb069c9502a5
Signed-off-by: Randy Li <>
5 years agosched: tune: Fix lacking spinlock initialization
Ke Wang [Fri, 25 Nov 2016 05:38:45 +0000 (13:38 +0800)]
sched: tune: Fix lacking spinlock initialization

The spinlock used by boost_groups in sched tune must be initialized.
This commit fixes this lack and the following errors:

[    0.384739] c2 BUG: spinlock bad magic on CPU#2, swapper/2/0
[    0.390313] c2  lock: 0xffffffc15fe1fc80, .magic:00000000, .owner: <none>/-1, .owner_cpu: 0
[    0.398739] c2 CPU: 2 PID: 0 Comm: swapper/2 Not tainted 4.4.6+ #4
[    0.404816] c2 Hardware name: Spreadtrum SP9860gBoard (DT)
[    0.410462] c2 Call trace:
[    0.413159] c2 [<ffffff800808b50c>] dump_backtrace+0x0/0x210
[    0.418803] c2 [<ffffff800808b73c>] show_stack+0x20/0x28
[    0.424100] c2 [<ffffff8008433310>] dump_stack+0xa8/0xe0
[    0.429398] c2 [<ffffff8008139398>] spin_dump+0x78/0x9c
[    0.434608] c2 [<ffffff80081393ec>] spin_bug+0x30/0x3c
[    0.439644] c2 [<ffffff80081394e4>] do_raw_spin_lock+0xac/0x1b4
[    0.445639] c2 [<ffffff8008abffe4>] _raw_spin_lock_irqsave+0x58/0x68
[    0.451977] c2 [<ffffff800812a560>] schedtune_enqueue_task+0x84/0x3bc
[    0.458320] c2 [<ffffff8008111678>] enqueue_task_fair+0x438/0x208c
[    0.464487] c2 [<ffffff80080feeec>] activate_task+0x70/0xd0
[    0.470130] c2 [<ffffff80080ff4a4>] ttwu_do_activate.constprop.131+0x4c/0x98
[    0.477079] c2 [<ffffff80081005d0>] try_to_wake_up+0x254/0x54c
[    0.482899] c2 [<ffffff80081009d4>] default_wake_function+0x30/0x3c
[    0.489154] c2 [<ffffff8008122464>] autoremove_wake_function+0x3c/0x6c
[    0.495754] c2 [<ffffff8008121b70>] __wake_up_common+0x64/0xa4
[    0.501574] c2 [<ffffff8008121e9c>] __wake_up+0x48/0x60
[    0.506788] c2 [<ffffff8008150fac>] rcu_gp_kthread_wake+0x50/0x5c
[    0.512866] c2 [<ffffff8008151fec>] note_gp_changes+0xac/0xd4
[    0.518597] c2 [<ffffff8008153044>] rcu_process_callbacks+0xe8/0x93c
[    0.524940] c2 [<ffffff80080d0b84>] __do_softirq+0x24c/0x5b8
[    0.530584] c2 [<ffffff80080d1284>] irq_exit+0xc0/0xec
[    0.535623] c2 [<ffffff8008144208>] __handle_domain_irq+0x94/0xf8
[    0.541789] c2 [<ffffff8008082554>] gic_handle_irq+0x64/0xc0

Signed-off-by: Ke Wang <>
5 years agoUPSTREAM: trace: Update documentation for mono, mono_raw and boot clock
Joel Fernandes [Mon, 28 Nov 2016 22:35:24 +0000 (14:35 -0800)]
UPSTREAM: trace: Update documentation for mono, mono_raw and boot clock

Documentation was missing for mono and mono_raw, add them and also for
the boot clock introduced in this series.

Bug: b/33184060

Cc: Steven Rostedt <>
Cc: Thomas Gleixner <>
Cc: Ingo Molnar <>
Cc: Richard Cochran <>
Cc: Prarit Bhargava <>
Reviewed-by: Thomas Gleixner <>
Signed-off-by: Joel Fernandes <>
Signed-off-by: John Stultz <>
Acked-by: Steven Rostedt <>
5 years agoUPSTREAM: trace: Add an option for boot clock as trace clock
Joel Fernandes [Mon, 28 Nov 2016 22:35:23 +0000 (14:35 -0800)]
UPSTREAM: trace: Add an option for boot clock as trace clock

Unlike monotonic clock, boot clock as a trace clock will account for
time spent in suspend useful for tracing suspend/resume. This uses
earlier introduced infrastructure for using the fast boot clock.

