Few post-3.0.101 patches (squashed commit)

remoteproc: fix null reference when certain error handling forces removal of virtio devices

Change-Id: Idee7bf23f0b36888a8922c534a964536df0fe9fc

netfilter: xt_qtaguid: fix ipv6 protocol lookup

When updating the stats for a given uid it would incorrectly assume
IPV4 and pick up the wrong protocol when IPV6.

Change-Id: Iea4a635012b4123bf7aa93809011b7b2040bb3d5
Signed-off-by: JP Abgrall <jpa@google.com>

netfilter: xt_qtaguid: report only uid tags to non-privileged processes

In the past, a process could only see its own stats (uid-based summary,
and details).
Now we allow any process to see other UIDs uid-based stats, but still
hide the detailed stats.

Change-Id: I7666961ed244ac1d9359c339b048799e5db9facc
Signed-off-by: JP Abgrall <jpa@google.com>

netfilter: xt_qtaguid: fix error exit that would keep a spinlock.

qtudev_open() could return with a uid_tag_data_tree_lock held
when an kzalloc(..., GFP_ATOMIC) would fail.
Very unlikely to get triggered AND survive the mayhem of running out of mem.

Signed-off-by: JP Abgrall <jpa@google.com>

netfilter: qtaguid: Don't BUG_ON if create_if_tag_stat fails

If create_if_tag_stat fails to allocate memory (GFP_ATOMIC) the
following will happen:

qtaguid: iface_stat: tag stat alloc failed
...
kernel BUG at xt_qtaguid.c:1482!

Signed-off-by: Pontus Fuchs <pontus.fuchs@gmail.com>

ashmem: avoid deadlock between read and mmap calls

Avoid holding ashmem_mutex across code that can page fault.  Page faults
grab the mmap_sem for the process, which are also held by mmap calls
prior to calling ashmem_mmap, which locks ashmem_mutex.  The reversed
order of locking between the two can deadlock.

The calls that can page fault are read() and the ASHMEM_SET_NAME and
ASHMEM_GET_NAME ioctls.  Move the code that accesses userspace pages
outside the ashmem_mutex.

Bug: 9261835
Change-Id: If1322e981d29c889a56cdc9dfcbc6df2729a45e9
Signed-off-by: Todd Poynor <toddpoynor@google.com>

net: ipv6: Add IPv6 support to the ping socket.

[backport of net-next 6d0bfe22611602f36617bc7aa2ffa1bbb2f54c67]

This adds the ability to send ICMPv6 echo requests without a
raw socket. The equivalent ability for ICMPv4 was added in
2011.

Instead of having separate code paths for IPv4 and IPv6, make
most of the code in net/ipv4/ping.c dual-stack and only add a
few IPv6-specific bits (like the protocol definition) to a new
net/ipv6/ping.c. Hopefully this will reduce divergence and/or
duplication of bugs in the future.

Caveats:

- Setting options via ancillary data (e.g., using IPV6_PKTINFO
  to specify the outgoing interface) is not yet supported.
- There are no separate security settings for IPv4 and IPv6;
  everything is controlled by /proc/net/ipv4/ping_group_range.
- The proc interface does not yet display IPv6 ping sockets
  properly.

Tested with a patched copy of ping6 and using raw socket calls.
Compiles and works with all of CONFIG_IPV6={n,m,y}.

Change-Id: Ia359af556021344fc7f890c21383aadf950b6498
Signed-off-by: Lorenzo Colitti <lorenzo@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
[lorenzo@google.com: backported to 3.0]
Signed-off-by: Lorenzo Colitti <lorenzo@google.com>

ping: always initialize ->sin6_scope_id and ->sin6_flowinfo

[net-next commit c26d6b46da3ee86fa8a864347331e5513ca84c2b]

If we don't need scope id, we should initialize it to zero.
Same for ->sin6_flowinfo.

Change-Id: I28e4bc9593e76fc3434052182466fab4bb8ccf3a
Cc: Lorenzo Colitti <lorenzo@google.com>
Cc: David S. Miller <davem@davemloft.net>
Signed-off-by: Cong Wang <amwang@redhat.com>
Acked-by: Lorenzo Colitti <lorenzo@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>

ipv6: introdcue __ipv6_addr_needs_scope_id and ipv6_iface_scope_id helper functions

[net-next commit b7ef213ef65256168df83ddfbb8131ed9adc10f9]

__ipv6_addr_needs_scope_id checks if an ipv6 address needs to supply
a 'sin6_scope_id != 0'. 'sin6_scope_id != 0' was enforced in case
of link-local addresses. To support interface-local multicast these
checks had to be enhanced and are now consolidated into these new helper
functions.

v2:
a) migrated to struct ipv6_addr_props

v3:
a) reverted changes for ipv6_addr_props
b) test for address type instead of comparing scope

v4:
a) unchanged

Change-Id: Id6fc54cec61f967928e08a9eba4f857157d973a3
Suggested-by: YOSHIFUJI Hideaki <yoshfuji@linux-ipv6.org>
Cc: YOSHIFUJI Hideaki <yoshfuji@linux-ipv6.org>
Acked-by: YOSHIFUJI Hideaki <yoshfuji@linux-ipv6.org>
Signed-off-by: Hannes Frederic Sowa <hannes@stressinduktion.org>
Acked-by: YOSHIFUJI Hideaki <yoshfuji@linux-ipv6.org>
Signed-off-by: David S. Miller <davem@davemloft.net>

ASoC: DSP: Fix BE link state and hw_params in debugfs

BE state and hw_params were incorrectly shown in DSP state debugfs,
it was showing FE's values instead.

Change-Id: Ib5afb1537824634208741b0b635a31152c5aaddd
Signed-off-by: Misael Lopez Cruz <misael.lopez@ti.com>

OMAP4: clock: Fixing clock internal source selection for ABE ports

ABE ports need a mask of two bits in order to select the
correct internal source clock. This patch fix this mask that
was only one bit and was overlaping with source clock bits.

Change-Id: I8597efd9cec6707e815da39598a0adb7a3ce3c61
Signed-off-by: Israel Cepeda <icepeda@ti.com>

remoteproc: use dev_dbg to print image version

The version of the remote processor's resource table format is printed
using dev_info during the startup path of a remoteproc. The version
changes very rarely and hence is converted to use a dev_dbg. An error
message is printed anyway in case of a mismatch, so this conversion is
useful in helping improve the overall processor init time.

Also, version info can be looked up using an offline readrprc utility.

Change-Id: I546d3c73582bb7a3fdb2b32b4e3df03ce3a6e7f2
Signed-off-by: Subramaniam C.A <subramaniam.ca@ti.com>
Signed-off-by: Suman Anna <s-anna@ti.com>

OMAP4+: HSI: Prevent HSI clock disable while ACWAKE is high

If HSI clocks are disabled while ACWAKE is high, it is possible that ACWAKE
goes low unexpectedly.
This is not seen on Link Layers which do not comply with MIPI, because in this
case ACWAKE and CAWAKE are high at the same time, so HSI clocks are not
disabled.
But for Link Layers which comply with MIPI, CAWAKE will go low independtly of
CAWAKE, and HSI driver might cut the clocks while ACWAKE is high, which causes
CAWAKE to have an unknwon value.

Change-Id: Ib37982b3702ed64a917626d1a7407d558df1b49a
Signed-off-by: Djamil Elaidi <d-elaidi@ti.com>

arm: vfp: Fix memory corruption on PM suspend

Commit 36af2a47 ("ARM: vfp: Always save VFP state in vfp_pm_suspend")
introduced a potential use-after-free bug. On SMP systems,
vfp_current_hw_state might hold dangling pointers in case a task which
used the VFP last migrates to another CPU and then exits. If
vfp_pm_suspend is called while vfp_current_hw_state still holds a
pointer to the freed thread_info, that memory location will be written,
potentially overwriting a new object allocated there.

The original problem is only relevant to UP systems in which the VFP
state is stored lazily.

Fix this by only storing the VFP state on UP systems, and avoid doing so
on SMP ones.

Change-Id: I8f7026eb735b340fcef4cf12fbd12b9a0ea08d3f
Signed-off-by: Ido Yariv <ido@wizery.com>
Signed-off-by: Eyal Shapira <eyal@wizery.com>
Signed-off-by: Colin Cross <ccross@android.com>

gcx: boot stability fix

lib/lzo: Update LZO compression to current upstream version

This commit updates the kernel LZO code to the current upsteam version
which features a significant speed improvement - benchmarking the Calgary
and Silesia test corpora typically shows a doubled performance in
both compression and decompression on modern i386/x86_64/powerpc machines.

Change-Id: Ifcde45460c856644097bdeb612f0d68c6429f03c
Signed-off-by: Markus F.X.J. Oberhumer <markus@oberhumer.com>

lib/lzo: huge LZO decompression speedup on ARM by using unaligned access

Change-Id: I4dc172b2822504c3f2db1913ed9404e031861d55
Signed-off-by: Markus F.X.J. Oberhumer <markus@oberhumer.com>

OMAP4: ST: Disabling UART if ldisc not installed.

OMAP4: ST: Disabling UART if ldisc not installed.

In cases when there is no line discipline to be installed UART chip must be
disabled.

Rationale: if ldisc is not installed so it can't be uninstalled.
Thus UART chip still enabled and we have wakelock for it
(see plat_uart_enable() function in both blaze and 44xx-tablet board files).
In that case we can't go in suspend mode.

Motivation: when using busybox ramdisk (e.g. for testing kernel w/o AFS) we
have no ldisc that causes impossibility to go to suspend mode.

Change-Id: I6fac0b9411ed765e8e598328b89a41a50b5fbfea
Signed-off-by: Semen Protsenko <semen.protsenko@ti.com>

gcx: fixed color conversion table.

Change-Id: I9f0c8ed5f6a341ca8d6a2460a1b5225d78a505e4
Signed-off-by: Alexei Shlychkov <shlychkov@gmail.com>

TILER: Add tiler_backpages method

tiler_backpages method can be used to get the number of pages
required for a tiler allocation.  This method is called before
the memory is partitioned, therefore, we cannot rely on tiler
being initialized.  Separated geometry initialization for this
purpose.

Change-Id: Ia68cbd81c31a357fdc51036753db222d21994996
Signed-off-by: Lajos Molnar <lajos@ti.com>
Signed-off-by: Dima Svetlov <svetlov@ti.com>

gpu: ion: group heap allocations by id in the debugfs

Multiple ion heaps can have the same type.  These heaps will have
separate debugfs files, but any allocation for a heap with the same
type will be listed in them.

Change-Id: Iad2f660c539e151d62e76f8f99ecc9ad80b16dd5
Signed-off-by: Lajos Molnar <lajos@ti.com>
Singed-off-by: Dima Svetlov <svetlov@ti.com>

gpu: ion: omap: Set correct heap for TILER allocations

OMAP has two TILER heaps, but all allocations are logged under
the first TILER heap, as ion_alloc only takes a heap type mask.
Correct the heap after ion_alloc, so the buffer is maintained
under the correct heap.

Change-Id: I7b4eb690a6cde6f07632f5254c91374c6088cb8a
Signed-off-by: Lajos Molnar <lajos@ti.com>
Signed-off-by: Dima Svetlov <svetlov@ti.com>

ion: convert system heap to alloc_page()

vmalloc() allocates pages and maps them into kernel space.  If nobody
requires the area to be mapped in kernel space, this uses potentially
valuable VM address space.  Split into separate allocation and mapping
of pages.

Change-Id: I98411b93edea67c2068e20b5e48708fb38a4cd1f
Signed-off-by: David Schleef <ds@ti.com>

ion: add support for tiler reservation heap

The tiler reservation heap is for allocating TILER address space, but
not the underlying pages.  The idea is to allocate TILER address space
and one or more ION buffers from the system heap, and map system heap
buffers into the allocated TILER address space.

Change-Id: Ibd53ab811259cabec87384cf2ab4f99c0cbdca23
Signed-off-by: David Schleef <ds@ti.com>

Conflicts:

	drivers/gpu/ion/omap/omap_tiler_heap.c

ion: fix comment to match reality

Change-Id: Ib722e6c34965bf48ca5bdaaef3b4741146cc1508
Signed-off-by: David Schleef <ds@ti.com>

omap: Add TILER reservation ION heap to omap4 board file

registration gives ion clients access to tiler reservation heap

The tiler reservation heap is for allocating TILER address space, but
not the underlying pages.  The idea is to allocate TILER address space
and one or more ION buffers from the system heap, and map system heap
buffers into the allocated TILER address space.

Signed-off-by: David Schleef <ds@ti.com>
Change-Id: I3eb8125d604106185c37f75d61cbbd9f2ef175a1

rpmsg: omx: send disconnect only if omx state is connected

The rpmsg_omx driver sends a disconnect message automatically when the
driver's .release is called. This should be done only if a connection
has been established, otherwise just destroy the local end point.

Change-Id: I21b84aa6d91ae0d456f49cbe958f8e64caf691d5
Signed-off-by: Miguel Vadillo <vadillo@ti.com>

rpmsg: omx: initialize completion event in rpmsg_omx_open

An omx object is created when opening the rpmsg-omx device. However
the "reply_arrived" completion event is not initialized until the
connection message is sent across.

When the rpmsg_omx driver is removed (like in recovery), all pending
threads waiting on the "reply_arrived" are unblocked by a complete_all
call, however, if the rpmsg-omx device was only opened, such event is
not initialized yet, so the complete_all call will dereference a null
object causing a panic.

This patch moves the initialization of the "reply_arrived" completion
event to the open call, after the allocation of the omx object.

Change-Id: I92cf9cf5ac748456cb43bedc88fe1a8d80addd6c
Signed-off-by: Juan Gutierrez <jgutierrez@ti.com>

Conflicts:

	drivers/rpmsg/rpmsg_omx.c

OMAP: TILER: validate input width and height

Add validation of input width and height to ensure that it does
not exceed maximum pixel width and height for the specific format.

Validate maximum length for 1D allocations.

Change-Id: I64b00f93a312ae715a040da28a0b0fe663afa9d8
Signed-off-by: Andy Gross <andy.gross@ti.com>

gpu: ion: check for input arguments in ion_free

ion_free is a public API and is directly dereferencing a
pointer without checking for NULL. A check has been
added for the same and throws a WARN in case of invalid
arguments.

Change-Id: Idcf72e4449f8cba2b8342d6fb0f64600c2c59c7e
Signed-off-by: Suman Anna <s-anna@ti.com>

Fix build error

OMAP4: OMAPDSS: Request higher bandwidth for 1080p FB

Request higher L3 bandwidth when we have 1080p, or higher,
resolution framebuffer. This is done to avoid underflow on
DSS pipelines.

Change-Id: Ieca56ae8bc9ec6147ab9301c267c29279a9399ca
Signed-off-by: Dandawate Saket <dsaket@ti.com>
Signed-off-by: Peter Nordström <nordstrom@ti.com>

Conflicts:

	drivers/video/omap2/dss/core.c
	include/video/omapdss.h

OMAP4: DVFS: Fix scaling dependent frequencies.

When scaling dependent frequencies down it is observed that the order
in which frequencies are changed is incorrect.  For example, when core
domain changes OPP down from OPP119 to OPP50 the order is:
a) scale L3 freq down to OPP50
b) scale SGX freq down to OPP50
which is wrong.

Frequencies are scaled in order devices are registered in omap dvfs
framework in device list. Devices are inserted to the list in order,
such as dependences are satisfied if scaling frequencies up.

When scaling frequencies down traverse list backwards.

Change-Id: I752bcb264cac12514f358986a906f29ee81ba75e
Signed-off-by: Oleksandr Kozaruk <oleksandr.kozaruk@ti.com>

gcx: Disable write all permission for cache_status_every_irq

Android CTS requires that no sysfs entry is writeable by anyone

Change-Id: I55123b9ba69072a730b2b7889752ed5b1ab88770
Signed-off-by: Craig Stout <craig.stout@ti.com>

Revert "OMAP4: battery: correcting measured battery temperature value"

This reverts commit 3ee53862e7af3ffa9f5d7e71db3b53c253c0eae0

Battery temperature now is reported in degrees Celsius, but
should be in tenths of degree Celsius. Insted of, for example,
300 it returns 30.

Change code to return battery temperature in thents of degree
Celsius.

Change-Id: Ic56eaf33c0950929fecbd07654c08d022a3029cb
Reported-by: Anand Gadiar <gadiyar@ti.com>
Signed-off-by: Oleksandr Kozaruk <oleksandr.kozaruk@ti.com>

SMC: Update to AG01.06p4 release

With this SMC driver version present in MSHIELD-DK 1.7.10 and using
corresponding PPA/PA, the crypto driver now uses DMA beyond a certain
data size threshold.

