mm compaction: fix of improper cache flush in migration code

commit c2cc499c5bcf9040a738f49e8051b42078205748 upstream.

Page 'new' during MIGRATION can't be flushed with flush_cache_page().
Using flush_cache_page(vma, addr, pfn) is justified only if the page is
already placed in process page table, and that is done right after
flush_cache_page().  But without it the arch function has no knowledge
of process PTE and does nothing.

Besides that, flush_cache_page() flushes an application cache page, but
the kernel has a different page virtual address and dirtied it.

Replace it with flush_dcache_page(new) which is the proper usage.

The old page is flushed in try_to_unmap_one() before migration.

This bug takes place in Sead3 board with M14Kc MIPS CPU without cache
aliasing (but Harvard arch - separate I and D cache) in tight memory
environment (128MB) each 1-3days on SOAK test.  It fails in cc1 during
kernel build (SIGILL, SIGBUS, SIGSEG) if CONFIG_COMPACTION is switched
ON.

Signed-off-by: Leonid Yegoshin <Leonid.Yegoshin@imgtec.com>
Cc: Leonid Yegoshin <yegoshin@mips.com>
Acked-by: Rik van Riel <riel@redhat.com>
Cc: Michal Hocko <mhocko@suse.cz>
Acked-by: Mel Gorman <mgorman@suse.de>
Cc: Ralf Baechle <ralf@linux-mips.org>
Cc: Russell King <rmk@arm.linux.org.uk>
Cc: David Miller <davem@davemloft.net>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

(cherry picked from commit 11e88c5e7bbb812ed25f1e6a8e98d334f0e7dc38)

Change-Id: I4e02a9b7697934a92d1721a5c5aaf54d3a61a24f
Reviewed-on: http://gerrit.pcs.mot.com/556258
Submit-Approved: Jira Key <jirakey@motorola.com>
Tested-by: Jira Key <jirakey@motorola.com>
Reviewed-by: Klocwork kwcheck <klocwork-kwcheck@sourceforge.mot.com>
Reviewed-by: Christopher Fries <c.fries@motorola.com>
SLT-Approved: Christopher Fries <c.fries@motorola.com>
mm: mmu_notifier: re-fix freed page still mapped in secondary MMU

commit d34883d4e35c0a994e91dd847a82b4c9e0c31d83 upstream.

Commit 751efd8610d3 ("mmu_notifier_unregister NULL Pointer deref and
multiple ->release()") breaks the fix 3ad3d901bbcf ("mm: mmu_notifier:
fix freed page still mapped in secondary MMU").

Since hlist_for_each_entry_rcu() is changed now, we can not revert that
patch directly, so this patch reverts the commit and simply fix the bug
spotted by that patch

This bug spotted by commit 751efd8610d3 is:

    There is a race condition between mmu_notifier_unregister() and
    __mmu_notifier_release().

    Assume two tasks, one calling mmu_notifier_unregister() as a result
    of a filp_close() ->flush() callout (task A), and the other calling
    mmu_notifier_release() from an mmput() (task B).

                        A                               B
    t1                                            srcu_read_lock()
    t2            if (!hlist_unhashed())
    t3                                            srcu_read_unlock()
    t4            srcu_read_lock()
    t5                                            hlist_del_init_rcu()
    t6                                            synchronize_srcu()
    t7            srcu_read_unlock()
    t8            hlist_del_rcu()  <--- NULL pointer deref.

This can be fixed by using hlist_del_init_rcu instead of hlist_del_rcu.

The another issue spotted in the commit is "multiple ->release()
callouts", we needn't care it too much because it is really rare (e.g,
can not happen on kvm since mmu-notify is unregistered after
exit_mmap()) and the later call of multiple ->release should be fast
since all the pages have already been released by the first call.
Anyway, this issue should be fixed in a separate patch.

-stable suggestions: Any version that has commit 751efd8610d3 need to be
backported.  I find the oldest version has this commit is 3.0-stable.

[akpm@linux-foundation.org: tweak comments]
Signed-off-by: Xiao Guangrong <xiaoguangrong@linux.vnet.ibm.com>
Tested-by: Robin Holt <holt@sgi.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

(cherry picked from commit bfd7610d981cd0fab6d68576c638c8e7550f3e51)

Change-Id: Idca453c713225fdaad5fc835c8c50dd6003536cc
Reviewed-on: http://gerrit.pcs.mot.com/556259
Submit-Approved: Jira Key <jirakey@motorola.com>
Tested-by: Jira Key <jirakey@motorola.com>
Reviewed-by: Klocwork kwcheck <klocwork-kwcheck@sourceforge.mot.com>
Reviewed-by: Christopher Fries <c.fries@motorola.com>
SLT-Approved: Christopher Fries <c.fries@motorola.com>
ARM: 7755/1: handle user space mapped pages in flush_kernel_dcache_page

Commit f8b63c1 made flush_kernel_dcache_page a no-op assuming that
the pages it needs to handle are kernel mapped only.  However, for
example when doing direct I/O, pages with user space mappings may
occur.

