CHROMIUM: xhci: fix hung task timeout when rm xhci-hcd

On some special platforms (e.g. rk3399), they will call
usb_remove_hcd() to remove xhci hcd if no device connected,
and add xhci hcd again when detect usb device. But they
just simply remove xhci hcd, and the usb core hub_event
don't know it at all. The hub_event just find usb device
disconnect, and try to call usb_disconnect() -> usb_disable
_endpoint() -> usb_kill_urb() -> usb_hcd_unlink_urb() ->
xhci_urb_dequeue -> queue a stop endpoint command, and
then the usb_kill_urb will wait_event(usb_kill_urb_queue,
atomic_read(&urb->use_count) == 0).

But in this case, we have removed xhci hcd and stop xhci
controller, so xhci can't complete stop endpoint command
and fail to call usb_hcd_giveback_urb() which can wakeup
usb_kill_urb_queue, this cause stall in usb_kill_urb()
with the following backstrace.

[  240.202208] INFO: task kworker/0:2:130 blocked for more than 120 seconds.
[  240.208996]       Not tainted 4.4.21 #454
[  240.213008] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
[  240.220828] kworker/0:2     D ffffffc000204fd8     0   130      2 0x00000000
[  240.227919] Workqueue: usb_hub_wq hub_event
[  240.232117] Call trace:
[  240.234576] [<ffffffc000204fd8>] __switch_to+0x9c/0xa8
[  240.239713] [<ffffffc000919cb4>] __schedule+0x440/0x6d8
[  240.244938] [<ffffffc000919fe0>] schedule+0x94/0xb4
[  240.249814] [<ffffffc000654530>] usb_kill_urb+0xc4/0x110
[  240.255128] [<ffffffc000653538>] usb_hcd_flush_endpoint+0x128/0x148
[  240.261755] [<ffffffc0006560e4>] usb_disable_endpoint+0x70/0xa4
[  240.267679] [<ffffffc00065617c>] usb_disable_interface+0x64/0x7c
[  240.273680] [<ffffffc000658760>] usb_unbind_interface+0x88/0x1f8
[  240.279687] [<ffffffc0005eb260>] __device_release_driver+0xb4/0x114
[  240.285952] [<ffffffc0005eb2ec>] device_release_driver+0x2c/0x40
[  240.291956] [<ffffffc0005ea38c>] bus_remove_device+0x110/0x128
[  240.297783] [<ffffffc0005e730c>] device_del+0x164/0x1f4
[  240.303006] [<ffffffc000656228>] usb_disable_device+0x94/0x1c8
[  240.308834] [<ffffffc00064dd08>] usb_disconnect+0x9c/0x1d0
[  240.314317] [<ffffffc00064f51c>] hub_event+0x58c/0xde0
[  240.319451] [<ffffffc0002397f0>] process_one_work+0x240/0x424
[  240.325193] [<ffffffc00023a28c>] worker_thread+0x2fc/0x424
[  240.330725] [<ffffffc00023f5fc>] kthread+0x10c/0x114
[  240.335708] [<ffffffc000203dd0>] ret_from_fork+0x10/0x40
...
[  240.466674] kworker/4:2     D ffffffc000204fd8     0   153      2 0x00000000
[  240.473752] Workqueue: events dwc3_rockchip_otg_extcon_evt_work
[  240.479680] Call trace:
[  240.482131] [<ffffffc000204fd8>] __switch_to+0x9c/0xa8
[  240.487265] [<ffffffc000919cb4>] __schedule+0x440/0x6d8
[  240.492487] [<ffffffc000919fe0>] schedule+0x94/0xb4
[  240.497361] [<ffffffc00091a364>] schedule_preempt_disabled+0x28/0x44
[  240.503713] [<ffffffc00091be20>] __mutex_lock_slowpath+0x120/0x1ac
[  240.509885] [<ffffffc00091bef8>] mutex_lock+0x4c/0x68
[  240.514936] [<ffffffc00064dcc8>] usb_disconnect+0x5c/0x1d0
[  240.520415] [<ffffffc000652278>] usb_remove_hcd+0xc8/0x1e0
[  240.525899] [<ffffffc000668ce8>] dwc3_rockchip_otg_extcon_evt_work+0x154/0x198
[  240.533112] [<ffffffc0002397f0>] process_one_work+0x240/0x424
[  240.538856] [<ffffffc00023a28c>] worker_thread+0x2fc/0x424
[  240.544335] [<ffffffc00023f5fc>] kthread+0x10c/0x114
[  240.549296] [<ffffffc000203dd0>] ret_from_fork+0x10/0x40

This patch try to do the same thing as XHCI_STATE_HALTED in
xhci_urb_dequeue() if xhci->xhc_state is XHCI_STATE_REMOVING.
Because XHCI_STATE_REMOVING means that we are removing xhci
hcd, and need to call usb_hcd_giveback_urb() directly without
queueing any stop endpoint command.

In addition, this patch also forbid xhci to queue command or
slot control if it's in XHCI_STATE_REMOVING. It maybe helpful
to avoid the other unexpected problems, though I haven't met
them so far.

BUG=chrome-os-partner:59103
TEST=do plug/unplug USB-C HUB with an USB3 flash drive,
check if kernel blocked for more than 120 seconds.

Change-Id: I35ec94dcc742d29d52f73fa30f79cf005063ea55
Signed-off-by: William wu <wulf@rock-chips.com>
Reviewed-on: https://chromium-review.googlesource.com/408127
Commit-Ready: Guenter Roeck <groeck@chromium.org>
Tested-by: Guenter Roeck <groeck@chromium.org>
Tested-by: Inno Park <ih.yoo.park@samsung.com>
Reviewed-by: Guenter Roeck <groeck@chromium.org>
Signed-off-by: William Wu <wulf@rock-chips.com>

CHROMIUM: usb: dwc3: rockchip: Check for plug/unplug events on resume

Check on resume if the cable state has changed to detect devices
(un)plugged during suspend.

TEST=build and boot on rk3399 board. No USB device plugged. Set
system enter suspend. Wait for device to suspend. Plug USB device.
Wakeup system; Verify USB device is enumerated.

Change-Id: Iadbefe6737fa3ddfe2da1a66473f876411a4412a
Signed-off-by: William Wu <wulf@rock-chips.com>
Signed-off-by: Matthias Kaehlcke <mka@chromium.org>
Reviewed-on: https://chromium-review.googlesource.com/395528
Reviewed-by: Guenter Roeck <groeck@chromium.org>

rockchip/vcodec: fix double lock and some warning

fix following problems:

vcodec_service.c:1613 try_set_reg()
error: double lock 'mutex:&pservice->shutdown_lock'
vcodec_service.c:1682 try_set_reg()
warn: inconsistent returns 'mutex:&pservice->shutdown_lock'.
  Locked on:   line 1614
  Unlocked on: line 1682

vcodec_service.c:599 vpu_get_clk()
warn: missing break? reassigning 'pservice->pd_video'
vcodec_service.c:901 vcodec_fd_to_iova()
warn: returning -1 instead of -ENOMEM is sloppy
vcodec_service.c:1100 vcodec_bufid_to_iova()
warn: returning -1 instead of -ENOMEM is sloppy
vcodec_service.c:1209 reg_init()
warn: passing __func__ while the format string already
contains the name of the function 'reg_init'
vcodec_service.c:1231 reg_init()
warn: passing __func__ while the format string already
contains the name of the function 'reg_init'
vcodec_service.c:1237 reg_init()
warn: passing __func__ while the format string already
contains the name of the function 'reg_init'
vcodec_service.c:1714 return_reg()
warn: passing __func__ while the format string already
contains the name of the function 'return_reg'

Change-Id: Ia2d3be7ad7a726d9af9e58c25079e6c11a7d302f
Signed-off-by: alpha lin <alpha.lin@rock-chips.com>

vidro/rockchip: Fix rga2 driver

1.If rga get the mmu error, we must unlock the lock
or it will lead the next frame timeout.
2.calculate the rga mmu buf back length size in the
rga time out handler or it will lead the next frame
get mmu lentch wrong.

Change-Id: If85751bd292774a1d0ef9693b7f8ad92a4727c07
Signed-off-by: Zikim,Wei <wzq@rock-chips.com>

vidro/rockchip: fix rga1 driver deadlock

If rga get the mmu error, we must unlock the lock
or it will lead the next frame timeout.

