msm: SSR: Fix problems with concurrent SSRs

If one SSR call comes in and queues a work and the work item
starts running and then another SSR call comes in we will end up
with a running work item and a pending work item. The pending
work item will not run until the running work item completes.
With the current code the work item will run to completion and
then the pending work item will run and restart the subsystem
again.

This is wrong since we want to 'short-circuit' the code in this
case and do nothing if multiple SSR calls come in while the
subsystem is in the 'crashed' state.  Add state tracking logic so
that we know what part of the restart process a particular
subsystem is in and use it to fix this problem.

Conflicts:

	arch/arm/mach-msm/subsystem_restart.c

Change-Id: Iac8713951af1f290af1df7e94468d1843fc7980b
CRs-Fixed: 397848
Signed-off-by: Stephen Boyd <sboyd@codeaurora.org>
Signed-off-by: Vikram Mulukutla <markivx@codeaurora.org>
msm: hotplug: wait for hotplug completion event from secondary core

Primary core has to wait for hotplug completion event from secondary
core to avoid race between ongoing hotplug and already queued online
event. This also prevent CPU_DEAD notifiers from executing before the
SPM has completed the collapse of the CPU. CPU DEAD notifiers executing
early have been attributed to MDD hardware block for the CPU being
turned off prematurely, resulting in crashes.
The patch also adds support for probing with device tree for 8974
targets.

Change-Id: Ibd35a7c56f42f156a643ca6d531509f019b2a3be
CRs-fixed: 438314
Signed-off-by: Anji Jonnala <anjir@codeaurora.org>
lib: qmi: Introduce QMI Encode/Decode library

Introduce Encode/Decode Library to perform QMI message marshaling.
The QMI Encode/Decode Library encodes the kernel C data structures into
QMI wire format and decodes the messages in QMI wire format into kernel
C structures.

Change-Id: Ib443e697dafedeac8a790de9a3a8ed4a8444082f
Signed-off-by: Karthikeyan Ramasubramanian <kramasub@codeaurora.org>
msm: ipc: Squashed updates from kk_2.7 branch

msm: ipc: Security updates to IPC Router

In order to provide fine-grained access control to QMI services,
a security script from user-space will feed the security rules to
IPC Router. The security rule implies that in order to send a QMI
message to a service, a client process should belong to a specific
Linux/Android group. IPC Router, after receiving the security rules,
will enforce the access control rules.

Change-Id: I49f8d7c0067fc37cb0b4de2ccb46a575905ef64f
Signed-off-by: Karthikeyan Ramasubramanian <kramasub@codeaurora.org>

msm: ipc: Allow QMI clients to send messages after IRSC is complete

Currently there exists a small time interval during initialization
where QMI clients in user-space can communicate with QMI services
before the IPC Router Security Configuration(IRSC) is complete.

Only allow clients to communicate after IRSC is complete.

Change-Id: I773ad5b3cb02c51a725cd60a77466876c1498b64
Signed-off-by: Karthikeyan Ramasubramanian <kramasub@codeaurora.org>

msm: ipc: Security updates to IPC Router

With the fine-grained access control in place for QMI clients, default
security check in socket create operation is redundant. Update the
IPC Router to perform the default security check only for the
bind operation, which is used during QMI service registration.

Change-Id: I967dbc3d414d39d307c071ff49c319828b5ed19e
Signed-off-by: Karthikeyan Ramasubramanian <kramasub@codeaurora.org>

msm: ipc: Add check to avoid integer & buffer overflow

In IPC Router service lookup operation, add check to avoid an integer
overflow and hence a buffer overflow.

CRs-Fixed: 457402
Change-Id: Ibe949fe20aad88b15679bdc96ebc505e4395ac3b
Signed-off-by: Karthikeyan Ramasubramanian <kramasub@codeaurora.org>

msm: ipc_router: Fix potential leaks and null dereferences

Added null pointer checks to avoid potential null pointer dereferences
and free statements to avoid potential memory leaks

Change-Id: I0553dfe6c61260a700a9dc6a411dcec6483e0eb8
Signed-off-by: Brent Hronik <bhronik@codeaurora.org>

msm: ipc: Access pointers after a successful check

Some pointers in msm_ipc_router_extract_msg function are accessed either
before a NULL pointer check or if one of the conditions in the check is
true.

Fix the code to dereference those pointers only after the pointer is not
NULL and the other associated conditions are true.

