mm: prevent MIGRATE_ISOLATE pages entering other free lists

It is observed that, during a CMA allocation,
test_pages_isolated() fails sometimes.
In low memory situations, this results in continuous
failures of CMA allocations.
When testing for isolation, test_pages_isolated finds
that some pages are allocated, which were available on
pcp list when start_isolate_page_range marked the
pageblock as MIGRATE_ISOLATE. These pages, though
marked as isolated in the respective pageblock, are
moved to non-isolate freelists while being drained.
This results in these pages being allocated from other
paths while a contig allocation is in progress. In
certain cases, these pages get allocated from the
migrate_pages() of current alloc_contig_range() itself.

In the function free_pcppages_bulk(), when a page is
moved to buddy, the migrate list is picked based on
page_private. In the case of CMA pages, which were on
pcp list during start_isolate_page_range, page_private
will point to MIGRATE_CMA, and the pageblock migrate
type can be MIGRATE_ISOLATE. This results in these pages
being moved to cma freelist, rather than isolate freelist,
inside free_pcppages_bulk. This means they can get allocated.

If cma pages are never allowed to enter pcp lists, we
will not hit this issue. This is partly done by
free_hot_cold_page(), where we prevent cma pages
entering pcp. But cma pages can still get on pcp lists
through rmqueue_bulk. Preventing cma pages enter pcp
via rmqueue_bulk, can result in underutilization of
CMA pages for non-contiguous allocations, as rmqueue_bulk
is the frequent path for order 0 allocations.

CRs-fixed:720761
Change-Id: I01b12e6455c75519f1dce5d31467123cb1eb54b7
Signed-off-by: Vinayak Menon <vinmenon@codeaurora.org>
mmc: core: Fix unclocked access in get_xfer_remain/stop_request

The unclocked access could happen in the following scenario -

1. mmcqd thread is waiting for previously submitted io to be done
2. before this io is done, it is woken up due to is_urgent event
3. mmcqd thread is running and is processing the is_urgent event
4. Just about the same time the previously submitted io is done and
it sets is_done_rcv flag, tries to wake up mmcqd thread and release
host clock so as to gate the clocks.

If step 3 and 4 happen at the same time, then clocks will be gated off
before is_urgent is completely handled. Hence, make sure to hold the
clock before invoking get_xfer_remain and stop_request host->op.

Change-Id: If03177bf5e28cc217cc8e86b10d81d4adbab78b9
Signed-off-by: Sahitya Tummala <stummala@codeaurora.org>
qseecom: fix secure app loading failure by kernel mode qseecom client

Make a change to fix secure app loading failure due to premature
kzfree() from __qseecom_load_fw(), when kernel mode qseecom client
tries to load app.

CRs-fixed: 694541

Change-Id: I1ac39ee885c12e08e863d976321dda2380ace852
Signed-off-by: William Clark <wclark@codeaurora.org>
msm: mdp: Validate input arguments from user space

Fully verify the input arguments from user client are safe
to use.

Change-Id: Ie14332443b187951009c63ebfb78456dcd9ba60f
Signed-off-by: Raghavendra Ambadas <rambad@codeaurora.org>
USB: gadget: f_rndis: Add check before queuing notification available

There is a chance that rndis_response_available() and unbind() race each
other due to which request's buffer might have freed and could cause
accessing freed buffer pointer. Hence add check before accessing buffer
pointer of USB request for interrupt endpoint.

CRs-fixed: 731323
Change-Id: I2082e54cbdc28817651e75e8e8ed13d0ee61a6d5
Signed-off-by: Vijayavardhan Vennapusa <vvreddy@codeaurora.org>
net: sockev: Initial Commit

Added module which subscribes to socket notifier events. Notifier events
are then converted to a multicast netlink message for user space
applications to consume.

CRs-Fixed:  626021
Change-Id: Id5c6808d972b69f5f065d7fba9094e75c6ad0b2c
Signed-off-by: Harout Hedeshian <harouth@codeaurora.org>
net: socket: Added notifier chains for socket administrative functions

Allows other areas in the kernel to register notifier callbacks which
get invoked whenever something performs an administrative action on a
socket. This patch adds hooks in socket(), bind(), listen(), accept(),
shutdown().

CRs-Fixed:  626021
Change-Id: I4ae99cb2206d7c4eddba69757335c18d10143045
Signed-off-by: Harout Hedeshian <harouth@codeaurora.org>
netlink: Queue the kernel socket after setting the flag

Queueing the socket after setting the NETLINK_KERNEL_SOCKET on the
kernel socket.

This change is required in-order to avoid the BUG check which is
caused due to race condition between setting this flag and a
message from the app space for this kernel netlink sock.

Change-Id: I19a8edf2fe009a3020b194684a6172654f8f257a
CRs-Fixed: 681815
Signed-off-by: Vinay Krishna Eranna <veran@codeaurora.org>
v4l2: vb2: replace VIDEO_MAX_FRAME with VB2_MAX_FRAME

- vb2 drivers to rely on VB2_MAX_FRAME.

- VB2_MAX_FRAME bumps the value to 64 from current 32

Change-Id: I3d7998898df43553486166c44b54524aac449deb
Signed-off-by: Balamurugan Alagarsamy <balaga@codeaurora.org>
msm: vidc: Increase max buffers to VB2_MAX_FRAME (i.e. 64)

It's an arbitrary limit anyway.  Increase it to satisfy some clients
that'd like more buffers.