Change-Id: I377217ea417de8e4d3f4ff63e478db1370951e62
Signed-off-by: Zikim,Wei <wzq@rock-chips.com>
(cherry picked from commit f453db8699919760a2297a7d2512f3c03c3edf25)

input: sensor-dev: fix smatch warning

fix below warnings:
sensor-dev.c:1016 gyro_dev_ioctl() warn: inconsistent returns 'mutex:&sensor->operation_mutex'.
  Locked on:   line 973
               line 982
  Unlocked on: line 919
               line 1010
               line 1016
sensor-dev.c:1905 sensor_probe() error: potential null dereference 'sensor->input_dev'.  (input_allocate_device returns null)
sensor-dev.c:1905 sensor_probe() error: we previously assumed 'sensor->input_dev' could be null (see line 1902)
sensor-dev.c:2051 sensor_probe() error: don't call input_free_device() after input_unregister_device()
sensor-dev.c:2080 sensor_remove() error: don't call input_free_device() after input_unregister_device()

Change-Id: I7da8a337282df7f9b8e6474a68928fc53d4e6890
Signed-off-by: Huang, Tao <huangtao@rock-chips.com>
(cherry picked from commit 08fd14ea02692f43eaa8a166791cdaaa4b6c0738)

arm64: dts: rockchip: add pvtm node for rk3399

Change-Id: Ic7becefeb7e7a1000b259c21fedda76794b7115c
Signed-off-by: Finley Xiao <finley.xiao@rock-chips.com>

arm64: dts: rockchip: add pvtm node for rk3366

Change-Id: Ic90466538671e69aaea82b0b20afdcb39ecf7006
Signed-off-by: Finley Xiao <finley.xiao@rock-chips.com>

arm64: rockchip_defconfig: enable pvtm

Change-Id: I726bddec7625540ff3b3b58cf4c3c9ee842d50da
Signed-off-by: Finley Xiao <finley.xiao@rock-chips.com>

soc: rockchip: pvtm: add driver handling Rockchip pvtm

This patch supports acquiring pvtm values.

Change-Id: I20c0c5a5136371880da1c246b0d71c7a2bddc1d6
Signed-off-by: Finley Xiao <finley.xiao@rock-chips.com>

dt-bindings: add binding document for Rockchip pvtm

This patch documents the Rockchip pvtm device tree binding.

Change-Id: I7edcd1d57ff2852eb6e6897680566abb7f9e76a9
Signed-off-by: Finley Xiao <finley.xiao@rock-chips.com>

clk: rockchip: rk3399: delete the CLK_IGNORE_UNUSED for pvtm clks

These clks will be enabed and disabled in pvtm driver.

Change-Id: I742a8c4ef5877486fb21c014f1e4ab27f72e468d
Signed-off-by: Finley Xiao <finley.xiao@rock-chips.com>

arm64: dts: rockchip: rk3399: add aclk_gpu init freq

Make sure the aclk_gpu freq is safety.
After soft reset the vdd_gpu is maintain
the voltage value before reset.

Change-Id: I3509b211d74cf649067090d13ce20d5c62782fd7
Signed-off-by: Elaine Zhang <zhangqing@rock-chips.com>

arm64: dts: rockchip: add power button for rk3399 excavator linux

Change-Id: I5c69940b93dec8a04f72e7240fc732071d0187ed
Signed-off-by: Jacob Chen <jacob2.chen@rock-chips.com>

arm64: dts: rockchip: add reset unit in saradc for rk3399

Change-Id: Iee831c8b4bc39cb324ee31ace9d98d235aaf7555
Signed-off-by: Jacob Chen <jacob2.chen@rock-chips.com>

rockchip/rga: rga driver fix compat ptr from u64

Change-Id: I23cff21aab9af09989b8b2332e7a2ef3ffc8bfb8
Signed-off-by: Zikim,Wei <wzq@rock-chips.com>

soc: rockchip: pm_test: add driver handling Rockchip pm_test

Add /sys/pm_tests/ node, only for internal testing.

Change-Id: I1fe9f09e6d410c9ed939666255111d2a8865466c
Signed-off-by: Finley Xiao <finley.xiao@rock-chips.com>

video: rockchip: sysfs: fixup dump_buf node

Change-Id: Ie2e86d65b3db58f45c8c49894f506ab52b125c25
Signed-off-by: Mark Yao <mark.yao@rock-chips.com>

arm64: dts: rockchip: add dp defaule mode for rk3399 discrete vr

Change-Id: Icc25da3598d9a7475817aebdc101f5d77f58624c
Signed-off-by: wjh <wjh@rock-chips.com>

video: rockchip: dp: get edid for discrete vr

Change-Id: Id791e838e37e76f72202731e53afd2533e653069
Signed-off-by: wjh <wjh@rock-chips.com>

video: rockchip: rk322x: use htotal to adjust fps

Use dclk to adjust fps may effect many things, some display
controller also need to know dclk update, such as mipi.
So if we change fps by dclk, we need update mipi or other
display controller, it waste time and screen would flash

From the fps formula: fps = dclk / htotal * vtotal

Instead change dclk, we also can modify fps by htotal or vtotal.

On testing, vtotal would effect display, use htotal is more safe.

Change-Id: I67d58a815eae150b4e6390b6608557b87d43a27b
Signed-off-by: Mark Yao <mark.yao@rock-chips.com>

video: rockchip: rk322x: keep vop standby before enable iommu

Vop may access illegal address and cause bus error with:
    1, vop iommu is disable
    2, vop is enable and its window use a iommu mapping address

The illegal memory access may cause bus abnormal.

Change-Id: I17d52ae12140b9bf85d37123765f7163422ec8f5
Signed-off-by: Mark Yao <mark.yao@rock-chips.com>

UPSTREAM: arm64: dts: rockchip: add powerdomain for typec on rk3399

The tcpc power domain will try to power up/down the power of Type-C PHY.
Hence, we need control it in Type-C PHY driver with the pm_runtime helper.

Change-Id: I7697c50bb8538c00bb0fa14c92cc1e55bcdd4025
Signed-off-by: Chris Zhong <zyw@rock-chips.com>
Signed-off-by: Heiko Stuebner <heiko@sntech.de>
Signed-off-by: Caesar Wang <wxt@rock-chips.com>
(cherry picked from git.kernel.org next/linux-next.git master
 commit 06ad4b2fad80713c50a31da6d1048cb1df728558)

FROMLIST: phy: rockchip-typec: add pm_runtime_disable in err case

Add pm_runtime_disable in err case to make the pm_runtime_enable/disable
is invoked balanced.

BUG=chrome-os-partner:52872
TEST=Check DP display and USB3

Change-Id: Ifc66a3e80d7b580963e609d2f14cea239104724c
Signed-off-by: Chris Zhong <zyw@rock-chips.com>
(am from https://patchwork.kernel.org/patch/9321849/)
Reviewed-on: https://chromium-review.googlesource.com/382723
Reviewed-by: Brian Norris <briannorris@chromium.org>
Signed-off-by: William Wu <wulf@rock-chips.com>

UPSTREAM: phy: rockchip-typec: add pm runtime support

Adds pm_runtime support for rockchip Type-C, so that power domain is
enabled only when there is a transaction going on to help save power.

BUG=chrome-os-partner:52872
TEST=Check DP display and USB3

Change-Id: I072fd06eaa4dfc4b4f598c4a6a3972ee458b833f
Signed-off-by: Chris Zhong <zyw@rock-chips.com>
Signed-off-by: Kishon Vijay Abraham I <kishon@ti.com>
(cherry picked from git.kernel.org kishon/linux-phy.git next
 commit 15ab5499bd837b1d70287da747dc3d9762ab320a)
Reviewed-on: https://chromium-review.googlesource.com/382113
Reviewed-by: Brian Norris <briannorris@chromium.org>

arm64: configs: enable drm rga in linux config

Change-Id: I92985f4e1f8cf18d2f0f578e3d039b45e5f445fb
Signed-off-by: Jacob Chen <jacob2.chen@rock-chips.com>

arm64: configs: enable extcon in linux config

Change-Id: I071fa1e075a5495be58315d47cc2a767ae09bd75
Signed-off-by: Jacob Chen <jacob2.chen@rock-chips.com>

UPSTREAM: sched/preempt: Fix preempt_count manipulations

Vikram reported that his ARM64 compiler managed to 'optimize' away the
preempt_count manipulations in code like:

preempt_enable_no_resched();
put_user();
preempt_disable();

Irrespective of that fact that that is horrible code that should be
fixed for many reasons, it does highlight a deficiency in the generic
preempt_count manipulators. As it is never right to combine/elide
preempt_count manipulations like this.

