Commit Graph

767 Commits

Author SHA1 Message Date
Mauro (mdrjr) Ribeiro
3b7e1f914d Merge tag 'v4.9.156' of git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable into odroidn2-4.9.y
This is the 4.9.156 stable release
2019-02-13 20:10:32 -02:00
Mauro (mdrjr) Ribeiro
d6a65d5b04 Merge tag 'v4.9.152' of git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable into odroidn2-4.9.y
This is the 4.9.152 stable release
2019-02-13 20:10:04 -02:00
Peter Rosin
06df6307c6 fbdev: fbmem: behave better with small rotated displays and many CPUs
[ Upstream commit f75df8d4b4 ]

Blitting an image with "negative" offsets is not working since there
is no clipping. It hopefully just crashes. For the bootup logo, there
is protection so that blitting does not happen as the image is drawn
further and further to the right (ROTATE_UR) or further and further
down (ROTATE_CW). There is however no protection when drawing in the
opposite directions (ROTATE_UD and ROTATE_CCW).

Add back this protection.

The regression is 20-odd years old but the mindless warning-killing
mentality displayed in commit 34bdb666f4 ("fbdev: fbmem: remove
positive test on unsigned values") is also to blame, methinks.

Fixes: 448d479747 ("fbdev: fb_do_show_logo() updates")
Signed-off-by: Peter Rosin <peda@axentia.se>
Cc: Tomi Valkeinen <tomi.valkeinen@ti.com>
Cc: Fabian Frederick <ffrederick@users.sourceforge.net>
Cc: Geert Uytterhoeven <geert+renesas@glider.be>
cc: Geoff Levand <geoff@infradead.org>
Cc: James Simmons <jsimmons@users.sf.net>
Signed-off-by: Bartlomiej Zolnierkiewicz <b.zolnierkie@samsung.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
2019-02-12 19:44:56 +01:00
Alexey Khoroshilov
55e7919907 video: clps711x-fb: release disp device node in probe()
[ Upstream commit fdac751355 ]

clps711x_fb_probe() increments refcnt of disp device node by
of_parse_phandle() and leaves it undecremented on both
successful and error paths.

Found by Linux Driver Verification project (linuxtesting.org).

Signed-off-by: Alexey Khoroshilov <khoroshilov@ispras.ru>
Cc: Alexander Shiyan <shc_work@mail.ru>
Signed-off-by: Bartlomiej Zolnierkiewicz <b.zolnierkie@samsung.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
2019-02-12 19:44:56 +01:00
Vlad Tsyrklevich
f5a7973c32 omap2fb: Fix stack memory disclosure
commit a01421e448 upstream.

Using [1] for static analysis I found that the OMAPFB_QUERY_PLANE,
OMAPFB_GET_COLOR_KEY, OMAPFB_GET_DISPLAY_INFO, and OMAPFB_GET_VRAM_INFO
cases could all leak uninitialized stack memory--either due to
uninitialized padding or 'reserved' fields.

Fix them by clearing the shared union used to store copied out data.

[1] https://github.com/vlad902/kernel-uninitialized-memory-checker

Signed-off-by: Vlad Tsyrklevich <vlad@tsyrklevich.net>
Reviewed-by: Kees Cook <keescook@chromium.org>
Fixes: b39a982dde ("OMAP: DSS2: omapfb driver")
Cc: security@kernel.org
[b.zolnierkie: prefix patch subject with "omap2fb: "]
Signed-off-by: Bartlomiej Zolnierkiewicz <b.zolnierkie@samsung.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2019-01-23 08:10:55 +01:00
jiejing.wang
6b2d479409 ODROID-COMMON:Merge AMLogic BSP 181208
ODROID-COMMON:Merge AMLogic BSP 181208
audioinfo: fix kasan compile problem [1/1]

PD#173553

Problem:
check stack out of bounds

Solution:
change variable's definition

Verify:
verifyed by r311

Change-Id: Id6efc3ac56b297b6812e2af786732e65867a07da
Signed-off-by: jiejing.wang <jiejing.wang@amlogic.com>

buildroot: Enable fb memory allocation in g12b_skt dts [1/1]

PD#SWPL-802

Problem:
  Kernel crash when run GPU slt program

Solution:
  Enable meson fb memory allocation in g12b_skt dts

Verify:
  w400

Change-Id: I3074c2053cda06cf4ae237d24bad2c89d789f90d
Signed-off-by: Blance Tang <guofeng.tang@amlogic.com>

amvecm: hdr: add hdr10 plus support [1/2]

PD#SWPL-869

Problem:
new feature, add hdr10 plus support

Solution:
1. add hdr10 plus metadat parser
2. add hdr10 plus code support
3. add hdr10 plus bypass mode

Verify:
verify on U200

Change-Id: I957954ce148021882e17f2913dd2552e64f1298c
Signed-off-by: MingLiang Dong <mingliang.dong@amlogic.com>

irqchip: add a new gpio IRQ driver to support double-edge detection [1/1]

PD#SWPL-922

Problem:
the existing gpio IRQ driver(porting from the upstream) does not
double-edge detection

Solution:
add a new gpio IRQ driver to support the double-edge detection,
the new driver is with different software structure but compatible
with functions of the existing driver

Verify:
test pass on s400

Change-Id: Id69dd0b4459eef20a6755947c7d95a24d7b17fa9
Signed-off-by: Xingyu Chen <xingyu.chen@amlogic.com>

pinctrl: fix some mistakes [1/1]

PD#172438

Problem:
1. return a negative when parsing the dts property
"output-high/output-low"
2. the prefix "bt565" don't meet corepinmux document

Solution:
1. add break statement in case PIN_CONFIG_OUTPUT to avoid
returning a negative value.
2. rename the "bt565" to "bt656" according to corepinmux document

Verify:
test pass on U200

Change-Id: Ieeb98367e2269007a6774592abac86ef05ee8f64
Signed-off-by: Xingyu Chen <xingyu.chen@amlogic.com>

amvecm: fix flicker when change between Launcher and Signal Source [1/1]

PD#SWPL-848

Problem:
ioctrl set the same gamma value again

Solution:
if the gamma value is same as the ioctrl userspace value, do not set again

Verify:
txlx

Change-Id: I6f17f5ff234513c5a886004aedea81b9945c5b98
Signed-off-by: Bencheng Jing <bencheng.jing@amlogic.com>

vpu: add support for tl1 [1/1]

PD#172587

Problem:
Bringup vpu for TL1.

Solution:
Add vpu support for TL1.

Verify:
Verified on PTM/PXP.

Change-Id: Ic2fb7682ddc1b21840e1be1d8462d4c0902e739d
Signed-off-by: Evoke Zhang <evoke.zhang@amlogic.com>

lcd: add tl1 support [1/1]

PD#172587

Problem:
not support tl1

Solution:
add tl1 support

Verify:
test pass on PTM

Change-Id: I5a9073fc08a98ae95d4961297a7427864d92279b
Signed-off-by: Evoke Zhang <evoke.zhang@amlogic.com>

backlight: add support for tl1 [1/1]

PD#172587

Problem:
do not suppoert for tl1

Solution:
add backlight support for fl1

Verify:
verified on PTM

Change-Id: I052a7ef93ec9cb21a544e4823a4c9a339d38b5f9
Signed-off-by: Evoke Zhang <evoke.zhang@amlogic.com>

arm: dts: tl1: add decoder device tree [3/3]

PD#174543

PD#172587

Problem:
new added function for tl1

Solution:
add vdin afbce support for tl1

Verify:
verified on PTM

Change-Id: I42054b8228161713ac10446491ebdb50a71975ad
Signed-off-by: shihong.zheng <shihong.zheng@amlogic.com>

media: add codec support for tl1 [1/1]

PD#172587

Problem:
Bringup codec for TL1.

Solution:
Add codec iomap device tree node for TL1.
Add canvas device tree node for TL1.

Verify:
Verified on PXP/PTM.

Change-Id: I8b9a6645f1f9fd7d4aa9cae6166895e61ddc3e36
Signed-off-by: pengcheng chen <pengcheng.chen@amlogic.com>

rdma: add rdma support for tl1 [1/1]

PD#172587

Problem:
Bringup rdma for TL1.

Solution:
Add rdma support for TL1.

Verify:
Verified on PXP/PTM.

Change-Id: I425edc1e47db2ea834fcc5acb0e3d0ee1f30a9f7
Signed-off-by: pengcheng chen <pengcheng.chen@amlogic.com>

osd: tl1: add osd support for tl1 [1/1]

PD#172587

Problem:
Bringup osd for TL1.

Solution:
Add osd support for TL1.
Add ge2d device tree node for TL1.

Verify:
Verified on PXP/PTM.

Change-Id: I3d20934f015108f545c3c72b979d1bd8187b282e
Signed-off-by: pengcheng chen <pengcheng.chen@amlogic.com>

amvideo: add amvideo support for tl1 [1/1]

PD#172587

Problem:
TL1 needs support amvideo driver.

Solution:
1. Add amvideo node into dts file, default enable.
2. Change the vd mif and sr reg offset.
3. Force bypass dolby vision function.
4. Change the register following hardware design.
5. Make amvideo afbc work for tl1.

Verify:
On PTM.

Change-Id: I0d857f8a707328383328daa23e6ba8e156c2e6e0
Signed-off-by: Brian Zhu <brian.zhu@amlogic.com>

audio: auge: add sound card support for tl1 [1/1]

PD#172587

Problem:
Bringup tl1 sound card.

Solution:
Add tl1 sound card.
Add external interface for audio input/output.

Verify:
Tested by PTM
Sound card is setup.
TDM and SPDIF internel loopback is ok

Change-Id: I60830ca44a62ee2a8e16343e91e7311152cab161
Signed-off-by: Xing Wang <xing.wang@amlogic.com>

vdac: vdac: add vdac support for tl1 [1/1]

PD#172587

Problem:
do not suppoert for tl1

Solution:
add vdac support for fl1

Verify:
test pass on local

Change-Id: I7b3da34289dfe0638a24b812658db7e462ebdd4c
Signed-off-by: Nian Jing <nian.jing@amlogic.com>

avin: add avin detect support for tl1 [1/1]

PD#172587

Problem:
do not suppoert for tl1

Solution:
add avin detect support for fl1

Verify:
just coding for tl1 will test later

Change-Id: I809f7068c9d0a45c89bd7dc4e6615db99b11f015
Signed-off-by: Nian Jing <nian.jing@amlogic.com>

tvin: add vdin and viu support for tl1 [1/1]

PD#172587

Problem:
do not suppoert for tl1

Solution:
add vdin and viu support for fl1

Verify:
verified on PTM

Change-Id: If4e267356fa666541853cfc7b49008795f9ec301
Signed-off-by: xuhua zhang <xuhua.zhang@amlogic.com>

vdin: add afbce function for tl1 [1/1]

PD#172587

Problem:
new added function for tl1

Solution:
add vdin afbce support for tl1

Verify:
verified on PTM

Change-Id: I5e3e2487b6cdbed2d2ca794a6a21ed885e4bf469
Signed-off-by: xuhua zhang <xuhua.zhang@amlogic.com>

hdmirx: hdmirx driver for tl1 [1/1]

PD#172587

Problem:
hdmirx bringup for tl1

Solution:
1.modify write top api, add addr offset -qy
2.modify write edid api -qy
3.replace top hw reset api
4.add aocec access register idle -qy
5.for tl1 bypass sw eq -qy
6.replace pddq api -qy
7.modify arc control for tl1 -qy
8.add n/cts auto mode
9.add hdcp balance path
10.add sscp mode
11.optimize reg map(rm unused reg addr)
12.add recent commits from 4.9 trunk
13.modify top clk cntl bit definition
14.modify top offset addr handle(x4)
15.add audio pll setting -qy
16.update phy setting - qy
17.modify audio pll ctrl api for tl1 -qy
	-add clk monitor function
	-add clk stable api for tl1
18.add emp data to pfifo -qy
19.modify edid write and other function -qy
20.add emp data to ddr -qy
21.add tmds data to ddr -qy
22.add cec for tl1 -qy
	-fix ctc 7-1
	-add status register for cec a/b
23.add cec and hdmirx dts -qy
24.clean tl1 rx related clk measure
25.hdmirx and cec dts

Verify:
1.run PTM
2.need verify on chip

Change-Id: Ia7cc5a2d84925587bdfae825936ba763713926af
Signed-off-by: Yong Qin <yong.qin@amlogic.com>

audio: codec: add tl1_acodec support for tl1 [1/1]

PD#172587

Problem:
Add aml_tl1_acodec driver support for tl1

Solution:
1.add files sound/soc/codecs/amlogic/aml_codec_tl1.acodec.c(.h)
2.update files sound/soc/codecs/amlogic/Kconfig(Makefile)

Verify:
kernel build passed, need verified after chipback

Change-Id: I19717a442f22f5b6844627475992ef7c8cc20a71
Signed-off-by: shuyu.li <shuyu.li@amlogic.com>

hdmirx: add hdmirx repeater function [1/6]

PD#SWPL-323:

Problem:
add hdmi repeater function

Solution:
1.add the edid receive and mix.
2.add the flow of repeater.

Verify:
R321

Change-Id: I9942c5f345e2fdfff110f01d4d0c2b4b23120c07
Signed-off-by: hongmin hua <hongmin.hua@amlogic.com>

ddr: fix bandwidth read result 0 on 32bit OS [1/1]

PD#SWPL-960

Problem:
Reading bandwidth of DDR from sysfs get all 0 result on 32
bit kernel

Solution:
Fix overflow when calculating bandwidth.

Verify:
P212

Change-Id: I35837db653bdc2d97ced98689546a9ffc0db21c7
Signed-off-by: tao zeng <tao.zeng@amlogic.com>

mm: reduce watermark if free cma is too large [1/1]

PD#SWPL-807

Problem:
Sometimes driver can't allocation memory under atomic environment.
And free pages is enough but they are nearly ALL CMA pages.

Solution:
Reduce watermark with harf of free cma pages even allocation support
CMA.

Verify:
P212

Change-Id: I8e49768d4384ed064775537754a2b7f09a5bbb7c
Signed-off-by: tao zeng <tao.zeng@amlogic.com>

avb: avb enable need to translate more types [1/1]

PD#SWPL-1095

Problem:
avb need more command line size.

Solution:
change max size to 2048

Verify:
verify by ampere

Change-Id: I9c1089a3ea0888e8ccd82f16d2b1111b6d88922a
Signed-off-by: Luan Yuan <luan.yuan@amlogic.com>

mm: avoid pages migrated to different zone [1/1]

PD#SWPL-881

Problem:
Amlogic modified code when compatcion from normal case.
And side effect is that pages in normal zone maybe migrated to
highmem zone. Which caused page_address get a NULL value and
kernel panic occurred.

Solution:
Avoid pages migarte to different zone by adding forbid_to_cma
flags.

Verify:
P212

Change-Id: I1d9c6653dc1069562db3c1be3f53a3510a51f0d1
Signed-off-by: tao zeng <tao.zeng@amlogic.com>

usb: adb reboot and then adb disconnect [1/1]

PD#174155

Problem:
complete_ep 0xffffffc05bed2858, ep->queue empty!
1. After adb process be killed, data buffer is freed and
this memory is allocated for the other. But the address
is hold by the controller.
2. Adbd in PC is running. So, the controller receive the
data and write to this memory.
3.The value of this memory is modified by the controller.
This could cause the memory problem.

Solution:
whenever io_data->aio equals 1, the data buffer is from a fixed array.

Verify:
Test: adb devices, adb shell, exit, adb push
in android8(p212) and android9(w400)
verified by he he

Change-Id: Idac755d3646639e2944a82f42abf9adb9aeaea8c
Signed-off-by: he.he <he.he@amlogic.com>

dts: support 32bit for gxm_q201 [1/1]

PD#SWPL-1140

Problem:
add support 32bit for gxm_q201.

Solution:
add 32bit dts for gxm_q201.

Verify:
gxm_q201

Change-Id: I3c9a6ae72fad6575bd814818967d9ff80e62f5d4
Signed-off-by: Jianxiong Pan <jianxiong.pan@amlogic.com>

amvecm: pq: add amvecm support for tl1 [1/1]

PD#172587

Problem:
new feature, add amvecm support for tl1

Solution:
1. add cm hist for tl1
2. add 3dlut for tl1
3. add hdr support for tl1
4. add wb for tl1
5. add local contrast

Verify:
verify on tl1 ptm

Change-Id: I1c7ebb83a1fb72a4529415fb9bf4acfd134e6b11
Signed-off-by: MingLiang Dong <mingliang.dong@amlogic.com>

dts: add ir cut control GPIO [1/1]

PD#SWPL-900

Problem:
add ir cut control

Solution:
add ir cut control GPIO

Verify:
g12b-skt

Change-Id: I16c7d03ed4cc1dd3842cab80a987dde1a83e5cbc
Signed-off-by: yu.zhang <yu.zhang@amlogic.com>

hdmitx: add init code for repeater [2/6]

PD#SWPL-323

Problem:
For TXLX/T962E, it has both HDMI Rx and TX, and lacks of HDMI repeater
functions, including HDCP repeater function.

Solution:
Add the init code for hdmi repeater

Verify:
TXLX/T962E/R321

Change-Id: Iaf17ae62c590ff4f8478dd5556f3ed24b9ff3bb1
Signed-off-by: Zongdong Jiao <zongdong.jiao@amlogic.com>

atv_demod: switch channel with the script, the ATV shows no signal [1/1]

PD#SWPL-791

Problem:
Switch channel with the script lasts 14 hours, the ATV shows no signal.

Solution:
To avoid conflict, don't need to check the CLK
and PLL states in atv demod write and read function.

Verify:
verified by p321

Change-Id: I033c54f14541ed540dfce1b9c4e21d2b5a8b9487
Signed-off-by: nengwen.chen <nengwen.chen@amlogic.com>

media: keep last normal frame before reset [2/2]

PD#OTT-71

Problem:
google cast display green lump when seek.
reset after seek opration.

Solution:
keep last normal frame before reset and buf free.

Verify:
U211, Atom

Change-Id: I02304998c9434f1055de1138700510f4c19f466f
Signed-off-by: shihong.zheng <shihong.zheng@amlogic.com>

unifykey: add the hdmirx repeater key block [3/6]

PD#SWPL-323:

Problem:
add the hdmirx repeater key block

Solution:
add the hdmirx repeater key block.

Verify:
R321

Change-Id: I61920b706b5dd08c6be9647add287f85b35fb0ee
Signed-off-by: hongmin hua <hongmin.hua@amlogic.com>

mm: make sure the gtp flag is low default [1/1]

PD#SWPL-807

Problem:
The app's window cound be black screen when launched if the ion system
does not retry to allocate memory with the gtp high flag.

Solution:
make sure the gtp flag is low default

Verify:
P212

Change-Id: I562125573f8175cd180196ca73eb04d7dd36add0
Signed-off-by: an.xi <an.xi@amlogic.com>

dts: emmc: uboot enable emmc config [2/3]

PD#SWPL-736

Problem:
The s400 emmc platform uboot cannot be loaded
into kernel normally

Solution:
enable enable emmc node in dtb by fdt command.
    and modify malloc max size to 18M.

Verify:
s400

Change-Id: Iaef58f1b05a952793d414eb82ac476d88d910fe1
Signed-off-by: yuegui.he <yuegui.he@amlogic.com>

dts: GVSDK: modify loopback and led device name [1/1]

PD#173996

Problem:
1. to support hw loopback channel 2,3 for GVSDK.
2. led is31fl32xx device name register fail.

Solution:
1. change boolback to channel 2,3
2. register led is31fl32xx name success.

Verify:
S400_GVSDK/S420_GVSDK

Change-Id: Ie1bbc01c4624fd1e2e2662c4d9c876e56c301a99
Signed-off-by: Renjun Xu <renjun.xu@amlogic.com>

mm: exclude free cma pages when calculate watermark [1/1]

PD#SWPL-1210

Problem:
Some drivers(eth/wifi) occasionally can't allocate memory under
atomic context. From mem status print, there are enough free
pages but most of them are CMA.

Solution:
Exclude free cma pages when calculate water mark. This can push
kswapd/compaction work more aggressive.

Verify:
P212

Change-Id: Ia723f21c0316eff1a38e759ff9f044bb59aa8efa
Signed-off-by: tao zeng <tao.zeng@amlogic.com>

dv: set stb core run_mode_delay as 0 [1/1]

PD#SWPL-781

Problem:
when starting to play video, the manu bar shakes

Solution:
stb core don't need run mode delay.

Verify:
t962e (txlx)

Change-Id: I22ba5d778eedd72f87b4c687b38acf1b8c6d6fc9
Signed-off-by: Yi Zhou <yi.zhou@amlogic.com>

dv: fix the green screen when changing dv mode [1/1]

PD#SWPL-1029

Problem:
when changing dv mode from standard to ll mode.
wn tp vks should be enabled

Solution:
enable wn tp vks when setting ll mode

Verify:
t962e (txlx)

Change-Id: I3b399132cf1a3c7b1799f36f9bc3a0696883029f
Signed-off-by: Yi Zhou <yi.zhou@amlogic.com>

lcd: lcd_extern: fix get invalid extern_driver null pointer mistake [1/1]

PD#SWPL-1152

Problem:
There is a null pointer mistake in lcd_extern_get_driver for invalid driver

Solution:
add null pointer protection

Verify:
txlx r311

Change-Id: I171d10ab26e6c298b8eb4065dfa054a237bfd53b
Signed-off-by: Evoke Zhang <evoke.zhang@amlogic.com>

crypto: Enable ARMCE and set aes dma to slow mode [1/1]

PD#SWPL-574

Problem:
xfrm test failed randomly in VtsKernelNetTest
due to random failed in gcm(aes)

Solution:
Use ARMCE for small sized crypto processing and use
copy mode when HW dma is used

Verify:
verified on ampere

Change-Id: I31cd75cfcd85da9fc9e9640135c7ce76623ef715
Signed-off-by: Matthew Shyu <matthew.shyu@amlogic.com>

USB: host: tuning disconnect threshold on g12a/g12b [2/2]

PD#174736

Problem:
Some usb device may disconnect when handshake

Solution:
tuning disconnect threshold when usb host initial
now default is 0x24, only three value can tuning, 0x2c,0x34,0x3c
we set 0x34 now

Verify:
Google estelle boards which return from factory
no side effect on refernce u200 board

Change-Id: I71d974a6bac43452b20bd7f2a6827d3a46fa39fb
Signed-off-by: qi duan <qi.duan@amlogic.com>

audio: solve av out output level low issue [2/2]

PD#SWPL-766

Problem:
  av output level only 100mv

Solution:
  change the channel map for av out,
  use orignal pcm for output w/o volume
  control and postprocess.

Verify:
  verified by r311

Change-Id: Ibeaf0ecfda03f81ff6061dc9c4975049452ba659
Signed-off-by: Lianlian Zhu <lianlian.zhu@amlogic.com>
Signed-off-by: Jian Xu <jian.xu@amlogic.com>

chipid: meson: add ops id for S805Y [1/2]

PD#SWPL-940

Problem:
Need ops id api for S805Y

Solution:
Add ops id api

Verify:
s805y_p215

Change-Id: I179f87acbc3f57456e0359bd0d502c58cc3a9b9c
Signed-off-by: Qiufang Dai <qiufang.dai@amlogic.com>

hdmitx: add feature limited [3/3]

PD#174490

Problem:
Lack feature limited for certain types

Solution:
Add feature limited for certain types

Verify:
TBD

Change-Id: Ifbe104fe98fe1e3875f2f1af7793348856275b92
Signed-off-by: Zongdong Jiao <zongdong.jiao@amlogic.com>

dts: support 32bit for g12b_w400 [1/1]

PD#SWPL-1010

Problem:
add support 32bit for g12b_w400

Solution:
add 32bit dts of g12b_w400.

Verify:
g12b_a311d_w400

Change-Id: I30ac9cb80721b04a13532ceb5c14f76bdf1cc575
Signed-off-by: Jianxiong Pan <jianxiong.pan@amlogic.com>

display: dts modify [1/1]

PD#TV-405

Problem:
Should create a 720p ui display mode on p321.

Solution:
Created a folder named t962_p321_720p under device/amlogic
and modified some variate.
The diffs that compare with txl_t962_p321.dts
amlogic-dt-id = "txl_p321_v1_720p";
	size = <0x400000>;
	alloc-ranges = <0x3fc00000 0x400000>;
	mem_size = <0x00400000 0x00b00000 0x00100000>;
	/* uboot logo,fb0/fb1 memory size,if afbcd fb0=0x0b51000*/
	display_mode_default = "720p60hz";
	/*1280*720*4*3 = 0xA8C000*/
	display_size_default = <1280 720 1280 2160 32>;
	logo_addr = "0x3fc00000";

Verify:
p321

Change-Id: Ia397cd6cbcf4fdd9fb139259099805bdad90b92f
Signed-off-by: Guotai Shen <guotai.shen@amlogic.com>

dts: support 32bit for gxl_p230 [1/1]

PD#SWPL-1116

Problem:
add support 32bit for gxl_p230.

Solution:
add 32bit dts for gxl_p230.

Verify:
gxl_p230

Change-Id: Icc62c45e7bd36e8248ad0bb11a67a0151cf7ea34
Signed-off-by: Jianxiong Pan <jianxiong.pan@amlogic.com>

dts: sync difference between arch32 and arch64 [1/1]

PD#SWPL-959

Problem:
sync arch32 and arch64 dts.

Solution:
sync arch32 and arch64 dts.

Verify:
r311

Change-Id: I493c83f38899628ac65c637e81f053a7c22bd24f
Signed-off-by: Jianxiong Pan <jianxiong.pan@amlogic.com>

cec: for support multi-logical address [1/2]

PD#SWPL-418

Problem:
cec: for support mult-logical address

Solution:
1.add interface: remove logical address
2.for support multi-logical address

Verify:
r311 r321

Change-Id: I9ea8b1004f43fb84855d41dd684c117fa5cbd7ae
Signed-off-by: Yong Qin <yong.qin@amlogic.com>

cec: for support multi-logical address [2/2]

PD#SWPL-418

Problem:
cec: support multi-logical address

Solution:
1.enable cec_a, cec_b
2.enable two interrupt
3.enable two pinmux oa_7, ao_8
4.cec_a only send all msg
5.cec_b only receive all msg
6.discard ceca broadcast msg

Verify:
r311 r321

Change-Id: I8f983ed6ad329ca5ec0144587a7ad1f03ad68031
Signed-off-by: Yong Qin <yong.qin@amlogic.com>

emmc: ffu: add emmc ffu update support [1/1]

PD#174683

Problem:
kernel emmc ffu is not supported.

