fs/super.c: sync ro remount after blocking writers

Move sync_filesystem() after sb_prepare_remount_readonly().  If writers
sneak in anywhere from sync_filesystem() to sb_prepare_remount_readonly()
it can cause inodes to be dirtied and writeback to occur well after
sys_mount() has completely successfully.

This was spotted by corrupted ubifs filesystems on reboot, but appears
that it can cause issues with any filesystem using writeback.

CRs-Fixed: 627559
Change-Id: Ib417b59d39210aab2de4e5ae48b18129e8bc3e26
Cc: Artem Bityutskiy <dedekind1@gmail.com>
Cc: Christoph Hellwig <hch@infradead.org>
Cc: Alexander Viro <viro@zeniv.linux.org.uk>
CC: Richard Weinberger <richard@nod.at>
Co-authored-by: Richard Weinberger <richard@nod.at>
Signed-off-by: Andrew Ruder <andrew.ruder@elecsyscorp.com>
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
Git-commit: 807612db2f9940b9fa6deaef054eb16d51bd3e00
Git-repo: git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
Signed-off-by: Subhash Jadavani <subhashj@codeaurora.org>
imx135 / fix GPIO Setting

Change-Id: I6f34fe8fba4696b3327166f1a716e00c5c380191
ARM: dts: g2-kddi: enable wifi-control-func

Change-Id: I0caf5b3d19cfb43c5bc3ba40236e07751a69a503
mmc: core: increase data-timeout value for Hynix cards

Add a quirk to increase the data-timeout value for Hynix eMMC
cards only. This value is fixed to a maximum of 4 seconds.

Change-Id: I4bca6cbc877b323b29a3f7f5923d0708c48adf2c
CRs-fixed: 587284
Signed-off-by: Asutosh Das <asutoshd@codeaurora.org>
mmc: sdhci: fix incorrect command used in tuning

For SD hosts using retuning mode 1, when retuning timer expired, it will
need to do retuning in sdhci_request before processing the actual
request. But the retuning command is fixed: cmd19 for SD card and cmd21
for eMMC card, so we can't use the original request's command to do the
tuning.

And since the tuning command depends on the card type attached to the
host, we will need to know the card type to use the correct tuning
command.

Change-Id: Ibde71d8a8b4e0ff75456923c7c3d8579c04109b4
Signed-off-by: Aaron Lu <aaron.lu@amd.com>
Reviewed-by: Philip Rakity <prakity@marvell.com>
Cc: stable <stable@vger.kernel.org> [3.3+]
Signed-off-by: Chris Ball <cjb@laptop.org>
Signed-off-by: Asutosh Das <asutoshd@codeaurora.org>
mmc: sdhci: fix NULL dereference in sdhci_request() tuning

Commit 473b095a72a9 ("mmc: sdhci: fix incorrect command used in tuning")
introduced a NULL dereference at resume-time if an SD 3.0 host controller
raises the SDHCI_NEEDS_TUNING flag while no card is inserted.  Seen on an
OLPC XO-4 with sdhci-pxav3, but presumably affects other controllers too.

Change-Id: I14a9e2a4566ed9f6d4186d6f63ed2e192485973d
Signed-off-by: Chris Ball <cjb@laptop.org>
Cc: stable <stable@vger.kernel.org> [3.3+]
Signed-off-by: Asutosh Das <asutoshd@codeaurora.org>
mmc: sdhci: retune on cmd or data CRC error

Initiate a DLL (delay locked loop) retune for the next command,
if the current command fails with a CRC error.
This may help to choose a different phase (delay) if the same
has changed over the elapsed period of time.

CRs-Fixed: 587985
Change-Id: I21f6a5dadb096dd38d41fcf2251fa50b03c8bbb4
Signed-off-by: Asutosh Das <asutoshd@codeaurora.org>
mmc: sdhci: Turn on controller clocks and card power at MMC_POWER_UP

Currently, the clock to the card is enabled prior to enabling
the power to card. Specification requires that the power be
supplied first and then a delay of 10ms and then clock be
provided to the card.

In this, during MMC_POWER_UP mode, the controller clocks would be
ON and the power would be supplied to the card. In the MMC_POWER_ON
mode, the clocks to the card would be enabled and the rate set.
A callback has been provided to facilitate the enabling of
controller clocks.

CRs-Fixed: 567658
Change-Id: I2d66eae1581b9b136faaba4cafc330aeb6a3f364
Signed-off-by: Asutosh Das <asutoshd@codeaurora.org>
Signed-off-by: Sujit Reddy Thumma <sthumma@codeaurora.org>
mmc: sdhci-msm: enable controller clocks at MMC_POWER_UP

A callback to turn-on the controller clocks is implemented.
This callback would ensure that the pclk and mclk are enabled
but the output clock to the card is disabled.

