bcmdhd: update to 1.88.51 from gpe 4.4

Change-Id: Ide40296c73e000798e174c9043a4cb8ec6a82639
msm: vidc: Use min_dpb from resource tracker in smooth streaming mode

Get min_dpb from resource tracker always if smooth streaming
mode is enabled to handle number of output buffers properly.

Change-Id: Ic46f76061f3895fda44e1d8e94198f898e5edf9b
Signed-off-by: Deepak Verma <dverma@codeaurora.org>
msm: msm_fb: Map RGB layers to the max possible size.

IOMMU Page Faults are observed on RGB layers during stability
because MDP is trying to fetch out of mapped area of the buffer.
This patch avoids the issue by overmapping the RGB layers to the
max possible RGB buffer size.

Change-Id: Idc7ac9acad70e351acac5dba2ae43b8731e84d35
Signed-off-by: Vishnuvardhan Prodduturi <vproddut@codeaurora.org>
msm: msm_fb: Do not use ION_IOMMU_UNMAP_DELAYED flag.

Since iommu buffers will be unmapped after two newer commits
had passed, there is no need to request iommu driver to further
delay unmapping an iommu buffer.

Change-Id: I44099054114403fa7ac6a5e3c71a43d6b932f4a3
Signed-off-by: raghavendra ambadas <rambad@codeaurora.org>
msm: fb: Fix security bugs in msmfb_notify_update & msm_fb_ioctl

msmfb_notify_update: Correct signature of msmfb_notify_update from
the ioctl declaration.

msm_fb_ioctl: Add appropriate null check for mfd data structure
before accessing it's members. This prevents null pointer accesses
in the driver.

CRs-Fixed: 526286
Change-Id: I731018057214fb0fa58c7617934100d2425617f8
Signed-off-by: Neti, Ravi Kumar <ravineti@codeaurora.org>
msm: mdp: Revert changes for delaying commit for tiled video

This reverts commits 3ec662e7079cad581e1b6f13a386059b40fa237a and.
bb3d5cf6e59c86dc619332fad568430c737e7a45.
These commits cause corruption with dynamic resolution changes

Bug: 10192531
Change-Id: I2dcce2fdc358bb0b87885e2ae3f853b4e728b498
Signed-off-by: Naseer Ahmed <naseer@codeaurora.org>
msm: vidc: estimate min_dpb for smooth streaming mode

In case of smoothstreaming:
[1] get dpb requirement for the firmware
[2] get count in resource resource tracker
Use higher of the above

b/10192531

Signed-off-by: Deepak Verma <dverma@codeaurora.org>
Signed-off-by: Praveen Chavan <pchavan@codeaurora.org>
msm: vidc: Set input buffer size dynamically

This change supports overriding of default input
buffer size using a set parameter call from the
client.

Change-Id: I5225ec53ba16b68aeedd4c30897bd291e81b4b09
Signed-off-by: Deepak Verma <dverma@codeaurora.org>
msm_fb: display: Program TILE video frame size in dma ISR

Since, video tile frame size register is single buffered, its
value takes effect as soon as it is programmed. Single buffered
registers like this should be configured very close to the vsync
to prevent issues like flicker or artifacts.
Program this register in dma ISR to prevent flickers and IOMMU
page faults.

Change-Id: Ifa770e4b4f29d6e4070e51388043422cc60e5872
Signed-off-by: Mayank Chopra <makchopra@codeaurora.org>
msm_fb: display: update video tile framesize register

The register should not be delayed in the case of
Witeback and command mode pannel

Change-Id: Ia90ccc1bb376ed829bedee131ba600194d471521
Signed-off-by: Justin Philip <jphili@codeaurora.org>
msm: msm_fb: Fix Regressions because of overmap changes.

Previous MDP overmap change is causing issues with HDMI because of
assumptions about overmap. This patch fixes all such issues.

