media: videobuf2-core: fix wrong jump

In error case handling, wrong jump was detected and fixed.

Change-Id: I76006903406354c69b232fa6eee22034bfae0101
Signed-off-by: Janghyuck Kim <janghyuck.kim@samsung.com>

media: scaler: improve alignment check

This patch improved alignment checking to make returning error instead
of the error interrupt after H/W operation.

Change-Id: I06df771d24fe5d1626bf4c33b6c1da1e1ecf3ba8
Signed-off-by: Janghyuck Kim <janghyuck.kim@samsung.com>

media: scaler: add job scheduling in buf_queue

buf_queue callback will be called when fence is signaled.
At that time, job should be tried to run because this buffer
queueing might satisfy the condition to work. Job would be never
triggered without this scheduling.

Change-Id: Iba5a25b1280e60b35f431266d289f1d5b2af5fdb
Signed-off-by: Janghyuck Kim <janghyuck.kim@samsung.com>

[COMMON] media: scaler: add version information

Change-Id: I64af7122ccc5fee89c57235a3e2c968d3300e2a0
Signed-off-by: Janghyuck Kim <janghyuck.kim@samsung.com>

[COMMON] media: scaler: apply 16 alignment for 2bit span

Span value of 2 bit should be 16 aligned.

Change-Id: Ibf26a8da49e14f7610f342596a4d87dbf303979f
Signed-off-by: Janghyuck Kim <janghyuck.kim@samsung.com>

[COMMON] media: scaler: fix middle buffer calculation

This patch added size calculation for 10bit pixel format to avoid page
fault when double scaling is operated with 10bit pixel format.

Change-Id: I1b00d991d08498131299f99476ccf398a6d77a2e
Signed-off-by: Janghyuck Kim <janghyuck.kim@samsung.com>

[COMMON] media: scaler: fix config value for S10B

Change-Id: I3c62349eb1dac8da032e34f64e7fe897cee9f13d
Signed-off-by: Janghyuck Kim <janghyuck.kim@samsung.com>

[COMMON] media: scaler: add byteswap seting for P010

When source format is P010, reading order is different than standard
format, so byteswap should be set to correct order.

Change-Id: Ib07d44edd98e29db95e006c470679f6b9bd80c42
Signed-off-by: Janghyuck Kim <janghyuck.kim@samsung.com>

[COMMON] media: scaler: fix condition for clk request

After 5.0.1 version, clk request setting is supported.

Change-Id: Iaf5d476e75ce93746e0c575e189698557b0f3296
Signed-off-by: Janghyuck Kim <janghyuck.kim@samsung.com>

[COMMON] media: scaler: add framerate interface for m2m1shot

framerate interface for m2m1shot is added and common setting code is
separated as common function.

Change-Id: I84a77a2e97dba857d2da8d45a43a5cf390a7c7f8
Signed-off-by: Janghyuck Kim <janghyuck.kim@samsung.com>

[COMMON] media: scaler: change clk request sequence

CLK request should be the first before scaler S/W reset.

Change-Id: I4e0133e141a6fd8ba79bf5b5c749a337775e6926
Signed-off-by: Janghyuck Kim <janghyuck.kim@samsung.com>

[COMMON] media: scaler: improve scaler SFR dump

This patch improved scaler SFR dump that reduced redundant dump and
added mandatory dump for debug status.

Change-Id: Icd5114d766135594948a3172493996b141e6cf63
Signed-off-by: Janghyuck Kim <janghyuck.kim@samsung.com>

[COMMOn] g2d: enable secure mode when self protection

G2D always enable the secure mode before the job
is executed to enable the firewall regardless of
self protection.

Change-Id: Ie1ff1528d5f83563c1ee202254a826edda97a8c1
Signed-off-by: hyesoo.yu <hyesoo.yu@samsung.com>

g2d: fix using virt_to_phys against stack variable

If CONFIG_VMAP_STACK is enabled, kernel stack is not physically linear
any more. Instead, it is allocated from vmap area and virt_to_phys and
similar macros are not available on that area.

G2D driver needs to get phyical address of a structure that describes
job properties to deliver the information to the secure world if G2D
H/W is not capable of protecting secure content leak.

Instead allocating the descriptor from the kernel stack, it is now
placed in g2d_task. It helps reducing data redundancy because all
values of the descriptor are also stored in g2d_task.

Change-Id: I91f9c9c5f3806890b4625db87e8b01627d58e5a0
Signed-off-by: Cho KyongHo <pullip.cho@samsung.com>

g2d: handle fence errors

dma_fence supports delivering error to the fence waiters. The fences
with error are also signaled like good fences. The waiters then should
check if the signaled fence has error status.
G2D driver now checks the status of all signaled before pushing a task
to H/W. If it finds an error from  the fences, it does not run H/W with
the task and push the back to the free task pool after resolving all
acquired resources including fences attached to the task. If the task
has a release fence, it is also signaled with -EIO error status.
G2D driver also signals release fences with error status when the a
fence is timed out or H/W does not incur interrupt until the deadline.
Signaling release fence with an error is helpful for the system
stability because the reader of the G2D output can determine if the
data from G2D is complete.

Change-Id: Ia54fafed45d1f8f0e0e1c2e3e81f084746ef02e5
Signed-off-by: Cho KyongHo <pullip.cho@samsung.com>

[COMMON] g2d: schedule the task directly on ioctl

Task of g2d should be scheduled on process context
due to power management, so every task are executed
on workqueue. However, task on state that all
fences are signaled on ioctl could be scheduled
directly without queueing and it make remove the delay
for workqueue.

Change-Id: I72475096165237eccba8172e0c8a7d9e6e3c34c9
Signed-off-by: hyesoo.yu <hyesoo.yu@samsung.com>

[COMMON] g2d: split timer as purpose

One timer is used for two purposes, but it may cause
unexpected race condition between timer handler
and deletion, initialization for another purpose.

