MLK-21656-1 gpu: imx: dpu: Access regs in display engine units wo holding mutex

We don't need holding mutex when accessing registers in display engine
units, because KMS is the only relevant client driver and it has ww mutex
mechansim to ensure there is no race condition on the CRTC resources.
Also, we are naturally safe when the driver initializes the units at the
probe and system power management stages.

Signed-off-by: Liu Ying <victor.liu@nxp.com>

MLK-21684 VPU Decoder: add new v4l2_g_ctrl to supply
    color aspect info

    #define V4L2_CID_USER_FRAME_COLORDESC       (V4L2_CID_USER_BASE + 0x1104)
    #define V4L2_CID_USER_FRAME_TRANSFERCHARS   (V4L2_CID_USER_BASE + 0x1105)
    #define V4L2_CID_USER_FRAME_MATRIXCOEFFS    (V4L2_CID_USER_BASE + 0x1106)
    #define V4L2_CID_USER_FRAME_FULLRANGE       (V4L2_CID_USER_BASE + 0x1107)
    #define V4L2_CID_USER_FRAME_VUIPRESENT      (V4L2_CID_USER_BASE + 0x1108)

    refine code of v4l2 contrl function

Signed-off-by: Shijie Qin <shijie.qin@nxp.com>

MLK-21480: ASoC: wm8962: add constrain for configure bclk

There is error log when suspend & resume

wm8962 3-001a: Failed to read DSPCLK: -1

when suspend the pm_runtime_suspend is called before the
set_bias_level. so in the wm8962_configure_bclk there is
failure when trying to read a volatile register for we have
enabled regcache_cache_only.

To avoid such issue, we can avoid to call set_bias_level
when the level change from SND_SOC_BIAS_ON to
SND_SOC_BIAS_PREPARE, for this flow is for disabling the codec.

Signed-off-by: Shengjiu Wang <shengjiu.wang@nxp.com>

MGS-4735 [#imx-1439] fix gpu suspend/resume stuck

L4.19 SCFW introduced LP mode, clk_set requires power-on,
fixed GPU govern to conform with the latest SCFW change.
remove redundant clk_set_rate in probe to fix LP clock.

Signed-off-by: Xianzhong <xianzhong.li@nxp.com>

MLK-17089-6: ASoC: wm8962: support suspend & resume for imx8

Base on latest power management design in MLK-17074, every driver
need to enter runtime suspend state in suspend, so the driver should
call the pm_runtime_force_suspend in suspend.

Signed-off-by: Shengjiu Wang <shengjiu.wang@nxp.com>
(cherry picked from commit b1003fc0341910b3e5fc94e5e04bed9ecfdb786d)

MLK-21623: ASoC: ak4458: add return value for ak4458_probe

There is ak4458 audio card even no audio board connected, which
is caused by there is no error return value even the i2c access
failed.

Signed-off-by: Shengjiu Wang <shengjiu.wang@nxp.com>
Signed-off-by: Viorel Suman <viorel.suman@nxp.com>

ARM64: dts: imx8mq-evk: specify spdif pll8k and pll11k clocks

In imx8mq-evk DTS both AUDIO PLL rates are configured, so SPDIF1
pll8k and pll11k clocks can be set accordingly.

Signed-off-by: Viorel Suman <viorel.suman@nxp.com>

MLK-17370 video: fbdev: mxc_edid: change '640x480' mode clock

For the '640x480' cea mode, change the 'pixclock' from
39722 ps to 39683 ps to satisfy the imx7ulp hdmi display
requirement.

Signed-off-by: Fancy Fang <chen.fang@nxp.com>
(cherry picked from commit 6ab4068aa1770dce623de70afb05978eade69304)

MLK-21655-2:VPU Decoder:fix improper write permission

Signed-off-by: ming_qian <ming.qian@nxp.com>

crypto: caam - fix copy of next buffer for xcbc and cmac

Fix a side effect of adding xcbc support, when the next_buffer is not
copied.
The issue occurs, when there is stored from previous state a blocksize
buffer and received, a less than blocksize, from user. In this case, the
nents for req->src is 0, and the next_buffer is not copied.
An example is:
{
.tap = { 17, 15, 8 },
.psize = 40,
.np = 3,
.ksize = 16,
}

Fixes: 12b8567f6fa4 ("crypto: caam - add support for xcbc(aes)")
Signed-off-by: Iuliana Prodan <iuliana.prodan@nxp.com>
Reviewed-by: Horia Geantă <horia.geanta@nxp.com>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
(cherry picked from commit b4e9e931e9bb2f5b302ce66640832f5a3e57e8c4)

crypto: caam - fix DMA mapping xcbc key twice

Fix a side effect of adding xcbc support, which leads to DMA mapping the
key twice.

Fixes: 12b8567f6fa4 ("crypto: caam - add support for xcbc(aes)")
Signed-off-by: Horia Geantă <horia.geanta@nxp.com>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
(cherry picked from commit 8e731ee5e2a5aa37b736c05ee2562e1169af866e)

crypto: caam - add support for xcbc(aes)

Add xcbc(aes) offloading support.

Due to xcbc algorithm design and HW implementation in CAAM,
driver must still have some bytes to send to the crypto engine when
ahash_final() is called - such that HW correctly uses either K2 or K3
for the last block.

Signed-off-by: Iuliana Prodan <iuliana.prodan@nxp.com>
Signed-off-by: Horia Geantă <horia.geanta@nxp.com>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
(cherry picked from commit 12b8567f6fa489c098024fc75caba2f6b1390a92)

Removed is_mdha() function since it doesn't exist in BSP.

Signed-off-by: Iuliana Prodan <iuliana.prodan@nxp.com>

crypto: caam - export ahash shared descriptor generation

caam/qi2 driver will support ahash algorithms,
thus move ahash descriptors generation in a shared location.

Signed-off-by: Horia Geantă <horia.geanta@nxp.com>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
(cherry picked from commit 0efa7579f3de1907acd16a358b0ade214b020d77)

Removed CRYPTO_DEV_FSL_DPAA2_CAAM from Kconfig, kept
CRYPTO_DEV_FSL_CAAM_CRYPTO_API_DESC as it is in BSP

Signed-off-by: Iuliana Prodan <iuliana.prodan@nxp.com>

crypto: caam - revert xcbc(aes) support

This commit reverts the xcbc(aes) support from BSP to backport it
from upstream.
This reverts commits:
eeb599a4eddc ("MLK-9971 Add XCBC-AES support for CAAM in i.MX6 family")
39fbc513bed5 ("MLK-12312: CAAM hash algorithms fail registration during
initialization")
cfd4431ab014 ("MLK-14611 Fix xcbc unkeyed registration")

Signed-off-by: Iuliana Prodan <iuliana.prodan@nxp.com>

MLK-21652 arm: dts: imx6sx-sdb: disable gpio regulator for lcd

GPIO3_27 is shared by LCD power LCD_3V3 as gpio regulator and the camera as
Reset pin. Need disable the gpio regulator function for LCD, otherwise the
Reset pin for camera can't be requested/used correctly.

Signed-off-by: Robby Cai <robby.cai@nxp.com>
Reviewed-by: Guoniu.Zhou <guoniu.zhou@nxp.com>

MLK-21588: ASoC: imx-wm8962: add missing pm

add missing pm for suspend and resume.

Signed-off-by: Shengjiu Wang <shengjiu.wang@nxp.com>

MLK-20067 arm64: dts: imx8mm: disable phy eee mode

Disable PHY eee mode in default to make ptp synchronized time
much more restricted in convergent range.

Reviewed-by: Richard Zhu <hongxing.zhu@nxp.com>
Signed-off-by: Fugang Duan <fugang.duan@nxp.com>

MLK-21663-2 arm64: fsl-imx8qm-device.dtsi: Minimize the range of dpu_intsteer regions

This patch minimizes the range of dpu_intsteers to
204-byte(from 0x0 to 0xc8) to avoid exposing the
inaccessible registers via debugfs.

Signed-off-by: Liu Ying <victor.liu@nxp.com>

MLK-21663-1 arm64: fsl-imx8dx.dtsi: Minimize the range of dpu_intsteer region

This patch minimizes the range of dpu_intsteer to
204-byte(from 0x0 to 0xc8) to avoid exposing the
inaccessible registers via debugfs.

Signed-off-by: Liu Ying <victor.liu@nxp.com>

crypto: caam: fix caam_dump_sg that iterates through scatterlist

Fix caam_dump_sg by correctly determining the next scatterlist
entry in the list.

