defconfig: remove support for /dev/mem and /dev/kmem on perf builds

Keeping /dev/mem and /dev/kmem exposed to userspace allows userspace
to peek/poke to these areas and is a security risk. Remove support for
/dev/mem and /dev/kmem on perf builds.

Change-Id: Iad85b34039a67c5f8796adfd16543a94a1bc3054
CRs-Fixed: 530719
Signed-off-by: Sarang Joshi <spjoshi@codeaurora.org>
wcnss: Trigger WCNSS driver on first open.

WCNSS driver requires a trigger followed by an open, this is to support
the trigger from an external script. However, startup scripts are no
more supported; and wcnss service should always trigger this driver. So
the first open to this driver (that is from wcnss service), should also
trigger the driver.

Change-Id: I843c044d4fa452ca541a62255bbcb33b9d7f6eb0
CRs-fixed: 611763
Signed-off-by: Sameer Thalappil <sameert@codeaurora.org>
Signed-off-by: Hardik Kantilal Patel <hkpatel@codeaurora.org>
msm: Make CONFIG_STRICT_MEMORY_RWX even stricter

If CONFIG_STRICT_MEMORY_RWX was set, the first section (containing
the kernel page table and the initial code) and the section
containing the init code were both given RWX permission, which is
a potential security hole.

Pad the first section after the initial code (which will never
be executed when the MMU is on) to make the rest of the kernel
text start in the second section and make the first section RW.

Move some data which had ended up in the "init text"
section into the "init data" one, as this is RW, not RX.
Make the "init text" RX.

We will not free the section containing the "init text",
because if we do, the kernel will allocate memory for RW data there.

Change-Id: I6ca5f4e07342c374246f04a3fee18042fd47c33b
CRs-fixed: 513919
Signed-off-by: Larry Bassel <lbassel@codeaurora.org>
msm: qdsp6v2: Deleting kernel driver from arch/arm/mach-msm/qdsp6v2

Driver is registering under misc driver but exists under arch/arm/mach

Change-Id: I1c8cff14a48550d1089593b28de7023160184cf0
CRs-Fixed: 548017
Signed-off-by: Mohammad Johny Shaik <mjshai@codeaurora.org>
net: fib: fix incorrect call_rcu_bh()

After IP route cache removal, I believe rcu_bh() has very little use and
we should remove this RCU variant, since it adds some cycles in fast
path.
Anyway, the call_rcu_bh() use in fib_true is obviously wrong, since
some users only assert rcu_read_lock().

4619.617291:   <0> Internal error: Oops: 5 [#1] PREEMPT SMP ARM
114619.622541:   <4> Modules linked in: wlan(O) adsprpc [last unloaded: wlan]
114619.628980:   <4> CPU: 1    Tainted: G        W  O  (3.4.0-g366f2d7-00028-gde45140 #1)
114619.636427:   <4> PC is at leaf_walk_rcu+0x50/0x9c
114619.640761:   <4> LR is at fib_route_seq_next+0x58/0x7c
...[ Dmesg snip snip ]...
14620.187747:   <0> 5fe0: 405a3cd4 405a3ca0 007207ac 0071c098 80000010 00000012 00000000 00000000
114620.196018:   <4> [<c0720ec4>] (leaf_walk_rcu+0x50/0x9c) from [<c07210b0>] (fib_route_seq_next+0x58/0x7c)
114620.205114:   <4> [<c07210b0>] (fib_route_seq_next+0x58/0x7c) from [<c01642d8>] (seq_read+0x304/0x498)
114620.213964:   <4> [<c01642d8>] (seq_read+0x304/0x498) from [<c018daf8>] (proc_reg_read+0x80/0x98)
114620.222388:   <4> [<c018daf8>] (proc_reg_read+0x80/0x98) from [<c0147e90>] (vfs_read+0xa4/0x12c)
114620.230720:   <4> [<c0147e90>] (vfs_read+0xa4/0x12c) from [<c0147f4c>] (sys_read+0x34/0x68)
114620.238625:   <4> [<c0147f4c>] (sys_read+0x34/0x68) from [<c000e2e0>] (ret_fast_syscall+0x0/0x30)

CRs-Fixed: 614067

Change-Id: If493d4873de2ab5fa17e54b451871b4b3d469865
Signed-off-by: Eric Dumazet <edumazet@google.com>
Cc: "Paul E. McKenney" <paulmck@linux.vnet.ibm.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Git-commit: 0c03eca3d995e73d691edea8c787e25929ec156d
Git-repo: https://www.codeaurora.org/cgit/quic/la/kernel/msm-3.10
Signed-off-by: Vijaya Kumar T M <vtmuni@codeaurora.org>
WLAN subsystem: Sysctl support for key TCP/IP parameters

It has been observed that default values for some of key tcp/ip
parameters are affecting the tput/performance of the system. Hence
extending configuration capabilities to TCP/Ip stack through
sysctl interface.

Change-Id: I0c99d5b50cbe0d6496e40d391eacc12b0c62dbed
CRs-Fixed: 507581
Signed-off-by: Mahesh A Saptasagar <msapta@codeaurora.org>
wlan: SAP in 5Ghz is not working

Regulatory hints by user is ignored by nl80211 as wiphy->regd
is null and WIPHY_FLAG_STRICT_REGULATORY is set in wiphy->flag.