It fixes some statbility issues observed since introduction of DMA
in MSHIELD-DK release 1.7.2

        * start using GFP_ATOMIC instead of GFP_KERNEL in
                aes_sync_operate() and tf_digest_hw_perform_dma()
        * tf_clock_timer_start() now called in tf_clock_timer_cbis()
        * fixed potential memory leak in aes_sync_operate

Change-Id: Ifcb4653b0cad7dc2e5cf61bd58631c56d7738dd7
Signed-off-by: Trusted Logic <smc_support@trusted-logic.com>
Signed-off-by: Bryan Buckley <bryan.buckley@ti.com>
Signed-off-by: Srinivas Pulukuru <srinivas.pulukuru@ti.com>

OMAP: TILER: Optimize placement for NV12 buffers

This patch changes the behaviour when allocating 2D buffers.  If
the required alignment is less than 4KiB and a security token is set,
the allocation will be flagged specifically for this format.  All
subsequent buffers of the same format and size will be placed inside
this area until the area is exhausted.

For NV12 allocations, this means that all Y allocations will share
one area, and the UV allocations will share another.

Change-Id: I13d29257c0cbab627c2938d4623557918448ee86
Signed-off-by: Andy Gross <andy.gross@ti.com>

omap-hsmmc: Prevent possible race condition

Making mmc_host_enable() and mmc_host_disable() invocations exclusive to
prevent race condition that occurs on specific board configurations based
on Blaze platform when repeated suspend/resume performed.

Change-Id: Ia709c2e0a4e19a0abb1cfbe7651c838b7c13fc1c
Signed-off-by: Semen Protsenko <semen.protsenko@ti.com>

sync struct wl12xx_platform_data to hardware/ti/wlan

this stops the wlan-driver from accesing memory outside
of its platform-data

Change-Id: I6e0f1920d3f8528cef3528d4989c9626507aa422

OMAP4: HDMI: Fix HDMI_TXPHY_TX_CONTROL.FREQOUT programming

According to TRM, the HDMI_TXPHY_TX_CONTROL.FREQOUT bit has to be programmed
based on the clock frequency. But this bit is always programmed as 1 in the HDMI
driver irrespective of the clock frequency values. Fix this and program
HDMI_TXPHY_TX_CONTROL.FREQOUT based on the clock frequency.

Change-Id: I25a4c335ec773e241cc0daca5c1c1c8f223cd4a0
Signed-off-by: TAKAHASHI, Masato <m_takahashi@ti.com>
Signed-off-by: Varadarajan, Charulatha <charu@ti.com>

Conflicts:
	include/video/hdmi_ti_4xxx_ip.h

twl6040: errata: PDMUP State In Sleep/Deep Sleep Mode

When AUDPWRON is set to 0 at any time in the IC operation to
put it into sleep or deep sleep mode, there is a finite probability
that the value of PDMUP could be at logic 1 (VDDVIO). In this state,
the resistive pulldown on OMAP on this pin results in a current drain.

Adding new impacted revisions (ES1.3, ES2.0, ES2.2) to errata workaround.

Change-Id: I049fe85eb2e1e9d04c72a9820f3adcc25db35646
Signed-off-by: Vadym Shovkoplias <shovkoplias.vadym@ti.com>

mmc: new api mmc_release_host_sync()

The current mmc API to release a specific mmc host
mmc_release_host() does not call host specific disable()
function immediately, but schedules it to be called with
some delay. Sometimes, during suspend/resume operations,
this is causing host->disable() function not to be called
before suspend and so the resources associated with host
are not released resulting in clocks not being released.

The new API mmc_release_host_sync() calls mmc_host_disable()
immediately instead of calling mmc_host_lazy_diable().

Change-Id: I64f3c8a96c29d9f4cff0382a3fe131faf48f2da1
Signed-off-by: Viswanath Puttagunta <vishp@ti.com>
Signed-off-by: Leonid Iziumtsev <x0153368@ti.com>

Conflicts:
	drivers/mmc/core/sdio.c

omap-hsmmc: Implementation of i761 errata

Errata description:
Due to a bad behavior of an internal signal, the Card Error interrupt bit
MMCHS_STAT[28] CERR may not be set sometimes when an error occurred in the
card response.

Workaround:
After responses of type R1/R1b for all cards and responses of type R5/R5b/R6
for SD and SDIO cards, software must read two registers: MMCHS_RSP10 and
MMCHS_CSRE. When a MMCHS_CSRE[i] bit is set to 1, if the corresponding bit at
the same position in the response MMCHS_RSP10[i] is set to 1, the host
controller indicates a card error and software should proceed in the same way
as if a CERR interrupt would have been detected in the MMCHS_STAT register.

Note:
This errata is applicable for omap44xx.

Change-Id: Ib024bfb0624df04b7d6c61c129cbd9a34f919814
Signed-off-by: Semen Protsenko <semen.protsenko@ti.com>

ASoC: OMAP ABE: BT backend as 16-bits stereo

Bluetooth data interface is connected to OMAP via McBSP and then to ABE.
ABE BT_VX ports require a low value for McBSP FIFO threshold (e.g. 1 for
mono, 2 for stereo), which has a side effect on latency. Since McBSP FIFO
stores each sample in a separate FIFO entry, using stereo instead of mono
halves the latency.

Change-Id: I03b9a04cafe65e1a5e5c97e2740ae17f3a9c8cdd
Signed-off-by: Misael Lopez Cruz <misael.lopez@ti.com>

OMAPDSS: DISPC: more precise scale limits checking

Use division with rounding-up when checking if maximum downscale ratio
was reached. This allows to avoid SYNC_LOST errors in case when small
amount of extra pixels or lines (usually 1-3) not taken into account

Change-Id: Id8f88c64671146a64738cfd820378bb7a28c1455
Signed-off-by: Sergiy Kibrik <sergiy.kibrik@globallogic.com>

OMAP4: OMAPFB: Dont error if display is already ON

Dont error if display state is already ON.

Change-Id: Ibad859847f2edd19cf6cd0d285461c66ed43c9a2
Signed-off-by: Dandawate Saket <dsaket@ti.com>
Signed-off-by: Muralidhar Dixit <murali.dixit@ti.com>

OMAP4: PM: Fix missed PRCM MPU interrupt events

OMAP PRCM detects events with EDGE sensitivity. Edge sensitivity
requires to clear the interrupt event status bit before acknowledging
the source event.
If the source event is cleared (1) before reseting the interrupt event
status bit (2), then a subsequent source event (i.e edge) between (1)
and (2) would be missed. Then, all the source events would be kept
"masked" until the source event is cleared again.

The bug seen here is that upon two consecutive PRCM interrupt events
from the IO daisy chain source event, the second event is missed if it
occurs before the PRCM interrupt event status is cleared.
Since the IO daisy chain source event has not been acknowledged, the
subseqent events from this source are missed too.

This patch fix the PRCM interrupt handler by acknowledging the interrupt
event status bit before clearing the source event.

Change-Id: I8c43a93c3b6c7c654ddaa262b7c1c3e7385da158
Signed-off-by: Patrick Combes <p-combes@ti.com>
Signed-off-by: Cedric Poignet <c-poignet@ti.com>

remoteproc: omap: differentiate auto-suspend from system suspend

The omap remoteproc driver sends a mailbox message to the remote
processor requesting it to save its context and then be suspended.
This can happen either through the runtime auto-suspend path or
through the system suspend.

The mailbox message being sent to the remote processor is now
differentiated between the two paths. This differentiation provides
flexibility on the remote processor to allow an application cancel
auto-suspend. This flexibility is needed as there can be some
operations wherein there is no on-going activity between the host
and the remote processor with the remote processor idle waiting for
an event that would take more time to complete than the auto-suspend
timeout.

The auto-suspend cancellation is detected by the driver on the
host-side through a timeout for the processor to be idled, and is
simply rescheduled.

Change-Id: Ifdeeb80a632ac0145194d3c20f66256226e7efd4
Signed-off-by: Shahid Akhtar <sakhtar@ti.com>
Signed-off-by: Suman Anna <s-anna@ti.com>

OMAPDSS: DSSCOMP: Fix incorrect num_ovls check

In setup manager IOCTL, the check to validate the number of overlays
is incorrect. Hence when all overlays are passed to setup manager IOCTL
with enable/disable, error was returned. Fix the same.

Change-Id: I8ec1a6dee9f074ebf83a39bdf113a97e2543cc70
Signed-off-by: Varadarajan, Charulatha <charu@ti.com>

omap: mailbox: process all messages before suspend

The mailbox for remote processors must wait for all messages
from remote processors to be processed before unregistering
block notifiers.

Change-Id: I75ae76dacdb95582b5f075690c2c3ecaf99e5f65
Signed-off-by: Shahid Akhtar <sakhtar@ti.com>

BV: Update headers to 2.2

Add bvbltparams.src2auxdstrect,
bvbltparams.maskauxdstrect,
BVFLAG_SRC2_AUXDSTRECT and BVFLAG_MASK_AUXDSTRECT;
Add BVAT_reserved2 bvauxtype;

Change-Id: I40c51f48642693fc8359fcfa15f37664a52f5823
Signed-off-by: Jack Yen <jyen@ti.com>

net: ks8851: report link state change

ks8851 is used in blaze/tablet but its driver doesn't report
the change of link state. Now this event is handled properly

Change-Id: I052673b51ef2be854439b41b2f323888df674d09
Signed-off-by: Ruslan Bilovol <ruslan.bilovol@ti.com>

OMAPDSS: DISPC: Use FIR filters other than M19

Pass correct arguments to FIR filter selection.  Previously we
always ended up selecting M19 5-tap filter.

This should improve image quality of scaled layers.

Change-Id: Iabe3219df7dcfd62c713fd92ee9c3d12221bc382
Signed-off-by: Lajos Molnar <lajos@ti.com>

Conflicts:
	drivers/video/omap2/dss/dispc.c

OMAPDSS: DSS: Relax L3 bus bandwidth constraint

In a current codebase L3 BW constraint is set if
any display has resution higher or equal FullHD.

Estimated available DSS bandwidth on L3@OPP50 is ~800MB/s.
It is approximately 3 WXGA layers or almost 1.5 FullHD layers at
60fps rate.

This patch relaxes L3 BW constraint and set it only
if current overlays' configuration needs higher BW.

Change-Id: I45afe36876e9898b45e20901d2b5c2633f32b914
Signed-off-by: Taras Kondratiuk <taras@ti.com>

OMAPDSS: DSS: Scale DSS OPP according to pixel clock rate

Before enabling pixel clock DSS should set its OPP
for OPP framework to set correct VDD_CORE voltage level.

When pixel clock is disabled DSS can set the lowest OPP.

Change-Id: Ia1459614ae306dba9b048b149e474442e2880bba
Signed-off-by: Taras Kondratiuk <taras@ti.com>

Conflicts:
	drivers/video/omap2/dss/dsi.c

OMAP4: OPP: Add DSS OPPs

To generate pixel clock rate higher than 93MHz
DSS has to scale VDD_CORE to at least OPP100 level.

This patch adds two DSS OPPs, for DSS to be able
to control minimum VDD_CORE level.

Change-Id: I98eab1c3b56fcf41026b742cb43c8155b68dd5c4
Signed-off-by: Taras Kondratiuk <taras@ti.com>

OMAP4: clock: Add 'virt_lcd_pclk' clock

Add virtual LCD pixel clock which is going to be used for DSS OPPs

Change-Id: Ia42668873d4dbe75deef22e97cec449a00f987d0
Signed-off-by: Vitaly Chernooky <vitaly.chernooky@ti.com>
Signed-off-by: Taras Kondratiuk <taras@ti.com>

OMAP: clock: Add dummy round_rate and set_rate functions

Add functions which are going to be used by dummy virtual clocks:
long clk_dummy_round_rate(struct clk *clk, unsigned long rate)
int clk_dummy_set_rate(struct clk *clk, unsigned long rate)

Change-Id: I9bb1e886888a117548d62ef2edd9598bce2723e6
Signed-off-by: Taras Kondratiuk <taras@ti.com>

OMAP3+: OPP: Remove unused _volt_to_opp() function

_volt_to_opp() is not used in the code anymore so can be removed

Change-Id: I2a9f4303c8ef31df928c0414cd6c3b09cd58e219
Signed-off-by: Taras Kondratiuk <taras@ti.com>

OMAP3+: DVFS: Use opp_find_volt functions instead of _volt_to_opp

Currently OMAP DVFS framework uses _volt_to_opp() function
to find OPP by voltage, but it is made in a hacky way,
because it doens't have access to list of OPP.

That function has a few important limitations:

1. It assumes that each OPP has an unique frequency value
   so it skips next OPPs with the same frequency.
   For example OMAP4 L3 bus has several OPPs which have
   same frequency, but different voltage values.
   So the function is not able to find correct OPP for L3.

2. Rounding direction is not predictable.
   By default function rounds up, but if requested voltage is
   higher that highest OPP voltage, then function rounds down.
   In most places where the function is used, code expect that
   it rounds down which is opposite to default behavior.

The patch change _volt_to_opp() function by opp_find_volt_ceil()
and opp_find_volt_floor() functions.

Change-Id: Iadc47b662924cd6277a008e8cb0d207ef5eb5598
Signed-off-by: Taras Kondratiuk <taras@ti.com>

PM: OPP: Add opp_find_volt_floor/ceil functions

Add functions to find OPP by voltage value
in the same way as it is made for frequency.

Change-Id: Ic7250258de82ca02d4ee27cfa53bafc7de87685f
Signed-off-by: Taras Kondratiuk <taras@ti.com>

OMAP4470: OPP/voltage: Add CORE OPP100 to High Perf CORE OPP set

Initially 4470 High Performance CORE OPP set didn't have OPP100 defined.
That's why when some devices need OPP100 VDD_CORE voltage level
to work at higher frequency they have to scale L3 to OPP-OV.

To fill a gap between OPP50 and OPP-OV a new OPP100 have been added.
It has OPP100 voltage level but keeps L3 frequency at 116MHz.

Both 4470's OPP sets share same OPP depencensies tables,
so a new OPP100H is defined to maintain correct depencencies
in both OPP sets.

Change-Id: Iab44165a4f0a8fecf6888e52a307425bd264e5cd
Signed-off-by: Taras Kondratiuk <taras@ti.com>

Conflicts:

	arch/arm/mach-omap2/opp4xxx_data.c

ASoC: ABE: Increase volume ramps for DMic's

Most digital microphones need about 10 ms to settle after setting bias
and clocks.  The OMAP DMic module is not able to set the clocks before
beginning the transfer, creating a full-scale pop at the beginning of
the transfer.

This patch works around this behavior by increasing the volume ramp
from 2ms to 50ms for DMic's.

Change-Id: I55fe727fb624965ad22c0f9087c8b426b18080ef
Signed-off-by: Gabriel M. Beddingfield <gabrbedd@ti.com>

ASoC: OMAP ABE: Fix TONES_DL 44.1kHz task settings

Back port of change-id: I0361bc6a1ae2bbc4fa0155e92c9d9c21cff7dfea

C_ABE_FW_TASK_IO_TONES_DL task wasn't scheduled for TONES_DL port at
44.1kHz which introduced noise.

Signed-off-by: Jyri Sarha <jsarha@ti.com>
Change-Id: I8972f1dd4524fe04a522fff4d5928886a8f94ad3

usb: ehci-omap: reimplement workaround for errata i693

The OMAP4 EHCI controller has the following defect (errata ID i693):

Title:
	USB HOST EHCI - Port Resume Fails On Second Resume Iteration

Description:
	When entering USB suspend mode, the EHCI will automatically
	ask the PHY to enter low power mode (PHY function control
	register bit suspendM is reset).
	The PHY will then cut the ULPI_CLK after a minimum of 5
	clock cycles.(no maximum specified). On the other hand,
	the EHCI embeds a counter counting up to 18 before cutting
	the internal clock after suspend signal is asserted. Since
	the PHY cuts the clock prematurely, the counter is not
	reaching 18. However, the first suspend and resume will work
	correctly. At the second suspend sequence, since the counter
	has maintained the value (thanks to retention flops),
	the counter reaches 18 and cuts the clock internally.
	As a consequence, the internal state machine does not
	transition to the correct state causing the next resume to fail.
	Both host initiated resume and remote wakeup are impacted
	by this issue.

Workaround
	After setting the suspend bit, switch the internal clock
	supply from the external ULPI_CLK provided by the PHY to
	the internal 60 MHz clock. This will allow the internal
	counter to reach 18. Then after 1ms, switch back to
	the external ULPI_CLK. This switch can be done thanks
	to the CM_L3INIT_HSUSBHOST_CLKCTRL[25:24]:CLKSEL_UTMI_P1/2 bits.
	During the application of the WA, the
	CM_L3INIT_HSUSBHOST_CLKCTRL[9:8]OPTFCLKEN_UTMI_P1/2_CLK
	optional clocks need to be enabled.

All OMAP4430 devices are impacted.

Change-Id: Ifb127cf86a8aeaa10a996403cf8f4e2a68d1ab23
Signed-off-by: Ruslan Bilovol <ruslan.bilovol@ti.com>

gpio/omap: fix _set_gpio_irqenable implementation

This function should be capable of both enabling and disabling interrupts
based upon the *enable* parameter. Right now the function only enables
the interrupt and *enable* is not used at all. So add the interrupt
disable capability also using the parameter.