Therefore sprinkle some volatile in the two generic accessors to
ensure the compiler is aware of the fact that the preempt_count is
observed outside of the regular program-order view and thus cannot be
optimized away like this.

x86; the only arch not using the generic code is not affected as we
do all this in asm in order to use the segment base per-cpu stuff.

Change-Id: I13da06ddb17c533b8150f008514a4c74723b1742
Reported-by: Vikram Mulukutla <markivx@codeaurora.org>
Tested-by: Vikram Mulukutla <markivx@codeaurora.org>
Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
Cc: Linus Torvalds <torvalds@linux-foundation.org>
Cc: Peter Zijlstra <peterz@infradead.org>
Cc: Thomas Gleixner <tglx@linutronix.de>
Fixes: a787870924db ("sched, arch: Create asm/preempt.h")
Link: http://lkml.kernel.org/r/20160516131751.GH3205@twins.programming.kicks-ass.net
Signed-off-by: Ingo Molnar <mingo@kernel.org>
Signed-off-by: Huang, Tao <huangtao@rock-chips.com>
(cherry picked from commit 2e636d5e66c35dfcbaf617aa8fa963f6847478fe)

arm64: rockchip_defconfig: enable HARDENED_USERCOPY

e41543b2d15f ("ANDROID: android-base: CONFIG_HARDENED_USERCOPY=y")

Change-Id: I4d2805c318f2fb65ae3c780aac26672bfc41be34
Signed-off-by: Huang, Tao <huangtao@rock-chips.com>

arm64: rockchip_defconfig: enable CC_STACKPROTECTOR_STRONG

df9e01a6c5d4 ("android-recommended.cfg: enable fstack-protector-strong")

If compiler has stack protector support, set
CONFIG_CC_STACKPROTECTOR_STRONG.

Change-Id: Icd3535b88fb7d62c135da72ae0921f7f4949efe4
Signed-off-by: Huang, Tao <huangtao@rock-chips.com>

UPSTREAM: f2fs: avoid hungtask problem caused by losing wake_up

The D state of wait_on_all_pages_writeback should be waken by
function f2fs_write_end_io when all writeback pages have been
succesfully written to device. It's possible that wake_up comes
between get_pages and io_schedule. Maybe in this case it will
lost wake_up and still in D state even if all pages have been
write back to device, and finally, the whole system will be into
the hungtask state.

                if (!get_pages(sbi, F2FS_WRITEBACK))
                         break;
<---------  wake_up
                io_schedule();

Change-Id: I8a60393c91343d75b7d48df2ca19d1735d69cc51
Signed-off-by: Yunlei He <heyunlei@huawei.com>
Signed-off-by: Biao He <hebiao6@huawei.com>
Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
(cherry picked from commit 0ff21646f2a5c6ff77acc51eb3df4235af39be46)
Signed-off-by: Cliff Chen <cliff.chen@rock-chips.com>

arm64: configs: add missing usb config in rockchip linux

Change-Id: I39f908c4427799a2728f7bc5f39e20accd126901
Signed-off-by: Jacob Chen <jacob2.chen@rock-chips.com>

arm64: configs: rockchip: enable configfs usb gadget and otg in rockchip_linux_defconfig

Change-Id: I3d260fe97fe3dad2101a4cc54a604f8eca7ed248
Signed-off-by: Jacob Chen <jacob2.chen@rock-chips.com>

Revert "arm64: dts: rk3399-sapphire: add vbus-5v gpio control in fusb302 node."

This reverts commit cb3e42dc8cf5e1e0431535a2fbe2a39dfac91d39.

This will make usb port in my board can't work, no 5v voltage.
Is it no issues in android?

Change-Id: I95fbd957d0ddb5fddf215d3b00ef74aae8af08d3
Signed-off-by: Jacob Chen <jacob2.chen@rock-chips.com>

drm: support ignore drm ioctl permission

Change-Id: I269766a9f3f844933bd294ce681466f5a97b1d43
Signed-off-by: Mark Yao <mark.yao@rock-chips.com>

UPSTREAM: arm64: dts: rockchip: add the tcpc for rk3399 power domain

The tcpc is the Type C Port Controller and Type C Port Delivery (tcpd)
is part of it, we haven't used them now, add it to save power consumption.

Change-Id: Ia1046fd3bb7382498811159d8280ee46b3753ebd
Signed-off-by: Caesar Wang <wxt@rock-chips.com>
Signed-off-by: Heiko Stuebner <heiko@sntech.de>
(cherry picked from commit 4a3a3d32c77f942a10c0319f589186a768821397)

UPSTREAM: soc: rockchip: power-domain: avoid infinite loop

In some cases, we have met the infinite loop in
rockchip_pmu_set_idle_request() or rockchip_do_pmu_set_power_domain().

As the crosbug.com/p/57351 reported, the boot hangs right after this
[1.629163] bootconsole [uart8250] disabled
[1.639286] [drm:drm_core_init] Initialized drm 1.1.0 20060810
[1.645926] [drm:drm_get_platform_dev] Initialized vgem 1.0.0 20120112..
[1.654558] iommu: Adding device ff8f0000.vop to group 0
[1.660569] iommu: Adding device ff900000.vop to group 1
<hang>

This patch adds the error message and timeout to avoid infinite loop if
it fails to get the ack.

Change-Id: Ia1e2edbdb48de3ec776f1304a941136d3e7a1854
Signed-off-by: Caesar Wang <wxt@rock-chips.com>
Signed-off-by: Heiko Stuebner <heiko@sntech.de>
(cherry picked from git.kernel.org mmind/linux-rockchip.git
 v4.10-armsoc/drivers commit e4c8cd82d5e1146590611c393001d846535bac5b)

ARM64: dts: rk3399: support cluster idle feature

Add cluster sleep in cpu idle_states for RK3399 SoCs.

Change-Id: I85ea62f9af0d0c61e866a1937f79921d854fd1dc
Signed-off-by: tony.xie <tony.xie@rock-chips.com>
Signed-off-by: Jianqun Xu <jay.xu@rock-chips.com>

MALI: midgard: ARM: patch for fence timeout in monkey test

comes from mali support case [TAC674871].

Change-Id: I5e7c54190e24eea0306a9d64545482c6209a2c0d
Signed-off-by: chenzhen <chenzhen@rock-chips.com>

rk: gcc-wrapper.py ignore memcontrol.c:5346

Change-Id: I19b5f58f395cce934fe2efbb01267576b7772c02
Signed-off-by: Huang, Tao <huangtao@rock-chips.com>

arm64: rockchip_defconfig: enable cpu avs

Change-Id: I626d1d238ea8efa38763fb6360936ce13c0c17fe
Signed-off-by: Finley Xiao <finley.xiao@rock-chips.com>

PM / AVS: rockchip-cpu-avs: add driver handling Rockchip cpu avs

This patch supports adjusting opp's voltage according to leakage

Change-Id: Ifbb6b6fec03abe0c7708a148affe4d7646ce38fa
Signed-off-by: Finley Xiao <finley.xiao@rock-chips.com>

arm64: dts: rockchip: add cpu-avs node for rk3399

Change-Id: Ibfcda65b6b97af453942888cf07e8f08b06768c2
Signed-off-by: Finley Xiao <finley.xiao@rock-chips.com>

dt-bindings: add binding document for Rockchip cpu avs

This patch documents the Rockchip cpu avs device tree binding.

Change-Id: I4a86cd384f304a5d77ff2763b2347804699b9b93
Signed-off-by: Finley Xiao <finley.xiao@rock-chips.com>

PM / OPP: Support adjusting OPP voltages at runtime

On some SoCs the Adaptive Voltage Scaling (AVS) technique is
employed to optimize the operating voltage of a device. At a
given frequency, the hardware monitors dynamic factors and either
makes a suggestion for how much to adjust a voltage for the
current frequency, or it automatically adjusts the voltage
without software intervention. Add an API to the OPP library for
the former case, so that AVS type devices can update the voltages
for an OPP when the hardware determines the voltage should
change. The assumption is that drivers like CPUfreq or devfreq
will register for the OPP notifiers and adjust the voltage
according to suggestions that AVS makes.

