msm: vidc: Protect smem operations with core lock

When FW triggers a hardware error, it is possible that one
instance is trying to resurrect FW and another instance is
calling SMEM operations which are not protected by core lock
and it can end up making IOMMU calls when IOMMU is detached.

Signed-off-by: Sachin Shah <sachins@codeaurora.org>
Signed-off-by: Pranav Vashi <neobuddy89@gmail.com>
msm: mdss: Don't call pan_idle for MSMFB_OVERLAY_PREPARE ioctl

We keep calling MSMFB_OVERLAY_PREPARE for each composition
cycle, even if there are no changes in params. Because of this
we can hit performance degradation due to pan idle wait.
This change removes pan_idle wait for prepare call.

Signed-off-by: Radhika Ranjan Soni <rrsoni@codeaurora.org>
Signed-off-by: Pranav Vashi <neobuddy89@gmail.com>
msm_serial_hs: Handling spinlocks during error case

In the API where UART driver notifies the top layer
about the errors received with the data, spinlock
is not released and returning from the API.
This patch fixes the issue.

Signed-off-by: Dilip Kota <c_dkota@codeaurora.org>
Signed-off-by: Pranav Vashi <neobuddy89@gmail.com>
msm_serial_hs: Handle Tx request while Clock OFF

If client initiates a Tx operation when UART clocks are
Off, the driver should not attempt to send data, as this
would result in interacting with unclocked hardware. Add
support to detect this condition and avoid writing to an
unclocked device.
Add a null check after memory allocation.

Signed-off-by: Dilip Kota <c_dkota@codeaurora.org>
Signed-off-by: Pranav Vashi <neobuddy89@gmail.com>
zram: revalidate disk after capacity change

Alexander reported mkswap on /dev/zram0 is failed if other process is
opening the block device file.

Step is as follows,

0. Reset the unused zram device.
1. Use a program that opens /dev/zram0 with O_RDWR and sleeps
   until killed.
2. While that program sleeps, echo the correct value to
   /sys/block/zram0/disksize.
3. Verify (e.g. in /proc/partitions) that the disk size is applied
   correctly. It is.
4. While that program still sleeps, attempt to mkswap /dev/zram0.
   This fails: mkswap: error: swap area needs to be at least 40 KiB

When I investigated, the size get by ioctl(fd, BLKGETSIZE64, xxx) on
mkswap to get a size of blockdev was zero although zram0 has right size by
2.

The reason is zram didn't revalidate disk after changing capacity so that
size of blockdev's inode is not uptodate until all of file is close.

This patch should fix the BUG.

Signed-off-by: Minchan Kim <minchan@kernel.org>
Reported-by: Alexander E. Patrakov <patrakov@gmail.com>
Tested-by: Alexander E. Patrakov <patrakov@gmail.com>
Reviewed-by: Sergey Senozhatsky <sergey.senozhatsky@gmail.com>
Cc: Nitin Gupta <ngupta@vflare.org>
Acked-by: Jerome Marchand <jmarchan@redhat.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Pranav Vashi <neobuddy89@gmail.com>
Bluetooth: Fix crash in l2cap_build_cmd() with small MTU

If a too small MTU value is set with ioctl(HCISETACLMTU) or by a bogus
controller, memory corruption happens due to a memcpy() call with
negative length.

Fix this crash on either incoming or outgoing connections with a MTU
smaller than L2CAP_HDR_SIZE + L2CAP_CMD_HDR_SIZE:

