rmnet_smux: device state check condition removed

If SSR happens in high watermark hit case, then the high-watermark-hit
condition is not reset correctly which causes TX data stall after
recovered from SSR.

In the SSR case, SMUX sends disconnect event to clients. For this event,
the RMNET client changes the device state to INACTIVE which prevents
call to msm_smux_close() from smux_rmnet_remove().

Remove the device state check condtion to iopen and close the RMNET
logical channel during RMNET device probe and remove.

CRs-fixed: 465510
Change-Id: I4dded65d41af4415f2427da388a59de4a1980a29
Signed-off-by: Arun Kumar Neelakantam <aneela@codeaurora.org>
ARM: hw_breakpoint: enable HAVE_HW_BREAKPOINT feature flag

HAVE_HW_BREAKPOINT was disabled temporarily from commit
480a82f59712136b51ee5ca05c4f22c1738010c5. Issue not seen with the
latest kernel hence re-enable the feature and fix merge issue from
previous kernel upgrade.

Change-Id: Ia6e7e8282c848dd73108e4d951b3375bb7caa63c
CRs-Fixed: 460454
Signed-off-by: Jin Hong <jinh@codeaurora.org>
Signed-off-by: Taniya Das <tdas@codeaurora.org>
hrtimer: Don't reinitialize a cpu_base's lock on CPU_UP

The current code makes the assumption that a cpu_base lock cannot
be held if a CPU is offline, which is tragically wrong.

If a hrtimer is not queued, then it will not be migrated by
migrate_hrtimers() when a CPU is offlined. Therefore, the
hrtimer's cpu_base may still point to a CPU which has
subsequently gone offline if the timer wasn't enqueued at the
time the CPU went down.

Normally this wouldn't be a problem, but a cpu_base's lock is
blindly reinitialized each time a CPU is brought up. If a CPU is
brought online during the period that another thread is
performing a hrtimer operation on a stale hrtimer, then the lock
will be reinitialized under its feet, and a SPIN_BUG() like the
following will be observed:

 [  448.212369] BUG: spinlock already unlocked on CPU#3,
 swapper/3/0
[  448.217368]  lock: 0xc47b1a40, .magic: dead4ead, .owner:
swapper/3/0, .owner_cpu: -1
[  448.217398] [<c0014398>] (unwind_backtrace+0x0/0x120) from
[<c0269ab0>] (do_raw_spin_unlock+0x44/0xdc)
[  448.217419] [<c0269ab0>] (do_raw_spin_unlock+0x44/0xdc) from
[<c071bbb0>] (_raw_spin_unlock_irqrestore+0xc/0x38)
[  448.217438] [<c071bbb0>]
(_raw_spin_unlock_irqrestore+0xc/0x38) from [<c00aa498>]
(hrtimer_try_to_cancel+0xf8/0x10c)
[  448.217455] [<c00aa498>] (hrtimer_try_to_cancel+0xf8/0x10c)
from [<c00aa4bc>] (hrtimer_cancel+0x10/0x20)
[  448.217475] [<c00aa4bc>] (hrtimer_cancel+0x10/0x20) from
[<c00e6934>] (rcu_idle_exit_common+0x5c/0xe0)
[  448.217494] [<c00e6934>] (rcu_idle_exit_common+0x5c/0xe0) from
[<c00e6ae8>] (rcu_idle_exit+0x9c/0xb4)
[  448.217514] [<c00e6ae8>] (rcu_idle_exit+0x9c/0xb4) from
[<c000f2dc>] (cpu_idle+0x98/0xf0)
[  448.217529] [<c000f2dc>] (cpu_idle+0x98/0xf0) from
[<000081ac>] (0x81ac)

CRs-Fixed: 460670
Change-Id: I588f6a864054abe6d4c249aad815c6d2f5a54077
Signed-off-by: Michael Bohan <mbohan@codeaurora.org>
mm: Don't use CMA page for file cache

Despite the best efforts of redirection, the file system may still
allocate CMA pages with references held for long periods of time.
If a CMA page ends up being allocated, free it and get a non-CMA page.