Change-Id: Ia6dddc0976f116555965f784794b8eca37582737
Signed-off-by: Finley Xiao <finley.xiao@rock-chips.com>

arm64: dts: rockchip: rk3399: add discrete vr support for box hardware

Change-Id: I64078f3ab5730a451df05e64bee779fe99051af0
Signed-off-by: Luo wei <lw@rock-chips.com>

arm64: dts: rk3399-vr: enable rk_headset on rk3399 vr

Change-Id: I4e078c586e6654c3a4711d0b0108d28360db9453
Signed-off-by: Wu Liangqing <wlq@rock-chips.com>

arm64: rockchip_defconfig: enable DEFAULT_USE_ENERGY_AWARE

Same as before merge last lsk.

Signed-off-by: Huang, Tao <huangtao@rock-chips.com>

Merge branch 'linux-linaro-lsk-v4.4-android' of git://git.linaro.org/kernel/linux-linaro-stable.git

* linux-linaro-lsk-v4.4-android: (1362 commits)
  Linux 4.4.30
  Revert "fix minor infoleak in get_user_ex()"
  Revert "x86/mm: Expand the exception table logic to allow new handling options"
  Linux 4.4.29
  ARM: pxa: pxa_cplds: fix interrupt handling
  powerpc/nvram: Fix an incorrect partition merge
  mpt3sas: Don't spam logs if logging level is 0
  perf symbols: Fixup symbol sizes before picking best ones
  perf symbols: Check symbol_conf.allow_aliases for kallsyms loading too
  perf hists browser: Fix event group display
  clk: divider: Fix clk_divider_round_rate() to use clk_readl()
  clk: qoriq: fix a register offset error
  s390/con3270: fix insufficient space padding
  s390/con3270: fix use of uninitialised data
  s390/cio: fix accidental interrupt enabling during resume
  x86/mm: Expand the exception table logic to allow new handling options
  dmaengine: ipu: remove bogus NO_IRQ reference
  power: bq24257: Fix use of uninitialized pointer bq->charger
  staging: r8188eu: Fix scheduling while atomic splat
  ASoC: dapm: Fix kcontrol creation for output driver widget
  ...

Revert "ARM64: cpufreq_sched: implement event CPUFREQ_GOV_LIMIT for governor"

This reverts commit d94634b0ab1bd61cc4088de63608287938a8fec2.

Fixed by commit 24884e54340e35d43bd09af0b12caef57a63458f
("sched/cpufreq_sched: Consolidated update")

Signed-off-by: Huang, Tao <huangtao@rock-chips.com>

Revert "ARM64: sched: cpufreq_sched: fix bug: init data before use it in thread"

This reverts commit 0ac5bfd6d9652d477387764a11e3b48f1afe6891.

Fixed by commit ac6f9bad52a79154bebd1626344dfc206d1cbefe
("FIXUP: sched: scheduler-driven cpu frequency selection")

Signed-off-by: Huang, Tao <huangtao@rock-chips.com>

Revert "ARM64: sched: fix bug: avoid infinite loop"

This reverts commit d4773e1407b6d59a202bd4ce8acc83deaceafa29.

Fixed by commit abdb60d816bfd20b8d4f61c3e7c95a61ad12212a
("FIXUP: sched/fair: Fix hang during suspend in sched_group_energy")

Signed-off-by: Huang, Tao <huangtao@rock-chips.com>

Revert "ROCKCHIP: sched: enable the feature ENERGY_AWARE"

This reverts commit a9ad2b25a053c995e9a5fd256cc655f32897ed68.

Fixed by commit fc1d6c8c6a6e7353147bcb02d0236db5714804d2
("sched: Add Kconfig option DEFAULT_USE_ENERGY_AWARE to set ENERGY_AWARE feature flag")

Signed-off-by: Huang, Tao <huangtao@rock-chips.com>

Revert "UPSTREAM: usb: dwc3: core: Move the mode setting to the right place"

This reverts commit 104756064072e39790eb16c5c987744e81d52a62.

This commit 1047560 will reinit dwc3 controller mode
when resuming dwc3 core. Generally, this patch can be
used for "dr_mode = host", "dr_mode = peripheral" and
"dr_mode = otg".

However, rockchip dwc3 core don't support otg function,
but only support DRD mode. So on rockchip platform, we
set dr_mode to otg for DRD mode, then switch host and
peripheral dynamically by extcon notifier. Also, we will
enable dwc3 to be a wakeup source and enable usb3 power
domain in suspend mode if usb device is pluged in. So
dwc3 controller will not lost the mode when resuming dwc3
core.

Change-Id: I0ee4f5b02d4504e853d8ef81df3df9a8a4ac284f
Signed-off-by: William Wu <wulf@rock-chips.com>

nvmem: rockchip-efuse: Change initcall to subsys

We will add a avs driver to adjust opp's voltage according to leakage.
As it need register a notifier before cpufreq starts, and make cpufreq
defer probe is probably not really easy, so avs should probe earlier
than cpufreq, efuse should probe earlier than avs.

Change-Id: I817aa44c3b34d2fdf44148e6b9649ceed76d8f1f
Signed-off-by: Finley Xiao <finley.xiao@rock-chips.com>

UPSTREAM: phy: Add reset callback

The only use for this is for solving a hardware design problem in
usb of Rockchip RK3288.

Change-Id: I40b17f5c33125c77759808720763d2694dfc25f2
Signed-off-by: Randy Li <ayaka@soulik.info>
Reviewed-by: Heiko Stuebner <heiko@sntech.de>
Signed-off-by: Kishon Vijay Abraham I <kishon@ti.com>
Signed-off-by: Huang, Tao <huangtao@rock-chips.com>
(cherry picked from commit cac18ecb6f44b11bc303d7afbae3887b27938fa4)

firmware: rockchip: sip: add rockchip SIP runtime service

Change-Id: I996a90b3f6cb471f255566dfab0059a55da8866d
Signed-off-by: Jianhong Chen <chenjh@rock-chips.com>

video: rockchip: 3399 vop: fix pwm config done lead to iommu pagefault

Change-Id: Ia8e8a3ccaf9a713d96e93a435503d8b55b794f3b
Signed-off-by: Huang Jiachai <hjc@rock-chips.com>

arm64: dts: rockchip: enable rk_headset on rk3399 mid

Change-Id: I8ef75283727152e7c5fa7380813296bc7220ed91
Signed-off-by: zhangjun <zhangjun@rock-chips.com>

Merge branch 'linux-linaro-lsk-v4.4' into linux-linaro-lsk-v4.4-android

 Merge tag 'v4.4.30' into linux-linaro-lsk-v4.4

 This is the 4.4.30 stable release

CHROMIUM: xhci: stop roothub port polling timer in shutdown

The xhci hcd use the port polling timer (rh_timer) to poll the
roothub for port events. But we can't allow the USB core to poll
the port events during shutdown because the xhci controller may
be disable and can't be accessed in shutdown. If we access xhci
port registers with port polling timer after xhci shutdown, it
may cause kernel crash or unexpected behavior. So we need to stop
the port polling timer while shutdown xhci.

I can easily reproduce the issue on rk3399 platform, plug in a
Type-C hub and an USB ethernet dongle, then do reboot test,
result in a crash with the following backtrace.

Unhandled fault: synchronous external abort (0x96000010) at 0xffffff80002f0430
Internal error: : 96000010 [#1] PREEMPT SMP
task: ffffffc001092cb0 ti: ffffffc00107c000 task.ti: ffffffc00107c000
PC is at xhci_hub_status_data+0xec/0x1e4
LR is at xhci_hub_status_data+0xb0/0x1e4
[<ffffffc00067a210>] xhci_hub_status_data+0xec/0x1e4
[<ffffffc00063ebf8>] usb_hcd_poll_rh_status+0x54/0x148
[<ffffffc00063ed0c>] rh_timer_func+0x20/0x2c
[<ffffffc0002845cc>] call_timer_fn+0xa4/0x1c8
[<ffffffc000284964>] run_timer_softirq+0x248/0x2cc
[<ffffffc000200928>] __do_softirq+0x178/0x338
[<ffffffc000224b08>] irq_exit+0x78/0xc0
[<ffffffc00027089c>] __handle_domain_irq+0x9c/0xbc
[<ffffffc0002006f4>] gic_handle_irq+0xcc/0x188

BUG=chrome-os-partner:59111
TEST=Plug in a Type-C hub, then do reboot test, check if
kernel crash during shutdown.

