msm: sps: Add integer wrap check for debugfs buffer

When converting debugfs buffer size to kilobytes value
there is a possible integer overflow and it may result
into negative value.

Fix the issue by adding integer wrap check for buffer
size just before conversion.

CRs-fixed: 564177
Change-Id: If4615561ea6a1c58e8be8c1b72f7881c068d8520
Signed-off-by: Dipen Parmar <dipenp@codeaurora.org>
Signed-off-by: franciscofranco <franciscofranco.1990@gmail.com>
netfilter: x_tables: fix ordering of jumpstack allocation and table update

During kernel stability testing on an SMP ARMv7 system, Yalin Wang
reported the following panic from the netfilter code:

  1fe0: 0000001c 5e2d3b10 4007e779 4009e110 60000010 00000032 ff565656 ff545454
  [<c06c48dc>] (ipt_do_table+0x448/0x584) from [<c0655ef0>] (nf_iterate+0x48/0x7c)
  [<c0655ef0>] (nf_iterate+0x48/0x7c) from [<c0655f7c>] (nf_hook_slow+0x58/0x104)
  [<c0655f7c>] (nf_hook_slow+0x58/0x104) from [<c0683bbc>] (ip_local_deliver+0x88/0xa8)
  [<c0683bbc>] (ip_local_deliver+0x88/0xa8) from [<c0683718>] (ip_rcv_finish+0x418/0x43c)
  [<c0683718>] (ip_rcv_finish+0x418/0x43c) from [<c062b1c4>] (__netif_receive_skb+0x4cc/0x598)
  [<c062b1c4>] (__netif_receive_skb+0x4cc/0x598) from [<c062b314>] (process_backlog+0x84/0x158)
  [<c062b314>] (process_backlog+0x84/0x158) from [<c062de84>] (net_rx_action+0x70/0x1dc)
  [<c062de84>] (net_rx_action+0x70/0x1dc) from [<c0088230>] (__do_softirq+0x11c/0x27c)
  [<c0088230>] (__do_softirq+0x11c/0x27c) from [<c008857c>] (do_softirq+0x44/0x50)
  [<c008857c>] (do_softirq+0x44/0x50) from [<c0088614>] (local_bh_enable_ip+0x8c/0xd0)
  [<c0088614>] (local_bh_enable_ip+0x8c/0xd0) from [<c06b0330>] (inet_stream_connect+0x164/0x298)
  [<c06b0330>] (inet_stream_connect+0x164/0x298) from [<c061d68c>] (sys_connect+0x88/0xc8)
  [<c061d68c>] (sys_connect+0x88/0xc8) from [<c000e340>] (ret_fast_syscall+0x0/0x30)
  Code: 2a000021 e59d2028 e59de01c e59f011c (e7824103)
  ---[ end trace da227214a82491bd ]---
  Kernel panic - not syncing: Fatal exception in interrupt

This comes about because CPU1 is executing xt_replace_table in response
to a setsockopt syscall, resulting in:

	ret = xt_jumpstack_alloc(newinfo);
		--> newinfo->jumpstack = kzalloc(size, GFP_KERNEL);

	[...]

	table->private = newinfo;
	newinfo->initial_entries = private->initial_entries;

Meanwhile, CPU0 is handling the network receive path and ends up in
ipt_do_table, resulting in:

	private = table->private;

	[...]

	jumpstack  = (struct ipt_entry **)private->jumpstack[cpu];

On weakly ordered memory architectures, the writes to table->private
and newinfo->jumpstack from CPU1 can be observed out of order by CPU0.
Furthermore, on architectures which don't respect ordering of address
dependencies (i.e. Alpha), the reads from CPU0 can also be re-ordered.

This patch adds an smp_wmb() before the assignment to table->private
(which is essentially publishing newinfo) to ensure that all writes to
newinfo will be observed before plugging it into the table structure.
A dependent-read barrier is also added on the consumer sides, to ensure
the same ordering requirements are also respected there.

Change-Id: Ia320d52510d7184c0f13d7f130102dbe685e8d6f
Cc: Paul E. McKenney <paulmck@linux.vnet.ibm.com>
Reported-by: Wang, Yalin <Yalin.Wang@sonymobile.com>
Tested-by: Wang, Yalin <Yalin.Wang@sonymobile.com>
Signed-off-by: Will Deacon <will.deacon@arm.com>
Acked-by: Eric Dumazet <edumazet@google.com>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Git-commit: b416c144f46af1a30ddfa4e4319a8f077381ad63
Git-repo: git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
Signed-off-by: Osvaldo Banuelos <osvaldob@codeaurora.org>
Signed-off-by: franciscofranco <franciscofranco.1990@gmail.com>
crypto: msm: multiple qce50 support

In some platforms such as fsm9900, multiple instances of qce50 hw
may be supported.  Each qce50 HW has an ndp-bam. Each qce50 HW
can support multiple instances of qce_dev platform device.
Each qce_dev has its own configured pipe set and associated qce50 HW,
defined by crypto-base and bam-pipe-pair fields in the device tree files.
This patch based on io address, it decides to create a new qce50 hw
instance or use the existing known instance at device probe time.