So, we seperate timers into two for each purpose.

Change-Id: I44831a4a7b663d75c5d5d4297a78e245f3b4d3ef
Signed-off-by: hyesoo.yu <hyesoo.yu@samsung.com>

[COMMON] g2d: fix the compat ioctl

The variable of buffer is corrupted while looping,
so incorrect data is written to the user's area in
the loop.

And user address of buffer is possible to be
corrupted when union variable is not initialized,
so fix it.

Change-Id: I5bb38eb4dd548a868153a32ebd5b31a76a20f112
Signed-off-by: Hyesoo Yu <hyesoo.yu@samsung.com>

media: vb2: fix missing iovmm_unmap in vb2-dma-sg

Change-Id: Id5d9cb3c4c687b5daf5ad339cb67e990056551ab
Signed-off-by: Seungchul Kim <sc377.kim@samsung.com>

[COMMON] ion: fix conflicts

Change-Id: I250c65be08f436f8cef3fc00674587a74886ea61
Signed-off-by: Cho KyongHo <pullip.cho@samsung.com>

[COMMON] ion: add ion_exynos_dma_buf_start[end]_cpu_access

The function provides cache flush for the buffer
if start[end] of cpu access from dmabuf framework
has direction of DMA_BIDIRECTIONAL even if there
is no attached device.

Change-Id: I22800e0abcc51b7f4e93d1d58dc55c0fd84901bb
Signed-off-by: hyesoo.yu <hyesoo.yu@samsung.com>

Revert "android: ion: add dmabuf cpu access ops for exynos"

This reverts commit 6e3e01a3504e7873d16777b1bf3f2ee54ec97cb7.

Change-Id: I843b42d82681c25fbec7df58710e2b00cd70caf6

[COMMON] ion: skip cache maintenance when DMA_NONE

Change-Id: Ifd6fc48d15a7d5b1330431e8bf0366441e2e9dba
Signed-off-by: hyesoo.yu <hyesoo.yu@samsung.com>

[COMMON] g2d: remove unnecessary sharable mapping

e3364c5c3c68 [COMMON] iommu/exynos: set sharable mapping for dma coherent device
6d648acaeb84 [COMMON] ion: set sharable mapping for dma coherent device

The iovmm mapping of dma coherent device is always
treated sharable mapping on exynos for cachable
memory.

Change-Id: I7b770f90f2a6cb3af8c6ef987109a33b747325a3
Signed-off-by: hyesoo.yu <hyesoo.yu@samsung.com>

[COMMON] ion: set sharable mapping for dma coherent device

Change-Id: Ia2c32882772adc6a8f8cce3a4de28f24d44f9e98
Signed-off-by: hyesoo.yu <hyesoo.yu@samsung.com>

[COMMON] ion: send aligned size to secure OS

Change-Id: I172f426a3289b3d8f26853e43fcd219d12e994c6
Signed-off-by: hyesoo.yu <hyesoo.yu@samsung.com>

[COMMON] g2d: release hwfc buffer when error happens

Change-Id: I561e8eefdebc3dca5d60e4c7945e89e5f4121725
Signed-off-by: hyesoo.yu <hyesoo.yu@samsung.com>

[COMMON] g2d: add debug code to measure the LLWFD latency

Change-Id: Ib9660284ef5bb133b14b922056b153a22bba4a7b
Signed-off-by: Seungpyo Hong <sp.hong@samsung.com>

[COMMON] g2d: enable to lock device frequency

Change-Id: I377499a8d7c351f17a7a7c2aa8aed8e8e1ebdc05
Signed-off-by: hyesoo.yu <hyesoo.yu@samsung.com>

Revert "[HACK] g2d: ignore performance request"

This reverts commit fe08c179382bccf66d82d0d92dfedb9b4f5586a6.

Change-Id: I8d328282366ff72bbe331d9b60c0bd5c81205906
Signed-off-by: hyesoo.yu <hyesoo.yu@samsung.com>

[COMMON] g2d: increase max extra regs for coefficient

Change-Id: I3ab380c8663198e35d60ff9eb3fc7c9c61af150b
Signed-off-by: hyesoo.yu <hyesoo.yu@samsung.com>

g2d: add complete support for Exynos9610

commit 46f75b91e ('[COMMON] g2d: add support for Exynos9610') is
cherry-picked from the middle of the patch development for the branch
android-exynos-4.14-mcd-dev.
That is why the above commit is incomplete.
So, the rest part of the complete commit to in
android-exynos-4.14-mcd-dev is now applied.

Change-Id: Ia3b6ea635a24c74425f05d15ba20ff5d85f5c6f1
Signed-off-by: Cho KyongHo <pullip.cho@samsung.com>

media: vb2: Fix videobuf2 to map correct area

[ Upstream commit d13a0139d7874a0577b5955d6eed895517d23b72 ]

Fixes vb2_vmalloc_get_userptr() to ioremap correct area.
Since the current code does ioremap the page address, if the offset > 0,
it does not do ioremap the last page and results in kernel panic.

This fixes to pass the size + offset to ioremap so that ioremap
can map correct area. Also, this uses __pfn_to_phys() to get the physical
address of given PFN.

Change-Id: Ic03697b0f12932995d2f0602b05394f72a1464df
Signed-off-by: Masami Hiramatsu <mhiramat@kernel.org>
Reported-by: Takao Orito <orito.takao@socionext.com>
Reported-by: Fumihiro ATSUMI <atsumi@infinitegra.co.jp>
Reviewed-by: Marek Szyprowski <m.szyprowski@samsung.com>
Signed-off-by: Hans Verkuil <hans.verkuil@cisco.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

media: vb2: replace iovmm api supported by ion

The iovmm api doesn't support system MMU mapping
of protected buffer. It is supported in exynos ion side.
We replace iovmm api to support protected buffer.

