msm_rmnet: Fix potential memory corruption

Usage of legacy string manipulation function sprintf could lead to
memory corruption as the number of bytes to be written to the
destination is not bounded. Replace sprintf with snprintf where the
number of bytes to be written is explicitly specified.

CRs-fixed: 672202
Change-Id: I1788d655f048124c6b7cccee4345d8239743ada8
Signed-off-by: Subash Abhinov Kasiviswanathan <subashab@codeaurora.org>
msm_rmnet_sdio: Fix potential memory corruption

Usage of legacy string manipulation function sprintf could lead to
memory corruption as the number of bytes to be written to the
destination is not bounded. Replace sprintf with snprintf where the
number of bytes to be written is explicitly specified.

CRs-fixed: 672202
Change-Id: Ic26bea1ddf9570a4970fc8c4373b066aa385e427
Signed-off-by: Subash Abhinov Kasiviswanathan <subashab@codeaurora.org>
msm: msm_bus: Fix memory leak during RPM transaction

This is a serious bug that eventually cripples the system due to
lost memory.

CRs-Fixed: 442381
Change-Id: If4d33b35475a33b1602a1d923031345b47af963e
Signed-off-by: Michael Bohan <mbohan@codeaurora.org>
Signed-off-by: Sana Venkat Raju <c_vsana@codeaurora.org>
msm_fb: display: reference count base pipe free in dsi and lcdc

During dsi off or lcdc off, base pipe could be freeed if fb device is
closed. Since base pipe allocation and free are managed through
reference counting api functions, so those free functions api should
be called.

Change-Id: I210716a590cde87ee254184a42d9df38c8012ff6
Signed-off-by: Huaibin Yang <huaibiny@codeaurora.org>
msm_fb: display: turn off lcdc timing generator when splash is done

The lcdc timing generator is configured by boot loader for splash
screen. TG should be disabled when kernel is about to configure it
with its own parameters. Otherwise, mdp may hang or underrun while TG
is still active.

Change-Id: Ia2b2947c2759975d02e718edf306c86403bc6d33
Signed-off-by: Huaibin Yang <huaibiny@codeaurora.org>
msm_fb: display: fix pipe solid fill initialization issue

Currently solid fill mode is not properly initialized. Only the base
pipe allocated for the interface is supposed to be initialized before
interface timing generator is turned on. However, the solidfill_init
function initializes all pipes and this could cause underruns on the
pipes already being used.

Change-Id: I6be589c188a2dc285b5dc4a942840c603af6d1be
Signed-off-by: Huaibin Yang <huaibiny@codeaurora.org>
add sysfs interface for vib intensity

Change-Id: I918ca477b796a386605cc799c409ec286b307017
iommu/core: pass a user-provided token to fault handlers

Sometimes a single IOMMU user may have to deal with several
different IOMMU devices (e.g. remoteproc).

When an IOMMU fault happens, such users have to regain their
context in order to deal with the fault.

Users can't use the private fields of neither the iommu_domain nor
the IOMMU device, because those are already used by the IOMMU core
and low level driver (respectively).

This patch just simply allows users to pass a private token (most
notably their own context pointer) to iommu_set_fault_handler(),
and then makes sure it is provided back to the users whenever
an IOMMU fault happens.

The patch also adopts remoteproc to the new fault handling
interface, but the real functionality using this (recovery of
remote processors) will only be added later in a subsequent patch
set.

Change-Id: Ic04659686e72838a0db518e9303dd037191e3879
Cc: Fernando Guzman Lugo <fernando.lugo@ti.com>
Signed-off-by: Ohad Ben-Cohen <ohad@wizery.com>
Signed-off-by: Joerg Roedel <joerg.roedel@amd.com>
[ohaugan@codeaurora.org: Resolved compilation and merge issues]
Signed-off-by: Olav Haugan <ohaugan@codeaurora.org>
ARM: Add support for 64 bit register reads/writes

Add macros to read and write to 64 bit registers.

Change-Id: Id45d4086aa148ba96df3987c3341c133f1c56541
Signed-off-by: Olav Haugan <ohaugan@codeaurora.org>
Signed-off-by: Iliyan Malchev <malchev@google.com>
msm: scm-pas: Provide a strongly ordered buffer to the secure world

The secure world requires that the metadata-containing buffer
be strongly ordered. Use the dma_alloc_attrs API to obtain a
strongly ordered region for this purpose.