Furthermore, this patch does iomap for only once for each HW BAM instance
to avoid issue with bam driver. If modprobe, and rmmod of qcedev,
and qcrypto are not in first in last out order, kernel may crash in
bam driver in the last rmmod.
This saves virtual space for IO if multiple instances of qcedev
share the same instance of HW BAM.

Change-Id: I1565b1976981b0512832ff793e0adb29c4be3ccc
Acked-by: Chemin Hsieh <cheminh@qti.qualcomm.com>
Signed-off-by: Rohit Vaswani <rvaswani@codeaurora.org>
Signed-off-by: Zhen Kong <zkong@codeaurora.org>
Signed-off-by: franciscofranco <franciscofranco.1990@gmail.com>
crypto: Fix memory leak in bam_release call

Release pmab memory when an error occurs as well.

Change-Id: I7aa13d5a03edbdfa806345039459feaeac6e7a11
Signed-off-by: Mona Hossain <mhossain@codeaurora.org>
Signed-off-by: Zhen Kong <zkong@codeaurora.org>
Signed-off-by: franciscofranco <franciscofranco.1990@gmail.com>
crypto: msm: Fix issues related to non-zero byteoffset input

Fix buffer overflow for a non-zero byteoffset value.

Also fixes memory leak issue by adding data_len check in check_params.
One of the scenarios data_len can be less than byteoffset which results
in memory leak with huge data length, which might cause the kernel panic.

Change-Id: I3f773673219f45dad4f17499b1ee0feda2aff1f7
Signed-off-by: AnilKumar Chimata <anilc@codeaurora.org>
Signed-off-by: franciscofranco <franciscofranco.1990@gmail.com>
crypto: msm: Remove invalid check in qcedev driver

Unsigned int variable is compared for < 0, which is an invalid if
condition. This patch removes the check.

Change-Id: I76c10223672db2c387e025697dd8bd921e5ddc1b
Signed-off-by: AnilKumar Chimata <anilc@codeaurora.org>
Signed-off-by: franciscofranco <franciscofranco.1990@gmail.com>
crypto: msm: qce50 ota crypto support

Kasumi/snow-3g f8/f9 are defined by 3gpp, as the algorithms for
UMTS, and LTE for over the air ciphering and integrity. The
algorithms are supported by crypto 5 hardware. This patch
enables qce50 driver to provide Kasumi/snow-3g f8/f9
ciphering and integrity services.

Acked-by: hemin Hsieh <cheminh@qti.qualcomm.com>
Signed-off-by: Rohit Vaswani <rvaswani@codeaurora.org>
Signed-off-by: Zhen Kong <zkong@codeaurora.org>
Signed-off-by: franciscofranco <franciscofranco.1990@gmail.com>
crypto: msm: Handle error case

Release memory and disable clk when sps_init fails.

Signed-off-by: Mona Hossain <mhossain@codeaurora.org>
Signed-off-by: Zhen Kong <zkong@codeaurora.org>
Signed-off-by: franciscofranco <franciscofranco.1990@gmail.com>
msm: kgsl: The memory entry pending flag should be guarded

Guard the memory entry free pending flag with the process
private lock. This usage of this flag is guarded everywhere
else in the code with the same lock.

Change-Id: Iac27f08876bfe8ff6205edc8233b9c27c6e9a599
Signed-off-by: Shubhraprakash Das <sadas@codeaurora.org>
Signed-off-by: franciscofranco <franciscofranco.1990@gmail.com>
msm: kgsl: Changing to kref_get_unless_zero for process refcount

Do not allow anything to get a refcount to the process_private
structure if its refcount has gone down to 0.

Change-Id: I7cd6f731286aebfc84c288284599b47f666dcd47
Signed-off-by: Shrenuj Bansal <shrenujb@codeaurora.org>
Signed-off-by: franciscofranco <franciscofranco.1990@gmail.com>
kmemleak: Replace list_for_each_continue_rcu with new interface

This patch replaces list_for_each_continue_rcu() with
list_for_each_entry_continue_rcu() to save a few lines
of code and allow removing list_for_each_continue_rcu().

