video: hdmi: judge interlace mode from vmode bit mask

Vmode is a flag with bit mask, we can't judge interlace mode
from equal compare, need mask its bit.

Change-Id: Iad69bd52173c5ea179639deaff25f9a4ed3fc5d3
Signed-off-by: Mark Yao <mark.yao@rock-chips.com>

video: lcdc: judge interlace mode from vmode bit mask

Vmode is a flag with bit mask, we can't judge interlace mode
from equal compare, need mask its bit.

Change-Id: I0cc53503198f98dc58369f4c9e6dd78b47095968
Signed-off-by: Mark Yao <mark.yao@rock-chips.com>

rk_fb: add RGB BT709/BT2020 format

Change-Id: I9581f78955c3efe77375bfa5e8ac571ac1d5aae4
Signed-off-by: Mark Yao <mark.yao@rock-chips.com>

rk_fb: set interlace flag for dts timing

Change-Id: I8711cefdf224af88214ed39d9ae225be8bc62304
Signed-off-by: Mark Yao <mark.yao@rock-chips.com>

camera: rk_camsys: rk3288: change gpio map method in camsys_gpio.h

rk3288 gpio bank0 only has 24 pins not 32 pins,so modify the gpio map
method for rk3288.

Change-Id: I1d59b25d9acb0f51f9a1ad8ec74db2952534b1f2
Signed-off-by: ZhongYichong <zyc@rock-chips.com>

ARM: dts: rk3228-sdk: enable nandc

Change-Id: I449544595eb93f6cb9d7154aced253bebe1dceb7
Signed-off-by: Zhaoyifeng <zyf@rock-chips.com>

 ARM: dts: rk3228: add nandc support

Change-Id: I40ddba4f4ce56a34ca5e448f1dfbcc06c2ad445c
Signed-off-by: Zhaoyifeng <zyf@rock-chips.com>

mmc: Allow forward compatibility for eMMC

As stated by the eMMC 5.0 specification, a chip should not be rejected
only because of the revision stated in the EXT_CSD_REV field of the
EXT_CSD register.

Remove the control on this value, the control of the CSD_STRUCTURE field
should be sufficient to reject future incompatible changes.

Change-Id: Ib69314bee902a4036183ef9a3565d9f0423ec971
Signed-off-by: Romain Izard <romain.izard.pro@gmail.com>
Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
Signed-off-by: Shawn Lin <shawn.lin@rock-chips.com>

ARM: dts: rk3228-sdk: enable psci

Change-Id: I0d965a15e2938f8b54d056d0b7e21ec9ce33ee57
Signed-off-by: Jianhong Chen <chenjh@rock-chips.com>

ARM: dtsi: rk3228: add psci support

This is just add psci code into kernel, if you want to enable psci,
you must add psci=enable in the Command Line.

Change-Id: Iaf0e0116cbaba0d210cb99d59c0ee82768bf54bb
Signed-off-by: Jianhong Chen <chenjh@rock-chips.com>

ARM: rockchip: support arch32 psci suspend

Change-Id: I0341d1c019b8c00376af574cd9f51e87fafa8601
Signed-off-by: Jianhong Chen <chenjh@rock-chips.com>

arm: rockchip: rk3228: dts: add pwm remote-ctrl

Change-Id: Iccb31c2472238887b24ca61d7c7bdcb54a1e0778
Signed-off-by: Huang zhibao <hzb@rock-chips.com>

video: rockchip: fb: delete DISPLAY_POLICY_BOX_TEMP

Change-Id: I59147b833754d5417d2813eb902923b4f700a9b0
Signed-off-by: Zheng Yang <zhengyang@rock-chips.com>

ARM: dts: rk3288-box: set disp-policy to DISPLAY_POLICY_BOX

Change-Id: I3ede07d2c26aaef44ec7165353a3b3d6a6177f6e
Signed-off-by: Zheng Yang <zhengyang@rock-chips.com>

ARM64: dts: rk3368-box: set disp-policy to DISPLAY_POLICY_BOX

Change-Id: Ib97c581b7488926d5f4203ea1d61ff706118bcc5
Signed-off-by: Zheng Yang <zhengyang@rock-chips.com>

i2c: rockchip: fix power off issue for rk818

The power off sequence is behind of i2c bus shutdown func,
it would prevent the rk818 to do power off action. The irq was
disabled when rk818 power off, it could let rk818 to power off
through i2c bus.

Change-Id: Ia6155f137ab2fa36dbe19e06878b0228670b1398
Signed-off-by: David Wu <wdc@rock-chips.com>

hdmi: cec: add HDMI_IOCTL_CECWAKESTATE

android HDMI CEC HAL need to know cec state when resume,
so we add the HDMI_IOCTL_CECWAKESTATE.

Change-Id: Iff942c6085d10891200cd873cc2ba53e9a2d6cad
Signed-off-by: Shen Zhenyi <szy@rock-chips.com>

arm64: rockchip: rk3368: dts: modify dvfs_table for core

Change-Id: I73c4a277b9fa38160f5206ebd8603984535f0ade
Signed-off-by: Xiao Feng <xf@rock-chips.com>

pinctrl: rockchip: fix crashed issue during pinctrl suspend

if the chip was rk3288, it didn't use pinctrl-rk3368.c,
but pinctrl-rockchip.c, driver of pinctrl-rk3368 was not registered.
It would make the NULL pointer at pinctrl-rk3368 suspend func.

Change-Id: I09dd4fb9b8bf001a4222ed9bef62347785b9906f
Signed-off-by: David Wu <wdc@rock-chips.com>

rk312x, mali_400: upgrade rk_ko_ver to 5.

Change-Id: If1851d44e75ef16e1b916ecb910526f749822be0
Signed-off-by: chenzhen <chenzhen@rock-chips.com>

ion: rockchip-ion: add API to set memory region secured

Add ion ioctl command -ION_IOC_SET_SECURED
for user to set memory region secured.

Change-Id: Ic4a7432ab8d2fd9f60fdfe7457e92f7c99768e12
Signed-off-by: Jianqun Xu <jay.xu@rock-chips.com>

ARM: rockchip-psci: add interface for ion to set memory secured

Add function "psci_set_memory_secure" for device to set memory
region secured.

Change-Id: Ife807c91d37ae66a5e1a0a3d8263c68cd601937d
Signed-off-by: Jianqun Xu <jay.xu@rock-chips.com>

rk312x, mali_400: make it more 'difficult' to dump down in mali_dvfs_list.