Change-Id: I3ca3d12d101241cd78138ea5d995708a2893d1a0
Signed-off-by: William wu <wulf@rock-chips.com>
Reviewed-on: https://chromium-review.googlesource.com/401121
Commit-Ready: Guenter Roeck <groeck@chromium.org>
Tested-by: Guenter Roeck <groeck@chromium.org>
Reviewed-by: Guenter Roeck <groeck@chromium.org>

CHROMIUM: xhci: do shutdown only hcd is registered

On some sepcial platforms (e.g. rk3399 platform), they will call
usb_remove_hcd() to remove xhci hcd if no device connected, and
also call xhci_stop() to halt and reset xhci. So we don't need to
do the same thing in shutdown if hcd has been unregistered.

In addition to remove hcd, rk3399 platform will disable xhci power
domain in runtime suspend, if we try to access xhci registers in
shutdown, it might cause kernel crash or unexpected behavior.

BUG=chrome-os-partner:59111
TEST=reboot the system

Change-Id: I7ecfce068211ff1c4a884fc4a8a54ca5b84c1c09
Signed-off-by: William wu <wulf@rock-chips.com>
Reviewed-on: https://chromium-review.googlesource.com/401120
Commit-Ready: Guenter Roeck <groeck@chromium.org>
Tested-by: Guenter Roeck <groeck@chromium.org>
Reviewed-by: Guenter Roeck <groeck@chromium.org>

CHROMIUM: usb: xhci-plat: use usb_hcd_platform_shutdown() callback

The xhci driver provides xhci_shutdown() to be called with the main
usb_hcd (the USB3 roothub) while do reboot. But actually, xhci-plat
never call xhci_shutdwon() during reboot because it doesn't use the
usb_hcd_platform_shutdown() helper.

So we use use usb_hcd_platform_shutdown() for xhci-plat, and the
normal shutdown call trace is:
kernel_restart -> kernel_restart_prepare -> device_shutdown ->
platform_drv_shutdown -> usb_hcd_platform_shutdown -> xhci_shutdown

BUG=chrome-os-partner:59111
TEST=reboot the system

Change-Id: I9be424257ea6ba1e51521cbdd01f4698ae1752ad
Signed-off-by: William wu <wulf@rock-chips.com>
Reviewed-on: https://chromium-review.googlesource.com/401119
Commit-Ready: Guenter Roeck <groeck@chromium.org>
Tested-by: Guenter Roeck <groeck@chromium.org>
Reviewed-by: Guenter Roeck <groeck@chromium.org>

Linux 4.4.30

Revert "fix minor infoleak in get_user_ex()"

This reverts commit 9d25c78ec01c402dc56272693c44ef9d72ecdd2e which is
1c109fabbd51863475cd12ac206bdd249aee35af upstream

Cc: Al Viro <viro@zeniv.linux.org.uk>
Cc: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

Revert "x86/mm: Expand the exception table logic to allow new handling options"

This reverts commit fcf5e5198b447969ed2a56ec335dae3c695a6b46 which is
548acf19234dbda5a52d5a8e7e205af46e9da840 upstream.

Cc: Tony Luck <tony.luck@intel.com>
Cc: Borislav Petkov <bp@suse.de>
Cc: Linus Torvalds <torvalds@linux-foundation.org>
Cc: Peter Zijlstra <peterz@infradead.org>
Cc: Thomas Gleixner <tglx@linutronix.de>
Cc: Ingo Molnar <mingo@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

Linux 4.4.29

ARM: pxa: pxa_cplds: fix interrupt handling

commit 9ba63e3cc849cdaf3b675c47cc51fe35419e5117 upstream.

Since its initial commit, the driver is buggy for multiple interrupts
handling. The translation from the former lubbock.c file was not
complete, and might stall all interrupt handling when multiple
interrupts occur.

This is especially true when inside the interrupt handler and if a new
interrupt comes and is not handled, leaving the output line still held,
and not creating a transition as the GPIO block behind would expect to
trigger another cplds_irq_handler() call.

For the record, the hardware is working as follows.

The interrupt mechanism relies on :
 - one status register
 - one mask register

Let's suppose the input irq lines are called :
 - i_sa1111
 - i_lan91x
 - i_mmc_cd
Let's suppose the status register for each irq line is called :
 - status_sa1111
 - status_lan91x
 - status_mmc_cd
Let's suppose the interrupt mask for each irq line is called :
 - irqen_sa1111
 - irqen_lan91x
 - irqen_mmc_cd
Let's suppose the output irq line, connected to GPIO0 is called :
 - o_gpio0

The behavior is as follows :
 - o_gpio0 = not((status_sa1111 & irqen_sa1111) |
 (status_lan91x & irqen_lan91x) |
 (status_mmc_cd & irqen_mmc_cd))
   => this is a N-to-1 NOR gate and multiple AND gates
 - irqen_* is exactly as programmed by a write to the FPGA
 - status_* behavior is governed by a bi-stable D flip-flop
   => on next FPGA clock :
     - if i_xxx is high, status_xxx becomes 1
     - if i_xxx is low, status_xxx remains as it is
     - if software sets status_xxx to 0, the D flip-flop is reset
       => status_xxx becomes 0
       => on next FPGA clock cycle, if i_xxx is high, status_xxx becomes
  1 again

Fixes: fc9e38c0f4d3 ("ARM: pxa: lubbock: use new pxa_cplds driver")
Reported-by: Russell King <rmk+kernel@armlinux.org.uk>
Signed-off-by: Robert Jarzmik <robert.jarzmik@free.fr>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

powerpc/nvram: Fix an incorrect partition merge

commit 11b7e154b132232535befe51c55db048069c8461 upstream.

When we merge two contiguous partitions whose signatures are marked
NVRAM_SIG_FREE, We need update prev's length and checksum, then write it
to nvram, not cur's. So lets fix this mistake now.

Also use memset instead of strncpy to set the partition's name. It's
more readable if we want to fill up with duplicate chars .

Fixes: fa2b4e54d41f ("powerpc/nvram: Improve partition removal")
Signed-off-by: Pan Xinhui <xinhui.pan@linux.vnet.ibm.com>
Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

mpt3sas: Don't spam logs if logging level is 0

commit 0d667f72b2a20bbac72bec0ab11467fc70bb0f1f upstream.

In _scsih_io_done() we test if the ioc->logging_level does _not_ have
the MPT_DEBUG_REPLY bit set and if it hasn't we print the debug
messages. This unfortunately is the wrong way around.

Note, the actual bug is older than af0094115 but this commit removed the
CONFIG_SCSI_MPT3SAS_LOGGING Kconfig option which hid the bug.

Fixes: af0094115 'mpt2sas, mpt3sas: Remove SCSI_MPTXSAS_LOGGING entry from Kconfig'
Signed-off-by: Johannes Thumshirn <jthumshirn@suse.de>
Acked-by: Chaitra P B <chaitra.basappa@broadcom.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

perf symbols: Fixup symbol sizes before picking best ones

commit 432746f8e0b6a82ba832b771afe31abd51af6752 upstream.

When we call symbol__fixup_duplicate() we use algorithms to pick the
"best" symbols for cases where there are various functions/aliases to an
address, and those check zero size symbols, which, before calling
symbol__fixup_end() are _all_ symbols in a just parsed kallsyms file.

So first fixup the end, then fixup the duplicates.

Found while trying to figure out why 'perf test vmlinux' failed, see the
output of 'perf test -v vmlinux' to see cases where the symbols picked
as best for vmlinux don't match the ones picked for kallsyms.

Cc: Anton Blanchard <anton@samba.org>
Cc: Adrian Hunter <adrian.hunter@intel.com>
Cc: David Ahern <dsahern@gmail.com>
Cc: Jiri Olsa <jolsa@kernel.org>
Cc: Masami Hiramatsu <mhiramat@kernel.org>
Cc: Namhyung Kim <namhyung@kernel.org>
Cc: Wang Nan <wangnan0@huawei.com>
Fixes: 694bf407b061 ("perf symbols: Add some heuristics for choosing the best duplicate symbol")
Link: http://lkml.kernel.org/n/tip-rxqvdgr0mqjdxee0kf8i2ufn@git.kernel.org
Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

perf symbols: Check symbol_conf.allow_aliases for kallsyms loading too

commit c97b40e4d15f13a36cd037d598e45cbe9e1e5757 upstream.

