net: wireless: bcmdhd: Prevent recursive call of cfg80211_sched_scan_stopped()

Change-Id: I821313a69b2d2bb978917fc184bf9e095dd48c47
Signed-off-by: Dmitry Shmidt <dimitrysh@google.com>
net: wireless: bcmdhd: Enable full scan on PNO event

Change-Id: I21cfbd5fd88ab528a481b3a215a922ec656c681f
Signed-off-by: Dmitry Shmidt <dimitrysh@google.com>
net: wireless: bcmdhd: Update to version 1.88.11

- Fix potential memory leak in wl_android_iolist_resume for Miracast command
- Check return value for "buf_key_b4_m4"
- Add Platform custom LISTEN INTERVAL
- Parse all P2P IEs to check for attributes

Change-Id: I892cd2efee425e38e08fbbec666c9a666eebe0cb
Signed-off-by: Dmitry Shmidt <dimitrysh@google.com>

Conflicts:
	drivers/net/wireless/bcmdhd/dhd_common.c
	drivers/net/wireless/bcmdhd/dhd_linux.c
	drivers/net/wireless/bcmdhd/wl_android.c
	drivers/net/wireless/bcmdhd/wl_cfg80211.c
	drivers/net/wireless/bcmdhd/wl_cfg80211.h
	drivers/net/wireless/bcmdhd/wl_cfgp2p.h
gpu: ion: Fix bug in ion shrinker

The high variable was sometimes used uninitialized

Change-Id: I2f51413fd2d063fdff325047e824dc8c749d9e0a
Signed-off-by: Rebecca Schultz Zavin <rebecca@android.com>

Conflicts:
	drivers/gpu/ion/ion_page_pool.c
cpufreq: interactive: fix uninitialized spinlock

Add missing spinlock init

Backtrace:
[<c0011ce4>] (dump_backtrace+0x0/0x10c) from [<c0662a68>] (dump_stack+0x18/0x1c)
 r6:00000032 r5:c0bd09ec r4:e6848000 r3:00000000
[<c0662a50>] (dump_stack+0x0/0x1c) from [<c06670b0>] (spin_dump+0x80/0x94)
[<c0667030>] (spin_dump+0x0/0x94) from [<c06670f0>] (spin_bug+0x2c/0x30)
 r5:c08f91fc r4:c0bd09ec
[<c06670c4>] (spin_bug+0x0/0x30) from [<c0245f74>] (do_raw_spin_unlock+0x88/0xcc)
 r5:e547bac0 r4:c0bd09ec
[<c0245eec>] (do_raw_spin_unlock+0x0/0xcc) from [<c066c9cc>] (_raw_spin_unlock_irqrestore+0x14/0x40)
 r5:e547bac0 r4:60000013
[<c066c9b8>] (_raw_spin_unlock_irqrestore+0x0/0x40) from [<c044b884>] (store_above_hispeed_delay+0x6c/0x80)
 r4:c0b4cf78 r3:00000007
[<c044b818>] (store_above_hispeed_delay+0x0/0x80) from [<c0235d24>] (kobj_attr_store+0x1c/0x28)
 r7:e68ff000 r6:00000032 r5:e58137c0 r4:e61cde80
[<c0235d08>] (kobj_attr_store+0x0/0x28) from [<c0156b78>] (sysfs_write_file+0x104/0x184)
[<c0156a74>] (sysfs_write_file+0x0/0x184) from [<c0100680>] (vfs_write+0xb0/0x140)
[<c01005d0>] (vfs_write+0x0/0x140) from [<c0100900>] (sys_write+0x44/0x70)
 r8:00000000 r7:00000004 r6:00000032 r5:bee43c90 r4:e5600300
[<c01008bc>] (sys_write+0x0/0x70) from [<c000e400>] (ret_fast_syscall+0x0/0x30)
 r9:e6842000 r8:c000e584 r6:00000032 r5:bee43c90 r4:00000009

Change-Id: I80a1e0b3fecb24adba501ff44f568479deeff7fa
Signed-off-by: Minsung Kim <ms925.kim@samsung.com>
ARM: fault: assume no context when IRQs are disabled during data abort.

Bail out early if IRQs are disabled in do_page_fault or else
  [14415.157266] BUG: sleeping function called from invalid context at arch/arm/mm/fault.c:301

Russell King's idea from
  http://comments.gmane.org/gmane.linux.ports.arm.omap/59256

Signed-off-by: JP Abgrall <jpa@google.com>
lowmemorykiller: make default lowmemorykiller debug message useful

lowmemorykiller debug messages are inscrutable and mostly useful
for debugging the lowmemorykiller, not explaining why a process
was killed.  Make the messages more useful by prefixing them
with "lowmemorykiller: " and explaining in more readable terms
what was killed, who it was killed for, and why it was killed.