Bug: b/33184060

Cc: Steven Rostedt <>
Cc: Thomas Gleixner <>
Cc: Ingo Molnar <>
Cc: Richard Cochran <>
Cc: Prarit Bhargava <>
Reviewed-by: Thomas Gleixner <>
Signed-off-by: Joel Fernandes <>
Signed-off-by: John Stultz <>
Acked-by: Steven Rostedt <>
5 years agoUPSTREAM: timekeeping: Add a fast and NMI safe boot clock
Joel Fernandes [Mon, 28 Nov 2016 22:35:22 +0000 (14:35 -0800)]
UPSTREAM: timekeeping: Add a fast and NMI safe boot clock

This boot clock can be used as a tracing clock and will account for
suspend time.

To keep it NMI safe since we're accessing from tracing, we're not using a
separate timekeeper with updates to monotonic clock and boot offset
protected with seqlocks. This has the following minor side effects:

(1) Its possible that a timestamp be taken after the boot offset is updated
but before the timekeeper is updated. If this happens, the new boot offset
is added to the old timekeeping making the clock appear to update slightly
   CPU 0                                        CPU 1
   __timekeeping_inject_sleeptime(tk, delta);
   timekeeping_update(tk, TK_CLEAR_NTP...);

(2) On 32-bit systems, the 64-bit boot offset (tk->offs_boot) may be
partially updated.  Since the tk->offs_boot update is a rare event, this
should be a rare occurrence which postprocessing should be able to handle.

Bug: b/33184060

Cc: Steven Rostedt <>
Cc: Thomas Gleixner <>
Cc: Ingo Molnar <>
Cc: Richard Cochran <>
Cc: Prarit Bhargava <>
Reviewed-by: Thomas Gleixner <>
Signed-off-by: Joel Fernandes <>
Signed-off-by: John Stultz <>
5 years agoANDROID: goldfish_pipe: fix allmodconfig build
Jin Qian [Fri, 18 Nov 2016 19:40:40 +0000 (11:40 -0800)]
ANDROID: goldfish_pipe: fix allmodconfig build

tree: android-4.4
head:   6297c6ba0d217d5b0998738fbfaff2f04cad77e6
commit: bc43565e1ac5ba3f204886a2275726bb4c3d44e6 [18/20] ANDROID:
goldfish_pipe: An implementation of more parallel pipe
config: i386-randconfig-s1-201646 (attached as .config)
compiler: gcc-6 (Debian 6.2.0-3) 6.2.0 20160901
        git checkout bc43565e1ac5ba3f204886a2275726bb4c3d44e6
        # save the attached .config to linux build tree
        make ARCH=i386

All errors (new ones prefixed by >>):

>> ERROR: "goldfish_pipe_device_deinit_v1" [drivers/platform/goldfish/goldfish_pipe_v2.ko] undefined!
>> ERROR: "goldfish_pipe_device_init_v1" [drivers/platform/goldfish/goldfish_pipe_v2.ko] undefined!
>> ERROR: "pipe_dev" [drivers/platform/goldfish/goldfish_pipe.ko] undefined!

Change-Id: Ibd51441edf82e6bb6824acc05ea795570cc374e8

5 years agoANDROID: goldfish: goldfish_pipe: fix locking errors
Greg Hackmann [Fri, 18 Nov 2016 19:09:02 +0000 (11:09 -0800)]
ANDROID: goldfish: goldfish_pipe: fix locking errors

If the get_user_pages_fast() call in goldfish_pipe_read_write() failed,
it would return while still holding pipe->lock.

goldfish_pipe_read_write() later releases and tries to re-acquire
pipe->lock.  If the re-acquire call failed, goldfish_pipe_read_write()
would try unlock pipe->lock on exit anyway.

This fixes the smatch messages:

drivers/platform/goldfish/goldfish_pipe.c:392 goldfish_pipe_read_write() error: double unlock 'mutex:&pipe->lock'
drivers/platform/goldfish/goldfish_pipe.c:397 goldfish_pipe_read_write() warn: inconsistent returns 'mutex:&pipe->lock'.

Change-Id: Ifd06a76b32027ca451a001704ade0c5440ed69c4
Signed-off-by: Greg Hackmann <>
5 years agoANDROID: video: goldfishfb: fix platform_no_drv_owner.cocci warnings
kbuild test robot [Fri, 18 Nov 2016 05:16:07 +0000 (13:16 +0800)]
ANDROID: video: goldfishfb: fix platform_no_drv_owner.cocci warnings

drivers/video/fbdev/goldfishfb.c:318:3-8: No need to set .owner here. The core will do it.