Change-Id: If5fd646aa6ca7f7383db70c84ff71f1570fe23b1
Signed-off-by: chenzhen <chenzhen@rock-chips.com>

ARM: rockchip: rockchip_defconfig enable IP_MULTICAST

Change-Id: Ic40cb94753f9fedc548ae6a77b36d0bed5754d88
Signed-off-by: Huang, Tao <huangtao@rock-chips.com>

ARM: rockchip: rockchip_defconfig enable UID_CPUTIME

Change-Id: Ifb92e539e868ed15561ae8698b226422fae5fee8
Signed-off-by: Huang, Tao <huangtao@rock-chips.com>

ARM: rockchip: rockchip_defconfig enable kernel-mode NEON and NEON based cypto

Change-Id: Ie3975cd780bbbedaaa2e3384d49e9f90734b65fe
Signed-off-by: Huang, Tao <huangtao@rock-chips.com>

ARM: rockchip-psci: add function id for secure memory set

Change-Id: I73c0b2c603a4b72f07804c684cd89bc82e5529c4
Signed-off-by: Jianqun Xu <jay.xu@rock-chips.com>

ARM: rockchip: psci support arch32 and arch64 smc call

Change-Id: I736c6c15cbb41d52aa9ef1e98cb9ebdd6ac9ebfc
Signed-off-by: Jianhong Chen <chenjh@rock-chips.com>

arm64: rockchip: rockchip_defconfig enable IP_MULTICAST

Change-Id: I07f7ad04f89c54b582b756c43d9841d99883e6df
Signed-off-by: Huang, Tao <huangtao@rock-chips.com>

arm64: rockchip: rockchip_defconfig enable UID_CPUTIME

Change-Id: Ia6f86bf86220261eda27ae1bba880fdf61241d5c
Signed-off-by: Huang, Tao <huangtao@rock-chips.com>

ARM: dts: rk3228: add ion node

Add ion node, with two memory reserved region,
cma-heap and system-heap

Change-Id: Ic6c4da56e0c608135653f901f37adfed7bc7cb15
Signed-off-by: Jianqun Xu <jay.xu@rock-chips.com>

arm64: rockchip: rockchip_defconfig enable ARM v8 crypto

Change-Id: I67d9ab8d0e8412e9899e64378beba8dd0764b310
Signed-off-by: Huang, Tao <huangtao@rock-chips.com>

arm64: rockchip: add support for kernel mode NEON

Change-Id: I964c5dad5562f0342b1d11d9a0483fcac0394e4d
Signed-off-by: Huang, Tao <huangtao@rock-chips.com>

rockchip: quiet module_request personality-8

In Android-M, below change in bionic was introduced
https://android-review.googlesource.com/122131

Which caused lot of SELinux denials to be logged regarding
module_request (similar to below one) for 32bit systems,
There is quite a lot of module_request denials when any 32bit
executable is executed.

type=1400 audit(946685139.719:12): avc: denied { module_request }
for pid=1970 comm="tzdatacheck" kmod="personality-8"
scontext=u:r:tzdatacheck:s0 tcontext=u:r:kernel:s0 tclass=system
permissive=1

So we patch the kernel to not attempt module loading for alternate
execution environments.

Change-Id: I7bd2c5fc08fd00fa7ff53d3ced401564b474fad4
Signed-off-by: Huang, Tao <huangtao@rock-chips.com>

mmc: dw_mmc: fix the max_blk_count in IDMAC

Even though 1MB is reserved for descriptor table in IDMAC,
the dw_mmc host driver is allowed to receive only maximum
128KB block length in one request. This is caused by setting
improper max_blk_count. It needs to be e adjusted so that
descriptor table is used fully. It is found that the performance
is improved with the increased the max_blk_count.

Change-Id: Ie4042f9e1924e0f575b9865aa721b7b61305c13d
Signed-off-by: Seungwon Jeon <tgih.jun@samsung.com>
Acked-by: Jaehoon Chung <jh80.chung@samsung.com>
Signed-off-by: Alim Akhtar <alim.akhtar@samsung.com>
Reviewed-by: Shawn Lin <shawn.lin@rock-chips.com>
Signed-off-by: Shawn Lin <shawn.lin@rock-chips.com>
Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>

ARM: dts: rk3228: hdmi: add pinctrl and pclk_hdmi_phy

Change-Id: I5570a3bf1970e6f8748cab55fea06a11af5c4f3e
Signed-off-by: Zheng Yang <zhengyang@rock-chips.com>

Merge branch 'android-3.10'

Exclude:
ext4 crypto
nl80211: fix scheduled scan RSSI matchset attribute confusion
mmc
Add wlan platform partial_resume handler
wlan: Add WLAN_PLAT_AP_FLAG for SOFTAP country code
ipc
zram

uid_cputime: Check for the range while removing range of UIDs.

Checking if the uid_entry->uid matches the uid intended to be removed will
prevent deleting unwanted uid_entry.
Type cast the key for the hashtable to the same size, as when they were
inserted. This will make sure that we can find the uid_entry we want.

Bug: 25195548
Change-Id: I567942123cfb20e4b61ad624da19ec4cc84642c1
Signed-off: Ruchi kandoi <kandoiruchi@google.com>
(cherry picked from commit 170458885df2e4e081d3f8489cfd4f66a9598995)

Revert "android: binder: Change binder mutex to rtmutex."

This reverts commit ebce7cd30b3e00232c8be23d0f04d7c0599089b5.

This ends up doing more damage than good on most devices. Go back to
using a standard mutex.

(cherry picked from commit ea93186577de4fae3a2273c296bfcf1839048df0)

ipv6: inet6_sk() should use sk_fullsock()

SYN_RECV & TIMEWAIT sockets are not full blown, they do not have a pinet6
pointer.

Bug: 24163529
Change-Id: I6ce67a190d67d200c6ebeb81d2daeb9c86cd7581
Fixes: ca6fb0651883 ("tcp: attach SYNACK messages to request sockets instead of listener")
Signed-off-by: Eric Dumazet <edumazet@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Lorenzo Colitti <lorenzo@google.com>
(cherry picked from commit feee3c175c23ae72ed17154caaa82a3002de0023)

net: add sk_fullsock() helper

We have many places where we want to check if a socket is
not a timewait or request socket. Use a helper to avoid
hard coding this.

Signed-off-by: Eric Dumazet <edumazet@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
[backported from net-next 1d0ab253872cdd3d8e7913f59c266c7fd01771d0]
[lorenzo@google.com: removed TCPF_NEW_SYN_RECV, and added a comment to add it back.]

Signed-off-by: Lorenzo Colitti <lorenzo@google.com>
Bug: 24163529
Change-Id: Ibf09017e1ab00af5e6925273117c335d7f515d73
(cherry picked from commit cdab04e3612c55f0906c84c3c05996a0507eab7d)

lowmemorykiller: trace kill events.

Allows for capturing lmk kill events and
their rationale.

Change-Id: Ibe215db5bb9806fc550c72c0b9832c85cbd56bf6
Signed-off-by: Martijn Coenen <maco@google.com>
(cherry picked from commit 6cfb58f07af4b913508f087fe551a08f5a21eb88)

arm64/crypto: use crypto instructions to generate AES key schedule

(cherry pick from commit 12ac3efe74f888a13cb4df88b38bb01e8034dea8)

This patch implements the AES key schedule generation using ARMv8
Crypto Instructions. It replaces the table based C implementation
in aes_generic.ko, which means we can drop the dependency on that
module.