Fixes: 5ecf8ef9103c ("crypto: caam - fix sg dump")
Signed-off-by: Iuliana Prodan <iuliana.prodan@nxp.com>

MLK-17089-3: ASoC: wm8960: support suspend & resume for imx8

Base on latest power management design in MLK-17074, every driver
need to enter runtime suspend state in suspend, so the driver should
call the pm_runtime_force_suspend in suspend.

Signed-off-by: Shengjiu Wang <shengjiu.wang@nxp.com>
(cherry picked from commit 9fe0c0ed2490635f06782dccc53306a7ac040e10)

MLK-21021: clk: imx8: Fix failure of set parent clock after resume

We need to set parent clock for some audio clock in dts,
when the system enter suspend, the whole audio subsystem
may be power off, the parent setting should be lost, so
we need to set CLK_SET_PARENT_NOCACHE flag in imx_clk_mux_scu,
to let the operation of reset parent clock in
drivers/soc/imx/pm-domains.c take effect.

This issue only occurs on imx8qm, not on imx8qxp, for on imx8qxp
the ADMA subsystem don't enter power off, there is other
device in power on state in suspend.

Signed-off-by: Shengjiu Wang <shengjiu.wang@nxp.com>
(cherry picked from commit 5e8b48b90effa1aa2b9fbbd8919b131f6ad86946)

MLK-21659: VPU Decoder: fix invalid timestamp(-1) may be outputed

Driver may steal 3 frame buffers to firmware.
In android platform, user may do munmap,
it will cause that driver can't find a frame buffer by physical address
when decoded event is received.
It will cause the TSManagerValid2 isn't called for some frame.
and the TSManagerSend2 may output an invalid timestamp(-1)

Signed-off-by: ming_qian <ming.qian@nxp.com>

MLK-21655: VPU Decoder: driver supply an interface to get the firmware
log

get the firmware log:
cat /sys/devices/platform/2c000000.vpu_decoder/fwlog

Signed-off-by: ming_qian <ming.qian@nxp.com>

MLK-21598: arm64: dts: imx8dx: fix csr reg range

The mipi_dsi_csr register range is wrong in the dts file, causing issues
when trying to read the whole allocated region.
Fix the dts nodes by correctly specifying the address range.

Signed-off-by: Robert Chiras <robert.chiras@nxp.com>
Reviewed-by: Laurentiu Palcu <laurentiu.palcu@nxp.com>

MLK-21614: arm64: dts: imx8mq: fix dual-display

Some nodes were deleted (by mistake) in the lcdif-adv7535.dtsi file,
causing the dcss driver not to be loaded when using dual-display.
Removing the /delete-node/ entries to fix this.

Signed-off-by: Robert Chiras <robert.chiras@nxp.com>
Reviewed-by: Laurentiu Palcu <laurentiu.palcu@nxp.com>

MLK-21647: drm/mxsfb: Turn off vblanks in disable

The calls to drm_crtc_vblank_on/off should be paired into pipe_enable
and pipe_disable callbacks.
This patch adds the call to drm_crtc_vblank_off in pipe_disable callback.

Signed-off-by: Robert Chiras <robert.chiras@nxp.com>
Reviewed-by: Laurentiu Palcu <laurentiu.palcu@nxp.com>

MLK-21612 PCI: imx: pcie ep probe failure

There is redundant attrs registration in ep's probe.
Maybe introduced by the merge conflication.
Remove them to fix the probe failure.

Signed-off-by: Richard Zhu <hongxing.zhu@nxp.com>
Reviewed-by: Fugang Duan <fugang.duan@nxp.com>

MLK-21646-2 arm64: fsl-imx8qm-device.dtsi: Minimize the range of LVDS regions

It turns out some registers in the 4K-byte LVDS range starting at 0x1000
as claimed by the memory map documentation are inaccessible based on tests.
Let's minimize the range to 4-byte starting at 0x10e0 to avoid exposing
the inaccessible registers via debugfs.

Signed-off-by: Liu Ying <victor.liu@nxp.com>

MLK-21646-1 arm64: fsl-imx8dx.dtsi: Minimize the range of LVDS regions

It turns out some registers in the 4K-byte LVDS range starting at 0x1000
as claimed by the memory map documentation are inaccessible based on tests.
Let's minimize the range to 4-byte starting at 0x10e0 to avoid exposing
the inaccessible registers via debugfs.

Signed-off-by: Liu Ying <victor.liu@nxp.com>

MGS-4783 integrate 6.4.0 beta official version

Also enabled commit worker feature for 6.4.0 beta

Signed-off-by: Xianzhong <xianzhong.li@nxp.com>

MLK-21617: crypto: caam - update SM test error handling

Update SM test module to return an error code in all cases and
based on this print an indication (test passed / failed) to make
test automation easier.

Signed-off-by: Horia Geantă <horia.geanta@nxp.com>
Reviewed-by: Iuliana Prodan <iuliana.prodan@nxp.com>

[i.MX845/VPU]:MLK-21235-3: multi instance encode process fail to resume encoding during suspend..

Modify 32bits ioctl function, remove wrong conversion between kernel and user space.

Signed-off-by: Zhou Peng <eagle.zhou@nxp.com>
(cherry picked from commit 23bde9ab8989b28b209521e0ad9f75fe93534e66)

MLK-21554-2 ARM: dts: imx6ull: use nvmem-cells for cpu speed grading

Add nvmem-cell support for i.MX6ULL and imx7ulz boards.

Signed-off-by: Arulpandiyan Vadivel <arulpandiyan_vadivel@mentor.com>
Signed-off-by: Shrikant Bobade <Shrikant_Bobade@mentor.com>

MLK-21554-1 ARM: dts: imx6sll: Add ocotp support

Add ocotp support to imx6sll board which helps to fix lowbus freq
issues.

Signed-off-by: Arulpandiyan Vadivel <arulpandiyan_vadivel@mentor.com>
Signed-off-by: Shrikant Bobade <Shrikant_Bobade@mentor.com>

MLK-21641 usb: typec: tcpm: cancel delayed work when unregister tcpm

We may do tcpm port unregister in middle of tcpm state transitions,
if there are delayed works queued, we need cancel them before finish
the tcpm unregsiter.

Reviewed-by: Fugang Duan <fugang.duan@nxp.com>
Signed-off-by: Li Jun <jun.li@nxp.com>

MLK-21589-2 VPU Decoder: implement insert decoder header of
    RV format for Amphion decoder

    Not add picture header and slice header for RV format if
    it is raw-data

Signed-off-by: Shijie Qin <shijie.qin@nxp.com>

MLK-21314: crypto: caam: Fix double creation of debugfs main folder

The creation of the root directory for the control driver of
the CAAM was done in enable_jobrings() and in init_debugfs()
stored in the variable dfs_root.

Both calls uses the same arguments hence the second creation
overrides the first one resulting in 2 entries in the debug FS
with the first one empty.

This patch removes the call from enable_jobrings().

The debug folder can be found in /sys/kernel/debug/*caam/ctl.

Fixes: de9807e6e0de (MLK-15473-1: crypto: caam: Add CAAM driver support for iMX8 soc family)
Reviewed-by: Horia Geantă <horia.geanta@nxp.com>
Signed-off-by: Franck LENORMAND <franck.lenormand@nxp.com>

MLK-21635: ARM: imx6sll-evk: fix clock reparent issue

There is error log:

[    0.000000] clk: failed to reparent pll4_audio_div to osc: -22
[    0.000000] clk: failed to reparent pll4_audio_div to osc: -22

The reason is that the assigned-clocks is used in imx6sll.dtsi
clks node, so the assigned-clocks in imx6sll-evk.dts will override
the previous one, then cause the reparent error issue.

Redefine the assigned-clocks in imx6sll-evk.dts.

Signed-off-by: Shengjiu Wang <shengjiu.wang@nxp.com>
Reviewed-by: Viorel Suman <viorel.suman@nxp.com>

MLK-21627: ASoC: imx-pcm-dma-v2: add debugfs_prefix for platform

There is warning log after switching to component in driver:

[ 3.321645] fsl-sai 30030000.sai: ASoC: Failed to create component debugfs directory

The reason is there is two component attached with one device,
the components' name are same, then creating debugfs for second
component failed.

This patch is to add debugfs_prefix for platform component to fix
the warning issue.

Signed-off-by: Shengjiu Wang <shengjiu.wang@nxp.com>
Reviewed-by: Daniel Baluta <daniel.baluta@nxp.com>

MLK-21530: hdmi: set default video mode

Set default video mode when driver probe.

Signed-off-by: Sandor Yu <Sandor.yu@nxp.com>

MLK-21618 ARM: dts: imx6/imx7: avoid duplicate names in lcdif node

This patch fixes the following warning on various imx boards.