CRs-Fixed: 471110
Change-Id: Ic45fe118818caa6985e5e56403ab3cc467174cf6
Signed-off-by: Karthikeyan Ramasubramanian <kramasub@codeaurora.org>

msm: ipc: Do not load any subsystem by default

Some users of IPC Router like IPC Router Security Configuration (IRSC)
open up a socket, perform some configuration/lookup operation quickly and
then close the socket. This causes the IPC Router to load a subsystem by
default and then unload it immediately. This behavior causes the subsystem
to lock up sometimes during the boot process.

Remove loading and unloading a subsystem by default during the socket
create and close operation.

CRs-Fixed: 480156
Change-Id: I9c1c01c18a538a462bcf65902e496bc773a03991
Signed-off-by: Karthikeyan Ramasubramanian <kramasub@codeaurora.org>
Signed-off-by: Sridhar Gujje <sgujje@codeaurora.org>

msm: ipc: Load default subsystem under appropriate scenario

Only client and service ports are used for communication with the remote
subsystems. Load the default subsystem only when the clients lookup their
services or when the local services get registered with the IPC Router.

CRs-Fixed: 480156
Change-Id: I18729bb849c656a826de4f67f9ffe159dd3cf5f6
Signed-off-by: Karthikeyan Ramasubramanian <kramasub@codeaurora.org>
Signed-off-by: Sridhar Gujje <sgujje@codeaurora.org>

msm: ipc: IPC Router updates to support QMI in the kernel

1) Move the kernel interface APIs to a separate header file.
2) Use platform device to indicate the arrival/exit of service.
3) Add kernel APIs to send and receive messages through IPC Router.
4) Clean up unused Macros, enums, header inclusion.

Change-Id: I1541e9815d104f7ea46d19c10b57c77d967bd065
Signed-off-by: Karthikeyan Ramasubramanian <kramasub@codeaurora.org>

msm: ipc: Update the wakelock naming format for the local ports

Update the wakelock names to "ipc<local_port_id>_<port_owner>". This
enables easier identification of the wakelock owners.

Change-Id: Ife2bcbea5f4ab27269749123475065b6ec7b7f0b
Signed-off-by: Karthikeyan Ramasubramanian <kramasub@codeaurora.org>

msm: ipc: Add support for IPC Logging

Enhance IPC Router to log information pertaining to the messages
exchanged between user-space and other systems.

Change-Id: I8ef3e793a85bcdb14c69eb96278ce2ea8a47df96
Signed-off-by: Zaheerulla Meer <zmeer@codeaurora.org>

msm: ipc: Add IPC Logging support to IPC Router

IPC Router to log debug & Router-to-Router messages onto the IPC Log
buffer. This will enable debugging the IPC Router initialization
issues and Router-to-Router communication issues, using debugfs without
logging to the kernel logs.

Change-Id: I90d968baf355f2f9abe95ea53d8b059781e8fbc6
Signed-off-by: Karthikeyan Ramasubramanian <kramasub@codeaurora.org>

msm: ipc: Change IPC log file name for IPC Router

Change the name of the files that contain the IPC log information
from the IPC Router. This change is done to reflect the module name
as a part of the IPC log file name.

Change-Id: I541aa5866251348b472eba6d1b3d1840500387f9
Signed-off-by: Zaheerulla Meer <zmeer@codeaurora.org>

msm: ipc: Update recvmsg operation to be non-blocking by default

Update the IPC Router recvmsg operation to be non-blocking by default
and return 0 when there is no data to read.

CRs-Fixed: 464634
Change-Id: I1f43e3a36d72312372a3ac141d506c81a613c408
Signed-off-by: Karthikeyan Ramasubramanian <kramasub@codeaurora.org>

msm: ipc_router: Fix potential leaks and null dereferences

Added null pointer checks to avoid potential null pointer dereferences
and free statements to avoid potential memory leaks

Change-Id: I0553dfe6c61260a700a9dc6a411dcec6483e0eb8
Signed-off-by: Brent Hronik <bhronik@codeaurora.org>

msm: ipc: Pass RESUME_TX events to the endpoints

IPC Message Router blocks the endpoints from transmission if the transmit
message count for the destination endpoint reaches the quota count. This
will cause the asynchronous message transfer to block, which violates the
defintion of asynchronous behavior.

Return -EAGAIN when the transmit message count for the destination
endpoint reaches the quota count. In addition, after receiving the
resume_tx event from the remote endpoints notify all the local endpoints
that are waiting on the remote endpoint's resume_tx event.