Tested-by: Steve Capper <steve.capper@linaro.org>
Acked-by: Steve Capper <steve.capper@linaro.org>
Signed-off-by: Ard Biesheuvel <ard.biesheuvel@linaro.org>
Signed-off-by: Will Deacon <will.deacon@arm.com>
Signed-off-by: Mark Salyzyn <salyzyn@google.com>
Bug: 23181629
(cherry picked from commit 60b9dd6043fdc26860d850c364fd92b1f4e170fc)

arm64: crypto: Change priority of arm64 aes cipher.

(cherry pick from commit d802476e8db2eb616d47d0a06310276532cc2ffa)

Change-Id: I0c614e0eca71b65945ff8bd17c65b03a02918b18
Signed-off-by: Riley Andrews <riandrews@google.com>
Signed-off-by: Mark Salyzyn <salyzyn@google.com>
Bug: 23181629
(cherry picked from commit 52d464160266101140ce95992256c25cc03e2bb3)

selinux: do not check open perm on ftruncate call

Use the ATTR_FILE attribute to distinguish between truncate()
and ftruncate() system calls. The two other cases where
do_truncate is called with a filp (and therefore ATTR_FILE is set)
are for coredump files and for open(O_TRUNC). In both of those cases
the open permission has already been checked during file open and
therefore does not need to be repeated.

Commit 95dbf739313f ("SELinux: check OPEN on truncate calls")
fixed a major issue where domains were allowed to truncate files
without the open permission. However, it introduced a new bug where
a domain with the write permission can no longer ftruncate files
without the open permission, even when they receive an already open
file.

(cherry picked from commit b21800f304392ee5d20f411c37470183cc779f11)

Bug: 22567870
Change-Id: Id7c305e46beba5091c2c777529bd468216aae1c3

Signed-off-by: Jeff Vander Stoep <jeffv@google.com>
Acked-by: Stephen Smalley <sds@tycho.nsa.gov>
Signed-off-by: Paul Moore <pmoore@redhat.com>
(cherry picked from commit df46bc83c1fc9b64b2e86290935a3ad550b2e56e)

Fix NULL pointer dereference in tcp_nuke_addr.

tcp_nuke addr only grabs the bottom half socket lock, but not the
userspace socket lock. This allows a userspace program to call
close() while the socket is running, which causes a NULL pointer
dereference in inet_put_port.

Bug: 23663111
Bug: 24072792
Change-Id: Iecb63af68c2db4764c74785153d1c9054f76b94f
Signed-off-by: Lorenzo Colitti <lorenzo@google.com>
(cherry picked from commit 74d66ee756afcc3269e4c1341f793c52be629af9)

usb: phy: fix dual role sysfs build if kernel modules are supported

Add a missing ";" after EXPORT_SYMBOL() otherwise we run
into following build error if Kernel Modules are supported:
----------
  CC      drivers/usb/phy/class-dual-role.o
drivers/usb/phy/class-dual-role.c:91:1: error: expected ',' or ';' before 'int'
 int dual_role_get_property(struct dual_role_phy_instance *dual_role,
 ^
make[3]: *** [drivers/usb/phy/class-dual-role.o] Error 1
----------

Signed-off-by: Amit Pundir <amit.pundir@linaro.org>
(cherry picked from commit 9ff158f4c245c2fecb1489a4aae62ca67c0846a1)

Change-Id: I7ec77584b3a753448ddc50a74204a20f4636f8a4
(cherry picked from commit f5af56b478111455ce9041d958b83f13bc742af6)

ion: Handle the memory mapping correctly on x86

This patch modifies the ion page pool code to address
limitation in x86 PAT. When one physical page is mapped
to multiple virtual pages, the same cache policy
should be used. Add set_memory_wc/uc call to avoid aliases.
If not, all mappings will be cached(write back).

Change-Id: I98ee8902df0c80135dddfa998c4ca4c2bb44e40e
Signed-off-by: Zhebin Jin <zhebin.jin@intel.com>
Signed-off-by: Vinil Cheeramvelil <vinil.cheeramvelil@intel.com>
(cherry picked from commit 6db47cc7e2f1d8dd8fc84912202ed749d6781a76)

Conflicts:
drivers/staging/android/ion/Kconfig
drivers/staging/android/ion/ion_priv.h

usb: phy: Dual role sysfs class definition

This CL adds a new class to monitor and change
dual role usb ports from userspace. The usb
phy drivers can register to the dual_role_usb
class and expose the capabilities of the ports.
The phy drivers can decide on whether a specific
attribute can be changed from userspace by
choosing to implement the appropriate callback.

Signed-off-by: Badhri Jagan Sridharan <badhri@google.com>
Bug: 21615151
Change-Id: I121b4a94437972b5abe8f781e3007efa8531978
(cherry picked from commit f3061b9d608ce2314f24088281131ebadafa3985)

trace/events: fix compilation error

include/trace/events/filemap.h: In function 'ftrace_raw_output_mm_filemap_find_page_cache_miss':
include/trace/ftrace.h:232:9: error: format '%lu' expects argument of type 'long unsigned int', but argument 5 has type 'size_t' [-Werror=format=]

Change-Id: Ic2d76f18fc8802cf1e2246f96d84a06d267a30ad
Signed-off-by: Jin Qian <jinqian@google.com>
(cherry picked from commit c91e2d317307431283b96ce040e8aefd44b0b286)

sysrq: Emergency Remount R/O in reverse order

This change fixes a problem where reboot on Android panics the kernel
almost every time when file systems are mounted over loop devices.

Android reboot command does:
- sync
- echo u > /proc/sysrq-trigger
- syscall_reboot

The problem is with sysrq emergency remount R/O trying to remount-ro
in wrong order.
since /data is re-mounted ro before loop devices, loop device
remount-ro fails to flush the journal and panics the kernel:

  EXT4-fs (loop0): Remounting filesystem read-only
  EXT4-fs (loop0): previous I/O error to superblock detected
  loop: Write error at byte offset 0, length 4096.
  Buffer I/O error on device loop0, logical block 0
  lost page write due to I/O error on loop0
  Kernel panic - not syncing: EXT4-fs panic from previous error

The fix is quite simple. In do_emergency_remount(), use
list_for_each_entry_reverse() on sb list instead of list_for_each_entry().
It makes a lot of sense to umount the file systems in reverse order in
which they were added to sb list.