Thus, continue to do lazy flushing if there are no user space
mappings.  Otherwise, flush the kernel cache lines directly.

Signed-off-by: Simon Baatz <gmbnomis@gmail.com>
Reviewed-by: Catalin Marinas <catalin.marinas@arm.com>
Cc: <stable@vger.kernel.org> # 3.2+
Signed-off-by: Russell King <rmk+kernel@arm.linux.org.uk>
(cherry picked from commit 1bc39742aab09248169ef9d3727c9def3528b3f3)
Change-Id: Ifbb3e2ec2236a3145cd8ce0be0ea27517a1ca322
Reviewed-on: http://gerrit.pcs.mot.com/556260
Submit-Approved: Jira Key <jirakey@motorola.com>
Tested-by: Jira Key <jirakey@motorola.com>
Reviewed-by: Klocwork kwcheck <klocwork-kwcheck@sourceforge.mot.com>
Reviewed-by: Christopher Fries <c.fries@motorola.com>
SLT-Approved: Christopher Fries <c.fries@motorola.com>
mm: migration: add migrate_entry_wait_huge()

commit 30dad30922ccc733cfdbfe232090cf674dc374dc upstream.

When we have a page fault for the address which is backed by a hugepage
under migration, the kernel can't wait correctly and do busy looping on
hugepage fault until the migration finishes.  As a result, users who try
to kick hugepage migration (via soft offlining, for example) occasionally
experience long delay or soft lockup.

This is because pte_offset_map_lock() can't get a correct migration entry
or a correct page table lock for hugepage.  This patch introduces
migration_entry_wait_huge() to solve this.

Signed-off-by: Naoya Horiguchi <n-horiguchi@ah.jp.nec.com>
Reviewed-by: Rik van Riel <riel@redhat.com>
Reviewed-by: Wanpeng Li <liwanp@linux.vnet.ibm.com>
Reviewed-by: Michal Hocko <mhocko@suse.cz>
Cc: Mel Gorman <mgorman@suse.de>
Cc: Andi Kleen <andi@firstfloor.org>
Cc: KOSAKI Motohiro <kosaki.motohiro@jp.fujitsu.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

(cherry picked from commit f517dfe6d161bf37a9355c86ea5cb605b06d5963)

Change-Id: I57afc43f4ac9056d57daf12293a69445ed43d315
Reviewed-on: http://gerrit.pcs.mot.com/556261
Submit-Approved: Jira Key <jirakey@motorola.com>
Tested-by: Jira Key <jirakey@motorola.com>
Reviewed-by: Christopher Fries <c.fries@motorola.com>
SLT-Approved: Christopher Fries <c.fries@motorola.com>
ARM: 7772/1: Fix missing flush_kernel_dcache_page() for noMMU

commit 63384fd0b1509acf522a8a8fcede09087eedb7df upstream.

Commit 1bc3974 (ARM: 7755/1: handle user space mapped pages in
flush_kernel_dcache_page) moved the implementation of
flush_kernel_dcache_page() into mm/flush.c but did not implement it
on noMMU ARM.

Signed-off-by: Simon Baatz <gmbnomis@gmail.com>
Acked-by: Kevin Hilman <khilman@linaro.org>
Signed-off-by: Russell King <rmk+kernel@arm.linux.org.uk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

(cherry picked from commit a5f9dc0a79f24b79ed088d910c0fa3c30f52e305)

Change-Id: Ifdcf192ffa28d68f798551df7a64fb22ff27d75c
Reviewed-on: http://gerrit.pcs.mot.com/556262
Submit-Approved: Jira Key <jirakey@motorola.com>
Tested-by: Jira Key <jirakey@motorola.com>
Reviewed-by: Klocwork kwcheck <klocwork-kwcheck@sourceforge.mot.com>
SLT-Approved: Christopher Fries <c.fries@motorola.com>
Reviewed-by: Igor Kovalenko <cik009@motorola.com>
Revert "sched: Add missing call to calc_load_exit_idle()"

This reverts commit 48f0f14ffb6ff4852922994d11fbda418d40100e which was
commit 749c8814f08f12baa4a9c2812a7c6ede7d69507d upstream.