CRs-Fixed: 473573
Change-Id: I82b49d268394bb8c064d88fd6a2799a5e9ec566f
Signed-off-by: Zaheerulla Meer <zmeer@codeaurora.org>
Signed-off-by: Karthikeyan Ramasubramanian <kramasub@codeaurora.org>

msm: ipc: Do not broadcast remove client messages, if possible

Remove client message is broadcast to all subsystems within the system.
If a client has never communicated over any link, then do not send the
remove client message over any link. If a client has been communicating
only over a specific link, then send the remove client message only over
that link. If a client has been communicating over multiple links, then
broadcast the remove client message.

CRs-Fixed: 454809
Change-Id: I007c7f1ace66191ce9cbf0bad033381c4f3b750f
Signed-off-by: Karthikeyan Ramasubramanian <kramasub@codeaurora.org>

msm: ipc: Return -ENODEV when remote port is not found

Current implementation returns -ENOMEM when look up for a remote port
fails.

Return -ENODEV instead of -ENOMEM.

Change-Id: I7022e760631b3faaf7f1ba7952c8569905c4ee5a
Signed-off-by: Zaheerulla Meer <zmeer@codeaurora.org>

msm: ipc: Check pointer validity before dereferencing it

Transport OPEN and CLOSE events are handled by dynamically allocating a
work. Check that the work item is properly allocated before dereferencing
it.

Change-Id: Icb73548f0747494791f14f9c8014f8effd4b844c
Signed-off-by: Karthikeyan Ramasubramanian <kramasub@codeaurora.org>

msm: ipc: Post a packet to a local port using a common routine

A packet is posted to a local port from multiple locations within the
IPC router code. This causes the same code to be repeated in multiple
locations.

Add a common routine to perform that operation, reduce the code
redundancy and avoid any potential bug due to incomplete code repetition.

Change-Id: I4ed43feb3ea8bb88479b89814846d5ea20bb3665
Signed-off-by: Karthikeyan Ramasubramanian <kramasub@codeaurora.org>

msm: ipc: Refactor the code that processes control messages

process_control_msg function looks lengthy and heavily indented.

Refactor the code that processes each type of control message into a
separate function of its own.

Change-Id: Id7c4038dd4369a182ed855bd6b1e66ce07f5b8c3
Signed-off-by: Karthikeyan Ramasubramanian <kramasub@codeaurora.org>

msm: ipc: Cleanup unused elements

Some of the mutexes, lists and wait queues are just initialized and left
unused in IPC Router. Cleanup those unused variables/elements.

Change-Id: Ifa363afd4315f8c24eb47c74fd44ac02d0b77eff
Signed-off-by: Karthikeyan Ramasubramanian <kramasub@codeaurora.org>

msm: ipc: Add SMD link to interface with WCNSS

This new SMD link will enable QMI/IPC Router communication between
Application processor and WCNSS.

Change-Id: I140834bd193e110e636d3945aa5dc93b3306ef05
Signed-off-by: Karthikeyan Ramasubramanian <kramasub@codeaurora.org>

msm: ipc: Define locking hierarchy and use read/write semaphores

Define the hierarchy of different locks used in IPC Router. This will
help in avoiding the classic AB-BA locking scenario inside IPC Router.

Update some of the locks from mutexes to read/write semaphores. This
will help in improving parallelism. This will also improve the robustness
of the IPC Router when some of the remote subsystem stop responding
silently.

As part of the locking revamp, optimize the code path which handles
subsystem restart and cleanup some of the unused macros.

Change-Id: I2a1d81bcb90cbaf4dd5d7030efbf94f2f0758d55
Signed-off-by: Karthikeyan Ramasubramanian <kramasub@codeaurora.org>

msm: ipc: Fix potential AB-BA deadlock

In kernel QMI, while receiving responses continuously, there is a
classic out-of-order(AB-BA) deadlock scenario between IPC router and
Kernel QMI interface. The scenario is as below:

  1) IPC Router receives the message for kernel QMI port and acquires the
     corresponding port's port_rx_q_lock and then calls the notify
     function for that port which tries to acquire the handle_lock of the
     port.

  2) Kernel QMI interface, that runs independent of IPC Router activities,
     tries to send a message and acquires handle_lock for the port and
     tries to acquire the port's port_rx_q_lock to read the response from
     the port.

  3) This creates a classic AB-BA deadlock because port_rx_q_lock is
     locked at step 1 and handle_lock is acquired at step 2.

Fix the deadlock.

Change-Id: I532cff30b445e11baa715a570e5e853d9b71bab3
Signed-off-by: Zaheerulla Meer <zmeer@codeaurora.org>

msm: ipc: Make the kernel-space read operation as non-blocking

Update the read operations of kernel space to be non-blocking and
return -ENOMSG when there is no message to read.