Change-Id: Ie6fe3f0fc2c877b31f0b7be7f23fe4492049a019
Signed-off-by: hyesoo.yu <hyesoo.yu@samsung.com>

ANDROID: v4l2-ioctl: fix function types for IOCTL_INFO_STD

Bug: 67506682
Change-Id: I0bfdb4a198e8fb8719ac6aa884fd39e163dbf762
Signed-off-by: Sami Tolvanen <samitolvanen@google.com>

media: v4l2-compat-ioctl32: don't oops on overlay

commit 85ea29f19eab56ec16ec6b92bc67305998706afa upstream.

At put_v4l2_window32(), it tries to access kp->clips. However,
kp points to an userspace pointer. So, it should be obtained
via get_user(), otherwise it can OOPS:

 vivid-000: ==================  END STATUS  ==================
 BUG: unable to handle kernel paging request at 00000000fffb18e0
 IP: [<ffffffffc05468d9>] __put_v4l2_format32+0x169/0x220 [videodev]
 PGD 3f5776067 PUD 3f576f067 PMD 3f5769067 PTE 800000042548f067
 Oops: 0001 [#1] SMP
 Modules linked in: vivid videobuf2_vmalloc videobuf2_memops v4l2_dv_timings videobuf2_core v4l2_common videodev media xt_CHECKSUM iptable_mangle ipt_MASQUERADE nf_nat_masquerade_ipv4 iptable_nat nf_nat_ipv4 nf_nat nf_conntrack_ipv4 nf_defrag_ipv4 xt_conntrack nf_conntrack tun bridge stp llc ebtable_filter ebtables ip6table_filter ip6_tables bluetooth rfkill binfmt_misc snd_hda_codec_hdmi i915 snd_hda_intel snd_hda_controller snd_hda_codec intel_rapl x86_pkg_temp_thermal snd_hwdep intel_powerclamp snd_pcm coretemp snd_seq_midi kvm_intel kvm snd_seq_midi_event snd_rawmidi i2c_algo_bit drm_kms_helper snd_seq drm crct10dif_pclmul e1000e snd_seq_device crc32_pclmul snd_timer ghash_clmulni_intel snd mei_me mei ptp pps_core soundcore lpc_ich video crc32c_intel [last unloaded: media]
 CPU: 2 PID: 28332 Comm: v4l2-compliance Not tainted 3.18.102+ #107
 Hardware name:                  /NUC5i7RYB, BIOS RYBDWi35.86A.0364.2017.0511.0949 05/11/2017
 task: ffff8804293f8000 ti: ffff8803f5640000 task.ti: ffff8803f5640000
 RIP: 0010:[<ffffffffc05468d9>]  [<ffffffffc05468d9>] __put_v4l2_format32+0x169/0x220 [videodev]
 RSP: 0018:ffff8803f5643e28  EFLAGS: 00010246
 RAX: 0000000000000000 RBX: 0000000000000000 RCX: 00000000fffb1ab4
 RDX: 00000000fffb1a68 RSI: 00000000fffb18d8 RDI: 00000000fffb1aa8
 RBP: ffff8803f5643e48 R08: 0000000000000001 R09: ffff8803f54b0378
 R10: 0000000000000000 R11: 0000000000000168 R12: 00000000fffb18c0
 R13: 00000000fffb1a94 R14: 00000000fffb18c8 R15: 0000000000000000
 FS:  0000000000000000(0000) GS:ffff880456d00000(0063) knlGS:00000000f7100980
 CS:  0010 DS: 002b ES: 002b CR0: 0000000080050033
 CR2: 00000000fffb18e0 CR3: 00000003f552b000 CR4: 00000000003407e0
 Stack:
  00000000fffb1a94 00000000c0cc5640 0000000000000056 ffff8804274f3600
  ffff8803f5643ed0 ffffffffc0547e16 0000000000000003 ffff8803f5643eb0
  ffffffff81301460 ffff88009db44b01 ffff880441942520 ffff8800c0d05640
 Call Trace:
  [<ffffffffc0547e16>] v4l2_compat_ioctl32+0x12d6/0x1b1d [videodev]
  [<ffffffff81301460>] ? file_has_perm+0x70/0xc0
  [<ffffffff81252a2c>] compat_SyS_ioctl+0xec/0x1200
  [<ffffffff8173241a>] sysenter_dispatch+0x7/0x21
 Code: 00 00 48 8b 80 48 c0 ff ff 48 83 e8 38 49 39 c6 0f 87 2b ff ff ff 49 8d 45 1c e8 a3 ce e3 c0 85 c0 0f 85 1a ff ff ff 41 8d 40 ff <4d> 8b 64 24 20 41 89 d5 48 8d 44 40 03 4d 8d 34 c4 eb 15 0f 1f
 RIP  [<ffffffffc05468d9>] __put_v4l2_format32+0x169/0x220 [videodev]
 RSP <ffff8803f5643e28>
 CR2: 00000000fffb18e0

Tested with vivid driver on Kernel v3.18.102.