It seems to be misapplied, and not needed for 3.4-stable

Reported-by: Paul Gortmaker <paul.gortmaker@windriver.com>
Cc: Charles Wang <muming.wq@taobao.com>
Cc: Peter Zijlstra <a.p.zijlstra@chello.nl>
Cc: Ingo Molnar <mingo@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

(cherry picked from commit 6d96e9394365dfddf5d418d8178ce2a503448c29)

Change-Id: Ib313482e9acf24d95ccb1df811c6bcfecaf6f191
Reviewed-on: http://gerrit.pcs.mot.com/556263
Submit-Approved: Jira Key <jirakey@motorola.com>
Tested-by: Jira Key <jirakey@motorola.com>
Reviewed-by: Klocwork kwcheck <klocwork-kwcheck@sourceforge.mot.com>
Reviewed-by: Christopher Fries <c.fries@motorola.com>
SLT-Approved: Christopher Fries <c.fries@motorola.com>
ASoC: wcd9310: Fix DMIC current leakage after disable

Observed after disabling DMIC path, some DMICs observe
power leakage of around 2mA and affecting power numbers.
This happens due to the DMIC clock runs off MCLK. 2 Stage
of Dividers are used to  generate various DMIC Clock Freq.
Since the SW Enable/Disabling is async to MCLK, the Divider
will either hold the last stage 0 or 1.
Manually force the digital mic clock pin to GPIO mode from
functional mode through the TLMM mux option and force the value
of DMIC voltage to 0V. This will avoid any current leakage.

CRs-Fixed: 504468
Change-Id: I720fadda77b59454feb1a64d0c4951a6c09de66c
Signed-off-by: Laxminath Kasam <lkasam@codeaurora.org>
Merge "msm_fb: display: Add compulsory wait after DTV's TG is disabled."
msm: bam_dmux: trigger modem subsystem restart in case of timeout

If bam_dmux times out waiting for a power collapse protocol response from
the modem, bam_dmux assumes the modem has crashed and will disable itself
until the subsystem restart callback is triggered.

Change the behavior in bam_dmux to request that the modem subsystem
restarts regardless of its current state so that the restart callback is
always triggered.

CRs-Fixed: 495690
Change-Id: I076ab16dd727694feb68b9e9052b1b6a60a2b0ca
Signed-off-by: Jeffrey Hugo <jhugo@codeaurora.org>
(cherry picked from commit 747eeec6978b88f8d0ddb954cc2af77d003b2f30)
Reviewed-on: http://gerrit.pcs.mot.com/554727
Submit-Approved: Jira Key <jirakey@motorola.com>
Tested-by: Jira Key <jirakey@motorola.com>
Reviewed-by: Jayachandran C <xnq784@motorola.com>
Reviewed-by: Klocwork kwcheck <klocwork-kwcheck@sourceforge.mot.com>
Reviewed-by: Igor Kovalenko <cik009@motorola.com>
Reviewed-by: Sathish Karunakaran <w18372@motorola.com>
SLT-Approved: Christopher Fries <c.fries@motorola.com>
msm: kgsl: Set alignment to 0 when low on mapped memory

If CPU map returns error due to low memory then we need to set
the alignment to 0 and instead of setting it to PAGE_OFFSET. This
is because we then simply search of a free memory gap at page
boundary and disrerard alignment requirement since memory is
low.

Change-Id: I828f5d0120d6d530e0e8857bcd96c9d5f266da10
Signed-off-by: Shubhraprakash Das <sadas@codeaurora.org>
msm: kgsl: Set proper pagetable address immediately after recovery

Update the MMU with proper pagetable address immediately after
recovery to avoid any translations with old pagetable.

Change-Id: Ib929598363e48a42b8ae174ed9718402541f5b09
Signed-off-by: Rajesh Kemisetti <rajeshk@codeaurora.org>
USB: EHCI:  Ensure 10 msec delay between bus states

According to EHCI specification, software must wait for at least 10 msec
after a port indicates that it is suspended before initiating a port
resume.  The current code uses jiffies and fails to give the delay if
suspend and resume happens at the timer tick boundaries.

The correct implementation would be ensuring this delay by using hrtimers
or ktime_get().  This involves changing many drivers.  Hence workaround
it by increasing the state change delay to 2 jiffies.