Change-Id: I92f55d8829755078f34ff3cbe2dc9b16ed7988df
Signed-off-by: Zaheerulla Meer <zmeer@codeaurora.org>

msm: ipc: Handle the Resume_Tx events from remote endpoints

To prevent the QMI clients from flooding the remote services, IPC Router
transport supports a flow control mechanism. When the IPC Router
transport returns -EAGAIN during message transmission, queue the packet
into client's pending transaction queue for transmission during later
time. In addition, handle RESUME_TX events from the remote services and
use that event to transmit the packets in pending transaction queue.

Change-Id: Ib24256fd0dbeecb9d96ea03ffd86afe2b4cc1483
Signed-off-by: Zaheerulla Meer <zmeer@codeaurora.org>

msm: smem: Update SMEM log dump_sym to indicate QMI modules

SMEM Log dump_sym file indicates log information from QCCI/QCSI modules
as ONCRPC and log information from IPC Router as ROUTER which is
misleading.

Update the code so that dump_sym indicates correct module names.

Change-Id: I8e67ccce60780ec935cfc71d0854f156f3e922b8
Signed-off-by: Zaheerulla Meer <zmeer@codeaurora.org>

msm: ipc: Return error value on send failure

msm_ipc_router_send_msg() returns 0 instead of the error code when the
send helper function fails.

Return error code from helper function in failure cases.

Change-Id: Idef1ceef261945e30b57cd5e99fcb0b2651b31ab
Signed-off-by: Zaheerulla Meer <zmeer@codeaurora.org>

msm: ipc: Add check to avoid integer & buffer overflow

In IPC Router configure security rule operation, add check to avoid
integer overflow and hence a buffer overflow.

CRs-Fixed: 457405
Change-Id: I5448e14242be764a7b7adfe650b2c9124701c2c5
Signed-off-by: Karthikeyan Ramasubramanian <kramasub@codeaurora.org>

msm: ipc: Detect integer overflow before it happens

As per ANSI C Standard document, integer overflow is an undefined
behavior. So update the code to detect integer overflow before it happens.

CRs-Fixed: 491629
Change-Id: Ifd90c05266477c7734710bb94b9021f8bb9ab761
Signed-off-by: Karthikeyan Ramasubramanian <kramasub@codeaurora.org>

msm: ipc: Clean-up code redundancy

The receive message operation for the socket interface and the kernel
interface has redundant code.

Clean-up redundant code.

Change-Id: Ibe52816f5b567feab4d6247a3dba1945e209c626
Signed-off-by: Arun Kumar Neelakantam <aneela@codeaurora.org>

msm: ipc: Initialize unused elements of control message to 0

Initialize the entire control message to 0, so that unused elements of
a control message are initialized to 0. This will prevent any uninitialized
elements from leaking information to the remote subsystems.

Change-Id: I910f3956e8f282e614216c45f7af92d741d887f8
Signed-off-by: Karthikeyan Ramasubramanian <kramasub@codeaurora.org>

msm: ipc: Send Resume_Tx from the client/server context

Resume_tx is passed by IPC Router as soon as it detects confirm_rx
field being set in received message. In a scenario where the local port
towards which the confirm_rx is directed is not in a state of accepting
messages, this behavior of IPC Router makes the remote port send more
data towards the local port. In addition, in a multi-hop scenario the
resume_tx message holds the destination node_id as the value of the
neighbouring node_id which is incorrect.

Pass Resume_Tx from the context of the thread to which the local port is
associated. Pass the right node_id as destination node_id in the
Resume_Tx message.

Change-Id: I6a05a85978c38831bd95210b3617c5d015eac5e4
Signed-off-by: Zaheerulla Meer <zmeer@codeaurora.org>

msm: ipc: Fix memory leak

When IPC Router detects a data packet from an unknown remote port,
the router creates a remote port. In case of failure while creating the
remote port, router doesn't free the memory allocated to the data packet.
This leads to memory leak beacuse once the above mentioned failure
occurs, the data packet never gets used.

Fix the memory leak in case of failure while creating the remote port.

Change-Id: I168329db88afb6159b1eda64fbd4bbeb95fbd94f
Signed-off-by: Zaheerulla Meer <zmeer@codeaurora.org>

msm: ipc: Pass the local service events to local clients

When a service gets registered or unregistered locally, the concerned
events are sent only to the remote subsystems.

Pass the local service events to local clients so that clients and
services can be started in any order.