Solution:
add emmc ffu update support with mmc untils.

Verify:
p212

Change-Id: Ice9ffb174c061e3f114b0b68af290492808b0a5e
Signed-off-by: Nan Li <nan.li@amlogic.com>

codec_mm: add reserved & cma support for 4.9. [1/1]

PD#172483

Problem:
Add reserved & cma support for 4.9.

Solution:
1. add tvp padding, for test.
2. add no-cma-tvp,to force not used cma for tvp.
3. add nomap for reserved memroy detective.
4. add res & cma two mem region on same board.
5. add clear-map property for codec_mm_cma.

Verify:
Test this function with Android_O-MR1(GTVS) & ExoPlayer.

Change-Id: Ib20e0e9bc4725afb271de97543ce5ebf3bfcfb29
Signed-off-by: Zhi Zhou <zhi.zhou@amlogic.com>

mm: clear MMU mapping for secure os memory [1/1]

PD#SWPL-1631

Problem:
If Cortex A73 accessed memory near secure memory range, an
SError may occur due to prefetch of A73 core.

Solution:
Remove mmu maping of secure memory range.
Note: must add clear-map and set clear range property in DTS

Verify:
W400

Change-Id: I718919c1b4873584eb87e00332622a1626672808
Signed-off-by: tao zeng <tao.zeng@amlogic.com>

cec: revert changesy [1/1]

PD#SWPL-418

Problem:
TXL can't bootup

Solution:
revert it

Verify:
p321

Revert "cec: for support multi-logical address [2/2]"
This reverts commit cc185dc81d.

Revert "cec: for support multi-logical address [1/2]"
This reverts commit b7922078ea.

Change-Id: I1cef0ac194464d75ffff3fe765f15b5f944406b2
Signed-off-by: Lei Qian <lei.qian@amlogic.com>

aarch64: enable swp software emulation [1/1]

PD#IPTV-14

Problem:
3D Benchmark.apk crash

Solution:
Add swp instruction support on armv8

Verify:
local

Change-Id: Ice2bef5c0ef7110b3adb4af811f99d4bfca1e8dc
Signed-off-by: Jianxin Pan <jianxin.pan@amlogic.com>

emmc: Modify delay of command line to 1/4 command window [1/1]

PD#SWPL-1184

Problem:
emmc data crc error

Solution:
Modify delay of command line

Verify:
A113d_s400

Change-Id: I7211da9da75569aebaf0c2790e3134e88a6f3077
Signed-off-by: Ruixuan Li <ruixuan.li@amlogic.com>

adc_key: delete early_suspend code [1/1]

PD#OTT-144

Problem:
after the dark screen, the adc button does not work

Solution:
The adc_keypad introduces earlysuspend for MID project:
after the LCD backlight disable, prevent the user from
pressing the key to open some applications and not complete standby.
Now check the adc button using the "system_freezable_wq" system queue,
which replaces the function of the code.So can remove it.

Verify:
g12b socket

Change-Id: I2333ba3dc406d2624962d116293a0b9d36f97534
Signed-off-by: Yingyuan Zhu <yingyuan.zhu@amlogic.com>

audio: fix errors of coverity [1/1]

PD#166793

Problem:
coverity check errors of format

Solution:
fix err

Verify:
verify locally

Change-Id: Ie3a404fe50c5bdaa6a9cf4a4194659502defdbd2
Signed-off-by: jiejing.wang <jiejing.wang@amlogic.com>

hdmirx: fix sound noise when switch hdmi port [1/1]

PD#SWPL-1224

Problem:
There will sound noise when switch hdmi port.

Solution:
Remove bandgap off when close port.

Verify:
Locally

Change-Id: Ibd9be3aa6f32072918f7b1ec151463452b2b879a
Signed-off-by: yicheng shen <yicheng.shen@amlogic.com>

mm: clear MMU mapping for secure os memory [1/1]

PD#SWPL-1631

Problem:
If Cortex A73 accessed memory near secure memory range, an
SError may occur due to prefetch of A73 core.

Solution:
Add clear mmu property for arm platform

Verify:
W400

Change-Id: I2e396f77772aeea231d0bf5f38a81440117ecdd6
Signed-off-by: tao zeng <tao.zeng@amlogic.com>

video: merged from A wait AFBC idle when report state [1/1]

PD#169128:

[Problem]
When quick switch video between 2 vsync isr, the AFBC may read wrong
data, and green screen or distortion image occurs.

[Solution]
1. Add delay when get video layer state, to make sure afbc is stopped
2. Remove ambiguous log print

[Platform]
Blanche
BranchTo: NONE

[Test]

Change-Id: I94ccf25373f29ce188829ab1b7db6f9df1fb49ad
Signed-off-by: Zhi Zhou <zhi.zhou@amlogic.com>

dts: add isp and galcore support to w400-buildroot [1/2]

PD#SWPL-1819

Problem:
lack of isp and galcore support in buildroot dts

Solution:
merge configurations from skt board

Verify:
local

Change-Id: I5936341fc24719f345c7707e16e692ae292ca6fe
Signed-off-by: Jun Zhang <jun.zhang@amlogic.com>

dts: modified atom.dts support 32bit. [1/1]

PD#SWPL-1942

Problem:
add atom.dts support 32bit.

Solution:
modified length of reg, mem etc.

Verify:
r321

Change-Id: I2a518af2a76b8cb17ded68e994c3065072b92b9c
Signed-off-by: Jianxiong Pan <jianxiong.pan@amlogic.com>

vccktest: add vccktest dts for buildroot [1/1]

PD#174851

Problem:
buildroot no vccktest dts

Solution:
add vccktest dts

Verify:
g12a/g12b test pass

Change-Id: I6907fa3cfc087ac84395956ddbda678f7a5e3f4b
Signed-off-by: Huan Biao <huan.biao@amlogic.com>

script: segments can appear in descriptive information [1/1]

PD#174488

Problem:
segmentation in descriptive information is reasonable and
should be allowed.

Solution:
modify the check codes.

Verify:
test locally.

Change-Id: I5e34ef2dd26077bb54adee7597a1aa3c789566c9
Signed-off-by: Jianxiong Pan <jianxiong.pan@amlogic.com>

vlock: optimize vlock process for interlace input [1/1]

PD#SWPL-743

Problem:
The picthre is shaking when press DVD remote
control in AV source

Solution:
add delay work for vlock process interlace input

Verify:
T962X-R311

Change-Id: Ic2ed077e0684ecc6b0990336e7a4ab7022931886
Signed-off-by: Dezhi Kong <dezhi.kong@amlogic.com>

atv_demod: pc bad value in panic after change source [1/1]

PD#SWPL-1636

Problem:
1.pc bad value in kernel panic after change source.
2.System crash down when change source.

Solution:
optimize atv demod code.

Verify:
verified by p321

Change-Id: I655d1253950475dfb49ae1b174597797000adb73
Signed-off-by: nengwen.chen <nengwen.chen@amlogic.com>

vout: add bist test on vout [1/1]

PD#SWPL-1630

Problem:
add cvbs/hdmi/lcd bist test on vout

Solution:
add cvbs bist test on vout

Verify:
test pass on u200/p212

Change-Id: Ie61d9b0d63649ec3022fd720068b689f4d721e3b
Signed-off-by: Nian Jing <nian.jing@amlogic.com>

osd: meson-hwc screen always blank [1/1]

PD#163001

Problem:
TL1 code merged caused meson-hwc screen always blank

Solution:
fix meson-hwc screen always blank

Verify:
verified in u200 board

Change-Id: I0a9371b42546e2713e6dcb926e7c94598e29da1d
Signed-off-by: pengcheng chen <pengcheng.chen@amlogic.com>

osd: osd shift-workaround one line fixed [1/1]

PD#163001

Problem:
current osd code have one line missing issue in meson-hwc

Solution:
osd blend used +1 line to fix shift issue,
and used freescale to cut it.

Verify:
verified in u200 board

Change-Id: I2354742d456327d9f1aa5713ee782648895034db
Signed-off-by: pengcheng chen <pengcheng.chen@amlogic.com>

smartcard: fix defects for coverity [1/1]

PD#166793

Problem:
conditional statement not is valid.

Solution:
change type u32 to type int.

Verify:
module owner confirmed.

Change-Id: I9fdfa444b29104c7afc9b7a380748ebe82ed390b
Signed-off-by: Jianxiong Pan <jianxiong.pan@amlogic.com>

osd: uboot logo scaler down in 4k issue [1/1]

PD#163001

Problem:
uboot logo scaler down in 4k

Solution:
uboot logo size adjust when vout changed before
first page flip command

Verify:
verified in u200 board

Change-Id: Ic23e695fe716811eaf3faa62069c808a03c26f9d
Signed-off-by: pengcheng chen <pengcheng.chen@amlogic.com>

osd: add hdr mode set via meson-hwc support [1/1]

PD#163001

Problem:
hdr mode set not supported

Solution:
add hdr mode set via meson-hwc support

Verify:
verified in u200 board

Change-Id: Iaad75982003870f9469e4155aedb9c13349b60b9
Signed-off-by: pengcheng chen <pengcheng.chen@amlogic.com>

dts: fix some errors on g12b_w400 for 32bit [1/1]

PD#SWPL-1010

Problem:
some errors of reg address.

Solution:
modify to support 32bit.

Verify:
w400.

Change-Id: Ia35e95ac59084a9c57a9a4ab32fecb64f78c772e
Signed-off-by: Jianxiong Pan <jianxiong.pan@amlogic.com>

ddr: detect bandwidth except mali and reduce bandwidth [2/3]

PD#SWPL-122

Problem:
ddr bandwidth is tightly in many cases, such as HDR/4K video playing,
and then refresh osd at the same time

Solution:
in most cases the problem is refreshing osd when bandwidth tightly,
so detect ddr bandwidth usage except mali and reduce it when it is tightly

Verify:
verify by p321/r311

Change-Id: Ia594f08dbe9a8a7a8d78b5104c93bddaa8229c0b
Signed-off-by: wenbiao zhang <wenbiao.zhang@amlogic.com>

arm: dts: gxl: replace watchdog with new version [1/1]

PD#SWPL-1600

Problem:
The current watchdog is not the upstream standard driver.

Solution:
Replace watchdog device tree to use the standard watchdog driver.

Verify:
S905X P215/P212 Android-32bit Kernel-32bit.

Change-Id: I972c8ebb0158caa2df393d9a2d687d9298181102
Signed-off-by: Bo Yang <bo.yang@amlogic.com>

arm64: dts: g12a: fine-tune voltage OPP [1/1]

PD#165143

Proble:
fine-tune voltage OPP

Solution:
fine-tune voltage OPP

Verify:
G12A/G12B,PASS

Change-Id: I0b3fb0e4624e2ddfa635c8225a740ed7a8ff3e51
Signed-off-by: Hong Guo <hong.guo@amlogic.com>

audio: fix audio driver del_timer BUG_ON crash issue  [1/1]

PD#SWPL-972

Problem:
    audio crash when ATV switch channel long time burning test

Solution:
    there is a risk to fetch the timer lock. when input stop, stop_timer
    will call del_timer, at the same time the function
    "aml_i2s_hrtimer_callback" is waiting for the timer lock,after
    stop_timer release the lock,"aml_i2s_hrtimer_callback" get the
    lock and call mod_timer again, which will set the timer to pending
    status. It will cause the next  "start input" stage,add_timer will
    trigger BUG_ON.Now we put the lock before the active status
    checking then we will not touch the timer.

Verify:
    Need burning test

Change-Id: I1fb66903a4d31e9491ac0533e477e1597575d4cf
Signed-off-by: Jian Xu <jian.xu@amlogic.com>

hdmitx: enable repeater_tx in r321/atom dts [2/3]

PD#SWPL-1303

Problem:
For TXLX/T962E/R321 cases, there are both HDMI TX and RX.
Should consider it as repeater.

Solution:
Enable repeater_tx in r321/atom dts
Also, add a missing ksv_lists[] clear.

Verify:
r321/atom

Change-Id: I7b512c34123481380220f9262466fde56b0ae6e3
Signed-off-by: Zongdong Jiao <zongdong.jiao@amlogic.com>

hdmitx: remove a wrong Y422 format judgement [1/1]

PD#IPTV-55

Problem:
When connect to a Samsung TV(support 4k60 422 12bit), get a wrong
0 of 'echo 2160p60hz422,12bit > valid_mode'

Solution:
Remove a wrong Y422 format judgement

Verify:
P212

Change-Id: Ic0f2cefc1e0893390ac38298b55272877d81e04b
Signed-off-by: Zongdong Jiao <zongdong.jiao@amlogic.com>

tsync: tsync change the apts set code [1/2]

PD#SWPL-1774

Problem:
DD program has avysnc problem over one night play

Solution:
fix the apts set bug

Verify:
p321

Change-Id: I0f6a5b47d3e3171a3dd8fa9a0b721cd11ec20b9e
Signed-off-by: live.li <live.li@amlogic.com>

amvecm: overscan: fix video local play, screen mode set error [1/1]

PD#SWPL-206

Problem:
overscan set error when local play

Solution:
overscan don't set at vpp

Verify:
verify on txlx

Change-Id: Ifd4ad4f5fcdb9fbc7ad05a540d0ed11b24d4ca66
Signed-off-by: MingLiang Dong <mingliang.dong@amlogic.com>

thermal: sensor: fix thermal disabled mode issue [1/1]

PD#SWPL-2130

Problem:
tsensor driver update thermal event when mode disabled

Solution:
fix tsensor disable mode issue

Verify:
A311D W400 pass

Change-Id: If9e3d3ea15732a0efbd8314003b27bc0bdf3e476
Signed-off-by: Huan Biao <huan.biao@amlogic.com>

deinterface: add afbc support on g12a and txlx [1/1]

PD#SWPL-1618

Problem:
Add afbc support on g12a and txlx

Solution:
add afbc support on g12a and txlx

Verify:
T962X-R311, U200(G12A)

Change-Id: Ia0cce8516a98653b01c3bc628e812c3a81b1df59
Signed-off-by: huaihao.guo <huaihao.guo@amlogic.com>

dts: change CMA layout [1/1]

PD#SWPL-1909

Problem:
On 32bit kernel, codec cma is located in normal zone by
"alloc-ranges" parameter with large size. This takse up
memory space for kernel and drivers. Sometimes we can see
memory allocation fail log but there are still enought
free pages. But most of these pages are CMA pages.

Solution:
Move codec cma location to high memzone. On 32bit, low
768MB memory is normal zone.
This change also correct first 1MB memory lost problem
for chips later than TXLX

Verify:
P212

Change-Id: I4592d34d08ee4dbb6700bbbfc4e0fadaceab0310
Signed-off-by: tao zeng <tao.zeng@amlogic.com>

media: remap the addr to prevent crash on the 32bit & 2G board [1/1]

PD#SWPL-1909

Problem:
mem rw exception caused crashed.

Solution:
1. add mapping the highmem address by the func vmap().
2. remove the flag CODEC_MM_FLAGS_CPU if not necessary.

Verify:
p212, w400

Change-Id: I982c775d7c009335cae5802f0eb6287d22037db6
Signed-off-by: Nanxin Qin <nanxin.qin@amlogic.com>

media: fix some coverity error: [1/1]

PD#SWPL-2053

Problem:
Coverity detected some code defects.

Solution:
Fixed these code defects.

Verify:
Verified u212

Change-Id: Ie3c0907c7ee3db94f65f58aa5d5c96812a7fe38c
Signed-off-by: Peng Yixin <yixin.peng@amlogic.com>

dts: modify the remaining 64bit dts to support 32bit [1/1]

PD#SWPL-2046

Problem:
some of the remaining 64bit boards do not support 32bit.

Solution:
modify the dts to support 32bit.

Verify:
axg, g12a, g12b, gxl, gxm, txl, txlx.

Change-Id: I951f8d32b18243a64e2abc5008bbb015c2e21e7a
Signed-off-by: Jianxiong Pan <jianxiong.pan@amlogic.com>

dv: set avi info limited range when dv output hdr mode [1/1]

PD#SWPL-1127

Problem:
when dv output hdr mode, the quantization range is default value
instead of limited range

Solution:
set quantization range to limited range in avi info

Verify:
t962e (txlx)

Change-Id: Ib4fbeb1c7efcedd7194143772ee5c663284a1c77
Signed-off-by: Yi Zhou <yi.zhou@amlogic.com>

drm: pq: G12A DRM support gamma and ctm setting [1/1]

PD#165492

Problem:
G12A DRM add gamma and ctm setting  support

Solution:
1. amvecm: add gamma apis for drm
2. drm: add gamma and ctm setting

Verify:
Verified on customer platfor

Change-Id: Iff5204ae7f719542463ac15140e471cd762c9c27
Signed-off-by: Bencheng Jing <bencheng.jing@amlogic.com>

di: fix dump_status log error [1/1]

PD#174473

Problem:
dump_status log error

Solution:
fix dump_status log error

Verify:
verified in t962X_r311 board

Change-Id: I53cec7b93f6e2649bd527b8591995d54bec6450d
Signed-off-by: wenfeng.guo <wenfeng.guo@amlogic.com>

sdio: optimize sd & wifi TDMA [1/1]

PD#SWPL-1908

Problem:
sdio wifi error TDMA.

Solution:
optimize host reg value set error.

Verify:
u211 & u212

Change-Id: I0e0d52ac2bce42cf163f0065d46badc938832a65
Signed-off-by: Nan Li <nan.li@amlogic.com>

atv_demod: Output big "PO" sound when change source from ATV [1/3]

PD#SWPL-318

Problem:
Output big "PO" sound when change source from ATV to others,
or switch between small window and full screen in ATV source.

Solution:
disable atv status early when exit ATV source.

Verify:
verified by p321

Change-Id: I82af7f8eaef181f1f72ef1f9d194e33c1efdcdb5
Signed-off-by: nengwen.chen <nengwen.chen@amlogic.com>

deinterlace: fix di coverity & di_trace [1/1]

PD#SWPL-2138

Problem:
Fix di coverity & di_trace

Solution:
fix di coverity & di

Verify:
T962X-R311

Change-Id: I9be91832eeed89ebd715276c75414e4e6da55240
Signed-off-by: wenfeng.guo <wenfeng.guo@amlogic.com>

vdin: enable vdin0 urgent for T950 default [1/1]

PD#TV-288

Problem:
There is flicker and jitter in HDMI

Solution:
enable vdin0 urgent for T950 default

Verify:
p321-T950

Change-Id: I17e472d7a47411093e9ade70a342807bed060a3a
Signed-off-by: Dezhi Kong <dezhi.kong@amlogic.com>

clk: g12a/g12b: fix 32bit set mpll clk overflow [1/1]

PD#SWPL-1933

Problem:
32bit system clk overflow

Solution:
let mpll clock not overflow

Verify:
g12b

Change-Id: Ie1c7c611e637776348bb35a3e0c1624cee57716f
Signed-off-by: shunzhou.jiang <shunzhou.jiang@amlogic.com>

reboot: reason: add reboot_reason quiescent [1/4]

PD#SWPL-1887

Problem:
Android TV need reboot_reason quiescent

Solution:
add reboot_reason quiescent

Verify:
ampere

Change-Id: Ie5a748faae05be93c56722b7806df6179116a047
Signed-off-by: Xindong Xu <xindong.xu@amlogic.com>

arm64: dts: p230: add dvb module

PD#172865

Problem:
Customer requests a new release for linux dvb
Need enable dvb for QA testing

Solution:
Need enable dvb for QA testing

Verify:

Change-Id: Ib082c457d6f43ef4d6a5d16059a7e8ce068a332e
Signed-off-by: yeping.miao <yeping.miao@amlogic.com>

emmc: clean emmc reg val for probe [1/1]

PD#SWPL-2286

Problem:
emmc response crc error in emmc init.

Solution:
clean emmc reg val from uboot to kernel.

Verify:
w400

Change-Id: I6a4763187f18e9e284c887c5c788f3a88c8548ff
Signed-off-by: Nan Li <nan.li@amlogic.com>

dts: dtsi: add dtsi for ab update [1/6]

PD#SWPL-1513

Problem:
ab update can not work on P

Solution:
add dtsi for ab update for P

Verify:
test pass in ampere

Change-Id: I6ff219170a16c0081fba7297110e8dfaadcff401
Signed-off-by: Xindong Xu <xindong.xu@amlogic.com>

backlight: ldim: update usage for new spi driver [1/1]

PD#SWPL-1603

Problem:
don't support old spi driver now

Solution:
update new spi driver api for ldim driver

Verify:
txlx r311

Change-Id: I4dff13e4cab5666a30488730e27c6275b933a922
Signed-off-by: Evoke Zhang <evoke.zhang@amlogic.com>

hdmitx: fix wrong power uevent in suspend/resume [1/1]

PD#SWPL-1931

Problem:
Wrong hdmi_power uevent in suspend/resume flow

Solution:
Remove current mode judgement

Verify:
R321

Change-Id: Ib36e8d6cb4988f7b2be91146b12e974c194526ca
Signed-off-by: Zongdong Jiao <zongdong.jiao@amlogic.com>

ddr: fix dmc_monitor register bit missmatch on G12A/G12B [1/1]

PD#172256

Problem:
On G12A/G12B, bit for ddr0 protection 0 vilation is not same

Solution:
Fix bit missmatch problem

Verify:
U212

Change-Id: I5dca14c8bc96bdcb85dbe8bbd5a9a18157834bcf
Signed-off-by: tao zeng <tao.zeng@amlogic.com>

deinterlace: fix kasan bug in di_task_handle [1/1]

PD#173820

Problem:
kasan bug in di_task_handle

Solution:
delete cma_mutex because it has no effect

Verify:
P321

Change-Id: Ie6ca7973576e7350870c5466b54b38b490dff65e
Signed-off-by: Jihong Sui <jihong.sui@amlogic.com>

mmc: fixup toshiba emmc secure discard [1/1]

PD#SWPL-1937

Problem:
secure discard and trim may cost 5mins on toshiba
"004GA0" emmc.

Solution:
using normal discard operation instead.

Verify:
W400

Change-Id: I7fd23867f8ae0af9192377de8f8c15609ef809ed
Signed-off-by: Yonghui Yu <yonghui.yu@amlogic.com>

ionvideo: Add thread stop protection when the process exits [1/1]

PD#SWPL-1689

Problem:
The thread still exists when the process exits

Solution:
Check if the thread exits when the process exits

Verify:
local

Change-Id: I6d805da6bfa0df85b6d39d065c95eed49b3cb7da
Signed-off-by: Renjiang Han <renjiang.han@amlogic.com>

dts: the memory of the reserved 1MB was recovered. [1/1]

PD#SWPL-2250

Problem:
h265 & vp9 4K playback abnormal because HEVC FRONT &
VPU READ2 pollute the phy address of near 0x0.

Solution:
it's only a temporary modification, the real reason
needs to take more time fixed.

Verify:
U212

Change-Id: I3dcc47f8979960e95c89cf53fe10eadc1a7ae5ad
Signed-off-by: Nanxin Qin <nanxin.qin@amlogic.com>

dts: r314: increase board dts file [2/3]

PD#SWPL-1978

Problem:
bring up board r314.

Solution:
increase board dts file

feature:
The Dts file with Einstein is identical except for the memory difference
R314 1.5G, Einstein 1G.

Verify:
Verified on txlx_t962x_r314  board.

Change-Id: I271cb92a9cbcab174fb0bb76cfbc8beff9c730d3
Signed-off-by: guotai.shen <guotai.shen@amlogic.com>

vrtc: vrtc time update for stick mem [2/2]

PD#174867

Problem:
vrtc time update for stick mem.

Solution:
vrtc time update for stick mem.

Verify:
g12a txl.

Change-Id: I65074422569370b253882a4e66fb771da10ccdbf
Signed-off-by: Hong Guo <hong.guo@amlogic.com>

irblaster: add synchronous transmit [1/1]

PD#SWPL-2170

Problem:
cts fail
android.hardware.consumerir.cts.ConsumerIrTest#test_timing

Solution:
add synchronous transmit
when it returns the pattern has been transmitted

Verify:
verify on franklin

Change-Id: I7e490236e5effc13f81e4fab3a1c7fc10c5dcfb3
Signed-off-by: Wencai You <wencai.you@amlogic.com>

amvecm: pq: add dnlp/bri/contrast for tl1 [1/1]

PD#172587

Problem:
dnlp/bri/contrast can not finetune

Solution:
1. add dnlp regisiter 10bit write
2. add brightness/contrast/sr for tl1

Verify:
verify on tl1

Change-Id: I90b363f57fbf2cd485e2acaddb5ce60a8715a47b
Signed-off-by: MingLiang Dong <mingliang.dong@amlogic.com>

ramdump: add ramdump support for ARM32 [1/1]

PD#165764

Problem:
ramdump is not enabled on ARM32

Solution:
Enable it and fix compatible with ARM64

Verify:
R311

Change-Id: I337ef019ecab05d25b7d9dc0cacab7a03149aa7b
Signed-off-by: tao zeng <tao.zeng@amlogic.com>

avsync: tsync: fix the avsync problem [1/1]

PD#SWPL-1158

Problem:
The video will become un-smooth after change
between several audio languages

Solution:
when apts and vpts distance is large then 60*90000
then set the tsync mode to vmaster and  set the tysnc
enable to 0

Verify:
P321

Change-Id: I7c7e32f49ca12645cf6a1aa58caeb968a9234c8c
Signed-off-by: live.li <live.li@amlogic.com>

dtv_demod: fix dtv demod crash switch once every 2s [1/1]

PD#SWPL-2293

Problem:
dtv demod switch once every 2s cause crash

Solution:
fix dtv demod crash switch once every 2s

Verify:
P321

Change-Id: Ibfd919a503e3dae41f51637cdff6e01ed27bac71
Signed-off-by: wenfeng.guo <wenfeng.guo@amlogic.com>

ramdump: fix a warning of cast [1/1]

PD#165764

Problem:
have a warning of the "ram" variable cast.

Solution:
add a "void *" to the ram variable.

Verify:
test locally.

