ARM: 7527/1: uaccess: explicitly check __user pointer when !CPU_USE_DOMAINS

The {get,put}_user macros don't perform range checking on the provided
__user address when !CPU_HAS_DOMAINS.

This patch reworks the out-of-line assembly accessors to check the user
address against a specified limit, returning -EFAULT if is is out of
range.

[will: changed get_user register allocation to match put_user]
[rmk: fixed building on older ARM architectures]

CRs-Fixed: 504011
Change-Id: I3818045a136fcdf72deb1371b132e090fd7ed643
Reported-by: Catalin Marinas <catalin.marinas@arm.com>
Signed-off-by: Will Deacon <will.deacon@arm.com>
Cc: stable@vger.kernel.org
Signed-off-by: Russell King <rmk+kernel@arm.linux.org.uk>
Git-commit: 8404663f81d212918ff85f493649a7991209fa04
Git-repo: git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
Signed-off-by: Laura Abbott <lauraa@codeaurora.org>
PM / QoS: Fix deadlock during PM QoS vote to default value

pm_qos_work_fn() calls pm_qos_update_request() which does
cancel_delayed_work_sync() on the same pm_qos_work_fn()
causing deadlock. Fix this by updating the target with
default timeout value directly instead of calling
pm_qos_update_request().

CRs-Fixed: 526216
Change-Id: I7de2fb1c89f87b0ebf7427116b8920aec50d5b2b
Signed-off-by: Sujit Reddy Thumma <sthumma@codeaurora.org>
Revert "msm: move printk out of spin lock low_water_lock"

This reverts commit 749c4210f338496abf2e16ef51308ff756b34f7b.

This patch is a hack intended to solve a particular instance of a more
generic problem. The cause of the spindump timeout has been fixed with
the commit f37a3dc536e4ecd72961a2d9c77f5587c5c55d8f. Furthermore this
change also introduces a race condition since the printk is actually
intended to be protected with the spinlock.

Change-Id: I8ca057f47760c7bb5b826cceeac92ae5e124e904
Signed-off-by: Syed Rameez Mustafa <rameezmustafa@codeaurora.org>
lib: spinlock_debug: increase spin dump timeout

On certain targets the worst case console buffer draining time can
exceed the aggressive spin dump timeout value. Relax the timeout value
to cater to these scenarios.

Change-Id: I7312ffe06bafd2dc7adf0f4e8b73a53fc5839235
Signed-off-by: Syed Rameez Mustafa <rameezmustafa@codeaurora.org>
msm: vidc: Add LTR feature for H264 encoder

This change adds Long Term Reference picture
selection feature for H264 video encoder.

Change-Id: Ida957df244d8715c955afe8d809708123a94e999
Signed-off-by: Maheshwar Ajja <majja@codeaurora.org>
block: Add URGENT request notification support to CFQ scheduler

When the scheduler reports to the block layer that there is an urgent
request pending, the device driver may decide to stop the transmission
of the current request in order to handle the urgent one. This is done
in order to reduce the latency of an urgent request. For example:
long WRITE may be stopped to handle an urgent READ.

Change-Id: I3072b8a1423870fed9c04c28d93caaf9557a7b89
Signed-off-by: Tatyana Brokhman <tlinder@codeaurora.org>
block: row: Remove warning massage from add_request

Regular priority queues is marked as "starved" if it skipped a dispatch
due to being empty. When a new request is added to a "starved" queue
it will be marked as urgent.
The removed WARN_ON was warning about an impossible case when a regular
priority (read) queue was marked as starved but wasn't empty. This is
a possible case due to the bellow:
If the device driver fetched a read request that is pending for
transmission and an URGENT request arrives, the fetched read will be
reinserted back to the scheduler. Its possible that the queue it will be
reinserted to was marked as "starved" in the meanwhile due to being empty.

CRs-fixed: 517800
Change-Id: Iaae642ea0ed9c817c41745b0e8ae2217cc684f0c
Signed-off-by: Tatyana Brokhman <tlinder@codeaurora.org>
jbd2: fix assertion failure in jbd2_journal_flush()

The following race is possible between start_this_handle() and someone
calling jbd2_journal_flush().