Same bug happens upstream too:

 BUG: KASAN: user-memory-access in __put_v4l2_format32+0x98/0x4d0 [videodev]
 Read of size 8 at addr 00000000ffe48400 by task v4l2-compliance/8713

 CPU: 0 PID: 8713 Comm: v4l2-compliance Not tainted 4.16.0-rc4+ #108
 Hardware name:  /NUC5i7RYB, BIOS RYBDWi35.86A.0364.2017.0511.0949 05/11/2017
 Call Trace:
  dump_stack+0x5c/0x7c
  kasan_report+0x164/0x380
  ? __put_v4l2_format32+0x98/0x4d0 [videodev]
  __put_v4l2_format32+0x98/0x4d0 [videodev]
  v4l2_compat_ioctl32+0x1aec/0x27a0 [videodev]
  ? __fsnotify_inode_delete+0x20/0x20
  ? __put_v4l2_format32+0x4d0/0x4d0 [videodev]
  compat_SyS_ioctl+0x646/0x14d0
  ? do_ioctl+0x30/0x30
  do_fast_syscall_32+0x191/0x3f4
  entry_SYSENTER_compat+0x6b/0x7a
 ==================================================================
 Disabling lock debugging due to kernel taint
 BUG: unable to handle kernel paging request at 00000000ffe48400
 IP: __put_v4l2_format32+0x98/0x4d0 [videodev]
 PGD 3a22fb067 P4D 3a22fb067 PUD 39b6f0067 PMD 39b6f1067 PTE 80000003256af067
 Oops: 0001 [#1] SMP KASAN
 Modules linked in: vivid videobuf2_vmalloc videobuf2_dma_contig videobuf2_memops v4l2_tpg v4l2_dv_timings videobuf2_v4l2 videobuf2_common v4l2_common videodev xt_CHECKSUM iptable_mangle ipt_MASQUERADE nf_nat_masquerade_ipv4 iptable_nat nf_nat_ipv4 nf_nat nf_conntrack_ipv4 nf_defrag_ipv4 xt_conntrack nf_conntrack libcrc32c tun bridge stp llc ebtable_filter ebtables ip6table_filter ip6_tables bluetooth rfkill ecdh_generic binfmt_misc snd_hda_codec_hdmi intel_rapl x86_pkg_temp_thermal intel_powerclamp i915 coretemp snd_hda_intel snd_hda_codec kvm_intel snd_hwdep snd_hda_core kvm snd_pcm irqbypass crct10dif_pclmul crc32_pclmul snd_seq_midi ghash_clmulni_intel snd_seq_midi_event i2c_algo_bit intel_cstate snd_rawmidi intel_uncore snd_seq drm_kms_helper e1000e snd_seq_device snd_timer intel_rapl_perf
  drm ptp snd mei_me mei lpc_ich pps_core soundcore video crc32c_intel
 CPU: 0 PID: 8713 Comm: v4l2-compliance Tainted: G    B            4.16.0-rc4+ #108
 Hardware name:  /NUC5i7RYB, BIOS RYBDWi35.86A.0364.2017.0511.0949 05/11/2017
 RIP: 0010:__put_v4l2_format32+0x98/0x4d0 [videodev]
 RSP: 0018:ffff8803b9be7d30 EFLAGS: 00010282
 RAX: 0000000000000000 RBX: ffff8803ac983e80 RCX: ffffffff8cd929f2
 RDX: 1ffffffff1d0a149 RSI: 0000000000000297 RDI: 0000000000000297
 RBP: 00000000ffe485c0 R08: fffffbfff1cf5123 R09: ffffffff8e7a8948
 R10: 0000000000000001 R11: fffffbfff1cf5122 R12: 00000000ffe483e0
 R13: 00000000ffe485c4 R14: ffff8803ac985918 R15: 00000000ffe483e8
 FS:  0000000000000000(0000) GS:ffff880407400000(0063) knlGS:00000000f7a46980
 CS:  0010 DS: 002b ES: 002b CR0: 0000000080050033
 CR2: 00000000ffe48400 CR3: 00000003a83f2003 CR4: 00000000003606f0
 Call Trace:
  v4l2_compat_ioctl32+0x1aec/0x27a0 [videodev]
  ? __fsnotify_inode_delete+0x20/0x20
  ? __put_v4l2_format32+0x4d0/0x4d0 [videodev]
  compat_SyS_ioctl+0x646/0x14d0
  ? do_ioctl+0x30/0x30
  do_fast_syscall_32+0x191/0x3f4
  entry_SYSENTER_compat+0x6b/0x7a
 Code: 4c 89 f7 4d 8d 7c 24 08 e8 e6 a4 69 cb 48 8b 83 98 1a 00 00 48 83 e8 10 49 39 c7 0f 87 9d 01 00 00 49 8d 7c 24 20 e8 c8 a4 69 cb <4d> 8b 74 24 20 4c 89 ef 4c 89 fe ba 10 00 00 00 e8 23 d9 08 cc
 RIP: __put_v4l2_format32+0x98/0x4d0 [videodev] RSP: ffff8803b9be7d30
 CR2: 00000000ffe48400

Change-Id: I07273310c5dd671eed74faf1f38446ac3d840553
cc: stable@vger.kernel.org
Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
Reviewed-by: Sakari Ailus <sakari.ailus@linux.intel.com>
Reviewed-by: Hans Verkuil <hans.verkuil@cisco.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

media: videobuf2-core: don't go out of the buffer range

[ Upstream commit df93dc61b0d8b19a5c9db545cf3fcc24f88dfde4 ]

