netfilter: x_tables: fix ordering of jumpstack allocation and table update

During kernel stability testing on an SMP ARMv7 system, Yalin Wang
reported the following panic from the netfilter code:

  1fe0: 0000001c 5e2d3b10 4007e779 4009e110 60000010 00000032 ff565656 ff545454
  [<c06c48dc>] (ipt_do_table+0x448/0x584) from [<c0655ef0>] (nf_iterate+0x48/0x7c)
  [<c0655ef0>] (nf_iterate+0x48/0x7c) from [<c0655f7c>] (nf_hook_slow+0x58/0x104)
  [<c0655f7c>] (nf_hook_slow+0x58/0x104) from [<c0683bbc>] (ip_local_deliver+0x88/0xa8)
  [<c0683bbc>] (ip_local_deliver+0x88/0xa8) from [<c0683718>] (ip_rcv_finish+0x418/0x43c)
  [<c0683718>] (ip_rcv_finish+0x418/0x43c) from [<c062b1c4>] (__netif_receive_skb+0x4cc/0x598)
  [<c062b1c4>] (__netif_receive_skb+0x4cc/0x598) from [<c062b314>] (process_backlog+0x84/0x158)
  [<c062b314>] (process_backlog+0x84/0x158) from [<c062de84>] (net_rx_action+0x70/0x1dc)
  [<c062de84>] (net_rx_action+0x70/0x1dc) from [<c0088230>] (__do_softirq+0x11c/0x27c)
  [<c0088230>] (__do_softirq+0x11c/0x27c) from [<c008857c>] (do_softirq+0x44/0x50)
  [<c008857c>] (do_softirq+0x44/0x50) from [<c0088614>] (local_bh_enable_ip+0x8c/0xd0)
  [<c0088614>] (local_bh_enable_ip+0x8c/0xd0) from [<c06b0330>] (inet_stream_connect+0x164/0x298)
  [<c06b0330>] (inet_stream_connect+0x164/0x298) from [<c061d68c>] (sys_connect+0x88/0xc8)
  [<c061d68c>] (sys_connect+0x88/0xc8) from [<c000e340>] (ret_fast_syscall+0x0/0x30)
  Code: 2a000021 e59d2028 e59de01c e59f011c (e7824103)
  ---[ end trace da227214a82491bd ]---
  Kernel panic - not syncing: Fatal exception in interrupt

This comes about because CPU1 is executing xt_replace_table in response
to a setsockopt syscall, resulting in:

	ret = xt_jumpstack_alloc(newinfo);
		--> newinfo->jumpstack = kzalloc(size, GFP_KERNEL);

	[...]

	table->private = newinfo;
	newinfo->initial_entries = private->initial_entries;

Meanwhile, CPU0 is handling the network receive path and ends up in
ipt_do_table, resulting in:

	private = table->private;

	[...]

	jumpstack  = (struct ipt_entry **)private->jumpstack[cpu];

On weakly ordered memory architectures, the writes to table->private
and newinfo->jumpstack from CPU1 can be observed out of order by CPU0.
Furthermore, on architectures which don't respect ordering of address
dependencies (i.e. Alpha), the reads from CPU0 can also be re-ordered.

This patch adds an smp_wmb() before the assignment to table->private
(which is essentially publishing newinfo) to ensure that all writes to
newinfo will be observed before plugging it into the table structure.
A dependent-read barrier is also added on the consumer sides, to ensure
the same ordering requirements are also respected there.

CRs-Fixed: 591149

Change-Id: Ica3ec69cd6e2f77945a1a7303f92887feecf42e9
Cc: Paul E. McKenney <paulmck@linux.vnet.ibm.com>
Reported-by: Wang, Yalin <Yalin.Wang@sonymobile.com>
Tested-by: Wang, Yalin <Yalin.Wang@sonymobile.com>
Signed-off-by: Will Deacon <will.deacon@arm.com>
Acked-by: Eric Dumazet <edumazet@google.com>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Git-commit: b416c144f46af1a30ddfa4e4319a8f077381ad63
Git-repo: https://www.codeaurora.org/cgit/quic/la/kernel/msm/common/
Signed-off-by: Vijaya Kumar T M <vtmuni@codeaurora.org>
msm: camera: Make AXI stop/abort/reset and overflow recovery
mutually exclusive.