 Remove .owner field if calls are used which set it automatically

Generated by: scripts/coccinelle/api/platform_no_drv_owner.cocci

CC: Greg Hackmann <>
Signed-off-by: Fengguang Wu <>
Signed-off-by: Guenter Roeck <>
5 years agoANDROID: goldfish_pipe: fix call_kern.cocci warnings
Julia Lawall [Fri, 18 Nov 2016 06:26:19 +0000 (07:26 +0100)]
ANDROID: goldfish_pipe: fix call_kern.cocci warnings

Function get_free_pipe_id_locked called on line 671 inside lock on line
669 but uses GFP_KERNEL.  Replace with GFP_ATOMIC.

Generated by: scripts/coccinelle/locks/call_kern.cocci

CC: Yurii Zubrytskyi <>
Signed-off-by: Julia Lawall <>
Signed-off-by: Fengguang Wu <>
Signed-off-by: Guenter Roeck <>
5 years agoarm64: rename ranchu defconfig to ranchu64
Jin Qian [Fri, 18 Nov 2016 01:01:43 +0000 (17:01 -0800)]
arm64: rename ranchu defconfig to ranchu64

Change-Id: Ib7cd1ef722167905957623f65c3cc064e9d5c357

5 years agoANDROID: arch: x86: disable pic for Android toolchain
Greg Hackmann [Thu, 23 Jul 2015 17:40:57 +0000 (10:40 -0700)]
ANDROID: arch: x86: disable pic for Android toolchain

Android toolchains enable PIC, so explicitly disable it with
-fno-pic (this is the upstream gcc default)

Signed-off-by: Greg Hackmann <>
(cherry picked from commit 892606ece2bebfa5a1ed62e9552cc973707ae9d3)

Change-Id: I1e600363e5d18e459479fe4eb23d76855e16868d

5 years agoANDROID: goldfish_pipe: An implementation of more parallel pipe
Yurii Zubrytskyi [Fri, 29 Jul 2016 17:51:46 +0000 (10:51 -0700)]
ANDROID: goldfish_pipe: An implementation of more parallel pipe

This is a driver code for a redesigned android pipe.
Currently it works for x86 and x64 emulators with the following
performance results:
  ADB push to /dev/null,
  400 MB file,
  times are for 1/10/100 parallel adb commands
x86 adb push: (4.4s / 11.5s / 2m10s) -> (2.8s / 6s / 51s)
x64 adb push: (7s / 15s / (too long, 6m+) -> (2.7s / 6.2s / 52s)

ADB pull and push to /data/ have the same %% of speedup
More importantly, I don't see any signs of slowdowns when
run in parallel with Antutu benchmark, so it is definitely
making much better job at multithreading.

The code features dynamic host detection: old emulator gets
the previous version of the pipe driver code.

Combine follow patch from android-goldfish-3.10

b543285 [pipe] Increase the default pipe buffers size, make it configurable

Signed-off-by: "Yurii Zubrytskyi" <>
Change-Id: I140d506204cab6e78dd503e5a43abc8886e4ffff

5 years agoANDROID: goldfish_pipe: bugfixes and performance improvements.
Yurii Zubrytskyi [Wed, 4 May 2016 20:05:38 +0000 (13:05 -0700)]
ANDROID: goldfish_pipe: bugfixes and performance improvements.

Combine following patches from android-goldfish-3.18 branch:

c0f015a [pipe] Fix the pipe driver for x64 platform + correct pages count
48e6bf5 [pipe] Use get_use_pages_fast() which is possibly faster
fb20f13 [goldfish] More pages in goldfish pipe
f180e6d goldfish_pipe: Return from read_write on signal and EIO
3dec3b7 [pipe] Fix a minor leak in setup_access_params_addr()

Change-Id: I1041fd65d7faaec123e6cedd3dbbc5a2fbb86c4d

5 years agoANDROID: goldfish: Add goldfish sync driver
Lingfeng Yang [Mon, 13 Jun 2016 16:24:07 +0000 (09:24 -0700)]
ANDROID: goldfish: Add goldfish sync driver

This is kernel driver for controlling the Goldfish sync
device on the host. It is used to maintain ordering
in critical OpenGL state changes while using
GPU emulation.

The guest open()'s the Goldfish sync device to create
a context for possibly maintaining sync timeline and fences.
There is a 1:1 correspondence between such sync contexts
and OpenGL contexts in the guest that need synchronization
(which in turn, is anything involving swapping buffers,
SurfaceFlinger, or Hardware Composer).

The ioctl QUEUE_WORK takes a handle to a sync object
and attempts to tell the host GPU to wait on the sync object
and deal with signaling it. It possibly outputs
a fence FD on which the Android systems that use them
(GLConsumer, SurfaceFlinger, anything employing
EGL_ANDROID_native_fence_sync) can use to wait.