Currently, there's no check if an invalid buffer range
is passed. However, while testing DVB memory mapped apps,
I got this:

   videobuf2_core: VB: num_buffers -2143943680, buffer 33, index -2143943647
   unable to handle kernel paging request at ffff888b773c0890
   IP: __vb2_queue_alloc+0x134/0x4e0 [videobuf2_core]
   PGD 4142c7067 P4D 4142c7067 PUD 0
   Oops: 0002 [#1] SMP
   Modules linked in: xt_CHECKSUM iptable_mangle ipt_MASQUERADE nf_nat_masquerade_ipv4 iptable_nat nf_nat_ipv4 nf_nat nf_conntrack_ipv4 nf_defrag_ipv4 xt_conntrack nf_conntrack tun bridge stp llc ebtable_filter ebtables ip6table_filter ip6_tables bluetooth rfkill ecdh_generic binfmt_misc rc_dvbsky sp2 ts2020 intel_rapl x86_pkg_temp_thermal dvb_usb_dvbsky intel_powerclamp dvb_usb_v2 coretemp m88ds3103 kvm_intel i2c_mux dvb_core snd_hda_codec_hdmi crct10dif_pclmul crc32_pclmul videobuf2_vmalloc videobuf2_memops snd_hda_intel ghash_clmulni_intel videobuf2_core snd_hda_codec rc_core mei_me intel_cstate snd_hwdep snd_hda_core videodev intel_uncore snd_pcm mei media tpm_tis tpm_tis_core intel_rapl_perf tpm snd_timer lpc_ich snd soundcore kvm irqbypass libcrc32c i915 i2c_algo_bit drm_kms_helper
   e1000e ptp drm crc32c_intel video pps_core
   CPU: 3 PID: 1776 Comm: dvbv5-zap Not tainted 4.14.0+ #78
   Hardware name:                  /NUC5i7RYB, BIOS RYBDWi35.86A.0364.2017.0511.0949 05/11/2017
   task: ffff88877c73bc80 task.stack: ffffb7c402418000
   RIP: 0010:__vb2_queue_alloc+0x134/0x4e0 [videobuf2_core]
   RSP: 0018:ffffb7c40241bc60 EFLAGS: 00010246
   RAX: 0000000080360421 RBX: 0000000000000021 RCX: 000000000000000a
   RDX: ffffb7c40241bcf4 RSI: ffff888780362c60 RDI: ffff888796d8e130
   RBP: ffffb7c40241bcc8 R08: 0000000000000316 R09: 0000000000000004
   R10: ffff888780362c00 R11: 0000000000000001 R12: 000000000002f000
   R13: ffff8887758be700 R14: 0000000000021000 R15: 0000000000000001
   FS:  00007f2849024740(0000) GS:ffff888796d80000(0000) knlGS:0000000000000000
   CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
   CR2: ffff888b773c0890 CR3: 000000043beb2005 CR4: 00000000003606e0
   Call Trace:
    vb2_core_reqbufs+0x226/0x420 [videobuf2_core]
    dvb_vb2_reqbufs+0x2d/0xc0 [dvb_core]
    dvb_dvr_do_ioctl+0x98/0x1d0 [dvb_core]
    dvb_usercopy+0x53/0x1b0 [dvb_core]
    ? dvb_demux_ioctl+0x20/0x20 [dvb_core]
    ? tty_ldisc_deref+0x16/0x20
    ? tty_write+0x1f9/0x310
    ? process_echoes+0x70/0x70
    dvb_dvr_ioctl+0x15/0x20 [dvb_core]
    do_vfs_ioctl+0xa5/0x600
    SyS_ioctl+0x79/0x90
    entry_SYSCALL_64_fastpath+0x1a/0xa5
   RIP: 0033:0x7f28486f7ea7
   RSP: 002b:00007ffc13b2db18 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
   RAX: ffffffffffffffda RBX: 000055b10fc06130 RCX: 00007f28486f7ea7
   RDX: 00007ffc13b2db48 RSI: 00000000c0086f3c RDI: 0000000000000007
   RBP: 0000000000000203 R08: 000055b10df1e02c R09: 000000000000002e
   R10: 0036b42415108357 R11: 0000000000000246 R12: 0000000000000000
   R13: 00007f2849062f60 R14: 00000000000001f1 R15: 00007ffc13b2da54
   Code: 74 0a 60 8b 0a 48 83 c0 30 48 83 c2 04 89 48 d0 89 48 d4 48 39 f0 75 eb 41 8b 42 08 83 7d d4 01 41 c7 82 ec 01 00 00 ff ff ff ff <4d> 89 94 c5 88 00 00 00 74 14 83 c3 01 41 39 dc 0f 85 f1 fe ff
   RIP: __vb2_queue_alloc+0x134/0x4e0 [videobuf2_core] RSP: ffffb7c40241bc60
   CR2: ffff888b773c0890

So, add a sanity check in order to prevent going past array.

Change-Id: I926c2bdd3b1f412a4f48ce9b6d5efd18470e233b
Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
Acked-by: Sakari Ailus <sakari.ailus@linux.intel.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

Revert "[HACK] g2d: enable self protection not to use smc call"

This reverts commit e72811145b3b24d9c54b0445d025ffe79139b497.

Change-Id: Ia272efa0a66aad3a98778413dbf14d716ffea2d7
Signed-off-by: Cho KyongHo <pullip.cho@samsung.com>

media: tsmux: add reordering_pes_private_data() function

The tsmux HAL will not support to reorder the input/stream counter.
The tsmux driver will support that.

Change-Id: Ib4839d257f1bdfcca129f43f2a870d48e96ecc1c
Signed-off-by: Seungpyo Hong <sp.hong@samsung.com>

media: tsmux: add spin lock to protect m2m rtp seq number

Change-Id: I57db1b1bc74319af712d9dc39f91f4d47cd70f15
Signed-off-by: shinwon.lee <shinwon.lee@samsung.com>

media: tsmux: modify build option for tsmux and repeater

Change-Id: Iaf7bf98482f81ec35025d6a53d4c26b469e58373
Signed-off-by: shinwon.lee <shinwon.lee@samsung.com>

media: repeater: remove the old ion interface

Change-Id: I84fbc23c260f38207cd2a37d502c609ede66bfec
Signed-off-by: shinwon.lee <shinwon.lee@samsung.com>

media: tsmux: control the TSP continuity counter by sfr

Change-Id: I50f1761d53fa3860c43ed0cf259f75bcf78f8ca6
Signed-off-by: Seungpyo Hong <sp.hong@samsung.com>

media: tsmux: remov the old ion interface

Change-Id: I5f4977fcaf45a1be739d4c06fea811a113d51d95
Signed-off-by: Seungpyo Hong <sp.hong@samsung.com>

media: tsmux: fix include header file

Change-Id: I036ebb420f444b3548b59c36525933a6479c36c5
Signed-off-by: shinwon.lee <shinwon.lee@samsung.com>

media: repeater: init version

Change-Id: I64a3967087873f5fbc48b2d145d1648b31f4d03c
Signed-off-by: shinwon.lee <shinwon.lee@samsung.com>

media: tsmux: init version

Change-Id: I482433ad032068c39884d12b71a80e804bc8f81b
Signed-off-by: shinwon.lee <shinwon.lee@samsung.com>