Change-Id: I9b902184cabe8990205c9d488d261d79a84b94d4
Signed-off-by: Tarun Kanti DebBarma <tarun.kanti@ti.com>
Reviewed-by: Santosh Shilimkar <santosh.shilimkar@ti.com>
Acked-by: Felipe Balbi <balbi@ti.com>
Reviewed-by: Kevin Hilman <khilman@ti.com>
Signed-off-by: Kevin Hilman <khilman@ti.com>
Signed-off-by: Ruslan Bilovol <ruslan.bilovol@ti.com>

Revert "OMAP4: early mux initialization for EHCI"

This reverts commit 5a2e0ba0863d099bbb454a303e8927b54d4f22bf.

Reverted commit does USB Host muxes initialization too early.
In case of HSIC connection, this generates IDLE state on the
line before USB Host initialization. But HSIC Device generates
CONNECT on the bus as soon as detects IDLE. However, since USB Host
is initialized later, it misses this event.

Change-Id: I90219bce6d55bc828ea5b76f6cf9efa272f28e0b
Signed-off-by: Ruslan Bilovol <ruslan.bilovol@ti.com>

ext4: prevent kernel panic in case of uninitialized jinode

In some cases the kernel crash occurs during system suspend/resume:

[ 4095.041351] Unable to handle kernel NULL pointer dereference at virtual address 00000000
[ 4095.050689] pgd = c0004000
[ 4095.053985] [00000000] *pgd=00000000
[ 4095.058807] Internal error: Oops: 5 [#1] PREEMPT SMP
[ 4095.064483] Modules linked in: wl12xx mac80211 pvrsrvkm_sgx540_120 cfg80211 compat [last unloaded: wl12xx_sdio]
[ 4095.064575] CPU: 1    Tainted: G    B        (3.0.31-01807-gfac16a0 #1)
[ 4095.064605] PC is at jbd2_journal_file_inode+0x38/0x118
[ 4095.064666] LR is at mpage_da_map_and_submit+0x48c/0x618
[ 4095.064697] pc : [<c01da5a8>]    lr : [<c01aeac0>]    psr: 60000013
[ 4095.064697] sp : c6e07c80  ip : c6e07ca0  fp : c6e07c9c
[ 4095.064727] r10: 00000001  r9 : c6e06000  r8 : 00000179
[ 4095.064758] r7 : c6e07ca0  r6 : c73b8400  r5 : 00000000  r4 : c59a7d80
[ 4095.064758] r3 : 00000038  r2 : 00000800  r1 : 00000000  r0 : c7754fc0
[ 4095.064788] Flags: nZCv  IRQs on  FIQs on  Mode SVC_32  ISA ARM  Segment kernel
[ 4095.064819] Control: 10c5387d  Table: 86cc804a  DAC: 00000015
[ 4095.064849]
[ 4095.064849] PC: 0xc01da528:
[ 4095.064880] a528  0a000003 e3a05000 e1a00005 e24bd020 e89da9f0 e5951010 e3e06000 e14b22dc
.....
[ 4095.070373] 7fe0: c00a48ac 00000013 00000000 c6e07ff8 c00a48ac c00c0a94 84752f09 60772177
[ 4095.070404] Backtrace:
[ 4095.070465] [<c01da570>] (jbd2_journal_file_inode+0x0/0x118) from [<c01aeac0>] (mpage_da_map_and_submit+0x48c/0x618)
[ 4095.070495]  r7:c6e07ca0 r6:c6e07d00 r5:c6e07d90 r4:c7754fc0
[ 4095.070556] [<c01ae634>] (mpage_da_map_and_submit+0x0/0x618) from [<c01af40c>] (ext4_da_writepages+0x2a4/0x5c8)
[ 4095.070617] [<c01af168>] (ext4_da_writepages+0x0/0x5c8) from [<c0112af4>] (do_writepages+0x34/0x40)
[ 4095.070678] [<c0112ac0>] (do_writepages+0x0/0x40) from [<c01645a4>] (writeback_single_inode+0xd4/0x288)
[ 4095.070709] [<c01644d0>] (writeback_single_inode+0x0/0x288) from [<c0164ed4>] (writeback_sb_inodes+0xb4/0x184)
[ 4095.070770] [<c0164e20>] (writeback_sb_inodes+0x0/0x184) from [<c01655a0>] (writeback_inodes_wb+0xc4/0x13c)
[ 4095.070831] [<c01654dc>] (writeback_inodes_wb+0x0/0x13c) from [<c01658f0>] (wb_writeback+0x2d8/0x464)
[ 4095.070861] [<c0165618>] (wb_writeback+0x0/0x464) from [<c0165cb8>] (wb_do_writeback+0x23c/0x2c4)
[ 4095.070922] [<c0165a7c>] (wb_do_writeback+0x0/0x2c4) from [<c0165df4>] (bdi_writeback_thread+0xb4/0x2dc)
[ 4095.070953] [<c0165d40>] (bdi_writeback_thread+0x0/0x2dc) from [<c00c0b18>] (kthread+0x90/0x98)
[ 4095.071014] [<c00c0a88>] (kthread+0x0/0x98) from [<c00a48ac>] (do_exit+0x0/0x72c)
[ 4095.071044]  r7:00000013 r6:c00a48ac r5:c00c0a88 r4:c78c7ec4
[ 4095.071105] Code: e89da8f0 e5963000 e3130002 1afffffa (e5913000)
[ 4095.071166] ---[ end trace 7fe9f9b727e5cf78 ]---
[ 4095.071197] Kernel panic - not syncing: Fatal exception

The probably reason of such behaviour is an inode opened in READ mode
has been marked as 'dirty' somehow and written back by ext4_da_writepages.
Cause jinode == NULL it could lead to the kernel panic.

The patch prevents kernel panic and helps to investigate the problem
providing an inode number.

Change-Id: I1d77a011b580db682b8e2d122ef3d5e44e0ce5c7
Signed-off-by: Volodymyr Mieshkov <volodymyr.mieshkov@ti.com>

ARM: backtrace: avoid crash on large invalid fp value

Wraparound on invalid frame pointer (signed) -4 <= fp <= -1
defeats check for too high.

Change-Id: Iaccb5d380e989660c06c0379a5e4ee31d9f84966
Signed-off-by: Todd Poynor <toddpoynor@google.com>
Signed-off-by: Aleksandar Momiroski <alex.momir@ti.com>

Bluetooth: Set conn->link_policy in hci_conn_add

This allows slaves to request sniff mode too when
idle_timeout is non-zero.  Otherwise, slaves connections
were not getting their link_policy initialized and
sniff mode requests would never be sent.

Change-Id: I3965e509ab03a9e00858415f9100fa4038d1c18d
Signed-off-by: Mike J. Chen <mjchen@google.com>
Signed-off-by: Ruslan Bilovol <ruslan.bilovol@ti.com>

ARM: OMAP4: trim_quirks: Repair the wrong comparison

The omap_rev() returns value not comparable with CHIP_IS_* constants.

Change-Id: I4f21fc84b37f09d1c14c2656bf13337a453d783e
Signed-off-by: Ivan Khoronzhuk <ivan.khoronzhuk@ti.com>

OMAP4430/60: EMIF: errata: Prohibit usage of Power-Down mode

A ZQ calibration long command is issued every time on exit
from active power-down and precharge power-down modes
when EMIF is configured to use Power-down mode
(EMIF_PWR_MGMT_CTRL.REG_LP_MODE=0x4).

Due to very short periods of power-down cycles, ZQ calibration
overhead creates bandwidth issues and increases overall system
power consumption.

As result, the guideline is to not allow Power-down mode and,
therefore, to not have set the
EMIF_PWR_MGMT_CTRL[10:8] REG_LP_MODE bit field to 0x4.

TI Errata i743; IMPACTED: OMAP4430/60 all revisions

Change-Id: Ib82f28e6e0c6c046ea277b90a78dc82c1ee82417
Signed-off-by: Grygorii Strashko <grygorii.strashko@ti.com>
Signed-off-by: Vitaly Chernooky <vitaly.chernooky@ti.com>

ARM: OMAP4: omap-twl: Fix setting VSEL code for max_voltage

Errata ProDB00121179 says voltage overshoot may occur if
switch from DVS to non-DVS ranges on TWL6032.
 - DVS range VSEL codes     0x01-0x39
 - non-DVS range VSEL codes 0x3A-0x3E

Max_volt settings (1.418V) were converted to VSEL=0x3A.
This VSEL code is in non-DVS range while all other codes
are in DVS range. Thus using this code leads to voltage
overshoot due to errata.
Now max_volt 1.418V is converted to code VSEL=0x39
which corresponds to 1.417960V and is in the safe range.
The voltages higher than 1.418V aren't used for both 6030 and 6032.
Thus replacing VSEL code 0x3A by 0x39 does not impact performance.
If used SMPS_OFFSET=0 (default only for twl6030 es1.0 and
is not used on twl6032) the max voltage of 1.35V is
recalculated to VSEL=0x3A and is not affected by the patch.

Change-Id: I5e992be09899f520c1635fe3c268cbfdedc4caf4
Signed-off-by: Oleg_Kosheliev <oleg.kosheliev@ti.com>

ION: Added some error handling

OMAP44xx: i723 fix. Reconfigure ABE DPLL on early kernel init

Avoid crashes during warm reboot due to DPLL ABE not relocking.
Currently the errata is documented as effective for OMAP4430 only,
but the issue is reproducible on 4460 and 4470 as well.
The fix affects OMAPS00285348 and OMAPS00285422.

Change-Id: I3cdb9ca273bacbc62bf400a70f60572cdf878d78
Signed-off-by: Andrii Anisov <andrii.anisov@ti.com>

ARM: 7301/1: Rename the T() macro to TUSER() to avoid namespace conflicts

This macro is used to generate unprivileged accesses (LDRT/STRT) to user
space.

Change-Id: I437b29aa989fce232e428859af7d28222d943353

ARM: 7527/1: uaccess: explicitly check __user pointer when !CPU_USE_DOMAINS

The {get,put}_user macros don't perform range checking on the provided
__user address when !CPU_HAS_DOMAINS.

This patch reworks the out-of-line assembly accessors to check the user
address against a specified limit, returning -EFAULT if is is out of
range.

[will: changed get_user register allocation to match put_user]
[rmk: fixed building on older ARM architectures]

Change-Id: I11f883c7d0c6f2464395104f99b66200ca62dbe2

Conflicts:
	arch/arm/include/asm/assembler.h

netlink: validate addr_len on bind

Otherwise an out of bounds read could happen.

Signed-off-by: Hannes Frederic Sowa <hannes@stressinduktion.org>
Signed-off-by: David S. Miller <davem@davemloft.net>

fs: vfat: reduce the worst case latencies

When a block partition is mounted with FAT file system
and MS_DIRSYNC option is used, some file system operations
like create, rename shall sleep in caller's context until
all the metadata have been committed to the non-volatile memory.
Since this operation is blocking call for user context,
the WRITE_SYNC option must be used instead of WRITE
(async operation) which incur inherent latencies while
flushing the meta-data corresponding to directory entries

Change-Id: I41c514889873a39d564271db0a421e6c66e5ae33
Signed-off-by: xiaogang <xiaogang@codeaurora.org>

block: add a flag to identify PM request

Add a flag REQ_PM to identify the request is PM related, such requests
will not change the device request queue's runtime status. It is
intended to be used in driver's runtime PM callback, so that driver can
perform some IO to the device there with the queue's runtime status
unaffected. e.g. in SCSI disk's runtime suspend callback, the disk will
be put into stopped power state, and this require sending a command to
the device. Such command processing should not change the disk's runtime
status.

Change-Id: I522bbee6cc911cefeefba50517ebc283e2838918
Signed-off-by: Lin Ming <ming.m.lin@intel.com>
Signed-off-by: Aaron Lu <aaron.lu@intel.com>
Acked-by: Alan Stern <stern@rowland.harvard.edu>
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Git-commit: 66311274691ec65972cad3626057fa8d00c146d8
Git-repo: git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
[sthumma@codeaurora.org: resolve trival merge conflicts]
Signed-off-by: Sujit Reddy Thumma <sthumma@codeaurora.org>

Conflicts:
	include/linux/blk_types.h

block: add runtime pm helpers

Add runtime pm helper functions:

void blk_pm_runtime_init(struct request_queue *q, struct device *dev)
  - Initialization function for drivers to call.

int blk_pre_runtime_suspend(struct request_queue *q)
  - If any requests are in the queue, mark last busy and return -EBUSY.
    Otherwise set q->rpm_status to RPM_SUSPENDING and return 0.

void blk_post_runtime_suspend(struct request_queue *q, int err)
  - If the suspend succeeded then set q->rpm_status to RPM_SUSPENDED.
    Otherwise set it to RPM_ACTIVE and mark last busy.

void blk_pre_runtime_resume(struct request_queue *q)
  - Set q->rpm_status to RPM_RESUMING.

void blk_post_runtime_resume(struct request_queue *q, int err)
  - If the resume succeeded then set q->rpm_status to RPM_ACTIVE
    and call __blk_run_queue, then mark last busy and autosuspend.
    Otherwise set q->rpm_status to RPM_SUSPENDED.

The idea and API is designed by Alan Stern and described here:
http://marc.info/?l=linux-scsi&m=133727953625963&w=2

Change-Id: I486612af79c7887116f70a4fde552c107f7fa360
Signed-off-by: Lin Ming <ming.m.lin@intel.com>
Signed-off-by: Aaron Lu <aaron.lu@intel.com>
Acked-by: Alan Stern <stern@rowland.harvard.edu>
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Git-commit: 6c9546675864f51506af69eca388e5d922942c56
Git-repo: git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
Signed-off-by: Sujit Reddy Thumma <sthumma@codeaurora.org>

Conflicts:
	block/blk-core.c
	include/linux/blkdev.h

block: implement runtime pm strategy

When a request is added:
    If device is suspended or is suspending and the request is not a
    PM request, resume the device.

When the last request finishes:
    Call pm_runtime_mark_last_busy().

When pick a request:
    If device is resuming/suspending, then only PM request is allowed
    to go.

The idea and API is designed by Alan Stern and described here:
http://marc.info/?l=linux-scsi&m=133727953625963&w=2

Change-Id: If9c8332164afba6aeca984277e3398008ad9c45a
Signed-off-by: Lin Ming <ming.m.lin@intel.com>
Signed-off-by: Aaron Lu <aaron.lu@intel.com>
Acked-by: Alan Stern <stern@rowland.harvard.edu>
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Git-commit: c8158819d506a8aedeca53c52dfb709a0aabe011
Git-repo: git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
Signed-off-by: Sujit Reddy Thumma <sthumma@codeaurora.org>

scsi_pm: resume device if suspend failed

For scsi devices which use scsi bus runtime callback, runtime suspend
will call scsi_dev_type_suspend, and if the drv->suspend failed, the
device will still be in active state. But since scsi_device_quiesce is
called, the device will not be able to respond any more commands.
So add a check here to see if err occured, if so, bring the device back
to normal state with scsi_device_resume.

Change-Id: I9d92645cae9a72da7e3f6d7596d18e5f925109a4
Signed-off-by: Aaron Lu <aaron.lu@amd.com>
Acked-by: Alan Stern <stern@rowland.harvard.edu>
Signed-off-by: James Bottomley <JBottomley@Parallels.com>
Git-commit: d20ec597cba1e8ea407c9a7c668a9e04fc057c83
Git-repo: git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
Signed-off-by: Sujit Reddy Thumma <sthumma@codeaurora.org>

scsi_pm: use callbacks from dev_pm_ops for scsi devices

Use of pm_message_t is deprecated and device driver is not supposed
to use that. This patch migrates the SCSI bus level pm callbacks
to call device's pm callbacks defined in its driver's dev_pm_ops.

This is achieved by finding out which device pm callback should be used
in bus callback function, and then pass that callback function pointer
as a param to the scsi_bus_{suspend,resume}_common routine, which will
further pass that callback to scsi_dev_type_{suspend,resume} after
proper handling.

The special case for freeze in scsi_bus_suspend_common is not necessary
since there is no high level SCSI driver has implemented freeze, so no
need to runtime resume the device if it is in runtime suspended state
for system freeze, just return like the system suspend/hibernate case.

Since only sd has implemented drv->suspend/drv->resume, and I'll update
sd driver to use the new callbacks in the following patch, there is no
need to fallback to call drv->suspend/drv->resume if dev_pm_ops is NULL.

Change-Id: I08b44d12e480cdbb736a39c8a4a7c7e7e8a42c36
Signed-off-by: Aaron Lu <aaron.lu@intel.com>
Acked-by: Alan Stern <stern@rowland.harvard.edu>
Acked-by: Rafael J. Wysocki <rjw@sisk.pl>
Signed-off-by: James Bottomley <JBottomley@Parallels.com>
Git-commit: 80d2fd48cca2a0de806c3130551744a04ad5b80b
Git-repo: git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
[sthumma@codeaurora.org: resolve trivial merge conflicts]
Signed-off-by: Sujit Reddy Thumma <sthumma@codeaurora.org>

Conflicts:
	drivers/scsi/scsi_pm.c

sd: use REQ_PM in sd's runtime suspend operation

With the introduction of REQ_PM, modify sd's runtime suspend operation
functions to use that flag so that the operations to put the device into
runtime suspended state(i.e. sync cache and stop device) will not affect
its runtime PM status.

