Add L-01F(G2 JPN-DCM) defconfig

Change-Id: Ie4a879f10ac4ce85c39dedbc4cd441cf5ece51d7
Add LGL22 au isai (G2 JPN-KDDI) defconfig

Change-Id: Ibff317fb53488450966e12d1606ac06f8225869d
bcmdhd: Adjust default hostwake/reset GPIOs to match the galbis

Change-Id: I84c3d71dde9fdea45652b24a65523d9947cdd25d
bluesleep: Don't wait for uart tx queue to flush before entering standby

There's no need to delay sleep for this. msm_hs_serial will do it on
its own, and this reduces the time to enter lpm

Change-Id: Ia13d44148130aaf133ea888807b5ba114936ce78
Merge "Add L-01F(G2 JPN-DCM) defconfig" into cm-11.0
Merge "Add LGL22 au isai (G2 JPN-KDDI) defconfig" into cm-11.0
futex-prevent-requeue-pi-on-same-futex.patch futex: Forbid uaddr == uaddr2 in futex_requeue(..., requeue_pi=1)

If uaddr == uaddr2, then we have broken the rule of only requeueing
from a non-pi futex to a pi futex with this call. If we attempt this,
then dangling pointers may be left for rt_waiter resulting in an
exploitable condition.

This change brings futex_requeue() into line with
futex_wait_requeue_pi() which performs the same check as per commit
6f7b0a2a5 (futex: Forbid uaddr == uaddr2 in futex_wait_requeue_pi())

[ tglx: Compare the resulting keys as well, as uaddrs might be
  	different depending on the mapping ]

Fixes CVE-2014-3153.

Reported-by: Pinkie Pie
Signed-off-by: Will Drewry <wad@chromium.org>
Signed-off-by: Kees Cook <keescook@chromium.org>
Cc: stable@vger.kernel.org
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>

Change-Id: I155eafa98f365408450527e34998893dcdd64801
futex: Validate atomic acquisition in futex_lock_pi_atomic()

We need to protect the atomic acquisition in the kernel against rogue
user space which sets the user space futex to 0, so the kernel side
acquisition succeeds while there is existing state in the kernel
associated to the real owner.

Verify whether the futex has waiters associated with kernel state. If
it has, return -EINVAL. The state is corrupted already, so no point in
cleaning it up. Subsequent calls will fail as well. Not our problem.

[ tglx: Use futex_top_waiter() and explain why we do not need to try
  	restoring the already corrupted user space state. ]

Signed-off-by: Darren Hart <dvhart@linux.intel.com>
Cc: Kees Cook <keescook@chromium.org>
Cc: Will Drewry <wad@chromium.org>
Cc: stable@vger.kernel.org
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>

Change-Id: I155eafa98f365408450527e34998893dcdd64802
futex: Always cleanup owner tid in unlock_pi

If the owner died bit is set at futex_unlock_pi, we currently do not
cleanup the user space futex. So the owner TID of the current owner
(the unlocker) persists. That's observable inconsistant state,
especially when the ownership of the pi state got transferred.

Clean it up unconditionally.

Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Cc: Kees Cook <keescook@chromium.org>
Cc: Will Drewry <wad@chromium.org>
Cc: Darren Hart <dvhart@linux.intel.com>
Cc: stable@vger.kernel.org

Change-Id: I155eafa98f365408450527e34998893dcdd64803
futex: Make lookup_pi_state more robust

The current implementation of lookup_pi_state has ambigous handling of
the TID value 0 in the user space futex. We can get into the kernel
even if the TID value is 0, because either there is a stale waiters
bit or the owner died bit is set or we are called from the requeue_pi
path or from user space just for fun.

The current code avoids an explicit sanity check for pid = 0 in case
that kernel internal state (waiters) are found for the user space
address. This can lead to state leakage and worse under some
circumstances.

Handle the cases explicit:

     Waiter | pi_state | pi->owner | uTID      | uODIED | ?