Change-Id: I2001151a2936a6d0780d223dda85a87c04ddb8c6
Signed-off-by: Laura Abbott <lauraa@codeaurora.org>
Revert "The names to the functions that acquire and release a console lock have changed,"

This reverts commit 9bd177600a395e02ab76002a11c8d718ad3c70e2.
Squashed revert of sched updates
Revert "sched: change WARN_ON_ONCE to WARN_ON in try_to_wake_up_local()"

This reverts commit dc5e3417d48554d978fed8c42dedbb8951b0823e.

Revert "sched: Convert BUG_ON()s in try_to_wake_up_local() to WARN_ON_ONCE()s"

This reverts commit fe01958ae18ec6b68d5400cb8f799ef30326a195.

Revert "sched: Make sure to not re-read variables after validation"

This reverts commit 87f05c5080d1af2b099e398b231541d57d80e310.

Revert "sched: re-calculate a cpu's next_balance point upon sched domain changes"

This reverts commit 09897ebb81abf0f37fa4af3a554862e62a2a029f.

Revert "sched: remove migration notification from RT class"

This reverts commit ac2160c25750ca1b50a4c58f3e62b29254ea118e.

Revert "sched: provide per cpu-cgroup option to notify on migrations"

This reverts commit 8330f8a92411868d48288dfd17b8db00cd314ab8.

Revert "sched: fix reference to wrong cfs_rq"

This reverts commit 4a3e3313f2e33f03eca2fa2100be5dc424dcc4ac.

Revert "sched: Mark schedule_io_timeout() with EXPORT_SYMBOL"

This reverts commit 55aae7d86f06f0f7f4080aff850ca113b507c556.

Revert "sched: Fix SCHED_HRTICK bug leading to late preemption of tasks"

This reverts commit 4db31c714525e1a6fc87021e7d46f44863fb1bb7.

Revert "sched: Reset rq->next_interval before going idle"

This reverts commit d6607dcf8a863262bfc9aff3ffdc489c99df6e1d.

Revert "sched: fix rq->lock recursion"

This reverts commit 37a6ff0763f998cc99d8546491f140fa76c39c50.
Squashed revert of cpufreq updates
Revert "msm: cpufreq: Only apply driver limits for scaling_min/max_freq writes"

This reverts commit 64b7d1c9a139fde23d14beb3e3b4ddd7c5f78805.

Revert "cpufreq: Retain only online cpus in managed_policy->cpus"

This reverts commit 137125b03e1c834aed1e279fb380c23628ccbeff.

Revert "msm: cpufreq: Ensure cpufreq change happens on corresponding CPU"

This reverts commit 05df3e62dda27aaaf830a07670c5650e98c3e38c.

Revert "msm: cpufreq: Relax constraints on "msm-cpufreq" workqueue"

This reverts commit 4547c41d6b2e7f8397f1bc409594c18c8696d7f2.

Revert "msm: cpufreq: Configure WQ for higer priority"

This reverts commit f7c14128d7faedc123b6fd543c7c66d059b16f2d.

Revert "msm: cpufreq: Always update frequency limits when core is online"

This reverts commit dbceb337c206a6fdf3adfe95cb44002798416843.

Revert "msm: cpufreq: Initialize cpufreq driver early at boot"

This reverts commit 19ad5787f6e8f67490623feb5341a73b7ff12238.

Change-Id: I8460e0c8e63081b5732024f5c520b3c75fbb0550

Revert "cpufreq: ondemand: Fix hotplug deadlock with store_powersave_bias"

This reverts commit fa1b45cbd6a0699d9110089fc8438227ec7c0c85.

Revert "cpufreq: ondemand: Fix update_sampling_rate race with hotplug"

This reverts commit a5251782b5c27319bf2c06d0e58b88782edd2d78.

Revert "cpufreq: ondemand: Boost CPU frequency only for touch input"

This reverts commit 664814f7f15b0c256192f83c6ed88d515dc16cd3.

Revert "cpufreq: ondemand: Disable freq sync feature in store_powersave_bias"

This reverts commit 84239a14963c9bf6fccc3dcf0ecfba377e96cedd.

Revert "cpufreq: ondemand: change freq sync code to use per-CPU kthreads"

This reverts commit bdf9cc8ad4a6109fc6fa58db3914e33a184554cc.