CRs-Fixed: 567658
Change-Id: Ic97e600a6388fb64f1267a097b201f31d114a1fb
Signed-off-by: Asutosh Das <asutoshd@codeaurora.org>
Signed-off-by: Sujit Reddy Thumma <sthumma@codeaurora.org>
msm: sdcc: Move vdd to optional property

Some devices might not use the vdd. So move vdd to optional property and
avoid controling the vdd in that device if qcom,not-use-vdd exists.

Change-Id: Ic504e7c2f6311cf158fc77fdc28b2723679826af
Signed-off-by: Devin Kim <dojip.kim@lge.com>
msm: sdcc: Use wifi_control_func to identify the wlan slot

Change-Id: I2a694d17ee74d90d789892e5058190b6cf8f4934
Revert "rfkill: Don't run btlock"

This reverts commit 746ec22855cc842a751585d14c3a481f900721b9.
bcmdhd: Update bcm4335 driver to 1.88.60

Change-Id: I9432f96429c8d7f3d51252af68594416670e9478
msm: mdss: mdss: g2_dcm: remove stock rom dependecy process.

this is JPN/DCM carrier specific logo only.
it is no need Cyanogenmod base rom, because it does not have "/initlogo_dcm_xi.rle""
and it is shown invalid frame a few times at phone starting.

Change-Id: I3c0800518fc5cf83f1c47ce406056bf765088b84
Add L-01F(G2 JPN-DCM) defconfig

Change-Id: Ie4a879f10ac4ce85c39dedbc4cd441cf5ece51d7
Add LGL22 au isai (G2 JPN-KDDI) defconfig

Change-Id: Ibff317fb53488450966e12d1606ac06f8225869d
Merge "msm: mdss: mdss: g2_dcm: remove stock rom dependecy process." into cm-11.0
n_tty: Fix n_tty_write crash when echoing in raw mode

The tty atomic_write_lock does not provide an exclusion guarantee for
the tty driver if the termios settings are LECHO & !OPOST.  And since
it is unexpected and not allowed to call TTY buffer helpers like
tty_insert_flip_string concurrently, this may lead to crashes when
concurrect writers call pty_write. In that case the following two
writers:
* the ECHOing from a workqueue and
* pty_write from the process
race and can overflow the corresponding TTY buffer like follows.

If we look into tty_insert_flip_string_fixed_flag, there is:
  int space = __tty_buffer_request_room(port, goal, flags);
  struct tty_buffer *tb = port->buf.tail;
  ...
  memcpy(char_buf_ptr(tb, tb->used), chars, space);
  ...
  tb->used += space;

so the race of the two can result in something like this:
              A                                B
__tty_buffer_request_room
                                  __tty_buffer_request_room
memcpy(buf(tb->used), ...)
tb->used += space;
                                  memcpy(buf(tb->used), ...) ->BOOM

B's memcpy is past the tty_buffer due to the previous A's tb->used
increment.

Since the N_TTY line discipline input processing can output
concurrently with a tty write, obtain the N_TTY ldisc output_lock to
serialize echo output with normal tty writes.  This ensures the tty
buffer helper tty_insert_flip_string is not called concurrently and
everything is fine.

Note that this is nicely reproducible by an ordinary user using
forkpty and some setup around that (raw termios + ECHO). And it is
present in kernels at least after commit
d945cb9cce20ac7143c2de8d88b187f62db99bdc (pty: Rework the pty layer to
use the normal buffering logic) in 2.6.31-rc3.

js: add more info to the commit log
js: switch to bool
js: lock unconditionally
js: lock only the tty->ops->write call

References: CVE-2014-0196
Reported-and-tested-by: Jiri Slaby <jslaby@suse.cz>
Signed-off-by: Peter Hurley <peter@hurleysoftware.com>
Signed-off-by: Jiri Slaby <jslaby@suse.cz>
Cc: Linus Torvalds <torvalds@linux-foundation.org>
Cc: Alan Cox <alan@lxorguk.ukuu.org.uk>
Cc: <stable@vger.kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
[bwh: Backported to 3.4: output_lock is a member of struct tty_struct]

Change-Id: I11d1685056e18f107c970fbe2cab5176ca3a91c4
bcmdhd: Adjust default hostwake/reset GPIOs to match the galbis

Change-Id: I84c3d71dde9fdea45652b24a65523d9947cdd25d
bluesleep: Don't wait for uart tx queue to flush before entering standby

There's no need to delay sleep for this. msm_hs_serial will do it on
its own, and this reduces the time to enter lpm

Change-Id: Ia13d44148130aaf133ea888807b5ba114936ce78