Change-Id: I0fe93acfbfbd01ce265a6dd2df6349ca26598fca
Signed-off-by: Lin Ming <ming.m.lin@intel.com>
Signed-off-by: Aaron Lu <aaron.lu@intel.com>
Acked-by: Alan Stern <stern@rowland.harvard.edu>
Signed-off-by: James Bottomley <JBottomley@Parallels.com>
Git-commit: 9b21493c4520970f8f404e0265f48e37f9cffaf5
Git-repo: git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
[sthumma@codeaurora.org: resolve trivial merge conflicts]
Signed-off-by: Sujit Reddy Thumma <sthumma@codeaurora.org>

driver core: fix possible missing of device probe

Inside bus_add_driver(), one device might be added(device_add()) into
the bus or probed which is triggered by deferred probe
just after completing of driver_attach() and before
'klist_add_tail(&priv->knode_bus, &bus->p->klist_drivers)',
so the device won't be probed by this driver.

This patch moves the below line

	'klist_add_tail(&priv->knode_bus, &bus->p->klist_drivers)'

before driver_attach() inside bus_add_driver() to fix the
problem.

Signed-off-by: Ming Lei <ming.lei@canonical.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

mmc: sdhci: ignore the hardware timeout when requested

Few card commands can be interrupted (using HPI command) if it takes
longer time to complete so in such case its acceptable to get the
timeout errors hence ignore them when MMC core layer request for it.

Change-Id: I347a2171e21746643e5f39eb927394d55cbca46e
Signed-off-by: Subhash Jadavani <subhashj@codeaurora.org>
Signed-off-by: Maya Erez <merez@codeaurora.org>

Conflicts:
	drivers/mmc/host/sdhci.c

blkpm: avoid sleep when holding queue lock

In blk_post_runtime_resume, an autosuspend request will be initiated for
the device. Since we are holding the queue lock, we can't sleep and thus
we should use the async version to initiate an autosuspend, i.e.
pm_request_suspend instead of pm_runtime_suspend, which might sleep.

Change-Id: I28cbe7e20ffdcb8f7b3329bf3b827c942dd1b45a
Signed-off-by: Aaron Lu <aaron.lu@intel.com>
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Git-commit: c60855cdb976c632b3bf8922eeab8a0e78edfc04
Git-repo: git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
Signed-off-by: Sujit Reddy Thumma <sthumma@codeaurora.org>

net: flow: Prevent bringing up new CPUs during per-CPU initialization

In a rare race-condition, it's possible that a CPU will be brought
online between when the for_each_online_cpu() loop executes to
call flow_cache_cpu_prepare(), and when the hotplug notifier for
calling this same function is registered. If this happens,
flow_cache_cpu_prepare() will never be called for the new CPU,
resulting in crashes due to uninitialized per-cpu data.

Fix this by preventing CPUs from being added or removed during
this small but sensitive window.

Change-Id: Iafbbaa8a50e5c527392d130561874313720849d0
Signed-off-by: Matt Wagantall <mattw@codeaurora.org>

Conflicts:
	net/core/flow.c

panic: force console_unlock() in panic()

If panic() is called when console is locked,
oops message can't be printed in console.
Especially, android ram_console doesn't have any information in this case.
Thus, console_unlock() in panic() if console is locked.

Change-Id: Ifbac48875ac189c35ed380b67734d0411bed2c08
Signed-off-by: Bongkyu Kim <bongkyu.kim@lge.com>

Conflicts:
	kernel/panic.c

arm: ftrace: ftrace_modify_code should make kernel text writable for update

STRICT_MEMORY_RWX write-protects the kernel text section, hence with
STRICT_MEMORY_RWX enabled ftrace need to make kernel text section
temporarily writable.

Change-Id: I67fef0ee1d81dd259bae623d7bf0ea2760ae7284
Signed-off-by: mohamed.khadri <mohamed.khadri@lge.com>

smp: Relax irqs_disable() warning in smp_call_function_single()

The change that long-ago added the interrupts-disabled warning in
smp_call_function_single() cited the following deadlock as the reason:
	CPU A				CPU B
	Disable interrupts
					smp_call_function()
					Take call_lock
					Send IPIs
					Wait for all cpus to acknowledge IPI
					CPU A has not responded, spin waiting
					for cpu A to respond, holding call_lock
	smp_call_function()
	Spin waiting for call_lock
	Deadlock			Deadlock

Such a deadlock is not possible however, in the event that
smp_call_function_single() is called for the currently-executing CPU.
While not a common usecase, relaxing the warning may simplify some
driver implementations.

The 'acpuclock-krait' driver in the MSM ARM sub-architecture provides
one example, where smp_call_function_single() is sometimes called from
a cpuidle path with interrupts disabled, but only ever from the target
CPU. Other callers of that same function may cross-call, but only do so
when interrupts are enabled.

Bug: 10858938
Change-Id: I647b3b46fe6aa4dfb06f7750396986b80b92d700
Signed-off-by: Matt Wagantall <mattw@codeaurora.org>
Signed-off-by: Ajay Dudani <adudani@codeaurora.org>

slub: tid must be retrieved from the percpu area of the current processor

As Steven Rostedt has pointer out: rescheduling could occur on a
different processor after the determination of the per cpu pointer and
before the tid is retrieved. This could result in allocation from the
wrong node in slab_alloc().

The effect is much more severe in slab_free() where we could free to the
freelist of the wrong page.

The window for something like that occurring is pretty small but it is
possible.

Signed-off-by: Christoph Lameter <cl@linux.com>
Signed-off-by: Pekka Enberg <penberg@kernel.org>

cpuidle: make a single register function for all

The usual scheme to initialize a cpuidle driver on a SMP is:

	cpuidle_register_driver(drv);
	for_each_possible_cpu(cpu) {
		device = &per_cpu(cpuidle_dev, cpu);
		cpuidle_register_device(device);
	}

This code is duplicated in each cpuidle driver.

On UP systems, it is done this way:

	cpuidle_register_driver(drv);
	device = &per_cpu(cpuidle_dev, cpu);
	cpuidle_register_device(device);

On UP, the macro 'for_each_cpu' does one iteration:

        for ((cpu) = 0; (cpu) < 1; (cpu)++, (void)mask)

Hence, the initialization loop is the same for UP than SMP.

Beside, we saw different bugs / mis-initialization / return code unchecked in
the different drivers, the code is duplicated including bugs. After fixing all
these ones, it appears the initialization pattern is the same for everyone.

Please note, some drivers are doing dev->state_count = drv->state_count. This is
not necessary because it is done by the cpuidle_enable_device function in the
cpuidle framework. This is true, until you have the same states for all your
devices. Otherwise, the 'low level' API should be used instead with the specific
initialization for the driver.

Let's add a wrapper function doing this initialization with a cpumask parameter
for the coupled idle states and use it for all the drivers.

That will save a lot of LOC, consolidate the code, and the modifications in the
future could be done in a single place. Another benefit is the consolidation of
the cpuidle_device variable which is now in the cpuidle framework and no longer
spread accross the different arch specific drivers.

Change-Id: I8f75188d5770871620f758c2973b74384ac570d5
Signed-off-by: Daniel Lezcano <daniel.lezcano@linaro.org>
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
Signed-off-by: Karthik Parsha <kparsha@codeaurora.org>
Signed-off-by: Mahesh Sivasubramanian <msivasub@codeaurora.org>
Signed-off-by: franciscofranco <franciscofranco.1990@gmail.com>

cpufreq: Add cpu-boost driver

When certain bursty and important events take place, it might take a while
for the current cpufreq governor to notice the new load and react to it.
That would result in poor user experience. To alleviate this, the cpu-boost
driver boosts the frequency of a CPU for a short duration to maintain good
user experience while the governor catches up.

Specifically, this commit deals with ensuring that when "important" tasks
migrate from a fast CPU to a slow CPU, the frequency of the slow CPU is
boosted to be at least as high as the fast CPU for a short duration.

Since this driver enforces the boost by hooking into standard cpufreq
ADJUST notifiers, it has several advantages:
- More portable across kernel versions where the cpufreq internals might
  have been rewritten.
- Governor agnostic and hence works with multiple governors like
  conservative, ondemand, interactive, etc.
- Does not affect the sampling period/logic of existing governors.
- Can have the boost period adjusted independent of governor sampling
  period.

Change-Id: Ibd814a20043d0aba64ee7637a4a79b9ffa1b0991
Signed-off-by: Saravana Kannan <skannan@codeaurora.org>
Signed-off-by: franciscofranco <franciscofranco.1990@gmail.com>

cpufreq: Add a sync limit to cpu-boost

Perform frequency synchronization only when source CPU's frequency
is less than sync_threshold, else sync to the sync_threshold.

Change-Id: I544c414568d4e015b80ce5891dd215275bac95da
Signed-off-by: Rohit Gupta <rohgup@codeaurora.org>
Signed-off-by: franciscofranco <franciscofranco.1990@gmail.com>

cpufreq: Add Input Boost feature to the cpu-boost driver

On incoming input events boost the frequency of all online cpus
for at least input_boost_ms ms. This is accomplished by changing
the policy->min of all the online cpus to input_boost_freq.

Change-Id: Idb0ab75d68ae4ceff259cbbaaec1a9bb3bc871d3
Signed-off-by: Rohit Gupta <rohgup@codeaurora.org>
Signed-off-by: franciscofranco <franciscofranco.1990@gmail.com>

cfg80211: Fix memory leak

When a driver requests a specific regulatory domain after cfg80211 already
has one, a struct ieee80211_regdomain is leaked.

Change-Id: Id28fc9861b9c911a97bd242439eabca097d76258
Reported-by: Larry Finger <Larry.Finger@lwfinger.net>
Tested-by: Larry Finger <Larry.Finger@lwfinger.net>
Signed-off-by: Larry Finger <Larry.Finger@lwfinger.net>
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Git-commit: b7566fc363e23f0efd3fa1e1460f9421cdc0d77e
Git-repo: git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
[mattw@codeaurora.org: trivially backport to the msm-3.4 kernel]
Signed-off-by: Matt Wagantall <mattw@codeaurora.org>

Signed-off-by: franciscofranco <franciscofranco.1990@gmail.com>

cfg80211: add flags to define country IE processing rules

802.11 cards may have different country IE parsing behavioural
preferences and vendors may want to support these. These preferences
were managed by the WIPHY_FLAG_CUSTOM_REGULATORY and the
WIPHY_FLAG_STRICT_REGULATORY flags and their combination.
Instead of using this existing notation, split out the country IE
behavioural preferences to a new flag. This will allow us to add more
customizations easily and make the code more maintainable. Also add
a new flag to disable country IE hints issued by the CORE as the
first customization.

Change-Id: I66ba4a92ac0f029a115eea0a274b02db11279787
CRs-Fixed: 542802
Signed-off-by: Mihir Shete <smihir@codeaurora.org>
Signed-off-by: franciscofranco <franciscofranco.1990@gmail.com>

Conflicts:
	include/net/cfg80211.h
	net/wireless/reg.c

cfg80211: Reset beacon interval when stop AP fails

When SSR happens at WLAN driver, the cfg80211 stop AP can fail at driver.
Make sure that the beacon interval is reset, even when this API fails.

Change-Id: I459f55ce5f4bc44c4d0e20170bd50a83c2d609b4
Signed-off-by: Sameer Thalappil <sameert@codeaurora.org>
Signed-off-by: franciscofranco <franciscofranco.1990@gmail.com>

Conflicts:
	net/wireless/nl80211.c

cfg80211: export regulatory_hint_user() API

This is to help the hardware configured in world
roaming mode to save power when not connected to
any AP.

CRs-Fixed: 542802
Change-Id: Ia643d0e9848dcd486832973bd6dd186edd7bd4ea
Signed-off-by: Mihir Shete <smihir@codeaurora.org>
Signed-off-by: franciscofranco <franciscofranco.1990@gmail.com>

cfg80211: permanently disable channels specified by base settings

if a custom regulatory domain is passed and if a rule for a channel
indicates it should be disabled that channel should always remain
disabled as per its documentation and design.
Likewise if WIPHY_FLAG_STRICT_REGULATORY flag is set and a
regulatory_hint() is issued if a channel is disabled that channel should
remain disabled.
Without this change only drivers that set the _orig flags appropriately
on their own would ensure disallowed channels remaind disabled. This
helps drivers save code by relying on the APIS provided to entrust
channels that should not be enabled be respected by only having to use
wiphy_apply_custom_regulatory() or regulatory_hint() with the
WIPHY_FLAG_STRICT_REGULATORY set.
If wiphy_apply_custom_regulatory() is used together with
WIPHY_FLAG_STRICT_REGULATORY and a regulatory_hint() issued later, the
incoming regulatory domain can override previously set _orig parameters
from the initial custom regulatory setting.

Change-Id: Ia1af4b293bd299ac20e1934e5e03e633ecb9d6ee
Signed-off-by: Luis R. Rodriguez <mcgrof@do-not-panic.com>
Signed-off-by: Mihir Shete <smihir@codeaurora.org>
Signed-off-by: franciscofranco <franciscofranco.1990@gmail.com>

Conflicts:
	net/wireless/reg.c

cfg80211: discard regulatory hints from country IEs with undefined wiphy

Regulatory hints are processed in a worker thread and by the
time this thread gets a chance to schedule driver can deregister
the wiphy on which the country IE was discovered. There is no need
to process the hints which are coming from such invalid wiphy
devices and we should drop them.

Change-Id: I44f6f7b29ed1d0927151a88f3ea9e0c17044bd7e
CRs-Fixed: 588103
Signed-off-by: Mihir Shete <smihir@codeaurora.org>
Signed-off-by: franciscofranco <franciscofranco.1990@gmail.com>

Conflicts:
	net/wireless/reg.c

USB: android: Prevent change of host mac address of 'rndis0' interface

On windows 7 platform, previously allocated ip address is maintained.
However, Host MAC address of 'rndis0' interface is changed when the
tethering driver re-enumerated. Thus, the tethering network driver
can't be allocated ip address from dhcp. It causes connection delay
between host and phone for usb tethering.

This patch prevents from changing Host MAC address of 'rndis0' interface.
In other words, this patch maintains the Host MAC address allocated by
userspace although the driver is re-enumerated.

CRs-Fixed: 534083
Change-Id: I94176ec010fc2cf5c57c35ed31a311dd747200bd
Signed-off-by: Vijayavardhan Vennapusa <vvreddy@codeaurora.org>
Signed-off-by: franciscofranco <franciscofranco.1990@gmail.com>

ARM: 7693/1: mm: clean-up in order to reduce to call kmap_high_get()

In kmap_atomic(), kmap_high_get() is invoked for checking already
mapped area. In __flush_dcache_page() and dma_cache_maint_page(),
we explicitly call kmap_high_get() before kmap_atomic()
when cache_is_vipt(), so kmap_high_get() can be invoked twice.
This is useless operation, so remove one.

v2: change cache_is_vipt() to cache_is_vipt_nonaliasing() in order to
be self-documented

Change-Id: I36e5a63fdae158d9e7562f564f7e593b351f6960
Acked-by: Nicolas Pitre <nico@linaro.org>
Signed-off-by: Joonsoo Kim <iamjoonsoo.kim@lge.com>
Signed-off-by: Russell King <rmk+kernel@arm.linux.org.uk>
Git-commit: dd0f67f4747797f36f0c6bab7fed6a1f2448476d
Git-repo: https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/
Signed-off-by: Chintan Pandya <cpandya@codeaurora.org>
Signed-off-by: franciscofranco <franciscofranco.1990@gmail.com>

ARM: 7735/2: Preserve the user r/w register TPIDRURW on context switch and fork

Since commit 6a1c53124aa1 the user writeable TLS register was zeroed to
prevent it from being used as a covert channel between two tasks.

There are more and more applications coming to Windows RT,
Wine could support them, but mostly they expect to have
the thread environment block (TEB) in TPIDRURW.

This patch preserves that register per thread instead of clearing it.
Unlike the TPIDRURO, which is already switched, the TPIDRURW
can be updated from userspace so needs careful treatment in the case that we
modify TPIDRURW and call fork(). To avoid this we must always read
TPIDRURW in copy_thread.

Change-Id: Ib1e25be7b9faa846ba5335aad2574e21a1246066
Signed-off-by: André Hentschel <nerv@dawncrow.de>
Signed-off-by: Will Deacon <will.deacon@arm.com>
Signed-off-by: Jonathan Austin <jonathan.austin@arm.com>
Signed-off-by: Russell King <rmk+kernel@arm.linux.org.uk>
Git-commit: a4780adeefd042482f624f5e0d577bf9cdcbb760
Git-repo: git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
[joonwoop@codeaurora.org: fixed merge conflict]
CRs-fixed: 561044
Signed-off-by: Joonwoo Park <joonwoop@codeaurora.org>

Signed-off-by: franciscofranco <franciscofranco.1990@gmail.com>

ARM: 7880/1: Clear the IT state independent of the Thumb-2 mode

The ARM architecture reference specifies that the IT state bits in the
PSR must be all zeros in ARM mode or behavior is unspecified.  On the
Qualcomm Snapdragon S4/Krait architecture CPUs the processor continues
to consider the IT state bits while in ARM mode.  This makes it so
that some instructions are skipped by the CPU.