[COMMON] tsmux: add header file

Change-Id: Ifcf87f240479dcbec56ebf0efa8e6b81a81a52d6
Signed-off-by: shinwon.lee <shinwon.lee@samsung.com>

[COMMON] iommu/exynos: set sharable mapping for dma coherent device

Change-Id: I9036ff34b860eb9bd698a4e8a938fca5d3dabb4e
Signed-off-by: hyesoo.yu <hyesoo.yu@samsung.com>

[COMMON] iommu/exynos: add checking TLB entries

TLB checking is added when SysMMU fault occurred.
It compares TLB value to page table entry and displays message if it
doesn't refered different entries.

Change-Id: I6599f7bb04f548093dc60e528466fd7f6a81cb30
Signed-off-by: Janghyuck Kim <janghyuck.kim@samsung.com>

[COMMON] iommu/exynos: fix prevent issue

This patch fixed BITSHIFT_MIGHT_OVERFLOW issue that was detected by
prevent.

Change-Id: I59d662f3d2d3e671cacd51349253ff8871b1e8f3
Signed-off-by: Janghyuck Kim <janghyuck.kim@samsung.com>

[COMMON] iommu/exynos: add checking SBB entries

This patch added SBB entries checking that comparing to page table, and
displays message when it cached different address.

Change-Id: I562633813afa771419e5124811469d431d866a96
Signed-off-by: Janghyuck Kim <janghyuck.kim@samsung.com>

[COMMON] iommu/exynos: improve SLPD logging

When SLPD is allocated and freed, logging for base address is added.

Change-Id: I19ea17808278f455b5faf3db3fddffdd9beec73e
Signed-off-by: Janghyuck Kim <janghyuck.kim@samsung.com>

Android-P: Change the build rule of dtbo image

Change-Id: Iea712679a44df21f10377c8fc192675e9104f60e
Signed-off-by: Taein, An <taein.an@samsung.com>

[9610] arch:arm64:dts: enable AVB for vendor partition

[Description]
Enable AVB for vendor partition

Platform Development Team
Shinkyu Park (shinkyu.park@samsung.com)

Change-Id: I704eca545297793aa43771df5212dc27d4e1c673
Signed-off-by: Youngwan Kim <y103.kim@samsung.com>

Android-P: rename ro.hardware to exynos9610

In android-P ro.arch is not accessible in vendor partition
For resolving this problem, I substitude ro.arch as ro.hardware.

Change-Id: If9cfa3e58a59189ded00fb3b43649d8518ef6557
Signed-off-by: Youngwan Kim <y103.kim@samsung.com>

Android-P: DTB is inlcluded in second section of bootimage

Change-Id: I86839752e878254378a7b3493eacaecec3defff1
Signed-off-by: Youngwan Kim <y103.kim@samsung.com>

Android-P: Add DTBOIMAGE to android build system

Change-Id: I09b20cda5d03f02d5f80b505e8d1b27dac68c6e4
Signed-off-by: Youngwan Kim <y103.kim@samsung.com>

Android-P: Add DTBO build sequnce

Change-Id: I5c73a923bea56269cae4d02e0a773ee087592d48
Signed-off-by: Youngwan Kim <y103.kim@samsung.com>

[9610][ERD] Add dtboimg config file

Change-Id: I9787cc493b0cca2472129713a7cc78106edb858b
Signed-off-by: Changki Kim <changki.kim@samsung.com>

[9610][ERD] arm64: dts: fix dtbo build error

Change-Id: Icf92c6699f2119b200ada3ec0d28a8d97d8277d6
Signed-off-by: Youngmin Nam <youngmin.nam@samsung.com>

[COMMON] arch: arm64: Support to build dtbo

Change-Id: I4032912aedf24ab68125cad91f5da81408049381
Signed-off-by: Youngmin Nam <youngmin.nam@samsung.com>

[COMMON] script: dtc: remove build error

This patch remove build error after applying
"Update dtc for Device Tree Overlay"

FATAL ERROR: Unrecognized check name "simple_bus_reg"
make[2]: *** [arch/arm64/boot/dts/exynos/exynos7-espresso.dtb] Error 1
make[2]: *** Waiting for unfinished jobs....
FATAL ERROR: Unrecognized check name "simple_bus_reg"
make[2]: *** [arch/arm64/boot/dts/exynos/exynos5433-tm2e.dtb] Error 1
FATAL ERROR: Unrecognized check name "simple_bus_reg"
make[2]: *** [arch/arm64/boot/dts/exynos/exynos5433-tm2.dtb] Error 1
FATAL ERROR: Unrecognized check name "simple_bus_reg"
make[2]: *** [arch/arm64/boot/dts/exynos/exynos9810.dtb] Error 1
make[1]: *** [arch/arm64/boot/dts/exynos] Error 2
make: *** [dtbs] Error 2
make: *** Waiting for unfinished jobs....