OF: Duplicate name in lcdif@......, renamed to "display#1"

Signed-off-by: Arulpandiyan Vadivel <arulpandiyan_vadivel@mentor.com>
Signed-off-by: Shrikant Bobade <Shrikant_Bobade@mentor.com>

MLK-21593 ARM: dts: imx7d fix the typo sound-hdmi node

Correct hdmi-controller property name in device tree to fix audio
enumeration on imx7d board.

Signed-off-by: Arulpandiyan Vadivel <arulpandiyan_vadivel@mentor.com>
Signed-off-by: Shrikant Bobade <Shrikant_Bobade@mentor.com>

MLK-21631 usb: typec: tcpci: Fix build failure

Fix compilation after porting from imx_4.14.y

Fixes: 3aaf2019e9e1 ("MLK-21368 typec: tcpci: disable irq when system suspend")

Signed-off-by: Leonard Crestez <leonard.crestez@nxp.com>

MLK-21549-3 ARM: dts: imx6ull: use fsl,imx6ul-ocotp under ocotp node

This patch use fsl,imx6ul-ocotp instead of fsl,imx6ull-ocotp under ocotp
node to align with the mainline.

Signed-off-by: Vipul Kumar <vipul_kumar@mentor.com>
Signed-off-by: Shrikant Bobade <Shrikant_Bobade@mentor.com>

MLK-21549-2 ARM: dts: imx6sll: use nvmem-cells for cpu speed grading

Use the nvmem-cells binding to read ocotp for imx6sll evk.

Signed-off-by: Vipul Kumar <vipul_kumar@mentor.com>
Signed-off-by: Shrikant Bobade <Shrikant_Bobade@mentor.com>

MLK-21549-1 cpufreq: imx6q: Add support for imx6ulz

This patch add support for imx6ulz board to read the cpu frequency from the
OPP table.

Signed-off-by: Vipul Kumar <vipul_kumar@mentor.com>
Signed-off-by: Shrikant Bobade <Shrikant_Bobade@mentor.com>

MLK-21550 ARM: dts: imx6ul-evk: Remove DRM panel support

This patch remove DRM panel support for imx6ul board.

Signed-off-by: Vipul Kumar <vipul_kumar@mentor.com>
Signed-off-by: Shrikant Bobade <Shrikant_Bobade@mentor.com>
(cherry picked from commit d5d39a1ec12cec0206e995357f8031647b10a763)

MLK-21576 Revert "soc: imx: gpc: Do not pass static memory as platform data"

This reverts commit f54e714cfc53b9164d1206f9ee49042195532a51.

This patch breaks the suspend and resume functionality in all imx6 boards.

Signed-off-by: Arulpandiyan Vadivel <arulpandiyan_vadivel@mentor.com>

MLK-21445 serial: fsl_lpuart: do HW reset for communication port

Do HW reset for communication port after the port is registered
if the UART controller support the feature.

Do partition reset with LPUART's power on, LPUART registers will
keep the previous status, like on i.MX8QM platform,  which is not
expected action, so reset the HW is required.

Currently, only i.MX7ULP and i.MX8QM LPUART controllers include
global register that support HW reset.

Tested-by: Robin Gong <yibin.gong@nxp.com>
Tested-by: Peng Fan <peng.fan@nxp.com>
Reviewed-by: Robby Cai <robby.cai@nxp.com>
Signed-off-by: Fugang Duan <fugang.duan@nxp.com>
(cherry picked from commit c2bc1f62ec28981462c9cb5ceac17134931ca19f)
Signed-off-by: Arulpandiyan Vadivel <arulpandiyan_vadivel@mentor.com>
Signed-off-by: Shrikant Bobade <Shrikant_Bobade@mentor.com>
(cherry picked from commit 9f396f540093402317c3c1b9a8fe955b91c89164)

MLK-21443: dmaengine: fsl-edma-v3: clear pending irq before request irq

edma interrupt maybe happened during reboot or watchdog reset, meanwhile
gic never power down on i.mx8QM/QXP, thus the unexpect irq will come in
once edma driver request irq at probe phase. Unfortunately, at that time
that edma channel's power domain which power-up by customer driver such
as audio/uart driver may not be ready, so kernel panic triggered once
touch such edma registers which still not power up in interrupt handler.
Move request irq from probe to alloc dma channel so that edma channel's
power domain has already been powered, besides, clear meaningless
interrupt before request irq.

Signed-off-by: Robin Gong <yibin.gong@nxp.com>
Acked-by: Fugang Duan <fugang.duan@nxp.com>
(cherry picked from commit 0a0d8f8b944094342fda18f23f3ac13b8a73871d)
Signed-off-by: Arulpandiyan Vadivel <arulpandiyan_vadivel@mentor.com>
Signed-off-by: Shrikant Bobade <Shrikant_Bobade@mentor.com>
(cherry picked from commit a6fa7853b4318a31df8c4f53068e5c68d6e0c4bd)

MLK-21368 typec: tcpci: disable irq when system suspend

Disable typec irq when suspend to avoid the threaded irq to access
some resource(e.g. i2c over rpmsg) but those resource is not
available at later phrase, also use IRQ_DISABLE_UNLAZY flag to
mask the irq on irq chip level when irq happens.

Suggested-by: Anson Huang <anson.huang@nxp.com>
Acked-by: Peter Chen <peter.chen@nxp.com>
Signed-off-by: Li Jun <jun.li@nxp.com>
(cherry picked from commit 61869f787fb0ee2f00d0fe9443cb8b487e16e5ec)
Signed-off-by: Arulpandiyan Vadivel <arulpandiyan_vadivel@mentor.com>
Signed-off-by: Shrikant Bobade <Shrikant_Bobade@mentor.com>
(cherry picked from commit 3b1fd5d8ccc9545818ead8bf1dcccb47bfd5c9e6)

MLK-21355 typec: tcpm: use freezable workqueue for event handling

While system suspend, the typec event handling required service
maybe is not available(suspended), so we need freeze those event
handling by using freezable workqueue, e.g while tcpm is handling
PD message but system suspend started.

Acked-by: Peter Chen <peter.chen@nxp.com>
Signed-off-by: Li Jun <jun.li@nxp.com>
(cherry picked from commit 270d4df94b7c2c773a171fe012fb8ce89196964f)
Signed-off-by: Arulpandiyan Vadivel <arulpandiyan_vadivel@mentor.com>
Signed-off-by: Shrikant Bobade <Shrikant_Bobade@mentor.com>
(cherry picked from commit 64a3a41322028985b4b06f16160f76b90cd92f5a)

MGS-4652 [#imx-1379] fix coverity dereference issue

CID: 5781508
device pointer should not be used before null check

Signed-off-by: Xianzhong <xianzhong.li@nxp.com>
(cherry picked from commit 17942905375a282ed9896c3cc778a246c321f5f0)
Signed-off-by: Arulpandiyan Vadivel <arulpandiyan_vadivel@mentor.com>
Signed-off-by: Shrikant Bobade <Shrikant_Bobade@mentor.com>
(cherry picked from commit 1156f9c81028d59c35835d0311dea19f2e6e52b1)

MLK-20208-4 mxc IPUv3: disp: Avoid division by zero in ipu_init_sync_panel()

To avoid potential division by zero in ipu_init_sync_panel(),
let's check the rounded_pixel_clk rate prior to that.

Detected by CoverityScan, CID#56278 ("Division or modulo by zero")

Signed-off-by: Liu Ying <victor.liu@nxp.com>
(cherry picked from commit 1523150b71f1aa0610f61ea47a9f3bdbcda92522)
Signed-off-by: Arulpandiyan Vadivel <arulpandiyan_vadivel@mentor.com>
Signed-off-by: Shrikant Bobade <Shrikant_Bobade@mentor.com>
(cherry picked from commit 5e2882f2fa1e852e6c405e38109505eae1459c90)

MLK-20208-3 mxc IPUv3: disp: Avoid division by zero in ipu_init_async_panel()

To avoid potential division by zero in ipu_init_async_panel(),
let's check the di_clk rate prior to that.

Detected by CoverityScan, CID#56264 ("Division or modulo by zero")

Signed-off-by: Liu Ying <victor.liu@nxp.com>
(cherry picked from commit d7777247e6ba4ca9fcc313bef6672060859fed19)
Signed-off-by: Arulpandiyan Vadivel <arulpandiyan_vadivel@mentor.com>
Signed-off-by: Shrikant Bobade <Shrikant_Bobade@mentor.com>
(cherry picked from commit 739a8482f07187566ec8777dbd2d4b79a1056c49)

MLK-20208-2 mxc IPUv3: device: Avoid potential out of bounds array access

To avoid potential out of bounds array access on tbl->used[][],
let's check the tsk->ipu_id prior to that.  Based on the context,
this is what we can do to make the coverity happy.