Change-Id: Ifd2f8a0596d9df08538464bdcdd5946cf84db4d9
Signed-off-by: Vishnuvardhan Prodduturi <vproddut@codeaurora.org>
Revert "[ARM] msm: iommu_domains: replace vmalloc with kmalloc"

When overmapping is used, system can request higher order page allocaitons.
this can lead to page allocation failure if kmalloc is used

CRs-Fixed: 571753

This reverts commit 191a48ee7bda08bf88a61b48fd0433627c5918dc.

Change-Id: I4d44bf88d84d96d315f89a1304a2d25b75be79d8
Signed-off-by: Srinivasarao P <spathi@codeaurora.org>
smp: Relax irqs_disable() warning in smp_call_function_single()

The change that long-ago added the interrupts-disabled warning in
smp_call_function_single() cited the following deadlock as the reason:
	CPU A				CPU B
	Disable interrupts
					smp_call_function()
					Take call_lock
					Send IPIs
					Wait for all cpus to acknowledge IPI
					CPU A has not responded, spin waiting
					for cpu A to respond, holding call_lock
	smp_call_function()
	Spin waiting for call_lock
	Deadlock			Deadlock

Such a deadlock is not possible however, in the event that
smp_call_function_single() is called for the currently-executing CPU.
While not a common usecase, relaxing the warning may simplify some
driver implementations.

The 'acpuclock-krait' driver in the MSM ARM sub-architecture provides
one example, where smp_call_function_single() is sometimes called from
a cpuidle path with interrupts disabled, but only ever from the target
CPU. Other callers of that same function may cross-call, but only do so
when interrupts are enabled.

Change-Id: I647b3b46fe6aa4dfb06f7750396986b80b92d700
Signed-off-by: Matt Wagantall <mattw@codeaurora.org>
mm: add a field to store names for private anonymous memory

Userspace processes often have multiple allocators that each do
anonymous mmaps to get memory.  When examining memory usage of
individual processes or systems as a whole, it is useful to be
able to break down the various heaps that were allocated by
each layer and examine their size, RSS, and physical memory
usage.

This patch adds a user pointer to the shared union in
vm_area_struct that points to a null terminated string inside
the user process containing a name for the vma.  vmas that
point to the same address will be merged, but vmas that
point to equivalent strings at different addresses will
not be merged.

Userspace can set the name for a region of memory by calling
prctl(PR_SET_VMA, PR_SET_VMA_ANON_NAME, start, len, (unsigned long)name);
Setting the name to NULL clears it.

The names of named anonymous vmas are shown in /proc/pid/maps
as [anon:<name>] and in /proc/pid/smaps in a new "Name" field
that is only present for named vmas.  If the userspace pointer
is no longer valid all or part of the name will be replaced
with "<fault>".

The idea to store a userspace pointer to reduce the complexity
within mm (at the expense of the complexity of reading
/proc/pid/mem) came from Dave Hansen.  This results in no
runtime overhead in the mm subsystem other than comparing
the anon_name pointers when considering vma merging.  The pointer
is stored in a union with fieds that are only used on file-backed
mappings, so it does not increase memory usage.

Change-Id: Ie2ffc0967d4ffe7ee4c70781313c7b00cf7e3092
Signed-off-by: Colin Cross <ccross@android.com>
tracing: Fix potential out-of-bounds in trace_get_user()

commit 057db8488b53d5e4faa0cedb2f39d4ae75dfbdbb upstream.