Process A                              Process B
start_this_handle().
  if (journal->j_barrier_count) # false
  if (!journal->j_running_transaction) { #true
    read_unlock(&journal->j_state_lock);
                                       jbd2_journal_lock_updates()
                                       jbd2_journal_flush()
                                         write_lock(&journal->j_state_lock);
                                         if (journal->j_running_transaction) {
                                           # false
                                         ... wait for committing trans ...
                                         write_unlock(&journal->j_state_lock);
    ...
    write_lock(&journal->j_state_lock);
    if (!journal->j_running_transaction) { # true
      jbd2_get_transaction(journal, new_transaction);
    write_unlock(&journal->j_state_lock);
    goto repeat; # eventually blocks on j_barrier_count > 0
                                         ...
                                         J_ASSERT(!journal->j_running_transaction);
                                           # fails

We fix the race by rechecking j_barrier_count after reacquiring j_state_lock
in exclusive mode.

Reported-by: yjwsignal@empal.com
Signed-off-by: Jan Kara <jack@suse.cz>
Signed-off-by: "Theodore Ts'o" <tytso@mit.edu>
Cc: stable@vger.kernel.org

CRs-Fixed: 468318
Change-Id: Ibe417ee5c50e257b7521b5ce8bbfa4e13547d4c5
Git-commit: d7961c7fa4d2e3c3f12be67e21ba8799b5a7238a
Git-repo: git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
Signed-off-by: Taniya Das <tdas@codeaurora.org>
fs: vfat: reduce the worst case latencies

When a block partition is mounted with FAT file system
and MS_DIRSYNC option is used, some file system operations
like create, rename shall sleep in caller's context until
all the metadata have been committed to the non-volatile memory.
Since this operation is blocking call for user context,
the WRITE_SYNC option must be used instead of WRITE
(async operation) which incur inherent latencies while
flushing the meta-data corresponding to directory entries

Change-Id: I41c514889873a39d564271db0a421e6c66e5ae33
Signed-off-by: xiaogang <xiaogang@codeaurora.org>
sysctl: Don't scan for the leaks on headers

These header allocations have life cycle till the device goes
shutdown. So, considering them as leak is false positive. Remove
them by marking kmemleak_not_leak

CRs-Fixed: 466552
Change-Id: Id1571b78365e533ddfe866d45cef8f89b0b62bc7
Signed-off-by: Chintan Pandya <cpandya@codeaurora.org>
msm_fb: hdmi: change HDMI_PHY_REG1 based on foundry.

Set value of HDMI_PHY_REG1[2:0] for output voltage swing control,
to prevent fallout for Vlow for GF foundry MSM's.

Change-Id: Ifb0f694226896fa1ad74dd84fb489f015901fc3e
Signed-off-by: Abhishek Kharbanda <akharban@codeaurora.org>
Signed-off-by: Mukesh Jha <cmjha@codeaurora.org>
msm_fb: hdmi: change HDMI_PHY_REG1 based on source.

Set value of HDMI_PHY_REG1[2:0] for output voltage swing control.

CRs-Fixed: 488207
Change-Id: I9aeba47491467a14a3141cf7688a95a2f43e80f5
Signed-off-by: Abhishek Kharbanda <akharban@codeaurora.org>
msm: display: Add DSI clock control for MDP GDHS power collapse

Enable DSI clock and regulator before enabling/disabling power collapse
for MDP GDHS.

(cherry picked from commit ad3200279e62eff01fd1bb9136cc9c0d11e10380)

(cherry picked from commit 58c5992c710df379e26bb210e00c74da501db9d2)

Change-Id: I76b91260c61abf214e688c0dea6989ed2cfa3801
Signed-off-by: Ravishangar Kalyanam <rkalya@codeaurora.org>
Signed-off-by: Siddhartha Agrawal <agrawals@codeaurora.org>
Signed-off-by: Ram Kumar Chakravarthy Chebathini <rcheba@codeaurora.org>
Signed-off-by: Dhivya Subramanian <dthiru@codeaurora.org>
msm: display: Proper handling of prepare and unprepare clocks

This change handles prepare and unprepare clocks properly to
fix clock mismatches.

Change-Id: I09986aa1f0e1a5be2e07655a1db0d23760dd0725
Signed-off-by: Sangani Suryanarayana Raju <csuryan@codeaurora.org>
Signed-off-by: Padmanabhan Komanduru <pkomandu@codeaurora.org>
msm_fb: display: Avoid dsi clock warnings during boot

Correctly set up the dsi_clk_rate in
cont_splash_clk_ctrl before enabling them.

Crs-fixed: 389531
Change-Id: Iee13e6d871ca1fdb7f3f45a5e3b36784145abd86
Signed-off-by: Mayank Goyal <goyalm@codeaurora.org>
msm_fb: display: Add compulsory wait after DTV's TG is disabled.