Change-Id: I037a89a28e98ae8c8ab965e908877bf4a72d3ead
Signed-off-by: Jianxiong Pan <jianxiong.pan@amlogic.com>

vpp: fix p212 osd sdr2hdr luma too dark [1/1]

PD#SWPL-1707

Problem:
{NTS}Manual,HDR-001-TC2 Failed step 8/12/16/20 VID
and GFX doesn't match

Solution:
add osd hdr2sdr convert table for 400nit on p212

Verify:
verify on p212

Change-Id: I9a9dcf13ab0deaa8b676c5c409919367420b6d1b
Signed-off-by: MingLiang Dong <mingliang.dong@amlogic.com>

vpp: fix p212 osd sdr2hdr luma too dark compile [1/1]

PD#SWPL-1707

Problem:
{NTS}Manual,HDR-001-TC2 Failed step 8/12/16/20 VID
and GFX doesn't match

Solution:
add osd hdr2sdr convert table for 400nit on p212

Verify:
verify on p212

Change-Id: I16637652b6d07ba81b25f46c2684ff7ae3e1c68c
Signed-off-by: MingLiang Dong <mingliang.dong@amlogic.com>

vdac: fix atv/dtv resume no signal issue [1/1]

PD#SWPL-2351

Problem:
atv/dtv no signal when suspend after switch from hdmi

Solution:
disable vdac bandgap when suspend

Verify:
test pass on P321

Change-Id: I0449f0d9673f46928b8951249f5759a4a1f16562
Signed-off-by: Nian Jing <nian.jing@amlogic.com>

spicc: fix miss bytes/time consume/loopback issue [1/1]

PD#SWPL-215

Problem:
1. additional or missing bytes be sent on mosi sometimes.
2. Customer DSP load firmware through SPICC. the loading time is 12s with
buildroot release 20180907 while 6s with 20180131.
3. rx error when work in loopback mode at high speed.

Solution:
1. change to disable irq at the irq-handle begining;
change to enable irq after all data pulled.
2. pre-setup of every spi transfer spends most of time on clk_set_rate().
this time is not obvious while cpu work at a high frequence such as
1000MHz.
In fact, a slave speed is almost fixed and we needn't set it for every
transfer but set only when speed changed.
3. disable auto io delay when in loopback mode.

Verify:
verified on axg-s400-v03 and tl1-skt

Change-Id: I61bcceccc243b218879b2b0711d0aff7538151f6
Signed-off-by: Sunny Luo <sunny.luo@amlogic.com>

framebuffer: remove lock in fbmem ioctl. [1/1]

PD#SWPL-2497

Problem:
on 32bit kernel, when user space call WAITFORVSYNC,
we cannot send other command to framebuffer.

Solution:
remove lock in fbioctl as fb compat_ioctl do.
Our driver have locks to protect internal resources.

Verify:
verified on franklin.

Change-Id: I1789c09a7ea459aed4b782748847687c7f974526
Signed-off-by: sky zhou <sky.zhou@amlogic.com>

dv: fix osd color matrix when dv enabled [1/1]

PD#SWPL-1804

Problem:
fix osd color matrix when dv enabled

Solution:
enable osd matrix when dv enabled

Verify:
verified on u212 dev board

Change-Id: I4b4206f4d8c447873f23a3a0066af0d0fa85e18c
Signed-off-by: Yi Zhou <yi.zhou@amlogic.com>

osd: fix osd color error when osd hdr enabled [1/1]

PD#SWPL-1804

Problem:
osd color error when osd hdr enabled

Solution:
div alpha when osd hdr enabled

Verify:
verified on u212 dev board

Change-Id: I1f5ea0db404d1956f454bd5da2532bded89626ee
Signed-off-by: pengcheng chen <pengcheng.chen@amlogic.com>

osd: add meson-hwc repodution rate support [1/2]

PD#SWPL-1810

Problem:
osd blend repodution rate not supported

Solution:
add meson-hwc repodution rate support

Verify:
verified on u212 dev board

Change-Id: Ied10393e240e8d3f2a1eefe17a2d4d3c965e3383
Signed-off-by: pengcheng chen <pengcheng.chen@amlogic.com>

dts: GXL: defendkey: support secure upgrade check [3/3]

PD#SWPL-2100

Problem:
GXL need to support secure upgrade check

Solution:
add defendkey support in all GXL dts

Verify:
GXL skt board verify pass

Change-Id: I73b84b86f23f512ddc556b61f3a07d015c717e8c
Signed-off-by: Zhongfu Luo <zhongfu.luo@amlogic.com>

GXL: defendkey: support secure upgrade check [2/3]

PD#SWPL-2100

Problem:
GXL need to support secure upgrade check

Solution:
1.add dtb decrypt support
2.add 32bit defendkey support

Verify:
GXL skt board verify pass

Change-Id: I501967530b2a61d9b90c20241b82f92b00829453
Signed-off-by: Zhongfu Luo <zhongfu.luo@amlogic.com>

PM_SUSPEND: suspend: set wakeup reason to stick mem [2/2]

PD#SWPL-2287

Problem:
set wakeup reason to stick mem

Solution:
set wakeup reason to stick mem

Verify:
gxl,test pass

Change-Id: Iff6f1824ea4ac9ec12b8295d4283992fdac03b14
Signed-off-by: Hong Guo <hong.guo@amlogic.com>

deinterlace: fix CMA layout adaptation di_cma_reserved [1/1]

PD#SWPL-2308

Problem:
CMA layout adaptation di_cma_reserved cause crash

Solution:
fix CMA layout adaptation di_cma_reserved

Verify:
P321

Change-Id: Ia24e811a02d47d70afa1c06361fd0852c357394c
Signed-off-by: wenfeng.guo <wenfeng.guo@amlogic.com>

media: media_sync: remove serial port debug logs [1/1]

PD#SWPL-2494

Problem:
serial port always print timestamp log

Solution:
remove this log output

Verify:
P321

Change-Id: I875dffab483269374b9939f556a3ed01e9d2b215
Signed-off-by: xiaoming.sui <xiaoming.sui@amlogic.com>

dts: GXL/TXL: adjust defendkey_reserved location [1/1]

PD#SWPL-2539

Problem:
defendkey_reserved have influenced on display
during the system boot up

Solution:
adjust defendkey_reserved node location

Verify:
GXL/TXL skt board verify pass

Change-Id: I5cf0245f9653e20224c4e3bab1f6f05527011210
Signed-off-by: Zhongfu Luo <zhongfu.luo@amlogic.com>

DTS: p230 board config spdif out pin [3/3]

PD# SWPL-1223

Problem:
p230 board spdif out no audio sound

Solution:
config p230 board spdif out pin

Verify:
verify on p230

Change-Id: I0c35e6d526aab98955206f78322fcc873ff01b8c
Signed-off-by: Chaomin Zheng <chaomin.zheng@amlogic.com>

hdmitx: disable encryption hdcp1.4 fail [1/1]

PD#SWPL-2302

Problem:
Play online video,half an hour later, the TV shows
a pink screen and the sound is normal.

Solution:
Check hdcp1.4 status and disable encryption when fail.

Verify:
S922X

Change-Id: I6ce51824726b267d140750f9e9d80aa8bb921cac
Signed-off-by: Kaifu Hu <kaifu.hu@amlogic.com>

dv: fix the flickered problem [1/1]

PD#SWPL-1207

Problem:
fix the filckered problem when playing transition
video in sdr tv

Solution:
when dv core2 don't run, the reset can't be executed

Verify:
r321

Change-Id: I719325f1722589e02a40d46442258b0d1e3feb17
Signed-off-by: Yi Zhou <yi.zhou@amlogic.com>

display: Modify the value of register afbc_gclk_ctrl [1/1]

PD#SWPL-2565

Problem:
The splash screen problem for first frame after starting up.

Solution:
Modify the value of register afbc_gclk_ctrl.

Verify:
u211

Change-Id: Ie1ddfade0566ff8cd571c43ba8490a8c277a8758
Signed-off-by: Peng Yixin <yixin.peng@amlogic.com>

dts: fix SD card read issue for g12a board [2/3]

PD#SWPL-2588

Problem:
g12a u220/u221 boad cann't read SD card

Solution:
auto detect revA and revB chip

Verify:
test pass on u220/u221 board

Change-Id: Ia153bb3f966fe2a58d5f3ed1bf1d3f610d00ff5a
Signed-off-by: Sandy Luo <sandy.luo@amlogic.com>

frame_sync: fix last few seconds of the DD+ stream are not smooth [4/4]

PD#SWPL-714

Problem:
The last few seconds of the DD+ stream are not smooth by DTV playback.

Solution:
check the apts and vpts both discontinue,then replay the stream.

Verify:
P321

Change-Id: I6cbbdecc052dfe9fef76b44f36545b231332ee12
Signed-off-by: Yinming Ding <yinming.ding@amlogic.com>

dvb: tuner: USB DVB tuner support from Google

PD#SWPL-932

Problem:
USB DVB Dongle search program Function is not implemented

Solution:
merge usb dvb tuner from kernel3.14
http://10.8.9.5/kernel/common/commit/?h=amlogic-3.14-dev&id=7af9c5c38efdc96f5d3235f17788232a630b3d32
fixed frontend.h structures

Verify:
Ampere P

Change-Id: I16d68c2507711eda43313619d210d05699abcc25
Signed-off-by: qi duan <qi.duan@amlogic.com>

scripts/dtc: Update to upstream version v1.4.5-3-gb1a60033c110

PD#SWPL-2193

This adds the following commits from upstream:

b1a60033c110 tests: Add a test for overlays syntactic sugar
737b2df39cc8 overlay: Add syntactic sugar version of overlays
497432fd2131 checks: Use proper format modifier for size_t
22a65c5331c2 dtc: Bump version to v1.4.5
c575d8059fff Add fdtoverlay to .gitignore
b6a6f9490d19 fdtoverlay: Sanity check blob size
8c1eb1526d2d pylibfdt: Use Python2 explicitly
ee3d26f6960b checks: add interrupts property check
c1e7738988f5 checks: add gpio binding properties check
b3bbac02d5e3 checks: add phandle with arg property checks
fe50bd1ecc1d fdtget: Split out cell list display into a new function
62d812308d11 README: Add a note about test_tree1.dts
5bed86aee9e8 pylibfdt: Add support for fdt_subnode_offset()
46f31b65b3b3 pylibfdt: Add support for fdt_node_offset_by_phandle()
a3ae43723687 pylibfdt: Add support for fdt_parent_offset()
a198af80344c pylibfdt: Add support for fdt_get_phandle()
b9eba92ea50f tests: Return a failure code when any tests fail
155faf6cc209 pylibfdt: Use local pylibfdt module
50e5cd07f325 pylibfdt: Add a test for use of uint32_t
ab78860f09f5 pylibfdt: Add stdint include to fix uint32_t
36f511fb1113 tests: Add stacked overlay tests on fdtoverlay
1bb00655d3e5 fdt: Allow stacked overlays phandle references
a33c2247ac8d Introduce fdt_setprop_placeholder() method
0016f8c2aa32 dtc: change default phandles to ePAPR style instead of both
e3b9a9588a35 tests: fdtoverlay unit test
42409146f2db fdtoverlay: A tool that applies overlays
aae22722fc8d manual: Document missing options
13ce6e1c2fc4 dtc: fix sprintf() format string error, again
d990b8013889 Makefile: Fix build on MSYS2 and Cygwin
51f56dedf8ea Clean up shared library compile/link options
21a2bc896e3d Suppress expected error message in fdtdump test
2a42b14d0d03 dtc: check.c fix compile error
a10cb3c818d3 Fix get_node_by_path string equality check
548aea2c436a fdtdump: Discourage use of fdtdump
c2258841a785 fdtdump: Fix over-zealous version check
9067ee4be0e6 Fix a few whitespace and style nits
e56f2b07be38 pylibfdt: Use setup.py to build the swig file
896f1c133265 pylibfdt: Use Makefile constructs to implement NO_PYTHON
90db6d9989ca pylibfdt: Allow setup.py to operate stand-alone
e20d9658cd8f Add Coverity Scan support
b04a2cf08862 pylibfdt: Fix code style in setup.py
1c5170d3a466 pylibfdt: Rename libfdt.swig to libfdt.i
580a9f6c2880 Add a libfdt function to write a property placeholder
ab15256d8d02 pylibfdt: Use the call function to simplify the Makefile
9f2e3a3a1f19 pylibfdt: Use the correct libfdt version in the module
e91c652af215 pylibfdt: Enable installation of Python module
8a892fd85d94 pylibfdt: Allow building to be disabled
741cdff85d3e .travis.yml: Add builds with and without Python library prerequisites
14c4171f4f9a pylibfdt: Use package_dir to set the package directory
89a5062ab231 pylibfdt: Use environment to pass C flags and files
4e0e0d049757 pylibfdt: Allow pkg-config to be supplied in the environment
6afd7d9688f5 Correct typo: s/pylibgfdt/pylibfdt/

Change-Id: Ib23ca90f1e34ed85db3aae9d223fc921e6f2114e
Signed-off-by: Rob Herring <robh@kernel.org>
Signed-off-by: jiamin ma <jiamin.ma@amlogic.com>

deinterface: temporary remove afbc support on chip after g12a [1/1]

PD#172587

Problem:
afbc now support on chip txlx and g12a,
but we use cpu_after_eq(G12A) to judge
if afbc is support or not.

Solution:
use is_meson_g12a_cpu() replace cpu_after_eq(G12A).

Verify:
u200(g12a),t962x_r311

Change-Id: I3fb7ed54f7137fada97481177e40a2543cf8df9f
Signed-off-by: huaihao guo <huaihao.guo@amlogic.com>

osd: osd: a black line below the screen when play video [1/1]

PD#SWPL-2558

Problem:
a black horizontal line below the screen when play video

Solution:
set dummy data alpha

Verify:
verified on p321

Change-Id: I36dc924b9bc89f4f8ea61eb86c6f5bc9199e40ae
Signed-off-by: Jian Cao <jian.cao@amlogic.com>

osd: call osd_update_enable if needed [2/2]

PD#SWPL-2580

Problem:
The vd1 postblend bit in vpp misc is overwriten.

Solution:
osd: call osd_update_enable if needed

Verify:
verify by p212

Change-Id: I438848dc843ea370d65dc3c6b4befb32d1f2b5f8
Signed-off-by: pengcheng chen <pengcheng.chen@amlogic.com>

video: vpp: add more check for vd1 postblend in vpp_misc [1/2]

PD#SWPL-2580

Problem:
The vd1 postblend bit in vpp misc is overwriten.

Solution:
add more check for vd1 postblend bit in vsync

Verify:
verify by p212

Change-Id: I367e920c13764af41446d7d759aaf8388fb08722
Signed-off-by: Brian Zhu <brian.zhu@amlogic.com>

osd: adjust free_scale_dst if interlaced [1/1]

PD#SWPL-2600

Problem:
osd display half menu when in 1080i

Solution:
osd: adjust free_scale_dst if interlaced

Verify:
verify by p212

Change-Id: Ie9faffbb5942faa317b380ca0cdbee072a30c01f
Signed-off-by: pengcheng chen <pengcheng.chen@amlogic.com>
Signed-off-by: Jian Cao <jian.cao@amlogic.com>

osd: call osd_update_enable directly if osd cursor [1/1]

PD#SWPL-2744

Problem:
osd mouse can't see before platform g12a

Solution:
call osd_update_enable directly if osd cursor

Verify:
verify by p212

Change-Id: Ia8488a5bd0f707de2a02aa2b74e4a07582ef7f60
Signed-off-by: pengcheng chen <pengcheng.chen@amlogic.com>

deinterlace: there's a change to hang in shutdown [1/1]

PD#OTT-778

Problem:
1.kernel received reboot command, but hang in shutdown

Solution:
move tasklet_disable behind tasklet_kill

Verify:
P321

Change-Id: I994c21c5aeb42dbbb4e3b50ccac8376db4d4039d
Signed-off-by: Jihong Sui <jihong.sui@amlogic.com>

Conflicts:
	drivers/amlogic/media/deinterlace/deinterlace.c

fdto: peripheral driver support dtbo [1/4]

PD#SWPL-2193

Problem:
We cannot compile dtbo file in a way like
make ARCH=arm foo.dtbo

Solution:
Add dtbo target and reuse the dtb rules

Verify:
Locally verifed

Change-Id: I34b88e61b409defe553cf5ed1077c160b9a6f350
Signed-off-by: jiamin ma <jiamin.ma@amlogic.com>

fdto: peripheral driver support dtbo [2/4]

PD#SWPL-2193

Problem:
Node dummy-battery and dummy-charger are android version
dependent, and should be "fdt overlayed"

Solution:
Add fdt overlay file android_p_overlay_dt.dts, and configure
dummy-battery and dummy-charger in it

Verify:
Locally on P212 and R311

Change-Id: I75a27a0ad1253556cae5273f36e0eb828291fd73
Signed-off-by: Jianxiong Pan <jianxiong.pan@amlogic.com>
Signed-off-by: jiamin ma <jiamin.ma@amlogic.com>

dts: fdto: the fdt is damaged in booting process [1/1]

PD#SWPL-2960

Problem:
If the overlay dts refers to a node which does not exist in the base
device tree, the final fdt will be in a damaged state after doing fdt
overlay

Solution:
Use the standard overlay dts syntax to note node to be applied instead
of the google recommended one

Verify:
Locally on P230

Change-Id: Ibf45abff1348437bc3fc2745e6d955cc8292db46
Signed-off-by: Jiamin Ma <jiamin.ma@amlogic.com>

dv: fix the error hsize and vsize of dv core 2 [1/1]

PD#OTT-776

Problem:
dv core 2 get the error hsize and vsize from OSD module

Solution:
when opening 3 osd paths. we get the accurate the parameters again

Verify:
g12b s922

Change-Id: Ib6af084910c8cf1896060295c7cea75971cd86b6
Signed-off-by: Yi Zhou <yi.zhou@amlogic.com>

codec_mm: show current tvp flag [1/2]

PD#OTT-937

Problem:
When kill mediacodec during playing drm, tvp memory not be freed

Solution:
Check tvp flag in kernel, free tvp memory if flag is not zero

Verify:
P212

Change-Id: I35cbb2808bf179710ec59bd5227995949946ee77
Signed-off-by: Tao Guo <tao.guo@amlogic.com>

Revert "arm: dts: gxl: replace watchdog with new version [1/1]"

This reverts commit d932cb0022.

Change-Id: Ie9af906663de4f49a5f21fe026d68e55238b3642

defendkey: G12A: support secure upgrade check [3/4]

PD#SWPL-2347

Problem:
G12A need to support secure upgrade check

Solution:
1.modify reserve memory mode
2.only use cpu0 in defendkey write process

Verify:
G12A skt board verify pass

Change-Id: Iad771381e959a79dcba7a0adb862295fa5ba5dee
Signed-off-by: Zhongfu Luo <zhongfu.luo@amlogic.com>

dts: G12A: defendkey: support secure upgrade check [4/4]

PD#SWPL-2347

Problem:
G12A need to support secure upgrade check

Solution:
add defendkey support in all G12A dts

Verify:
G12A skt board verify pass

Change-Id: I7343c2c553dfe776eefcfff9ab3a270c87014118
Signed-off-by: Zhongfu Luo <zhongfu.luo@amlogic.com>

emmc: modify device node name [1/1]

PD#SWPL-2719

Problem:
Can't idetify correctlly when move disk have multi
partition

Solution:
Remove the function of using the partition name as
the device node name

Verify:
test pass on tl1 ref board

Change-Id: I113e63f209c529149fb94b0bb10b0b254717c2bf
Signed-off-by: Ruixuan Li <ruixuan.li@amlogic.com>

arm: dts: gxl: replace watchdog with new version [1/1]

PD#SWPL-1600

Problem:
The current watchdog is not the upstream standard driver.

Solution:
Replace watchdog device tree to use the standard watchdog driver.

Verify:
S905X P215/P212 Android-32bit Kernel-32bit.

Change-Id: I972c8ebb0158caa2df393d9a2d687d9298181102
Signed-off-by: Bo Yang <bo.yang@amlogic.com>

watchdog: Change the feed watchdog mode [1/1]

PD#SWPL-2378

Problem:
Using Android to feed watchdog is not easy to debug the
crash problem, in addition, the Android does not open
the dog feeding service.

Solution:
Change the DTS configuration and change into driver feed watchdog.

Verify:
test pass on g12a-u200

Change-Id: Ie0a91fd8451fdccf3038ba6290a277c9048c52cd
Signed-off-by: Yingyuan Zhu <yingyuan.zhu@amlogic.com>

hdmitx: add parsing for non-standard dv edid [1/1]

PD#SWPL-1968

Problem:
some error edid need to be parsed

Solution:
add parsing for non-standard dv edid

Verify:
t962e (txlx)

Change-Id: Ia952ed59650fd0b1c665ca03175a38c1cf3ae5bb
Signed-off-by: Yi Zhou <yi.zhou@amlogic.com>

media: video: fix cvbs black dot issue [1/1]

PD#SWPL-1910

Problem:
Black dot on cvbsout when local play 4k

Solution:
Set limit rang when vpp output yuv for cvbs

Verify:
test pass on u200/s905x

Change-Id: Ia3e93078eb1a00d8c974bae8cc373a3a679f8b9f
Signed-off-by: Nian Jing <nian.jing@amlogic.com>

hdmitx: fix a resmue panic isse [1/1]

PD#SWPL-3188

Problem:
When HDMI cable is not connected(that is CVBS out), and system
may be panic after resume.

Solution:
Add NULL pointer protection check

Verify:
P212

Change-Id: I60818faaf7049667501e31990fa557b754ea7f1b
Signed-off-by: Zongdong Jiao <zongdong.jiao@amlogic.com>

dts: G12B: defendkey: support secure upgrade check [3/3]

PD#SWPL-2348

Problem:
G12B need to support secure upgrade check

Solution:
add defendkey support in all G12B dts

Verify:
G12B skt board verify pass

Change-Id: I2c3f51e761531cf2169dda483991b3d876039686
Signed-off-by: Zhongfu Luo <zhongfu.luo@amlogic.com>

dts: GXL: defendkey: modify reserve memory mode [2/2]

PD#SWPL-2100

Problem:
GXL need to modify reserve memory mode

Solution:
remove defendkey reserved memory in GXL dts

Verify:
GXL skt board verify pass

Change-Id: Ie5ed01c6dd8f88c5594d6bc73f13282e535071a2
Signed-off-by: Zhongfu Luo <zhongfu.luo@amlogic.com>

cec: for support multi-logical address [1/1]

PD#SWPL-418

Problem:
cec: support multi-logical address

Solution:
if working on multi-logical address, enable two ip
1.enable cec_a, cec_b
2.enable two interrupt
3.enable two pinmux oa_7, ao_8
4.cec_a only send all msg
5.cec_b only receive all msg
6.discard ceca broadcast msg

Verify:
r311
r321
p321

Change-Id: I1dc93429876ede951657102bcd7d41a500946719
Signed-off-by: Yong Qin <yong.qin@amlogic.com>

cec: add device match for tl1 [1/1]

PD#172587

Problem:
add device match for tl1

Solution:
1.add cecb ver
2.add ceca status reg flag

Verify:
1.run TPM
2.run chip

Change-Id: I304abfd1d6f1f216f9f0c56ca19a8bdb2ccfeabb
Signed-off-by: Yong Qin <yong.qin@amlogic.com>

cec: update cec platform data for tl1 [1/1]

PD#172587

Problem:
the line check always return low.
the print of check too much.

Solution:
modify the cec gpio from 7 to 10.
modify the check line.

Verify:
tl1 x301 board

Change-Id: I09ae5eee455d83e51e65957cd293e07da1c0046a
Signed-off-by: hongmin hua <hongmin.hua@amlogic.com>

cec: auto shutdown case crash [1/1]

PD#SWPL-2258

Problem:
1.running autoshutdown cause device crashed

Solution:
1.optimize cec power on proble flow

Verify:
1.p212

Change-Id: Ia78c76cdb4b72a1a275628b3ad77ea6d71696d89
Signed-off-by: Yong Qin <yong.qin@amlogic.com>
2019-01-04 15:31:37 +09:00
Mauro (mdrjr) Ribeiro
901d3e0e46 Merge tag 'v4.9.138' into odroidn2-4.9.y
This is the 4.9.138 stable release
2018-11-28 18:58:44 +09:00
Mauro (mdrjr) Ribeiro
b880273097 Merge tag 'v4.9.136' into odroidn2-4.9.y
This is the 4.9.136 stable release
2018-11-28 18:58:37 +09:00
Mauro (mdrjr) Ribeiro
1de3a94f7e Merge tag 'v4.9.134' into odroidn2-4.9.y
This is the 4.9.134 stable release
2018-11-28 18:50:36 +09:00
Mauro (mdrjr) Ribeiro
41af7ed3af Merge tag 'v4.9.133' into odroidn2-4.9.y
This is the 4.9.133 stable release
2018-11-28 18:46:05 +09:00
Mauro (mdrjr) Ribeiro
cee80e1274 Merge tag 'v4.9.129' into odroidn2-4.9.y
This is the 4.9.129 stable release
2018-11-28 18:36:03 +09:00
Mauro (mdrjr) Ribeiro
a01138426b Merge tag 'v4.9.126' into odroidn2-4.9.y
This is the 4.9.126 stable release
2018-11-28 18:24:27 +09:00
Mikulas Patocka
7ecf24877e mach64: fix image corruption due to reading accelerator registers
commit c09bcc91bb upstream.

Reading the registers without waiting for engine idle returns
unpredictable values. These unpredictable values result in display
corruption - if atyfb_imageblit reads the content of DP_PIX_WIDTH with the
bit DP_HOST_TRIPLE_EN set (from previous invocation), the driver would
never ever clear the bit, resulting in display corruption.

We don't want to wait for idle because it would degrade performance, so
this patch modifies the driver so that it never reads accelerator
registers.

HOST_CNTL doesn't have to be read, we can just write it with
HOST_BYTE_ALIGN because no other part of the driver cares if
HOST_BYTE_ALIGN is set.

DP_PIX_WIDTH is written in the functions atyfb_copyarea and atyfb_fillrect
with the default value and in atyfb_imageblit with the value set according
to the source image data.

Signed-off-by: Mikulas Patocka <mpatocka@redhat.com>
Reviewed-by: Ville Syrjälä <syrjala@sci.fi>
Cc: stable@vger.kernel.org
Signed-off-by: Bartlomiej Zolnierkiewicz <b.zolnierkie@samsung.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2018-11-21 09:26:00 +01:00
Mikulas Patocka
6bd9b55243 mach64: fix display corruption on big endian machines
commit 3c6c6a7878 upstream.

The code for manual bit triple is not endian-clean. It builds the variable
"hostdword" using byte accesses, therefore we must read the variable with
"le32_to_cpu".

The patch also enables (hardware or software) bit triple only if the image
is monochrome (image->depth). If we want to blit full-color image, we
shouldn't use the triple code.

Signed-off-by: Mikulas Patocka <mpatocka@redhat.com>
Reviewed-by: Ville Syrjälä <syrjala@sci.fi>
Cc: stable@vger.kernel.org
Signed-off-by: Bartlomiej Zolnierkiewicz <b.zolnierkie@samsung.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2018-11-21 09:25:59 +01:00
Bjorn Helgaas
2d4260b280 efi/fb: Correct PCI_STD_RESOURCE_END usage
[ Upstream commit 92a16c8629 ]

PCI_STD_RESOURCE_END is (confusingly) the index of the last valid BAR, not
the *number* of BARs.  To iterate through all possible BARs, we need to
include PCI_STD_RESOURCE_END.