Change-Id: I23919357ca3e24821dd5dbb6ace47b80b2f2fe47
Signed-off-by: Hyunki Koo <hyunki00.koo@samsung.com>

[COMMON] script: dtc: Update dtc for Device Tree Overlay

Change-Id: I00b8471767b066b614d979517b85d520007b07f3
Signed-off-by: Changki Kim <changki.kim@samsung.com>

[9610] arm64: dts: apply dtbo image build

Change-Id: I2222ed5aada69604295cda0364f08e2f18ecff8c
Signed-off-by: Youngmin Nam <youngmin.nam@samsung.com>

[9610][ERD] arm64: dts: enable dtbo overlay to make dtbo image

Change-Id: If498f7478282dabb32df5889e40ac2ace73fe916
Signed-off-by: Youngmin Nam <youngmin.nam@samsung.com>

[9610] arm64: dts: add SoC dts file to make dtbo image

Change-Id: I3ecd2787761768dc4bf9537e9cc8d1c406916392
Signed-off-by: Youngmin Nam <youngmin.nam@samsung.com>

[9610] drivers: modem_if: Remove device node name print during rx_demux error

Change-Id: If9dc23a822b3bc83cc3a2b5e945eb7a98fd51b53
Signed-off-by: Taejin Kim <tj7.kim@samsung.com>

[9610] drivers: modem_if: Fix checkpatch issue

Change-Id: I26c04dba9830942b8a97aaf98df14d876ce91358
Signed-off-by: Jiyoung Jeong <ji_0.jeong@samsung.com>

[9610] drivers: misc: For the consistency of rx_demux logic

When rx_demux call, error handling instead of higher layer function

Change-Id: I319bb8642d53bc215ed9b8a6606dd3e8439a5367
Signed-off-by: Jiyoung Jeong <ji_0.jeong@samsung.com>

[9610] drivers: mcu_ipc: Add debug log to verify CP memory map

Change-Id: Ia4651cde60d4d3329963e1ed8ef05b95ed7bfbf5
Signed-off-by: Jiyoung Jeong <ji_0.jeong@samsung.com>

[9610] tcp: clear tp->packets_out when purging write queue

Clear tp->packets_out when purging the write queue, otherwise
tcp_rearm_rto() mistakenly assumes TCP write queue is not empty.
This results in NULL pointer dereference.

Also, remove the redundant `tp->packets_out = 0` from
tcp_disconnect(), since tcp_disconnect() calls
tcp_write_queue_purge().

Change-Id: If7e959a4adf6a830ff551bcf2452f15dcb7ccdab
Fixes: a27fd7a8ed38 (tcp: purge write queue upon RST)
Reported-by: Subash Abhinov Kasiviswanathan <subashab@codeaurora.org>
Reported-by: Sami Farin <hvtaifwkbgefbaei@gmail.com>
Tested-by: Sami Farin <hvtaifwkbgefbaei@gmail.com>
Signed-off-by: Eric Dumazet <edumazet@google.com>
Signed-off-by: Soheil Hassas Yeganeh <soheil@google.com>
Acked-by: Yuchung Cheng <ycheng@google.com>
Acked-by: Neal Cardwell <ncardwell@google.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

[9610] drivers: modem_if: Remove redundant ap2cp_status for dump

Add waiting cp2ap status enable

Change-Id: Ie8ae6dbe4bacc7111f2236fe275b387c34e0683e
Signed-off-by: Jiyoung Jeong <ji_0.jeong@samsung.com>

Revert "[HACK] iommu/exynos: fix compile error"

This reverts commit 99ee2e11f8522bf0dee40b7aee1eab497d2ecd2f.

Change-Id: Ie0139d3f23b860acbba9a9b50816a8e8b3a1a571

[9610] soc: samsung: Add secmem

Change-Id: I89c984a9331e0e9da21254441a36149e73a5c9f4
Signed-off-by: DongHyun Cha <dhyun.cha@samsung.com>
Signed-off-by: Jungtae Kim <jt1217.kim@samsung.com>

[COMMON] spi: s3c64xx: check xfer length in DMA spi_map and unmap

When transfer length is smaller than fifo-size in DMA mode,
it is transferred by CPU mode not DMA. This patch makes spi_map
function not executed in this case.

Change-Id: Iec9f52f83b1a8abefed67af3276f2194df90e9e4
Signed-off-by: myung-su.cha <myung-su.cha@samsung.com>

[9610] soc: samsung: el3_mon: Invalidate smc_debug_mem

smc_debug_mem has been used as shared memory between
SWd and NWd. Therefore, Kernel needs to invalidate
this memory before reading it.

Change-Id: I0d99ebf681bfee97dc8bf96067a4d90e37960d98
Signed-off-by: Junho Choi <junhosj.choi@samsung.com>

[9610] soc: samsung: el3_mon: Delete unused codes

This code is not used any more.

Change-Id: I42d183a5d72c43bef897b3c05d4ee6f9681c8e34
Signed-off-by: Junho Choi <junhosj.choi@samsung.com>

[COMMON] lib: dss: fix processor ID when scheduling

Change-Id: I65bef72f54930f0374a5a2a722e7adb85a3e54cb
Signed-off-by: Donghyeok Choe <d7271.choe@samsung.com>

[COMMON] arm64: traps: Add to print callstack in last information

Change-Id: I6e20a80adc72e4d11e912605d1559dbc331dd3b0
Signed-off-by: Changki Kim <changki.kim@samsung.com>

[9610][ERD] arm64: configs: enable coresight for debugging

Change-Id: Ic10e725525d76a69e15eb991bc7d0a1945bf5aa2
Signed-off-by: Donghyeok Choe <d7271.choe@samsung.com>