When DTV timing generator is disabled during dtv_off, a wait for
at least a frame period is required. This is done by waiting on
vsync. In some scenarios, vsync interrupt is received such that, no
wait really happens which results in MDP hangs.
Add wait for 20ms after TG is disabled, to ensure wait for at least
a frame period. Also, print timeout error in case wait for vsync
times out.

Change-Id: I960326e495bc8dc108bf6c6f1994ea3071f1c06d
Signed-off-by: Mayank Chopra <makchopra@codeaurora.org>
CHROMIUM: mm: Fix calculation of dirtyable memory

The system uses global_dirtyable_memory() to calculate
number of dirtyable pages/pages that can be allocated
to the page cache.  A bug causes an underflow thus making
the page count look like a big unsigned number.  This in turn
confuses the dirty writeback throttling to aggressively write
back pages as they become dirty (usually 1 page at a time).

Fix is to ensure there is no underflow while doing the math.

Signed-off-by: Sonny Rao <sonnyrao@chromium.org>
Signed-off-by: Puneet Kumar <puneetster@chromium.org>

BUG=chrome-os-partner:16011
TEST=Manual; boot kernel, powerwash, login with testaccount and
make sure no jank occurs on sync of applications

Change-Id: I614e7c3156e014f0f28a4ef9bdd8cb8a2cd07b2a
Reviewed-on: https://gerrit.chromium.org/gerrit/37612
Reviewed-by: Kees Cook <keescook@chromium.org>
Reviewed-by: Olof Johansson <olofj@chromium.org>
Commit-Ready: Puneet Kumar <puneetster@chromium.org>
Reviewed-by: Puneet Kumar <puneetster@chromium.org>
Tested-by: Puneet Kumar <puneetster@chromium.org>
CHROMIUM: zram: fix 32-bit overflow

The 64-bit division operator is not available in 32-bit kernels,
so have to use do_div.

BUG=chromium:245703
TEST=compiled

Change-Id: I44ab763ea9e115cef6212f6524518cf7d9eac8c7
Signed-off-by: Luigi Semenzato <semenzato@chromium.org>
Reviewed-on: https://gerrit.chromium.org/gerrit/64695
Reviewed-by: Doug Anderson <dianders@chromium.org>
CHROMIUM: zram: finish fixing 32-bit overflow

Nasty bug.  PAGE_MASK is unsigned, so it extends to 64 bit with zeros.
The first read in the zram block device is done by mkswap, which
tries to read at the end of device.  zram_set_disksize is a side
effect of the first read, so the disk size is now silently changed
from 6GB to 2GB.  The read fails, but mkswap does not complain either:
it finds the size of the device by trial and error and continues.
Swapon detects the mismatch and fails.

BUG=chromium:245703
TEST=ran before and after change with various printks
Signed-off-by: Luigi Semenzato <semenzato@chromium.org>

Change-Id: I01750554964756c2759375df1f14d7bb8b859ccf
Reviewed-on: https://gerrit.chromium.org/gerrit/65752
Tested-by: Luigi Semenzato <semenzato@chromium.org>
Reviewed-by: Mike Frysinger <vapier@chromium.org>
Commit-Queue: Luigi Semenzato <semenzato@chromium.org>
CHROMIUM: BACKPORT: lib/lzo: Update LZO compression to current upstream version

This commit updates the kernel LZO code to the current upsteam version
which features a significant speed improvement - benchmarking the Calgary
and Silesia test corpora typically shows a doubled performance in
both compression and decompression on modern i386/x86_64/powerpc machines.

Signed-off-by: Markus F.X.J. Oberhumer <markus@oberhumer.com>
(cherry picked from commit 8b975bd3f9089f8ee5d7bbfd798537b992bbc7e7)
Signed-off-by: Stephen Barber <smbarber@chromium.org>

BUG=chromium:269723
TEST=Boot and verify that read/write performance has improved by dd'ing
to /dev/zram0. Verify that checksum of decompressed data matches
original data.

Backported from Linux 3.9.

Change-Id: Iea48a73a45c38d4d78d140ed5efc3fcf60d07ca1
Reviewed-on: https://gerrit.chromium.org/gerrit/64995
Reviewed-by: Olof Johansson <olofj@chromium.org>
Commit-Queue: Stephen Barber <smbarber@chromium.org>
Tested-by: Stephen Barber <smbarber@chromium.org>