After wlan is loaded give regulatory hint from driver to
allocate wiphy->regd so that nl80211 will process hints given
by user.

CRs-fixed: 611125

Change-Id: I6608820bbe4c38dc357fd3a0aeb5320bb0b56094
wlan: wext.c buffer over read fix

vos_mem_copy may over read genIeBytes
use correct length to copy.

Change-Id: I8f5c47b210045385bb2a3c46cc87de4fb182a4ca
CRs-fixed: 611940
wlan: adding a new ini parameter to disable/enable AMSDU in AMPDU

This fix will give us a control on when to enable AMSDU support
and when to disable it. by default we are disabling AMSDU support.

Change-Id: Ibfcf5245f1dd0bf938dcc7819642c939c4013c2c
CRs-fixed: 539301
wlan: Check for WatchDog reset status during queue selection

Check for the WatchDog reset status during queue selection request,
If WD reset in progress, then return the Best Effort queue index.
Else derive queue index based on the current session parameter and
return.

This avoids any access to the internal data structure during
reset.

Change-Id: I3a5e0b3223153733fac19cd935364749f2fd1f94
CRs-Fixed: 609907
wlan: Reason code for scan abort.

Add a reason code for scan abort. Currently , this is required to
know if the abort is because of a band change. It can be enhanced
further to cater the requirements.

Change-Id: I641f36245d881b4f2cba70223f0abf90edd55b28
CRs-Fixed: 592516
wlan: Flush/filter temp scan results along with the main results

Flush the temp scan results along with main scan results in
csrScanFlushResult(). This is required to flush the results
completely , as the results are getting updated from temp list to
the main list only after completion of scan.
Filter the temp scan results based on valid channels list along
with the main scan results in csrScanFilterResults().

CRs-Fixed: 592516
Change-Id: Id0c66b9edbd513800418490d296749466a250ef1
wlan: flush scan results obtained from the 11d scans

11d scans are done when the driver is loaded to find
any BSS which is advertizing 11d IEs, 11d scans are
passive and we scan all the channels the device
supports irrespective of the regulatory domain
restrictions. Sometimes as part of 11d scans we
find APs on frequencies which are not supported
by the regulatory domain and if we notify such APs
to the supplicant, user may attempt to connect to
such APs. To avoid this situation we will flush all
the scan results cached by the SME after 11d scan.

Change-Id: Iae78d3bec3ddbce4ab0d23a31df0652b2f5013c7
CRs-Fixed: 604464
wlan: Filter the scan results in case of abort due to band change

The scan results need to be filterd based on the current band and
valid channel list in case of band change, to avoid the connection
with APs from non-selected band.  If there is any ongoing scan,
that scan can be aborted and the scan results needs to be filtered.

Set a flag in the scan command in csrScanAbortMacScan() if the
abort reason is eCSR_SCAN_ABORT_DUE_TO_BAND_CHANGE. Filter the
scan results after the scan completion, based on that flag.

CRs-Fixed: 592516
Change-Id: I6ee1f0359ab536fb1bfe5b32ee102d50f886ffd8
wlan: Do not process SIGNAL_POLL request if roaming is in progress

When framework issues signal_poll request to get the statistics of
the station, supplicant shall get blocked for a maximum period of
800 msec waiting for the response if the processing of the
corresponding command fails in the host driver. This time out is
configured by WLAN_WAIT_TIME_STATS.
It is observed that if the signal_poll command is issued when the
device is trying to roam, the host driver times out to get the
response and thus the supplicant is blocked for this duration.
This results in the failed security association (4-way handshake)
with the AP as the supplicant shall not receive any of the events
from the driver till it gets the response from the driver as part
of the signal_poll command.
Thus do not process signal_poll request in the host driver if the
device is in the roaming state.

Change-Id: I0bea7027fd2fc54ac188251082e14b0d84d877aa
CRs-Fixed: 593755
WLAN:Obtain WPA version from the supplicant connect params

Obtain WPA version from the 'cfg80211_crypto_settings'
structure which is available as part of connect params and
not to look into the IE's to identify the WPA version.

CRs-Fixed: 506135
Change-Id: I8d88065cd1bf8d4ea48bc5e0899c0d12c54c49c9
wlan:Retry ReassocReq only in FT_REASSOC_RSP_STATE

Currently upon the ReassocTimer expiry the
limAssocFailureTimerHandler checks and retries
the Reassoc request. But the ReassocRetryReq is
populated only in eLIM_MLM_WT_FT_REASSOC_RSP_STATE,
which is leading to crash due to lack of availablity
of retry context in another state
(eLIM_MLM_WT_REASSOC_RSP_STATE). Hence added the
approriate check in limAssocFailureTimerHandler
to retry reassoc when only in limstate
eLIM_MLM_WT_FT_REASSOC_RSP_STATE.

Change-Id: I62449d7e3f99781105d74c2f2042081a9673d4dc
CRs-Fixed: 608890
wlan: wrong bitwise operation in get interface mac addr

In wlan_hdd_get_intf_addr the bitwise operation to check for
unused mac address is not proper.

Add proper check to get the unused mac address.

Change-Id: Iafdf59750a68a4b7ab4b6b7e8de3f782d750990c
CRs-Fixed: 600550
Merge "msm: qdsp6v2: Deleting kernel driver from arch/arm/mach-msm/qdsp6v2"
Merge "Merge "wlan:Revision 3.2.7.39""