[1]  NULL   | ---      | ---       | 0         | 0/1    | Valid
[2]  NULL   | ---      | ---       | >0        | 0/1    | Valid

[3]  Found  | NULL     | --        | Any       | 0/1    | Invalid

[4]  Found  | Found    | NULL      | 0         | 1      | Valid
[5]  Found  | Found    | NULL      | >0        | 1      | Invalid

[6]  Found  | Found    | task      | 0         | 1      | Valid

[7]  Found  | Found    | NULL      | Any       | 0      | Invalid

[8]  Found  | Found    | task      | ==taskTID | 0/1    | Valid
[9]  Found  | Found    | task      | 0         | 0      | Invalid
[10] Found  | Found    | task      | !=taskTID | 0/1    | Invalid

[1]  Indicates that the kernel can acquire the futex atomically. We
     came came here due to a stale FUTEX_WAITERS/FUTEX_OWNER_DIED bit.

[2]  Valid, if TID does not belong to a kernel thread. If no matching
     thread is found then it indicates that the owner TID has died.

[3]  Invalid. The waiter is queued on a non PI futex

[4]  Valid state after exit_robust_list(), which sets the user space
     value to FUTEX_WAITERS | FUTEX_OWNER_DIED.

[5]  The user space value got manipulated between exit_robust_list()
     and exit_pi_state_list()

[6]  Valid state after exit_pi_state_list() which sets the new owner in
     the pi_state but cannot access the user space value.

[7]  pi_state->owner can only be NULL when the OWNER_DIED bit is set.

[8]  Owner and user space value match

[9]  There is no transient state which sets the user space TID to 0
     except exit_robust_list(), but this is indicated by the
     FUTEX_OWNER_DIED bit. See [4]

[10] There is no transient state which leaves owner and user space
     TID out of sync.

Backport to 3.13
  conflicts: kernel/futex.c

Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Signed-off-by: John Johansen <john.johansen@canonical.com>
Cc: Kees Cook <keescook@chromium.org>
Cc: Will Drewry <wad@chromium.org>
Cc: Darren Hart <dvhart@linux.intel.com>
Cc: stable@vger.kernel.org

Change-Id: I155eafa98f365408450527e34998893dcdd64804
msm: pm-8x60: Register sleep status driver before regulator

During hotplug, drivers wait for core to be power collapsed to turn off
the resources used by a core in CPU_DEAD notification. The kernel
thermal module which hotplugs the core in certain conditions is
registered in the arch_initcall(). To ensure that the CPU_DEAD waits for
sleep status to be set during hotplug, register the cpu sleep status
driver before the regulator driver.

To this effect, the sleep status driver is no longer made a child device
for pm-8x60 device.

Change-Id: I772521f4b3cd18e367aa44a41d60ef9735c99ef9
Signed-off-by: Mahesh Sivasubramanian <msivasub@codeaurora.org>
pinctrl: core device tree mapping table parsing support

During pinctrl_get(), if the client device has a device tree node, look
for the common pinctrl properties there. If found, parse the referenced
device tree nodes, with the help of the pinctrl drivers, and generate
mapping table entries from them.

During pinctrl_put(), free any results of device tree parsing.

Change-Id: Ie9c90c81b5bb6272525a4952079fcdc4bfe47cd0
Acked-by: Dong Aisheng <dong.aisheng@linaro.org>
Signed-off-by: Stephen Warren <swarren@wwwdotorg.org>
Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
Git-commit: 57291ce295c0aca738dd284c4a9c591c09ebee71
Git-repo: git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
Signed-off-by: Hanumant Singh <hanumant@codeaurora.org>
pinctrl: fix build when CONFIG_OF && !CONFIG_PINCTRL

pinctrl/devicetree.c won't compile when !CONFIG_PINCTRL, since the
pinctrl headers don't declare some types when !PINCTRL. Make sure
pinctrl/Makefile only attempts to compile devicetree.c when OF &&
PINCTRL.

Change-Id: I2e14fa681ca3f4ca4e2234a3b22a26ceb56842fe
Acked-by: Dong Aisheng <dong.aisheng@linaro.org>
Signed-off-by: Stephen Warren <swarren@nvidia.com>
Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
Git-commit: eafeb7a44aa8f79c992b9d557ede740c739f4b25
Git-repo: git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
Signed-off-by: Hanumant Singh <hanumant@codeaurora.org>
pinctrl: replace list_*() with get_*_count()

Most of the SoC drivers implement list_groups() and list_functions()
routines for pinctrl and pinmux. These routines continue returning
zero until the selector argument is greater than total count of
available groups or functions.

