cgroup: Take css_set_lock from cgroup_css_sets_empty()

As indicated in the comment above cgroup_css_sets_empty it needs the
css_set_lock. But neither of the 2 call points have it, so rather then fixing
the callers just take the lock inside cgroup_css_sets_empty().

Signed-off-by: Hans de Goede <hdegoede@redhat.com>
Change-Id: If7aea71824f6d0e3f2cc6c1ce236c3ae6be2037b
cgroup: Fix use after free of cgrp (cgrp->css_sets)

Running a 3.4 kernel + Fedora-18 (systemd) userland on my Allwinner A10
(arm cortex a8), I'm seeing repeated, reproducable list_del list corruption
errors when build with CONFIG_DEBUG_LIST, and the backtrace always shows
free_css_set_work as the function making the problematic list_del call.

I've tracked this doen to a use after free of the cgrp struct, specifically
of the cgrp->css_sets list_head, which gets cleared by free_css_set_work.

Since free_css_set_work runs form a workqueue, it is possible for it to not be
done with clearing the list when the cgrp gets free-ed. To avoid this the code
adding the links increases cgrp->count, and the freeing code running from the
workqueue decreases cgrp->count *after* doing list_del, and then if the count
goes to 0 calls cgroup_wakeup_rmdir_waiter().

However cgroup_rmdir() is missing a check for cgrp->count != 0, causing it
to still continue with the rmdir (which leads to the free-ing of the cgrp),
before free_css_set_work is done. Sometimes the free-ed memory is re-used
before free_css_set_work gets around to unlinking link->cgrp_link_list,
triggering the list_del list corruption messages.

This patch fixes this by properly checking for cgrp->count != 0 and waiting
for the cgroup_rmdir_waitq in that case.

Change-Id: I9dbc02a0a75d5dffa1b65d67456e00139dea57c3
Signed-off-by: Hans de Goede <hdegoede@redhat.com>
Revert "epoll: use freezable blocking call"

This reverts commit 1c441e921201 (epoll: use freezable blocking call)
which is reported to cause user space memory corruption to happen
after suspend to RAM.

Since it appears to be extremely difficult to root cause this
problem, it is best to revert the offending commit and try to address
the original issue in a better way later.

Change-Id: Ib57a2bda6c190454ae3bd3ae7eeb1456ea2156a6
References: https://bugzilla.kernel.org/show_bug.cgi?id=61781
Reported-by: Natrio <natrio@list.ru>
Reported-by: Jeff Pohlmeyer <yetanothergeek@gmail.com>
Bisected-by: Leo Wolf <jclw@ymail.com>
Fixes: 1c441e921201 (epoll: use freezable blocking call)
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
Cc: 3.11+ <stable@vger.kernel.org> # 3.11+
Git-commit: c511851de162e8ec03d62e7d7feecbdf590d881d
Git-repo: git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux-stable.git
Signed-off-by: Osvaldo Banuelos <osvaldob@codeaurora.org>
cma: assign to correct variable in __iommu_alloc_buffer

When we moved to pfns in [9740ba422e "cma: use pfn instead of pages for
argument passing"], there was one place where we should have been using
a page variable instead of a pfn. Fix this.

Change-Id: I8fd920dff19a21ad441a35c0f772f947bfb756d9
Signed-off-by: Mitchel Humpherys <mitchelh@codeaurora.org>
smp: Add task_struct argument to __cpu_up()

Preparatory patch to make the idle thread allocation for secondary
cpus generic.

Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Cc: Peter Zijlstra <peterz@infradead.org>
Cc: Rusty Russell <rusty@rustcorp.com.au>
Cc: Paul E. McKenney <paulmck@linux.vnet.ibm.com>
Cc: Srivatsa S. Bhat <srivatsa.bhat@linux.vnet.ibm.com>
Cc: Matt Turner <mattst88@gmail.com>
Cc: Russell King <linux@arm.linux.org.uk>
Cc: Mike Frysinger <vapier@gentoo.org>
Cc: Jesper Nilsson <jesper.nilsson@axis.com>
Cc: Richard Kuo <rkuo@codeaurora.org>
Cc: Tony Luck <tony.luck@intel.com>
Cc: Hirokazu Takata <takata@linux-m32r.org>
Cc: Ralf Baechle <ralf@linux-mips.org>
Cc: David Howells <dhowells@redhat.com>
Cc: James E.J. Bottomley <jejb@parisc-linux.org>
Cc: Benjamin Herrenschmidt <benh@kernel.crashing.org>
Cc: Martin Schwidefsky <schwidefsky@de.ibm.com>
Cc: Paul Mundt <lethal@linux-sh.org>
Cc: David S. Miller <davem@davemloft.net>
Cc: Chris Metcalf <cmetcalf@tilera.com>
Cc: Richard Weinberger <richard@nod.at>
Cc: x86@kernel.org
Link: http://lkml.kernel.org/r/20120420124556.964170564@linutronix.de