This would avoid potential problems when AXI bus is stopped when
recovery is in progress and vice versa.

Change-Id: I44ef2c4f7b54f81aef5be41293a5f70099307a13
CRs-Fixed: 561680,586602
Signed-off-by: Alok Kediya <kediya@codeaurora.org>
Revert "Update on Program TILE video frame size in dma ISR."

This reverts commit 88ac781cec1034301882099f1f11984b73831d92.

Change-Id: Idecc76ededc625d77ae3c8fd3f9e0da512b4848f
Signed-off-by: raghavendra ambadas <rambad@codeaurora.org>
Revert "msm_fb: display: update video tile framesize register"

This reverts commit 80f8dfbbbb20adde0fc0c164c19bd5ea50c2ddf1.

Change-Id: I1270e0296808a53e5a2559c19526cec67b5dbc33
Signed-off-by: raghavendra ambadas <rambad@codeaurora.org>
Revert "msm_fb: display: Program TILE video frame size in dma ISR"

This reverts commit 472d090f0b745f09d515b81961291971996b6fd3.

Change-Id: Ic38c8d634cec7200df58dcf108b4f37b4fe06f70
Signed-off-by: raghavendra ambadas <rambad@codeaurora.org>
Merge "netfilter: x_tables: fix ordering of jumpstack allocation and table update"
Merge "msm: camera: Make AXI stop/abort/reset and overflow recovery mutually exclusive."
Merge "Revert "Update on Program TILE video frame size in dma ISR.""
Merge "Revert "msm_fb: display: update video tile framesize register""
Merge "Revert "msm_fb: display: Program TILE video frame size in dma ISR""
Merge AU_LINUX_ANDROID_KK_2.7_RB1.04.04.01.007.025 on remote branch

Change-Id: I603257639c5c228eb6f25253ca1f48dd090490fb
Merge "Merge AU_LINUX_ANDROID_KK_2.7_RB1.04.04.01.007.025 on remote branch"
Merge AU_LINUX_ANDROID_KK_2.7_RB1.04.04.02.007.026 on remote branch

Change-Id: I8a89c27071c00f2fd415e9411517607482edfc36
Merge "Merge AU_LINUX_ANDROID_KK_2.7_RB1.04.04.02.007.026 on remote branch"
Merge AU_LINUX_ANDROID_KK_2.7_RB1.04.04.02.007.027 on remote branch

Change-Id: I7dacc0db8f0fcbd253ba7ea0cf35c8ea9e4a90d3
Merge "Merge AU_LINUX_ANDROID_KK_2.7_RB1.04.04.02.007.027 on remote branch"
Merge AU_LINUX_ANDROID_KK_2.7_RB1.04.04.02.007.028 on remote branch

Change-Id: Ie7de3497bf0ee756df71e821f95c646553bc2bc7
Merge "Merge AU_LINUX_ANDROID_KK_2.7_RB1.04.04.02.007.028 on remote branch"
diag: Reduce error message frequency

Some diag error messages are printed with high frequency. This
cause flooding of kernel logs. Rate limiting these messages will
help reading kernel logs.

Change-Id: I477ff2394116603a27d65948a60d3460c32572d1
CRs-fixed: 594186
Signed-off-by: Katish Paran <kparan@codeaurora.org>
Rotator getting stuck leading to fence timeout

Even though cancel_delayed_work should cancel the worker thread
in some race condition it can fail and get scheduled.
To avoid this situation use cancel_delayed_work_sync.
Also rotator_lock mutex need not be unlocked while waiting for isr
as isr does not aquire this mutex for doing its operations.
It is after this unlock of mutex sometimes in race condition rotator
clock is getting disabled via the msm_rotator_rot_clk_work_f

Change-Id: I574aec489fe51ec0e5f7c215c9aba9bb0ec66ffa
Signed-off-by: Justin Philip <jphili@codeaurora.org>