Bug: 10750953
Signed-off-by: Vikram Mulukutla <markivx@codeaurora.org>
Signed-off-by: Mekala Natarajan <mekalan@codeaurora.org>
msm: scm: Add scm_call_atomic3

Some drivers need to pass three arguments atomically. Add support
for it.

Change-Id: Id0f962400c5c4f721eef44069fc3db1779248ae3
Signed-off-by: Stephen Boyd <sboyd@codeaurora.org>
Signed-off-by: Carter Cooper <ccooper@codeaurora.org>
lib/lzo: Rename lzo1x_decompress.c to lzo1x_decompress_safe.c

Rename the source file to match the function name and thereby
also make room for a possible future even slightly faster
"non-safe" decompressor version.

Signed-off-by: Markus F.X.J. Oberhumer <markus@oberhumer.com>
lib/lzo: Update LZO compression to current upstream version

This commit updates the kernel LZO code to the current upsteam version
which features a significant speed improvement - benchmarking the Calgary
and Silesia test corpora typically shows a doubled performance in
both compression and decompression on modern i386/x86_64/powerpc machines.

Signed-off-by: Markus F.X.J. Oberhumer <markus@oberhumer.com>
lib/lzo: huge LZO decompression speedup on ARM by using unaligned access

Signed-off-by: Markus F.X.J. Oberhumer <markus@oberhumer.com>
ARM: 7668/1: fix memset-related crashes caused by recent GCC (4.7.2) optimizations

Recent GCC versions (e.g. GCC-4.7.2) perform optimizations based on
assumptions about the implementation of memset and similar functions.
The current ARM optimized memset code does not return the value of
its first argument, as is usually expected from standard implementations.

For instance in the following function:

void debug_mutex_lock_common(struct mutex *lock, struct mutex_waiter *waiter)
{
	memset(waiter, MUTEX_DEBUG_INIT, sizeof(*waiter));
	waiter->magic = waiter;
	INIT_LIST_HEAD(&waiter->list);
}

compiled as:

800554d0 <debug_mutex_lock_common>:
800554d0:       e92d4008        push    {r3, lr}
800554d4:       e1a00001        mov     r0, r1
800554d8:       e3a02010        mov     r2, #16 ; 0x10
800554dc:       e3a01011        mov     r1, #17 ; 0x11
800554e0:       eb04426e        bl      80165ea0 <memset>
800554e4:       e1a03000        mov     r3, r0
800554e8:       e583000c        str     r0, [r3, #12]
800554ec:       e5830000        str     r0, [r3]
800554f0:       e5830004        str     r0, [r3, #4]
800554f4:       e8bd8008        pop     {r3, pc}

GCC assumes memset returns the value of pointer 'waiter' in register r0; causing
register/memory corruptions.

This patch fixes the return value of the assembly version of memset.
It adds a 'mov' instruction and merges an additional load+store into
existing load/store instructions.
For ease of review, here is a breakdown of the patch into 4 simple steps:

Step 1
======
Perform the following substitutions:
ip -> r8, then
r0 -> ip,
and insert 'mov ip, r0' as the first statement of the function.
At this point, we have a memset() implementation returning the proper result,
but corrupting r8 on some paths (the ones that were using ip).

Step 2
======
Make sure r8 is saved and restored when (! CALGN(1)+0) == 1:

save r8:
-       str     lr, [sp, #-4]!
+       stmfd   sp!, {r8, lr}

and restore r8 on both exit paths:
-       ldmeqfd sp!, {pc}               @ Now <64 bytes to go.
+       ldmeqfd sp!, {r8, pc}           @ Now <64 bytes to go.
(...)
        tst     r2, #16
        stmneia ip!, {r1, r3, r8, lr}
-       ldr     lr, [sp], #4
+       ldmfd   sp!, {r8, lr}

Step 3
======
Make sure r8 is saved and restored when (! CALGN(1)+0) == 0:

save r8:
-       stmfd   sp!, {r4-r7, lr}
+       stmfd   sp!, {r4-r8, lr}

and restore r8 on both exit paths:
        bgt     3b
-       ldmeqfd sp!, {r4-r7, pc}
+       ldmeqfd sp!, {r4-r8, pc}
(...)
        tst     r2, #16
        stmneia ip!, {r4-r7}
-       ldmfd   sp!, {r4-r7, lr}
+       ldmfd   sp!, {r4-r8, lr}

Step 4
======
Rewrite register list "r4-r7, r8" as "r4-r8".