Detected by CoverityScan, CID#17689 ("Derefernece before null check")

Signed-off-by: Liu Ying <victor.liu@nxp.com>
(cherry picked from commit f5dcf709c54da8e64eb84f1dd7a4452ad8d942cf)
Signed-off-by: Arulpandiyan Vadivel <arulpandiyan_vadivel@mentor.com>
Signed-off-by: Shrikant Bobade <Shrikant_Bobade@mentor.com>
(cherry picked from commit a9d03df1de0c6744335eb185506a3b6e27c4d24b)

MLK-20208-1 mxc IPUv3: device: Remove a piece of dead code in ipu_task_thread()

The check on !sp_tsk0 is unnecessary in ipu_task_thread(), because the
beforehand "list_del(&sp_tsk0->node);" within the context implies sp_tsk0
is not null, otherwise, we'll dereference a null pointer earlier.

Detected by CoverityScan, CID#17842 ("Logically dead code")

Signed-off-by: Liu Ying <victor.liu@nxp.com>
(cherry picked from commit 9ad5edd076d61bc8bb3a558e523cc7b31f2c3043)
Signed-off-by: Arulpandiyan Vadivel <arulpandiyan_vadivel@mentor.com>
Signed-off-by: Shrikant Bobade <Shrikant_Bobade@mentor.com>
(cherry picked from commit 2c4dd0cb989176b9ca71b7ee60e9cdb899f5f633)

MLK-20370 IPU: mxc_vout: fix the potential uninitalized variable usage

Fix Covertity CID 18110 Uninitialized scalar variable

Signed-off-by: Oliver Brown <oliver.brown@nxp.com>
(cherry picked from commit 0f2a05c5cef95dabdbdd1e78531cd42aec24876a)
Signed-off-by: Arulpandiyan Vadivel <arulpandiyan_vadivel@mentor.com>
Signed-off-by: Shrikant Bobade <Shrikant_Bobade@mentor.com>
(cherry picked from commit 66e74fc3d5adad10766adf08a73109da064945e9)

MLK-21073 usb: cdns3: core: fix the oops when the interrupt occurs during suspend

When the interrupt occurs during the USB is entering suspend, the
cdns->lpm flag may not be updated well, the below oops may occur.
We treat above interrupt as wakeup interrupt, it should be handled
after lpm flag is set.

irq 120: nobody cared (try booting with the "irqpoll" option)
CPU: 0 PID: 107 Comm: kworker/0:1 Tainted: G           O    4.14.78 #1
Hardware name: Freescale i.MX8QM MEK (DT)
Workqueue: pm pm_runtime_work
Call trace:
[<ffff000008083230>] el1_irq+0xb0/0x124
[<ffff000009028fcc>] _raw_spin_unlock_irqrestore+0x18/0x48
[<ffff000008147a6c>] __irq_put_desc_unlock+0x1c/0x44
[<ffff000008149e4c>] enable_irq+0x54/0x90
[<ffff0000089cb08c>] cdns3_enter_suspend+0x30c/0x3ac
[<ffff0000089cb274>] cdns3_runtime_suspend+0x40/0x78
[<ffff000008796cd8>] pm_generic_runtime_suspend+0x28/0x48
[<ffff0000087a7400>] genpd_runtime_suspend+0x90/0x21c
[<ffff00000879a14c>] __rpm_callback+0x130/0x264
[<ffff00000879a2a4>] rpm_callback+0x24/0x78
[<ffff000008798ec8>] rpm_suspend+0x10c/0x668
[<ffff0000087996b4>] rpm_idle+0x1c0/0x390
[<ffff00000879aa6c>] pm_runtime_work+0x94/0xe0
[<ffff0000080fac88>] process_one_work+0x140/0x3f8
[<ffff0000080fb078>] worker_thread+0x138/0x3e4
[<ffff0000081014e0>] kthread+0x104/0x130
[<ffff00000808552c>] ret_from_fork+0x10/0x18

Signed-off-by: Peter Chen <peter.chen@nxp.com>
Signed-off-by: Arulpandiyan Vadivel <arulpandiyan_vadivel@mentor.com>
Signed-off-by: Shrikant Bobade <Shrikant_Bobade@mentor.com>
(cherry picked from commit e9f0c22de405d2e7f9698e67fbebde1e5aa37fdc)

MLK-20972 ARM: dts: imx7ulp-evkb: add the model name

Add the model name accordingly for imx7ulp EVKB board since
the machine name and/or compatible may be used by user.

Reviewed-by: Richard Zhu <hongxing.zhu@nxp.com>
Signed-off-by: Fugang Duan <fugang.duan@nxp.com>
Signed-off-by: Arulpandiyan Vadivel <arulpandiyan_vadivel@mentor.com>
Signed-off-by: Shrikant Bobade <Shrikant_Bobade@mentor.com>
(cherry picked from commit f49cee78a98eab62793392279df1804acdf4a09b)

bluetooth: l2cap: add security setting check

Add security setting check for socket interface since
stack will check the return value.

Signed-off-by: Fugang Duan <fugang.duan@nxp.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Arulpandiyan Vadivel <arulpandiyan_vadivel@mentor.com>
Signed-off-by: Shrikant Bobade <Shrikant_Bobade@mentor.com>
(cherry picked from commit a23098e20ce214d134cc3cef3ad51a6bba13b99a)

MLK-21163 PCI: enable cyw4356 D3 mode

Remove the quirk for disable cyw4356 D3 mode since current FW
already support it.
This revert the commit 28db0ac248b3("MLK-20716 PCI: add quirk for
cyw4356 to disable D3 mode")

Reviewed-by: Richard Zhu <hongxing.zhu@nxp.com>
Signed-off-by: Fugang Duan <fugang.duan@nxp.com>
Signed-off-by: Arulpandiyan Vadivel <arulpandiyan_vadivel@mentor.com>
Signed-off-by: Shrikant Bobade <Shrikant_Bobade@mentor.com>
(cherry picked from commit d0e2c4b0b66e46b2f33633efdea19af6241f95ef)

MLK-13459 video: fbdev: export symbols needed for module build

mipid_hx8369_get_lcd_videomode and mipid_hx8369_lcd_setup are now exported
for the module build.

Signed-off-by: Oliver Brown <oliver.brown@nxp.com>
Signed-off-by: Arulpandiyan Vadivel <arulpandiyan_vadivel@mentor.com>
Signed-off-by: Shrikant Bobade <Shrikant_Bobade@mentor.com>
(cherry picked from commit d4cc133df431df7c620fe95543dad80e5d25d5b3)

MLK-21105 IPUv3: disp: Explicitly clear DI_GEN_POLARITY_DISP_CLK when necessary

The IPUv3 fb driver would call ipu_init_sync_panel() to enable a display.
It reads the DI_GENERAL register first and sets the bit
DI_GEN_POLARITY_DISP_CLK to high if sig.clk_pol is false.  This assumes
no one else would program the bit and the pixel clock polarity never
changes(which is usually the case).  However, the commit mentioned below
sets the bit to high in ipu_uninit_sync_panel() when a display is disabled,
in order to avoid power leakage for display pins.  This would keep the
bit being high as long as the display was disabled since the system is
actively running.  This patch explicitly clears the bit when necessary
to fix the issue.  Tests are done for CLAA-WVGA parallel LCD panel,
SEIKO-WVGA parallel LCD panel, Hannstar XGA LVDS panel(LVDS0 and LVDS1),
HIMAX WVGA MIPI DSI panel and native HDMI output on i.MX6q SabreSD board.

Fixes: 9afd177e7524 ("ENGR00141552 ipuv3: fix display pin's power leak")
Signed-off-by: Liu Ying <victor.liu@nxp.com>
(cherry picked from commit 02db8c7829d72bd45967d866965a17d818b9cc57)
Signed-off-by: Arulpandiyan Vadivel <arulpandiyan_vadivel@mentor.com>
Signed-off-by: Shrikant Bobade <Shrikant_Bobade@mentor.com>
(cherry picked from commit 0f52c8a6d5c22f62e58109ae4ff8b1dad5c09348)

MLK-21031 arm: imx: fix standby resume hang on imx7ulp

When system resume from VLPS mode, DDR IO must be restored
before mmdc out of the self-fresh mode.

