msm_bam_rmnet: Fix packet corruption due to QoS

Remove the QoS header added at the beginning of the
SKB (If QoS is enabled) in case of a failure to send
a packet to bam_dmux in order to avoid a possible loop
that adds QoS headers on each failure which will cause
a packet corruption.

CRs-Fixed: 599456
Change-Id: I5cda4db1f49638b37998d2502ff07b1e82518db1
Acked-by: David Arinzon <darinzon@qti.qualcomm.com>
Signed-off-by: Subash Abhinov Kasiviswanathan <subashab@codeaurora.org>
msm_bam_rmnet: Fix potential memory corruption

Usage of legacy string manipulation function sprintf could lead to
memory corruption as the number of bytes to be written to the
destination is not bounded. Replace sprintf with snprintf where the
number of bytes to be written is explicitly specified.

CRs-fixed: 672202
Change-Id: Iab7516ad0e2540eb619fe96e26a3516c7adf86cc
Signed-off-by: Subash Abhinov Kasiviswanathan <subashab@codeaurora.org>
net: flow_dissector: fail on evil iph->ihl

We don't validate iph->ihl which may lead a dead loop if we meet a IPIP
skb whose iph->ihl is zero. Fix this by failing immediately when iph->ihl
is evil (less than 5).

CRs-Fixed: 589913
Change-Id: Ifd7be75d153d7504704e7ff9d8f63fe3767326d2
Acked-by: David Arinzon <darinzon@qti.qualcomm.com>
Signed-off-by: Subash Abhinov Kasiviswanathan <subashab@codeaurora.org>
genalloc: Correct nbytes calculation on long boundary

In existing code we calculate nbytes based on the byte
boundary, but genalloc uses bitmap for maintaining the
memory allocation aligned to long. So while calculating
nbytes we end up getting wrong nbytes.
example: lets say nbytes comes to 9 bytes for 70 bits when
bytes aligned,but if long aligned we will have 3 long words
i.e 12 bytes. This difference may lead to choosing the
wrong api for freeing the memory i.e Between kfree() and
vfree().
Fix was inspired by an upstream commit
eedce141cd2dad8d0cefc5468ef41898949a7031, bringing same fix
into the gen_pool_detroy path.

Change-Id: I942caf59e25515c780896b328b912604df9e10bf
Signed-off-by: Hareesh Gundu <hareeshg@codeaurora.org>
Signed-off-by: Sunil Khatri <sunilkh@codeaurora.org>
TTY: msm_smd_tty: Fix simultaneous open/close race condition

smd_tty_close currently has a variable that depends on a race
condition with tty_port_open. This causes a null-pointer dereference
when the same port is simultaneously being opened/closed.

Use data from a static array instead of the variable to eliminate
the race condition.

CRs-Fixed: 624398
Change-Id: Ie55d37feaadd3a15f64e18501cd3af19145dbc8e
Signed-off-by: Steven Cahail <scahail@codeaurora.org>
freezer: replace msleep with usleep_delay for sleep time of <20mS

usleep_delay() works more accurately for sleep time of <20mS.
All tasks can easily be frozen in under 10 ms, switch to using
an initial 1 ms sleep followed by exponential backoff until 8 ms.

Change-Id: Id932d7dbefe9c59eded33aa87cdb3cb8b581efa2
Signed-off-by: Sravan Kumar Ambapuram <asravan@codeaurora.org>
ARM: smp: BUG() if smp_send_reschedule() is called for an offline cpu

Sending an IPI_RESCHEDULE to an offline CPU is incorrect and potentially
bad for both power and stability. On some sub-architectures such as MSM,
if a power-collapsed CPU is unexpectedly woken up by an IPI, it will be
begin executing without the preparations that would normally happen as
part of CPU_UP_PREPARE. If clocks, voltage regulators, or other hardware
configuration are not performed, the booting CPU may cause general
instability or (at best) poor power performance since the CPU would be
powered up but not utilized.

One common cause for such issues is misuse of add_timer_on() or APIs
such as queue_work_on() which call it. If proper precautions are not
taken to block hotplug while these APIs are called then a race may
result in IPIs being sent to CPUs that are already offline.

This same argument could be applied to other IPIs (with the exception
of IPI_WAKEUP), but the others are already restricted to only online
CPUs by existing mechanisms, so an explicit assertion is not useful.