This patch replaces these list_*() routines with get_*_count()
routines, which returns the number of available selection for SoC
driver. pinctrl layer will use this value to check the range it can
choose.

This patch fixes all user drivers for this change. There are other
routines in user drivers, which have checks to check validity of
selector passed to them. It is also no more required and hence
removed.

Documentation updated as well.

Acked-by: Stephen Warren <swarren@wwwdotorg.org>
Signed-off-by: Viresh Kumar <viresh.kumar@st.com>
[Folded in fix and fixed a minor merge artifact manually]
Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
Git-commit: d1e90e9e7467dbfe521b25ba79f520bf676ebc36
Git-repo: git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
Signed-off-by: Hanumant Singh <hanumant@codeaurora.org>

Change-Id: Ib31455134ae94c874ba986b88028b0ebb2613d0a
pinctrl: fix pinmux_check_ops error checking

Do not use get_functions_count before checking.

Change-Id: I591f4bf9a33d9cc0e1cf64e91f839c47d415a58b
Acked-by: Stephen Warren <swarren@wwwdotorg.org>
Signed-off-by: Dong Aisheng <dong.aisheng@linaro.org>
Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
Git-commit: a1d31f71e6ed2f714830df8885ec07dfe1f6632e
Git-repo: git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
Signed-off-by: Hanumant Singh <hanumant@codeaurora.org>
pinctrl: add some error checking for user interfaces

This patch can avoid kernel oops in case the mux or config
function is not supported by driver.

Change-Id: I127693bd11296608b64388abd4b5241021868619
Acked-by: Stephen Warren <swarren@wwwdotorg.org>
Signed-off-by: Dong Aisheng <dong.aisheng@linaro.org>
Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
Git-commit: ad8bb720c23a80233e45ed31d67458f5e5b7ab31
Git-repo: git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
Signed-off-by: Hanumant Singh <hanumant@codeaurora.org>
pinctrl: implement pinctrl deferred probing

If drivers try to obtain pinctrl handles for a pin controller that
has not yet registered to the subsystem, we need to be able to
back out and retry with deferred probing. So let's return
-EPROBE_DEFER whenever this location fails. Also downgrade the
errors to info, maybe we will even set them to debug once the
deferred probing is commonplace.

Change-Id: I621368a66637485001f77c1a9d74c5198ba0c342
Cc: Arnd Bergmann <arnd@arndb.de>
Reviewed-by: Mark Brown <broonie@opensource.wolfsonmicro.com>
Acked-by: Stephen Warren <swarren@wwwdotorg.org>
Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
Git-commit: c05127c4e2c6e7d9949347a76fd05c337bcd5e84
Git-repo: git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
Signed-off-by: Hanumant Singh <hanumant@codeaurora.org>
pinctrl: mark non-EXPERIMENTAL

With the finalization of the external driver API and the device
tree support, this subsystem is now mature and can be promoted to
non-experimental status.

Change-Id: If959f828d476a0470118ed7d3dfc031c072efa84
Acked-by: Stephen Warren <swarren@wwwdotorg.org>
Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
Git-commit: 630e2d0494f001cc3c435cac374f92e4bde0f518
Git-repo: git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
Signed-off-by: Hanumant Singh <hanumant@codeaurora.org>
pinctrl: ifdef CONFIG_DEBUG_FS cleanup

Only provide prototypes for pin{mux,conf}.c debugfs-related functions
when both CONFIG_PIN* /and/ CONFIG_DEBUG_FS are enabled, otherwise
provide static inlines.

Change-Id: I9e32e63583be875d8920a5692cdd439357302a7f
Signed-off-by: Stephen Warren <swarren@nvidia.com>
Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
Git-commit: c736d73c9e6d9849ecb08c34c1d3917b210e8f38
Git-repo: git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
Signed-off-by: Hanumant Singh <hanumant@codeaurora.org>
pinctrl: allow pctldevs to decode pin config in debugfs

Add a pinconf op so that pin controller drivers can decode their pin
config settings for debugfs.

Change-Id: I3daf0dc489903962dd398c366dcf914db1fd1143
Signed-off-by: Stephen Warren <swarren@nvidia.com>
Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
Git-commit: 6cb4158757a8629e14851e7802f3b6bfaa7d6f00
Git-repo: git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
Signed-off-by: Hanumant Singh <hanumant@codeaurora.org>