[   46.885433] BUG: unable to handle kernel paging request at f56ad000
[   46.888037] IP: [<c03d94cd>] memcpy+0x1d/0x40
[   46.888037] *pdpt = 0000000000ac3001 *pde = 00000000373f8067 *pte = 80000000356ad060
[   46.888037] Oops: 0002 [#1] SMP DEBUG_PAGEALLOC
[   46.888037] Modules linked in: hci_vhci bluetooth virtio_balloon i2c_piix4 uhci_hcd usbcore usb_common
[   46.888037] CPU: 0 PID: 1044 Comm: kworker/u3:0 Not tainted 3.10.0-rc1+ #12
[   46.888037] Hardware name: Bochs Bochs, BIOS Bochs 01/01/2007
[   46.888037] Workqueue: hci0 hci_rx_work [bluetooth]
[   46.888037] task: f59b15b0 ti: f55c4000 task.ti: f55c4000
[   46.888037] EIP: 0060:[<c03d94cd>] EFLAGS: 00010212 CPU: 0
[   46.888037] EIP is at memcpy+0x1d/0x40
[   46.888037] EAX: f56ac1c0 EBX: fffffff8 ECX: 3ffffc6e EDX: f55c5cf2
[   46.888037] ESI: f55c6b32 EDI: f56ad000 EBP: f55c5c68 ESP: f55c5c5c
[   46.888037]  DS: 007b ES: 007b FS: 00d8 GS: 00e0 SS: 0068
[   46.888037] CR0: 8005003b CR2: f56ad000 CR3: 3557d000 CR4: 000006f0
[   46.888037] DR0: 00000000 DR1: 00000000 DR2: 00000000 DR3: 00000000
[   46.888037] DR6: ffff0ff0 DR7: 00000400
[   46.888037] Stack:
[   46.888037]  fffffff8 00000010 00000003 f55c5cac f8c6a54c ffffffff f8c69eb2 00000000
[   46.888037]  f4783cdc f57f0070 f759c590 1001c580 00000003 0200000a 00000000 f5a88560
[   46.888037]  f5ba2600 f5a88560 00000041 00000000 f55c5d90 f8c6f4c7 00000008 f55c5cf2
[   46.888037] Call Trace:
[   46.888037]  [<f8c6a54c>] l2cap_send_cmd+0x1cc/0x230 [bluetooth]
[   46.888037]  [<f8c69eb2>] ? l2cap_global_chan_by_psm+0x152/0x1a0 [bluetooth]
[   46.888037]  [<f8c6f4c7>] l2cap_connect+0x3f7/0x540 [bluetooth]
[   46.888037]  [<c019b37b>] ? trace_hardirqs_off+0xb/0x10
[   46.888037]  [<c01a0ff8>] ? mark_held_locks+0x68/0x110
[   46.888037]  [<c064ad20>] ? mutex_lock_nested+0x280/0x360
[   46.888037]  [<c064b9d9>] ? __mutex_unlock_slowpath+0xa9/0x150
[   46.888037]  [<c01a118c>] ? trace_hardirqs_on_caller+0xec/0x1b0
[   46.888037]  [<c064ad08>] ? mutex_lock_nested+0x268/0x360
[   46.888037]  [<c01a125b>] ? trace_hardirqs_on+0xb/0x10
[   46.888037]  [<f8c72f8d>] l2cap_recv_frame+0xb2d/0x1d30 [bluetooth]
[   46.888037]  [<c01a0ff8>] ? mark_held_locks+0x68/0x110
[   46.888037]  [<c064b9d9>] ? __mutex_unlock_slowpath+0xa9/0x150
[   46.888037]  [<c01a118c>] ? trace_hardirqs_on_caller+0xec/0x1b0
[   46.888037]  [<f8c754f1>] l2cap_recv_acldata+0x2a1/0x320 [bluetooth]
[   46.888037]  [<f8c491d8>] hci_rx_work+0x518/0x810 [bluetooth]
[   46.888037]  [<f8c48df2>] ? hci_rx_work+0x132/0x810 [bluetooth]
[   46.888037]  [<c0158979>] process_one_work+0x1a9/0x600
[   46.888037]  [<c01588fb>] ? process_one_work+0x12b/0x600
[   46.888037]  [<c015922e>] ? worker_thread+0x19e/0x320
[   46.888037]  [<c015922e>] ? worker_thread+0x19e/0x320
[   46.888037]  [<c0159187>] worker_thread+0xf7/0x320
[   46.888037]  [<c0159090>] ? rescuer_thread+0x290/0x290
[   46.888037]  [<c01602f8>] kthread+0xa8/0xb0
[   46.888037]  [<c0656777>] ret_from_kernel_thread+0x1b/0x28
[   46.888037]  [<c0160250>] ? flush_kthread_worker+0x120/0x120
[   46.888037] Code: c3 90 8d 74 26 00 e8 63 fc ff ff eb e8 90 55 89 e5 83 ec 0c 89 5d f4 89 75 f8 89 7d fc 3e 8d 74 26 00 89 cb 89 c7 c1 e9 02 89 d6 <f3> a5 89 d9 83 e1 03 74 02 f3 a4 8b 5d f4 8b 75 f8 8b 7d fc 89
[   46.888037] EIP: [<c03d94cd>] memcpy+0x1d/0x40 SS:ESP 0068:f55c5c5c
[   46.888037] CR2: 00000000f56ad000
[   46.888037] ---[ end trace 0217c1f4d78714a9 ]---

Signed-off-by: Anderson Lizardo <anderson.lizardo@openbossa.org>
Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
Signed-off-by: John W. Linville <linville@tuxdriver.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Pranav Vashi <neobuddy89@gmail.com>
Bluetooth: Fix missing length checks for L2CAP signalling PDUs

There has been code in place to check that the L2CAP length header
matches the amount of data received, but many PDU handlers have not been
checking that the data received actually matches that expected by the
specific PDU. This patch adds passing the length header to the specific
handler functions and ensures that those functions fail cleanly in the
case of an incorrect amount of data.

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
Signed-off-by: John W. Linville <linville@tuxdriver.com>
[bwh: Backported to 3.2:
 - Adjust context
 - Move uses of *req below the new check in l2cap_connect_req]
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
[wujg: Backported to 3.4:
 - Adjust context
 - Adjust l2cap_create_channel_rsp()'s parameters]
Signed-off-by: Jianguo Wu <wujianguo@huawei.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
[neo: Adapt to msm-3.4]
Signed-off-by: Pranav Vashi <neobuddy89@gmail.com>
Bluetooth: Add missing length check for L2CAP signalling PDUs

* This check is added in upstream as well, our msm-3.4 is
  quite different and so it was missed by last commit.