[9610] arm64: dtsi: add coresight entry

Change-Id: Ie6761967ce0f0a48b3b27ca0eaff03bd5de7a598
Signed-off-by: Donghyeok Choe <d7271.choe@samsung.com>

[COMMON] samsung: debug: add coresight for debugging

Change-Id: I45cd528009297eba86e8c5a6fea0eac206a6adb2
Signed-off-by: Donghyeok Choe <d7271.choe@samsung.com>

[9610] samsung: debug: fix watchdog config name

Change-Id: I2be359091ed88f062e1fb75f047f9f3c13127f2d
Signed-off-by: Donghyeok Choe <d7271.choe@samsung.com>

[9610] fimc-is2: Disable a sensor vc tasklet

PR JIRA ID: CPR-47

Change-Id: I3ee47ad7894c1eea3244b4451f3bbcf9b91405d5
Signed-off-by: dan huh <dan.huh@samsung.com>

[COMMON] fimc-is2: Modify a use tasklet and function

- When sensor vc tasklet delayed, already dqbuf group leader
  so access a group leader at tasklet, unable to handle kernel paging

PR JIRA ID: CPR-47

Change-Id: I5fa23a92ce340956f6a71c7aa476c3acf1fc7490
Signed-off-by: dan huh <dan.huh@samsung.com>

[COMMON] media: mfc: remove debug mode when "But error"

If the result has error in s5p_mfc_wait_for_done_ctx()  the debug mode
generates panic. If there is an error stream, panic will always occur.
So this removes the debug mode in that case.

Change-Id: I89b124fdb41ca8fe7ca16cc9cd7d3251011242d7
Signed-off-by: Sunyoung Kang <sy0816.kang@samsung.com>

fbdev: dpu20: added decon bgr565 pixcel format

Change-Id: Idd9d27d16dd10bc22f714086485dd94bc13d887d
Signed-off-by: ChiHun Won <chihun.won@samsung.com>

fbdev: dpu20: AFBC debug patch modified

- added sgtables for each afbc channel for the buffer dump
- name change (vgf -> afbc)

Change-Id: I3daa0e361800658c40798316a3bc4212d0973d7a
Signed-off-by: Min Ho Kim <m8891.kim@samsung.com>
Signed-off-by: ChiHun Won <chihun.won@samsung.com>

fbdev: dpu20: AFBC debug feature code changed

- due to common layer, general concept for AFBC channel
has been applied

Change-Id: I6a98aa396e02d398b760af7e179ad9fcb89fed13
Signed-off-by: Min Ho Kim <m8891.kim@samsung.com>
Signed-off-by: ChiHun Won <chihun.won@samsung.com>

[9610] arm64: dts: updated dpu dma hw restriction

Change-Id: I00aaca1fef5210202547e4d34aedb976ea844e0f
Signed-off-by: ChiHun Won <chihun.won@samsung.com>

fbdev: dpu20: added acquire fence logging

Change-Id: I6aba0ba31c43aa16579ad4f5829213dae1cc742c
Signed-off-by: ChiHun Won <chihun.won@samsung.com>

[9610] fbdev: dpu20: fixed dpu null pointer exception

Change-Id: I017138815d129f22fccab48f01509da624de5507
Signed-off-by: ChiHun Won <chihun.won@samsung.com>

fbdev: dpu20: fixed dpu null pointer exception

Change-Id: I27906b12ddecec8744e8ab56561f13e23c8f9a25
Signed-off-by: ChiHun Won <chihun.won@samsung.com>

[9610] wlbt: increment scsc_release to 6.36.1

Import FW for iteration 6.36.1

Change-Id: I1831fabff7a91ed83f877d7142cc6b1284e5ade8
SCSC-Bug-Id: scsc_release_6.36.1
Signed-off-by: Ivan Priest <i.priest@samsung.com>

[9610][7885][7872][7570] wlbt: reprint last service failure reason

Buffer the reason string from scsc_mx_service_failed() and reprint it
whenever a mxman_open() is rejected due to WLBT being in the failed
state. This allows historical failure reasons to be determined
more easily when they have scrolled out of the kernel log.

Change-Id: I28d7df1aba12b0b55912605071b8c3d2e80e6e76
SCSC-Bug-Id: SSB-39469
Signed-off-by: Ivan Priest <i.priest@samsung.com>

[7885] Driver crash on startup

For single band solutions, do not access the 5g channels

Change-Id: Iaf7ad26129eb43795fb03bc73cae9f58ef4409ef
SCSC-Bug-Id: SSB-37249
Signed-off-by: Himani Gupta <himani.g2@samsung.com>

[9610] wlbt: files in /data/misc move to /data/vendor

Some log files generated in /data/misc move to /data/vendor
for P Treble compliance.

Change-Id: I155af88fd91a86bb36c4747ad7b6f78855790338
SCSC-Bug-Id: SSB-41803
Signed-off-by: Ivan Priest <i.priest@samsung.com>

[9610] wlbt: add regdom revision to .wifiver.info file

1) Move the .wifiver.info file from common code to
Wi-Fi service driver.
2) Read regdom revision from a new added MIB and
print it in .wifiver.info file

Change-Id: I1d72abc92d15d3d9e5cdf72a301ca6459b24aa2e
SCSC-Bug-Id: SSB-41300
Signed-off-by: Debabrata Purohit <d.purohit@samsung.com>
Signed-off-by: Albert Cano <a.canocamps@samsung.com>

[9610][7885][7872][7570] wlbt: Correction to host configuration of ctwindow

Driver converts ctwindow from msec to TU on the FAPI interface. This
is not required as configuration received in driver is in TU. Hence
reverting conversion.

SCSC-Bug-Id: SSB-30843
Change-Id: Iff3ef5138839cb65c579a94bfdf4c94d31812f5b
Signed-off-by: raj.chandra <raj.chandra@samsung.com>