Conflicts:
	arch/arm/kernel/smp.c

Change-Id: Idd1ab4a309918acee2b934fba3de5879663b7fec
arm: Use generic idle thread allocation

Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Cc: Peter Zijlstra <peterz@infradead.org>
Cc: Rusty Russell <rusty@rustcorp.com.au>
Cc: Paul E. McKenney <paulmck@linux.vnet.ibm.com>
Cc: Srivatsa S. Bhat <srivatsa.bhat@linux.vnet.ibm.com>
Cc: Russell King <linux@arm.linux.org.uk>
Tested-by: Frank Rowand <frank.rowand@am.sony.com>
Link: http://lkml.kernel.org/r/20120420124557.448826362@linutronix.de

Conflicts:
	arch/arm/Kconfig
	arch/arm/kernel/smp.c

Change-Id: I5d578157a22fc7accd152a4515e4dd2c9b086b75
cpu: Fix generic idle thread allocation

 * This was missed in the backport, rendering it ineffective.

Change-Id: I1cb079531d0dce913ce3693a9557e99f324ad346
ASoC: wcd9320: Handle the port disconnect correctly

In irq handler driver goes through all irq register
status bits to check which interrupt has really
triggered. However hardware sets the irq status register
regardless of mask value set by the driver. This has
an un-intended consequence of stack dump in driver as
it was not expecting this interrupt.

Change-Id: I2fd9ff93134f76cd924fdab7024e712f95caf7fe
Signed-off-by: Anish Kumar <kanish@codeaurora.org>
ASoC: wcd9xxx: Changes for High performance mode

Add changes for high performance audio playback on headset
for better audio quality during 192KHz/24bit audio playback.

CRs-Fixed: 706322
Change-Id: Ie79293f24114d5d81a610186d24b44b1550dae9c
Signed-off-by: Sudheer Papothi <spapothi@codeaurora.org>
ASoC: wcd9xxx: Change PA on and VDDIO switch sequence

During removing and re-inserting of headset while music
playback is ON, mbhc driver disables HPH PA and re-enables
it once the detection is completed. After enabling PA, it
switches micbias output to VDDIO to avoid polling noise on
the headset. This sequence would cause a glitch because PA
is already enabled while switching to VDDIO is taking place.
Avoid this glitch by changing the sequence - switch to vddio
and then enable HPH PA.

CRs-Fixed: 704414
Change-Id: Ibe7d2ffa65adb0203e67d488acadc299e3a54fc0
Signed-off-by: Phani Kumar Uppalapati <phaniu@codeaurora.org>
ASoC: wcd9xxx: Avoid micbias glitches during audio playback

During audio playback over headset, micbias output is switched
to vddio and it's parameters are programmed so that it will do
button polling with a voltage equal to vddio (1.8v). It is observed
that during this polling interval there is a drop in micbias
voltage which would cause issues with button press. Avoid this
voltage drop by disabling mbhc micbias when vddio switch is enabled.

CRs-Fixed: 705060
Change-Id: I0c2f6a0224760aef1f8e51b1ae34c77fc9863b52
Signed-off-by: Phani Kumar Uppalapati <phaniu@codeaurora.org>
video: mdss: Improve sysfs controls and Truly panel support

 * Don't create bogus sysfs entries
 * Add new features for Truly panel
 * Clean up initialization sequence for Truly panel

Change-Id: I2b65a7689403543fd1a635c7720368513c09293e
video: mdss: Set initial backlight after first frame done

 * Garbage is randomly appearing during unsuspend on the Truly panel.
 * Userspace is updating the backlight sysfs very quickly (good), but in
   some cases there is random garbage in frame memory which might
   end up being displayed to the user (bad).
 * Update the backlight after the first frame done in this case
   to make sure any random crap left in the frame memory is overwritten
   by a proper image.

Change-Id: I800ce2bd2f428b09b0dbf3c5968f92e3acb60f49
asoc: wcd9xxx: Detect more types of headsets

 * With the triple-checked recalibration, the invalid range check is
   causing more harm than good. We've been narrowing this range over
   time, and it's not solving any problems. Kill it with fire.
 * Also raise the delta range to accomodate more variations.

Change-Id: I7c5da6f1b968157528cef30c2c1e8f29bc57a0e7
msm8974: oppo: Enable display partial update feature

 * Need to set the proper alignment and fix userspace parsing of
   panel attributes to get this working.
 * Enable for both JDI and Truly variants to save power.

Change-Id: I3c528c5c59029e500856979a3208d2fb8f039fa8
ARM: 7449/1: use generic strnlen_user and strncpy_from_user functions

This patch implements the word-at-a-time interface for ARM using the
same algorithm as x86. We use the fls macro from ARMv5 onwards, where
we have a clz instruction available which saves us a mov instruction
when targetting Thumb-2. For older CPUs, we use the magic 0x0ff0001
constant. Big-endian configurations make use of the implementation from
asm-generic.