We can allow aliases to be kept, but we were checking this just when
loading vmlinux files, be consistent, do it for any symbol table loading
code that calls symbol__fixup_duplicate() by making this function check
.allow_aliases instead.

Cc: Adrian Hunter <adrian.hunter@intel.com>
Cc: David Ahern <dsahern@gmail.com>
Cc: Jiri Olsa <jolsa@kernel.org>
Cc: Masami Hiramatsu <mhiramat@kernel.org>
Cc: Namhyung Kim <namhyung@kernel.org>
Cc: Wang Nan <wangnan0@huawei.com>
Fixes: 680d926a8cb0 ("perf symbols: Allow symbol alias when loading map for symbol name")
Link: http://lkml.kernel.org/n/tip-z0avp0s6cfjckc4xj3pdfjdz@git.kernel.org
Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

perf hists browser: Fix event group display

commit d9ea48bc4e7cc297ca1073fa3f90ed80d964b7b4 upstream.

Milian reported that the event group on TUI shows duplicated overhead.
This was due to a bug on calculating hpp->buf position.  The
hpp_advance() was called from __hpp__slsmg_color_printf() on TUI but
it's already called from the hpp__call_print_fn macro in __hpp__fmt().
The end result is that the print function returns number of bytes it
printed but the buffer advanced twice of the length.

This is generally not a problem since it doesn't need to access the
buffer again.  But with event group, overhead needs to be printed
multiple times and hist_entry__snprintf_alignment() tries to fill the
space with buffer after it printed.  So it (brokenly) showed the last
overhead again.

The bug was there from the beginning, but I think it's only revealed
when the alignment function was added.

Reported-by: Milian Wolff <milian.wolff@kdab.com>
Signed-off-by: Namhyung Kim <namhyung@kernel.org>
Cc: Andi Kleen <andi@firstfloor.org>
Cc: Jiri Olsa <jolsa@kernel.org>
Cc: Peter Zijlstra <a.p.zijlstra@chello.nl>
Fixes: 89fee7094323 ("perf hists: Do column alignment on the format iterator")
Link: http://lkml.kernel.org/r/20160912061958.16656-2-namhyung@kernel.org
Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

clk: divider: Fix clk_divider_round_rate() to use clk_readl()

commit 2cf9a57811bddb6fa6b0f8d7376da164d5534813 upstream.

clk-divider uses clk_readl()/clk_writel() everywhere, except in
clk_divider_round_rate(), where plain readl() is used. Change this to
clk_readl(), as it makes a difference on powerpc.

Fixes: e6d5e7d90be92cee ("clk-divider: Fix READ_ONLY when divider > 1")
Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
Reviewed-by: James Hogan <james.hogan@imgtec.com>
Signed-off-by: Stephen Boyd <sboyd@codeaurora.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

clk: qoriq: fix a register offset error

commit 8964193f6bfda5c4cf14eedb7e94892c1f1c34f0 upstream.

The offset of Core Cluster clock control/status register
on cluster group V3 version is different from others, and
should be plus 0x70000.

Signed-off-by: Tang Yuantian <yuantian.tang@nxp.com>
Reviewed-by: Scott Wood <oss@buserror.net>
Fixes: 9e19ca2f627e ("clk: qoriq: Add ls2080a support.")
Signed-off-by: Stephen Boyd <sboyd@codeaurora.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

s390/con3270: fix insufficient space padding

commit 6cd997db911f28f2510b771691270c52b63ed2e6 upstream.

con3270 contains an optimisation that reduces the amount of data to be
transmitted to the 3270 terminal by putting a Repeat to Address (RA)
order into the data stream. The RA order itself takes up space, so
con3270 only uses it if there's enough space left in the line
buffer. Otherwise it just pads out the line manually.

For lines that were _just_ short enough that the RA order still fit in
the line buffer, the line was instead padded with an insufficient
amount of spaces. This was caused by examining the size of the
allocated line buffer rather than the length of the string to be
displayed.

For con3270_cline_end(), we just compare against the line length. For
con3270_update_string() however that isn't available anymore, so we
check whether the Repeat to Address order is present.

Fixes: f51320a5 ("[PATCH] s390: new 3270 driver.") (tglx/history.git)
Tested-by: Jing Liu <liujbjl@linux.vnet.ibm.com>
Tested-by: Yang Chen <bjcyang@linux.vnet.ibm.com>
Signed-off-by: Sascha Silbe <silbe@linux.vnet.ibm.com>
Signed-off-by: Martin Schwidefsky <schwidefsky@de.ibm.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

s390/con3270: fix use of uninitialised data

commit c14f2aac7aa147861793eed9f41f91dd530f0be1 upstream.

con3270 contains an optimisation that reduces the amount of data to be
transmitted to the 3270 terminal by putting a Repeat to Address (RA)
order into the data stream. The RA order itself takes up space, so
con3270 only uses it if there's enough space left in the line
buffer. Otherwise it just pads out the line manually.

For lines too long to include the RA order, one byte was left
uninitialised. This was caused by an off-by-one bug in the loop that
pads out the line. Since the buffer is allocated from a common pool,
the single byte left uninitialised contained some previous buffer
content. Usually this was just a space or some character (which can
result in clutter but is otherwise harmless). Sometimes, however, it
was a Repeat to Address order, messing up the entire screen layout and
causing the display to send the entire buffer content on every
keystroke.

Fixes: f51320a5 ("[PATCH] s390: new 3270 driver.") (tglx/history.git)
Reported-by: Liu Jing <liujbjl@linux.vnet.ibm.com>
Tested-by: Jing Liu <liujbjl@linux.vnet.ibm.com>
Tested-by: Yang Chen <bjcyang@linux.vnet.ibm.com>
Signed-off-by: Sascha Silbe <silbe@linux.vnet.ibm.com>
Signed-off-by: Martin Schwidefsky <schwidefsky@de.ibm.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

s390/cio: fix accidental interrupt enabling during resume

commit d53c51f26145657aa7c55fa396f93677e613548d upstream.

Since commit 9f3d6d7 chsc_get_channel_measurement_chars is called with
interrupts disabled during resume from hibernate. Since this function
used spin_unlock_irq, interrupts have been enabled accidentally. Fix
this by using the irqsave variant.

Since we can't guarantee the IRQ-enablement state for all (future/
external) callers, change the locking in related functions to prevent
similar bugs in the future.

Fixes: 9f3d6d7 ("s390/cio: update measurement characteristics")
Signed-off-by: Sebastian Ott <sebott@linux.vnet.ibm.com>
Reviewed-by: Peter Oberparleiter <oberpar@linux.vnet.ibm.com>
Signed-off-by: Martin Schwidefsky <schwidefsky@de.ibm.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

x86/mm: Expand the exception table logic to allow new handling options

commit 548acf19234dbda5a52d5a8e7e205af46e9da840 upstream.

Huge amounts of help from  Andy Lutomirski and Borislav Petkov to
produce this. Andy provided the inspiration to add classes to the
exception table with a clever bit-squeezing trick, Boris pointed
out how much cleaner it would all be if we just had a new field.

Linus Torvalds blessed the expansion with:

  ' I'd rather not be clever in order to save just a tiny amount of space
    in the exception table, which isn't really criticial for anybody. '

The third field is another relative function pointer, this one to a
handler that executes the actions.

We start out with three handlers:

 1: Legacy - just jumps the to fixup IP
 2: Fault - provide the trap number in %ax to the fixup code
 3: Cleaned up legacy for the uaccess error hack

Signed-off-by: Tony Luck <tony.luck@intel.com>
Reviewed-by: Borislav Petkov <bp@suse.de>
Cc: Linus Torvalds <torvalds@linux-foundation.org>
Cc: Peter Zijlstra <peterz@infradead.org>
Cc: Thomas Gleixner <tglx@linutronix.de>
Link: http://lkml.kernel.org/r/f6af78fcbd348cf4939875cfda9c19689b5e50b8.1455732970.git.tony.luck@intel.com
Signed-off-by: Ingo Molnar <mingo@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

dmaengine: ipu: remove bogus NO_IRQ reference

commit 86c7e6836479c4045a9a81ed5ea76c51d719f9c1 upstream.

A workaround for a warning introduced a use of the NO_IRQ
macro that should have been gone for a long time.