Change-Id: I4370e39b5873bd16ade5d5f9ddb2704beb02a2bb
Signed-off-by: Amir Goldstein <amir@cellrox.com>
Acked-by: Oren Laadan <orenl@cellrox.com>
(cherry picked from commit 334cc257d864f112b64fb885be908e6cdd644c08)

pstore: pmsg: return -ENOMEM on vmalloc failure

Signed-off-by: Mark Salyzyn <salyzyn@google.com>
Bug: 23385441
Change-Id: I294cb72c25bddafbba4e64fdb0a18ae46655a05d
(cherry picked from commit 62bb84973c1d55a4cc35cc4d95cb723ce0aa2c0b)

Page cache miss tracing using ftrace on mm/filemap

This patch includes two trace events on generic_perform_write and
do_generic_file_read to check on the address_space mapping for the
pages to be accessed by the request.

Change-Id: Ib319b9b2c971b9e5c76645be6cfd995ef9465d77
Signed-off-by: Daniel Campello <campello@google.com>
(cherry picked from commit d3952c50853166bd04562766c9603ed86ab0da75)

Conflicts:
include/linux/pagemap.h

wakeup_reason: use vsnprintf instead of snsprintf for vargs.

Bug: 22368519
Signed-off-by: Ruchi Kandoi <kandoiruchi@google.com>
(cherry picked from commit 26dfa1394af4da60bf8ce7c5e56168b1ad8f2179)

uid_cputime: Iterates over all the threads instead of processes.

Bug: 22833116
Change-Id: I775a18f61bd2f4df2bec23d01bd49421d0969f87
Signed-off-by: Ruchi Kandoi <kandoiruchi@google.com>
(cherry picked from commit eb9cf7d0d416edc93edfe6e784189f02c82701a1)

ipv6: sysctl to restrict candidate source addresses

Per RFC 6724, section 4, "Candidate Source Addresses":

    It is RECOMMENDED that the candidate source addresses be the set
    of unicast addresses assigned to the interface that will be used
    to send to the destination (the "outgoing" interface).

Add a sysctl to enable this behaviour.

Signed-off-by: Erik Kline <ek@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
[Simplified back-port of net-next 3985e8a3611a93bb36789f65db862e5700aab65e]

Bug: 19470192
Bug: 21832279
Bug: 22464419
Change-Id: Ib74ef945dcabe64215064f15ee1660b6524d65ce
(cherry picked from commit 0633924e7776754ccb473d649e5fa9ee45617a46)

uid_cputime: fix cputime overflow

Converting cputime_t to usec caused overflow when the value is greater
than 1 hour. Use msec and convert to unsigned long long to support bigger
range.

Bug: 22461683

Change-Id: I853fe3e8e7dbf0d3e2cc5c6f9688a5a6e1f1fb3e
Signed-off-by: Jin Qian <jinqian@google.com>
(cherry picked from commit 75bf23fe4bfb1805b411965b5ce3c4b81b957898)

initramfs: Add skip_initramfs command line option

Add a skip_initramfs option to allow choosing whether to boot using
the initramfs or not at runtime.

Change-Id: If30428fa748c1d4d3d7b9d97c1f781de5e4558c3
Signed-off-by: Rom Lemarchand <romlem@google.com>
(cherry picked from commit 6f36227aa43c9e4b17a2dcda6a38e79d1b00d1b5)

cpu_power: Avoids race condition when the task exits.

When the task is terminated, the cpu_power for that particular task is
added to the terminated tasks. cpu_power is set to ULLONG_MAX at this
point to avoid double accounting of the power. It is possible that before the
task releases all the resources, cpu reschedules the task or a timer
interrupt is fired. At this point we will try to add the additional time
to the process, which will cause the accounting to be skewed. This
avoids the case where we change the cpu_power when it is already set to
ULLONG_MAX.

Bug: 22064385
Change-Id: I405733725d535b0a864088516bf52fa3638ee6aa
Signed-off-by: Jin Qian <jinqian@google.com>
Signed-off-by: Ruchi Kandoi <kandoiruchi@google.com>
(cherry picked from commit fd72341df7e6e8b834f5d4ec86a30f248eb96385)

Fix arch/arm/crypto/sha256_glue.c

MODULE_ALIAS_CRYPTO is not defined, use MODULE_ALIAS.

Signed-off-by: Sami Tolvanen <samitolvanen@google.com>
Change-Id: I24803dbbbf7ac7889bc027f69af371b594eca835
(cherry picked from 5eb3cca16fcf9c62753058aaf73bb12b71acba79)

(cherry picked from commit 9645fcee58b4af5f9f9a530f0fb514e7245012a8)

of: add empty of_find_node_by_path() for !OF

Add an empty version of of_find_node_by_path().
This fixes following build error for asoc tree:
sound/soc/fsl/fsl_ssi.c: In function 'fsl_ssi_probe':
sound/soc/fsl/fsl_ssi.c:1471:2: error: implicit declaration of function 'of_find_node_by_path' [-Werror=implicit-function-declaration]
  sprop = of_get_property(of_find_node_by_path("/"), "compatible", NULL);

Change-Id: Ib635dffb97877a2820fb80b99db96a285a6d2d14
Reported-by: Stephen Rothwell <sfr@canb.auug.org.au>
Signed-off-by: Alexander Shiyan <shc_work@mail.ru>
Signed-off-by: Rob Herring <robh@kernel.org>
(cherry picked from commit 9e7f1b065a312062eb8acdb1c505ddb3792b7583)

uid_cputime: Avoids double accounting of process stime, utime and cpu_power in
task exit.

This avoids the race where a particular process is terminating and we
read the show_uid_stats. At this time since the task_struct still exists
and we will account for the terminating process as one of the active
task, where as the stats would have been added in the task exit
callback.

Bug: 22064385
Change-Id: Id2ae04b33fcd230eda9683a41b6019d4dd8f5d85
Signed-off-by: Jin Qian <jinqian@google.com>
Signed-off-by: Ruchi Kandoi <kandoiruchi@google.com>
(cherry picked from commit ddd9aac59e0aea3d5a4df485173115e8ecb3e17d)

Shrink ashmem directly through shmem_fallocate

When ashmem_shrink is called from direct reclaim on a user thread, a
call to do_fallocate will check for permissions against the security
policy of that user thread.  It can thus fail by chance if called on a
thread that isn't permitted to modify the relevant ashmem areas.

Because we know that we have a shmem file underneath, call the shmem
implementation of fallocate directly instead of going through the
user-space interface for fallocate.

FIX=DMS06243560
Area: Kernel/Linux Kernel

Bug: 21951515
Change-Id: Ie98fff18a2bdeb535cd24d4fbdd13677e12681a7
Signed-off-by: Jeff Vander Stoep <jeffv@google.com>
(cherry picked from commit 2ecc7f173a30ee7df10240d6944108252a5f5b7d)

cpufreq: Iterate over all the possible cpus to create powerstats.

For architectures which support a single policy for multiple cpus,
powerstats will not be initalized for all the cores. This change will
make sure powerstats is initialized for all the cores.

Also minor changes to increase code readability.