Signed-off-by: T.J. Purtell <tj@mobisocial.us>
[rmk+kernel@arm.linux.org.uk: fixed whitespace formatting in patch]
Signed-off-by: Russell King <rmk+kernel@arm.linux.org.uk>
Git-commit: 6ecf830e5029598732e04067e325d946097519cb
Git-repo: git://git.kernel.org/pub/scm/linux/kernel/git/next/linux-next.git
Change-Id: I74275a3d98aef291d6f41b1905acc3aeecb50b47
Signed-off-by: Stepan Moskovchenko <stepanm@codeaurora.org>

Signed-off-by: franciscofranco <franciscofranco.1990@gmail.com>

ARM: Flush the caches for non panicking CPUs in case of a kernel panic

In case of a kernel panic, only the panicking CPU does an entire
cache flush. This means that certain dirty cache lines in the L1
caches of the other CPUs may never get flushed. This gives us
improper RAM dumps. Add cache flushing for all the online CPUs.
The outer domain is not flushed since it is already being done by
the panicking CPU.

Change-Id: Ibf844ecf6b4dbc3c623789f72a26936aeb4a7306
Signed-off-by: Syed Rameez Mustafa <rameezmustafa@codeaurora.org>
Signed-off-by: franciscofranco <franciscofranco.1990@gmail.com>

ARM: 7668/1: fix memset-related crashes caused by recent GCC (4.7.2) optimizations

Recent GCC versions (e.g. GCC-4.7.2) perform optimizations based on
assumptions about the implementation of memset and similar functions.
The current ARM optimized memset code does not return the value of
its first argument, as is usually expected from standard implementations.

For instance in the following function:

void debug_mutex_lock_common(struct mutex *lock, struct mutex_waiter *waiter)
{
	memset(waiter, MUTEX_DEBUG_INIT, sizeof(*waiter));
	waiter->magic = waiter;
	INIT_LIST_HEAD(&waiter->list);
}

compiled as:

800554d0 <debug_mutex_lock_common>:
800554d0:       e92d4008        push    {r3, lr}
800554d4:       e1a00001        mov     r0, r1
800554d8:       e3a02010        mov     r2, #16 ; 0x10
800554dc:       e3a01011        mov     r1, #17 ; 0x11
800554e0:       eb04426e        bl      80165ea0 <memset>
800554e4:       e1a03000        mov     r3, r0
800554e8:       e583000c        str     r0, [r3, #12]
800554ec:       e5830000        str     r0, [r3]
800554f0:       e5830004        str     r0, [r3, #4]
800554f4:       e8bd8008        pop     {r3, pc}

GCC assumes memset returns the value of pointer 'waiter' in register r0; causing
register/memory corruptions.

This patch fixes the return value of the assembly version of memset.
It adds a 'mov' instruction and merges an additional load+store into
existing load/store instructions.
For ease of review, here is a breakdown of the patch into 4 simple steps:

Step 1
======
Perform the following substitutions:
ip -> r8, then
r0 -> ip,
and insert 'mov ip, r0' as the first statement of the function.
At this point, we have a memset() implementation returning the proper result,
but corrupting r8 on some paths (the ones that were using ip).

Step 2
======
Make sure r8 is saved and restored when (! CALGN(1)+0) == 1:

save r8:
-       str     lr, [sp, #-4]!
+       stmfd   sp!, {r8, lr}

and restore r8 on both exit paths:
-       ldmeqfd sp!, {pc}               @ Now <64 bytes to go.
+       ldmeqfd sp!, {r8, pc}           @ Now <64 bytes to go.
(...)
        tst     r2, #16
        stmneia ip!, {r1, r3, r8, lr}
-       ldr     lr, [sp], #4
+       ldmfd   sp!, {r8, lr}

Step 3
======
Make sure r8 is saved and restored when (! CALGN(1)+0) == 0:

save r8:
-       stmfd   sp!, {r4-r7, lr}
+       stmfd   sp!, {r4-r8, lr}

and restore r8 on both exit paths:
        bgt     3b
-       ldmeqfd sp!, {r4-r7, pc}
+       ldmeqfd sp!, {r4-r8, pc}
(...)
        tst     r2, #16
        stmneia ip!, {r4-r7}
-       ldmfd   sp!, {r4-r7, lr}
+       ldmfd   sp!, {r4-r8, lr}

Step 4
======
Rewrite register list "r4-r7, r8" as "r4-r8".

Change-Id: I79a0d6897572b693d50f8ea8a94aa331bfcc59f8
Git-Commit: 455bd4c430b0c0a361f38e8658a0d6cb469942b5
Git-Repo: git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
Signed-off-by: Ivan Djelic <ivan.djelic@parrot.com>
Reviewed-by: Nicolas Pitre <nico@linaro.org>
Signed-off-by: Dirk Behme <dirk.behme@gmail.com>
Signed-off-by: Russell King <rmk+kernel@arm.linux.org.uk>
Signed-off-by: Stepan Moskovchenko <stepanm@codeaurora.org>
Signed-off-by: franciscofranco <franciscofranco.1990@gmail.com>

ARM: 7670/1: fix the memset fix

Commit 455bd4c430b0 ("ARM: 7668/1: fix memset-related crashes caused by
recent GCC (4.7.2) optimizations") attempted to fix a compliance issue
with the memset return value.  However the memset itself became broken
by that patch for misaligned pointers.

This fixes the above by branching over the entry code from the
misaligned fixup code to avoid reloading the original pointer.

Also, because the function entry alignment is wrong in the Thumb mode
compilation, that fixup code is moved to the end.

While at it, the entry instructions are slightly reworked to help dual
issue pipelines.

Change-Id: I5db45a7de1e389bacb5d6e4513c0d446ae2c9440
Git-Commit: 418df63adac56841ef6b0f1fcf435bc64d4ed177
Git-Repo: git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
Signed-off-by: Nicolas Pitre <nico@linaro.org>
Tested-by: Alexander Holler <holler@ahsoftware.de>
Signed-off-by: Russell King <rmk+kernel@arm.linux.org.uk>
Signed-off-by: Stepan Moskovchenko <stepanm@codeaurora.org>
Signed-off-by: franciscofranco <franciscofranco.1990@gmail.com>

CPU hotplug, debug: detect imbalance between get_online_cpus() and put_online_cpus()

The synchronization between CPU hotplug readers and writers is achieved
by means of refcounting, safeguarded by the cpu_hotplug.lock.

get_online_cpus() increments the refcount, whereas put_online_cpus()
decrements it.  If we ever hit an imbalance between the two, we end up
compromising the guarantees of the hotplug synchronization i.e, for
example, an extra call to put_online_cpus() can end up allowing a
hotplug reader to execute concurrently with a hotplug writer.

So, add a WARN_ON() in put_online_cpus() to detect such cases where the
refcount can go negative, and also attempt to fix it up, so that we can
continue to run.

Change-Id: I144efeaa5899a2e8a3cddd21f010679cbaaa2459
Signed-off-by: Srivatsa S. Bhat <srivatsa.bhat@linux.vnet.ibm.com>
Reviewed-by: Yasuaki Ishimatsu <isimatu.yasuaki@jp.fujitsu.com>
Cc: Jiri Kosina <jkosina@suse.cz>
Cc: Thomas Gleixner <tglx@linutronix.de>
Cc: Ingo Molnar <mingo@kernel.org>
Cc: Peter Zijlstra <peterz@infradead.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Git-commit: 075663d19885eb3738fd2d7dbdb8947e12563b68
Git-repo: git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
Signed-off-by: Osvaldo Banuelos <osvaldob@codeaurora.org>
Signed-off-by: franciscofranco <franciscofranco.1990@gmail.com>

lib/int_sqrt.c: optimize square root algorithm

Optimize the current version of the shift-and-subtract (hardware)
algorithm, described by John von Newmann[1] and Guy L Steele.

Iterating 1,000,000 times, perf shows for the current version:

 Performance counter stats for './sqrt-curr' (10 runs):

         27.170996 task-clock                #    0.979 CPUs utilized            ( +-  3.19% )
                 3 context-switches          #    0.103 K/sec                    ( +-  4.76% )
                 0 cpu-migrations            #    0.004 K/sec                    ( +-100.00% )
               104 page-faults               #    0.004 M/sec                    ( +-  0.16% )
        64,921,199 cycles                    #    2.389 GHz                      ( +-  0.03% )
        28,967,789 stalled-cycles-frontend   #   44.62% frontend cycles idle     ( +-  0.18% )
   <not supported> stalled-cycles-backend
       104,502,623 instructions              #    1.61  insns per cycle
                                             #    0.28  stalled cycles per insn  ( +-  0.00% )
        34,088,368 branches                  # 1254.587 M/sec                    ( +-  0.00% )
             4,901 branch-misses             #    0.01% of all branches          ( +-  1.32% )

       0.027763015 seconds time elapsed                                          ( +-  3.22% )

And for the new version:

Performance counter stats for './sqrt-new' (10 runs):

          0.496869 task-clock                #    0.519 CPUs utilized            ( +-  2.38% )
                 0 context-switches          #    0.000 K/sec
                 0 cpu-migrations            #    0.403 K/sec                    ( +-100.00% )
               104 page-faults               #    0.209 M/sec                    ( +-  0.15% )
           590,760 cycles                    #    1.189 GHz                      ( +-  2.35% )
           395,053 stalled-cycles-frontend   #   66.87% frontend cycles idle     ( +-  3.67% )
   <not supported> stalled-cycles-backend
           398,963 instructions              #    0.68  insns per cycle
                                             #    0.99  stalled cycles per insn  ( +-  0.39% )
            70,228 branches                  #  141.341 M/sec                    ( +-  0.36% )
             3,364 branch-misses             #    4.79% of all branches          ( +-  5.45% )

       0.000957440 seconds time elapsed                                          ( +-  2.42% )

Furthermore, this saves space in instruction text:

   text    data     bss     dec     hex filename
    111       0       0     111      6f lib/int_sqrt-baseline.o
     89       0       0      89      59 lib/int_sqrt.o

[1] http://en.wikipedia.org/wiki/First_Draft_of_a_Report_on_the_EDVAC

Signed-off-by: Davidlohr Bueso <davidlohr.bueso@hp.com>
Reviewed-by: Jonathan Gonzalez <jgonzlez@linets.cl>
Tested-by: Jonathan Gonzalez <jgonzlez@linets.cl>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Francisco Franco <franciscofranco.1990@gmail.com>

Enable pipe flag.

Signed-off-by: franciscofranco <franciscofranco.1990@gmail.com>
Signed-off-by: Francisco Franco <franciscofranco.1990@gmail.com>

audit: kiss goodbye you stupid piece of crap logging messages.

Signed-off-by: Francisco Franco <franciscofranco.1990@gmail.com>

 writeback: fix race that cause writeback hung

There is a race between mark inode dirty and writeback thread, see the
following scenario.  In this case, writeback thread will not run though
there is dirty_io.

__mark_inode_dirty()                                          bdi_writeback_workfn()
...                                                       ...
spin_lock(&inode->i_lock);
...
if (bdi_cap_writeback_dirty(bdi)) {
    <<< assume wb has dirty_io, so wakeup_bdi is false.
    <<< the following inode_dirty also have wakeup_bdi false.
    wakeup_bdi = true;
}
spin_unlock(&inode->i_lock);
                                                            <<< assume last dirty_io is removed here.
                                                            pages_written = wb_do_writeback(wb);
                                                            ...
                                                            <<< work_list empty and wb has no dirty_io,
                                                            <<< delayed_work will not be queued.
                                                                (wb_has_dirty_io(wb) && dirty_writeback_interval))
                                                                queue_delayed_work(bdi_wq, &wb->dwork,
                                                                    msecs_to_jiffies(dirty_writeback_interval * 10));
spin_lock(&bdi->wb.list_lock);
inode->dirtied_when = jiffies;
<<< new dirty_io is added.
list_move(&inode->i_wb_list, &bdi->wb.b_dirty);
spin_unlock(&bdi->wb.list_lock);

<<< though there is dirty_io, but wakeup_bdi is false,
<<< so writeback thread will not be waked up and
<<< the new dirty_io will not be flushed.
if (wakeup_bdi)
    bdi_wakeup_thread_delayed(bdi);

Writeback will run until there is a new flush work queued.  This may cause
a lot of dirty pages stay in memory for a long time.

Signed-off-by: Junxiao Bi <junxiao.bi@oracle.com>
Reviewed-by: Jan Kara <jack@suse.cz>
Cc: Fengguang Wu <fengguang.wu@intel.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Francisco Franco <franciscofranco.1990@gmail.com>

mm: frontswap: core swap subsystem hooks and headers

From: Dan Magenheimer <dan.magenheimer@oracle.com>
Subject: [PATCH V10 2/6] mm: frontswap: core swap subsystem hooks and headers

(Note to earlier reviewers:  This patchset has been reorganized due to
feedback from Kame Hiroyuki and Andrew Morton. This patch combines patch
1of4 and patch 3of4 from the previous series.)

This second patch of six in the frontswap series contains the changes
to the core swap subsystem.  This includes:

(1) makes available core swap data structures (swap_lock, swap_list and
swap_info) that are needed by frontswap.c but we don't need to expose them
to the dozens of files that include swap.h so we create a new swapfile.h
just to extern-ify these and modify their declarations to non-static

(2) adds frontswap-related elements to swap_info_struct.  Frontswap_map
points to vzalloc'ed one-bit-per-swap-page metadata that indicates
whether the swap page is in frontswap or in the device and frontswap_pages
counts how many pages are in frontswap.

(3) adds hooks in the swap subsystem and extends try_to_unuse so that
frontswap_shrink can do a "partial swapoff".

Note that a failed frontswap_map allocation is safe... failure is noted
by lack of "FS" in the subsequent printk.

[v10: no change]
[v9: akpm@linux-foundation.org: mark some statics __read_mostly]
[v9: akpm@linux-foundation.org: add clarifying comments]
[v9: akpm@linux-foundation.org: no need to loop repeating try_to_unuse]
[v9: error27@gmail.com: remove superfluous check for NULL]
[v8: rebase to 3.0-rc4]
[v8: kamezawa.hiroyu@jp.fujitsu.com: change counter to atomic_t to avoid races]
[v8: kamezawa.hiroyu@jp.fujitsu.com: comment to clarify informational counters]
[v7: rebase to 3.0-rc3]
[v7: JBeulich@novell.com: add new swap struct elements only if config'd]
[v6: rebase to 3.0-rc1]
[v6: lliubbo@gmail.com: fix null pointer deref if vzalloc fails]
[v6: konrad.wilk@oracl.com: various checks and code clarifications/comments]
[v5: no change from v4]
[v4: rebase to 2.6.39]
Signed-off-by: Dan Magenheimer <dan.magenheimer@oracle.com>
Reviewed-by: Konrad Wilk <konrad.wilk@oracle.com>
Reviewed-by: Kamezawa Hiroyuki <kamezawa.hiroyu@jp.fujitsu.com>
Acked-by: Jan Beulich <JBeulich@novell.com>
Acked-by: Seth Jennings <sjenning@linux.vnet.ibm.com>
Cc: Jeremy Fitzhardinge <jeremy@goop.org>
Cc: Hugh Dickins <hughd@google.com>
Cc: Johannes Weiner <hannes@cmpxchg.org>
Cc: Nitin Gupta <ngupta@vflare.org>
Cc: Matthew Wilcox <matthew@wil.cx>
Cc: Chris Mason <chris.mason@oracle.com>
Cc: Rik Riel <riel@redhat.com>
Cc: Andrew Morton <akpm@linux-foundation.org>
modified for 3.0.x on OMAP4460 by faux123

oom: fix race while temporarily setting current's oom_score_adj

test_set_oom_score_adj() was introduced in 72788c385604 ("oom: replace
PF_OOM_ORIGIN with toggling oom_score_adj") to temporarily elevate
current's oom_score_adj for ksm and swapoff without requiring an
additional per-process flag.

Using that function to both set oom_score_adj to OOM_SCORE_ADJ_MAX and
then reinstate the previous value is racy since it's possible that
userspace can set the value to something else itself before the old value
is reinstated.  That results in userspace setting current's oom_score_adj
to a different value and then the kernel immediately setting it back to
its previous value without notification.

To fix this, a new compare_swap_oom_score_adj() function is introduced
with the same semantics as the compare and swap CAS instruction, or
CMPXCHG on x86.  It is used to reinstate the previous value of
oom_score_adj if and only if the present value is the same as the old
value.

Signed-off-by: David Rientjes <rientjes@google.com>
Cc: Oleg Nesterov <oleg@redhat.com>
Cc: Ying Han <yinghan@google.com>
Cc: KOSAKI Motohiro <kosaki.motohiro@jp.fujitsu.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

Conflicts:

	mm/swapfile.c
modified by faux123

sched: Make initial SCHED_RR timeslace DEF_TIMESLICE

From: Hiroshi Shimamoto <h-shimamoto@ct.jp.nec.com>

Current the initial SCHED_RR timeslice of init_task is HZ, which means
1s, and is not same as the default SCHED_RR timeslice DEF_TIMESLICE.

Change that initial timeslice to the DEF_TIMESLICE.