Fixes: 55d728a40d ("efi/fb: Avoid reconfiguration of BAR that covers the framebuffer")
Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
2018-11-10 07:42:45 -08:00
Lubomir Rintel
8641700477 pxa168fb: prepare the clock
[ Upstream commit d85536cde9 ]

Add missing prepare/unprepare operations for fbi->clk,
this fixes following kernel warning:

  ------------[ cut here ]------------
  WARNING: CPU: 0 PID: 1 at drivers/clk/clk.c:874 clk_core_enable+0x2c/0x1b0
  Enabling unprepared disp0_clk
  Modules linked in:
  CPU: 0 PID: 1 Comm: swapper Not tainted 4.18.0-rc8-00032-g02b43ddd4f21-dirty #25
  Hardware name: Marvell MMP2 (Device Tree Support)
  [<c010f7cc>] (unwind_backtrace) from [<c010cc6c>] (show_stack+0x10/0x14)
  [<c010cc6c>] (show_stack) from [<c011dab4>] (__warn+0xd8/0xf0)
  [<c011dab4>] (__warn) from [<c011db10>] (warn_slowpath_fmt+0x44/0x6c)
  [<c011db10>] (warn_slowpath_fmt) from [<c043898c>] (clk_core_enable+0x2c/0x1b0)
  [<c043898c>] (clk_core_enable) from [<c0439ec8>] (clk_core_enable_lock+0x18/0x2c)
  [<c0439ec8>] (clk_core_enable_lock) from [<c0436698>] (pxa168fb_probe+0x464/0x6ac)
  [<c0436698>] (pxa168fb_probe) from [<c04779a0>] (platform_drv_probe+0x48/0x94)
  [<c04779a0>] (platform_drv_probe) from [<c0475bec>] (driver_probe_device+0x328/0x470)
  [<c0475bec>] (driver_probe_device) from [<c0475de4>] (__driver_attach+0xb0/0x124)
  [<c0475de4>] (__driver_attach) from [<c0473c38>] (bus_for_each_dev+0x64/0xa0)
  [<c0473c38>] (bus_for_each_dev) from [<c0474ee0>] (bus_add_driver+0x1b8/0x230)
  [<c0474ee0>] (bus_add_driver) from [<c0476a20>] (driver_register+0xac/0xf0)
  [<c0476a20>] (driver_register) from [<c0102dd4>] (do_one_initcall+0xb8/0x1f0)
  [<c0102dd4>] (do_one_initcall) from [<c0b010a0>] (kernel_init_freeable+0x294/0x2e0)
  [<c0b010a0>] (kernel_init_freeable) from [<c07e9eb8>] (kernel_init+0x8/0x10c)
  [<c07e9eb8>] (kernel_init) from [<c01010e8>] (ret_from_fork+0x14/0x2c)
  Exception stack(0xd008bfb0 to 0xd008bff8)
  bfa0:                                     00000000 00000000 00000000 00000000
  bfc0: 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000
  bfe0: 00000000 00000000 00000000 00000000 00000013 00000000
  ---[ end trace c0af40f9e2ed7cb4 ]---

Signed-off-by: Lubomir Rintel <lkundrak@v3.sk>
[b.zolnierkie: enhance patch description a bit]
Signed-off-by: Bartlomiej Zolnierkiewicz <b.zolnierkie@samsung.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
2018-11-10 07:42:43 -08:00
Mikulas Patocka
9f5095da2d mach64: detect the dot clock divider correctly on sparc
commit 76ebebd246 upstream.

On Sun Ultra 5, it happens that the dot clock is not set up properly for
some videomodes. For example, if we set the videomode "r1024x768x60" in
the firmware, Linux would incorrectly set a videomode with refresh rate
180Hz when booting (suprisingly, my LCD monitor can display it, although
display quality is very low).

The reason is this: Older mach64 cards set the divider in the register
VCLK_POST_DIV. The register has four 2-bit fields (the field that is
actually used is specified in the lowest two bits of the register
CLOCK_CNTL). The 2 bits select divider "1, 2, 4, 8". On newer mach64 cards,
there's another bit added - the top four bits of PLL_EXT_CNTL extend the
divider selection, so we have possible dividers "1, 2, 4, 8, 3, 5, 6, 12".
The Linux driver clears the top four bits of PLL_EXT_CNTL and never sets
them, so it can work regardless if the card supports them. However, the
sparc64 firmware may set these extended dividers during boot - and the
mach64 driver detects incorrect dot clock in this case.

This patch makes the driver read the additional divider bit from
PLL_EXT_CNTL and calculate the initial refresh rate properly.

Signed-off-by: Mikulas Patocka <mpatocka@redhat.com>
Cc: stable@vger.kernel.org
Acked-by: David S. Miller <davem@davemloft.net>
Reviewed-by: Ville Syrjälä <syrjala@sci.fi>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2018-10-18 09:13:21 +02:00
Tomi Valkeinen
22feb4d4f4 fbdev/omapfb: fix omapfb_memory_read infoleak
commit 1bafcbf59f upstream.

OMAPFB_MEMORY_READ ioctl reads pixels from the LCD's memory and copies
them to a userspace buffer. The code has two issues:

- The user provided width and height could be large enough to overflow
  the calculations
- The copy_to_user() can copy uninitialized memory to the userspace,
  which might contain sensitive kernel information.

Fix these by limiting the width & height parameters, and only copying
the amount of data that we actually received from the LCD.

Signed-off-by: Tomi Valkeinen <tomi.valkeinen@ti.com>
Reported-by: Jann Horn <jannh@google.com>
Cc: stable@vger.kernel.org
Cc: security@kernel.org
Cc: Will Deacon <will.deacon@arm.com>
Cc: Jann Horn <jannh@google.com>
Cc: Tony Lindgren <tony@atomide.com>
Signed-off-by: Bartlomiej Zolnierkiewicz <b.zolnierkie@samsung.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2018-10-13 09:18:53 +02:00
Fredrik Noring
6431fb7b5e fbdev: Distinguish between interlaced and progressive modes
[ Upstream commit 1ba0a59cea ]

I discovered the problem when developing a frame buffer driver for the
PlayStation 2 (not yet merged), using the following video modes for the
PlayStation 3 in drivers/video/fbdev/ps3fb.c:

    }, {
        /* 1080if */
        "1080if", 50, 1920, 1080, 13468, 148, 484, 36, 4, 88, 5,
        FB_SYNC_BROADCAST, FB_VMODE_INTERLACED
    }, {
        /* 1080pf */
        "1080pf", 50, 1920, 1080, 6734, 148, 484, 36, 4, 88, 5,
        FB_SYNC_BROADCAST, FB_VMODE_NONINTERLACED
    },

In ps3fb_probe, the mode_option module parameter is used with fb_find_mode
but it can only select the interlaced variant of 1920x1080 since the loop
matching the modes does not take the difference between interlaced and
progressive modes into account.

In short, without the patch, progressive 1920x1080 cannot be chosen as a
mode_option parameter since fb_find_mode (falsely) thinks interlace is a
perfect match.

Signed-off-by: Fredrik Noring <noring@nocrew.org>
Cc: "Maciej W. Rozycki" <macro@linux-mips.org>
[b.zolnierkie: updated patch description]
Signed-off-by: Bartlomiej Zolnierkiewicz <b.zolnierkie@samsung.com>
Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2018-09-26 08:36:32 +02:00
Daniel Mack
1e5d820bc8 video: fbdev: pxafb: clear allocated memory for video modes
[ Upstream commit b951d80aaf ]

When parsing the video modes from DT properties, make sure to zero out
memory before using it. This is important because not all fields in the mode
struct are explicitly initialized, even though they are used later on.

Fixes: 420a488278 ("video: fbdev: pxafb: initial devicetree conversion")
Reviewed-by: Robert Jarzmik <robert.jarzmik@free.fr>
Signed-off-by: Daniel Mack <daniel@zonque.org>
Signed-off-by: Bartlomiej Zolnierkiewicz <b.zolnierkie@samsung.com>
Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2018-09-26 08:36:32 +02:00
Randy Dunlap
e97220e28f fbdev/via: fix defined but not used warning
[ Upstream commit b6566b47a6 ]

Fix a build warning in viafbdev.c when CONFIG_PROC_FS is not enabled
by marking the unused function as __maybe_unused.

../drivers/video/fbdev/via/viafbdev.c:1471:12: warning: 'viafb_sup_odev_proc_show' defined but not used [-Wunused-function]

Signed-off-by: Randy Dunlap <rdunlap@infradead.org>
Cc: Florian Tobias Schandinat <FlorianSchandinat@gmx.de>
Signed-off-by: Bartlomiej Zolnierkiewicz <b.zolnierkie@samsung.com>
Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2018-09-26 08:36:32 +02:00
Anton Vasilyev
d9f6ae2f49 video: goldfishfb: fix memory leak on driver remove
[ Upstream commit 5958fde72d ]

goldfish_fb_probe() allocates memory for fb, but goldfish_fb_remove() does
not have deallocation of fb, which leads to memory leak on probe/remove.

The patch adds deallocation into goldfish_fb_remove().

Found by Linux Driver Verification project (linuxtesting.org).

Signed-off-by: Anton Vasilyev <vasilyev@ispras.ru>
Cc: Aleksandar Markovic <aleksandar.markovic@mips.com>
Cc: Miodrag Dinic <miodrag.dinic@mips.com>
Cc: Goran Ferenc <goran.ferenc@mips.com>
Signed-off-by: Bartlomiej Zolnierkiewicz <b.zolnierkie@samsung.com>
Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2018-09-26 08:36:32 +02:00
Dan Carpenter
85d6635b63 fbdev: omapfb: off by one in omapfb_register_client()
[ Upstream commit 5ec1ec35b2 ]

The omapfb_register_client[] array has OMAPFB_PLANE_NUM elements so the
> should be >= or we are one element beyond the end of the array.

Fixes: 8b08cf2b64 ("OMAP: add TI OMAP framebuffer driver")
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Cc: Imre Deak <imre.deak@solidboot.com>
Signed-off-by: Bartlomiej Zolnierkiewicz <b.zolnierkie@samsung.com>
Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2018-09-26 08:36:32 +02:00
Mikulas Patocka
3752de782d fb: fix lost console when the user unplugs a USB adapter
commit 8c5b044299 upstream.

I have a USB display adapter using the udlfb driver and I use it on an ARM
board that doesn't have any graphics card. When I plug the adapter in, the
console is properly displayed, however when I unplug and re-plug the
adapter, the console is not displayed and I can't access it until I reboot
the board.

The reason is this:
When the adapter is unplugged, dlfb_usb_disconnect calls
unlink_framebuffer, then it waits until the reference count drops to zero
and then it deallocates the framebuffer. However, the console that is
attached to the framebuffer device keeps the reference count non-zero, so
the framebuffer device is never destroyed. When the USB adapter is plugged
again, it creates a new device /dev/fb1 and the console is not attached to
it.

This patch fixes the bug by unbinding the console from unlink_framebuffer.
The code to unbind the console is moved from do_unregister_framebuffer to
a function unbind_console. When the console is unbound, the reference
count drops to zero and the udlfb driver frees the framebuffer. When the
adapter is plugged back, a new framebuffer is created and the console is
attached to it.

Signed-off-by: Mikulas Patocka <mpatocka@redhat.com>
Cc: Dave Airlie <airlied@redhat.com>
Cc: Bernie Thompson <bernie@plugable.com>
Cc: Ladislav Michl <ladis@linux-mips.org>
Cc: stable@vger.kernel.org
[b.zolnierkie: preserve old behavior for do_unregister_framebuffer()]
Signed-off-by: Bartlomiej Zolnierkiewicz <b.zolnierkie@samsung.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2018-09-09 20:01:25 +02:00
Greg Kroah-Hartman
03c70feafd Merge 4.9.111 into android-4.9
Changes in 4.9.111
	x86/spectre_v1: Disable compiler optimizations over array_index_mask_nospec()
	x86/mce: Improve error message when kernel cannot recover
	x86/mce: Check for alternate indication of machine check recovery on Skylake
	x86/mce: Fix incorrect "Machine check from unknown source" message
	x86/mce: Do not overwrite MCi_STATUS in mce_no_way_out()
	x86: Call fixup_exception() before notify_die() in math_error()
	m68k/mm: Adjust VM area to be unmapped by gap size for __iounmap()
	serial: sh-sci: Use spin_{try}lock_irqsave instead of open coding version
	signal/xtensa: Consistenly use SIGBUS in do_unaligned_user
	usb: do not reset if a low-speed or full-speed device timed out
	1wire: family module autoload fails because of upper/lower case mismatch.
	ASoC: dapm: delete dapm_kcontrol_data paths list before freeing it
	ASoC: cirrus: i2s: Fix LRCLK configuration
	ASoC: cirrus: i2s: Fix {TX|RX}LinCtrlData setup
	clk: renesas: cpg-mssr: Stop using printk format %pCr
	lib/vsprintf: Remove atomic-unsafe support for %pCr
	mips: ftrace: fix static function graph tracing
	branch-check: fix long->int truncation when profiling branches
	ipmi:bt: Set the timeout before doing a capabilities check
	Bluetooth: hci_qca: Avoid missing rampatch failure with userspace fw loader
	fuse: atomic_o_trunc should truncate pagecache
	fuse: don't keep dead fuse_conn at fuse_fill_super().
	fuse: fix control dir setup and teardown
	powerpc/mm/hash: Add missing isync prior to kernel stack SLB switch
	powerpc/ptrace: Fix setting 512B aligned breakpoints with PTRACE_SET_DEBUGREG
	powerpc/ptrace: Fix enforcement of DAWR constraints
	powerpc/powernv/ioda2: Remove redundant free of TCE pages
	cpuidle: powernv: Fix promotion from snooze if next state disabled
	powerpc/fadump: Unregister fadump on kexec down path.
	ARM: 8764/1: kgdb: fix NUMREGBYTES so that gdb_regs[] is the correct size
	arm64: kpti: Use early_param for kpti= command-line option
	arm64: mm: Ensure writes to swapper are ordered wrt subsequent cache maintenance
	of: unittest: for strings, account for trailing \0 in property length field
	IB/qib: Fix DMA api warning with debug kernel
	IB/{hfi1, qib}: Add handling of kernel restart
	IB/mlx5: Fetch soft WQE's on fatal error state
	IB/isert: Fix for lib/dma_debug check_sync warning
	IB/isert: fix T10-pi check mask setting
	RDMA/mlx4: Discard unknown SQP work requests
	mtd: cfi_cmdset_0002: Change write buffer to check correct value
	mtd: cfi_cmdset_0002: Use right chip in do_ppb_xxlock()
	mtd: cfi_cmdset_0002: fix SEGV unlocking multiple chips
	mtd: cfi_cmdset_0002: Fix unlocking requests crossing a chip boudary
	mtd: cfi_cmdset_0002: Avoid walking all chips when unlocking.
	MIPS: BCM47XX: Enable 74K Core ExternalSync for PCIe erratum
	PCI: Add ACS quirk for Intel 7th & 8th Gen mobile
	PCI: Add ACS quirk for Intel 300 series
	PCI: pciehp: Clear Presence Detect and Data Link Layer Status Changed on resume
	printk: fix possible reuse of va_list variable
	MIPS: io: Add barrier after register read in inX()
	time: Make sure jiffies_to_msecs() preserves non-zero time periods
	X.509: unpack RSA signatureValue field from BIT STRING
	Btrfs: fix return value on rename exchange failure
	Btrfs: fix unexpected cow in run_delalloc_nocow
	iio:buffer: make length types match kfifo types
	scsi: qla2xxx: Fix setting lower transfer speed if GPSC fails
	scsi: zfcp: fix missing SCSI trace for result of eh_host_reset_handler
	scsi: zfcp: fix missing SCSI trace for retry of abort / scsi_eh TMF
	scsi: zfcp: fix misleading REC trigger trace where erp_action setup failed
	scsi: zfcp: fix missing REC trigger trace on terminate_rport_io early return
	scsi: zfcp: fix missing REC trigger trace on terminate_rport_io for ERP_FAILED
	scsi: zfcp: fix missing REC trigger trace for all objects in ERP_FAILED
	scsi: zfcp: fix missing REC trigger trace on enqueue without ERP thread
	linvdimm, pmem: Preserve read-only setting for pmem devices
	clk: at91: PLL recalc_rate() now using cached MUL and DIV values
	md: fix two problems with setting the "re-add" device state.
	rpmsg: smd: do not use mananged resources for endpoints and channels
	ubi: fastmap: Cancel work upon detach
	ubi: fastmap: Correctly handle interrupted erasures in EBA
	UBIFS: Fix potential integer overflow in allocation
	backlight: as3711_bl: Fix Device Tree node lookup
	backlight: max8925_bl: Fix Device Tree node lookup
	backlight: tps65217_bl: Fix Device Tree node lookup
	mfd: intel-lpss: Program REMAP register in PIO mode
	perf tools: Fix symbol and object code resolution for vdso32 and vdsox32
	perf intel-pt: Fix sync_switch INTEL_PT_SS_NOT_TRACING
	perf intel-pt: Fix decoding to accept CBR between FUP and corresponding TIP
	perf intel-pt: Fix MTC timing after overflow
	perf intel-pt: Fix "Unexpected indirect branch" error
	perf intel-pt: Fix packet decoding of CYC packets
	media: v4l2-compat-ioctl32: prevent go past max size
	media: cx231xx: Add support for AverMedia DVD EZMaker 7
	media: dvb_frontend: fix locking issues at dvb_frontend_get_event()
	nfsd: restrict rd_maxcount to svc_max_payload in nfsd_encode_readdir
	NFSv4: Fix possible 1-byte stack overflow in nfs_idmap_read_and_verify_message
	NFSv4: Revert commit 5f83d86cf5 ("NFSv4.x: Fix wraparound issues..")
	video: uvesafb: Fix integer overflow in allocation
	Input: elan_i2c - add ELAN0618 (Lenovo v330 15IKB) ACPI ID
	pwm: lpss: platform: Save/restore the ctrl register over a suspend/resume
	rbd: flush rbd_dev->watch_dwork after watch is unregistered
	mm: fix devmem_is_allowed() for sub-page System RAM intersections
	xen: Remove unnecessary BUG_ON from __unbind_from_irq()
	udf: Detect incorrect directory size
	Input: elan_i2c_smbus - fix more potential stack buffer overflows
	Input: elantech - enable middle button of touchpads on ThinkPad P52
	Input: elantech - fix V4 report decoding for module with middle key
	ALSA: hda/realtek - Fix pop noise on Lenovo P50 & co
	ALSA: hda/realtek - Add a quirk for FSC ESPRIMO U9210
	block: Fix transfer when chunk sectors exceeds max
	dm thin: handle running out of data space vs concurrent discard
	cdc_ncm: avoid padding beyond end of skb
	Linux 4.9.111

Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
2018-07-03 18:27:19 +02:00
Kees Cook
7673ca3c93 video: uvesafb: Fix integer overflow in allocation
commit 9f645bcc56 upstream.

cmap->len can get close to INT_MAX/2, allowing for an integer overflow in
allocation. This uses kmalloc_array() instead to catch the condition.