Design decisions and work log:

- New approach is to have the guest issue ioctls that
  trigger host wait, and then host increments timeline.
- We need the host's sync object handle and sync thread handle
  as the necessary information for that.
- ioctl() from guest can work simultaneously with the
  interrupt handling for commands from host.
- optimization: don't write back on timeline inc
- Change spin lock design to be much more lightweight;
  do not call sw_sync functions or loop too long
- Send read/write commands in batches to minimize guest/host
- robustness: BUG if we will overrun the cmd buffer.
- robustness: return fd -1 if we cannot get an unused fd.
- correctness: remove global mutex
- cleanup pass done, incl. but not limited to:
    - removal of clear_upto and
    - switching to devm_***

This is part of a sequential, multi-CL change:

external/qemu: <- host-side device's
host interface

external/qemu-android: <- host-side device

kernel/goldfish: <- needed <- this CL

Also squash following bug fixes from android-goldfish-3.18 branch.

b44d486 goldfish_sync: provide a signal to detect reboot
ad1f597 goldfish_sync: fix stalls by avoiding early kfree()
de208e8 [goldfish-sync] Fix possible race between kernel and user space

Change-Id: I22f8a0e824717a7e751b1b0e1b461455501502b6

5 years agoANDROID: goldfish: add ranchu defconfigs
Jin Qian [Fri, 7 Oct 2016 23:20:47 +0000 (16:20 -0700)]
ANDROID: goldfish: add ranchu defconfigs

Change-Id: I73ef1b132b6203ae921a1e1d4850eaadf58f8926

5 years agoANDROID: goldfish_audio: Clear audio read buffer status after each read
Joshua Lang [Sat, 18 Jun 2016 00:30:55 +0000 (17:30 -0700)]
ANDROID: goldfish_audio: Clear audio read buffer status after each read

The buffer_status field is interrupt updated. After every read request,
the buffer_status read field should be reset so that on the next loop
iteration we don't read a stale value and read data before the
device is ready.

Signed-off-by: “Joshua Lang” <>
Change-Id: I4943d5aaada1cad9c7e59a94a87c387578dabe86

5 years agoANDROID: goldfish_events: no extra EV_SYN; register goldfish
Lingfeng Yang [Fri, 18 Dec 2015 20:04:43 +0000 (12:04 -0800)]
ANDROID: goldfish_events: no extra EV_SYN; register goldfish

If we send SYN_REPORT on every single
multitouch event, it breaks the multitouch.

The multitouch becomes janky and
having to click 2-3 times to
do stuff (plus randomly activating notification
bars when not clicking)

If we suppress these SYN_REPORTS,
multitouch will work fine, plus the events
will have a protocol that looks nice.

In addition, we need to register Goldfish Events
as a multitouch device by issuing
input_mt_init_slots, otherwise
input_handle_abs_event in drivers/input/input.c
will silently drop all ABS_MT_SLOT events,
making it so that touches with more than 1 finger
do not work properly.

Signed-off-by: "Lingfeng Yang" <>
Change-Id: Ib2350f7d1732449d246f6f0d9b7b08f02cc7c2dd
(cherry picked from commit 6cf40d0a16330e1ef42bdf07d9aba6c16ee11fbc)

5 years agoANDROID: goldfish_fb: Set pixclock = 0
Christoffer Dall [Thu, 19 Jun 2014 14:24:04 +0000 (16:24 +0200)]
ANDROID: goldfish_fb: Set pixclock = 0

User space Android code identifies pixclock == 0 as a sign for emulation
and will set the frame rate to 60 fps when reading this value, which is
the desired outcome.

Change-Id: I759bf518bf6683446bc786bf1be3cafa02dd8d42
Signed-off-by: Christoffer Dall <>
Signed-off-by: Peter Maydell <>
5 years agoANDROID: goldfish: Enable ACPI-based enumeration for goldfish audio
Yu Ning [Tue, 31 Mar 2015 06:41:48 +0000 (14:41 +0800)]
ANDROID: goldfish: Enable ACPI-based enumeration for goldfish audio

Follow the same way in which ACPI was enabled for goldfish battery. See
commit d3be10e for details.

Change-Id: I6ffe38ebc80fb8af8322152370b9d1fd227eaf50
Signed-off-by: Yu Ning <>
5 years agoANDROID: goldfish: Enable ACPI-based enumeration for goldfish framebuffer
Yu Ning [Thu, 12 Feb 2015 03:44:40 +0000 (11:44 +0800)]
ANDROID: goldfish: Enable ACPI-based enumeration for goldfish framebuffer

Follow the same way in which ACPI was enabled for goldfish battery. See
commit d3be10e for details.

Note that this patch also depends on commit af33cac.

Change-Id: Ic63b6e7e0a4b9896ef9a9d0ed135a7796a4c1fdb
Signed-off-by: Yu Ning <>