Signed-off-by: Hiroshi Shimamoto <h-shimamoto@ct.jp.nec.com>
adapted by faux123 for linux 3.0.x

mm: compaction: allow compaction to isolate dirty pages

Short summary: There are severe stalls when a USB stick using VFAT is
used with THP enabled that are reduced by this series.  If you are
experiencing this problem, please test and report back and considering I
have seen complaints from openSUSE and Fedora users on this as well as a
few private mails, I'm guessing it's a widespread issue.  This is a new
type of USB-related stall because it is due to synchronous compaction
writing where as in the past the big problem was dirty pages reaching
the end of the LRU and being written by reclaim.

Am cc'ing Andrew this time and this series would replace
mm-do-not-stall-in-synchronous-compaction-for-thp-allocations.patch.
I'm also cc'ing Dave Jones as he might have merged that patch to Fedora
for wider testing and ideally it would be reverted and replaced by this
series.

That said, the later patches could really do with some review.  If this
series is not the answer then a new direction needs to be discussed
because as it is, the stalls are unacceptable as the results in this
leader show.

For testers that try backporting this to 3.1, it won't work because
there is a non-obvious dependency on not writing back pages in direct
reclaim so you need those patches too.

Changelog since V5
o Rebase to 3.2-rc5
o Tidy up the changelogs a bit

Changelog since V4
o Added reviewed-bys, credited Andrea properly for sync-light
o Allow dirty pages without mappings to be considered for migration
o Bound the number of pages freed for compaction
o Isolate PageReclaim pages on their own LRU list

This is against 3.2-rc5 and follows on from discussions on "mm: Do
not stall in synchronous compaction for THP allocations" and "[RFC
PATCH 0/5] Reduce compaction-related stalls". Initially, the proposed
patch eliminated stalls due to compaction which sometimes resulted in
user-visible interactivity problems on browsers by simply never using
sync compaction. The downside was that THP success allocation rates
were lower because dirty pages were not being migrated as reported by
Andrea. His approach at fixing this was nacked on the grounds that
it reverted fixes from Rik merged that reduced the amount of pages
reclaimed as it severely impacted his workloads performance.

This series attempts to reconcile the requirements of maximising THP
usage, without stalling in a user-visible fashion due to compaction
or cheating by reclaiming an excessive number of pages.

Patch 1 partially reverts commit 39deaf85 to allow migration to isolate
	dirty pages. This is because migration can move some dirty
	pages without blocking.

Patch 2 notes that the /proc/sys/vm/compact_memory handler is not using
	synchronous compaction when it should be. This is unrelated
	to the reported stalls but is worth fixing.

Patch 3 checks if we isolated a compound page during lumpy scan and
	account for it properly. For the most part, this affects
	tracing so it's unrelated to the stalls but worth fixing.

Patch 4 notes that it is possible to abort reclaim early for compaction
	and return 0 to the page allocator potentially entering the
	"may oom" path. This has not been observed in practice but
	the rest of the series potentially makes it easier to happen.

Patch 5 adds a sync parameter to the migratepage callback and gives
	the callback responsibility for migrating the page without
	blocking if sync==false. For example, fallback_migrate_page
	will not call writepage if sync==false. This increases the
	number of pages that can be handled by asynchronous compaction
	thereby reducing stalls.

Patch 6 restores filter-awareness to isolate_lru_page for migration.
	In practice, it means that pages under writeback and pages
	without a ->migratepage callback will not be isolated
	for migration.

Patch 7 avoids calling direct reclaim if compaction is deferred but
	makes sure that compaction is only deferred if sync
	compaction was used.

Patch 8 introduces a sync-light migration mechanism that sync compaction
	uses. The objective is to allow some stalls but to not call
	->writepage which can lead to significant user-visible stalls.

Patch 9 notes that while we want to abort reclaim ASAP to allow
	compation to go ahead that we leave a very small window of
	opportunity for compaction to run. This patch allows more pages
	to be freed by reclaim but bounds the number to a reasonable
	level based on the high watermark on each zone.

Patch 10 allows slabs to be shrunk even after compaction_ready() is
	true for one zone. This is to avoid a problem whereby a single
	small zone can abort reclaim even though no pages have been
	reclaimed and no suitably large zone is in a usable state.

Patch 11 fixes a problem with the rate of page scanning. As reclaim is
	rarely stalling on pages under writeback it means that scan
	rates are very high. This is particularly true for direct
	reclaim which is not calling writepage. The vmstat figures
	implied that much of this was busy work with PageReclaim pages
	marked for immediate reclaim. This patch is a prototype that
	moves these pages to their own LRU list.

This has been tested and other than 2 USB keys getting trashed,
nothing horrible fell out. That said, I am a bit unhappy with the
rescue logic in patch 11 but did not find a better way around it. It
does significantly reduce scan rates and System CPU time indicating
it is the right direction to take.

What is of critical importance is that stalls due to compaction
are massively reduced even though sync compaction was still
allowed. Testing from people complaining about stalls copying to USBs
with THP enabled are particularly welcome.

The following tests all involve THP usage and USB keys in some
way. Each test follows this type of pattern

1. Read from some fast fast storage, be it raw device or file. Each time
   the copy finishes, start again until the test ends
2. Write a large file to a filesystem on a USB stick. Each time the copy
   finishes, start again until the test ends
3. When memory is low, start an alloc process that creates a mapping
   the size of physical memory to stress THP allocation. This is the
   "real" part of the test and the part that is meant to trigger
   stalls when THP is enabled. Copying continues in the background.
4. Record the CPU usage and time to execute of the alloc process
5. Record the number of THP allocs and fallbacks as well as the number of THP
   pages in use a the end of the test just before alloc exited
6. Run the test 5 times to get an idea of variability
7. Between each run, sync is run and caches dropped and the test
   waits until nr_dirty is a small number to avoid interference
   or caching between iterations that would skew the figures.

The individual tests were then

writebackCPDeviceBasevfat
	Disable THP, read from a raw device (sda), vfat on USB stick
writebackCPDeviceBaseext4
	Disable THP, read from a raw device (sda), ext4 on USB stick
writebackCPDevicevfat
	THP enabled, read from a raw device (sda), vfat on USB stick
writebackCPDeviceext4
	THP enabled, read from a raw device (sda), ext4 on USB stick
writebackCPFilevfat
	THP enabled, read from a file on fast storage and USB, both vfat
writebackCPFileext4
	THP enabled, read from a file on fast storage and USB, both ext4

The kernels tested were

3.1		3.1
vanilla		3.2-rc5
freemore	Patches 1-10
immediate	Patches 1-11
andrea		The 8 patches Andrea posted as a basis of comparison

The results are very long unfortunately. I'll start with the case
where we are not using THP at all

writebackCPDeviceBasevfat
                   3.1.0-vanilla         rc5-vanilla       freemore-v6r1        isolate-v6r1         andrea-v2r1
System Time         1.28 (    0.00%)   54.49 (-4143.46%)   48.63 (-3687.69%)    4.69 ( -265.11%)   51.88 (-3940.81%)
+/-                 0.06 (    0.00%)    2.45 (-4305.55%)    4.75 (-8430.57%)    7.46 (-13282.76%)    4.76 (-8440.70%)
User Time           0.09 (    0.00%)    0.05 (   40.91%)    0.06 (   29.55%)    0.07 (   15.91%)    0.06 (   27.27%)
+/-                 0.02 (    0.00%)    0.01 (   45.39%)    0.02 (   25.07%)    0.00 (   77.06%)    0.01 (   52.24%)
Elapsed Time      110.27 (    0.00%)   56.38 (   48.87%)   49.95 (   54.70%)   11.77 (   89.33%)   53.43 (   51.54%)
+/-                 7.33 (    0.00%)    3.77 (   48.61%)    4.94 (   32.63%)    6.71 (    8.50%)    4.76 (   35.03%)
THP Active          0.00 (    0.00%)    0.00 (    0.00%)    0.00 (    0.00%)    0.00 (    0.00%)    0.00 (    0.00%)
+/-                 0.00 (    0.00%)    0.00 (    0.00%)    0.00 (    0.00%)    0.00 (    0.00%)    0.00 (    0.00%)
Fault Alloc         0.00 (    0.00%)    0.00 (    0.00%)    0.00 (    0.00%)    0.00 (    0.00%)    0.00 (    0.00%)
+/-                 0.00 (    0.00%)    0.00 (    0.00%)    0.00 (    0.00%)    0.00 (    0.00%)    0.00 (    0.00%)
Fault Fallback      0.00 (    0.00%)    0.00 (    0.00%)    0.00 (    0.00%)    0.00 (    0.00%)    0.00 (    0.00%)
+/-                 0.00 (    0.00%)    0.00 (    0.00%)    0.00 (    0.00%)    0.00 (    0.00%)    0.00 (    0.00%)

The THP figures are obviously all 0 because THP was enabled. The
main thing to watch is the elapsed times and how they compare to
times when THP is enabled later. It's also important to note that
elapsed time is improved by this series as System CPu time is much
reduced.

writebackCPDevicevfat

                   3.1.0-vanilla         rc5-vanilla       freemore-v6r1        isolate-v6r1         andrea-v2r1
System Time         1.22 (    0.00%)   13.89 (-1040.72%)   46.40 (-3709.20%)    4.44 ( -264.37%)   47.37 (-3789.33%)
+/-                 0.06 (    0.00%)   22.82 (-37635.56%)    3.84 (-6249.44%)    6.48 (-10618.92%)    6.60
(-10818.53%)
User Time           0.06 (    0.00%)    0.06 (   -6.90%)    0.05 (   17.24%)    0.05 (   13.79%)    0.04 (   31.03%)
+/-                 0.01 (    0.00%)    0.01 (   33.33%)    0.01 (   33.33%)    0.01 (   39.14%)    0.01 (   25.46%)
Elapsed Time     10445.54 (    0.00%) 2249.92 (   78.46%)   70.06 (   99.33%)   16.59 (   99.84%)  472.43 (
95.48%)
+/-               643.98 (    0.00%)  811.62 (  -26.03%)   10.02 (   98.44%)    7.03 (   98.91%)   59.99 (   90.68%)
THP Active         15.60 (    0.00%)   35.20 (  225.64%)   65.00 (  416.67%)   70.80 (  453.85%)   62.20 (  398.72%)
+/-                18.48 (    0.00%)   51.29 (  277.59%)   15.99 (   86.52%)   37.91 (  205.18%)   22.02 (  119.18%)
Fault Alloc       121.80 (    0.00%)   76.60 (   62.89%)  155.40 (  127.59%)  181.20 (  148.77%)  286.60 (  235.30%)
+/-                73.51 (    0.00%)   61.11 (   83.12%)   34.89 (   47.46%)   31.88 (   43.36%)   68.13 (   92.68%)
Fault Fallback    881.20 (    0.00%)  926.60 (   -5.15%)  847.60 (    3.81%)  822.00 (    6.72%)  716.60 (   18.68%)
+/-                73.51 (    0.00%)   61.26 (   16.67%)   34.89 (   52.54%)   31.65 (   56.94%)   67.75 (    7.84%)
MMTests Statistics: duration
User/Sys Time Running Test (seconds)       3540.88   1945.37    716.04     64.97   1937.03
Total Elapsed Time (seconds)              52417.33  11425.90    501.02    230.95   2520.28

The first thing to note is the "Elapsed Time" for the vanilla kernels
of 2249 seconds versus 56 with THP disabled which might explain the
reports of USB stalls with THP enabled. Applying the patches brings
performance in line with THP-disabled performance while isolating
pages for immediate reclaim from the LRU cuts down System CPU time.

The "Fault Alloc" success rate figures are also improved. The vanilla
kernel only managed to allocate 76.6 pages on average over the course
of 5 iterations where as applying the series allocated 181.20 on
average albeit it is well within variance. It's worth noting that
applies the series at least descreases the amount of variance which
implies an improvement.

Andrea's series had a higher success rate for THP allocations but
at a severe cost to elapsed time which is still better than vanilla
but still much worse than disabling THP altogether. One can bring my
series close to Andrea's by removing this check

        /*
         * If compaction is deferred for high-order allocations, it is because
         * sync compaction recently failed. In this is the case and the caller
         * has requested the system not be heavily disrupted, fail the
         * allocation now instead of entering direct reclaim
         */
        if (deferred_compaction && (gfp_mask & __GFP_NO_KSWAPD))
                goto nopage;

I didn't include a patch that removed the above check because hurting
overall performance to improve the THP figure is not what the average
user wants. It's something to consider though if someone really wants
to maximise THP usage no matter what it does to the workload initially.

This is summary of vmstat figures from the same test.

                                       3.1.0-vanilla rc5-vanilla freemore-v6r1 isolate-v6r1 andrea-v2r1
Page Ins                                  3257266139  1111844061    17263623    10901575   161423219
Page Outs                                   81054922    30364312     3626530     3657687     8753730
Swap Ins                                        3294        2851        6560        4964        4592
Swap Outs                                     390073      528094      620197      790912      698285
Direct pages scanned                      1077581700  3024951463  1764930052   115140570  5901188831
Kswapd pages scanned                        34826043     7112868     2131265     1686942     1893966
Kswapd pages reclaimed                      28950067     4911036     1246044      966475     1497726
Direct pages reclaimed                     805148398   280167837     3623473     2215044    40809360
Kswapd efficiency                                83%         69%         58%         57%         79%
Kswapd velocity                              664.399     622.521    4253.852    7304.360     751.490
Direct efficiency                                74%          9%          0%          1%          0%
Direct velocity                            20557.737  264745.137 3522673.849  498551.938 2341481.435
Percentage direct scans                          96%         99%         99%         98%         99%
Page writes by reclaim                        722646      529174      620319      791018      699198
Page writes file                              332573        1080         122         106         913
Page writes anon                              390073      528094      620197      790912      698285
Page reclaim immediate                             0  2552514720  1635858848   111281140  5478375032
Page rescued immediate                             0           0           0       87848           0
Slabs scanned                                  23552       23552        9216        8192        9216
Direct inode steals                              231           0           0           0           0
Kswapd inode steals                                0           0           0           0           0
Kswapd skipped wait                            28076         786           0          61           6
THP fault alloc                                  609         383         753         906        1433
THP collapse alloc                                12           6           0           0           6
THP splits                                       536         211         456         593        1136
THP fault fallback                              4406        4633        4263        4110        3583
THP collapse fail                                120         127           0           0           4
Compaction stalls                               1810         728         623         779        3200
Compaction success                               196          53          60          80         123
Compaction failures                             1614         675         563         699        3077
Compaction pages moved                        193158       53545      243185      333457      226688
Compaction move failure                         9952        9396       16424       23676       45070

The main things to look at are

1. Page In/out figures are much reduced by the series.

2. Direct page scanning is incredibly high (264745.137 pages scanned
   per second on the vanilla kernel) but isolating PageReclaim pages
   on their own list reduces the number of pages scanned significantly.

3. The fact that "Page rescued immediate" is a positive number implies
   that we sometimes race removing pages from the LRU_IMMEDIATE list
   that need to be put back on a normal LRU but it happens only for
   0.07% of the pages marked for immediate reclaim.

writebackCPDeviceext4
                   3.1.0-vanilla         rc5-vanilla       freemore-v6r1        isolate-v6r1         andrea-v2r1
System Time         1.51 (    0.00%)    1.77 (  -17.66%)    1.46 (    2.92%)    1.15 (   23.77%)    1.89 (  -25.63%)
+/-                 0.27 (    0.00%)    0.67 ( -148.52%)    0.33 (  -22.76%)    0.30 (  -11.15%)    0.19 (   30.16%)
User Time           0.03 (    0.00%)    0.04 (  -37.50%)    0.05 (  -62.50%)    0.07 ( -112.50%)    0.04 (  -18.75%)
+/-                 0.01 (    0.00%)    0.02 ( -146.64%)    0.02 (  -97.91%)    0.02 (  -75.59%)    0.02 (  -63.30%)
Elapsed Time      124.93 (    0.00%)  114.49 (    8.36%)   96.77 (   22.55%)   27.48 (   78.00%)  205.70 (  -64.65%)
+/-                20.20 (    0.00%)   74.39 ( -268.34%)   59.88 ( -196.48%)    7.72 (   61.79%)   25.03 (  -23.95%)
THP Active        161.80 (    0.00%)   83.60 (   51.67%)  141.20 (   87.27%)   84.60 (   52.29%)   82.60 (   51.05%)
+/-                71.95 (    0.00%)   43.80 (   60.88%)   26.91 (   37.40%)   59.02 (   82.03%)   52.13 (   72.45%)
Fault Alloc       471.40 (    0.00%)  228.60 (   48.49%)  282.20 (   59.86%)  225.20 (   47.77%)  388.40 (   82.39%)
+/-                88.07 (    0.00%)   87.42 (   99.26%)   73.79 (   83.78%)  109.62 (  124.47%)   82.62 (   93.81%)
Fault Fallback    531.60 (    0.00%)  774.60 (  -45.71%)  720.80 (  -35.59%)  777.80 (  -46.31%)  614.80 (  -15.65%)
+/-                88.07 (    0.00%)   87.26 (    0.92%)   73.79 (   16.22%)  109.62 (  -24.47%)   82.29 (    6.56%)
MMTests Statistics: duration
User/Sys Time Running Test (seconds)         50.22     33.76     30.65     24.14    128.45
Total Elapsed Time (seconds)               1113.73   1132.19   1029.45    759.49   1707.26

Similar test but the USB stick is using ext4 instead of vfat. As
ext4 does not use writepage for migration, the large stalls due to
compaction when THP is enabled are not observed. Still, isolating
PageReclaim pages on their own list helped completion time largely
by reducing the number of pages scanned by direct reclaim although
time spend in congestion_wait could also be a factor.