Signed-off-by: Michael Wang <wangyun@linux.vnet.ibm.com>
Acked-by: Catalin Marinas <catalin.marinas@arm.com>
Signed-off-by: Paul E. McKenney <paulmck@linux.vnet.ibm.com>
Reviewed-by: Josh Triplett <josh@joshtriplett.org>
Signed-off-by: franciscofranco <franciscofranco.1990@gmail.com>
kmemleak: use rbtree instead of prio tree

kmemleak uses a tree where each node represents an allocated memory object
in order to quickly find out what object a given address is part of.
However, the objects don't overlap, so rbtrees are a better choice than
prio tree for this use.  They are both faster and have lower memory
overhead.

Tested by booting a kernel with kmemleak enabled, loading the
kmemleak_test module, and looking for the expected messages.

Signed-off-by: Michel Lespinasse <walken@google.com>
Cc: Rik van Riel <riel@redhat.com>
Cc: Hillf Danton <dhillf@gmail.com>
Cc: Peter Zijlstra <a.p.zijlstra@chello.nl>
Cc: Andrea Arcangeli <aarcange@redhat.com>
Cc: David Woodhouse <dwmw2@infradead.org>
Acked-by: Catalin Marinas <catalin.marinas@arm.com>
Tested-by: Catalin Marinas <catalin.marinas@arm.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: franciscofranco <franciscofranco.1990@gmail.com>
mm/kmemleak.c: remove obsolete simple_strtoul

Replace the obsolete simple_strtoul() with kstrtoul().

Signed-off-by: Abhijit Pawar <abhi.c.pawar@gmail.com>
Cc: Catalin Marinas <catalin.marinas@arm.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: franciscofranco <franciscofranco.1990@gmail.com>
Revert "msm: mdss: Use interruptible threads"

This reverts commit b3016176e5e36c4f0456dd22a5599b4b1c47e709.
msm: Fix high load average from uninterruptible waits

 * The load average on all MSMs is currently hovering at around 14
   due to uninterruptible waits in various places.
 * Convert these waits to interruptible waits to bring the load
   back down to zero at idle.

Change-Id: I14bad4af135b1594e235e2252cb484cb34d91054
Signed-off-by: franciscofranco <franciscofranco.1990@gmail.com>
msm: mdss: On sharing dma pipe increment pipe ref_cnt

When DMA pipe is being shared and if mdss_mdp_pipe_map is called,
there could be a race condition when the pipe being shared
is unmapped, will lead to map failure as map is used for operations
on pipe which are already having positive ref_cnt.
This can result in potential map failure and attempt to free of
unmapped pipe resulting in crash.

Hence in this scenario of shared pipe usage atomic_inc should
be used instead of mdss_mdp_pipe_map.

CRs-Fixed: 590736
Change-Id: Ibaba20ac96662b5cd8aba3585f10d9cfe6e72d22
Signed-off-by: Justin Philip <jphili@codeaurora.org>
Signed-off-by: franciscofranco <franciscofranco.1990@gmail.com>
Revert "mdss: use a nonthreaded interrupt"

This reverts commit 0a1f6b2fc7ab80b8d0daf1ed77779c2d2b62e414.

Signed-off-by: franciscofranco <franciscofranco.1990@gmail.com>
mm: fix anon vma naming

Fix two bugs caused by merging anon vma_naming, a typo in
mempolicy.c and a bad merge in sys.c.

Change-Id: Ia4ced447d50573e68195e95ea2f2b4d9456b8a90
Signed-off-by: Colin Cross <ccross@android.com>
Signed-off-by: franciscofranco <franciscofranco.1990@gmail.com>
gpu: ion: system_heap: add support for 2MB allocations

Enable 2MB (order 9) allocations from the system heap. This improves the
performance of some heavyweight use cases. The benefit is especially
large for use cases where the buffer is mapped into an IOMMU since we
can leverage the 2MB IOMMU page table mappings.

Change-Id: I869733089b9ccba8090bbca80aac7b5f248b335e
Signed-off-by: Mitchel Humpherys <mitchelh@codeaurora.org>
Signed-off-by: franciscofranco <franciscofranco.1990@gmail.com>
ion: use iounmap instead of __arm_iounmap

The API iounmap() is more generic and portable
than __arm_iounmap().

Change-Id: If9601e9266bec56442686d3f2bdb1d475cd7bead
Signed-off-by: Larry Bassel <lbassel@codeaurora.org>
Signed-off-by: franciscofranco <franciscofranco.1990@gmail.com>