Andrey reported the following report:

ERROR: AddressSanitizer: heap-buffer-overflow on address ffff8800359c99f3
ffff8800359c99f3 is located 0 bytes to the right of 243-byte region [ffff8800359c9900, ffff8800359c99f3)
Accessed by thread T13003:
  #0 ffffffff810dd2da (asan_report_error+0x32a/0x440)
  #1 ffffffff810dc6b0 (asan_check_region+0x30/0x40)
  #2 ffffffff810dd4d3 (__tsan_write1+0x13/0x20)
  #3 ffffffff811cd19e (ftrace_regex_release+0x1be/0x260)
  #4 ffffffff812a1065 (__fput+0x155/0x360)
  #5 ffffffff812a12de (____fput+0x1e/0x30)
  #6 ffffffff8111708d (task_work_run+0x10d/0x140)
  #7 ffffffff810ea043 (do_exit+0x433/0x11f0)
  #8 ffffffff810eaee4 (do_group_exit+0x84/0x130)
  #9 ffffffff810eafb1 (SyS_exit_group+0x21/0x30)
  #10 ffffffff81928782 (system_call_fastpath+0x16/0x1b)

Allocated by thread T5167:
  #0 ffffffff810dc778 (asan_slab_alloc+0x48/0xc0)
  #1 ffffffff8128337c (__kmalloc+0xbc/0x500)
  #2 ffffffff811d9d54 (trace_parser_get_init+0x34/0x90)
  #3 ffffffff811cd7b3 (ftrace_regex_open+0x83/0x2e0)
  #4 ffffffff811cda7d (ftrace_filter_open+0x2d/0x40)
  #5 ffffffff8129b4ff (do_dentry_open+0x32f/0x430)
  #6 ffffffff8129b668 (finish_open+0x68/0xa0)
  #7 ffffffff812b66ac (do_last+0xb8c/0x1710)
  #8 ffffffff812b7350 (path_openat+0x120/0xb50)
  #9 ffffffff812b8884 (do_filp_open+0x54/0xb0)
  #10 ffffffff8129d36c (do_sys_open+0x1ac/0x2c0)
  #11 ffffffff8129d4b7 (SyS_open+0x37/0x50)
  #12 ffffffff81928782 (system_call_fastpath+0x16/0x1b)

Shadow bytes around the buggy address:
  ffff8800359c9700: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
  ffff8800359c9780: fd fd fd fd fd fd fd fd fa fa fa fa fa fa fa fa
  ffff8800359c9800: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  ffff8800359c9880: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  ffff8800359c9900: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
=>ffff8800359c9980: 00 00 00 00 00 00 00 00 00 00 00 00 00 00[03]fb
  ffff8800359c9a00: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  ffff8800359c9a80: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  ffff8800359c9b00: fa fa fa fa fa fa fa fa 00 00 00 00 00 00 00 00
  ffff8800359c9b80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  ffff8800359c9c00: 00 00 00 00 00 00 00 00 fa fa fa fa fa fa fa fa
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07
  Heap redzone:          fa
  Heap kmalloc redzone:  fb
  Freed heap region:     fd
  Shadow gap:            fe

The out-of-bounds access happens on 'parser->buffer[parser->idx] = 0;'

Although the crash happened in ftrace_regex_open() the real bug
occurred in trace_get_user() where there's an incrementation to
parser->idx without a check against the size. The way it is triggered
is if userspace sends in 128 characters (EVENT_BUF_SIZE + 1), the loop
that reads the last character stores it and then breaks out because
there is no more characters. Then the last character is read to determine
what to do next, and the index is incremented without checking size.

Then the caller of trace_get_user() usually nulls out the last character
with a zero, but since the index is equal to the size, it writes a nul
character after the allocated space, which can corrupt memory.

Luckily, only root user has write access to this file.

Link: http://lkml.kernel.org/r/20131009222323.04fd1a0d@gandalf.local.home

Reported-by: Andrey Konovalov <andreyknvl@google.com>
Signed-off-by: Steven Rostedt <rostedt@goodmis.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
tracing/sched: add load balancer tracepoint

When doing performance analysis it can be useful to see exactly
what is going on with the load balancer - when it runs and why
exactly it may not be redistributing load.

This additional tracepoint will show the idle context of the
load balance operation (idle, not idle, newly idle), various
values from the load balancing operation, the final result,
and the new balance interval.