Reported-by: Dr Silvio Cesare of InfoSect <silvio.cesare@gmail.com>
Fixes: 8bdb3a2d7d ("uvesafb: the driver core")
Cc: stable@vger.kernel.org
Signed-off-by: Kees Cook <keescook@chromium.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2018-07-03 11:23:16 +02:00
Greg Kroah-Hartman
9797dcb8c7 Merge 4.9.104 into android-4.9
Changes in 4.9.104
	MIPS: c-r4k: Fix data corruption related to cache coherence
	MIPS: ptrace: Expose FIR register through FP regset
	MIPS: Fix ptrace(2) PTRACE_PEEKUSR and PTRACE_POKEUSR accesses to o32 FGRs
	KVM: Fix spelling mistake: "cop_unsuable" -> "cop_unusable"
	affs_lookup(): close a race with affs_remove_link()
	aio: fix io_destroy(2) vs. lookup_ioctx() race
	ALSA: timer: Fix pause event notification
	do d_instantiate/unlock_new_inode combinations safely
	mmc: sdhci-iproc: remove hard coded mmc cap 1.8v
	mmc: sdhci-iproc: fix 32bit writes for TRANSFER_MODE register
	libata: Blacklist some Sandisk SSDs for NCQ
	libata: blacklist Micron 500IT SSD with MU01 firmware
	xen-swiotlb: fix the check condition for xen_swiotlb_free_coherent
	drm/vmwgfx: Fix 32-bit VMW_PORT_HB_[IN|OUT] macros
	IB/hfi1: Use after free race condition in send context error path
	Revert "ipc/shm: Fix shmat mmap nil-page protection"
	ipc/shm: fix shmat() nil address after round-down when remapping
	kasan: fix memory hotplug during boot
	kernel/sys.c: fix potential Spectre v1 issue
	kernel/signal.c: avoid undefined behaviour in kill_something_info
	KVM/VMX: Expose SSBD properly to guests
	KVM: s390: vsie: fix < 8k check for the itdba
	KVM: x86: Update cpuid properly when CR4.OSXAVE or CR4.PKE is changed
	kvm: x86: IA32_ARCH_CAPABILITIES is always supported
	firewire-ohci: work around oversized DMA reads on JMicron controllers
	x86/tsc: Allow TSC calibration without PIT
	NFSv4: always set NFS_LOCK_LOST when a lock is lost.
	ALSA: hda - Use IS_REACHABLE() for dependency on input
	kvm: x86: fix KVM_XEN_HVM_CONFIG ioctl
	netfilter: ipv6: nf_defrag: Pass on packets to stack per RFC2460
	tracing/hrtimer: Fix tracing bugs by taking all clock bases and modes into account
	PCI: Add function 1 DMA alias quirk for Marvell 9128
	Input: psmouse - fix Synaptics detection when protocol is disabled
	i40iw: Zero-out consumer key on allocate stag for FMR
	tools lib traceevent: Simplify pointer print logic and fix %pF
	perf callchain: Fix attr.sample_max_stack setting
	tools lib traceevent: Fix get_field_str() for dynamic strings
	perf record: Fix failed memory allocation for get_cpuid_str
	iommu/vt-d: Use domain instead of cache fetching
	dm thin: fix documentation relative to low water mark threshold
	net: stmmac: dwmac-meson8b: fix setting the RGMII TX clock on Meson8b
	net: stmmac: dwmac-meson8b: propagate rate changes to the parent clock
	nfs: Do not convert nfs_idmap_cache_timeout to jiffies
	watchdog: sp5100_tco: Fix watchdog disable bit
	kconfig: Don't leak main menus during parsing
	kconfig: Fix automatic menu creation mem leak
	kconfig: Fix expr_free() E_NOT leak
	mac80211_hwsim: fix possible memory leak in hwsim_new_radio_nl()
	ipmi/powernv: Fix error return code in ipmi_powernv_probe()
	Btrfs: set plug for fsync
	btrfs: Fix out of bounds access in btrfs_search_slot
	Btrfs: fix scrub to repair raid6 corruption
	btrfs: fail mount when sb flag is not in BTRFS_SUPER_FLAG_SUPP
	HID: roccat: prevent an out of bounds read in kovaplus_profile_activated()
	fm10k: fix "failed to kill vid" message for VF
	device property: Define type of PROPERTY_ENRTY_*() macros
	jffs2: Fix use-after-free bug in jffs2_iget()'s error handling path
	powerpc/numa: Use ibm,max-associativity-domains to discover possible nodes
	powerpc/numa: Ensure nodes initialized for hotplug
	RDMA/mlx5: Avoid memory leak in case of XRCD dealloc failure
	ntb_transport: Fix bug with max_mw_size parameter
	gianfar: prevent integer wrapping in the rx handler
	tcp_nv: fix potential integer overflow in tcpnv_acked
	kvm: Map PFN-type memory regions as writable (if possible)
	ocfs2: return -EROFS to mount.ocfs2 if inode block is invalid
	ocfs2/acl: use 'ip_xattr_sem' to protect getting extended attribute
	ocfs2: return error when we attempt to access a dirty bh in jbd2
	mm/mempolicy: fix the check of nodemask from user
	mm/mempolicy: add nodes_empty check in SYSC_migrate_pages
	asm-generic: provide generic_pmdp_establish()
	sparc64: update pmdp_invalidate() to return old pmd value
	mm: thp: use down_read_trylock() in khugepaged to avoid long block
	mm: pin address_space before dereferencing it while isolating an LRU page
	mm/fadvise: discard partial page if endbyte is also EOF
	openvswitch: Remove padding from packet before L3+ conntrack processing
	IB/ipoib: Fix for potential no-carrier state
	drm/nouveau/pmu/fuc: don't use movw directly anymore
	netfilter: ipv6: nf_defrag: Kill frag queue on RFC2460 failure
	x86/power: Fix swsusp_arch_resume prototype
	firmware: dmi_scan: Fix handling of empty DMI strings
	ACPI: processor_perflib: Do not send _PPC change notification if not ready
	ACPI / scan: Use acpi_bus_get_status() to initialize ACPI_TYPE_DEVICE devs
	bpf: fix selftests/bpf test_kmod.sh failure when CONFIG_BPF_JIT_ALWAYS_ON=y
	MIPS: generic: Fix machine compatible matching
	MIPS: TXx9: use IS_BUILTIN() for CONFIG_LEDS_CLASS
	xen-netfront: Fix race between device setup and open
	xen/grant-table: Use put_page instead of free_page
	RDS: IB: Fix null pointer issue
	arm64: spinlock: Fix theoretical trylock() A-B-A with LSE atomics
	proc: fix /proc/*/map_files lookup
	cifs: silence compiler warnings showing up with gcc-8.0.0
	bcache: properly set task state in bch_writeback_thread()
	bcache: fix for allocator and register thread race
	bcache: fix for data collapse after re-attaching an attached device
	bcache: return attach error when no cache set exist
	tools/libbpf: handle issues with bpf ELF objects containing .eh_frames
	bpf: fix rlimit in reuseport net selftest
	vfs/proc/kcore, x86/mm/kcore: Fix SMAP fault when dumping vsyscall user page
	locking/qspinlock: Ensure node->count is updated before initialising node
	irqchip/gic-v3: Ignore disabled ITS nodes
	cpumask: Make for_each_cpu_wrap() available on UP as well
	irqchip/gic-v3: Change pr_debug message to pr_devel
	ARC: Fix malformed ARC_EMUL_UNALIGNED default
	ptr_ring: prevent integer overflow when calculating size
	libata: Fix compile warning with ATA_DEBUG enabled
	selftests: pstore: Adding config fragment CONFIG_PSTORE_RAM=m
	selftests: memfd: add config fragment for fuse
	ARM: OMAP2+: timer: fix a kmemleak caused in omap_get_timer_dt
	ARM: OMAP3: Fix prm wake interrupt for resume
	ARM: OMAP1: clock: Fix debugfs_create_*() usage
	ibmvnic: Free RX socket buffer in case of adapter error
	iwlwifi: mvm: fix security bug in PN checking
	iwlwifi: mvm: always init rs with 20mhz bandwidth rates
	NFC: llcp: Limit size of SDP URI
	rxrpc: Work around usercopy check
	mac80211: round IEEE80211_TX_STATUS_HEADROOM up to multiple of 4
	mac80211: fix a possible leak of station stats
	mac80211: fix calling sleeping function in atomic context
	mac80211: Do not disconnect on invalid operating class
	md raid10: fix NULL deference in handle_write_completed()
	drm/exynos: g2d: use monotonic timestamps
	drm/exynos: fix comparison to bitshift when dealing with a mask
	locking/xchg/alpha: Add unconditional memory barrier to cmpxchg()
	md: raid5: avoid string overflow warning
	kernel/relay.c: limit kmalloc size to KMALLOC_MAX_SIZE
	powerpc/bpf/jit: Fix 32-bit JIT for seccomp_data access
	s390/cio: fix ccw_device_start_timeout API
	s390/cio: fix return code after missing interrupt
	s390/cio: clear timer when terminating driver I/O
	PKCS#7: fix direct verification of SignerInfo signature
	ARM: OMAP: Fix dmtimer init for omap1
	smsc75xx: fix smsc75xx_set_features()
	regulatory: add NUL to request alpha2
	integrity/security: fix digsig.c build error with header file
	locking/xchg/alpha: Fix xchg() and cmpxchg() memory ordering bugs
	x86/topology: Update the 'cpu cores' field in /proc/cpuinfo correctly across CPU hotplug operations
	mac80211: drop frames with unexpected DS bits from fast-rx to slow path
	arm64: fix unwind_frame() for filtered out fn for function graph tracing
	macvlan: fix use-after-free in macvlan_common_newlink()
	kvm: fix warning for CONFIG_HAVE_KVM_EVENTFD builds
	fs: dcache: Avoid livelock between d_alloc_parallel and __d_add
	fs: dcache: Use READ_ONCE when accessing i_dir_seq
	md: fix a potential deadlock of raid5/raid10 reshape
	md/raid1: fix NULL pointer dereference
	batman-adv: fix packet checksum in receive path
	batman-adv: invalidate checksum on fragment reassembly
	netfilter: ebtables: convert BUG_ONs to WARN_ONs
	batman-adv: Ignore invalid batadv_iv_gw during netlink send
	batman-adv: Ignore invalid batadv_v_gw during netlink send
	batman-adv: Fix netlink dumping of BLA claims
	batman-adv: Fix netlink dumping of BLA backbones
	nvme-pci: Fix nvme queue cleanup if IRQ setup fails
	clocksource/drivers/fsl_ftm_timer: Fix error return checking
	ceph: fix dentry leak when failing to init debugfs
	ARM: orion5x: Revert commit 4904dbda41.
	qrtr: add MODULE_ALIAS macro to smd
	r8152: fix tx packets accounting
	virtio-gpu: fix ioctl and expose the fixed status to userspace.
	dmaengine: rcar-dmac: fix max_chunk_size for R-Car Gen3
	bcache: fix kcrashes with fio in RAID5 backend dev
	ip6_tunnel: fix IFLA_MTU ignored on NEWLINK
	sit: fix IFLA_MTU ignored on NEWLINK
	ARM: dts: NSP: Fix amount of RAM on BCM958625HR
	powerpc/boot: Fix random libfdt related build errors
	gianfar: Fix Rx byte accounting for ndev stats
	net/tcp/illinois: replace broken algorithm reference link
	nvmet: fix PSDT field check in command format
	xen/pirq: fix error path cleanup when binding MSIs
	drm/sun4i: Fix dclk_set_phase
	Btrfs: send, fix issuing write op when processing hole in no data mode
	selftests/powerpc: Skip the subpage_prot tests if the syscall is unavailable
	KVM: PPC: Book3S HV: Fix VRMA initialization with 2MB or 1GB memory backing
	iwlwifi: mvm: fix TX of CCMP 256
	watchdog: f71808e_wdt: Fix magic close handling
	watchdog: sbsa: use 32-bit read for WCV
	batman-adv: Fix multicast packet loss with a single WANT_ALL_IPV4/6 flag
	e1000e: Fix check_for_link return value with autoneg off
	e1000e: allocate ring descriptors with dma_zalloc_coherent
	ia64/err-inject: Use get_user_pages_fast()
	RDMA/qedr: Fix kernel panic when running fio over NFSoRDMA
	RDMA/qedr: Fix iWARP write and send with immediate
	IB/mlx4: Fix corruption of RoCEv2 IPv4 GIDs
	IB/mlx4: Include GID type when deleting GIDs from HW table under RoCE
	IB/mlx5: Fix an error code in __mlx5_ib_modify_qp()
	fbdev: Fixing arbitrary kernel leak in case FBIOGETCMAP_SPARC in sbusfb_ioctl_helper().
	fsl/fman: avoid sleeping in atomic context while adding an address
	net: qcom/emac: Use proper free methods during TX
	net: smsc911x: Fix unload crash when link is up
	IB/core: Fix possible crash to access NULL netdev
	xen: xenbus: use put_device() instead of kfree()
	arm64: Relax ARM_SMCCC_ARCH_WORKAROUND_1 discovery
	dmaengine: mv_xor_v2: Fix clock resource by adding a register clock
	netfilter: ebtables: fix erroneous reject of last rule
	bnxt_en: Check valid VNIC ID in bnxt_hwrm_vnic_set_tpa().
	workqueue: use put_device() instead of kfree()
	ipv4: lock mtu in fnhe when received PMTU < net.ipv4.route.min_pmtu
	sunvnet: does not support GSO for sctp
	drm/imx: move arming of the vblank event to atomic_flush
	net: Fix vlan untag for bridge and vlan_dev with reorder_hdr off
	batman-adv: fix header size check in batadv_dbg_arp()
	batman-adv: Fix skbuff rcsum on packet reroute
	vti4: Don't count header length twice on tunnel setup
	vti4: Don't override MTU passed on link creation via IFLA_MTU
	perf/cgroup: Fix child event counting bug
	brcmfmac: Fix check for ISO3166 code
	kbuild: make scripts/adjust_autoksyms.sh robust against timestamp races
	RDMA/ucma: Correct option size check using optlen
	RDMA/qedr: fix QP's ack timeout configuration
	RDMA/qedr: Fix rc initialization on CNQ allocation failure
	mm/mempolicy.c: avoid use uninitialized preferred_node
	mm, thp: do not cause memcg oom for thp
	selftests: ftrace: Add probe event argument syntax testcase
	selftests: ftrace: Add a testcase for string type with kprobe_event
	selftests: ftrace: Add a testcase for probepoint
	batman-adv: fix multicast-via-unicast transmission with AP isolation
	batman-adv: fix packet loss for broadcasted DHCP packets to a server
	ARM: 8748/1: mm: Define vdso_start, vdso_end as array
	net: qmi_wwan: add BroadMobi BM806U 2020:2033
	perf/x86/intel: Fix linear IP of PEBS real_ip on Haswell and later CPUs
	llc: properly handle dev_queue_xmit() return value
	builddeb: Fix header package regarding dtc source links
	mm/kmemleak.c: wait for scan completion before disabling free
	net: Fix untag for vlan packets without ethernet header
	net: mvneta: fix enable of all initialized RXQs
	sh: fix debug trap failure to process signals before return to user
	nvme: don't send keep-alives to the discovery controller
	x86/pgtable: Don't set huge PUD/PMD on non-leaf entries
	x86/mm: Do not forbid _PAGE_RW before init for __ro_after_init
	fs/proc/proc_sysctl.c: fix potential page fault while unregistering sysctl table
	swap: divide-by-zero when zero length swap file on ssd
	sr: get/drop reference to device in revalidate and check_events
	Force log to disk before reading the AGF during a fstrim
	cpufreq: CPPC: Initialize shared perf capabilities of CPUs
	dp83640: Ensure against premature access to PHY registers after reset
	mm/ksm: fix interaction with THP
	mm: fix races between address_space dereference and free in page_evicatable
	Btrfs: bail out on error during replay_dir_deletes
	Btrfs: fix NULL pointer dereference in log_dir_items
	btrfs: Fix possible softlock on single core machines
	ocfs2/dlm: don't handle migrate lockres if already in shutdown
	sched/rt: Fix rq->clock_update_flags < RQCF_ACT_SKIP warning
	KVM: VMX: raise internal error for exception during invalid protected mode state
	fscache: Fix hanging wait on page discarded by writeback
	sparc64: Make atomic_xchg() an inline function rather than a macro.
	net: bgmac: Fix endian access in bgmac_dma_tx_ring_free()
	btrfs: tests/qgroup: Fix wrong tree backref level
	Btrfs: fix copy_items() return value when logging an inode
	btrfs: fix lockdep splat in btrfs_alloc_subvolume_writers
	rxrpc: Fix Tx ring annotation after initial Tx failure
	rxrpc: Don't treat call aborts as conn aborts
	xen/acpi: off by one in read_acpi_id()
	drivers: macintosh: rack-meter: really fix bogus memsets
	ACPI: acpi_pad: Fix memory leak in power saving threads
	powerpc/mpic: Check if cpu_possible() in mpic_physmask()
	m68k: set dma and coherent masks for platform FEC ethernets
	parisc/pci: Switch LBA PCI bus from Hard Fail to Soft Fail mode
	hwmon: (nct6775) Fix writing pwmX_mode
	powerpc/perf: Prevent kernel address leak to userspace via BHRB buffer
	powerpc/perf: Fix kernel address leak via sampling registers
	tools/thermal: tmon: fix for segfault
	selftests: Print the test we're running to /dev/kmsg
	net/mlx5: Protect from command bit overflow
	ath10k: Fix kernel panic while using worker (ath10k_sta_rc_update_wk)
	cxgb4: Setup FW queues before registering netdev
	ima: Fallback to the builtin hash algorithm
	virtio-net: Fix operstate for virtio when no VIRTIO_NET_F_STATUS
	arm: dts: socfpga: fix GIC PPI warning
	cpufreq: cppc_cpufreq: Fix cppc_cpufreq_init() failure path
	zorro: Set up z->dev.dma_mask for the DMA API
	bcache: quit dc->writeback_thread when BCACHE_DEV_DETACHING is set
	ACPICA: Events: add a return on failure from acpi_hw_register_read
	ACPICA: acpi: acpica: fix acpi operand cache leak in nseval.c
	cxgb4: Fix queue free path of ULD drivers
	i2c: mv64xxx: Apply errata delay only in standard mode
	KVM: lapic: stop advertising DIRECTED_EOI when in-kernel IOAPIC is in use
	perf top: Fix top.call-graph config option reading
	perf stat: Fix core dump when flag T is used
	IB/core: Honor port_num while resolving GID for IB link layer
	regulator: gpio: Fix some error handling paths in 'gpio_regulator_probe()'
	spi: bcm-qspi: fIX some error handling paths
	MIPS: ath79: Fix AR724X_PLL_REG_PCIE_CONFIG offset
	PCI: Restore config space on runtime resume despite being unbound
	ipmi_ssif: Fix kernel panic at msg_done_handler
	powerpc: Add missing prototype for arch_irq_work_raise()
	f2fs: fix to check extent cache in f2fs_drop_extent_tree
	perf/core: Fix perf_output_read_group()
	drm/panel: simple: Fix the bus format for the Ontat panel
	hwmon: (pmbus/max8688) Accept negative page register values
	hwmon: (pmbus/adm1275) Accept negative page register values
	perf/x86/intel: Properly save/restore the PMU state in the NMI handler
	cdrom: do not call check_disk_change() inside cdrom_open()
	perf/x86/intel: Fix large period handling on Broadwell CPUs
	perf/x86/intel: Fix event update for auto-reload
	arm64: dts: qcom: Fix SPI5 config on MSM8996
	soc: qcom: wcnss_ctrl: Fix increment in NV upload
	gfs2: Fix fallocate chunk size
	x86/devicetree: Initialize device tree before using it
	x86/devicetree: Fix device IRQ settings in DT
	ALSA: vmaster: Propagate slave error
	dmaengine: pl330: fix a race condition in case of threaded irqs
	dmaengine: rcar-dmac: Check the done lists in rcar_dmac_chan_get_residue()
	enic: enable rq before updating rq descriptors
	hwrng: stm32 - add reset during probe
	dmaengine: qcom: bam_dma: get num-channels and num-ees from dt
	net: stmmac: ensure that the device has released ownership before reading data
	net: stmmac: ensure that the MSS desc is the last desc to set the own bit
	cpufreq: Reorder cpufreq_online() error code path
	PCI: Add function 1 DMA alias quirk for Marvell 88SE9220
	udf: Provide saner default for invalid uid / gid
	ARM: dts: bcm283x: Fix probing of bcm2835-i2s
	audit: return on memory error to avoid null pointer dereference
	rcu: Call touch_nmi_watchdog() while printing stall warnings
	pinctrl: sh-pfc: r8a7796: Fix MOD_SEL register pin assignment for SSI pins group
	MIPS: Octeon: Fix logging messages with spurious periods after newlines
	drm/rockchip: Respect page offset for PRIME mmap calls
	x86/apic: Set up through-local-APIC mode on the boot CPU if 'noapic' specified
	perf tests: Use arch__compare_symbol_names to compare symbols
	perf report: Fix memory corruption in --branch-history mode --branch-history
	selftests/net: fixes psock_fanout eBPF test case
	netlabel: If PF_INET6, check sk_buff ip header version
	regmap: Correct comparison in regmap_cached
	ARM: dts: imx7d: cl-som-imx7: fix pinctrl_enet
	ARM: dts: porter: Fix HDMI output routing
	regulator: of: Add a missing 'of_node_put()' in an error handling path of 'of_regulator_match()'
	pinctrl: msm: Use dynamic GPIO numbering
	kdb: make "mdr" command repeat
	Linux 4.9.104

Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
2018-05-30 13:19:56 +02:00
Peter Malone
05b4268070 fbdev: Fixing arbitrary kernel leak in case FBIOGETCMAP_SPARC in sbusfb_ioctl_helper().
[ Upstream commit 250c6c49e3 ]

Fixing arbitrary kernel leak in case FBIOGETCMAP_SPARC in
sbusfb_ioctl_helper().

'index' is defined as an int in sbusfb_ioctl_helper().
We retrieve this from the user:
if (get_user(index, &c->index) ||
    __get_user(count, &c->count) ||
    __get_user(ured, &c->red) ||
    __get_user(ugreen, &c->green) ||
    __get_user(ublue, &c->blue))
       return -EFAULT;

and then we use 'index' in the following way:
red = cmap->red[index + i] >> 8;
green = cmap->green[index + i] >> 8;
blue = cmap->blue[index + i] >> 8;

This is a classic information leak vulnerability. 'index' should be
an unsigned int, given its usage above.

This patch is straight-forward; it changes 'index' to unsigned int
in two switch-cases: FBIOGETCMAP_SPARC && FBIOPUTCMAP_SPARC.

This patch fixes CVE-2018-6412.

Signed-off-by: Peter Malone <peter.malone@gmail.com>
Acked-by: Mathieu Malaterre <malat@debian.org>
Signed-off-by: Bartlomiej Zolnierkiewicz <b.zolnierkie@samsung.com>
Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2018-05-30 07:50:35 +02:00
Greg Kroah-Hartman
8683408f8e Merge 4.9.94 into android-4.9
Changes in 4.9.94
	qed: Fix overriding of supported autoneg value.
	cfg80211: make RATE_INFO_BW_20 the default
	md/raid5: make use of spin_lock_irq over local_irq_disable + spin_lock
	rtc: snvs: fix an incorrect check of return value
	x86/asm: Don't use RBP as a temporary register in csum_partial_copy_generic()
	x86/mm/kaslr: Use the _ASM_MUL macro for multiplication to work around Clang incompatibility
	ovl: persistent inode numbers for upper hardlinks
	NFSv4.1: RECLAIM_COMPLETE must handle NFS4ERR_CONN_NOT_BOUND_TO_SESSION
	x86/boot: Declare error() as noreturn
	IB/srpt: Fix abort handling
	IB/srpt: Avoid that aborting a command triggers a kernel warning
	af_key: Fix slab-out-of-bounds in pfkey_compile_policy.
	mac80211: bail out from prep_connection() if a reconfig is ongoing
	bna: Avoid reading past end of buffer
	qlge: Avoid reading past end of buffer
	ubi: fastmap: Fix slab corruption
	ipmi_ssif: unlock on allocation failure
	net: cdc_ncm: Fix TX zero padding
	net: ethernet: ti: cpsw: adjust cpsw fifos depth for fullduplex flow control
	lockd: fix lockd shutdown race
	drivers/misc/vmw_vmci/vmci_queue_pair.c: fix a couple integer overflow tests
	pidns: disable pid allocation if pid_ns_prepare_proc() is failed in alloc_pid()
	s390: move _text symbol to address higher than zero
	net/mlx4_en: Avoid adding steering rules with invalid ring
	qed: Correct doorbell configuration for !4Kb pages
	NFSv4.1: Work around a Linux server bug...
	CIFS: silence lockdep splat in cifs_relock_file()
	perf/callchain: Force USER_DS when invoking perf_callchain_user()
	blk-mq: NVMe 512B/4K+T10 DIF/DIX format returns I/O error on dd with split op
	net: qca_spi: Fix alignment issues in rx path
	netxen_nic: set rcode to the return status from the call to netxen_issue_cmd
	mdio: mux: Correct mdio_mux_init error path issues
	Input: elan_i2c - check if device is there before really probing
	Input: elantech - force relative mode on a certain module
	KVM: PPC: Book3S PR: Check copy_to/from_user return values
	irqchip/mbigen: Fix the clear register offset calculation
	vmxnet3: ensure that adapter is in proper state during force_close
	mm, vmstat: Remove spurious WARN() during zoneinfo print
	SMB2: Fix share type handling
	bus: brcmstb_gisb: Use register offsets with writes too
	bus: brcmstb_gisb: correct support for 64-bit address output
	PowerCap: Fix an error code in powercap_register_zone()
	iio: pressure: zpa2326: report interrupted case as failure
	ARM: dts: imx53-qsrb: Pulldown PMIC IRQ pin
	staging: wlan-ng: prism2mgmt.c: fixed a double endian conversion before calling hfa384x_drvr_setconfig16, also fixes relative sparse warning
	clk: renesas: rcar-gen2: Fix PLL0 on R-Car V2H and E2
	x86/tsc: Provide 'tsc=unstable' boot parameter
	powerpc/modules: If mprofile-kernel is enabled add it to vermagic
	ARM: dts: imx6qdl-wandboard: Fix audio channel swap
	i2c: mux: reg: put away the parent i2c adapter on probe failure
	arm64: perf: Ignore exclude_hv when kernel is running in HYP
	mdio: mux: fix device_node_continue.cocci warnings
	ipv6: avoid dad-failures for addresses with NODAD
	async_tx: Fix DMA_PREP_FENCE usage in do_async_gen_syndrome()
	KVM: arm: Restore banked registers and physical timer access on hyp_panic()
	KVM: arm64: Restore host physical timer access on hyp_panic()
	usb: dwc3: keystone: check return value
	btrfs: fix incorrect error return ret being passed to mapping_set_error
	ata: libahci: properly propagate return value of platform_get_irq()
	ipmr: vrf: Find VIFs using the actual device
	uio: fix incorrect memory leak cleanup
	neighbour: update neigh timestamps iff update is effective
	arp: honour gratuitous ARP _replies_
	ARM: dts: rockchip: fix rk322x i2s1 pinctrl error
	usb: chipidea: properly handle host or gadget initialization failure
	pxa_camera: fix module remove codepath for v4l2 clock
	USB: ene_usb6250: fix first command execution
	net: x25: fix one potential use-after-free issue
	USB: ene_usb6250: fix SCSI residue overwriting
	serial: 8250: omap: Disable DMA for console UART
	serial: sh-sci: Fix race condition causing garbage during shutdown
	net/wan/fsl_ucc_hdlc: fix unitialized variable warnings
	net/wan/fsl_ucc_hdlc: fix incorrect memory allocation
	fsl/qe: add bit description for SYNL register for GUMR
	sh_eth: Use platform device for printing before register_netdev()
	mlxsw: spectrum: Avoid possible NULL pointer dereference
	scsi: csiostor: fix use after free in csio_hw_use_fwconfig()
	powerpc/mm: Fix virt_addr_valid() etc. on 64-bit hash
	ath5k: fix memory leak on buf on failed eeprom read
	selftests/powerpc: Fix TM resched DSCR test with some compilers
	xfrm: fix state migration copy replay sequence numbers
	ASoC: simple-card: fix mic jack initialization
	iio: hi8435: avoid garbage event at first enable
	iio: hi8435: cleanup reset gpio
	iio: light: rpr0521 poweroff for probe fails
	ext4: handle the rest of ext4_mb_load_buddy() ENOMEM errors
	md-cluster: fix potential lock issue in add_new_disk
	ARM: davinci: da8xx: Create DSP device only when assigned memory
	ray_cs: Avoid reading past end of buffer
	net/wan/fsl_ucc_hdlc: fix muram allocation error
	leds: pca955x: Correct I2C Functionality
	perf/core: Fix error handling in perf_event_alloc()
	sched/numa: Use down_read_trylock() for the mmap_sem
	gpio: crystalcove: Do not write regular gpio registers for virtual GPIOs
	net/mlx5: Tolerate irq_set_affinity_hint() failures
	selinux: do not check open permission on sockets
	block: fix an error code in add_partition()
	mlx5: fix bug reading rss_hash_type from CQE
	net: ieee802154: fix net_device reference release too early
	libceph: NULL deref on crush_decode() error path
	perf report: Fix off-by-one for non-activation frames
	netfilter: ctnetlink: fix incorrect nf_ct_put during hash resize
	pNFS/flexfiles: missing error code in ff_layout_alloc_lseg()
	ASoC: rsnd: SSI PIO adjust to 24bit mode
	scsi: bnx2fc: fix race condition in bnx2fc_get_host_stats()
	fix race in drivers/char/random.c:get_reg()
	ext4: fix off-by-one on max nr_pages in ext4_find_unwritten_pgoff()
	ARM64: PCI: Fix struct acpi_pci_root_ops allocation failure path
	tcp: better validation of received ack sequences
	net: move somaxconn init from sysctl code
	Input: elan_i2c - clear INT before resetting controller
	bonding: Don't update slave->link until ready to commit
	cpuhotplug: Link lock stacks for hotplug callbacks
	PCI/msi: fix the pci_alloc_irq_vectors_affinity stub
	KVM: X86: Fix preempt the preemption timer cancel
	KVM: nVMX: Fix handling of lmsw instruction
	net: llc: add lock_sock in llc_ui_bind to avoid a race condition
	drm/msm: Take the mutex before calling msm_gem_new_impl
	i40iw: Fix sequence number for the first partial FPDU
	i40iw: Correct Q1/XF object count equation
	ARM: dts: ls1021a: add "fsl,ls1021a-esdhc" compatible string to esdhc node
	thermal: power_allocator: fix one race condition issue for thermal_instances list
	perf probe: Add warning message if there is unexpected event name
	l2tp: fix missing print session offset info
	rds; Reset rs->rs_bound_addr in rds_add_bound() failure path
	ACPI / video: Default lcd_only to true on Win8-ready and newer machines
	net/mlx4_en: Change default QoS settings
	VFS: close race between getcwd() and d_move()
	PM / devfreq: Fix potential NULL pointer dereference in governor_store
	hwmon: (ina2xx) Make calibration register value fixed
	media: videobuf2-core: don't go out of the buffer range
	ASoC: Intel: Skylake: Disable clock gating during firmware and library download
	ASoC: Intel: cht_bsw_rt5645: Analog Mic support
	scsi: libiscsi: Allow sd_shutdown on bad transport
	scsi: mpt3sas: Proper handling of set/clear of "ATA command pending" flag.
	irqchip/gic-v3: Fix the driver probe() fail due to disabled GICC entry
	ACPI: EC: Fix debugfs_create_*() usage
	mac80211: Fix setting TX power on monitor interfaces
	vfb: fix video mode and line_length being set when loaded
	gpio: label descriptors using the device name
	IB/rdmavt: Allocate CQ memory on the correct node
	blk-mq: fix race between updating nr_hw_queues and switching io sched
	backlight: tdo24m: Fix the SPI CS between transfers
	pinctrl: baytrail: Enable glitch filter for GPIOs used as interrupts
	ASoC: Intel: sst: Fix the return value of 'sst_send_byte_stream_mrfld()'
	rt2x00: do not pause queue unconditionally on error path
	wl1251: check return from call to wl1251_acx_arp_ip_filter
	hdlcdrv: Fix divide by zero in hdlcdrv_ioctl
	x86/efi: Disable runtime services on kexec kernel if booted with efi=old_map
	netfilter: conntrack: don't call iter for non-confirmed conntracks
	HID: i2c: Call acpi_device_fix_up_power for ACPI-enumerated devices
	ovl: filter trusted xattr for non-admin
	powerpc/[booke|4xx]: Don't clobber TCR[WP] when setting TCR[DIE]
	dmaengine: imx-sdma: Handle return value of clk_prepare_enable
	backlight: Report error on failure
	arm64: futex: Fix undefined behaviour with FUTEX_OP_OPARG_SHIFT usage
	net/mlx5: avoid build warning for uniprocessor
	cxgb4: FW upgrade fixes
	cxgb4: Fix netdev_features flag
	rtc: m41t80: fix SQW dividers override when setting a date
	i40evf: fix merge error in older patch
	rtc: opal: Handle disabled TPO in opal_get_tpo_time()
	rtc: interface: Validate alarm-time before handling rollover
	SUNRPC: ensure correct error is reported by xs_tcp_setup_socket()
	net: freescale: fix potential null pointer dereference
	clk: at91: fix clk-generated parenting
	drm/sun4i: Ignore the generic connectors for components
	dt-bindings: display: sun4i: Add allwinner,tcon-channel property
	mtd: nand: gpmi: Fix gpmi_nand_init() error path
	mtd: nand: check ecc->total sanity in nand_scan_tail
	KVM: SVM: do not zero out segment attributes if segment is unusable or not present
	clk: scpi: fix return type of __scpi_dvfs_round_rate
	clk: Fix __set_clk_rates error print-string
	powerpc/spufs: Fix coredump of SPU contexts
	drm/amdkfd: NULL dereference involving create_process()
	ath10k: add BMI parameters to fix calibration from DT/pre-cal
	perf trace: Add mmap alias for s390
	qlcnic: Fix a sleep-in-atomic bug in qlcnic_82xx_hw_write_wx_2M and qlcnic_82xx_hw_read_wx_2M
	arm64: kernel: restrict /dev/mem read() calls to linear region
	mISDN: Fix a sleep-in-atomic bug
	net: phy: micrel: Restore led_mode and clk_sel on resume
	RDMA/iw_cxgb4: Avoid touch after free error in ARP failure handlers
	RDMA/hfi1: fix array termination by appending NULL to attr array
	drm/omap: fix tiled buffer stride calculations
	powerpc/8xx: fix mpc8xx_get_irq() return on no irq
	cxgb4: fix incorrect cim_la output for T6
	Fix serial console on SNI RM400 machines
	bio-integrity: Do not allocate integrity context for bio w/o data
	ip6_tunnel: fix traffic class routing for tunnels
	skbuff: return -EMSGSIZE in skb_to_sgvec to prevent overflow
	macsec: check return value of skb_to_sgvec always
	sit: reload iphdr in ipip6_rcv
	net/mlx4: Fix the check in attaching steering rules
	net/mlx4: Check if Granular QoS per VF has been enabled before updating QP qos_vport
	perf header: Set proper module name when build-id event found
	perf report: Ensure the perf DSO mapping matches what libdw sees
	iwlwifi: mvm: fix firmware debug restart recording
	watchdog: f71808e_wdt: Add F71868 support
	iwlwifi: mvm: Fix command queue number on d0i3 flow
	iwlwifi: tt: move ucode_loaded check under mutex
	iwlwifi: pcie: only use d0i3 in suspend/resume if system_pm is set to d0i3
	iwlwifi: fix min API version for 7265D, 3168, 8000 and 8265
	tags: honor COMPILED_SOURCE with apart output directory
	ARM: dts: qcom: ipq4019: fix i2c_0 node
	e1000e: fix race condition around skb_tstamp_tx()
	igb: fix race condition with PTP_TX_IN_PROGRESS bits
	cxl: Unlock on error in probe
	cx25840: fix unchecked return values
	mceusb: sporadic RX truncation corruption fix
	net: phy: avoid genphy_aneg_done() for PHYs without clause 22 support
	ARM: imx: Add MXC_CPU_IMX6ULL and cpu_is_imx6ull
	nvme-pci: fix multiple ctrl removal scheduling
	nvme: fix hang in remove path
	KVM: nVMX: Update vmcs12->guest_linear_address on nested VM-exit
	e1000e: Undo e1000e_pm_freeze if __e1000_shutdown fails
	perf/core: Correct event creation with PERF_FORMAT_GROUP
	sched/deadline: Use the revised wakeup rule for suspending constrained dl tasks
	MIPS: mm: fixed mappings: correct initialisation
	MIPS: mm: adjust PKMAP location
	MIPS: kprobes: flush_insn_slot should flush only if probe initialised
	ARM: dts: armadillo800eva: Split LCD mux and gpio
	Fix loop device flush before configure v3
	net: emac: fix reset timeout with AR8035 phy
	perf tools: Decompress kernel module when reading DSO data
	perf tests: Decompress kernel module before objdump
	skbuff: only inherit relevant tx_flags
	xen: avoid type warning in xchg_xen_ulong
	X.509: Fix error code in x509_cert_parse()
	pinctrl: meson-gxbb: remove non-existing pin GPIOX_22
	coresight: Fix reference count for software sources
	coresight: tmc: Configure DMA mask appropriately
	stmmac: fix ptp header for GMAC3 hw timestamp
	geneve: add missing rx stats accounting
	crypto: omap-sham - buffer handling fixes for hashing later
	crypto: omap-sham - fix closing of hash with separate finalize call
	bnx2x: Allow vfs to disable txvlan offload
	sctp: fix recursive locking warning in sctp_do_peeloff
	net: fec: Add a fec_enet_clear_ethtool_stats() stub for CONFIG_M5272
	sparc64: ldc abort during vds iso boot
	iio: magnetometer: st_magn_spi: fix spi_device_id table
	net: ena: fix rare uncompleted admin command false alarm
	net: ena: fix race condition between submit and completion admin command
	net: ena: add missing return when ena_com_get_io_handlers() fails
	net: ena: add missing unmap bars on device removal
	net: ena: disable admin msix while working in polling mode
	clk: meson: meson8b: add compatibles for Meson8 and Meson8m2
	Bluetooth: Send HCI Set Event Mask Page 2 command only when needed
	cpuidle: dt: Add missing 'of_node_put()'
	ACPICA: OSL: Add support to exclude stdarg.h
	ACPICA: Events: Add runtime stub support for event APIs
	ACPICA: Disassembler: Abort on an invalid/unknown AML opcode
	s390/dasd: fix hanging safe offline
	vxlan: dont migrate permanent fdb entries during learn
	hsr: fix incorrect warning
	selftests: kselftest_harness: Fix compile warning
	drm/vc4: Fix resource leak in 'vc4_get_hang_state_ioctl()' in error handling path
	bcache: stop writeback thread after detaching
	bcache: segregate flash only volume write streams
	scsi: libsas: fix memory leak in sas_smp_get_phy_events()
	scsi: libsas: fix error when getting phy events
	scsi: libsas: initialize sas_phy status according to response of DISCOVER
	blk-mq: fix kernel oops in blk_mq_tag_idle()
	tty: n_gsm: Allow ADM response in addition to UA for control dlci
	EDAC, mv64x60: Fix an error handling path
	cxgb4vf: Fix SGE FL buffer initialization logic for 64K pages
	sdhci: Advertise 2.0v supply on SDIO host controller
	Input: goodix - disable IRQs while suspended
	mtd: mtd_oobtest: Handle bitflips during reads
	perf tools: Fix copyfile_offset update of output offset
	ipsec: check return value of skb_to_sgvec always
	rxrpc: check return value of skb_to_sgvec always
	virtio_net: check return value of skb_to_sgvec always
	virtio_net: check return value of skb_to_sgvec in one more location
	random: use lockless method of accessing and updating f->reg_idx
	clk: at91: fix clk-generated compilation
	arp: fix arp_filter on l3slave devices
	ipv6: the entire IPv6 header chain must fit the first fragment
	net: fix possible out-of-bound read in skb_network_protocol()
	net/ipv6: Fix route leaking between VRFs
	net/ipv6: Increment OUTxxx counters after netfilter hook
	netlink: make sure nladdr has correct size in netlink_connect()
	net/sched: fix NULL dereference in the error path of tcf_bpf_init()
	pptp: remove a buggy dst release in pptp_connect()
	r8169: fix setting driver_data after register_netdev
	sctp: do not leak kernel memory to user space
	sctp: sctp_sockaddr_af must check minimal addr length for AF_INET6
	sky2: Increase D3 delay to sky2 stops working after suspend
	vhost: correctly remove wait queue during poll failure
	vlan: also check phy_driver ts_info for vlan's real device
	bonding: fix the err path for dev hwaddr sync in bond_enslave
	bonding: move dev_mc_sync after master_upper_dev_link in bond_enslave
	bonding: process the err returned by dev_set_allmulti properly in bond_enslave
	net: fool proof dev_valid_name()
	ip_tunnel: better validate user provided tunnel names
	ipv6: sit: better validate user provided tunnel names
	ip6_gre: better validate user provided tunnel names
	ip6_tunnel: better validate user provided tunnel names
	vti6: better validate user provided tunnel names
	net/mlx5e: Sync netdev vxlan ports at open
	net/sched: fix NULL dereference in the error path of tunnel_key_init()
	net/sched: fix NULL dereference on the error path of tcf_skbmod_init()
	net/mlx4_en: Fix mixed PFC and Global pause user control requests
	vhost: validate log when IOTLB is enabled
	route: check sysctl_fib_multipath_use_neigh earlier than hash
	team: move dev_mc_sync after master_upper_dev_link in team_port_add
	vhost_net: add missing lock nesting notation
	net/mlx4_core: Fix memory leak while delete slave's resources
	strparser: Fix sign of err codes
	net sched actions: fix dumping which requires several messages to user space
	vrf: Fix use after free and double free in vrf_finish_output
	Revert "xhci: plat: Register shutdown for xhci_plat"
	Linux 4.9.94

Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
2018-04-14 15:40:56 +02:00
Pieter \"PoroCYon\" Sluys
2707d9b2f9 vfb: fix video mode and line_length being set when loaded
[ Upstream commit 7b9faf5df0 ]

Currently, when loading the vfb module, the newly created fbdev
has a line_length of 0, and its video mode would be PSEUDOCOLOR
regardless of color depth. (The former could be worked around by
calling the FBIOPUT_VSCREENINFO ioctl with having the FBACTIVIATE_FORCE
flag set.) This patch automatically sets the line_length correctly,
and the video mode is derived from the bit depth now as well.

Thanks to Geert Uytterhoeven for confirming the bug and helping me with
the patch.

Output of `fbset -i' before the patch:
mode "1366x768-60"
    # D: 72.432 MHz, H: 47.403 kHz, V: 60.004 Hz
    geometry 1366 768 1366 768 32
    timings 13806 120 10 14 3 32 5
    rgba 8/0,8/8,8/16,8/24
endmode

Frame buffer device information:
    Name        : Virtual FB
    Address     : 0xffffaa1405d85000
    Size        : 4196352
    Type        : PACKED PIXELS
    Visual      : PSEUDOCOLOR
    XPanStep    : 1
    YPanStep    : 1
    YWrapStep   : 1
    LineLength  : 0                    <-- note this
    Accelerator : No

After:
mode "1366x768-60"
    # D: 72.432 MHz, H: 47.403 kHz, V: 60.004 Hz
    geometry 1366 768 1366 768 32
    timings 13806 120 10 14 3 32 5
    rgba 8/0,8/8,8/16,8/24
endmode

Frame buffer device information:
    Name        : Virtual FB
    Address     : 0xffffaa1405d85000
    Size        : 4196352
    Type        : PACKED PIXELS
    Visual      : TRUECOLOR
    XPanStep    : 1
    YPanStep    : 1
    YWrapStep   : 1
    LineLength  : 5464
    Accelerator : No

Signed-off-by: "Pieter \"PoroCYon\" Sluys" <pcy@national.shitposting.agency>
Reviewed-by: Geert Uytterhoeven <geert@linux-m68k.org>
[b.zolnierkie: minor fixups]
Signed-off-by: Bartlomiej Zolnierkiewicz <b.zolnierkie@samsung.com>
Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2018-04-13 19:48:10 +02:00
Greg Kroah-Hartman
dd1e37e646 Merge 4.9.90 into android-4.9
Changes in 4.9.90
	tpm: fix potential buffer overruns caused by bit glitches on the bus
	ASoC: rsnd: check src mod pointer for rsnd_mod_id()
	SMB3: Validate negotiate request must always be signed
	CIFS: Enable encryption during session setup phase
	staging: android: ashmem: Fix possible deadlock in ashmem_ioctl
	Revert "led: core: Fix brightness setting when setting delay_off=0"
	led: core: Clear LED_BLINK_SW flag in led_blink_set()
	platform/x86: asus-nb-wmi: Add wapf4 quirk for the X302UA
	bonding: handle link transition from FAIL to UP correctly
	regulator: anatop: set default voltage selector for pcie
	power: supply: bq24190_charger: Limit over/under voltage fault logging
	x86: i8259: export legacy_pic symbol
	rtc: cmos: Do not assume irq 8 for rtc when there are no legacy irqs
	Input: ar1021_i2c - fix too long name in driver's device table
	time: Change posix clocks ops interfaces to use timespec64
	ACPI/processor: Fix error handling in __acpi_processor_start()
	ACPI/processor: Replace racy task affinity logic
	cpufreq/sh: Replace racy task affinity logic
	genirq: Use irqd_get_trigger_type to compare the trigger type for shared IRQs
	i2c: i2c-scmi: add a MS HID
	net: ipv6: send unsolicited NA on admin up
	media/dvb-core: Race condition when writing to CAM
	btrfs: fix a bogus warning when converting only data or metadata
	ASoC: Intel: Atom: update Thinkpad 10 quirk
	tools/testing/nvdimm: fix nfit_test shutdown crash
	spi: dw: Disable clock after unregistering the host
	powerpc/64s: Remove SAO feature from Power9 DD1
	ath: Fix updating radar flags for coutry code India
	clk: ns2: Correct SDIO bits
	iwlwifi: split the handler and the wake parts of the notification infra
	iwlwifi: a000: fix memory offsets and lengths
	scsi: virtio_scsi: Always try to read VPD pages
	KVM: PPC: Book3S PR: Exit KVM on failed mapping
	mwifiex: don't leak 'chan_stats' on reset
	x86/reboot: Turn off KVM when halting a CPU
	ARM: 8668/1: ftrace: Fix dynamic ftrace with DEBUG_RODATA and !FRAME_POINTER
	irqchip/mips-gic: Separate IPI reservation & usage tracking
	iommu/omap: Register driver before setting IOMMU ops
	md/raid10: wait up frozen array in handle_write_completed
	NFS: Fix missing pg_cleanup after nfs_pageio_cond_complete()
	tcp: remove poll() flakes with FastOpen
	e1000e: fix timing for 82579 Gigabit Ethernet controller
	ALSA: hda - Fix headset microphone detection for ASUS N551 and N751
	IB/ipoib: Fix deadlock between ipoib_stop and mcast join flow
	IB/ipoib: Update broadcast object if PKey value was changed in index 0
	HSI: ssi_protocol: double free in ssip_pn_xmit()
	IB/mlx4: Take write semaphore when changing the vma struct
	IB/mlx4: Change vma from shared to private
	IB/mlx5: Take write semaphore when changing the vma struct
	IB/mlx5: Change vma from shared to private
	IB/mlx5: Set correct SL in completion for RoCE
	ASoC: Intel: Skylake: Uninitialized variable in probe_codec()
	ibmvnic: Disable irq prior to close
	netvsc: Deal with rescinded channels correctly
	Fix driver usage of 128B WQEs when WQ_CREATE is V1.
	Fix Express lane queue creation.
	gpio: gpio-wcove: fix irq pending status bit width
	netfilter: xt_CT: fix refcnt leak on error path
	openvswitch: Delete conntrack entry clashing with an expectation.
	netfilter: nf_ct_helper: permit cthelpers with different names via nfnetlink
	mmc: host: omap_hsmmc: checking for NULL instead of IS_ERR()
	tipc: check return value of nlmsg_new
	wan: pc300too: abort path on failure
	qlcnic: fix unchecked return value
	netfilter: nft_dynset: continue to next expr if _OP_ADD succeeded
	platform/x86: intel-vbtn: add volume up and down
	scsi: mac_esp: Replace bogus memory barrier with spinlock
	infiniband/uverbs: Fix integer overflows
	pNFS: Fix use after free issues in pnfs_do_read()
	xprtrdma: Cancel refresh worker during buffer shutdown
	NFS: don't try to cross a mountpount when there isn't one there.
	iio: st_pressure: st_accel: Initialise sensor platform data properly
	mt7601u: check return value of alloc_skb
	libertas: check return value of alloc_workqueue
	rndis_wlan: add return value validation
	Btrfs: fix incorrect space accounting after failure to insert inline extent
	Btrfs: send, fix file hole not being preserved due to inline extent
	Btrfs: fix extent map leak during fallocate error path
	orangefs: do not wait for timeout if umounting
	mac80211: don't parse encrypted management frames in ieee80211_frame_acked
	ACPICA: iasl: Fix IORT SMMU GSI disassembling
	iio: hid-sensor: fix return of -EINVAL on invalid values in ret or value
	dt-bindings: mfd: axp20x: Add "xpowers,master-mode" property for AXP806 PMICs
	mfd: palmas: Reset the POWERHOLD mux during power off
	mtip32xx: use runtime tag to initialize command header
	x86/KASLR: Fix kexec kernel boot crash when KASLR randomization fails
	gpio: gpio-wcove: fix GPIO IRQ status mask
	staging: unisys: visorhba: fix s-Par to boot with option CONFIG_VMAP_STACK set to y
	staging: wilc1000: fix unchecked return value
	ipvs: explicitly forbid ipv6 service/dest creation if ipv6 mod is disabled
	mac80211: Fix possible sband related NULL pointer de-reference
	mmc: sdhci-of-esdhc: limit SD clock for ls1012a/ls1046a
	netfilter: x_tables: unlock on error in xt_find_table_lock()
	ARM: DRA7: clockdomain: Change the CLKTRCTRL of CM_PCIE_CLKSTCTRL to SW_WKUP
	IB/rdmavt: restore IRQs on error path in rvt_create_ah()
	IB/hfi1: Fix softlockup issue
	platform/x86: asus-wmi: try to set als by default
	ipmi/watchdog: fix wdog hang on panic waiting for ipmi response
	ACPI / PMIC: xpower: Fix power_table addresses
	drm/amdgpu: fix gpu reset crash
	drm/nouveau/kms: Increase max retries in scanout position queries.
	jbd2: Fix lockdep splat with generic/270 test
	ixgbevf: fix size of queue stats length
	net: ethernet: ucc_geth: fix MEM_PART_MURAM mode
	soc/fsl/qe: round brg_freq to 1kHz granularity
	Bluetooth: hci_ldisc: Add protocol check to hci_uart_dequeue()
	Bluetooth: hci_ldisc: Add protocol check to hci_uart_tx_wakeup()
	vxlan: correctly handle ipv6.disable module parameter
	qed: Unlock on error in qed_vf_pf_acquire()
	bnx2x: Align RX buffers
	power: supply: bq24190_charger: Add disable-reset device-property
	power: supply: isp1704: Fix unchecked return value of devm_kzalloc
	power: supply: pda_power: move from timer to delayed_work
	Input: twl4030-pwrbutton - use correct device for irq request
	IB/rxe: Don't clamp residual length to mtu
	md/raid10: skip spare disk as 'first' disk
	ACPI / power: Delay turning off unused power resources after suspend
	ia64: fix module loading for gcc-5.4
	tcm_fileio: Prevent information leak for short reads
	x86/xen: split xen_smp_prepare_boot_cpu()
	video: fbdev: udlfb: Fix buffer on stack
	sm501fb: don't return zero on failure path in sm501fb_start()
	pNFS: Fix a deadlock when coalescing writes and returning the layout
	net: hns: fix ethtool_get_strings overflow in hns driver
	cifs: small underflow in cnvrtDosUnixTm()
	mm: fix check for reclaimable pages in PF_MEMALLOC reclaim throttling
	mm, vmstat: suppress pcp stats for unpopulated zones in zoneinfo
	mm: hwpoison: call shake_page() after try_to_unmap() for mlocked page
	rtc: ds1374: wdt: Fix issue with timeout scaling from secs to wdt ticks
	rtc: ds1374: wdt: Fix stop/start ioctl always returning -EINVAL
	ath10k: fix out of bounds access to local buffer
	perf tests kmod-path: Don't fail if compressed modules aren't supported
	block/mq: Cure cpu hotplug lock inversion
	Bluetooth: hci_qca: Avoid setup failure on missing rampatch
	Bluetooth: btqcomsmd: Fix skb double free corruption
	media: c8sectpfe: fix potential NULL pointer dereference in c8sectpfe_timer_interrupt
	drm/msm: fix leak in failed get_pages
	RDMA/iwpm: Fix uninitialized error code in iwpm_send_mapinfo()
	rtlwifi: rtl_pci: Fix the bug when inactiveps is enabled.
	media: bt8xx: Fix err 'bt878_probe()'
	ath10k: handling qos at STA side based on AP WMM enable/disable
	media: [RESEND] media: dvb-frontends: Add delay to Si2168 restart
	qmi_wwan: set FLAG_SEND_ZLP to avoid network initiated disconnect
	serial: 8250_dw: Disable clock on error
	cros_ec: fix nul-termination for firmware build info
	watchdog: Fix potential kref imbalance when opening watchdog
	platform/chrome: Use proper protocol transfer function
	dmaengine: zynqmp_dma: Fix race condition in the probe
	drm/tilcdc: ensure nonatomic iowrite64 is not used
	mmc: avoid removing non-removable hosts during suspend
	IB/ipoib: Avoid memory leak if the SA returns a different DGID
	RDMA/cma: Use correct size when writing netlink stats
	IB/umem: Fix use of npages/nmap fields
	iser-target: avoid reinitializing rdma contexts for isert commands
	vgacon: Set VGA struct resource types
	omapdrm: panel: fix compatible vendor string for td028ttec1
	drm/omap: DMM: Check for DMM readiness after successful transaction commit
	pty: cancel pty slave port buf's work in tty_release
	coresight: Fix disabling of CoreSight TPIU
	pinctrl: Really force states during suspend/resume
	pinctrl: rockchip: enable clock when reading pin direction register
	iommu/vt-d: clean up pr_irq if request_threaded_irq fails
	ip6_vti: adjust vti mtu according to mtu of lower device
	RDMA/ocrdma: Fix permissions for OCRDMA_RESET_STATS
	ARM: dts: aspeed-evb: Add unit name to memory node
	nfsd4: permit layoutget of executable-only files
	clk: Don't touch hardware when reparenting during registration
	clk: axi-clkgen: Correctly handle nocount bit in recalc_rate()
	clk: si5351: Rename internal plls to avoid name collisions
	dmaengine: ti-dma-crossbar: Fix event mapping for TPCC_EVT_MUX_60_63
	IB/mlx5: Fix integer overflows in mlx5_ib_create_srq
	IB/mlx5: Fix out-of-bounds read in create_raw_packet_qp_rq
	clk: migrate the count of orphaned clocks at init
	RDMA/ucma: Fix access to non-initialized CM_ID object
	RDMA/ucma: Don't allow join attempts for unsupported AF family
	usb: gadget: f_hid: fix: Move IN request allocation to set_alt()
	Linux 4.9.90

Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
2018-03-25 10:55:44 +02:00
H. Nikolaus Schaller
4ae338d139 omapdrm: panel: fix compatible vendor string for td028ttec1
[ Upstream commit c1b9d4c75c ]

The vendor name was "toppoly" but other panels and the vendor list
have defined it as "tpo". So let's fix it in driver and bindings.

We keep the old definition in parallel to stay compatible with
potential older DTB setup.

Signed-off-by: H. Nikolaus Schaller <hns@goldelico.com>
Signed-off-by: Tomi Valkeinen <tomi.valkeinen@ti.com>
Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2018-03-24 11:00:25 +01:00
Alexey Khoroshilov
e22a6754ab sm501fb: don't return zero on failure path in sm501fb_start()
[ Upstream commit dc85e9a874 ]

If fbmem iomemory mapping failed, sm501fb_start() breaks off
initialization, deallocates resources, but returns zero.
As a result, double deallocation can happen in sm501fb_stop().

Found by Linux Driver Verification project (linuxtesting.org).

Signed-off-by: Alexey Khoroshilov <khoroshilov@ispras.ru>
Cc: Tomi Valkeinen <tomi.valkeinen@ti.com>
Signed-off-by: Bartlomiej Zolnierkiewicz <b.zolnierkie@samsung.com>
Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2018-03-24 11:00:21 +01:00
Maksim Salau
e5ea3b0408 video: fbdev: udlfb: Fix buffer on stack
[ Upstream commit 45f580c42e ]

Allocate buffers on HEAP instead of STACK for local array
that is to be sent using usb_control_msg().