The messages now look like:
[   76.997631] lowmemorykiller: Killing 'droid.gallery3d' (2172), adj 1000,
[   76.997635]    to free 27436kB on behalf of 'kswapd0' (29) because
[   76.997638]    cache 122624kB is below limit 122880kB for oom_score_adj 1000
[   76.997641]    Free memory is -53356kB above reserved

A negative number for free memory above reserved means some of the
reserved memory has been used and is being regenerated by kswapd,
which is likely what called the shrinkers.

Change-Id: I1fe983381e73e124b90aa5d91cb66e55eaca390f
Signed-off-by: Colin Cross <ccross@android.com>
net: wireless: bcmdhd: Update to version 1.88.16

- Change the logic to enable Power save mode for STA or P2P GC
- Fix protxstatus bug for corner case
- Reset uninitialized value for mac entry
- Remove dhd_wlfc_init/deinit in wl_android.c
- Fix IBSS mode

Change-Id: I4589e87eda456798eae48548261a1f7cb9542660
Signed-off-by: Dmitry Shmidt <dimitrysh@google.com>

Conflicts:
	drivers/net/wireless/bcmdhd/dhd.h
	drivers/net/wireless/bcmdhd/dhd_cdc.c
	drivers/net/wireless/bcmdhd/dhd_sdio.c
	drivers/net/wireless/bcmdhd/wl_android.c
	drivers/net/wireless/bcmdhd/wl_cfg80211.c
	drivers/net/wireless/bcmdhd/wl_cfg80211.h
perf: Treat attr.config as u64 in perf_swevent_init()

Trinity discovered that we fail to check all 64 bits of
attr.config passed by user space, resulting to out-of-bounds
access of the perf_swevent_enabled array in
sw_perf_event_destroy().

Introduced in commit b0a873ebb ("perf: Register PMU
implementations").

Signed-off-by: Tommi Rantala <tt.rantala@gmail.com>
Cc: Peter Zijlstra <a.p.zijlstra@chello.nl>
Cc: davej@redhat.com
Cc: Paul Mackerras <paulus@samba.org>
Cc: Arnaldo Carvalho de Melo <acme@ghostprotocols.net>
Link: http://lkml.kernel.org/r/1365882554-30259-1-git-send-email-tt.rantala@gmail.com
Signed-off-by: Ingo Molnar <mingo@kernel.org>
mmc: Add tracepoints of mmc block operations

Add tracepoints to record the start and end of each mmc block
operation.  This includes read, write, erase, secure erase,
trim, secure trim1 and secure trim 2, discard and
sanitize commands.

Change-Id: Ic5d1cbdb9adb940d8b1a2a13c73970023575df50
Signed-off-by: Ken Sumrall <ksumrall@android.com>
net: wireless: bcmdhd: Close p2p0 device in wl_down

Change-Id: I9e8404badf55c0e7a54144d7b5f1c5d80aa0cb4b
Signed-off-by: Dmitry Shmidt <dimitrysh@google.com>

Conflicts:
	drivers/net/wireless/bcmdhd/wl_cfg80211.c
misc: uidstat: avoid create_stat() race and blockage.

* create_stat() race would lead to:
  [   58.132324] proc_dir_entry 'uid_stat/10061' already registered

* blocking kmalloc reported by sbranden
 tcp_read_sock()
  uid_stat_tcp_rcv()
    create_stat()
      kmalloc(GFP_KERNEL)

Signed-off-by: JP Abgrall <jpa@google.com>
net: wireless: bcmdhd: Update to version 1.88.21

- Remove DHCP_SCAN_SUPPRESS option
- Tune P2P parameters
- Add bcm4339 support

Change-Id: Ifc2906b3df6c17a7a8ea8e27f5f001fe3d9acd01
Signed-off-by: Dmitry Shmidt <dimitrysh@google.com>