With this implemented, we can replace our byte-at-a-time strnlen_user
and strncpy_from_user functions with the optimised generic versions.

Reviewed-by: Nicolas Pitre <nico@linaro.org>
Signed-off-by: Will Deacon <will.deacon@arm.com>
Signed-off-by: Russell King <rmk+kernel@arm.linux.org.uk>

lib: Sparc's strncpy_from_user is generic enough, move under lib/

To use this, an architecture simply needs to:

1) Provide a user_addr_max() implementation via asm/uaccess.h

2) Add "select GENERIC_STRNCPY_FROM_USER" to their arch Kcnfig

3) Remove the existing strncpy_from_user() implementation and symbol
   exports their architecture had.

Signed-off-by: David S. Miller <davem@davemloft.net>
Acked-by: David Howells <dhowells@redhat.com>

lib: add generic strnlen_user() function

This adds a new generic optimized strnlen_user() function that uses the
<asm/word-at-a-time.h> infrastructure to portably do efficient string
handling.

In many ways, strnlen is much simpler than strncpy, and in particular we
can always pre-align the words we load from memory.  That means that all
the worries about alignment etc are a non-issue, so this one can easily
be used on any architecture.  You obviously do have to do the
appropriate word-at-a-time.h macros.

Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

kernel: Move REPEAT_BYTE definition into linux/kernel.h

And make sure that everything using it explicitly includes
that header file.

Signed-off-by: David S. Miller <davem@davemloft.net>

word-at-a-time: make the interfaces truly generic

This changes the interfaces in <asm/word-at-a-time.h> to be a bit more
complicated, but a lot more generic.

In particular, it allows us to really do the operations efficiently on
both little-endian and big-endian machines, pretty much regardless of
machine details.  For example, if you can rely on a fast population
count instruction on your architecture, this will allow you to make your
optimized <asm/word-at-a-time.h> file with that.

NOTE! The "generic" version in include/asm-generic/word-at-a-time.h is
not truly generic, it actually only works on big-endian.  Why? Because
on little-endian the generic algorithms are wasteful, since you can
inevitably do better. The x86 implementation is an example of that.

(The only truly non-generic part of the asm-generic implementation is
the "find_zero()" function, and you could make a little-endian version
of it.  And if the Kbuild infrastructure allowed us to pick a particular
header file, that would be lovely)

The <asm/word-at-a-time.h> functions are as follows:

 - WORD_AT_A_TIME_CONSTANTS: specific constants that the algorithm
   uses.

 - has_zero(): take a word, and determine if it has a zero byte in it.
   It gets the word, the pointer to the constant pool, and a pointer to
   an intermediate "data" field it can set.

   This is the "quick-and-dirty" zero tester: it's what is run inside
   the hot loops.

 - "prep_zero_mask()": take the word, the data that has_zero() produced,
   and the constant pool, and generate an *exact* mask of which byte had
   the first zero.  This is run directly *outside* the loop, and allows
   the "has_zero()" function to answer the "is there a zero byte"
   question without necessarily getting exactly *which* byte is the
   first one to contain a zero.

   If you do multiple byte lookups concurrently (eg "hash_name()", which
   looks for both NUL and '/' bytes), after you've done the prep_zero_mask()
   phase, the result of those can be or'ed together to get the "either
   or" case.

 - The result from "prep_zero_mask()" can then be fed into "find_zero()"
   (to find the byte offset of the first byte that was zero) or into
   "zero_bytemask()" (to find the bytemask of the bytes preceding the
   zero byte).

   The existence of zero_bytemask() is optional, and is not necessary
   for the normal string routines.  But dentry name hashing needs it, so
   if you enable DENTRY_WORD_AT_A_TIME you need to expose it.

This changes the generic strncpy_from_user() function and the dentry
hashing functions to use these modified word-at-a-time interfaces.  This
gets us back to the optimized state of the x86 strncpy that we lost in
the previous commit when moving over to the generic version.

Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

ARM: 7450/1: dcache: select DCACHE_WORD_ACCESS for little-endian ARMv6+ CPUs

DCACHE_WORD_ACCESS uses the word-at-a-time API for optimised string
comparisons in the vfs layer.

This patch implements support for load_unaligned_zeropad for ARM CPUs
with native support for unaligned memory accesses (v6+) when running
little-endian.

Change-Id: Ifdf8207f2581f93870eb0e627f5d12f97c4be7cc
Reviewed-by: Nicolas Pitre <nico@linaro.org>
Signed-off-by: Will Deacon <will.deacon@arm.com>
Signed-off-by: Russell King <rmk+kernel@arm.linux.org.uk>
msm8974pro: gpu: start gpu at 200Mhz at boot

Change-Id: Ia7e3ede88d8af6c43ce52dccf130503cf9513a70