Revert "cpufreq: ondemand: Fix locking in store_powersave_bias"

This reverts commit 14396126ebc385bd7f0a29326f7432cc2760d6f2.

Revert "cpufreq: ondemand: Fix store_powersave_bias() race with hotplug"

This reverts commit b06523f671184a29d22a87c73c1546a50692c3aa.

Revert "cpufreq: Use dedicated high-priority workqueues"

This reverts commit 21ff7fcd61d7673fabbce1be2ff09619d6f4d004.

Revert "msm: Synchronize CPU frequency on thread migration"

This reverts commit 7b0dc3844c9eb3dc9abfdcb2e6a3f68fc06fb577.

Revert "cpufreq: Fix optimal_freq logic on ramp down"

This reverts commit ac2c4705210d9b0810a178107265b879948489ae.

Revert "msm: cpufreq: make the gov stop part fully atomic"

This reverts commit 8c0a2219707fa9674f8c4855324a98bc74790225.

Revert "cpufreq: ondemand: Fix kernel warning in cpufreq_governor_dbs"

This reverts commit 54b1c3c967fd98f88b6f3100902e389fec05705c.

Revert "cpufreq: Avoid using smp_processor_id() in preemptible context"

This reverts commit 83c0eef3b502add99bd4a76c4231758afb293872.

Conflicts:
	arch/arm/mach-msm/cpufreq.c
cpufreq: ondemand: Fix kernel warning in cpufreq_governor_dbs

GOV_STOP event destroys the timer_mutex and is not initialized back
upon GOV_START event.
The Kernel complains at mutex_lock(during GOV_LIMITS event) after
mutex_destroy.

[<c0014918>] (unwind_backtrace+0x0/0x11c)
[<c007c004>] (warn_slowpath_common+0x4c/0x64)
[<c007c034>] (warn_slowpath_null+0x18/0x1c)
[<c079eef8>] (__mutex_lock_slowpath+0x130/0x3c4)
[<c079f1ac>] (mutex_lock+0x20/0x3c) from [<c0540900>]
[<c0540900>] (cpufreq_governor_dbs+0x3c8/0x468)
[<c053d500>] (__cpufreq_governor+0x90/0xe0)
[<c053d774>] (__cpufreq_set_policy+0x224/0x258)
[<c053da58>] (cpufreq_add_dev_interface+0x2b0/0x308)
[<c053e784>] (cpufreq_add_dev+0x500/0x56c)
[<c079247c>] (cpufreq_cpu_callback+0x88/0x9c)
[<c07a2ca8>] (notifier_call_chain+0x38/0x68)
[<c007ded0>] (__cpu_notify+0x28/0x40)
[<c0790024>] (_cpu_up+0xe4/0x118)
[<c0790024>] (cpu_up+0x64/0x80)
[<c0765840>] (store_online+0x48/0x78)
[<c038d0c8>] (dev_attr_store+0x18/0x24)
[<c017be40>] (sysfs_write_file+0x108/0x13c)
[<c012cdfc>] (vfs_write+0xb0/0x128)
[<c012d034>](sys_write+0x38/0x64)

Change-Id: Ie2a796b17209243de731ccf2ab04b7f9e7048df8
CRs-fixed: 576272
Signed-off-by: Anji Jonnala <anjir@codeaurora.org>
cpufreq: ondemand: Fix locking issue in store_powersave_bias

store_powersave_bias takes timer_mutex before calling dbs_timer_exit
which tries to cancel the delayed work do_dbs_timer which in turn
tries to take the same lock. This can cause a lock recursion under
the race condition where can cancel_delayed_work_sync is called
when the work has already started executing.

This can be avoided by taking that lock after calling
dbs_timer_exit.