It is clear from the code that the value cannot actually
be used, but apparently there was a configuration at
some point that caused a warning, so instead of just
reverting that patch, this rearranges the code in a way that
the warning cannot reappear.

Signed-off-by: Arnd Bergmann <arnd@arndb.de>
Fixes: 6ef41cf6f721 ("dmaengine :ipu: change ipu_irq_handler() to remove compile warning")
Signed-off-by: Vinod Koul <vinod.koul@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

power: bq24257: Fix use of uninitialized pointer bq->charger

commit 0610735928ee47870e083d5901caa371089216f1 upstream.

bq->charger is initialized in bq24257_power_supply_init.
Therefore, bq24257_power_supply_init should be called before the
registration of the IRQ handler bq24257_irq_handler_thread that calls
power_supply_changed(bq->charger).

Signed-off-by: Georges Savoundararadj <savoundg@gmail.com>
Cc: Aurelien Chanot <chanot.a@gmail.com>
Cc: Andreas Dannenberg <dannenberg@ti.com>
Cc: Sebastian Reichel <sre@kernel.org>
Cc: David Woodhouse <dwmw2@infradead.org>
Fixes: 2219a935963e ("power_supply: Add TI BQ24257 charger driver")
Signed-off-by: Sebastian Reichel <sre@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

staging: r8188eu: Fix scheduling while atomic splat

commit 1335a9516d3d52f157ad87456efdd8dc9ae1747b upstream.

Commit fadbe0cd5292851608e2e01b91d9295fa287b9fe ("staging: rtl8188eu:
Remove rtw_zmalloc(), wrapper for kzalloc()") changed all allocation
calls to be GFP_KERNEL even though the original wrapper was testing
to determine if the caller was in atomic mode. Most of the mistakes
were corrected with commit 33dc85c3c667209c930b2dac5ccbc2a365e06b7a
("staging: r8188eu: Fix scheduling while atomic error introduced in
commit fadbe0cd"); however, two kzalloc calls were missed as the
call only happens when the driver is shutting down.

Fixes: fadbe0cd5292851608e2e01b91d9295fa287b9fe ("staging: rtl8188eu: Remove rtw_zmalloc(), wrapper for kzalloc()")
Signed-off-by: Larry Finger <Larry.Finger@lwfinger.net>
Cc: navin patidar <navin.patidar@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

ASoC: dapm: Fix kcontrol creation for output driver widget

commit a3930ed060df4ccf2a06cf0b68738dec3e6ff89a upstream.

Commit d88429a695a4 ("ASoC: dapm: Add output driver widget") added
the snd_soc_dapm_out_drv ID for the output driver widget, which is
the same as the PGA widget, with a later power sequence number.

Commit 19a2557b76d6 ("ASoC: dapm: Add kcontrol support for PGAs")
then added kcontrol support for PGA widgets, but failed to account
for output driver widgets. Attempts to use kcontrols with output
driver widgets result in silent failures, with the developer having
little idea about what went on.

Add snd_soc_dapm_out_drv to the switch/case block under snd_soc_dapm_pga
in dapm_create_or_share_kcontrol, since they are essentially the same.

Fixes: 19a2557b76d6 (ASoC: dapm: Add kcontrol support for PGAs)
Signed-off-by: Chen-Yu Tsai <wens@csie.org>
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

ASoC: dapm: Fix value setting for _ENUM_DOUBLE MUX's second channel

commit 071133a209354f39d4e5785d5a6a390e03241841 upstream.

The value for the second channel in _ENUM_DOUBLE (double channel) MUXs
is not correctly updated, due to using the wrong bit shift.

Use the correct bit shift, so both channels toggle together.

Fixes: 3727b4968453 (ASoC: dapm: Consolidate MUXs and value MUXs)
Signed-off-by: Chen-Yu Tsai <wens@csie.org>
Reviewed-by: Charles Keepax <ckeepax@opensource.wolfsonmicro.com>
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

ASoC: dapm: Fix possible uninitialized variable in snd_soc_dapm_get_volsw()

commit 01ad5e7de67b408d9b48b437b06a9938ddf460b5 upstream.

If soc_dapm_read() fails, val will be uninitialized, and bogus values
will be written later:

ret = soc_dapm_read(dapm, reg, &val);
val = (val >> shift) & mask;

However, the compiler does not give a warning. Return on error before
val is really used to avoid this.

This is similar to the commit 6912831623c5 ("ASoC: dapm: Fix
uninitialized variable in snd_soc_dapm_get_enum_double()")

Fixes: ce0fc93ae56e (ASoC: Add DAPM support at the component level)
Signed-off-by: Chen-Yu Tsai <wens@csie.org>
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

ASoC: topology: Fix error return code in soc_tplg_dapm_widget_create()

commit 8ae3ea48df0d746b663057cf0b972a18d0777b7b upstream.

Fix to return error code -ENOMEM instead of 0 when failed to create
widget, as done elsewhere in this function.

Fixes: 8a9782346dcc ("ASoC: topology: Add topology core")
Signed-off-by: Wei Yongjun <weiyj.lk@gmail.com>
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

hwrng: omap - Only fail if pm_runtime_get_sync returns < 0

commit ad8529fde9e3601180a839867a8ab041109aebb5 upstream.

Currently omap-rng checks the return value of pm_runtime_get_sync and
reports failure if anything is returned, however it should be checking
if ret < 0 as pm_runtime_get_sync return 0 on success but also can return
1 if the device was already active which is not a failure case. Only
values < 0 are actual failures.

Fixes: 61dc0a446e5d ("hwrng: omap - Fix assumption that runtime_get_sync will always succeed")
Signed-off-by: Dave Gerlach <d-gerlach@ti.com>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

crypto: arm/ghash-ce - add missing async import/export

commit ed4767d612fd2c39e2c4c69eba484c1219dcddb6 upstream.

Since commit 8996eafdcbad ("crypto: ahash - ensure statesize is non-zero"),
all ahash drivers are required to implement import()/export(), and must have
a non-zero statesize. Fix this for the ARM Crypto Extensions GHASH
implementation.

Fixes: 8996eafdcbad ("crypto: ahash - ensure statesize is non-zero")
Signed-off-by: Ard Biesheuvel <ard.biesheuvel@linaro.org>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

crypto: gcm - Fix IV buffer size in crypto_gcm_setkey

commit 50d2e6dc1f83db0563c7d6603967bf9585ce934b upstream.

The cipher block size for GCM is 16 bytes, and thus the CTR transform
used in crypto_gcm_setkey() will also expect a 16-byte IV. However,
the code currently reserves only 8 bytes for the IV, causing
an out-of-bounds access in the CTR transform. This patch fixes
the issue by setting the size of the IV buffer to 16 bytes.

Fixes: 84c911523020 ("[CRYPTO] gcm: Add support for async ciphers")
Signed-off-by: Ondrej Mosnacek <omosnacek@gmail.com>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

mwifiex: correct aid value during tdls setup

commit b64db1b252e9974a43a51ba083fa7d03e4716167 upstream.

AID gets updated during TDLS setup, but modified value isn't reflected
in "priv->assoc_rsp_buf". This causes TDLS setup failure. The problem is
fixed here.

Fixes: 4aff53ef18e4a4 ("mwifiex: parsing aid while receiving..")
Signed-off-by: Xinming Hu <huxm@marvell.com>
Signed-off-by: Amitkumar Karwar <akarwar@marvell.com>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

spi: spi-fsl-dspi: Drop extra spi_master_put in device remove function

commit 6999aeabbb703a81a204cb6f9f8f151759a99ac4 upstream.

The call sequence spi_alloc_master/spi_register_master/spi_unregister_master
is complete; it reduces the device reference count to zero, which and results
in device memory being freed. The subsequent call to spi_master_put is
unnecessary and results in an access to free memory. Drop it.

Fixes: 9298bc727385 ("spi: spi-fsl-dspi: Remove spi-bitbang")
Signed-off-by: Wei Yongjun <weiyj.lk@gmail.com>
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

ARM: clk-imx35: fix name for ckil clk

commit fcff03813a7c612873303037cef5ba0329850c35 upstream.

This fixes
[    0.000000] i.MX clk 82: register failed with -17
because the name is duplicated.