Again, Andrea's series had far higher success rates for THP allocation
at the cost of elapsed time. I didn't look too closely but a quick
look at the vmstat figures tells me kswapd reclaimed 8 times more pages
than the patch series and direct reclaim reclaimed roughly three times
as many pages. It follows that if memory is aggressively reclaimed,
there will be more available for THP.

writebackCPFilevfat
                   3.1.0-vanilla         rc5-vanilla       freemore-v6r1        isolate-v6r1         andrea-v2r1
System Time         1.76 (    0.00%)   29.10 (-1555.52%)   46.01 (-2517.18%)    4.79 ( -172.35%)   54.89 (-3022.53%)
+/-                 0.14 (    0.00%)   25.61 (-18185.17%)    2.15 (-1434.83%)    6.60 (-4610.03%)    9.75
(-6863.76%)
User Time           0.05 (    0.00%)    0.07 (  -45.83%)    0.05 (   -4.17%)    0.06 (  -29.17%)    0.06 (  -16.67%)
+/-                 0.02 (    0.00%)    0.02 (   20.11%)    0.02 (   -3.14%)    0.01 (   31.58%)    0.01 (   47.41%)
Elapsed Time     22520.79 (    0.00%) 1082.85 (   95.19%)   73.30 (   99.67%)   32.43 (   99.86%)  291.84 (  98.70%)
+/-              7277.23 (    0.00%)  706.29 (   90.29%)   19.05 (   99.74%)   17.05 (   99.77%)  125.55 (   98.27%)
THP Active         83.80 (    0.00%)   12.80 (   15.27%)   15.60 (   18.62%)   13.00 (   15.51%)    0.80 (    0.95%)
+/-                66.81 (    0.00%)   20.19 (   30.22%)    5.92 (    8.86%)   15.06 (   22.54%)    1.17 (    1.75%)
Fault Alloc       171.00 (    0.00%)   67.80 (   39.65%)   97.40 (   56.96%)  125.60 (   73.45%)  133.00 (   77.78%)
+/-                82.91 (    0.00%)   30.69 (   37.02%)   53.91 (   65.02%)   55.05 (   66.40%)   21.19 (   25.56%)
Fault Fallback    832.00 (    0.00%)  935.20 (  -12.40%)  906.00 (   -8.89%)  877.40 (   -5.46%)  870.20 (   -4.59%)
+/-                82.91 (    0.00%)   30.69 (   62.98%)   54.01 (   34.86%)   55.05 (   33.60%)   20.91 (   74.78%)
MMTests Statistics: duration
User/Sys Time Running Test (seconds)       7229.81    928.42    704.52     80.68   1330.76
Total Elapsed Time (seconds)             112849.04   5618.69    571.11    360.54   1664.28

In this case, the test is reading/writing only from filesystems but as
it's vfat, it's slow due to calling writepage during compaction. Little
to observe really - the time to complete the test goes way down
with the series applied and THP allocation success rates go up in
comparison to 3.2-rc5.  The success rates are lower than 3.1.0 but
the elapsed time for that kernel is abysmal so it is not really a
sensible comparison.

As before, Andrea's series allocates more THPs at the cost of overall
performance.

writebackCPFileext4
                   3.1.0-vanilla         rc5-vanilla       freemore-v6r1        isolate-v6r1         andrea-v2r1
System Time         1.51 (    0.00%)    1.77 (  -17.66%)    1.46 (    2.92%)    1.15 (   23.77%)    1.89 (  -25.63%)
+/-                 0.27 (    0.00%)    0.67 ( -148.52%)    0.33 (  -22.76%)    0.30 (  -11.15%)    0.19 (   30.16%)
User Time           0.03 (    0.00%)    0.04 (  -37.50%)    0.05 (  -62.50%)    0.07 ( -112.50%)    0.04 (  -18.75%)
+/-                 0.01 (    0.00%)    0.02 ( -146.64%)    0.02 (  -97.91%)    0.02 (  -75.59%)    0.02 (  -63.30%)
Elapsed Time      124.93 (    0.00%)  114.49 (    8.36%)   96.77 (   22.55%)   27.48 (   78.00%)  205.70 (  -64.65%)
+/-                20.20 (    0.00%)   74.39 ( -268.34%)   59.88 ( -196.48%)    7.72 (   61.79%)   25.03 (  -23.95%)
THP Active        161.80 (    0.00%)   83.60 (   51.67%)  141.20 (   87.27%)   84.60 (   52.29%)   82.60 (   51.05%)
+/-                71.95 (    0.00%)   43.80 (   60.88%)   26.91 (   37.40%)   59.02 (   82.03%)   52.13 (   72.45%)
Fault Alloc       471.40 (    0.00%)  228.60 (   48.49%)  282.20 (   59.86%)  225.20 (   47.77%)  388.40 (   82.39%)
+/-                88.07 (    0.00%)   87.42 (   99.26%)   73.79 (   83.78%)  109.62 (  124.47%)   82.62 (   93.81%)
Fault Fallback    531.60 (    0.00%)  774.60 (  -45.71%)  720.80 (  -35.59%)  777.80 (  -46.31%)  614.80 (  -15.65%)
+/-                88.07 (    0.00%)   87.26 (    0.92%)   73.79 (   16.22%)  109.62 (  -24.47%)   82.29 (    6.56%)
MMTests Statistics: duration
User/Sys Time Running Test (seconds)         50.22     33.76     30.65     24.14    128.45
Total Elapsed Time (seconds)               1113.73   1132.19   1029.45    759.49   1707.26

Same type of story - elapsed times go down. In this case, allocation
success rates are roughtly the same. As before, Andrea's has higher
success rates but takes a lot longer.

Overall the series does reduce latencies and while the tests are
inherency racy as alloc competes with the cp processes, the variability
was included. The THP allocation rates are not as high as they could
be but that is because we would have to be more aggressive about
reclaim and compaction impacting overall performance.

This patch:

Commit 39deaf85 ("mm: compaction: make isolate_lru_page() filter-aware")
noted that compaction does not migrate dirty or writeback pages and that
is was meaningless to pick the page and re-add it to the LRU list.

What was missed during review is that asynchronous migration moves dirty
pages if their ->migratepage callback is migrate_page() because these can
be moved without blocking.  This potentially impacted hugepage allocation
success rates by a factor depending on how many dirty pages are in the
system.

This patch partially reverts 39deaf85 to allow migration to isolate dirty
pages again.  This increases how much compaction disrupts the LRU but that
is addressed later in the series.

Signed-off-by: Mel Gorman <mgorman@suse.de>
Reviewed-by: Andrea Arcangeli <aarcange@redhat.com>
Reviewed-by: Rik van Riel <riel@redhat.com>
Reviewed-by: Minchan Kim <minchan.kim@gmail.com>
Cc: Dave Jones <davej@redhat.com>
Cc: Jan Kara <jack@suse.cz>
Cc: Andy Isaacson <adi@hexapodia.org>
Cc: Nai Xia <nai.xia@gmail.com>
Cc: Johannes Weiner <jweiner@redhat.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

Conflicts:

	mm/compaction.c

kswapd: reduce time spent in congestion_wait

By reducing the amount of time kswapd spends in
congestion_wait kswapd is able to free up more
memory in the background and therefore  reduce
the amount  of time spent in direct reclaim.

Change-Id: I46ebe577f8954d8ce9907430958fa0e53090979c
Signed-off-by: Liam Mark <lmark@codeaurora.org>
Signed-off-by: Greg Grisco <ggrisco@codeaurora.org>

ARM: 7178/1: fault.c: Port OOM changes into do_page_fault

Commit d065bd810b6deb67d4897a14bfe21f8eb526ba99
(mm: retry page fault when blocking on disk transfer) and
commit 37b23e0525d393d48a7d59f870b3bc061a30ccdb
(x86,mm: make pagefault killable)

The above commits introduced changes into the x86 pagefault handler
for making the page fault handler retryable as well as killable.

These changes reduce the mmap_sem hold time, which is crucial
during OOM killer invocation.

Port these changes to ARM.

Without these changes, my ARM board encounters many hang and livelock
scenarios.
After applying this patch, OOM feature performance improves according to
my testing.

Signed-off-by: Kautuk Consul <consul.kautuk@gmail.com>
Signed-off-by: Russell King <rmk+kernel@arm.linux.org.uk>

Conflicts:

	arch/arm/mm/fault.c
modified for Tuna kernel from Mainline by faux123

ARM: smp: Fix cpu_up() racing with sys_reboot

Nothing stops a process from hotplugging in a CPU concurrently
with a sys_reboot() call. In such a situation we could have
ipi_cpu_stop() mark a cpu as 'offline' and _cpu_up() ignore the
fact that the CPU is not really offline and call the
CPU_UP_PREPARE notifier. When this happens stop_machine code will
complain that the cpu thread already exists and BUG_ON().

CPU0                      CPU1

sys_reboot()
 kernel_restart()
  machine_restart()
   machine_shutdown()
    smp_send_stop()
    ...                   ipi_cpu_stop()
                           set_cpu_online(1, false)
                            local_irq_disable()
                             while(1)
    <PREEMPT>
cpu_up()
 _cpu_up()
   if (!cpu_online(1))
    __cpu_notify(CPU_UP_PREPARE...)
cpu_stop_cpu_callback()
  BUG_ON(stopper->thread)

This is easily reproducible by hotplugging in and out in a tight
loop while also rebooting.

Since the CPU is not really offline and hasn't gone through the
proper steps to be marked as such, let's mark the CPU as inactive.
This is just as easily testable as online and avoids any possibility
of _cpu_up() trying to bring the CPU back online when it never was
offline to begin with.

Signed-off-by: Stephen Boyd <sboyd@codeaurora.org>
modified for tuna kernel by faux123 from Linux 3.5+

time: RCU permitted to stop idle entry via softirq

RCU needs to be able to use softirq to stop idle entry in order to
be able to drain RCU callbacks from the current CPU, which in turn
enables faster entry into dyntick-idle mode, which in turn reduces power
consumption.  This commit therefore silences the error message that is
sometimes produced when the going-idle CPU suddenly finds that it has
an RCU_SOFTIRQ to process.

Signed-off-by: Paul E. McKenney <paul.mckenney@linaro.org>
backported by faux123 from Linux 3.5+ to Linux 3.0

tmpfs: fix mempolicy object leaks

This patch fixes several mempolicy leaks in the tmpfs mount logic.
These leaks are slow - on the order of one object leaked per mount
attempt.

Leak 1 (umount doesn't free mpol allocated in mount):
    while true; do
        mount -t tmpfs -o mpol=interleave,size=100M nodev /mnt
        umount /mnt
    done

Leak 2 (errors parsing remount options will leak mpol):
    mount -t tmpfs -o size=100M nodev /mnt
    while true; do
        mount -o remount,mpol=interleave,size=x /mnt 2> /dev/null
    done
    umount /mnt

Leak 3 (multiple mpol per mount leak mpol):
    while true; do
        mount -t tmpfs -o mpol=interleave,mpol=interleave,size=100M nodev /mnt
        umount /mnt
    done

This patch fixes all of the above.  I could have broken the patch into
three pieces but is seemed easier to review as one.

Signed-off-by: Greg Thelen <gthelen@google.com>
modified for Mako kernel from LKML reference

Signed-off-by: faux123 <reioux@gmail.com>

time: cast ->raw_interval to u64 to avoid shift overflow

We fixed a bunch of integer overflows in timekeeping code during the 3.6
cycle.  I did an audit based on that and found this potential overflow.

Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
backported from Linux 3.6+ to Tuna Hybrid kernel by faux123

net: wireless: bcmdhd: Fix possible memory leak in escan/iscan

Signed-off-by: Dmitry Shmidt <dimitrysh@google.com>

net: wireless: bcmdhd: Call init_ioctl() only if was started properly

Signed-off-by: Dmitry Shmidt <dimitrysh@google.com>

Conflicts:
	drivers/net/wireless/bcmdhd/wl_android.c

ARM: mm: use TTBR1 instead of reserved context ID

On ARMv7 CPUs that cache first level page table entries (like the
Cortex-A15), using a reserved ASID while changing the TTBR or flushing
the TLB is unsafe.

This is because the CPU may cache the first level entry as the result of
a speculative memory access while the reserved ASID is assigned. After
the process owning the page tables dies, the memory will be reallocated
and may be written with junk values which can be interpreted as global,
valid PTEs by the processor. This will result in the TLB being populated
with bogus global entries.

This patch avoids the use of a reserved context ID in the v7 switch_mm
and ASID rollover code by temporarily using the swapper_pg_dir pointed
at by TTBR1, which contains only global entries that are not tagged
with ASIDs.

Acked-by: Catalin Marinas <catalin.marinas@arm.com>
Signed-off-by: Will Deacon <will.deacon@arm.com>

ARM: mm: allow ASID 0 to be allocated to tasks

Now that ASID 0 is no longer used as a reserved value, allow it to be
allocated to tasks.

Acked-by: Catalin Marinas <catalin.marinas@arm.com>
Signed-off-by: Will Deacon <will.deacon@arm.com>

ARM: mm: Optimise the v7 Dcache flush all routine.

The current algorithm flushes using the SET and WAY, where it iterates over
a given SET in all the WAYS and to the next SET. Change this so that every
successive flush address will go to in to the alternate EMIF(1/2), there by
utilising the full bandwidth. Also iterating all the SETS of a given WAY,
and then switching to the next way can reduce the possibility of frequent
change in the row bits during successive transactions of the DDR memory.
This will help in reducing the ROW open/close time.

Signed-off-by: Marquette Anderson <m-anderson13@ti.com>

ARM: mm: Add v7_flush_dcache_by_level() API.

On ARMv7 based SOC with an integrated L2 cache, there is a need to have a flush
api to operate on each cache level. In few low power modes, L2 cache is retained
where as L1 is lost. The current v7_flush_dcache_all(), flushes all the levels
and it would be quite expensive.

So introduce v7_flush_dcache_by_level() API which takes a parameter (cache
level), and flush only on that level.

The set/way loops can be shared between v7_flush_dcache_by_level() and
v7_flush_dcache_all(). I didn't do that in this version to avoid indirections
and primiarily not to touch the existing and widely used API.

Signed-off-by: Santosh Shilimkar <santosh.shilimkar@ti.com>
Signed-off-by: Sricharan R <r.sricharan@ti.com>

ARM: OMAP: DMA: Correct cpu checking for OMAP4

Update function for CPU check for DMA. Current function are
not defined. So check is not working. We should use cpu_is_omap44xx.

Signed-off-by: Sebastien Guiriec <s-guiriec@ti.com>

Conflicts:
	arch/arm/mach-omap2/dma.c

ARM: OMAP: Improve register access in L3 Error handler.

* Changed the way of accessing L3 target
  registers from standard base rather
  than relative to STDERRLOG_MAIN.

* Use ffs() to find error source from
  the L3_FLAGMUX_REGERRn register.

* Remove extra l3_base[] entry.

* Modified L3 custom error message.

Signed-off-by: Todd Poynor <toddpoynor@google.com>
Signed-off-by: R Sricharan <r.sricharan@ti.com>
Signed-off-by: Santosh Shilimkar <santosh.shilimkar@ti.com>

Conflicts:
	arch/arm/mach-omap2/omap_l3_noc.c
	arch/arm/mach-omap2/omap_l3_noc.h

ARM: OMAP: Fix a BUG in l3 error handler.

With the current sequence of registering the irq and
assigning it to the app_irq, debug_irq driver variables,
there can be corner cases where the pending irq gets
triggered immediately after registering, handler gets called
resulting in a crash. So changed this sequence.

Signed-off-by: R Sricharan <r.sricharan@ti.com>
Signed-off-by: Todd Poynor <toddpoynor@google.com>
Signed-off-by: Santosh Shilimkar <santosh.shilimkar@ti.com>

ARM: OMAP: Fix indentation issues in l3 error handler.

The indentation problems in the l3 noc and smx
error handler files are fixed.

Signed-off-by: R Sricharan <r.sricharan@ti.com>
Signed-off-by: Santosh Shilimkar <santosh.shilimkar@ti.com>
Reported-by: Paul Walmsley <paul@pwsan.com>
Cc: Paul Walmsley <paul@pwsan.com>

ARM: OMAP: Fix sparse warnings in l3 error handler.