Conflicts:
	drivers/net/wireless/bcmdhd/bcmsdh_sdmmc.c
	drivers/net/wireless/bcmdhd/dhd.h
	drivers/net/wireless/bcmdhd/dhd_cfg80211.c
	drivers/net/wireless/bcmdhd/dhd_linux.c
	drivers/net/wireless/bcmdhd/dhd_sdio.c
	drivers/net/wireless/bcmdhd/include/bcmdevs.h
	drivers/net/wireless/bcmdhd/include/linux_osl.h
	drivers/net/wireless/bcmdhd/include/linuxver.h
	drivers/net/wireless/bcmdhd/linux_osl.c
	drivers/net/wireless/bcmdhd/siutils.c
	drivers/net/wireless/bcmdhd/wl_cfg80211.c
	drivers/net/wireless/bcmdhd/wl_cfg80211.h
	drivers/net/wireless/bcmdhd/wl_iw.c
gpu: ion: Also shrink memory cached in the deferred free list

When the system is low on memory, we want to shrink any cached
system memory ion is holding.  Previously we were shrinking memory
in the page pools, but not in the deferred free list.  This patch
makes it possible to shrink both.  It also moves the shrinker
code into the heaps so they can correctly manage any caches they
might contain.

Change-Id: I177f587f999a5220eddbf7af94745aae736cac75
Signed-off-by: Rebecca Schultz Zavin <rebecca@android.com>

Conflicts:
	drivers/gpu/ion/ion.c
	drivers/gpu/ion/ion_heap.c
	drivers/gpu/ion/ion_priv.h
	drivers/gpu/ion/ion_system_heap.c
ashmem: avoid deadlock between read and mmap calls

Avoid holding ashmem_mutex across code that can page fault.  Page faults
grab the mmap_sem for the process, which are also held by mmap calls
prior to calling ashmem_mmap, which locks ashmem_mutex.  The reversed
order of locking between the two can deadlock.

The calls that can page fault are read() and the ASHMEM_SET_NAME and
ASHMEM_GET_NAME ioctls.  Move the code that accesses userspace pages
outside the ashmem_mutex.

Bug: 9261835
Change-Id: If1322e981d29c889a56cdc9dfcbc6df2729a45e9
Signed-off-by: Todd Poynor <toddpoynor@google.com>
cpufreq: interactive: handle errors from cpufreq_frequency_table_target

Add checks for error return from cpufreq_frequency_table_target, and be
less noisy on the existing call with an error check.  CPU hotplug and
system shutdown may cause this call to return -EINVAL.

Bug: 8613560
Change-Id: Id78d8829920462c0db1c7e14e717d91740d6cb44
Signed-off-by: Todd Poynor <toddpoynor@google.com>
cpufreq: interactive: reduce chance of zero time delta on load eval

Reschedule load sampling timer after timestamp of sample start taken,
hold spinlock across entire sequence to avoid preemption.  Avoid the
WARN for zero time delta in the load sampling timer function.

Change-Id: Idc10a756f09141decb6df92669521a1ebf0dbc10
Signed-off-by: Todd Poynor <toddpoynor@google.com>
cpufreq: interactive: avoid underflow on active time calculation

Check for idle time delta less than elapsed time delta, avoid
underflow computing active time.

Change-Id: I3e4c6ef1ad794eec49ed379c0c50fa727fd6ad28
Signed-off-by: Minsung Kim <ms925.kim@samsung.com>
alarmtimer: Use hrtimer per-alarm instead of per-base

Arve Hjønnevåg reported numerous crashes from the
"BUG_ON(timer->state != HRTIMER_STATE_CALLBACK)" check
in __run_hrtimer after it called alarmtimer_fired.

It ends up the alarmtimer code was not properly handling
possible failures of hrtimer_try_to_cancel, and because
these faulres occur when the underlying base hrtimer is
being run, this limits the ability to properly handle
modifications to any alarmtimers on that base.

Because much of the logic duplicates the hrtimer logic,
it seems that we might as well have a per-alarmtimer
hrtimer, and avoid the extra complextity of trying to
multiplex many alarmtimers off of one hrtimer.

Thus this patch moves the hrtimer to the alarm structure
and simplifies the management logic.

Change-Id: I54b2d718ed1d39598e321eacf88c3335284d4cea
Cc: Arve Hjønnevåg <arve@android.com>
Cc: Colin Cross <ccross@google.com>
Cc: Thomas Gleixner <tglx@linutronix.de>
Reported-by: Arve Hjønnevåg <arve@android.com>
Signed-off-by: John Stultz <john.stultz@linaro.org>
alarmtimer: add alarm_restart

Analogous to hrtimer_restart, restart an alarmtimer after the expires
time has already been updated (as with alarm_forward).

Change-Id: Ia2613bbb467404cb2c35c11efa772bc56294963a
Signed-off-by: Todd Poynor <toddpoynor@google.com>