Change-Id: I437db112e7e2fa7c0635e4e97e265692621944f1
Signed-off-by: Matt Wagantall <mattw@codeaurora.org>
msm: smd_tty: Fix client notification issue in suspend state

SMD_TTY driver holds a wakeup source for 500ms to provide enough time
to notify the user client waiting for data. However, when system is in
suspend state the 500ms timer may not be sufficient to notify the
user clients because in some cases system resume of devices and tasks
is taking more time and this causes delay in client notification.

Register for PM_SUSPEND_PREPARE and PM_POST_SUSPEND events to track
system suspend and resume state and then notify the clients after system
resume completes.

CRs-Fixed: 613589
Change-Id: Iffb2ecb1c58f46e0c4a745cdcce2fb717ea2ece8
Signed-off-by: Arun Kumar Neelakantam <aneela@codeaurora.org>
ion: Add missing unlock on error path

A mutex_unlock was missing for the alloc_lock on an error
path. Add it.

Change-Id: If88b72fbc2fd18504347b784d5daa2bc9170c55f
Signed-off-by: Laura Abbott <lauraa@codeaurora.org>
(cherry picked from commit 76d17e36bbb9f1a3acde26e02cfa4ee20903f4f5)
Fix sizeof-pointer-memaccess warning with gcc 4.8

This patch fixes wrong memcpy size when copying ltk value to
HCI_OP_LE_LTK_REPLY command.

Change-Id: I44e5e3da15369d4b424581720ccd3bac820ef2e0
msm: vidc: Add support for setting initial qp

Adds support to set initial qp, thereby allowing the client to set
initial qp for I,P, and B frames.

Change-Id: Ie956651bde85e800d97a0007769af9aec8ca16a4
Signed-off-by: Ashray Kulkarni <ashrayk@codeaurora.org>
msm: vidc: Amend calculation of buffer sizes in VENUS_BUFFER_SIZE

Add 8KB worth of padding for extradata. This is required to accommodate
some of the larger extradata types that didn't fit into the residual
space between the actual buffer size and its aligned size.

CRs-Fixed: 647378
Change-Id: I550f806079dfbdece229f68ffdfc5c0e20b3c9e1
Signed-off-by: Deva Ramasubramanian <dramasub@codeaurora.org>
msm: vidc: Expose extradata size to userspace

Previously, the extradata size was included within VENUS_BUFFER_SIZE
and callers (primarily in userspace) wouldn't know how much extra
padding was added to the buffer size. Exposing it allows userspace to
query directly instead of doing guesswork.

Change-Id: I7f9701a4adfe364d757028514bdd4fa84402a995
Signed-off-by: Deva Ramasubramanian <dramasub@codeaurora.org>
msm: vidc: Add AFD and CC metadata support to extradata

Add support and control for setting Active format
description and closed caption meta data in the
extradata. FW parses metadata and adds it to the
extradata. Client can use control to parse extradata
for the metadata information.

Change-Id: I79fb71e635927c95e0792862c9dea7d96f58e895
Signed-off-by: Jayasena Sangaraboina <jsanga@codeaurora.org>
msm: vidc: Add support for different errors

When hardware is overloaded or when max number of clients are
reached in driver or firmware, hardware error is sent to video
client. This change is to replace hardware error with actual
errors.

CRs-fixed: 575852
Change-Id: I07e599f894a3716a3dc4fed5eb7c987311f5bdde
Signed-off-by: Deepak Verma <dverma@codeaurora.org>
msm: vidc: Change in input buffer size calculation

Right now, input buffer size is calculated based on
maximum supported height and width returned from FW.
These values are not true representation as they are
calculated for rotation usecase. Driver needs to use
max MB supported from FW. This change fixes the same.

CRs-Fixed: 599818
Change-Id: I5b5f7d0db1088a4bc16ec7a32b31e1f763d5da7c
Signed-off-by: Manikanta Sivapala <msivap@codeaurora.org>
msm: vidc: add new control for limiting i/p buffer size

Take the minimum of the size calculated by driver using
max width and height supported and the size set by client
for input buffers. Change interface to get input and
output buffer sizes.

Change-Id: Ia3eb4cc7ae7bb38e2650fff1b694623e2aab62ef
Signed-off-by: Manikanta Sivapala <msivap@codeaurora.org>
Merge remote-tracking branch 'upstream/cm-12.0' into cm-12.0