Signed-off-by: Uwe Kleine-König <u.kleine-koenig@pengutronix.de>
Fixes: 3713e3f5e927 ("clk: imx35: define two clocks for rtc")
Acked-by: Shawn Guo <shawnguo@kernel.org>
Signed-off-by: Stephen Boyd <sboyd@codeaurora.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

uio: fix dmem_region_start computation

commit 4d31a2588ae37a5d0f61f4d956454e9504846aeb upstream.

The variable i contains a total number of resources (including
IORESOURCE_IRQ). However, we want the dmem_region_start to point
after the last resource of type IORESOURCE_MEM. The original behaviour
leads (very likely) to skipping several UIO mapping regions and makes
them useless. Fix this by computing dmem_region_start from the uiomem
which points to the last used UIO mapping.

Fixes: 0a0c3b5a24bd ("Add new uio device for dynamic memory allocation")
Signed-off-by: Jan Viktorin <viktorin@rehivetech.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

genirq/generic_chip: Add irq_unmap callback

commit ee26c013cdee0b947e29d6cadfb9ff3341c69ff9 upstream.

Without this patch irq_domain_disassociate() cannot properly release the
interrupt. In fact, irq_map_generic_chip() checks a bit on 'gc->installed'
but said bit is never cleared, only set.

Commit 088f40b7b027 ("genirq: Generic chip: Add linear irq domain support")
added irq_map_generic_chip() function and also stated "This lacks a removal
function for now".

This commit provides an implementation of an unmap function that can be
called by irq_domain_disassociate().

[ tglx: Made the function static and removed the export as we have neither
   a prototype nor a modular user. ]

Fixes: 088f40b7b027 ("genirq: Generic chip: Add linear irq domain support")
Signed-off-by: Sebastian Frias <sf84@laposte.net>
Cc: Marc Zyngier <marc.zyngier@arm.com>
Cc: Mason <slash.tmp@free.fr>
Cc: Jason Cooper <jason@lakedaemon.net>
Link: http://lkml.kernel.org/r/579F5C5A.2070507@laposte.net
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

perf stat: Fix interval output values

commit 51fd2df1e882a3c2a3f4b6c9ff243a93c9046dba upstream.

We broke interval data displays with commit:

  3f416f22d1e2 ("perf stat: Do not clean event's private stats")

This commit removed stats cleaning, which is important for '-r' option
to carry counters data over the whole run. But it's necessary to clean
it for interval mode, otherwise the displayed value is avg of all
previous values.

Before:
  $ perf stat -e cycles -a -I 1000 record
  #           time             counts unit events
       1.000240796         75,216,287      cycles
       2.000512791        107,823,524      cycles

  $ perf stat report
  #           time             counts unit events
       1.000240796         75,216,287      cycles
       2.000512791         91,519,906      cycles

Now:
  $ perf stat report
  #           time             counts unit events
       1.000240796         75,216,287      cycles
       2.000512791        107,823,524      cycles

Notice the second value being bigger (91,.. < 107,..).

This could be easily verified by using perf script which displays raw
stat data:

  $ perf script
  CPU  THREAD       VAL         ENA         RUN        TIME EVENT
    0      -1  23855779  1000209530  1000209530  1000240796 cycles
    1      -1  33340397  1000224964  1000224964  1000240796 cycles
    2      -1  15835415  1000226695  1000226695  1000240796 cycles
    3      -1   2184696  1000228245  1000228245  1000240796 cycles
    0      -1  97014312  2000514533  2000514533  2000512791 cycles
    1      -1  46121497  2000543795  2000543795  2000512791 cycles
    2      -1  32269530  2000543566  2000543566  2000512791 cycles
    3      -1   7634472  2000544108  2000544108  2000512791 cycles

The sum of the first 4 values is the first interval aggregated value:

  23855779 + 33340397 + 15835415 + 2184696 = 75,216,287

The sum of the second 4 values minus first value is the second interval
aggregated value:

  97014312 + 46121497 + 32269530 + 7634472 - 75216287 = 107,823,524

Signed-off-by: Jiri Olsa <jolsa@kernel.org>
Cc: Andi Kleen <ak@linux.intel.com>
Cc: David Ahern <dsahern@gmail.com>
Cc: Namhyung Kim <namhyung@kernel.org>
Cc: Peter Zijlstra <a.p.zijlstra@chello.nl>
Cc: Stephane Eranian <eranian@google.com>
Link: http://lkml.kernel.org/r/1454485436-20639-1-git-send-email-jolsa@kernel.org
Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
Cc: Jeremy Linton <jeremy.linton@arm.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

powerpc/eeh: Null check uses of eeh_pe_bus_get

commit 04fec21c06e35b169a83e75a84a015ab4606bf5e upstream.

eeh_pe_bus_get() can return NULL if a PCI bus isn't found for a given PE.
Some callers don't check this, and can cause a null pointer dereference
under certain circumstances.

Fix this by checking NULL everywhere eeh_pe_bus_get() is called.

Fixes: 8a6b1bc70dbb ("powerpc/eeh: EEH core to handle special event")
Cc: stable@vger.kernel.org # v3.11+
Signed-off-by: Russell Currey <ruscur@russell.cc>
Reviewed-by: Andrew Donnellan <andrew.donnellan@au1.ibm.com>
Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

tunnels: Remove encapsulation offloads on decap.

commit a09a4c8dd1ec7f830e1fb9e59eb72bddc965d168 upstream.

If a packet is either locally encapsulated or processed through GRO
it is marked with the offloads that it requires. However, when it is
decapsulated these tunnel offload indications are not removed. This
means that if we receive an encapsulated TCP packet, aggregate it with
GRO, decapsulate, and retransmit the resulting frame on a NIC that does
not support encapsulation, we won't be able to take advantage of hardware
offloads even though it is just a simple TCP packet at this point.

This fixes the problem by stripping off encapsulation offload indications
when packets are decapsulated.

The performance impacts of this bug are significant. In a test where a
Geneve encapsulated TCP stream is sent to a hypervisor, GRO'ed, decapsulated,
and bridged to a VM performance is improved by 60% (5Gbps->8Gbps) as a
result of avoiding unnecessary segmentation at the VM tap interface.

Reported-by: Ramu Ramamurthy <sramamur@linux.vnet.ibm.com>
Fixes: 68c33163 ("v4 GRE: Add TCP segmentation offload for GRE")
Signed-off-by: Jesse Gross <jesse@kernel.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
(backported from commit a09a4c8dd1ec7f830e1fb9e59eb72bddc965d168)
[adapt iptunnel_pull_header arguments, avoid 7f290c9]
Signed-off-by: Stefan Bader <stefan.bader@canonical.com>
Signed-off-by: Juerg Haefliger <juerg.haefliger@hpe.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

tunnels: Don't apply GRO to multiple layers of encapsulation.

commit fac8e0f579695a3ecbc4d3cac369139d7f819971 upstream.

When drivers express support for TSO of encapsulated packets, they
only mean that they can do it for one layer of encapsulation.
Supporting additional levels would mean updating, at a minimum,
more IP length fields and they are unaware of this.

No encapsulation device expresses support for handling offloaded
encapsulated packets, so we won't generate these types of frames
in the transmit path. However, GRO doesn't have a check for
multiple levels of encapsulation and will attempt to build them.

UDP tunnel GRO actually does prevent this situation but it only
handles multiple UDP tunnels stacked on top of each other. This
generalizes that solution to prevent any kind of tunnel stacking
that would cause problems.

Fixes: bf5a755f ("net-gre-gro: Add GRE support to the GRO stack")
Signed-off-by: Jesse Gross <jesse@kernel.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Juerg Haefliger <juerg.haefliger@hpe.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

ipip: Properly mark ipip GRO packets as encapsulated.

commit b8cba75bdf6a48ea4811bbefb11a94a5c7281b68 upstream.

ipip encapsulated packets can be merged together by GRO but the result
does not have the proper GSO type set or even marked as being
encapsulated at all. Later retransmission of these packets will likely
fail if the device does not support ipip offloads. This is similar to
the issue resolved in IPv6 sit in feec0cb3
("ipv6: gro: support sit protocol").

Reported-by: Patrick Boutilier <boutilpj@ednet.ns.ca>
Fixes: 9667e9bb ("ipip: Add gro callbacks to ipip offload")
Tested-by: Patrick Boutilier <boutilpj@ednet.ns.ca>
Acked-by: Eric Dumazet <edumazet@google.com>
Signed-off-by: Jesse Gross <jesse@kernel.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Juerg Haefliger <juerg.haefliger@hpe.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>