CRs-Fixed: 521047
Change-Id: I703210cca83d649d1b253e971dfba8f62c6ccb8c
Signed-off-by: Pavankumar Kondeti <pkondeti@codeaurora.org>
perf: Treat attr.config as u64 in perf_swevent_init()

Trinity discovered that we fail to check all 64 bits of
attr.config passed by user space, resulting to out-of-bounds
access of the perf_swevent_enabled array in
sw_perf_event_destroy().

Introduced in commit b0a873ebb ("perf: Register PMU
implementations").

Signed-off-by: Tommi Rantala <tt.rantala@gmail.com>
Cc: Peter Zijlstra <a.p.zijlstra@chello.nl>
Cc: davej@redhat.com
Cc: Paul Mackerras <paulus@samba.org>
Cc: Arnaldo Carvalho de Melo <acme@ghostprotocols.net>
Signed-off-by: Ingo Molnar <mingo@kernel.org>
Patch-mainline: linux-kernel @ 04/13/13, 19:49
Signed-off-by: Deepak Katragadda <dkatraga@codeaurora.com>
msm: kgsl: Use the kmalloc/vmalloc trick for the sharedmem page array

It was previously assumed that most GPU memory allocations would be
small enough to allow us to fit the array of page pointers into one
or two pages allocated via kmalloc.  Recent reports have proven
those assumptions to be wrong - allocations on the order of 32MB will
end up trying to get 8 pages from kmalloc and 8 contiguous pages
on a busy system are a rare beast indeed.

So use the usual kmalloc/vmalloc trick instead - use kmalloc for the
page array when we can and vmalloc if we can't.

CRs-fixed: 513469
Change-Id: Ic0dedbad0a5b14abe6a8bd73342b3e68faa8c8b7
Signed-off-by: Jordan Crouse <jcrouse@codeaurora.org>
Merge "perf: Treat attr.config as u64 in perf_swevent_init()"
msm: 8064-pmic: Update the maximum current supported by LEDs

LEDs on 8064 can support 12mA. Update the platform data
for LED to reflect the same.

CRs-fixed: 514882
Change-Id: I012051f63e39f90123373c78e4280bf008e1bbea
Signed-off-by: Mohan Pallaka <mpallaka@codeaurora.org>
gpu: ion: Free the sgtable for CMA based heaps

When an sgtable is allocated with sg_alloc_table, the table needs
to be destroyed in addition to being freed. Destroy the sgtable
when freeing the associated memory.

Change-Id: Iedba81146ba453070790f071848f86826f7eec9c
Signed-off-by: Laura Abbott <lauraa@codeaurora.org>
Signed-off-by: Srinivasarao P <spathi@codeaurora.org>
wcnss: Do not log CCPU registers

Accessing CCPU registers during WDI timeout can cause timeout issues
when common_ss is power collapsed. So remove the CCPU register dump from
reset intrrupt API.

Change-Id: I4945d827c1840e85e796c276c45f7cf23cbe2b2a
CRs-Fixed: 517940
Signed-off-by: Sameer Thalappil <sameert@codeaurora.org>

Conflicts:
	drivers/net/wireless/wcnss/wcnss_wlan.c
Change-Id: I9ba7207a4453dfb623f286aca1bca855cbc68bb3
Reviewed-on: http://gerrit.pcs.mot.com/556665
Submit-Approved: Jira Key <jirakey@motorola.com>
Tested-by: Jira Key <jirakey@motorola.com>
Reviewed-by: Check Patch <CHEKPACH@motorola.com>
Reviewed-by: Klocwork kwcheck <klocwork-kwcheck@sourceforge.mot.com>
Reviewed-by: Christopher Fries <c.fries@motorola.com>
SLT-Approved: Sanjay Dhar <csd004@motorola.com>
mmc: core: Fix MMC clock scaling in case of tuning failure

When the clock scaling state is changed from MMC_LOAD_LOW to
MMC_LOAD_HIGH, the clocks are first scaled up and then tuning
is performed. But in case of tuning failure, the current code
does nothing but still retain the previous clock scale stats
(state and curr_freq within struct clk_scaling). Hence, correct
it to scale down the clocks in case of tuning failure so that
clock scaling stats reflect the correct status. This also helps
proceed with data transfers at lower clock rate in such cases.

Change-Id: I7e9379d1e3ddc863132af31019604c22a42f8d59
Signed-off-by: Sahitya Tummala <stummala@codeaurora.org>
msm: msm_bus: Add NULL pointer check

This patch protects the bus driver against clients who try to
update requests without registering the client

Change-Id: Ie740844218dbabe5fca098798c461590aba42e97
CRs-Fixed: 459651
Signed-off-by: Gagan Mac <gmac@codeaurora.org>