Bug: 21498425
Change-Id: I938f45e92ff6d5371c32c4d0e37274e6de66769c
Signed-off-by: Ruchi Kandoi <kandoiruchi@google.com>
(cherry picked from commit 5862c50d1970886b5b5a57b5b52ecfd6feb95ebd)

Merge tag 'v3.10.92'

This is the 3.10.92 stable release

Merge tag 'lsk-v3.10-15.10-android'

LSK Android 15.10 v3.10

uart: rockchip: add uart supported for rk3228

Change-Id: I86b49f20954a739645b9277e45d6b75058ff9c2b
Signed-off-by: David Wu <wdc@rock-chips.com>

ARM: dts: rk3228: tsadc: support tsadc for rk3228

add rk3228 tsadc parameter for dtsi.

Change-Id: I74cc9b6c2e4d53aa5e3391d5a820937925f07077
Signed-off-by: zhangqing <zhangqing@rock-chips.com>

Linux 3.10.92

rbd: fix double free on rbd_dev->header_name

commit 3ebe138ac642a195c7f2efdb918f464734421fd6 upstream.

If rbd_dev_image_probe() in rbd_dev_probe_parent() fails, header_name
is freed twice: once in rbd_dev_probe_parent() and then in its caller
rbd_dev_image_probe() (rbd_dev_image_probe() is called recursively to
handle parent images).

rbd_dev_probe_parent() is responsible for probing the parent, so it
shouldn't muck with clone's fields.

Signed-off-by: Ilya Dryomov <idryomov@gmail.com>
Reviewed-by: Alex Elder <elder@linaro.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

dm thin: fix missing pool reference count decrement in pool_ctr error path

commit ba30670f4d5292c4e7f7980bbd5071f7c4794cdd upstream.

Fixes: ac8c3f3df ("dm thin: generate event when metadata threshold passed")
Signed-off-by: Mike Snitzer <snitzer@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

workqueue: make sure delayed work run in local cpu

commit 874bbfe600a660cba9c776b3957b1ce393151b76 upstream.

My system keeps crashing with below message. vmstat_update() schedules a delayed
work in current cpu and expects the work runs in the cpu.
schedule_delayed_work() is expected to make delayed work run in local cpu. The
problem is timer can be migrated with NO_HZ. __queue_work() queues work in
timer handler, which could run in a different cpu other than where the delayed
work is scheduled. The end result is the delayed work runs in different cpu.
The patch makes __queue_delayed_work records local cpu earlier. Where the timer
runs doesn't change where the work runs with the change.

[   28.010131] ------------[ cut here ]------------
[   28.010609] kernel BUG at ../mm/vmstat.c:1392!
[   28.011099] invalid opcode: 0000 [#1] PREEMPT SMP DEBUG_PAGEALLOC KASAN
[   28.011860] Modules linked in:
[   28.012245] CPU: 0 PID: 289 Comm: kworker/0:3 Tainted: G        W4.3.0-rc3+ #634
[   28.013065] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.7.5-20140709_153802- 04/01/2014
[   28.014160] Workqueue: events vmstat_update
[   28.014571] task: ffff880117682580 ti: ffff8800ba428000 task.ti: ffff8800ba428000
[   28.015445] RIP: 0010:[<ffffffff8115f921>]  [<ffffffff8115f921>]vmstat_update+0x31/0x80
[   28.016282] RSP: 0018:ffff8800ba42fd80  EFLAGS: 00010297
[   28.016812] RAX: 0000000000000000 RBX: ffff88011a858dc0 RCX:0000000000000000
[   28.017585] RDX: ffff880117682580 RSI: ffffffff81f14d8c RDI:ffffffff81f4df8d
[   28.018366] RBP: ffff8800ba42fd90 R08: 0000000000000001 R09:0000000000000000
[   28.019169] R10: 0000000000000000 R11: 0000000000000121 R12:ffff8800baa9f640
[   28.019947] R13: ffff88011a81e340 R14: ffff88011a823700 R15:0000000000000000
[   28.020071] FS:  0000000000000000(0000) GS:ffff88011a800000(0000)knlGS:0000000000000000
[   28.020071] CS:  0010 DS: 0000 ES: 0000 CR0: 000000008005003b
[   28.020071] CR2: 00007ff6144b01d0 CR3: 00000000b8e93000 CR4:00000000000006f0
[   28.020071] Stack:
[   28.020071]  ffff88011a858dc0 ffff8800baa9f640 ffff8800ba42fe00ffffffff8106bd88
[   28.020071]  ffffffff8106bd0b 0000000000000096 0000000000000000ffffffff82f9b1e8
[   28.020071]  ffffffff829f0b10 0000000000000000 ffffffff81f18460ffff88011a81e340
[   28.020071] Call Trace:
[   28.020071]  [<ffffffff8106bd88>] process_one_work+0x1c8/0x540
[   28.020071]  [<ffffffff8106bd0b>] ? process_one_work+0x14b/0x540
[   28.020071]  [<ffffffff8106c214>] worker_thread+0x114/0x460
[   28.020071]  [<ffffffff8106c100>] ? process_one_work+0x540/0x540
[   28.020071]  [<ffffffff81071bf8>] kthread+0xf8/0x110
[   28.020071]  [<ffffffff81071b00>] ?kthread_create_on_node+0x200/0x200
[   28.020071]  [<ffffffff81a6522f>] ret_from_fork+0x3f/0x70
[   28.020071]  [<ffffffff81071b00>] ?kthread_create_on_node+0x200/0x200

Signed-off-by: Shaohua Li <shli@fb.com>
Signed-off-by: Tejun Heo <tj@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

i2c: rcar: enable RuntimePM before registering to the core

commit 4f7effddf4549d57114289f273710f077c4c330a upstream.

The core may register clients attached to this master which may use
funtionality from the master. So, RuntimePM must be enabled before, otherwise
this will fail. While here, move drvdata, too.

Reported-by: Geert Uytterhoeven <geert+renesas@glider.be>
Signed-off-by: Wolfram Sang <wsa+renesas@sang-engineering.com>
Signed-off-by: Wolfram Sang <wsa@the-dreams.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

crypto: ahash - ensure statesize is non-zero

commit 8996eafdcbad149ac0f772fb1649fbb75c482a6a upstream.

Unlike shash algorithms, ahash drivers must implement export
and import as their descriptors may contain hardware state and
cannot be exported as is.  Unfortunately some ahash drivers did
not provide them and end up causing crashes with algif_hash.

This patch adds a check to prevent these drivers from registering
ahash algorithms until they are fixed.

Signed-off-by: Russell King <rmk+kernel@arm.linux.org.uk>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

crypto: sparc - initialize blkcipher.ivsize

commit a66d7f724a96d6fd279bfbd2ee488def6b081bea upstream.

Some of the crypto algorithms write to the initialization vector,
but no space has been allocated for it. This clobbers adjacent memory.