Fix below sparse warnings from the l3-noc and l3-smx error handlers
files.

arch/arm/mach-omap2/omap_l3_smx.h:209:22: warning: symbol 'omap3_l3_app_bases' was not declared. Should it be static?
arch/arm/mach-omap2/omap_l3_smx.h:308:22: warning: symbol 'omap3_l3_debug_bases' was not declared. Should it be static?
arch/arm/mach-omap2/omap_l3_smx.h:325:2: warning: incorrect type in initializer (different address spaces)
arch/arm/mach-omap2/omap_l3_smx.h:325:2:    expected unsigned int [usertype] *
arch/arm/mach-omap2/omap_l3_smx.h:325:2:    got unsigned int [noderef] [toplevel] <asn:2>*<noident>
arch/arm/mach-omap2/omap_l3_smx.h:326:2: warning: incorrect type in initializer (different address spaces)
arch/arm/mach-omap2/omap_l3_smx.h:326:2:    expected unsigned int [usertype] *
arch/arm/mach-omap2/omap_l3_smx.h:326:2:    got unsigned int [noderef] [toplevel] <asn:2>*<noident>
arch/arm/mach-omap2/omap_l3_smx.h:324:5: warning: symbol 'omap3_l3_bases' was not declared. Should it be static?
  CC      arch/arm/mach-omap2/omap_l3_smx.o
  CHECK   arch/arm/mach-omap2/omap_l3_noc.c
arch/arm/mach-omap2/omap_l3_noc.c:73:13: warning: symbol '__v' shadows an earlier one
arch/arm/mach-omap2/omap_l3_noc.c:73:13: originally declared here
arch/arm/mach-omap2/omap_l3_noc.c:83:20: warning: symbol '__v' shadows an earlier one
arch/arm/mach-omap2/omap_l3_noc.c:83:20: originally declared here
arch/arm/mach-omap2/omap_l3_noc.c:90:5: warning: symbol '__v' shadows an earlier one
arch/arm/mach-omap2/omap_l3_noc.c:90:5: originally declared here
arch/arm/mach-omap2/omap_l3_noc.h:39:5: warning: symbol 'l3_flagmux' was not declared. Should it be static?
arch/arm/mach-omap2/omap_l3_noc.h:46:5: warning: symbol 'l3_targ_inst_clk1' was not declared. Should it be static?
arch/arm/mach-omap2/omap_l3_noc.h:54:5: warning: symbol 'l3_targ_inst_clk2' was not declared. Should it be static?
arch/arm/mach-omap2/omap_l3_noc.h:75:5: warning: symbol 'l3_targ_inst_clk3' was not declared. Should it be static?
arch/arm/mach-omap2/omap_l3_noc.h:79:6: warning: symbol 'l3_targ_inst_name' was not declared. Should it be static?
arch/arm/mach-omap2/omap_l3_noc.h:112:5: warning: symbol 'l3_targ' was not declared. Should it be static?
arch/arm/mach-omap2/omap_l3_noc.c:72:11: warning: cast removes address space of expression
arch/arm/mach-omap2/omap_l3_noc.c:73:13: warning: incorrect type in argument 1 (different base types)
arch/arm/mach-omap2/omap_l3_noc.c:73:13:    expected void const volatile [noderef] <asn:2>*<noident>
arch/arm/mach-omap2/omap_l3_noc.c:73:13:    got unsigned int
arch/arm/mach-omap2/omap_l3_noc.c:83:20: warning: incorrect type in argument 1 (different base types)
arch/arm/mach-omap2/omap_l3_noc.c:83:20:    expected void const volatile [noderef] <asn:2>*<noident>
arch/arm/mach-omap2/omap_l3_noc.c:83:20:    got unsigned int
arch/arm/mach-omap2/omap_l3_noc.c:90:5: warning: incorrect type in argument 1 (different base types)
arch/arm/mach-omap2/omap_l3_noc.c:90:5:    expected void const volatile [noderef] <asn:2>*<noident>
arch/arm/mach-omap2/omap_l3_noc.c:90:5:    got unsigned int
arch/arm/mach-omap2/omap_l3_noc.c:96:5: warning: incorrect type in argument 1 (different base types)
arch/arm/mach-omap2/omap_l3_noc.c:96:5:    expected void const volatile [noderef] <asn:2>*<noident>
arch/arm/mach-omap2/omap_l3_noc.c:96:5:    got unsigned int
arch/arm/mach-omap2/omap_l3_noc.c:108:5: warning: incorrect type in argument 1 (different base types)
arch/arm/mach-omap2/omap_l3_noc.c:108:5:    expected void const volatile [noderef] <asn:2>*<noident>
arch/arm/mach-omap2/omap_l3_noc.c:108:5:    got unsigned int

Signed-off-by: R Sricharan <r.sricharan@ti.com>
Signed-off-by: Santosh Shilimkar <santosh.shilimkar@ti.com>
Reported-by: Paul Walmsley <paul@pwsan.com>
Cc: Paul Walmsley <paul@pwsan.com>

Conflicts:
	arch/arm/mach-omap2/omap_l3_noc.h

ARM: OMAP: Print Initiator name for l3 custom error.

The initiator id gets logged in the l3 target
registers for custom error. So print it
to aid debugging.

Based on a internal patch by Devaraj Rangasamy <dev@ti.com>

Signed-off-by: R Sricharan <r.sricharan@ti.com>

fs/super.c: sync ro remount after blocking writers

Move sync_filesystem() after sb_prepare_remount_readonly().  If writers
sneak in anywhere from sync_filesystem() to sb_prepare_remount_readonly()
it can cause inodes to be dirtied and writeback to occur well after
sys_mount() has completely successfully.

This was spotted by corrupted ubifs filesystems on reboot, but appears
that it can cause issues with any filesystem using writeback.

CRs-Fixed: 627559
Change-Id: Ib417b59d39210aab2de4e5ae48b18129e8bc3e26
Cc: Artem Bityutskiy <dedekind1@gmail.com>
Cc: Christoph Hellwig <hch@infradead.org>
Cc: Alexander Viro <viro@zeniv.linux.org.uk>
CC: Richard Weinberger <richard@nod.at>
Co-authored-by: Richard Weinberger <richard@nod.at>
Signed-off-by: Andrew Ruder <andrew.ruder@elecsyscorp.com>
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
Git-commit: 807612db2f9940b9fa6deaef054eb16d51bd3e00
Git-repo: git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
Signed-off-by: Subhash Jadavani <subhashj@codeaurora.org>

n_tty: Fix n_tty_write crash when echoing in raw mode

The tty atomic_write_lock does not provide an exclusion guarantee for
the tty driver if the termios settings are LECHO & !OPOST.  And since
it is unexpected and not allowed to call TTY buffer helpers like
tty_insert_flip_string concurrently, this may lead to crashes when
concurrect writers call pty_write. In that case the following two
writers:
* the ECHOing from a workqueue and
* pty_write from the process
race and can overflow the corresponding TTY buffer like follows.

If we look into tty_insert_flip_string_fixed_flag, there is:
  int space = __tty_buffer_request_room(port, goal, flags);
  struct tty_buffer *tb = port->buf.tail;
  ...
  memcpy(char_buf_ptr(tb, tb->used), chars, space);
  ...
  tb->used += space;

so the race of the two can result in something like this:
              A                                B
__tty_buffer_request_room
                                  __tty_buffer_request_room
memcpy(buf(tb->used), ...)
tb->used += space;
                                  memcpy(buf(tb->used), ...) ->BOOM

B's memcpy is past the tty_buffer due to the previous A's tb->used
increment.

Since the N_TTY line discipline input processing can output
concurrently with a tty write, obtain the N_TTY ldisc output_lock to
serialize echo output with normal tty writes.  This ensures the tty
buffer helper tty_insert_flip_string is not called concurrently and
everything is fine.

Note that this is nicely reproducible by an ordinary user using
forkpty and some setup around that (raw termios + ECHO). And it is
present in kernels at least after commit
d945cb9cce20ac7143c2de8d88b187f62db99bdc (pty: Rework the pty layer to
use the normal buffering logic) in 2.6.31-rc3.

js: add more info to the commit log
js: switch to bool
js: lock unconditionally
js: lock only the tty->ops->write call

Change-Id: I1321fcfbb9c324929d26326a8a1ec330e7b9496c
References: CVE-2014-0196
Reported-and-tested-by: Jiri Slaby <jslaby@suse.cz>
Signed-off-by: Peter Hurley <peter@hurleysoftware.com>
Signed-off-by: Jiri Slaby <jslaby@suse.cz>
Cc: Linus Torvalds <torvalds@linux-foundation.org>
Cc: Alan Cox <alan@lxorguk.ukuu.org.uk>
Cc: <stable@vger.kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

OMAP4: PM: Removed redundant code added by mismerge

sleep44xx.S has code repeated three times. It is duplicated in merge
a80710ad1a7ddfee509425056ac5e0483d88fbaa and then in merge
abf9aaf60d96bb25036590169b910f52548c5eb0.

Change-Id: I62cfeb261acb0fdd7a1686e8eb072ad07bf0b77c
Signed-off-by: Ivan Khoronzhuk <ivan.khoronzhuk@ti.com>

futex: Prevent attaching to kernel threads

We happily allow userspace to declare a random kernel thread to be the
owner of a user space PI futex.

Found while analysing the fallout of Dave Jones syscall fuzzer.

We also should validate the thread group for private futexes and find
some fast way to validate whether the "alleged" owner has RW access on
the file which backs the SHM, but that's a separate issue.

Change-Id: I03941dc5737bcb9d3ddd2ec88f7c263c27a1247d
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Cc: Dave Jones <davej@redhat.com>
Cc: Linus Torvalds <torvalds@linux-foundation.org>
Cc: Peter Zijlstra <peterz@infradead.org>
Cc: Darren Hart <darren@dvhart.com>
Cc: Davidlohr Bueso <davidlohr@hp.com>
Cc: Steven Rostedt <rostedt@goodmis.org>
Cc: Clark Williams <williams@redhat.com>
Cc: Paul McKenney <paulmck@linux.vnet.ibm.com>
Cc: Lai Jiangshan <laijs@cn.fujitsu.com>
Cc: Roland McGrath <roland@hack.frob.com>
Cc: Carlos ODonell <carlos@redhat.com>
Cc: Jakub Jelinek <jakub@redhat.com>
Cc: Michael Kerrisk <mtk.manpages@gmail.com>
Cc: Sebastian Andrzej Siewior <bigeasy@linutronix.de>
Link: http://lkml.kernel.org/r/20140512201701.194824402@linutronix.de
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Cc: stable@vger.kernel.org

futex: Add another early deadlock detection check

Dave Jones trinity syscall fuzzer exposed an issue in the deadlock
detection code of rtmutex:
  http://lkml.kernel.org/r/20140429151655.GA14277@redhat.com

That underlying issue has been fixed with a patch to the rtmutex code,
but the futex code must not call into rtmutex in that case because
    - it can detect that issue early
    - it avoids a different and more complex fixup for backing out

If the user space variable got manipulated to 0x80000000 which means
no lock holder, but the waiters bit set and an active pi_state in the
kernel is found we can figure out the recursive locking issue by
looking at the pi_state owner. If that is the current task, then we
can safely return -EDEADLK.

The check should have been added in commit 59fa62451 (futex: Handle
futex_pi OWNER_DIED take over correctly) already, but I did not see
the above issue caused by user space manipulation back then.

Change-Id: I5242efcdc3c08159c652fe645e1f85b27687e6ca
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Cc: Dave Jones <davej@redhat.com>
Cc: Linus Torvalds <torvalds@linux-foundation.org>
Cc: Peter Zijlstra <peterz@infradead.org>
Cc: Darren Hart <darren@dvhart.com>
Cc: Davidlohr Bueso <davidlohr@hp.com>
Cc: Steven Rostedt <rostedt@goodmis.org>
Cc: Clark Williams <williams@redhat.com>
Cc: Paul McKenney <paulmck@linux.vnet.ibm.com>
Cc: Lai Jiangshan <laijs@cn.fujitsu.com>
Cc: Roland McGrath <roland@hack.frob.com>
Cc: Carlos ODonell <carlos@redhat.com>
Cc: Jakub Jelinek <jakub@redhat.com>
Cc: Michael Kerrisk <mtk.manpages@gmail.com>
Cc: Sebastian Andrzej Siewior <bigeasy@linutronix.de>
Link: http://lkml.kernel.org/r/20140512201701.097349971@linutronix.de
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Cc: stable@vger.kernel.org

futex-prevent-requeue-pi-on-same-futex.patch futex: Forbid uaddr == uaddr2 in futex_requeue(..., requeue_pi=1)

If uaddr == uaddr2, then we have broken the rule of only requeueing
from a non-pi futex to a pi futex with this call. If we attempt this,
then dangling pointers may be left for rt_waiter resulting in an
exploitable condition.

This change brings futex_requeue() into line with
futex_wait_requeue_pi() which performs the same check as per commit
6f7b0a2a5 (futex: Forbid uaddr == uaddr2 in futex_wait_requeue_pi())

[ tglx: Compare the resulting keys as well, as uaddrs might be
  	different depending on the mapping ]

Fixes CVE-2014-3153.

Change-Id: I473bf486ad451de0bfd049a110b69795a6fda451
Reported-by: Pinkie Pie
Signed-off-by: Will Drewry <wad@chromium.org>
Signed-off-by: Kees Cook <keescook@chromium.org>
Cc: stable@vger.kernel.org
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>

futex: Validate atomic acquisition in futex_lock_pi_atomic()

We need to protect the atomic acquisition in the kernel against rogue
user space which sets the user space futex to 0, so the kernel side
acquisition succeeds while there is existing state in the kernel
associated to the real owner.

Verify whether the futex has waiters associated with kernel state. If
it has, return -EINVAL. The state is corrupted already, so no point in
cleaning it up. Subsequent calls will fail as well. Not our problem.

[ tglx: Use futex_top_waiter() and explain why we do not need to try
  	restoring the already corrupted user space state. ]

Change-Id: Ic8714ed2e9dee323a011eed42f7c0159c65dfbf3
Signed-off-by: Darren Hart <dvhart@linux.intel.com>
Cc: Kees Cook <keescook@chromium.org>
Cc: Will Drewry <wad@chromium.org>
Cc: stable@vger.kernel.org
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>

futex: Always cleanup owner tid in unlock_pi

If the owner died bit is set at futex_unlock_pi, we currently do not
cleanup the user space futex. So the owner TID of the current owner
(the unlocker) persists. That's observable inconsistant state,
especially when the ownership of the pi state got transferred.

Clean it up unconditionally.

Change-Id: I4eeb2e139b720f1dd46e43407a96b3d9a19aacd1
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Cc: Kees Cook <keescook@chromium.org>
Cc: Will Drewry <wad@chromium.org>
Cc: Darren Hart <dvhart@linux.intel.com>
Cc: stable@vger.kernel.org

futex: Make lookup_pi_state more robust

The current implementation of lookup_pi_state has ambigous handling of
the TID value 0 in the user space futex. We can get into the kernel
even if the TID value is 0, because either there is a stale waiters
bit or the owner died bit is set or we are called from the requeue_pi
path or from user space just for fun.

The current code avoids an explicit sanity check for pid = 0 in case
that kernel internal state (waiters) are found for the user space
address. This can lead to state leakage and worse under some
circumstances.

Handle the cases explicit:

     Waiter | pi_state | pi->owner | uTID      | uODIED | ?

[1]  NULL   | ---      | ---       | 0         | 0/1    | Valid
[2]  NULL   | ---      | ---       | >0        | 0/1    | Valid

[3]  Found  | NULL     | --        | Any       | 0/1    | Invalid

[4]  Found  | Found    | NULL      | 0         | 1      | Valid
[5]  Found  | Found    | NULL      | >0        | 1      | Invalid

[6]  Found  | Found    | task      | 0         | 1      | Valid

[7]  Found  | Found    | NULL      | Any       | 0      | Invalid

[8]  Found  | Found    | task      | ==taskTID | 0/1    | Valid
[9]  Found  | Found    | task      | 0         | 0      | Invalid
[10] Found  | Found    | task      | !=taskTID | 0/1    | Invalid

[1]  Indicates that the kernel can acquire the futex atomically. We
     came came here due to a stale FUTEX_WAITERS/FUTEX_OWNER_DIED bit.

[2]  Valid, if TID does not belong to a kernel thread. If no matching
     thread is found then it indicates that the owner TID has died.

[3]  Invalid. The waiter is queued on a non PI futex

[4]  Valid state after exit_robust_list(), which sets the user space
     value to FUTEX_WAITERS | FUTEX_OWNER_DIED.

[5]  The user space value got manipulated between exit_robust_list()
     and exit_pi_state_list()

[6]  Valid state after exit_pi_state_list() which sets the new owner in
     the pi_state but cannot access the user space value.

[7]  pi_state->owner can only be NULL when the OWNER_DIED bit is set.

[8]  Owner and user space value match

[9]  There is no transient state which sets the user space TID to 0
     except exit_robust_list(), but this is indicated by the
     FUTEX_OWNER_DIED bit. See [4]

[10] There is no transient state which leaves owner and user space
     TID out of sync.

Backport to 3.13
  conflicts: kernel/futex.c

Change-Id: Ic410036b38ccb7289b3d58eff56ad64d3a9dcada
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Signed-off-by: John Johansen <john.johansen@canonical.com>
Cc: Kees Cook <keescook@chromium.org>
Cc: Will Drewry <wad@chromium.org>
Cc: Darren Hart <dvhart@linux.intel.com>
Cc: stable@vger.kernel.org