Change-Id: Ia1e0afd09089b6303b6590de804ea509b01626f4
Signed-off-by: Deva Ramasubramanian <dramasub@codeaurora.org>
Signed-off-by: Balamurugan Alagarsamy <balaga@codeaurora.org>

Conflicts:
	drivers/media/platform/msm/vidc/msm_vdec.c
msm: vidc: remove fw version condition for core capabilities

Different core capabilities are supported from fw version
1.4 onwards, so removing fw version condition from driver.

Change-Id: If618dbe51982f044e67b435bedf4d25f14f96110
Signed-off-by: Pushkaraj Patil <ppatil@codeaurora.org>
[PATCH] netlink: add signed types

Signed types might be needed in NL communication from time to time
(I need s32 in team driver), so add them.

Change-Id: Icc6c8286a1d55313fcc7993d8b02267fe1ef2bdc
CRs-Fixed: 677858
Signed-off-by: Jiri Pirko <jiri@resnulli.us>
Signed-off-by: David S. Miller <davem@davemloft.net>
alarmtimer: add rtc irq support for alarm

Add the rtc irq support for alarmtimer to wakeup the
alarm during system suspend.

Change-Id: I41b774ed4e788359321e1c6a564551cc9cd40c8e
Signed-off-by: Xiaocheng Li <lix@codeaurora.org>
alarmtimer: return EINVAL instead of ENOTSUPP if rtcdev doesn't exist

commit 98d6f4dd84a134d942827584a3c5f67ffd8ec35f upstream.

Fedora Ruby maintainer reported latest Ruby doesn't work on Fedora Rawhide
on ARM. (http://bugs.ruby-lang.org/issues/9008)

Because of, commit 1c6b39ad3f (alarmtimers: Return -ENOTSUPP if no
RTC device is present) intruduced to return ENOTSUPP when
clock_get{time,res} can't find a RTC device. However this is incorrect.

First, ENOTSUPP isn't exported to userland (ENOTSUP or EOPNOTSUP are the
closest userland equivlents).

Second, Posix and Linux man pages agree that clock_gettime and
clock_getres should return EINVAL if clk_id argument is invalid.
While the arugment that the clockid is valid, but just not supported
on this hardware could be made, this is just a technicality that
doesn't help userspace applicaitons, and only complicates error
handling.

Thus, this patch changes the code to use EINVAL.

Cc: Thomas Gleixner <tglx@linutronix.de>
Cc: Frederic Weisbecker <fweisbec@gmail.com>
Reported-by: Vit Ondruch <v.ondruch@tiscali.cz>
Signed-off-by: KOSAKI Motohiro <kosaki.motohiro@jp.fujitsu.com>
[jstultz: Tweaks to commit message to include full rational]
Signed-off-by: John Stultz <john.stultz@linaro.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
rtc: alarm: set power_on_alarm again when calling alarmtimer_resume

The power_on alarm might be replaced or cleared during alarm
suspend and resume process.So restore the power_on alarm into RTC
during alarm resume.

Change-Id: I1eefb082f9dfbd78517f3da1cc60a989853555fd
Signed-off-by: Mao Jinlong <c_jmao@codeaurora.org>
wcnss: Reset IRIS card before Starting IRIS XO configuration

Set iris_reset bit of PMU CFG register to reset the IRIS
card before Starting IRIS XO configuration.

Change-Id: Id1cfd7e3e3df29919089725b2233c6f95afbbfb5
CRs-Fixed: 664642
Signed-off-by: Hardik Kantilal Patel <hkpatel@codeaurora.org>
msm: vidc: fix failure to set LTR with index value

When MARKLTR/USELTR was set with a index value the value never
propagated to firmware resulting in failure to set the property.

Change-Id: I37536e1662c2d1092477fddde6838d4239805ac5
Signed-off-by: Ashray Kulkarni <ashrayk@codeaurora.org>
msm: vidc: Advertise extradata size in queue_setup()

If extradata is enabled, the correct size must be advertised as part of
queue_setup().  Prior to this commit, the output buffer size was taken
to be the extradata size.

In order to make sure that we aren't advertising stale buffer sizes,
query the core for both CAPTURE and OUTPUT planes.

Change-Id: I300e0e1d852caab208fd4cfc6df7cf3152f52431
Signed-off-by: Pushkaraj Patil <ppatil@codeaurora.org>
msm: vidc: Add NULL pointer check before deiniting controls

Add NULL pointer check in deinit function, and return -EINVAL
when NULL pointer is found.
Without this change, accidentally, msm_venc_ctrl_deinit() will be called
with a null pointer parameter, which will cause kernel panic.

Change-Id: I80bb6c271dcd3277ddce5332c5f42328ca376128
CRs-Fixed: 652365
Signed-off-by: huiy <huiyQuic@codeaurora.org>
msm: vidc: Bug fix in instance clean-up

When close is called directly without proper state operations,
then driver tries to clean all V4L2 framework memory. When driver
calls queue_release, it tries to call stream_off again. This
causes driver to re-enter the state operations. This change
prevents driver to re-enter the state diagram.

Change-Id: I6df248792fca78fe743bead311fa1cec61a6bb79
Signed-off-by: Praneeth Paladugu <ppaladug@codeaurora.org>