Signed-off-by: Dave Kleikamp <dave.kleikamp@oracle.com>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

m68k/uaccess: Fix asm constraints for userspace access

commit 631d8b674f5f8235e9cb7e628b0fe9e5200e3158 upstream.

When compiling a MMU kernel with CPU_HAS_ADDRESS_SPACES=n (e.g. "MMU=y
allnoconfig": "echo CONFIG_MMU=y > allno.config && make KCONFIG_ALLCONFIG=1
allnoconfig"), we use plain "move" instead of "moves", and I got:

  CC      arch/m68k/lib/uaccess.o
{standard input}: Assembler messages:
{standard input}:47: Error: operands mismatch -- statement `move.b %a0,(%a1)' ignored

This happens because plain "move" doesn't support byte transfers between
memory and address registers, while "moves" does.

Fix the asm constraints for __generic_copy_from_user(),
__generic_copy_to_user(), and __clear_user() to only use data registers
when accessing userspace.

Also, relax the asm constraints for 16-bit userspace accesses in
__put_user() and __get_user(), as both "move" and "moves" do support
such transfers between memory and address registers.

Signed-off-by: Geert Uytterhoeven <geert@linux-m68k.org>
Cc: Guenter Roeck <linux@roeck-us.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

asix: Do full reset during ax88772_bind

[ Upstream commit 436c2a5036b6ffe813310df2cf327d3b69be0734 ]

commit 3cc81d85ee01 ("asix: Don't reset PHY on if_up for ASIX 88772")
causes the ethernet on Arndale to no longer function. This appears to
be because the Arndale ethernet requires a full reset before it will
function correctly, however simply reverting the above patch causes
problems with ethtool settings getting reset.

It seems the problem is that the ethernet is not properly reset during
bind, and indeed the code in ax88772_bind that resets the device is a
very small subset of the actual ax88772_reset function. This patch uses
ax88772_reset in place of the existing reset code in ax88772_bind which
removes some code duplication and fixes the ethernet on Arndale.

It is still possible that the original patch causes some issues with
suspend and resume but that seems like a separate issue and I haven't
had a chance to test that yet.

Signed-off-by: Charles Keepax <ckeepax@opensource.wolfsonmicro.com>
Tested-by: Riku Voipio <riku.voipio@linaro.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

asix: Don't reset PHY on if_up for ASIX 88772

[ Upstream commit 3cc81d85ee01e5a0b7ea2f4190e2ed1165f53c31 ]

I've noticed every time the interface is set to 'up,', the kernel
reports that the link speed is set to 100 Mbps/Full Duplex, even
when ethtool is used to set autonegotiation to 'off', half
duplex, 10 Mbps.
It can be tested by:
 ifconfig eth0 down
 ethtool -s eth0 autoneg off speed 10 duplex half
 ifconfig eth0 up

Then checking 'dmesg' for the link speed.

Signed-off-by: Michel Stam <m.stam@fugro.nl>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

ethtool: Use kcalloc instead of kmalloc for ethtool_get_strings

[ Upstream commit 077cb37fcf6f00a45f375161200b5ee0cd4e937b ]

It seems that kernel memory can leak into userspace by a
kmalloc, ethtool_get_strings, then copy_to_user sequence.

Avoid this by using kcalloc to zero fill the copied buffer.

Signed-off-by: Joe Perches <joe@perches.com>
Acked-by: Ben Hutchings <ben@decadent.org.uk>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

ppp: don't override sk->sk_state in pppoe_flush_dev()

[ Upstream commit e6740165b8f7f06d8caee0fceab3fb9d790a6fed ]

Since commit 2b018d57ff18 ("pppoe: drop PPPOX_ZOMBIEs in pppoe_release"),
pppoe_release() calls dev_put(po->pppoe_dev) if sk is in the
PPPOX_ZOMBIE state. But pppoe_flush_dev() can set sk->sk_state to
PPPOX_ZOMBIE _and_ reset po->pppoe_dev to NULL. This leads to the
following oops:

[  570.140800] BUG: unable to handle kernel NULL pointer dereference at 00000000000004e0
[  570.142931] IP: [<ffffffffa018c701>] pppoe_release+0x50/0x101 [pppoe]
[  570.144601] PGD 3d119067 PUD 3dbc1067 PMD 0
[  570.144601] Oops: 0000 [#1] SMP
[  570.144601] Modules linked in: l2tp_ppp l2tp_netlink l2tp_core ip6_udp_tunnel udp_tunnel pppoe pppox ppp_generic slhc loop crc32c_intel ghash_clmulni_intel jitterentropy_rng sha256_generic hmac drbg ansi_cprng aesni_intel aes_x86_64 ablk_helper cryptd lrw gf128mul glue_helper acpi_cpufreq evdev serio_raw processor button ext4 crc16 mbcache jbd2 virtio_net virtio_blk virtio_pci virtio_ring virtio
[  570.144601] CPU: 1 PID: 15738 Comm: ppp-apitest Not tainted 4.2.0 #1
[  570.144601] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Debian-1.8.2-1 04/01/2014
[  570.144601] task: ffff88003d30d600 ti: ffff880036b60000 task.ti: ffff880036b60000
[  570.144601] RIP: 0010:[<ffffffffa018c701>]  [<ffffffffa018c701>] pppoe_release+0x50/0x101 [pppoe]
[  570.144601] RSP: 0018:ffff880036b63e08  EFLAGS: 00010202
[  570.144601] RAX: 0000000000000000 RBX: ffff880034340000 RCX: 0000000000000206
[  570.144601] RDX: 0000000000000006 RSI: ffff88003d30dd20 RDI: ffff88003d30dd20
[  570.144601] RBP: ffff880036b63e28 R08: 0000000000000001 R09: 0000000000000000
[  570.144601] R10: 00007ffee9b50420 R11: ffff880034340078 R12: ffff8800387ec780
[  570.144601] R13: ffff8800387ec7b0 R14: ffff88003e222aa0 R15: ffff8800387ec7b0
[  570.144601] FS:  00007f5672f48700(0000) GS:ffff88003fc80000(0000) knlGS:0000000000000000
[  570.144601] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[  570.144601] CR2: 00000000000004e0 CR3: 0000000037f7e000 CR4: 00000000000406a0
[  570.144601] Stack:
[  570.144601]  ffffffffa018f240 ffff8800387ec780 ffffffffa018f240 ffff8800387ec7b0
[  570.144601]  ffff880036b63e48 ffffffff812caabe ffff880039e4e000 0000000000000008
[  570.144601]  ffff880036b63e58 ffffffff812cabad ffff880036b63ea8 ffffffff811347f5
[  570.144601] Call Trace:
[  570.144601]  [<ffffffff812caabe>] sock_release+0x1a/0x75
[  570.144601]  [<ffffffff812cabad>] sock_close+0xd/0x11
[  570.144601]  [<ffffffff811347f5>] __fput+0xff/0x1a5
[  570.144601]  [<ffffffff811348cb>] ____fput+0x9/0xb
[  570.144601]  [<ffffffff81056682>] task_work_run+0x66/0x90
[  570.144601]  [<ffffffff8100189e>] prepare_exit_to_usermode+0x8c/0xa7
[  570.144601]  [<ffffffff81001a26>] syscall_return_slowpath+0x16d/0x19b
[  570.144601]  [<ffffffff813babb1>] int_ret_from_sys_call+0x25/0x9f
[  570.144601] Code: 48 8b 83 c8 01 00 00 a8 01 74 12 48 89 df e8 8b 27 14 e1 b8 f7 ff ff ff e9 b7 00 00 00 8a 43 12 a8 0b 74 1c 48 8b 83 a8 04 00 00 <48> 8b 80 e0 04 00 00 65 ff 08 48 c7 83 a8 04 00 00 00 00 00 00
[  570.144601] RIP  [<ffffffffa018c701>] pppoe_release+0x50/0x101 [pppoe]
[  570.144601]  RSP <ffff880036b63e08>
[  570.144601] CR2: 00000000000004e0
[  570.200518] ---[ end trace 46956baf17349563 ]---