Signed-off-by: Jacky Bai <ping.bai@nxp.com>
Tested-by: Anson Huang <Anson.Huang@nxp.com>
(cherry picked from commit 7dec20bcb6633c7feee1eb32a5d81356075a61f7)
Signed-off-by: Arulpandiyan Vadivel <arulpandiyan_vadivel@mentor.com>
Signed-off-by: Shrikant Bobade <Shrikant_Bobade@mentor.com>
(cherry picked from commit 1a484976fdfda18e316c4e0b22fbbd4c99593f8d)

MLK-21006 Driver: lpuart: Disable interrupts before request irq

Commit b311ef1d549b ("MLK-20989: Driver: lpuart: reset registers
before enable lpuart") breaks early console function, and the
commit already was reverted. The reworked patch is to fix the
issue correctly.

This patch has been tested on i.MX8QM/QXP.

change log:
V1 -> V2:
  1. Remove lock, since there is no race condition.

Suggested-by: Peng Fan <peng.fan@nxp.com>
Signed-off-by: Flynn xu <flynn.xu@nxp.com>
Signed-off-by: Arulpandiyan Vadivel <arulpandiyan_vadivel@mentor.com>
Signed-off-by: Shrikant Bobade <Shrikant_Bobade@mentor.com>
(cherry picked from commit 161f0144934fe917123c79eae6a7539806d1e04e)

MLK-20970: mtd: flexspi: add delay cell support for fspi

Add delay cell support for fspi to set calibrated value to DLL register
for different clock frequency.

Signed-off-by: Han Xu <han.xu@nxp.com>
(cherry picked from commit 5b608b98697668bd11563febba89bd0eea1c1b26)
Signed-off-by: Arulpandiyan Vadivel <arulpandiyan_vadivel@mentor.com>
Signed-off-by: Shrikant Bobade <Shrikant_Bobade@mentor.com>
(cherry picked from commit 75bd56659a626a2f013e7ec3e9019eede68bd315)

MLK-20957-2 mmc: cqhci: clear the HALT bit in the first request when resume back

After system suspend, CQE is in cqhci_off state, which set the HALT bit, make
CQE in HALT state. If the SoC do not power down the USDHC module, then when
system resume back, this bit keep the same, still set. So need to clear this
bit when enable CQE for the first request after system resume back. If not,
imx8mm will stuck in the first CMDQ request after system resume back. On
imx8qxp and imx8qm, we do not find this issue because usdhc module lost power
during system suspend/resume, and all the register return to the default reset
value, and the reset value of bit HALT is 0.

Signed-off-by: Haibo Chen <haibo.chen@nxp.com>
(cherry picked from commit 49d6f5d5cca3a66fa65568a50f75cbbac87ba312)
Signed-off-by: Arulpandiyan Vadivel <arulpandiyan_vadivel@mentor.com>
Signed-off-by: Shrikant Bobade <Shrikant_Bobade@mentor.com>
(cherry picked from commit bb7964bdf5dee51e82d8b7fff3e2454e3c9a57fc)

MLK-20957-1 mmc: sdhci-esdhc-imx: correct the fix of ERR004536

the commit 885c943ca13d ("ENGR00288842 mmc: sdhci-esdhc-imx: add
ADMA Length Mismatch errata fix") involve the fix of ERR004536.
But double confirm with IC, need to clear the bit 7 of register
0x6c rather than set this bit 7.
here is the function of bit 7 of 0x6c:
0: enable the new IC fix for ERR004536
1: do not use the IC fix, keep the same as before

Due to the reset value of this bit 7 is 0, and ROM code also do not
touch this bit 7, so this patch directly remove the operation of this
bit 7, make sure the fix of ERR004536 can work.

Note, for all versons of 6DQP 6DQ 6DL and 6SL, IC do not has this
hardware fix, so writing this bit has no effect and we keep using
ADMA as before which has been used for several years with the
consideration of no performance drop.

For other SoC like imx6SLL imx6SX imx6UL/imx6ULL imx7 imx8, IC already
contain this hareware fix, so must make sure the bit 7 of the register
0x6c is 0. If not, we meet the ADMA length mismatch error on imx8mm-evk
and imx8qxp-ddr3l-val board when enable CMDQ.

Signed-off-by: Haibo Chen <haibo.chen@nxp.com>
(cherry picked from commit 2ea2f2b374545ff63a714fabc16c0d7c6b3b47b6)
Signed-off-by: Arulpandiyan Vadivel <arulpandiyan_vadivel@mentor.com>
Signed-off-by: Shrikant Bobade <Shrikant_Bobade@mentor.com>
(cherry picked from commit 359538c2faf5d975072c9950e510d61d10815a69)

MLK-20956 rtc: imx-rpmsg: do NOT overwrite rtc driver data

Some test cases need to use RTC driver data, so do NOT
overwrite it using rpmsg data structure.

Signed-off-by: Anson Huang <Anson.Huang@nxp.com>
Reviewed-by: Bai Ping <ping.bai@nxp.com>
(cherry picked from commit da74fb3d328f037ecb1832a53f45cebdbda8f86f)
Signed-off-by: Arulpandiyan Vadivel <arulpandiyan_vadivel@mentor.com>
Signed-off-by: Shrikant Bobade <Shrikant_Bobade@mentor.com>
(cherry picked from commit 776e5fa2eef90e50cbd90c904c7f880323e8bc33)

MLK-20951 arm: imx: Update the mmdc io save/restore on imx7ulp

When system enters VLPS/VLLS mode, the IOMUXC config register
for MMDC related IO pads need to set to '0' to reduce the current
leakage for these IO pads.

Signed-off-by: Jacky Bai <ping.bai@nxp.com>
Reviewed-by: Anson Huang <Anson.Huang@nxp.com>
Signed-off-by: Arulpandiyan Vadivel <arulpandiyan_vadivel@mentor.com>
Signed-off-by: Shrikant Bobade <Shrikant_Bobade@mentor.com>
(cherry picked from commit acf5535cf6603fd5a68cb86c88a685d5f70db8d5)

MLK-20882: pxp: add VUY444 format support for PXP PS engine

VUY444 is supported by PXP HW but driver miss it. so add it

Signed-off-by: Guoniu.Zhou <guoniu.zhou@nxp.com>
(cherry picked from commit 57e9b876954170cd0718eb8af8666573ebb26bb4)
Signed-off-by: Arulpandiyan Vadivel <arulpandiyan_vadivel@mentor.com>
Signed-off-by: Shrikant Bobade <Shrikant_Bobade@mentor.com>
(cherry picked from commit 4e62c1fb7a8f1ef14ea35fe5d5294b17f18cebbe)

MLK-20060-6 dts: lpspi: Prevent CS line error in slave mode

Prevent cs line configuration error in slave mode.

If master mode uses cs-gpio configuration, it should be changed into
non-gpio for CS line in slave mode. Otherwise, slave will receive several
0xFF at the beginning of one transfer especially in dma mode.

Signed-off-by: Clark Wang <xiaoning.wang@nxp.com>
Acked-by: Fugang Duan <Fugang.duan@nxp.com>
Signed-off-by: Arulpandiyan Vadivel <arulpandiyan_vadivel@mentor.com>
Signed-off-by: Shrikant Bobade <Shrikant_Bobade@mentor.com>
(cherry picked from commit 88ba1025094d53fdecd1b443ef1a85514a132f21)

MLK-20368 i2c-imx: Coverity: fix divide by zero warning

"i2c_clk_rate / 2" might be zero when the i2c_clk_rate gets the clock is
0 or 1, so add a judgment to avoid the denominator is equal to 0.

Signed-off-by: Clark Wang <xiaoning.wang@nxp.com>
[Arul: Add support to check return value everywhere in the driver]
Signed-off-by: Arulpandiyan Vadivel <arulpandiyan_vadivel@mentor.com>
Signed-off-by: Shrikant Bobade <Shrikant_Bobade@mentor.com>
(cherry picked from commit d382de595bffc0975ab7c0582e08dd4f7afc0c1a)

MLK-20716 PCI: add quirk for cyw4356 to disable D3 mode

Add quirk for cyw4356 to disable D3 mode because current firmware
still doesn't support D3 mode.

Reviewed-by: Richard Zhu <hongxing.zhu@nxp.com>
Signed-off-by: Fugang Duan <fugang.duan@nxp.com>
Signed-off-by: Arulpandiyan Vadivel <arulpandiyan_vadivel@mentor.com>
Signed-off-by: Shrikant Bobade <Shrikant_Bobade@mentor.com>
(cherry picked from commit 22212c60d7fb067e28a2fed16914515e3d6d3950)

MLK-20389 Changed OPTEE busfreq trace

   To be able to constat that busfreq is started/done vith
   OPTEE OS, changed the mach-imx/busfreq_optee.c pr_debug
   macro with printk(KERN_DEBUG ...)