Change-Id: I9e5c97ae3878bea44e60d189ff3cec2275f2c75e
Signed-off-by: Steve Muckle <smuckle@codeaurora.org>
sched: Fix clear NOHZ_BALANCE_KICK

I have faced a sequence where the Idle Load Balance was sometime not
triggered for a while on my platform, in the following scenario:

 CPU 0 and CPU 1 are running tasks and CPU 2 is idle

 CPU 1 kicks the Idle Load Balance
 CPU 1 selects CPU 2 as the new Idle Load Balancer
 CPU 2 sets NOHZ_BALANCE_KICK for CPU 2
 CPU 2 sends a reschedule IPI to CPU 2

 While CPU 3 wakes up, CPU 0 or CPU 1 migrates a waking up task A on CPU 2

 CPU 2 finally wakes up, runs task A and discards the Idle Load Balance
       task A quickly goes back to sleep (before a tick occurs on CPU 2)
 CPU 2 goes back to idle with NOHZ_BALANCE_KICK set

Whenever CPU 2 will be selected as the ILB, no reschedule IPI will be sent
because NOHZ_BALANCE_KICK is already set and no Idle Load Balance will be
performed.

We must wait for the sched softirq to be raised on CPU 2 thanks to another
part the kernel to come back to clear NOHZ_BALANCE_KICK.

The proposed solution clears NOHZ_BALANCE_KICK in schedule_ipi if
we can't raise the sched_softirq for the Idle Load Balance.

Change since V1:

- move the clear of NOHZ_BALANCE_KICK in got_nohz_idle_kick if the ILB
  can't run on this CPU (as suggested by Peter)

Signed-off-by: Vincent Guittot <vincent.guittot@linaro.org>
Signed-off-by: Peter Zijlstra <peterz@infradead.org>
Link: http://lkml.kernel.org/r/1370419991-13870-1-git-send-email-vincent.guittot@linaro.org
Signed-off-by: Ingo Molnar <mingo@kernel.org>
Git-commit: 873b4c65b519fd769940eb281f77848227d4e5c1
Git-repo: git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
[smuckle@codeaurora.org: minor merge resolution for 3.4 in scheduler_ipi()]
Signed-off-by: Steve Muckle <smuckle@codeaurora.org>
Change-Id: I3548612057cccc2ecc29429c129c44183083831f
slub: tid must be retrieved from the percpu area of the current processor

As Steven Rostedt has pointer out: rescheduling could occur on a
different processor after the determination of the per cpu pointer and
before the tid is retrieved. This could result in allocation from the
wrong node in slab_alloc().

The effect is much more severe in slab_free() where we could free to the
freelist of the wrong page.

The window for something like that occurring is pretty small but it is
possible.

Change-Id: I9e658e97ed2096f658d6e67739764a86151f13e3
Signed-off-by: Christoph Lameter <cl@linux.com>
Signed-off-by: Pekka Enberg <penberg@kernel.org>
Git-commit: 7cccd80b4397699902aced1ad3d692d384aaab77
Git-repo: git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
Signed-off-by: Matt Wagantall <mattw@codeaurora.org>
mm: panic on the first bad page table entry access

Sometimes having a number of bad page table entries precipitates in
a crash much later. Because of this, we do not have any context for
the point at which the first bad pte entry was encountered. Hence,
panic on first such instance to help gather context for debug.

Change-Id: Idddf2b977214eb1463d08e16630e98264b9af487
Signed-off-by: Pushkar Joshi <pushkarj@codeaurora.org>
debug-pagealloc: Panic on pagealloc corruption

Currently, we just print the pagealloc corruption warnings and
proceed. Sometimes, we are getting multiple errors printed down
the line. It will be good to get the device state as early as
possible when we get the first pagealloc error.

Change-Id: I79155ac8a039b30a3a98d5dd1384d3923082712f
Signed-off-by: Subbaraman Narayanamurthy <subbaram@codeaurora.org>