Revert "ARM: 7747/1: pcpu: ensure __my_cpu_offset cannot be re-ordered across barrier()"

This reverts commit 2ed4f29393865eb718e516a189bbb806e2aabfa1.
Revert "ARM: 7587/1: implement optimized percpu variable access"

This reverts commit 859174f630d8dff3a2cb5991ab82f6146069351a.
vsprintf: ignore %n again

This ignores %n in printf again, as was originally documented.
Implementing %n poses a greater security risk than utility, so it should
stay ignored.  To help anyone attempting to use %n, a warning will be
emitted if it is encountered.

Based on an earlier patch by Joe Perches.

Because %n was designed to write to pointers on the stack, it has been
frequently used as an attack vector when bugs are found that leak
user-controlled strings into functions that ultimately process format
strings.  While this class of bug can still be turned into an
information leak, removing %n eliminates the common method of elevating
such a bug into an arbitrary kernel memory writing primitive,
significantly reducing the danger of this class of bug.

For seq_file users that need to know the length of a written string for
padding, please see seq_setwidth() and seq_pad() instead.

Signed-off-by: Kees Cook <keescook@chromium.org>
Cc: Joe Perches <joe@perches.com>
Cc: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>
Cc: David Miller <davem@davemloft.net>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: David Brown <davidb@codeaurora.org>
Signed-off-by: Pranav Vashi <neobuddy89@gmail.com>
seq_file: introduce seq_setwidth() and seq_pad()

There are several users who want to know bytes written by seq_*() for
alignment purpose.  Currently they are using %n format for knowing it
because seq_*() returns 0 on success.

This patch introduces seq_setwidth() and seq_pad() for allowing them to
align without using %n format.

Signed-off-by: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>
Signed-off-by: Kees Cook <keescook@chromium.org>
Cc: Joe Perches <joe@perches.com>
Cc: David Miller <davem@davemloft.net>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: David Brown <davidb@codeaurora.org>
Signed-off-by: Pranav Vashi <neobuddy89@gmail.com>
dt: introduce for_each_available_child_of_node, of_get_next_available_child

Macro for_each_child_of_node() makes it easy to iterate over all of the
children for a given device tree node, including those nodes that are
marked as unavailable (i.e. status = "disabled").

Introduce for_each_available_child_of_node(), which is like
for_each_child_of_node(), but it automatically skips unavailable nodes.
This also requires the introduction of helper function
of_get_next_available_child(), which returns the next available child
node.

Signed-off-by: Timur Tabi <timur@freescale.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Pranav Vashi <neobuddy89@gmail.com>
cgroup: Take css_set_lock from cgroup_css_sets_empty()

As indicated in the comment above cgroup_css_sets_empty it needs the
css_set_lock. But neither of the 2 call points have it, so rather then fixing
the callers just take the lock inside cgroup_css_sets_empty().

Signed-off-by: Hans de Goede <hdegoede@redhat.com>
Change-Id: If7aea71824f6d0e3f2cc6c1ce236c3ae6be2037b
cgroup: Fix use after free of cgrp (cgrp->css_sets)

Running a 3.4 kernel + Fedora-18 (systemd) userland on my Allwinner A10
(arm cortex a8), I'm seeing repeated, reproducable list_del list corruption
errors when build with CONFIG_DEBUG_LIST, and the backtrace always shows
free_css_set_work as the function making the problematic list_del call.

I've tracked this doen to a use after free of the cgrp struct, specifically
of the cgrp->css_sets list_head, which gets cleared by free_css_set_work.

Since free_css_set_work runs form a workqueue, it is possible for it to not be
done with clearing the list when the cgrp gets free-ed. To avoid this the code
adding the links increases cgrp->count, and the freeing code running from the
workqueue decreases cgrp->count *after* doing list_del, and then if the count
goes to 0 calls cgroup_wakeup_rmdir_waiter().

However cgroup_rmdir() is missing a check for cgrp->count != 0, causing it
to still continue with the rmdir (which leads to the free-ing of the cgrp),
before free_css_set_work is done. Sometimes the free-ed memory is re-used
before free_css_set_work gets around to unlinking link->cgrp_link_list,
triggering the list_del list corruption messages.

This patch fixes this by properly checking for cgrp->count != 0 and waiting
for the cgroup_rmdir_waitq in that case.

Change-Id: I9dbc02a0a75d5dffa1b65d67456e00139dea57c3
Signed-off-by: Hans de Goede <hdegoede@redhat.com>
PM / QoS: Use NULL pointer instead of plain integer in qos.c

Fix the following sparse warning:
drivers/base/power/qos.c:465:29: warning: Using plain integer as NULL pointer

Signed-off-by: Sachin Kamat <sachin.kamat@linaro.org>
Signed-off-by: Rafael J. Wysocki <rjw@sisk.pl>
Signed-off-by: Pranav Vashi <neobuddy89@gmail.com>
arch/arm/mm/proc-v7.S: fix wrong location for DSB after patch 3.4.83
msm: spm-v2: Store voltage levels into PMIC_DATA3

On certain targets, where the SPM controls the power supply for each
core, the SPM power down sequence takes care of restoring the Voltage
level after a power collapse to the appropriate sleep level. The active
voltage level is stored in the PMIC_DATA_3 register and SPM state
machine uses the data in this register to restore the voltage to the
current active level.