Signed-off-by: Cedric Neveux <cedric.neveux@nxp.com>
Signed-off-by: Arulpandiyan Vadivel <arulpandiyan_vadivel@mentor.com>
Signed-off-by: Shrikant Bobade <Shrikant_Bobade@mentor.com>
(cherry picked from commit 8e416ebaada127eeb408cf2e2ffc41202933eebb)

MLK-20582 Fix busfreq compilation CONFIG_OPTEE=n

   Compilation error with busfreq optee when CONFIG_OPTEE=n

Signed-off-by: Cedric Neveux <cedric.neveux@nxp.com>
Signed-off-by: Arulpandiyan Vadivel <arulpandiyan_vadivel@mentor.com>
Signed-off-by: Shrikant Bobade <Shrikant_Bobade@mentor.com>
(cherry picked from commit db9e345f9bd67048bcb17d9df306b35f64abbb14)

MLK-20682 reset: gpio-reset: add suspend/resume callback

The reset PIN may loss its state when system suspend due to GPIO
controller power off. Set pinctrl as "sleep" state to keep PIN
voltage during system suspend, and configurate pinctrl as "default"
state after system resume back. Because GPIO resume back earlier
than gpio-reset, then GPIO signal can control the PIN voltage again.

Reviewed-by: Richard Zhu <hongxing.zhu@nxp.com>
Signed-off-by: Fugang Duan <fugang.duan@nxp.com>
Signed-off-by: Arulpandiyan Vadivel <arulpandiyan_vadivel@mentor.com>
Signed-off-by: Shrikant Bobade <Shrikant_Bobade@mentor.com>
(cherry picked from commit ea5a9cdc1941afc36fd0f5a223ea762b85512130)

MLK-20585-2 usb: cdns3: gadget: fix the KASAN issue

BUG: KASAN: use-after-free in pending_setup_status_handler+0x4c/0x9c
Read of size 8 at addr ffff8008b2fb6130 by task kworker/0:1/4432

CPU: 0 PID: 4432 Comm: kworker/0:1 Not tainted 4.14.78-06631-gd2e1817-dirty #18
Hardware name: Freescale i.MX8QM MEK (DT)
Workqueue: events_freezable pending_setup_status_handler
Call trace:
[<ffff20000808dff8>] dump_backtrace+0x0/0x49c
[<ffff20000808e4a8>] show_stack+0x14/0x1c
[<ffff20000967b808>] dump_stack+0xa0/0xc8
[<ffff200008344f80>] print_address_description+0x124/0x2f8
[<ffff200008345404>] kasan_report+0x200/0x348
[<ffff200008343780>] __asan_load8+0x6c/0x84
[<ffff200008d897d8>] pending_setup_status_handler+0x4c/0x9c
[<ffff2000081236e4>] process_one_work+0x250/0x72c
[<ffff200008123c58>] worker_thread+0x98/0x69c
[<ffff20000812cd00>] kthread+0x170/0x1b0
[<ffff200008085cd8>] ret_from_fork+0x10/0x18

Allocated by task 4689:
 kasan_kmalloc.part.5+0x50/0x124
 kasan_kmalloc+0xc4/0xe4
 kmem_cache_alloc_trace+0x13c/0x298
 usb_ss_gadget_ep_alloc_request+0x48/0x50
 usb_ep_alloc_request+0x44/0x16c
 composite_dev_prepare+0x4c/0x1b8
 configfs_composite_bind+0x6c/0x694
 udc_bind_to_driver+0xcc/0x218
 usb_gadget_probe_driver+0x108/0x1b0
 gadget_dev_desc_UDC_store+0xf4/0x174
 configfs_write_file+0x184/0x25c
 vfs_write+0xf0/0x26c
 SyS_write+0x64/0xd4
 el0_svc_naked+0x34/0x38

Freed by task 3406:
 kasan_slab_free+0xb0/0x1c0
 kfree+0x7c/0x270
 usb_ss_gadget_ep_free_request+0x10/0x18
 usb_ep_free_request+0x44/0x158
 composite_dev_cleanup+0x188/0x230
 configfs_composite_unbind+0x48/0x80
 usb_gadget_remove_driver+0x84/0xf0
 usb_gadget_unregister_driver+0x10c/0x134
 gadget_dev_desc_UDC_store+0xa0/0x174
 configfs_write_file+0x184/0x25c
 vfs_write+0xf0/0x26c
 SyS_write+0x64/0xd4
 el0_svc_naked+0x34/0x38

The buggy address belongs to the object at ffff8008b2fb6100
 which belongs to the cache kmalloc-128 of size 128
The buggy address is located 48 bytes inside of
 128-byte region [ffff8008b2fb6100, ffff8008b2fb6180)
The buggy address belongs to the page:
page:ffff7e0022cbed80 count:1 mapcount:0 mapping:          (null) index:0x0

Reported-by: Yang Tian <yang.tian@nxp.com>
Tested-by: Yang Tian <yang.tian@nxp.com>
Signed-off-by: Peter Chen <peter.chen@nxp.com>
Signed-off-by: Arulpandiyan Vadivel <arulpandiyan_vadivel@mentor.com>
Signed-off-by: Shrikant Bobade <Shrikant_Bobade@mentor.com>
(cherry picked from commit 78d9001692cc77d1e0c60ada2e00b1d2afca92f0)

MLK-20585-1 usb: cdns3: gadget: fix the KASAN issue

BUG: KASAN: use-after-free in cdns3_gadget_remove+0x114/0x1d8
Read of size 8 at addr ffff80081f8817a0 by task swapper/0/1

CPU: 0 PID: 1 Comm: swapper/0 Not tainted 4.14.78-05577-gbe1ecd23b99a-dirty #231
Hardware name: Freescale i.MX8QXP MEK (DT)
Call trace:
[<ffff20000808cd10>] dump_backtrace+0x0/0x510
[<ffff20000808d234>] show_stack+0x14/0x20
[<ffff200009471d84>] dump_stack+0xa4/0xc8
[<ffff2000082966c0>] print_address_description+0x60/0x250
[<ffff200008296bb8>] kasan_report+0x240/0x308
[<ffff2000082952e0>] __asan_load8+0x88/0xb0
[<ffff200008d089cc>] cdns3_gadget_remove+0x114/0x1d8
[<ffff200008d0220c>] cdns3_probe+0x634/0x940
[<ffff2000089ebf10>] platform_drv_probe+0x70/0xf0
[<ffff2000089e9060>] driver_probe_device+0x388/0x5f0
[<ffff2000089e9414>] __driver_attach+0x14c/0x150
[<ffff2000089e5dd8>] bus_for_each_dev+0xd8/0x138
[<ffff2000089e8560>] driver_attach+0x30/0x40
[<ffff2000089e7c38>] bus_add_driver+0x278/0x3a0
[<ffff2000089ea27c>] driver_register+0xb4/0x198
[<ffff2000089ebe0c>] __platform_driver_register+0x7c/0x88
[<ffff20000a0d78e8>] cdns3_driver_platform_register+0x1c/0x24
[<ffff200008083cc0>] do_one_initcall+0x90/0x1b8
[<ffff20000a071040>] kernel_init_freeable+0x238/0x2d8
[<ffff20000948c2a8>] kernel_init+0x10/0x118
[<ffff200008085450>] ret_from_fork+0x10/0x18

Allocated by task 1:
 kasan_kmalloc+0xd8/0x188
 __cdns3_gadget_init+0xb8/0x998
 cdns3_gadget_init+0xbc/0xd0
 cdns3_probe+0x718/0x940
 platform_drv_probe+0x70/0xf0
 driver_probe_device+0x388/0x5f0
 __driver_attach+0x14c/0x150
 bus_for_each_dev+0xd8/0x138
 driver_attach+0x30/0x40
 bus_add_driver+0x278/0x3a0
 driver_register+0xb4/0x198
 __platform_driver_register+0x7c/0x88
 cdns3_driver_platform_register+0x1c/0x24
 do_one_initcall+0x90/0x1b8
 kernel_init_freeable+0x238/0x2d8
 kernel_init+0x10/0x118
 ret_from_fork+0x10/0x18