pppoe_flush_dev() has no reason to override sk->sk_state with
PPPOX_ZOMBIE. pppox_unbind_sock() already sets sk->sk_state to
PPPOX_DEAD, which is the correct state given that sk is unbound and
po->pppoe_dev is NULL.

Fixes: 2b018d57ff18 ("pppoe: drop PPPOX_ZOMBIEs in pppoe_release")
Tested-by: Oleksii Berezhniak <core@irc.lg.ua>
Signed-off-by: Guillaume Nault <g.nault@alphalink.fr>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

net: add pfmemalloc check in sk_add_backlog()

[ Upstream commit c7c49b8fde26b74277188bdc6c9dca38db6fa35b ]

Greg reported crashes hitting the following check in __sk_backlog_rcv()

BUG_ON(!sock_flag(sk, SOCK_MEMALLOC));

The pfmemalloc bit is currently checked in sk_filter().

This works correctly for TCP, because sk_filter() is ran in
tcp_v[46]_rcv() before hitting the prequeue or backlog checks.

For UDP or other protocols, this does not work, because the sk_filter()
is ran from sock_queue_rcv_skb(), which might be called _after_ backlog
queuing if socket is owned by user by the time packet is processed by
softirq handler.

Fixes: b4b9e35585089 ("netvm: set PF_MEMALLOC as appropriate during SKB processing")
Signed-off-by: Eric Dumazet <edumazet@google.com>
Reported-by: Greg Thelen <gthelen@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

skbuff: Fix skb checksum partial check.

[ Upstream commit 31b33dfb0a144469dd805514c9e63f4993729a48 ]

Earlier patch 6ae459bda tried to detect void ckecksum partial
skb by comparing pull length to checksum offset. But it does
not work for all cases since checksum-offset depends on
updates to skb->data.

Following patch fixes it by validating checksum start offset
after skb-data pointer is updated. Negative value of checksum
offset start means there is no need to checksum.

Fixes: 6ae459bda ("skbuff: Fix skb checksum flag on skb pull")
Reported-by: Andrew Vagin <avagin@odin.com>
Signed-off-by: Pravin B Shelar <pshelar@nicira.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

skbuff: Fix skb checksum flag on skb pull

[ Upstream commit 6ae459bdaaeebc632b16e54dcbabb490c6931d61 ]

VXLAN device can receive skb with checksum partial. But the checksum
offset could be in outer header which is pulled on receive. This results
in negative checksum offset for the skb. Such skb can cause the assert
failure in skb_checksum_help(). Following patch fixes the bug by setting
checksum-none while pulling outer header.

Following is the kernel panic msg from old kernel hitting the bug.

------------[ cut here ]------------
kernel BUG at net/core/dev.c:1906!
RIP: 0010:[<ffffffff81518034>] skb_checksum_help+0x144/0x150
Call Trace:
<IRQ>
[<ffffffffa0164c28>] queue_userspace_packet+0x408/0x470 [openvswitch]
[<ffffffffa016614d>] ovs_dp_upcall+0x5d/0x60 [openvswitch]
[<ffffffffa0166236>] ovs_dp_process_packet_with_key+0xe6/0x100 [openvswitch]
[<ffffffffa016629b>] ovs_dp_process_received_packet+0x4b/0x80 [openvswitch]
[<ffffffffa016c51a>] ovs_vport_receive+0x2a/0x30 [openvswitch]
[<ffffffffa0171383>] vxlan_rcv+0x53/0x60 [openvswitch]
[<ffffffffa01734cb>] vxlan_udp_encap_recv+0x8b/0xf0 [openvswitch]
[<ffffffff8157addc>] udp_queue_rcv_skb+0x2dc/0x3b0
[<ffffffff8157b56f>] __udp4_lib_rcv+0x1cf/0x6c0
[<ffffffff8157ba7a>] udp_rcv+0x1a/0x20
[<ffffffff8154fdbd>] ip_local_deliver_finish+0xdd/0x280
[<ffffffff81550128>] ip_local_deliver+0x88/0x90
[<ffffffff8154fa7d>] ip_rcv_finish+0x10d/0x370
[<ffffffff81550365>] ip_rcv+0x235/0x300
[<ffffffff8151ba1d>] __netif_receive_skb+0x55d/0x620
[<ffffffff8151c360>] netif_receive_skb+0x80/0x90
[<ffffffff81459935>] virtnet_poll+0x555/0x6f0
[<ffffffff8151cd04>] net_rx_action+0x134/0x290
[<ffffffff810683d8>] __do_softirq+0xa8/0x210
[<ffffffff8162fe6c>] call_softirq+0x1c/0x30
[<ffffffff810161a5>] do_softirq+0x65/0xa0
[<ffffffff810687be>] irq_exit+0x8e/0xb0
[<ffffffff81630733>] do_IRQ+0x63/0xe0
[<ffffffff81625f2e>] common_interrupt+0x6e/0x6e

Reported-by: Anupam Chanda <achanda@vmware.com>
Signed-off-by: Pravin B Shelar <pshelar@nicira.com>
Acked-by: Tom Herbert <tom@herbertland.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

af_unix: return data from multiple SKBs on recv() with MSG_PEEK flag

[ Upstream commit 9f389e35674f5b086edd70ed524ca0f287259725 ]

AF_UNIX sockets now return multiple skbs from recv() when MSG_PEEK flag
is set.

This is referenced in kernel bugzilla #12323 @
https://bugzilla.kernel.org/show_bug.cgi?id=12323

As described both in the BZ and lkml thread @
http://lkml.org/lkml/2008/1/8/444 calling recv() with MSG_PEEK on an
AF_UNIX socket only reads a single skb, where the desired effect is
to return as much skb data has been queued, until hitting the recv
buffer size (whichever comes first).