Signed-off-by: Maksim Salau <maksim.salau@gmail.com>
Cc: Bernie Thompson <bernie@plugable.com>
Cc: Geert Uytterhoeven <geert@linux-m68k.org>
Signed-off-by: Bartlomiej Zolnierkiewicz <b.zolnierkie@samsung.com>
Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2018-03-24 11:00:21 +01:00
Greg Kroah-Hartman
960923fdc2 Merge 4.9.89 into android-4.9
Changes in 4.9.89
	blkcg: fix double free of new_blkg in blkcg_init_queue
	Input: tsc2007 - check for presence and power down tsc2007 during probe
	perf stat: Issue a HW watchdog disable hint
	staging: speakup: Replace BUG_ON() with WARN_ON().
	staging: wilc1000: add check for kmalloc allocation failure.
	HID: reject input outside logical range only if null state is set
	drm: qxl: Don't alloc fbdev if emulation is not supported
	ARM: dts: r8a7791: Remove unit-address and reg from integrated cache
	ARM: dts: r8a7792: Remove unit-address and reg from integrated cache
	ARM: dts: r8a7793: Remove unit-address and reg from integrated cache
	ARM: dts: r8a7794: Remove unit-address and reg from integrated cache
	arm64: dts: r8a7796: Remove unit-address and reg from integrated cache
	drm/sun4i: Fix up error path cleanup for master bind function
	drm/sun4i: Set drm_crtc.port to the underlying TCON's output port node
	ath10k: fix a warning during channel switch with multiple vaps
	drm/sun4i: Fix TCON clock and regmap initialization sequence
	PCI/MSI: Stop disabling MSI/MSI-X in pci_device_shutdown()
	selinux: check for address length in selinux_socket_bind()
	x86/mm: Make mmap(MAP_32BIT) work correctly
	perf sort: Fix segfault with basic block 'cycles' sort dimension
	x86/mce: Handle broadcasted MCE gracefully with kexec
	eventpoll.h: fix epoll event masks
	i40e: Acquire NVM lock before reads on all devices
	i40e: fix ethtool to get EEPROM data from X722 interface
	perf tools: Make perf_event__synthesize_mmap_events() scale
	ARM: brcmstb: Enable ZONE_DMA for non 64-bit capable peripherals
	drivers: net: xgene: Fix hardware checksum setting
	drivers: net: phy: xgene: Fix mdio write
	drivers: net: xgene: Fix wrong logical operation
	drivers: net: xgene: Fix Rx checksum validation logic
	drm: Defer disabling the vblank IRQ until the next interrupt (for instant-off)
	ath10k: disallow DFS simulation if DFS channel is not enabled
	ath10k: fix fetching channel during potential radar detection
	usb: misc: lvs: fix race condition in disconnect handling
	ARM: bcm2835: Enable missing CMA settings for VC4 driver
	net: ethernet: bgmac: Allow MAC address to be specified in DTB
	netem: apply correct delay when rate throttling
	x86/mce: Init some CPU features early
	omapfb: dss: Handle return errors in dss_init_ports()
	perf probe: Fix concat_probe_trace_events
	perf probe: Return errno when not hitting any event
	HID: clamp input to logical range if no null state
	net/8021q: create device with all possible features in wanted_features
	ARM: dts: Adjust moxart IRQ controller and flags
	qed: Always publish VF link from leading hwfn
	s390/topology: fix typo in early topology code
	zd1211rw: fix NULL-deref at probe
	batman-adv: handle race condition for claims between gateways
	of: fix of_device_get_modalias returned length when truncating buffers
	solo6x10: release vb2 buffers in solo_stop_streaming()
	x86/boot/32: Defer resyncing initial_page_table until per-cpu is set up
	scsi: fnic: Fix for "Number of Active IOs" in fnicstats becoming negative
	scsi: ipr: Fix missed EH wakeup
	media: i2c/soc_camera: fix ov6650 sensor getting wrong clock
	timers, sched_clock: Update timeout for clock wrap
	sysrq: Reset the watchdog timers while displaying high-resolution timers
	Input: qt1070 - add OF device ID table
	sched: act_csum: don't mangle TCP and UDP GSO packets
	PCI: hv: Properly handle PCI bus remove
	PCI: hv: Lock PCI bus on device eject
	ASoC: rcar: ssi: don't set SSICR.CKDV = 000 with SSIWSR.CONT
	spi: omap2-mcspi: poll OMAP2_MCSPI_CHSTAT_RXS for PIO transfer
	tcp: sysctl: Fix a race to avoid unexpected 0 window from space
	dmaengine: imx-sdma: add 1ms delay to ensure SDMA channel is stopped
	usb: dwc3: make sure UX_EXIT_PX is cleared
	ARM: dts: bcm2835: add index to the ethernet alias
	perf annotate: Fix a bug following symbolic link of a build-id file
	perf buildid: Do not assume that readlink() returns a null terminated string
	i40e/i40evf: Fix use after free in Rx cleanup path
	scsi: be2iscsi: Check tag in beiscsi_mccq_compl_wait
	driver: (adm1275) set the m,b and R coefficients correctly for power
	bonding: make speed, duplex setting consistent with link state
	mm: Fix false-positive VM_BUG_ON() in page_cache_{get,add}_speculative()
	ALSA: firewire-lib: add a quirk of packet without valid EOH in CIP format
	ARM: dts: r8a7794: Add DU1 clock to device tree
	ARM: dts: r8a7794: Correct clock of DU1
	ARM: dts: silk: Correct clock of DU1
	blk-throttle: make sure expire time isn't too big
	regulator: core: Limit propagation of parent voltage count and list
	perf trace: Handle unpaired raw_syscalls:sys_exit event
	f2fs: relax node version check for victim data in gc
	drm/ttm: never add BO that failed to validate to the LRU list
	bonding: refine bond_fold_stats() wrap detection
	PCI: Apply Cavium ACS quirk only to CN81xx/CN83xx/CN88xx devices
	powerpc/mm/hugetlb: Filter out hugepage size not supported by page table layout
	braille-console: Fix value returned by _braille_console_setup
	drm/vmwgfx: Fixes to vmwgfx_fb
	vxlan: vxlan dev should inherit lowerdev's gso_max_size
	NFC: nfcmrvl: Include unaligned.h instead of access_ok.h
	NFC: nfcmrvl: double free on error path
	NFC: pn533: change order of free_irq and dev unregistration
	ARM: dts: r7s72100: fix ethernet clock parent
	ARM: dts: r8a7790: Correct parent of SSI[0-9] clocks
	ARM: dts: r8a7791: Correct parent of SSI[0-9] clocks
	ARM: dts: r8a7793: Correct parent of SSI[0-9] clocks
	powerpc: Avoid taking a data miss on every userspace instruction miss
	net: hns: Correct HNS RSS key set function
	net/faraday: Add missing include of of.h
	qed: Fix TM block ILT allocation
	rtmutex: Fix PI chain order integrity
	printk: Correctly handle preemption in console_unlock()
	drm: rcar-du: Handle event when disabling CRTCs
	ARM: dts: koelsch: Correct clock frequency of X2 DU clock input
	reiserfs: Make cancel_old_flush() reliable
	ASoC: rt5677: Add OF device ID table
	IB/hfi1: Check for QSFP presence before attempting reads
	ALSA: firewire-digi00x: add support for console models of Digi00x series
	ALSA: firewire-digi00x: handle all MIDI messages on streaming packets
	fm10k: correctly check if interface is removed
	EDAC, altera: Fix peripheral warnings for Cyclone5
	scsi: ses: don't get power status of SES device slot on probe
	qed: Correct MSI-x for storage
	apparmor: Make path_max parameter readonly
	iommu/iova: Fix underflow bug in __alloc_and_insert_iova_range
	kvm/svm: Setup MCG_CAP on AMD properly
	kvm: nVMX: Disallow userspace-injected exceptions in guest mode
	video: ARM CLCD: fix dma allocation size
	drm/radeon: Fail fb creation from imported dma-bufs.
	drm/amdgpu: Fail fb creation from imported dma-bufs. (v2)
	drm/rockchip: vop: Enable pm domain before vop_initial
	i40e: only register client on iWarp-capable devices
	coresight: Fixes coresight DT parse to get correct output port ID.
	lkdtm: turn off kcov for lkdtm_rodata_do_nothing:
	tty: amba-pl011: Fix spurious TX interrupts
	serial: imx: setup DCEDTE early and ensure DCD and RI irqs to be off
	MIPS: BPF: Quit clobbering callee saved registers in JIT code.
	MIPS: BPF: Fix multiple problems in JIT skb access helpers.
	MIPS: r2-on-r6-emu: Fix BLEZL and BGTZL identification
	MIPS: r2-on-r6-emu: Clear BLTZALL and BGEZALL debugfs counters
	v4l: vsp1: Prevent multiple streamon race commencing pipeline early
	v4l: vsp1: Register pipe with output WPF
	regulator: isl9305: fix array size
	md/raid6: Fix anomily when recovering a single device in RAID6.
	md.c:didn't unlock the mddev before return EINVAL in array_size_store
	powerpc/nohash: Fix use of mmu_has_feature() in setup_initial_memory_limit()
	usb: dwc2: Make sure we disconnect the gadget state
	usb: gadget: dummy_hcd: Fix wrong power status bit clear/reset in dummy_hub_control()
	perf evsel: Return exact sub event which failed with EPERM for wildcards
	iwlwifi: mvm: fix RX SKB header size and align it properly
	drivers/perf: arm_pmu: handle no platform_device
	perf inject: Copy events when reordering events in pipe mode
	net: fec: add phy-reset-gpios PROBE_DEFER check
	perf session: Don't rely on evlist in pipe mode
	vfio/powerpc/spapr_tce: Enforce IOMMU type compatibility check
	vfio/spapr_tce: Check kzalloc() return when preregistering memory
	scsi: sg: check for valid direction before starting the request
	scsi: sg: close race condition in sg_remove_sfp_usercontext()
	ALSA: hda: Add Geminilake id to SKL_PLUS
	kprobes/x86: Fix kprobe-booster not to boost far call instructions
	kprobes/x86: Set kprobes pages read-only
	pwm: tegra: Increase precision in PWM rate calculation
	clk: qcom: msm8996: Fix the vfe1 powerdomain name
	Bluetooth: Avoid bt_accept_unlink() double unlinking
	Bluetooth: 6lowpan: fix delay work init in add_peer_chan()
	mac80211_hwsim: use per-interface power level
	ath10k: fix compile time sanity check for CE4 buffer size
	wil6210: fix protection against connections during reset
	wil6210: fix memory access violation in wil_memcpy_from/toio_32
	perf stat: Fix bug in handling events in error state
	mwifiex: Fix invalid port issue
	drm/edid: set ELD connector type in drm_edid_to_eld()
	video/hdmi: Allow "empty" HDMI infoframes
	HID: elo: clear BTN_LEFT mapping
	iwlwifi: mvm: rs: don't override the rate history in the search cycle
	clk: meson: gxbb: fix wrong clock for SARADC/SANA
	ARM: dts: exynos: Correct Trats2 panel reset line
	sched: Stop switched_to_rt() from sending IPIs to offline CPUs
	sched: Stop resched_cpu() from sending IPIs to offline CPUs
	test_firmware: fix setting old custom fw path back on exit
	net: ieee802154: adf7242: Fix bug if defined DEBUG
	net: xfrm: allow clearing socket xfrm policies.
	mtd: nand: fix interpretation of NAND_CMD_NONE in nand_command[_lp]()
	net: thunderx: Set max queue count taking XDP_TX into account
	ARM: dts: am335x-pepper: Fix the audio CODEC's reset pin
	ARM: dts: omap3-n900: Fix the audio CODEC's reset pin
	mtd: nand: ifc: update bufnum mask for ver >= 2.0.0
	userns: Don't fail follow_automount based on s_user_ns
	leds: pm8058: Silence pointer to integer size warning
	power: supply: ab8500_charger: Fix an error handling path
	power: supply: ab8500_charger: Bail out in case of error in 'ab8500_charger_init_hw_registers()'
	ath10k: update tdls teardown state to target
	scsi: ses: don't ask for diagnostic pages repeatedly during probe
	pwm: stmpe: Fix wrong register offset for hwpwm=2 case
	clk: qcom: msm8916: fix mnd_width for codec_digcodec
	mwifiex: cfg80211: do not change virtual interface during scan processing
	ath10k: fix invalid STS_CAP_OFFSET_MASK
	tools/usbip: fixes build with musl libc toolchain
	spi: sun6i: disable/unprepare clocks on remove
	bnxt_en: Don't print "Link speed -1 no longer supported" messages.
	scsi: core: scsi_get_device_flags_keyed(): Always return device flags
	scsi: devinfo: apply to HP XP the same flags as Hitachi VSP
	scsi: dh: add new rdac devices
	media: vsp1: Prevent suspending and resuming DRM pipelines
	media: cpia2: Fix a couple off by one bugs
	veth: set peer GSO values
	drm/amdkfd: Fix memory leaks in kfd topology
	powerpc/modules: Don't try to restore r2 after a sibling call
	agp/intel: Flush all chipset writes after updating the GGTT
	mac80211_hwsim: enforce PS_MANUAL_POLL to be set after PS_ENABLED
	mac80211: remove BUG() when interface type is invalid
	ASoC: nuc900: Fix a loop timeout test
	ipvlan: add L2 check for packets arriving via virtual devices
	rcutorture/configinit: Fix build directory error message
	locking/locktorture: Fix num reader/writer corner cases
	ima: relax requiring a file signature for new files with zero length
	net: hns: Some checkpatch.pl script & warning fixes
	x86/boot/32: Fix UP boot on Quark and possibly other platforms
	x86/cpufeatures: Add Intel PCONFIG cpufeature
	selftests/x86/entry_from_vm86: Exit with 1 if we fail
	selftests/x86: Add tests for User-Mode Instruction Prevention
	selftests/x86: Add tests for the STR and SLDT instructions
	selftests/x86/entry_from_vm86: Add test cases for POPF
	x86/vm86/32: Fix POPF emulation
	x86/speculation, objtool: Annotate indirect calls/jumps for objtool on 32-bit kernels
	x86/speculation: Remove Skylake C2 from Speculation Control microcode blacklist
	x86/mm: Fix vmalloc_fault to use pXd_large
	parisc: Handle case where flush_cache_range is called with no context
	ALSA: pcm: Fix UAF in snd_pcm_oss_get_formats()
	ALSA: hda - Revert power_save option default value
	ALSA: seq: Fix possible UAF in snd_seq_check_queue()
	ALSA: seq: Clear client entry before deleting else at closing
	drm/amdgpu: fix prime teardown order
	drm/amdgpu/dce: Don't turn off DP sink when disconnected
	fs: Teach path_connected to handle nfs filesystems with multiple roots.
	lock_parent() needs to recheck if dentry got __dentry_kill'ed under it
	fs/aio: Add explicit RCU grace period when freeing kioctx
	fs/aio: Use RCU accessors for kioctx_table->table[]
	irqchip/gic-v3-its: Ensure nr_ites >= nr_lpis
	scsi: sg: fix SG_DXFER_FROM_DEV transfers
	scsi: sg: fix static checker warning in sg_is_valid_dxfer
	scsi: sg: only check for dxfer_len greater than 256M
	btrfs: alloc_chunk: fix DUP stripe size handling
	btrfs: Fix use-after-free when cleaning up fs_devs with a single stale device
	scsi: qla2xxx: Fix extraneous ref on sp's after adapter break
	USB: gadget: udc: Add missing platform_device_put() on error in bdc_pci_probe()
	usb: dwc3: Fix GDBGFIFOSPACE_TYPE values
	usb: gadget: bdc: 64-bit pointer capability check
	Linux 4.9.89

Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
2018-03-22 09:54:47 +01:00
Liam Beguin
b8c231ebce video: ARM CLCD: fix dma allocation size
[ Upstream commit 9a1c779e6b ]

This patch forces the frambuffer size to be aligned on kernel pages.

During the board startup, the splash screed did appear;
the "ts_test" program or our application were not able to start.

The following error message was reported:
error: failed to map framebuffer device to memory.
LinuxFB: driver cannot connect

The issue was discovered, on the LPC32xx platform, during the migration
of the LCD definition from the board file to the device tree.

Signed-off-by: Liam Beguin <lbeguin@tycoint.com>
Signed-off-by: Sylvain Lemieux <slemieux@tycoint.com>
Cc: Vladimir Zapolskiy <vz@mleia.com>
Cc: Russell King <linux@armlinux.org.uk>
Signed-off-by: Bartlomiej Zolnierkiewicz <b.zolnierkie@samsung.com>
Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2018-03-22 09:17:48 +01:00
Arvind Yadav
a124c8751f omapfb: dss: Handle return errors in dss_init_ports()
[ Upstream commit 0348aaa344 ]

dss_init_ports() is not handling return errors from dpi_init_port() and
sdi_init_port(). It is also always returning 0 currently which results in
part of error handling code in dss_bind() being unused.

Fix dss_init_ports() to handle return errors from dpi_init_port() and
sdi_init_port().

Signed-off-by: Arvind Yadav <arvind.yadav.cs@gmail.com>
Cc: tomi.valkeinen@ti.com
[b.zolnierkie: fail early on errors, minor fixups]
Signed-off-by: Bartlomiej Zolnierkiewicz <b.zolnierkie@samsung.com>
Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2018-03-22 09:17:40 +01:00
Greg Kroah-Hartman
a9d027374a Merge 4.9.84 into android-4.9
Changes in 4.9.84
	vhost: use mutex_lock_nested() in vhost_dev_lock_vqs()
	kcm: Check if sk_user_data already set in kcm_attach
	kcm: Only allow TCP sockets to be attached to a KCM mux
	cfg80211: check dev_set_name() return value
	xfrm: skip policies marked as dead while rehashing
	mm,vmscan: Make unregister_shrinker() no-op if register_shrinker() failed.
	xfrm: Fix stack-out-of-bounds read on socket policy lookup.
	xfrm: check id proto in validate_tmpl()
	sctp: set frag_point in sctp_setsockopt_maxseg correctly
	blktrace: fix unlocked registration of tracepoints
	drm: Require __GFP_NOFAIL for the legacy drm_modeset_lock_all
	ptr_ring: fail early if queue occupies more than KMALLOC_MAX_SIZE
	Provide a function to create a NUL-terminated string from unterminated data
	selinux: ensure the context is NUL terminated in security_context_to_sid_core()
	selinux: skip bounded transition processing if the policy isn't loaded
	crypto: x86/twofish-3way - Fix %rbp usage
	staging: android: ion: Add __GFP_NOWARN for system contig heap
	staging: android: ion: Switch from WARN to pr_warn
	blk_rq_map_user_iov: fix error override
	KVM: x86: fix escape of guest dr6 to the host
	kcov: detect double association with a single task
	netfilter: x_tables: fix int overflow in xt_alloc_table_info()
	netfilter: x_tables: avoid out-of-bounds reads in xt_request_find_{match|target}
	netfilter: ipt_CLUSTERIP: fix out-of-bounds accesses in clusterip_tg_check()
	netfilter: on sockopt() acquire sock lock only in the required scope
	netfilter: xt_cgroup: initialize info->priv in cgroup_mt_check_v1()
	netfilter: xt_RATEEST: acquire xt_rateest_mutex for hash insert
	rds: tcp: atomically purge entries from rds_tcp_conn_list during netns delete
	net: avoid skb_warn_bad_offload on IS_ERR
	crypto: hash - annotate algorithms taking optional key
	crypto: hash - prevent using keyed hashes without setting key
	ASoC: ux500: add MODULE_LICENSE tag
	video: fbdev/mmp: add MODULE_LICENSE
	ARM: 8743/1: bL_switcher: add MODULE_LICENSE tag
	arm64: dts: add #cooling-cells to CPU nodes
	dn_getsockoptdecnet: move nf_{get/set}sockopt outside sock lock
	staging: android: ashmem: Fix a race condition in pin ioctls
	binder: check for binder_thread allocation failure in binder_poll()
	staging: iio: adc: ad7192: fix external frequency setting
	staging: iio: ad5933: switch buffer mode to software
	usbip: keep usbip_device sockfd state in sync with tcp_socket
	usb: build drivers/usb/common/ when USB_SUPPORT is set
	ARM: OMAP2+: Fix SRAM virt to phys translation for save_secure_ram_context
	ARM: AM33xx: PRM: Remove am33xx_pwrdm_read_prev_pwrst function
	ARM: dts: Fix omap4 hang with GPS connected to USB by using wakeupgen
	ARM: dts: logicpd-som-lv: Fix gpmc addresses for NAND and enet
	ARM: dts: logicpd-somlv: Fix wl127x pinmux
	ARM: dts: am4372: Correct the interrupts_properties of McASP
	ARM: dts: am437x-cm-t43: Correct the dmas property of spi0
	perf top: Fix window dimensions change handling
	perf bench numa: Fixup discontiguous/sparse numa nodes
	media: s5k6aa: describe some function parameters
	pinctrl: sunxi: Fix A80 interrupt pin bank
	pinctrl: sunxi: Fix A64 UART mux value
	i40iw: Correct ARP index mask
	RDMA/cma: Make sure that PSN is not over max allowed
	sctp: only update outstanding_bytes for transmitted queue when doing prsctp_prune
	scripts/kernel-doc: Don't fail with status != 0 if error encountered with -none
	ipvlan: Add the skb->mark as flow4's member to lookup route
	m68k: add missing SOFTIRQENTRY_TEXT linker section
	powerpc/perf: Fix oops when grouping different pmu events
	s390/dasd: prevent prefix I/O error
	ARM: dts: Fix elm interrupt compiler warning
	gianfar: fix a flooded alignment reports because of padding issue.
	net_sched: red: Avoid devision by zero
	net_sched: red: Avoid illegal values
	btrfs: Fix possible off-by-one in btrfs_search_path_in_tree
	brcmfmac: Avoid build error with make W=1
	net: ethernet: arc: fix error handling in emac_rockchip_probe
	509: fix printing uninitialized stack memory when OID is empty
	gianfar: Disable EEE autoneg by default
	dmaengine: ioat: Fix error handling path
	dmaengine: at_hdmac: fix potential NULL pointer dereference in atc_prep_dma_interleaved
	clk: fix a panic error caused by accessing NULL pointer
	ASoC: rockchip: disable clock on error
	spi: sun4i: disable clocks in the remove function
	xfrm: Fix stack-out-of-bounds with misconfigured transport mode policies.
	drm/armada: fix leak of crtc structure
	dmaengine: jz4740: disable/unprepare clk if probe fails
	usb: dwc3: gadget: Wait longer for controller to end command processing
	usb: dwc3: of-simple: fix missing clk_disable_unprepare
	mm/early_ioremap: Fix boot hang with earlyprintk=efi,keep
	x86/mm/kmmio: Fix mmiotrace for page unaligned addresses
	platform/x86: dell-laptop: Fix keyboard max lighting for Dell Latitude E6410
	xen: XEN_ACPI_PROCESSOR is Dom0-only
	hippi: Fix a Fix a possible sleep-in-atomic bug in rr_close
	powerpc/64s: Fix conversion of slb_miss_common to use RFI_TO_USER/KERNEL
	powerpc/64s: Simple RFI macro conversions
	powerpc/64s: Improve RFI L1-D cache flush fallback
	crypto: talitos - fix Kernel Oops on hashing an empty file
	drm/i915: fix intel_backlight_device_register declaration
	shmem: avoid maybe-uninitialized warning
	clk: sunxi-ng: fix build error without CONFIG_RESET_CONTROLLER
	vmxnet3: prevent building with 64K pages
	perf/x86: Shut up false-positive -Wmaybe-uninitialized warning
	PCI: vmd: Fix suspend handlers defined-but-not-used warning
	gpio: intel-mid: Fix build warning when !CONFIG_PM
	platform/x86: intel_mid_thermal: Fix suspend handlers unused warning
	usb: musb: fix compilation warning on unused function
	PCI: Change pci_host_common_probe() visibility
	perf: xgene: Include module.h
	video: fbdev: via: remove possibly unused variables
	scsi: advansys: fix build warning for PCI=n
	x86/ras/inject: Make it depend on X86_LOCAL_APIC=y
	gpio: xgene: mark PM functions as __maybe_unused
	arm64: define BUG() instruction without CONFIG_BUG
	x86/fpu/math-emu: Fix possible uninitialized variable use
	tools build: Add tools tree support for 'make -s'
	x86/build: Silence the build with "make -s"
	thermal: fix INTEL_SOC_DTS_IOSF_CORE dependencies
	x86: add MULTIUSER dependency for KVM
	dmaengine: zx: fix build warning
	x86/platform: Add PCI dependency for PUNIT_ATOM_DEBUG
	x86/vm86: Fix unused variable warning if THP is disabled
	scsi: advansys: fix uninitialized data access
	arm64: Kconfig: select COMPAT_BINFMT_ELF only when BINFMT_ELF is set
	ALSA: hda/ca0132 - fix possible NULL pointer use
	reiserfs: avoid a -Wmaybe-uninitialized warning
	cw1200: fix bogus maybe-uninitialized warning
	security/keys: BIG_KEY requires CONFIG_CRYPTO
	drm: exynos: mark pm functions as __maybe_unused
	rbd: silence bogus -Wmaybe-uninitialized warning
	drm/nouveau: hide gcc-4.9 -Wmaybe-uninitialized
	Input: tca8418_keypad - hide gcc-4.9 -Wmaybe-uninitialized warning
	KVM: add X86_LOCAL_APIC dependency
	shmem: fix compilation warnings on unused functions
	tc358743: fix register i2c_rd/wr functions
	go7007: add MEDIA_CAMERA_SUPPORT dependency
	em28xx: only use mt9v011 if camera support is enabled
	tw5864: use dev_warn instead of WARN to shut up warning
	ISDN: eicon: reduce stack size of sig_ind function
	clk: meson: gxbb: fix build error without RESET_CONTROLLER
	kasan: rework Kconfig settings
	drm/i915: hide unused intel_panel_set_backlight function
	arm64: sunxi: always enable reset controller
	binfmt_elf: compat: avoid unused function warning
	spi: bcm-qspi: shut up warning about cfi header inclusion
	idle: i7300: add PCI dependency
	arm64: fix warning about swapper_pg_dir overflow
	usb: phy: msm add regulator dependency
	x86/microcode/AMD: Change load_microcode_amd()'s param to bool to fix preemptibility bug
	KVM: async_pf: Fix #DF due to inject "Page not Present" and "Page Ready" exceptions simultaneously
	KVM: VMX: clean up declaration of VPID/EPT invalidation types
	KVM: nVMX: invvpid handling improvements
	crypto: s5p-sss - Fix kernel Oops in AES-ECB mode
	Linux 4.9.84

Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
2018-02-26 09:18:03 +01:00
Arnd Bergmann
6d07cb5cc3 video: fbdev: via: remove possibly unused variables
commit 484c7bbf26 upstream.

When CONFIG_PROC_FS is disabled, we get warnings about unused variables
as remove_proc_entry() evaluates to an empty macro.

drivers/video/fbdev/via/viafbdev.c: In function 'viafb_remove_proc':
drivers/video/fbdev/via/viafbdev.c:1635:4: error: unused variable 'iga2_entry' [-Werror=unused-variable]
drivers/video/fbdev/via/viafbdev.c:1634:4: error: unused variable 'iga1_entry' [-Werror=unused-variable]

These are easy to avoid by using the pointer from the structure.

Signed-off-by: Arnd Bergmann <arnd@arndb.de>
Cc: Florian Tobias Schandinat <FlorianSchandinat@gmx.de>
Signed-off-by: Bartlomiej Zolnierkiewicz <b.zolnierkie@samsung.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2018-02-25 11:05:51 +01:00
Arnd Bergmann
fc42856098 video: fbdev/mmp: add MODULE_LICENSE
commit c1530ac5a3 upstream.

Kbuild complains about the lack of a license tag in this driver:

WARNING: modpost: missing MODULE_LICENSE() in drivers/video/fbdev/mmp/mmp_disp.o

This adds the license, author and description tags.