Freed by task 1:
 kasan_slab_free+0x88/0x188
 kfree+0x70/0x1e0
 cdns3_gadget_release+0x60/0x80
 device_release+0x44/0xd8
 kobject_put+0xd8/0x280
 device_unregister+0x28/0x80
 cdns3_gadget_remove+0x100/0x1d8
 cdns3_probe+0x634/0x940
 platform_drv_probe+0x70/0xf0
 driver_probe_device+0x388/0x5f0
 __driver_attach+0x14c/0x150
 bus_for_each_dev+0xd8/0x138
 driver_attach+0x30/0x40
 bus_add_driver+0x278/0x3a0
 driver_register+0xb4/0x198
 __platform_driver_register+0x7c/0x88
 cdns3_driver_platform_register+0x1c/0x24
 do_one_initcall+0x90/0x1b8
 kernel_init_freeable+0x238/0x2d8
 kernel_init+0x10/0x118
 ret_from_fork+0x10/0x18

The buggy address belongs to the object at ffff80081f881100
 which belongs to the cache kmalloc-4096 of size 4096
The buggy address is located 1696 bytes inside of
 4096-byte region [ffff80081f881100, ffff80081f882100)
The buggy address belongs to the page:
page:ffff7e00207e2000 count:1 mapcount:0 mapping:          (null) index:0x0 compound_mapcount: 0
flags: 0x1fffc00000008100(slab|head)
raw: 1fffc00000008100 0000000000000000 0000000000000000 0000000180070007
raw: dead000000000100 dead000000000200 ffff800822003200 0000000000000000
page dumped because: kasan: bad access detected

Reviewed-by: Jun Li <jun.li@nxp.com>
Signed-off-by: Peter Chen <peter.chen@nxp.com>
Signed-off-by: Arulpandiyan Vadivel <arulpandiyan_vadivel@mentor.com>
Signed-off-by: Shrikant Bobade <Shrikant_Bobade@mentor.com>
(cherry picked from commit 62683f2ada3da52981b7cf3775a9bab95de2b00f)

MLK-20599-2 usb: cdns3: gadget: fix link test TD 7.37

USB3 device should accept LGO_U1 request after receiving SET_CONFIGURATION.

Signed-off-by: Peter Chen <peter.chen@nxp.com>
Signed-off-by: Arulpandiyan Vadivel <arulpandiyan_vadivel@mentor.com>
Signed-off-by: Shrikant Bobade <Shrikant_Bobade@mentor.com>
(cherry picked from commit 4e1fc76ac36ebde235abe7dc0dc78a73ff9544b4)

MLK-20599-1 usb: cdns3: gadget: fix link test TD 7.23

The USB compliance link test TD 7.23 requires the U1 exit time
is from 900ns to 1.2us, the current code is 744ns, the default
value is 1.104us, so changing it as default value.

Signed-off-by: Peter Chen <peter.chen@nxp.com>
Signed-off-by: Arulpandiyan Vadivel <arulpandiyan_vadivel@mentor.com>
Signed-off-by: Shrikant Bobade <Shrikant_Bobade@mentor.com>
(cherry picked from commit be0a22ce7192387b98a887d3ce4358e1db71b9f4)

MLK-20371: video: fbdev: adv7535: Fix coverity issues

Fix structurally dead code reported by coverity. Assign the return value
to ret, instead of returning it so there will be a proper clean up.

Signed-off-by: Robert Chiras <robert.chiras@nxp.com>
Signed-off-by: Arulpandiyan Vadivel <arulpandiyan_vadivel@mentor.com>
Signed-off-by: Shrikant Bobade <Shrikant_Bobade@mentor.com>
(cherry picked from commit 0d0ca80d965144e38e9f860fbaab76547573c0b6)

MLK-20295: fbdev/mxsfb: Fix coverity issues

Fixing two coverity issues:
1. Checking disp_videomode against 0, which will always be true, since
disp_videomode is a char array. So, fix it by checking it's first byte
instead.
2. Possible division by zero, if clk_get_rate returns 0 (which is
possible).

Signed-off-by: Robert Chiras <robert.chiras@nxp.com>
Signed-off-by: Arulpandiyan Vadivel <arulpandiyan_vadivel@mentor.com>
Signed-off-by: Shrikant Bobade <Shrikant_Bobade@mentor.com>
(cherry picked from commit d2672125a376020dfc9aa87339be290d45b0d252)

MLK-20201 clk: imx: Fix coverity issue of CID 17326/17327

This patch fixes below coverity issues:

CID 17326/17327: Unintentional integer overflow (OVERFLOW_BEFORE_WIDEN)
overflow_before_widen: Potentially overflowing expression div *
parent_rate with type unsigned long (32 bits, unsigned) is evaluated
using 32-bit arithmetic, and then used in a context that expects an
expression of type u64 (64 bits, unsigned).

Signed-off-by: Anson Huang <Anson.Huang@nxp.com>
Reviewed-by: Bai Ping <ping.bai@nxp.com>
Signed-off-by: Arulpandiyan Vadivel <arulpandiyan_vadivel@mentor.com>
Signed-off-by: Shrikant Bobade <Shrikant_Bobade@mentor.com>
(cherry picked from commit 4bb630c8543c9346a0c21b4e42ad3949e7c6185d)

MLK-20598 dmaengine: imx-sdma: fix potential system hang

In multi audio play/stop case,sdma_alloc_chan_resources/
sdma_free_chan_resources will be called quickly, especially,dma done
interrupt comes after sdma_free_chan_resources, thus, system will be
hang in interrupt since it'll check sdma register but clocks have
already been disabled in sdma_free_chan_resources. To avoid it, enable
clock in isr.

Signed-off-by: Robin Gong <yibin.gong@nxp.com>
Signed-off-by: Arulpandiyan Vadivel <arulpandiyan_vadivel@mentor.com>
Signed-off-by: Shrikant Bobade <Shrikant_Bobade@mentor.com>
(cherry picked from commit 09b55a84522fbf404d6cd82b4640a93672c2aa27)

MA-13763 [#imx-1237] Fix fence signal memory leakage issue.

The signal id is missed when set to fence.
Then signal structure will not be freed at last.
Set correct signal id to fence to fix this issue.

Change-Id: I6a67dac0f6979183796cb8e9f2ac7aef6623ac00
Signed-off-by: Ivan.liu <xiaowen.liu@nxp.com>
Signed-off-by: Arulpandiyan Vadivel <arulpandiyan_vadivel@mentor.com>
Signed-off-by: Shrikant Bobade <Shrikant_Bobade@mentor.com>
(cherry picked from commit 2ce8ab2b7de5c6eb2f20421909839a747ed85d06)

MLK-18076-2: ASoC: fsl_asrc: support S8 format for p2p

support S8 format for p2p

Signed-off-by: Shengjiu Wang <shengjiu.wang@nxp.com>
Signed-off-by: Arulpandiyan Vadivel <arulpandiyan_vadivel@mentor.com>
Signed-off-by: Shrikant Bobade <Shrikant_Bobade@mentor.com>
(cherry picked from commit 52ec854864d4841d8f6798cfdf9cce8cf7ad4758)

MLK-18076-1: ASoC: fsl_asrc_m2m: support input width with 8bit

support input data width with 8bit for m2m

Signed-off-by: Shengjiu Wang <shengjiu.wang@nxp.com>
Signed-off-by: Arulpandiyan Vadivel <arulpandiyan_vadivel@mentor.com>
Signed-off-by: Shrikant Bobade <Shrikant_Bobade@mentor.com>
(cherry picked from commit 532bb31b14c304afd65c300da5d2fcc4cf13549f)

MLK-20541 cfg80211: fix phy index confliction with loadable test for multiple phys

The commit ae97fd867aa3 ("MLK-19091 cfg80211: make phy index match
after wiphy dev is released") manage wiphy_counter matching between
creating and freeing wiphy device. Then for one wifi instance, the index
of attached phy is not changed during loadable test. But it ignores
multiple wifi cards loadable test case, that introduces the phy index
confliction. So the patch revert the commit.

Reviewed-by: Richard Zhu <hongxing.zhu@nxp.com>
Signed-off-by: Fugang Duan <fugang.duan@nxp.com>
Signed-off-by: Arulpandiyan Vadivel <arulpandiyan_vadivel@mentor.com>
Signed-off-by: Shrikant Bobade <Shrikant_Bobade@mentor.com>
(cherry picked from commit 4bfe854b650f1e8bc46624d5f3b559f0112f327a)

MLK-20204: drivers: crypto: dcp: Check we have input data for AES

If the input scatter gather table is wrongly built (no entries), the
code will try to copy memory which is not allowed.