Change-Id: I7f862286e66f1ddc1e13e4eeee369dd188fc10d5
CRs-fixed: 576272
Signed-off-by: Rohit Gupta <rohgup@codeaurora.org>
cpufreq: ondemand:Fix NULL check for dbs_info->cur_policy

dbs_info->cur_policy can go NULL when processing
CPUFREQ_GOV_LIMITS, NULL check is required
before processing it

Change-Id: Iba99b563e230835dfcd24573335065d68ad25821
CRs-fixed: 576272
Signed-off-by: Swetha Chikkaboraiah <schikk@codeaurora.org>
cpufreq: ondemand: Fix store_powersave_bias() race with hotplug

store_powersave_bias() assumes that CPUs will not be taken offline or
brought online while executing its for_each_online_cpu() loops. Fix
this race by blocking hotplug while executing in these loop.

CRs-Fixed: 576272
Change-Id: I0d5520444ec21a8d9b12fb73c06ac8442449fa85
Signed-off-by: Matt Wagantall <mattw@codeaurora.org>
cpufreq: ondemand: Fix locking in store_powersave_bias

store_powersave_bias() assumes that dbs_info->cur_policy will
not change while it is executing. If it does, memory corruption
can potentially result. Fix this by acquiring the dbs_lock.

Most noticeably, this resolves timer-related list corruptions
encountered when queue_delayed_work_on() is called from within
store_powersave_bias() while a CPU is being hotplugged in and
out.

CRs-Fixed: 576272
Change-Id: I0fd5cbef6834545274cad9481e574ec50b37b871
Signed-off-by: Matt Wagantall <mattw@codeaurora.org>
crypto: msm: check potential integer overflow on AEAD req length

According to the specification of AEAD, AEAD request cryptlen is
not a Fixed maximum and assoclen is also same. This could lead to
potential integer overflow, thus allocating less memory. So we
need to check potential integer overflow on AEAD request length.

Change-Id: I58a0c5e1a6e890bad30f7865e96b7db46337158c
Signed-off-by: Zhen Kong <zkong@codeaurora.org>
qseecom: Change __copy_from_user to copy_from_user

__copy_from_user does not do address check, so use
copy_from_user instead.

Change-Id: I575c0f3c44b55a521c0d42828988c518c0640a29
Signed-off-by: Hariprasad Dhalinarasimha <hnamgund@codeaurora.org>
qseecom: Ensure incoming "app_name" does not corrupt the kernel stack

Printing a string with that does not have null terminated character,
would lead to overflow, as the print continues until it finds a null
terminated character.
Avoid this issue by explicitly assigning a string with null termination.

Change-Id: I9528db2ba046c514d829097d08c09540588bb1a2
Signed-off-by: Hariprasad Dhalinarasimha <hnamgund@codeaurora.org>
qseecom: Validate the incoming length from user space

Check if there is no integer overflow before using req_len and
resp_len (received from user space). If an overflow is detected
then exit the operation.

Change-Id: I0459a6992bb3b280db42be63a275c55fa6105b1c
Signed-off-by: Hariprasad Dhalinarasimha <hnamgund@codeaurora.org>
crypto: msm: Check destination buffer write access

Use VERIFY_WRITE to check write access to destination buffers
before writing to them.

Change-Id: If9708695e85659bb25e13762c54dd50abd9577c7
Signed-off-by: Mona Hossain <mhossain@codeaurora.org>
crypto: msm: Check for invalid byte offset field

There is potential for HEAP corruption when the
byte offset field is set to a huge value.

Change-Id: Idd851cf3ec57627aba7d8250914cd18ccdd697ec
Signed-off-by: Mona Hossain <mhossain@codeaurora.org>
qseecom: Fix issues with qssecom_remove/exit APIs

Clean-up the qseecom_remove() function by removing the null pointer
dereference. Change the logic by removing the unnecessary code and
also modified the qseecom_exit() function with proper calls.

Change-Id: Ibcca1b3c2c37024661505de2550e202b507703aa
Signed-off-by: AnilKumar Chimata <anilc@codeaurora.org>
crypto: msm: Fix issues related to non-zero byteoffset input

Fix buffer overflow for a non-zero byteoffset value.

Also fixes memory leak issue by adding data_len check in check_params.
One of the scenarios data_len can be less than byteoffset which results
in memory leak with huge data length, which might cause the kernel panic.

Change-Id: I3f773673219f45dad4f17499b1ee0feda2aff1f7
Signed-off-by: AnilKumar Chimata <anilc@codeaurora.org>