Change-Id: I1f672cb3e7cac2ae2f26922add0320ffd84a38ad
Signed-off-by: Karthikeyan Ramasubramanian <kramasub@codeaurora.org>

msm: ipc: Cleanup a routing table entry under subsystem restart

Currently when a remote subsystem restarts, the routing table entry
corresponding to that remote subsystem is recycled. This causes some
subsystems to be not reachable if the system's network topology is
not meshed.

Remove the routing table entry for a restarting subsystem so that
it gets added again either through HELLO message from that subsystem or
through first NEW_SERVER message from that subsystem.

Change-Id: I2957ebfb2b66610f68e000e42e2c07d463c89eb6
Signed-off-by: Karthikeyan Ramasubramanian <kramasub@codeaurora.org>

msm: ipc: Add support to handle version 2 header

IPC Router Message header is 32 bytes in size since each element uses
4 bytes in size regardless of the data range being represented.

Add a version 2 header format that compacts the header into 16 bytes.

Change-Id: I5e6cfc0672ca1dc3365b31c26d2ce4b3c6230cfc
Signed-off-by: Karthikeyan Ramasubramanian <kramasub@codeaurora.org>

msm: ipc: Return the error codes without modification

The user-space modules perform decisions regarding retransmission etc.
based on the error codes returned by the IPC Router.

So return the error codes as is without any modification to the
user-space.

Change-Id: Ic7012109c446aaeaba74c3a29cffd16c155e7212
Signed-off-by: Karthikeyan Ramasubramanian <kramasub@codeaurora.org>

msm: ipc: Fix SKB ownership for failure case

When a client writes to IPC Router and if the write fails, then in
certain scenarios both the client and IPC Router take up the ownership
of the SKB. These failure scenarios lead to a double-free and
segmentation fault.

Fix these scenarios by resolving the ownership issue. If the write to
IPC Router is successful, then IPC Router will keep the ownership of the
SKBs and free the packets. If the write fails, then the client will keep
the ownership of the SKBs and free the packets.

CRs-Fixed: 530180
Change-Id: Iaba47f5da377cdf0a6b16ae02d99eab91a9a6221
Signed-off-by: Zaheerulla Meer <zmeer@codeaurora.org>

msm: ipc: Append alignment bytes to loopback packet

When messages are looped back to the local port, the sender does not
append the alignment bytes while the receiver is discarding the
alignment bytes. This leads to receiver receiving an incomplete message.

Fix this issue by appending the alignment bytes in the loopback path.

Change-Id: Ie340e5311e15e39558a8fe9c95a54da686df4371
Signed-off-by: Karthikeyan Ramasubramanian <kramasub@codeaurora.org>

msm: ipc: Update the check for minimum packet size

IPC Router checks for the minimum packet size of the incoming message to
be at least 32 bytes. With IPC Router version 2 header, this check is
invalid for some packets.

Update the check for the minimum incoming packet size based on the
transport on which the packet is received.

Change-Id: Iacebfe876db2e5c3513d18fcfae425ea9bd6a7cd
Signed-off-by: Karthikeyan Ramasubramanian <kramasub@codeaurora.org>
msm: pm-8x60: Remove timeout waiting for cpu to power collapse

The delays in the CPU_DYING notication path could result in the core
initiating the hotplug to send out CPU_DEAD notifications after
msm_pm_wait_cpu_shutdown() times out. This could result in a unknown
resets when regulator/clocks are disabled in the CPU_DEAD path. To
prevent unknown resets, wait infinitely to enter power collapse but
throw a warning after the 1ms mark.

The platform_cpu_kill() path is also executed in the reboot path when a
core tries to stop secondary cores. In these cases, platform_cpu_kill
shouldn't wait infinitely for the secondary cores to power collapse. To
circumvent this scenario, track dying cpus as a part of the hotplug
notification and skip waiting for the core to power collpase during
reboot path.

CRs-fixed: 582925
Change-Id: I144e95a6d019e897381d2bca62ab50ecefd56b5b
Signed-off-by: Mahesh Sivasubramanian <msivasub@codeaurora.org>
Signed-off-by: Swetha Chikkaboraiah <schikk@codeaurora.org>
cpufreq: ondemand:kernel NULL pointer dereference at dbs_check_cpu

Function dbs_check_cpu  calls __cpufreq_driver_getavg
With  policy as IN/OUT parameter.
There is possiblity of policy becoming NULL in
 __cpufreq_driver_getavg. Same policy is getting
accessed in the for loop which leads to NULL pointer dereference.
So NULL check is required for the policy

CRs-fixed: 582925
Change-Id: Ib8d8de8d66500430a5aa4c275937640e4f934aa8
Signed-off-by: Swetha Chikkaboraiah <schikk@codeaurora.org>