Coverity Explanation:
drivers/crypto/mxs-dcp.c:388: CID 5233058 (#1 of 1):
  Type: Out-of-bounds access (OVERRUN)
  Classification: Unclassified
  Severity: Unspecified
  Action: Modeling Required
  Owner: nxa21133
  First detected on 2018-10-16.
drivers/crypto/mxs-dcp.c:297:
  1. alias: Assigning: "out_buf" = "sdcp->coh->aes_out_buf". "out_buf"
  now points to byte 0 of "sdcp->coh->aes_out_buf" (which consists of
  4096 bytes).
drivers/crypto/mxs-dcp.c:301:
  2. assignment: Assigning: "last_out_len" = "0U".
drivers/crypto/mxs-dcp.c:316:
  3. path: Condition "!rctx->ecb", taking true branch.
drivers/crypto/mxs-dcp.c:321:
  4. path: Falling through to end of if statement.
drivers/crypto/mxs-dcp.c:325:
  5. path: Condition "i < nents", taking false branch.
drivers/crypto/mxs-dcp.c:386:
  6. path: Condition "!rctx->ecb", taking true branch.
drivers/crypto/mxs-dcp.c:387:
  7. path: Condition "rctx->enc", taking true branch.
drivers/crypto/mxs-dcp.c:388:
  8. overrun-buffer-arg: Overrunning buffer pointed to by "out_buf +
  (last_out_len - 16U)" of 4096 bytes by passing it to a function which
  accesses it at byte offset 4294967295 using argument "16U".

Signed-off-by: Franck LENORMAND <franck.lenormand@nxp.com>
Signed-off-by: Arulpandiyan Vadivel <arulpandiyan_vadivel@mentor.com>
Signed-off-by: Shrikant Bobade <Shrikant_Bobade@mentor.com>
(cherry picked from commit 26560456d04ec6fc147600ab5a92d06144c1da88)

MLK-20425-2 ARM: dts: imx7ulp-evkb: add GOODIX 911 touch support

Both the new MIPI panel (RK055IQH042 panel and RK055AHD042 panel)
use GOODIX 911 touch chip, so this patch add GOODIX 911 touch
support for imx7ulp-evkb board.

Signed-off-by: Haibo Chen <haibo.chen@nxp.com>
Signed-off-by: Arulpandiyan Vadivel <arulpandiyan_vadivel@mentor.com>
Signed-off-by: Shrikant Bobade <Shrikant_Bobade@mentor.com>
(cherry picked from commit 06145aa96bc2b28fa109f3e64fd0c9475082f32e)

MLK-20235 mmc: sdhci-of-esdhc: fix coverity uncheck return value issue.

CID 4058489: Unchecked return value (CHECKED_RETURN)
2. check_return: Calling dma_set_mask_and_coherent without checking
return value.

Signed-off-by: Arulpandiyan Vadivel <arulpandiyan_vadivel@mentor.com>
Signed-off-by: Shrikant Bobade <Shrikant_Bobade@mentor.com>
(cherry picked from commit 9df9165707c34b8c4efe0e89f97e93cca7a222a0)

MLK-20388-2: mtd: fsl-quadspi: use ioremap_wc to handle qspi unaligned access

Use ioremap_wc to handle unaligned qspi AHB read. Remove the previous
SW alignment handle for neat code.

Signed-off-by: Han Xu <han.xu@nxp.com>
Signed-off-by: Arulpandiyan Vadivel <arulpandiyan_vadivel@mentor.com>
Signed-off-by: Shrikant Bobade <Shrikant_Bobade@mentor.com>
(cherry picked from commit 07c7e72b0ed05beaf2c07d8e098e18c1e48ec634)

MLK-20388-1: mtd: fsl-flexspi: use ioremap_wc to handle fspi unaligned access

Use ioremap_wc to handle unaligned flexspi AHB read. Remove the previous
SW alignment handle for neat code.

Signed-off-by: Han Xu <han.xu@nxp.com>
Signed-off-by: Arulpandiyan Vadivel <arulpandiyan_vadivel@mentor.com>
Signed-off-by: Shrikant Bobade <Shrikant_Bobade@mentor.com>
(cherry picked from commit c180c525fd7b834ea0e07be4ca79fb8986a214cf)

Revert "PCI: imx6: Fix link training status detection in link up check"

This reverts commit 2a031cab71cd9909fa659c96b6221d1fe33ad87f.

Signed-off-by: Shrikant Bobade <Shrikant_Bobade@mentor.com>
(cherry picked from commit 91d66f481121b2eab56f5d829a0002f6bb47953e)

MLK-21589 VPU Decoder: implement insert decode header of
    RV format for Amphion decoder

    Insert sequence header, frame header and slice header for
    input buffer of RV format.
    Include rv8, rv9 and rv10, the header of rv9 and rv10 are
    the same.
    Extract an independent punction for copy buffer to ring
    stream buffer.

Signed-off-by: Shijie Qin <shijie.qin@nxp.com>

MLK-19341 brcmfmac: bcmsdh: add shutdown handler to avoid kernel panic on reboot

When running wlan interface up/down stress test in background then run
reboot command, there have kernel panic as below message.
This issue is fixed by doing cleanup in shutdown handler.

Unable to handle kernel paging request at virtual address 7f0e9040
pgd = 86c20000
[7f0e9040] *pgd=86ecd811, *pte=00000000, *ppte=00000000
Internal error: Oops: 7 [#1] PREEMPT SMP ARM
task: 8603c000 task.stack: 86040000
PC is at device_shutdown+0x198/0x204
LR is at _raw_spin_unlock_irq+0x28/0x54
pc : [<804ee520>]    lr : [<809a70dc>]    psr: 20030013
sp : 86041e60  ip : 00000000  fp : 80c5b7e4
r10: 80cb0b24  r9 : 80f7e020  r8 : 86b0b844
r7 : 80fdce84  r6 : 86b0b810  r5 : 80f34ef0  r4 : 86b0b81c
r3 : 7f0e9018  r2 : ffffffff  r1 : 00000002  r0 : 00000000
Flags: nzCv  IRQs on  FIQs on  Mode SVC_32  ISA ARM  Segment none
Control: 10c53c7d  Table: 86c2006a  DAC: 00000051
Process systemd-shutdow (pid: 1, stack limit = 0x86040210)
Stack: (0x86041e60 to 0x86042000)
1e60: 00000000 00000000 80f0f704 aef99500 fee1dead 80107c44 86040000 00000000
1e80: 7eee5fd4 8014bb74 00000000 8014bdcc 00000000 00000000 00000000 8020464c
1ea0: 87336540 00000000 00000000 00000000 861b24e0 87336548 00000024 00000002
1ec0: 00000000 00000005 0000001e 80205c34 00000000 00000000 1c4a66cc 87336540
1ee0: 00000000 86041f08 86041f80 00000000 00000000 80205d5c 86041f04 86041f08
1f00: 00000000 00000000 00000001 00000000 00000024 86041f20 00000005 7eee521c
1f20: 7eee5350 00000004 7eee5f1c 00000010 7eee5364 00000005 7eee53f4 0000000a
1f40: 76ece6fc 00000001 86005b00 00000005 fffffffe fffffffe 86d1a000 fffff000
1f60: 80107c44 87336540 87336540 00000000 7eee5318 80205df0 00000000 00000004
1f80: 00000000 00000000 00000000 7eee53f4 7eee5318 00000000 00000000 00000000
1fa0: 00000058 80107a60 00000000 00000000 fee1dead 28121969 01234567 aef99500
1fc0: 00000000 00000000 00000000 00000058 00000000 ffffffff 00000000 7eee5fd4
1fe0: 004a0e18 7eee5c44 0048afa4 76d0b5e0 60030010 fee1dead 00000000 00000000
[<804ee520>] (device_shutdown) from [<8014bb74>] (kernel_restart+0xc/0x50)
[<8014bb74>] (kernel_restart) from [<8014bdcc>] (SyS_reboot+0xc8/0x1ac)
[<8014bdcc>] (SyS_reboot) from [<80107a60>] (ret_fast_syscall+0x0/0x54)
Code: eaffffb5 e5943040 e3530000 0afffff3 (e5933028)
---[ end trace cb8c3d96d6f26a91 ]---

Reviewed-by: Richard Zhu <hongxing.zhu@nxp.com>
Signed-off-by: Fugang Duan <fugang.duan@nxp.com>

MLK-21611 brcmfmac: change message level for reading optional iovar data

Not all firmware set channel/ulp_sdioctrl, so change the error message
to debug level for reading chanspec/ulp_sdioctrl iovar data.

Reviewed-by: Richard Zhu <hongxing.zhu@nxp.com>
Signed-off-by: Fugang Duan <fugang.duan@nxp.com>