Signed-off-by: Ivan Djelic <ivan.djelic@parrot.com>
Reviewed-by: Nicolas Pitre <nico@linaro.org>
Signed-off-by: Dirk Behme <dirk.behme@gmail.com>
Signed-off-by: Russell King <rmk+kernel@arm.linux.org.uk>
ARM: 7743/1: compressed/head.S: work around new binutils warning

commit da94a829305f1c217cfdf6771cb1faca0917e3b9 upstream.

In August 2012, Matthew Gretton-Dann checked a change into binutils
labelled "Error on obsolete & warn on deprecated registers", apparently as
part of ARMv8 support. Apparently, this was supposed to emit the message
"Warning: This coprocessor register access is deprecated in ARMv8" when
using certain mcr/mrc instructions and building for ARMv8. Unfortunately,
the message that is actually emitted appears to be '(null)', which is
less helpful in comparison.

Even more unfortunately, this is biting us on every single kernel
build with a new gas, because arch/arm/boot/compressed/head.S and some
other files in that directory are built with -march=all since kernel
commit 80cec14a8 "[ARM] Add -march=all to assembly file build in
arch/arm/boot/compressed" back in v2.6.28.

This patch reverts Russell's nice solution and instead marks the head.S
file to be built for armv7-a, which fortunately lets us build all
instructions in that file without warnings even on the broken binutils.

Without this patch, building anything results in:

arch/arm/boot/compressed/head.S: Assembler messages:
arch/arm/boot/compressed/head.S:565: Warning: (null)
arch/arm/boot/compressed/head.S:676: Warning: (null)
arch/arm/boot/compressed/head.S:698: Warning: (null)
arch/arm/boot/compressed/head.S:722: Warning: (null)
arch/arm/boot/compressed/head.S:726: Warning: (null)
arch/arm/boot/compressed/head.S:957: Warning: (null)
arch/arm/boot/compressed/head.S:996: Warning: (null)
arch/arm/boot/compressed/head.S:997: Warning: (null)
arch/arm/boot/compressed/head.S:1027: Warning: (null)
arch/arm/boot/compressed/head.S:1035: Warning: (null)
arch/arm/boot/compressed/head.S:1046: Warning: (null)
arch/arm/boot/compressed/head.S:1060: Warning: (null)
arch/arm/boot/compressed/head.S:1092: Warning: (null)
arch/arm/boot/compressed/head.S:1094: Warning: (null)
arch/arm/boot/compressed/head.S:1095: Warning: (null)
arch/arm/boot/compressed/head.S:1102: Warning: (null)
arch/arm/boot/compressed/head.S:1134: Warning: (null)

Signed-off-by: Arnd Bergmann <arnd@arndb.de>
Cc: stable@vger.kernel.org
Cc: Matthew Gretton-Dann <matthew.gretton-dann@arm.com>
Signed-off-by: Russell King <rmk+kernel@arm.linux.org.uk>
[ccross: cherry-picked to 3.4]
Change-Id: If1c4c1a9f3f721a45d9833f2a36f1b7ce58c5e9a
Signed-off-by: Colin Cross <ccross@android.com>
ARM: 7670/1: fix the memset fix

Commit 455bd4c430b0 ("ARM: 7668/1: fix memset-related crashes caused by
recent GCC (4.7.2) optimizations") attempted to fix a compliance issue
with the memset return value.  However the memset itself became broken
by that patch for misaligned pointers.

This fixes the above by branching over the entry code from the
misaligned fixup code to avoid reloading the original pointer.

Also, because the function entry alignment is wrong in the Thumb mode
compilation, that fixup code is moved to the end.

While at it, the entry instructions are slightly reworked to help dual
issue pipelines.

Signed-off-by: Nicolas Pitre <nico@linaro.org>
Tested-by: Alexander Holler <holler@ahsoftware.de>
Signed-off-by: Russell King <rmk+kernel@arm.linux.org.uk>
HACK: ARM: disable sleeping while atomic warning in do_signal

ARM disables interrupts in do_signal, which triggers a warning in
try_to_freeze, see details at https://lkml.org/lkml/2011/8/23/221.
To prevent the warnings, add try_to_freeze_nowarn and call it from
do_signal.

Change-Id: If7482de21c386adc705fa1ac4ecb8c7ece5bb356
Signed-off-by: Colin Cross <ccross@android.com>
Revert "mach-msm: mdm: Wait for 30 seconds on first boot"

This reverts commit 138a3af6450912520722aaeac2f9b257fd28921f.
usb: Add more (OTG) fixes from Samsung

Change-Id: Ifb560cbc1b830f6034876ce7c04f0c941b3e7202