Signed-off-by: Arnd Bergmann <arnd@arndb.de>
Signed-off-by: Bartlomiej Zolnierkiewicz <b.zolnierkie@samsung.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2018-02-25 11:05:44 +01:00
Greg Kroah-Hartman
da9fb78452 Merge 4.9.83 into android-4.9
Changes in 4.9.83
	scsi: smartpqi: allow static build ("built-in")
	drm/radeon: Add dpm quirk for Jet PRO (v2)
	drm/radeon: adjust tested variable
	rtc-opal: Fix handling of firmware error codes, prevent busy loops
	mbcache: initialize entry->e_referenced in mb_cache_entry_create()
	jbd2: fix sphinx kernel-doc build warnings
	ext4: fix a race in the ext4 shutdown path
	ext4: save error to disk in __ext4_grp_locked_error()
	ext4: correct documentation for grpid mount option
	mm: hide a #warning for COMPILE_TEST
	mm: Fix memory size alignment in devm_memremap_pages_release()
	MIPS: Fix typo BIG_ENDIAN to CPU_BIG_ENDIAN
	PCI: keystone: Fix interrupt-controller-node lookup
	video: fbdev: atmel_lcdfb: fix display-timings lookup
	console/dummy: leave .con_font_get set to NULL
	rtlwifi: rtl8821ae: Fix connection lost problem correctly
	target/iscsi: avoid NULL dereference in CHAP auth error path
	Btrfs: fix deadlock in run_delalloc_nocow
	Btrfs: fix crash due to not cleaning up tree log block's dirty bits
	Btrfs: fix extent state leak from tree log
	Btrfs: fix btrfs_evict_inode to handle abnormal inodes correctly
	Btrfs: fix unexpected -EEXIST when creating new inode
	9p/trans_virtio: discard zero-length reply
	mtd: nand: vf610: set correct ooblayout
	ALSA: hda - Fix headset mic detection problem for two Dell machines
	ALSA: usb-audio: Fix UAC2 get_ctl request with a RANGE attribute
	ALSA: hda/realtek - Enable Thinkpad Dock device for ALC298 platform
	ALSA: hda/realtek: PCI quirk for Fujitsu U7x7
	ALSA: usb-audio: add implicit fb quirk for Behringer UFX1204
	ALSA: seq: Fix racy pool initializations
	mvpp2: fix multicast address filter
	usb: Move USB_UHCI_BIG_ENDIAN_* out of USB_SUPPORT
	dm: correctly handle chained bios in dec_pending()
	powerpc: fix build errors in stable tree
	IB/qib: Fix comparison error with qperf compare/swap test
	IB/mlx4: Fix incorrectly releasing steerable UD QPs when have only ETH ports
	kselftest: fix OOM in memory compaction test
	RDMA/rxe: Fix a race condition related to the QP error state
	cpufreq: powernv: Dont assume distinct pstate values for nominal and pmin
	PM / devfreq: Propagate error from devfreq_add_device()
	ocfs2: try a blocking lock before return AOP_TRUNCATED_PAGE
	s390: fix handling of -1 in set{,fs}[gu]id16 syscalls
	arm64: dts: msm8916: Correct ipc references for smsm
	ARM: lpc3250: fix uda1380 gpio numbers
	ARM: dts: STi: Add gpio polarity for "hdmi,hpd-gpio" property
	ARM: dts: nomadik: add interrupt-parent for clcd
	arm: spear600: Add missing interrupt-parent of rtc
	arm: spear13xx: Fix dmas cells
	arm: spear13xx: Fix spics gpio controller's warning
	x86/entry/64/compat: Clear registers for compat syscalls, to reduce speculation attack surface
	compiler-gcc.h: Introduce __optimize function attribute
	x86/speculation: Update Speculation Control microcode blacklist
	x86/speculation: Correct Speculation Control microcode blacklist again
	KVM/x86: Reduce retpoline performance impact in slot_handle_level_range(), by always inlining iterator helper methods
	X86/nVMX: Properly set spec_ctrl and pred_cmd before merging MSRs
	x86/speculation: Clean up various Spectre related details
	selftests/x86/pkeys: Remove unused functions
	selftests/x86: Do not rely on "int $0x80" in test_mremap_vdso.c
	selftests/x86: Do not rely on "int $0x80" in single_step_syscall.c
	x86/speculation: Fix up array_index_nospec_mask() asm constraint
	nospec: Move array_index_nospec() parameter checking into separate macro
	x86/speculation: Add <asm/msr-index.h> dependency
	selftests/x86/mpx: Fix incorrect bounds with old _sigfault
	x86/cpu: Rename cpu_data.x86_mask to cpu_data.x86_stepping
	x86/spectre: Fix an error message
	x86/cpu: Change type of x86_cache_size variable to unsigned int
	x86: fix build warnign with 32-bit PAE
	vfs: don't do RCU lookup of empty pathnames
	ARM: dts: exynos: fix RTC interrupt for exynos5410
	ARM: pxa/tosa-bt: add MODULE_LICENSE tag
	arm64: dts: msm8916: Add missing #phy-cells
	ARM: dts: s5pv210: add interrupt-parent for ohci
	arm: dts: mt2701: Add reset-cells
	ARM: dts: Delete bogus reference to the charlcd
	media: r820t: fix r820t_write_reg for KASAN
	Linux 4.9.83

Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
2018-02-22 18:10:27 +01:00
Jia Zhang
06be007aa4 x86/cpu: Rename cpu_data.x86_mask to cpu_data.x86_stepping
commit b399151cb4 upstream.

x86_mask is a confusing name which is hard to associate with the
processor's stepping.

Additionally, correct an indent issue in lib/cpu.c.

Signed-off-by: Jia Zhang <qianyue.zj@alibaba-inc.com>
[ Updated it to more recent kernels. ]
Cc: Linus Torvalds <torvalds@linux-foundation.org>
Cc: Peter Zijlstra <peterz@infradead.org>
Cc: Thomas Gleixner <tglx@linutronix.de>
Cc: bp@alien8.de
Cc: tony.luck@intel.com
Link: http://lkml.kernel.org/r/1514771530-70829-1-git-send-email-qianyue.zj@alibaba-inc.com
Signed-off-by: Ingo Molnar <mingo@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2018-02-22 15:43:55 +01:00
Johan Hovold
dca0dc604a video: fbdev: atmel_lcdfb: fix display-timings lookup
commit 9cb18db070 upstream.

Fix child-node lookup during probe, which ended up searching the whole
device tree depth-first starting at the parent rather than just matching
on its children.

To make things worse, the parent display node was also prematurely
freed.

Note that the display and timings node references are never put after a
successful dt-initialisation so the nodes would leak on later probe
deferrals and on driver unbind.

Fixes: b985172b32 ("video: atmel_lcdfb: add device tree suport")
Cc: stable <stable@vger.kernel.org>     # 3.13
Cc: Jean-Christophe PLAGNIOL-VILLARD <plagnioj@jcrosoft.com>
Cc: Nicolas Ferre <nicolas.ferre@microchip.com>
Cc: Alexandre Belloni <alexandre.belloni@free-electrons.com>
Signed-off-by: Johan Hovold <johan@kernel.org>
Signed-off-by: Bartlomiej Zolnierkiewicz <b.zolnierkie@samsung.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2018-02-22 15:43:49 +01:00
Greg Kroah-Hartman
319c8e1bc7 Merge 4.9.71 into android-4.9
Changes in 4.9.71
	mfd: fsl-imx25: Clean up irq settings during removal
	crypto: rsa - fix buffer overread when stripping leading zeroes
	crypto: hmac - require that the underlying hash algorithm is unkeyed
	crypto: salsa20 - fix blkcipher_walk API usage
	autofs: fix careless error in recent commit
	tracing: Allocate mask_str buffer dynamically
	USB: uas and storage: Add US_FL_BROKEN_FUA for another JMicron JMS567 ID
	USB: core: prevent malicious bNumInterfaces overflow
	usbip: fix stub_rx: get_pipe() to validate endpoint number
	usb: add helper to extract bits 12:11 of wMaxPacketSize
	usbip: fix stub_rx: harden CMD_SUBMIT path to handle malicious input
	usbip: fix stub_send_ret_submit() vulnerability to null transfer_buffer
	ceph: drop negative child dentries before try pruning inode's alias
	usb: xhci: fix TDS for MTK xHCI1.1
	Bluetooth: btusb: driver to enable the usb-wakeup feature
	xhci: Don't add a virt_dev to the devs array before it's fully allocated
	nfs: don't wait on commit in nfs_commit_inode() if there were no commit requests
	sched/rt: Do not pull from current CPU if only one CPU to pull
	eeprom: at24: change nvmem stride to 1
	dmaengine: dmatest: move callback wait queue to thread context
	ext4: fix fdatasync(2) after fallocate(2) operation
	ext4: fix crash when a directory's i_size is too small
	mac80211: Fix addition of mesh configuration element
	usb: phy: isp1301: Add OF device ID table
	KVM: nVMX: do not warn when MSR bitmap address is not backed
	usb: xhci-mtk: check hcc_params after adding primary hcd
	md-cluster: free md_cluster_info if node leave cluster
	userfaultfd: shmem: __do_fault requires VM_FAULT_NOPAGE
	userfaultfd: selftest: vm: allow to build in vm/ directory
	net: initialize msg.msg_flags in recvfrom
	bnxt_en: Ignore 0 value in autoneg supported speed from firmware.
	net: bcmgenet: correct the RBUF_OVFL_CNT and RBUF_ERR_CNT MIB values
	net: bcmgenet: correct MIB access of UniMAC RUNT counters
	net: bcmgenet: reserved phy revisions must be checked first
	net: bcmgenet: power down internal phy if open or resume fails
	net: bcmgenet: synchronize irq0 status between the isr and task
	net: bcmgenet: Power up the internal PHY before probing the MII
	rxrpc: Wake up the transmitter if Rx window size increases on the peer
	net/mlx5: Fix create autogroup prev initializer
	net/mlx5: Don't save PCI state when PCI error is detected
	iommu/io-pgtable-arm-v7s: Check for leaf entry before dereferencing it
	drm/amdgpu: fix parser init error path to avoid crash in parser fini
	NFSD: fix nfsd_minorversion(.., NFSD_AVAIL)
	NFSD: fix nfsd_reset_versions for NFSv4.
	Input: i8042 - add TUXEDO BU1406 (N24_25BU) to the nomux list
	drm/omap: fix dmabuf mmap for dma_alloc'ed buffers
	netfilter: bridge: honor frag_max_size when refragmenting
	ASoC: rsnd: fix sound route path when using SRC6/SRC9
	blk-mq: Fix tagset reinit in the presence of cpu hot-unplug
	writeback: fix memory leak in wb_queue_work()
	net: wimax/i2400m: fix NULL-deref at probe
	dmaengine: Fix array index out of bounds warning in __get_unmap_pool()
	irqchip/mvebu-odmi: Select GENERIC_MSI_IRQ_DOMAIN
	net: Resend IGMP memberships upon peer notification.
	mlxsw: reg: Fix SPVM max record count
	mlxsw: reg: Fix SPVMLR max record count
	qed: Align CIDs according to DORQ requirement
	qed: Fix mapping leak on LL2 rx flow
	qed: Fix interrupt flags on Rx LL2
	drm: amd: remove broken include path
	intel_th: pci: Add Gemini Lake support
	openrisc: fix issue handling 8 byte get_user calls
	ASoC: rcar: clear DE bit only in PDMACHCR when it stops
	scsi: hpsa: update check for logical volume status
	scsi: hpsa: limit outstanding rescans
	scsi: hpsa: do not timeout reset operations
	fjes: Fix wrong netdevice feature flags
	drm/radeon/si: add dpm quirk for Oland
	Drivers: hv: util: move waiting for release to hv_utils_transport itself
	iwlwifi: mvm: cleanup pending frames in DQA mode
	sched/deadline: Add missing update_rq_clock() in dl_task_timer()
	sched/deadline: Make sure the replenishment timer fires in the next period
	sched/deadline: Throttle a constrained deadline task activated after the deadline
	sched/deadline: Use deadline instead of period when calculating overflow
	mmc: mediatek: Fixed bug where clock frequency could be set wrong
	drm/radeon: reinstate oland workaround for sclk
	afs: Fix missing put_page()
	afs: Populate group ID from vnode status
	afs: Adjust mode bits processing
	afs: Deal with an empty callback array
	afs: Flush outstanding writes when an fd is closed
	afs: Migrate vlocation fields to 64-bit
	afs: Prevent callback expiry timer overflow
	afs: Fix the maths in afs_fs_store_data()
	afs: Invalid op ID should abort with RXGEN_OPCODE
	afs: Better abort and net error handling
	afs: Populate and use client modification time
	afs: Fix page leak in afs_write_begin()
	afs: Fix afs_kill_pages()
	afs: Fix abort on signal while waiting for call completion
	nvme-loop: fix a possible use-after-free when destroying the admin queue
	nvmet: confirm sq percpu has scheduled and switched to atomic
	nvmet-rdma: Fix a possible uninitialized variable dereference
	net/mlx4_core: Avoid delays during VF driver device shutdown
	net: mpls: Fix nexthop alive tracking on down events
	rxrpc: Ignore BUSY packets on old calls
	tty: don't panic on OOM in tty_set_ldisc()
	tty: fix data race in tty_ldisc_ref_wait()
	perf symbols: Fix symbols__fixup_end heuristic for corner cases
	efi/esrt: Cleanup bad memory map log messages
	NFSv4.1 respect server's max size in CREATE_SESSION
	btrfs: add missing memset while reading compressed inline extents
	target: Use system workqueue for ALUA transitions
	target: fix ALUA transition timeout handling
	target: fix race during implicit transition work flushes
	Revert "x86/acpi: Set persistent cpuid <-> nodeid mapping when booting"
	HID: cp2112: fix broken gpio_direction_input callback
	sfc: don't warn on successful change of MAC
	fbdev: controlfb: Add missing modes to fix out of bounds access
	video: udlfb: Fix read EDID timeout
	video: fbdev: au1200fb: Release some resources if a memory allocation fails
	video: fbdev: au1200fb: Return an error code if a memory allocation fails
	rtc: pcf8563: fix output clock rate
	ASoC: Intel: Skylake: Fix uuid_module memory leak in failure case
	dmaengine: ti-dma-crossbar: Correct am335x/am43xx mux value type
	PCI/PME: Handle invalid data when reading Root Status
	powerpc/powernv/cpufreq: Fix the frequency read by /proc/cpuinfo
	PCI: Do not allocate more buses than available in parent
	iommu/mediatek: Fix driver name
	netfilter: ipvs: Fix inappropriate output of procfs
	powerpc/opal: Fix EBUSY bug in acquiring tokens
	powerpc/ipic: Fix status get and status clear
	platform/x86: intel_punit_ipc: Fix resource ioremap warning
	target/iscsi: Fix a race condition in iscsit_add_reject_from_cmd()
	iscsi-target: fix memory leak in lio_target_tiqn_addtpg()
	target:fix condition return in core_pr_dump_initiator_port()
	target/file: Do not return error for UNMAP if length is zero
	badblocks: fix wrong return value in badblocks_set if badblocks are disabled
	iommu/amd: Limit the IOVA page range to the specified addresses
	xfs: truncate pagecache before writeback in xfs_setattr_size()
	arm-ccn: perf: Prevent module unload while PMU is in use
	crypto: tcrypt - fix buffer lengths in test_aead_speed()
	mm: Handle 0 flags in _calc_vm_trans() macro
	clk: mediatek: add the option for determining PLL source clock
	clk: imx6: refine hdmi_isfr's parent to make HDMI work on i.MX6 SoCs w/o VPU
	clk: hi6220: mark clock cs_atb_syspll as critical
	clk: tegra: Fix cclk_lp divisor register
	ppp: Destroy the mutex when cleanup
	ASoC: rsnd: rsnd_ssi_run_mods() needs to care ssi_parent_mod
	thermal/drivers/step_wise: Fix temperature regulation misbehavior
	scsi: scsi_debug: write_same: fix error report
	GFS2: Take inode off order_write list when setting jdata flag
	bcache: explicitly destroy mutex while exiting
	bcache: fix wrong cache_misses statistics
	Ib/hfi1: Return actual operational VLs in port info query
	arm64: prevent regressions in compressed kernel image size when upgrading to binutils 2.27
	btrfs: tests: Fix a memory leak in error handling path in 'run_test()'
	platform/x86: hp_accel: Add quirk for HP ProBook 440 G4
	nvme: use kref_get_unless_zero in nvme_find_get_ns
	l2tp: cleanup l2tp_tunnel_delete calls
	xfs: fix log block underflow during recovery cycle verification
	xfs: fix incorrect extent state in xfs_bmap_add_extent_unwritten_real
	RDMA/cxgb4: Declare stag as __be32
	PCI: Detach driver before procfs & sysfs teardown on device remove
	scsi: hpsa: cleanup sas_phy structures in sysfs when unloading
	scsi: hpsa: destroy sas transport properties before scsi_host
	powerpc/perf/hv-24x7: Fix incorrect comparison in memord
	soc: mediatek: pwrap: fix compiler errors
	tty fix oops when rmmod 8250
	usb: musb: da8xx: fix babble condition handling
	pinctrl: adi2: Fix Kconfig build problem
	raid5: Set R5_Expanded on parity devices as well as data.
	scsi: scsi_devinfo: Add REPORTLUN2 to EMC SYMMETRIX blacklist entry
	IB/core: Fix calculation of maximum RoCE MTU
	vt6655: Fix a possible sleep-in-atomic bug in vt6655_suspend
	rtl8188eu: Fix a possible sleep-in-atomic bug in rtw_createbss_cmd
	rtl8188eu: Fix a possible sleep-in-atomic bug in rtw_disassoc_cmd
	scsi: sd: change manage_start_stop to bool in sysfs interface
	scsi: sd: change allow_restart to bool in sysfs interface
	scsi: bfa: integer overflow in debugfs
	udf: Avoid overflow when session starts at large offset
	macvlan: Only deliver one copy of the frame to the macvlan interface
	RDMA/cma: Avoid triggering undefined behavior
	IB/ipoib: Grab rtnl lock on heavy flush when calling ndo_open/stop
	icmp: don't fail on fragment reassembly time exceeded
	ath9k: fix tx99 potential info leak
	Linux 4.9.71

Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
2017-12-20 10:51:15 +01:00
Christophe JAILLET
cf53526f33 video: fbdev: au1200fb: Return an error code if a memory allocation fails
[ Upstream commit 8cae353e6b ]

'ret' is known to be 0 at this point.
In case of memory allocation error in 'framebuffer_alloc()', return
-ENOMEM instead.

Signed-off-by: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
Cc: Tejun Heo <tj@kernel.org>
Signed-off-by: Bartlomiej Zolnierkiewicz <b.zolnierkie@samsung.com>
Signed-off-by: Sasha Levin <alexander.levin@verizon.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2017-12-20 10:07:27 +01:00
Christophe JAILLET
90e2591f6f video: fbdev: au1200fb: Release some resources if a memory allocation fails
[ Upstream commit 451f130602 ]

We should go through the error handling code instead of returning -ENOMEM
directly.

Signed-off-by: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
Cc: Tejun Heo <tj@kernel.org>
Signed-off-by: Bartlomiej Zolnierkiewicz <b.zolnierkie@samsung.com>
Signed-off-by: Sasha Levin <alexander.levin@verizon.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2017-12-20 10:07:27 +01:00
Ladislav Michl
92c3c7db83 video: udlfb: Fix read EDID timeout
[ Upstream commit c987694755 ]

While usb_control_msg function expects timeout in miliseconds, a value
of HZ is used. Replace it with USB_CTRL_GET_TIMEOUT and also fix error
message which looks like:
udlfb: Read EDID byte 78 failed err ffffff92
as error is either negative errno or number of bytes transferred use %d
format specifier.

Returned EDID is in second byte, so return error when less than two bytes
are received.

Fixes: 18dffdf891 ("staging: udlfb: enhance EDID and mode handling support")
Signed-off-by: Ladislav Michl <ladis@linux-mips.org>
Cc: Bernie Thompson <bernie@plugable.com>
Signed-off-by: Bartlomiej Zolnierkiewicz <b.zolnierkie@samsung.com>
Signed-off-by: Sasha Levin <alexander.levin@verizon.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2017-12-20 10:07:27 +01:00
Geert Uytterhoeven
aecce5fc04 fbdev: controlfb: Add missing modes to fix out of bounds access
[ Upstream commit ac831a379d ]

Dan's static analysis says:

    drivers/video/fbdev/controlfb.c:560 control_setup()
    error: buffer overflow 'control_mac_modes' 20 <= 21

Indeed, control_mac_modes[] has only 20 elements, while VMODE_MAX is 22,
which may lead to an out of bounds read when parsing vmode commandline
options.

The bug was introduced in v2.4.5.6, when 2 new modes were added to
macmodes.h, but control_mac_modes[] wasn't updated:

https://kernel.opensuse.org/cgit/kernel/diff/include/video/macmodes.h?h=v2.5.2&id=29f279c764808560eaceb88fef36cbc35c529aad

Augment control_mac_modes[] with the two new video modes to fix this.

Reported-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Geert Uytterhoeven <geert@linux-m68k.org>
Cc: Dan Carpenter <dan.carpenter@oracle.com>
Cc: Benjamin Herrenschmidt <benh@kernel.crashing.org>
Signed-off-by: Bartlomiej Zolnierkiewicz <b.zolnierkie@samsung.com>
Signed-off-by: Sasha Levin <alexander.levin@verizon.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2017-12-20 10:07:27 +01:00
Greg Kroah-Hartman
a6d71ba679 Merge 4.9.62 into android-4.9
Changes in 4.9.62
	adv7604: Initialize drive strength to default when using DT
	video: fbdev: pmag-ba-fb: Remove bad `__init' annotation
	PCI: mvebu: Handle changes to the bridge windows while enabled
	sched/core: Add missing update_rq_clock() call in sched_move_task()
	xen/netback: set default upper limit of tx/rx queues to 8
	ARM: dts: imx53-qsb-common: fix FEC pinmux config
	dt-bindings: clockgen: Add compatible string for LS1012A
	EDAC, amd64: Add x86cpuid sanity check during init
	PM / OPP: Error out on failing to add static OPPs for v1 bindings
	clk: samsung: exynos5433: Add IDs for PHYCLK_MIPIDPHY0_* clocks
	drm: drm_minor_register(): Clean up debugfs on failure
	KVM: PPC: Book 3S: XICS: correct the real mode ICP rejecting counter
	iommu/arm-smmu-v3: Clear prior settings when updating STEs
	pinctrl: baytrail: Fix debugfs offset output
	powerpc/corenet: explicitly disable the SDHC controller on kmcoge4
	cxl: Force psl data-cache flush during device shutdown
	ARM: omap2plus_defconfig: Fix probe errors on UARTs 5 and 6
	arm64: dma-mapping: Only swizzle DMA ops for IOMMU_DOMAIN_DMA
	crypto: vmx - disable preemption to enable vsx in aes_ctr.c
	drm: mali-dp: fix Lx_CONTROL register fields clobber
	iio: trigger: free trigger resource correctly
	iio: pressure: ms5611: claim direct mode during oversampling changes
	iio: magnetometer: mag3110: claim direct mode during raw writes
	iio: proximity: sx9500: claim direct mode during raw proximity reads
	dt-bindings: Add LEGO MINDSTORMS EV3 compatible specification
	dt-bindings: Add vendor prefix for LEGO
	phy: increase size of MII_BUS_ID_SIZE and bus_id
	serial: sh-sci: Fix register offsets for the IRDA serial port
	libertas: fix improper return value
	usb: hcd: initialize hcd->flags to 0 when rm hcd
	netfilter: nft_meta: deal with PACKET_LOOPBACK in netdev family
	brcmfmac: setup wiphy bands after registering it first
	rt2800usb: mark tx failure on timeout
	apparmor: fix undefined reference to `aa_g_hash_policy'
	IPsec: do not ignore crypto err in ah4 input
	EDAC, amd64: Save and return err code from probe_one_instance()
	s390/topology: make "topology=off" parameter work
	Input: mpr121 - handle multiple bits change of status register
	Input: mpr121 - set missing event capability
	sched/cputime, powerpc32: Fix stale scaled stime on context switch
	IB/ipoib: Change list_del to list_del_init in the tx object
	ARM: dts: STiH410-family: fix wrong parent clock frequency
	s390/qeth: fix retrieval of vipa and proxy-arp addresses
	s390/qeth: issue STARTLAN as first IPA command
	wcn36xx: Don't use the destroyed hal_mutex
	IB/rxe: Fix reference leaks in memory key invalidation code
	clk: mvebu: adjust AP806 CPU clock frequencies to production chip
	net: dsa: select NET_SWITCHDEV
	platform/x86: hp-wmi: Fix detection for dock and tablet mode
	cdc_ncm: Set NTB format again after altsetting switch for Huawei devices
	KEYS: trusted: sanitize all key material
	KEYS: trusted: fix writing past end of buffer in trusted_read()
	platform/x86: hp-wmi: Fix error value for hp_wmi_tablet_state
	platform/x86: hp-wmi: Do not shadow error values
	x86/uaccess, sched/preempt: Verify access_ok() context
	workqueue: Fix NULL pointer dereference
	crypto: ccm - preserve the IV buffer
	crypto: x86/sha1-mb - fix panic due to unaligned access
	crypto: x86/sha256-mb - fix panic due to unaligned access
	KEYS: fix NULL pointer dereference during ASN.1 parsing [ver #2]
	ARM: 8720/1: ensure dump_instr() checks addr_limit
	ALSA: seq: Fix OSS sysex delivery in OSS emulation
	ALSA: seq: Avoid invalid lockdep class warning
	drm/i915: Do not rely on wm preservation for ILK watermarks
	MIPS: microMIPS: Fix incorrect mask in insn_table_MM
	MIPS: Fix CM region target definitions
	MIPS: SMP: Use a completion event to signal CPU up
	MIPS: Fix race on setting and getting cpu_online_mask
	MIPS: SMP: Fix deadlock & online race
	selftests: firmware: send expected errors to /dev/null
	tools: firmware: check for distro fallback udev cancel rule
	ASoC: sun4i-spdif: remove legacy dapm components
	MIPS: BMIPS: Fix missing cbr address
	MIPS: AR7: Defer registration of GPIO
	MIPS: AR7: Ensure that serial ports are properly set up
	Input: elan_i2c - add ELAN060C to the ACPI table
	rbd: use GFP_NOIO for parent stat and data requests
	drm/vmwgfx: Fix Ubuntu 17.10 Wayland black screen issue
	drm/bridge: adv7511: Rework adv7511_power_on/off() so they can be reused internally
	drm/bridge: adv7511: Reuse __adv7511_power_on/off() when probing EDID
	drm/bridge: adv7511: Re-write the i2c address before EDID probing
	can: sun4i: handle overrun in RX FIFO
	can: ifi: Fix transmitter delay calculation
	can: c_can: don't indicate triple sampling support for D_CAN
	x86/smpboot: Make optimization of delay calibration work correctly
	x86/oprofile/ppro: Do not use __this_cpu*() in preemptible context
	Linux 4.9.62

Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
2017-11-15 16:13:49 +01:00
Maciej W. Rozycki
bf41c17c22 video: fbdev: pmag-ba-fb: Remove bad `__init' annotation
[ Upstream commit 879e5a0df6 ]

Fix:

WARNING: drivers/video/fbdev/pmag-ba-fb.o(.text+0x308): Section mismatch in reference from the function pmagbafb_probe() to the function .init.text:pmagbafb_erase_cursor()
The function pmagbafb_probe()
references the function __init pmagbafb_erase_cursor().
This is often because pmagbafb_probe lacks a __init
annotation or the annotation of pmagbafb_erase_cursor is wrong.

-- a fallout from a missed update from commit 9625b51350 ("VIDEO:
PMAG-BA: Fix section mismatch") and then commit 48c68c4f1b ("Drivers:
video: remove __dev* attributes.")

Signed-off-by: Maciej W. Rozycki <macro@linux-mips.org>
Signed-off-by: Bartlomiej Zolnierkiewicz <b.zolnierkie@samsung.com>
Signed-off-by: Sasha Levin <alexander.levin@verizon.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2017-11-15 15:53:11 +01:00