Signed-off-by: Pranav Vashi <neobuddy89@gmail.com>
serial: tty: msm_hs_uart: Fix the compat table

The compat tables in the msm_hs and msm_hsl drivers do
not have a null terminator structure at the end of the
array. Add them.

Signed-off-by: Abhimanyu Kapur <abhimany@codeaurora.org>
Signed-off-by: Pranav Vashi <neobuddy89@gmail.com>
hammerhead: bluetooth: Use new-CAF map structure

* Use new structure for UART DT without wakeup_irq
  since wakeup_irq is controlled by bluesleep driver.
* Some tuning for bluesleep driver.

Signed-off-by: Pranav Vashi <neobuddy89@gmail.com>
msm: mdss: Remove some cruft

Signed-off-by: Pranav Vashi <neobuddy89@gmail.com>
drivers: serial: Fix risky coding style in wait_for_xmitr()

Add inline qualifier for wait_for_xmitr() according to its
declaration.

Signed-off-by: Xiaocheng Li <lix@codeaurora.org>
Signed-off-by: Pranav Vashi <neobuddy89@gmail.com>
Staging: android: binder: More offset validation.

Make sure offsets don't point to overlapping flat_binder_object
structs.

Signed-off-by: Arve HjÃ¸nnevÃ¥g <arve@android.com>
Signed-off-by: Pranav Vashi <neobuddy89@gmail.com>
netlink: add signed types

Signed types might be needed in NL communication from time to time
(I need s32 in team driver), so add them.

Signed-off-by: Jiri Pirko <jiri@resnulli.us>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Pranav Vashi <neobuddy89@gmail.com>
msm: msm-krait-l2-accessors: Add RTB logging

Accesses to indirect CP15 registers are important system events that
are worth recording in the RTB logs. The logs may aid in debugging
issues seen following operations that use these APIs, like CPU clock
source selection changes.

Signed-off-by: Matt Wagantall <mattw@codeaurora.org>
Signed-off-by: Pranav Vashi <neobuddy89@gmail.com>
ARM: gic: Add support for logging interrupts in RTB

To help with the debug of interrupt storms and problems during IRQ
handling, log the IRQ number in RTB for each interrupt that fires.

Signed-off-by: Subbaraman Narayanamurthy <subbaram@codeaurora.org>
Signed-off-by: Pranav Vashi <neobuddy89@gmail.com>
ARM: gic: Use _no_log variants while accessing some registers

Some GIC register accesses happens more frequently flooding the
RTB logs. Since they're not that useful for debugging purposes,
use _no_log variants while accessing those registers.

Signed-off-by: Subbaraman Narayanamurthy <subbaram@codeaurora.org>
Signed-off-by: Pranav Vashi <neobuddy89@gmail.com>
msm: kgsl: Remove the "global" locking from the ioctl path

Remove the lock code from the generic ioctl handler and move the
mutex lock/unlock code to the places that really need it.  In
particular try not to hold a lock while doing user memory functions
(copy_to_user/copy_from_user) to avoid the potential of a deadlock
with the memory semaphore.

CRs-Fixed: 671080
Change-Id: Ic0dedbad6f7325b53d71a5dbbed50f92483871c8
Signed-off-by: Jordan Crouse <jcrouse@codeaurora.org>
Signed-off-by: Hareesh Gundu <hareeshg@codeaurora.org>
Signed-off-by: Pranav Vashi <neobuddy89@gmail.com>
msm: kgsl: Protect CP_STATE_DEBUG_INDEX

Put CP_STATE_DEBUG_INDEX and CP_STATE_DEBUG_DATA under protection
to keep it from being written from an IB1. Doing so however opens
up a subtle "feature" in the microcode: memory read opcodes turn off
protected mode in the microcode to do the read and then turns it
back on regardless of the initial state. This is a problem if the
memory read happens while protected mode is turned off and then we
try to access a protected register which then complains and goes boom.

To account for this irregularity explicitly turn back off protected
mode in all the places where we know this will be a problem.

Signed-off-by: Jordan Crouse <jcrouse@codeaurora.org>
Signed-off-by: Pranav Vashi <neobuddy89@gmail.com>
msm: kgsl: Skip the entire command during fault recovery

During fault recovery the algorithm may choose to skip the faulting
command. To skip just one indirect buffer we have to rely on
CP_IB1_BASE but depending on where the fault happened the base could
already be pointing to the next buffer. This causes the code to skip
over the wrong buffer. There is no advantage to skipping just one
buffer vs the entire submission.

Signed-off-by: Tarun Karra <tkarra@codeaurora.org>
Signed-off-by: Pranav Vashi <neobuddy89@gmail.com>