Signed-off-by: Mahesh Sivasubramanian <msivasub@codeaurora.org>
Signed-off-by: Pranav Vashi <neobuddy89@gmail.com>
msm: spm-v2: Flush the PMIC_DATA registers

Different versions of SAW use different PMIC_DATA registers to
save the current voltage, which is used to restore voltage when
exiting low power modes. Flush the appropriate PMIC_DATA registers
depending on the SAW versions.

Signed-off-by: Archana Sathyakumar <asathyak@codeaurora.org>
Signed-off-by: Pranav Vashi <neobuddy89@gmail.com>
msm: spm-v2: Use proper register offsets for SAW2_v3.0

Current code get the register offsets for SAW2 based
on hardcode macros. Use SAW2 major, minor numbers to
get the proper register offsets to different versions
of SAW2 controllers(i.e: SAW2_v2.1 and SAW2_v3.0) and
this patch remove the SAW2_v1.1 controller related code.

Signed-off-by: Murali Nalajala <mnalajal@codeaurora.org>
Signed-off-by: Pranav Vashi <neobuddy89@gmail.com>

Conflicts:
	arch/arm/mach-msm/spm-v2.c
msm: spm: set pc mode bit for SAW2_3.0

Set the power collapse bitin SAW2_SPM_CTL register.
This bit is used to differentiate other low power modes
from power collapse mode. This information is used for
contolling DBGWRDUP input signal. If PC_MODE is set DBGPWRDUP
signal is de-asserted as soon as SPM_WAIT_ACK becomes HIGH.
When the PC mode is not set it will help in early exit from
clock gating.

Signed-off-by: Venkat Devarasetty <vdevaras@codeaurora.org>
Signed-off-by: Pranav Vashi <neobuddy89@gmail.com>
msm: spm: Update msm_spm_turn_on_cpu_rail() to use new SAW2 base address

Update the msm_spm_turn_on_cpu_rail() to use SAW2 base addresses passed
from the release_secondary to turn on the cpu rail, before bringing back
the cpu online.

Signed-off-by: Praveen Chidambaram <pchidamb@codeaurora.org>
Signed-off-by: Pranav Vashi <neobuddy89@gmail.com>

Conflicts:
	arch/arm/mach-msm/platsmp.c
	arch/arm/mach-msm/spm.h
	arch/arm/mach-msm/spm_devices.c
binder: search for receiving context pid in global namespace

BugLink: http://bugs.launchpad.net/bugs/1210149

If binder cannot find the receiving task in the sender's namespace it
will default to a null PID which thus breaks communication in our
container-based scenario. This patch extends binder to first look in the
senders namespace and if unsuccesfull search in the global namespace.

Change-Id: I83077ffac575e632c1379bd69ea84b22acc61ba4
Signed-off-by: Ricardo Mendoza <ricardo.mendoza@canonical.com>
Signed-off-by: Tim Gardner <tim.gardner@canonical.com>

https://github.com/Christopher83/samsung-kernel-msm7x30/commit/026fcc5b0163e9d93f843c856805e2981ba5c449
https://bugs.launchpad.net/ubuntu/+source/linux-grouper/+bug/1210149
arm: dma-removed: Add option to skip buffer zeroing

The DMA framework currently zeros all buffers because it (righfully so)
assumes that drivers will soon need to pass the memory to a device.
Some devices/use case may not require zeroed memory and there can
be an increase in performance if we skip the zeroing. Use the
DMA_ATTR_SKIP_ZEROING attr to allow skipping of DMA zeroing.

Signed-off-by: Taniya Das <tdas@codeaurora.org>
Signed-off-by: Pranav Vashi <neobuddy89@gmail.com>
drivers: dma: map pages only if required

DMA clients such as PIL would often allocate large
contiguous physical memory through dma-removed interface
for carve-outs. It may not be possible to map these large
allocations due to insufficient vmalloc space.

Hence provide provision to map the allocated pages only
if mapping or zeroing is explicitly requested for.

Signed-off-by: Shiraz Hashim <shashim@codeaurora.org>
Signed-off-by: Pranav Vashi <neobuddy89@gmail.com>
Fixed spm commits
cma: Increase the default number of regions

The total number of CMA regions that can be created is statically
decided at compile time via a config option. Incoming memory map
changes increase the number of CMA regions significantly across
almost all targets. Rather than make every target set the CONFIG,
just increase the default number. The additional overhead is very
small.

Signed-off-by: Laura Abbott <lauraa@codeaurora.org>
Signed-off-by: Pranav Vashi <neobuddy89@gmail.com>
drivers: cma: Fix wrong CMA selected region size default value

Kconfig lists CMA_SIZE_SEL_ABSOLUTE as the default value fo the CMA
selected region size, but that option isn't available in the defined
choices. Set the default to CMA_SIZE_SEL_MBYTES instead.

Signed-off-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
Signed-off-by: Marek Szyprowski <m.szyprowski@samsung.com>
Signed-off-by: Pranav Vashi <neobuddy89@gmail.com>