The modified MSG_PEEK path will now move to the next skb in the tree
and jump to the again: label, rather than following the natural loop
structure. This requires duplicating some of the loop head actions.

This was tested using the python socketpair python code attached to
the bugzilla issue.

Signed-off-by: Aaron Conole <aconole@bytheb.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

af_unix: Convert the unix_sk macro to an inline function for type safety

[ Upstream commit 4613012db1d911f80897f9446a49de817b2c4c47 ]

As suggested by Eric Dumazet this change replaces the
#define with a static inline function to enjoy
complaints by the compiler when misusing the API.

Signed-off-by: Aaron Conole <aconole@bytheb.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

l2tp: protect tunnel->del_work by ref_count

[ Upstream commit 06a15f51cf3618e32a73871ee6a547ef7fd902b5 ]

There is a small chance that tunnel_free() is called before tunnel->del_work scheduled
resulting in a zero pointer dereference.

Signed-off-by: Alexander Couzens <lynxis@fe80.eu>
Acked-by: James Chapman <jchapman@katalix.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

pwm: rockchip: add pwm supported for rk3228

Change-Id: I30d816d4bca2fb532b009505947d1465732a2f07
Signed-off-by: David Wu <wdc@rock-chips.com>

i2c: rockchip: add i2c supported for rk3228

Change-Id: I3836b589f3ba456869f20a0ad97e6cde031debfd
Signed-off-by: David Wu <wdc@rock-chips.com>

rk3228: pinctrl: add rk3288-pinctrl func supported

Change-Id: I9d85f55d6478bcd5dfcee704b235585ee0ba7c75
Signed-off-by: David Wu <wdc@rock-chips.com>

mmc: rk_sdmmc: fix NULL pointer in printout

This patch fix NULL pointer to chan_id while requsting
external dma channel failed.

Change-Id: I0abe1acb0a892cbaec0cadb24fe215b46e2e9abb
Signed-off-by: Shawn Lin <shawn.lin@rock-chips.com>

rk3228: thermal: support tsadc for rk3228

add rk3228 tsadc in rockchip-thermal.c

Change-Id: I86db35d5b551031ca464df1caaed836a3d56e779
Signed-off-by: zhangqing <zhangqing@rock-chips.com>

rk3288, mali_t760: add 'static' on DEVICE_ATTR variables.

Change-Id: I73ca6930e50d1a834ffa97741842944ae420f6da
Signed-off-by: chenzhen <chenzhen@rock-chips.com>

rk312x, mali_400: add 'static' on DEVICE_ATTR variables.

Change-Id: Icaaf3ce9626e78fe12e74587cc0812bfcfa3de2e
Signed-off-by: chenzhen <chenzhen@rock-chips.com>

Linux 3.10.91

3w-9xxx: don't unmap bounce buffered commands

commit 15e3d5a285ab9283136dba34bbf72886d9146706 upstream.

3w controller don't dma map small single SGL entry commands but instead
bounce buffer them.  Add a helper to identify these commands and don't
call scsi_dma_unmap for them.

Based on an earlier patch from James Bottomley.

Fixes: 118c85 ("3w-9xxx: fix command completion race")
Reported-by: Tóth Attila <atoth@atoth.sote.hu>
Tested-by: Tóth Attila <atoth@atoth.sote.hu>
Signed-off-by: Christoph Hellwig <hch@lst.de>
Acked-by: Adam Radford <aradford@gmail.com>
Signed-off-by: James Bottomley <JBottomley@Odin.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

staging: speakup: fix speakup-r regression

commit b1d562acc78f0af46de0dfe447410bc40bdb7ece upstream.

Here is a patch to make speakup-r work again.

It broke in 3.6 due to commit 4369c64c79a22b98d3b7eff9d089196cd878a10a
"Input: Send events one packet at a time)

The problem was that the fakekey.c routine to fake a down arrow no
longer functioned properly and putting the input_sync fixed it.

Fixes: 4369c64c79a22b98d3b7eff9d089196cd878a10a
Acked-by: Samuel Thibault <samuel.thibault@ens-lyon.org>
Signed-off-by: John Covici <covici@ccs.covici.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

dm cache: fix NULL pointer when switching from cleaner policy

commit 2bffa1503c5c06192eb1459180fac4416575a966 upstream.

The cleaner policy doesn't make use of the per cache block hint space in
the metadata (unlike the other policies).  When switching from the
cleaner policy to mq or smq a NULL pointer crash (in dm_tm_new_block)
was observed.  The crash was caused by bugs in dm-cache-metadata.c
when trying to skip creation of the hint btree.

The minimal fix is to change hint size for the cleaner policy to 4 bytes
(only hint size supported).

Signed-off-by: Joe Thornber <ejt@redhat.com>
Signed-off-by: Mike Snitzer <snitzer@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

x86: Add 1/2/4/8 byte optimization to 64bit __copy_{from,to}_user_inatomic

commit ff47ab4ff3cddfa7bc1b25b990e24abe2ae474ff upstream.

The 64bit __copy_{from,to}_user_inatomic always called
copy_from_user_generic, but skipped the special optimizations for 1/2/4/8
byte accesses.

This especially hurts the futex call, which accesses the 4 byte futex
user value with a complicated fast string operation in a function call,
instead of a single movl.

Use __copy_{from,to}_user for _inatomic instead to get the same
optimizations. The only problem was the might_fault() in those functions.
So move that to new wrapper and call __copy_{f,t}_user_nocheck()
from *_inatomic directly.

32bit already did this correctly by duplicating the code.

Signed-off-by: Andi Kleen <ak@linux.intel.com>
Link: http://lkml.kernel.org/r/1376687844-19857-2-git-send-email-andi@firstfloor.org
Signed-off-by: H. Peter Anvin <hpa@linux.intel.com>
Cc: Thomas Gleixner <tglx@linutronix.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

genirq: Fix race in register_irq_proc()

commit 95c2b17534654829db428f11bcf4297c059a2a7e upstream.

Per-IRQ directories in procfs are created only when a handler is first
added to the irqdesc, not when the irqdesc is created.  In the case of
a shared IRQ, multiple tasks can race to create a directory.  This
race condition seems to have been present forever, but is easier to
hit with async probing.

Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
Link: http://lkml.kernel.org/r/1443266636.2004.2.camel@decadent.org.uk
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

fib_rules: Fix dump_rules() not to exit early

Backports of 41fc014332d9 ("fib_rules: fix fib rule dumps across
multiple skbs") introduced a regression in "ip rule show" - it ends up
dumping the first rule over and over and never exiting, because 3.19
and earlier are missing commit 053c095a82cf ("netlink: make
nlmsg_end() and genlmsg_end() void"), so fib_nl_fill_rule() ends up
returning skb->len (i.e. > 0) in the success case.

Fix this by checking the return code for < 0 instead of != 0.

Signed-off-by: Roland Dreier <roland@purestorage.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>