ARM: Fix deadlock scenario with smp_send_stop()

If one process calls sys_reboot and that process then stops other
CPUs while those CPUs are within a spin_lock() region we can
potentially encounter a deadlock scenario like below.

CPU 0                   CPU 1
-----                   -----
                        spin_lock(my_lock)
smp_send_stop()
 send_IPI               handle_IPI()
                         disable_preemption/irqs
                          while(1);
 <PREEMPT>
spin_lock(my_lock) <--- Waits forever

We shouldn't attempt to run any other tasks after we send a stop
IPI to a CPU so disable preemption so that this task runs to
completion.

Change-Id: I528af0b4448433bd9d6ca12d6a0e2c422a55d4be
CRs-Fixed: 396169
Reported-by: Sundarajan Srinivasan <sundaraj@codeaurora.com>
Signed-off-by: Stephen Boyd <sboyd@codeaurora.org>
qdsp5: mvs: Fix kernel panic due to early closure of endpont

MVS driver closes the RPC endpoint while it sends reply to the
RPC read sometimes. The RPC write for this reply results in
crash as endpoint is already closed.
Wait for RPC read and reply to complete before closing the
endpoint.

CRs-Fixed: 443706
Change-Id: Ia1918082118f23ab9aefec1c3a04908d8d8c1199
Signed-off-by: Sriranjan Srikantam <cssrika@codeaurora.org>
qdsp5: mvs: Allow only single instance of mvs session

During MVS open, mvs driver calls msm_rpc_connect to establish
rpc connection with modem mvs server without checking for
current state of mvs driver. This causes modem oncrpc memory
pool to exhaust if back to back open is called without closing
the mvs driver.

Added check to call rpc connect only if mvs driver is in
closed state.

(cherry picked from commit 32c4287136ff1dedd396586fd3adb3ce7959fc2c)

Change-Id: I8abbe1fcc9d4d099938bbf7556e32161aaad75a8
CRs-Fixed: 433208
Signed-off-by: Manish Dewangan <manish@codeaurora.org>
msm: qdsp5: Modify check in voice memo process rpc request

Packet size of callback data is currently checked against frame size
corresponding to 20msec data. There are instances where 200msec data
is sent to apps corresponding to total record buffer size. In such
cases, the added condition fails and no recording happens causing
voice memo recording to fail.
Modify condition to check against record buffer size instead of
frame size to avoid such failure cases.

CRs-Fixed: 377529
Change-Id: I77bab73a34d95e823f14f3750550a793540248d1
Signed-off-by: Chaithanya Krishna Bacharaju <chaithan@codeaurora.org>
msm: board-msm7627a: De-feature FMEM suport

We are no longer supporting FMEM from MSMs. So, disable
FMEM from 7627a/8625

Change-Id: I557a9a851a21ff1480d76e5115b1b07acdd48483
Signed-off-by: Chintan Pandya <cpandya@codeaurora.org>
msm: dma: Moving queue_work() function within spinlock

Currently we are adding a dma command to the staged list with in a
spinlock and then adding to workqueue using queue_work after unlocking
the spinlock. With this there is chance of executing DMA commands in out
of order in below concurrency case.

Tread1                                Thread2
__msm_dmov_enqueue_cmd_ext
   spin_lock_irqsave(..)
   list_add_tail(..)
   spin_unlock_irqrestore(..)
       --PREEMPT--
                                      __msm_dmov_enqueue_cmd_ext
                                         spin_lock_irqsave(..)
                                         list_add_tail(..)
                                         spin_unlock_irqrestore(..)
                                         queue_work()
                                         ..
   queue_work()
So adding queue_work with in spin_lock will make sure that the
work added in the work_queue is processed in the same order as they
are added in staged_commands.

CRs-Fixed: 423190
Change-Id: I2ffd1327fb5f0cd1f06db7de9c026d1c4997fe4d
Acked-by: Gopi Krishna Nedanuri <gnedanur@qti.qualcomm.com>
Signed-off-by: Utsab Bose <ubose@codeaurora.org>
msm: rpc: hold spinlock while doing wait_event

To prevent a race condition between wake_up called by
msm_rpcrouter_xprt_notify and wait_event in rr_read
hold a spinlock irqsave to prevent the system from going into
sleep when there is pending SMD data to process.

CRs-Fixed: 393416
Change-Id: Ic329c785fa8272857b7f067819d51a516a9cdc0d
Signed-off-by: Angshuman Sarkar <angshuman@codeaurora.org>
msm: rpc: Release spinlock irqsave before blocking operation

Registering the platfrom device is a blocking operation,
release spinlock irqsave before device registration.

CRs-Fixed: 423256
Change-Id: I64b11eaf9dbad2e0e92db271887cda77d1823c3b
Signed-off-by: Zaheerulla Meer <zmeer@codeaurora.org>
Signed-off-by: Arun Kumar Neelakantam <aneela@codeaurora.org>
cpufreq: Fix panic when setting sampling rate

Kernel panics when trying to set the sampling rate before the ondemand
governor CPUFREQ_GOV_START notification is received.

[<c078e500>] panic+0x15c
[<c0012354>] die+0x19c
[<c0018e60>] __do_kernel_fault+0x64
[<c0793660>] do_page_fault+0x3b8
[<c0008514>] do_DataAbort+0x134
[<c0791c58>] __dabt_svc+0x38
[<c02b5c68>] __list_add+0x38
[<c078f1b0>] __mutex_lock_slowpath+0x128
[<c078fc68>] mutex_lock+0x20
[<c05409c4>] store_sampling_rate+0x98
[<c02a6648>] kobj_attr_store+0x18
[<c0183124>] sysfs_write_file+0x108
[<c0131758>] vfs_write+0xac
[<c013188c>] sys_write+0x3c
[<c000e340>] ret_fast_syscall+0x0

Initialize the mutex as part of cpufreq_gov_dbs_init().

(cherry picked from commit 457a44596ed40d99cd4cc6d609593c3e2e6ab972)

Change-Id: I5494f59975618c1b6e878827f3961a727a7d09aa
Signed-off-by: Praveen Chidambaram <pchidamb@codeaurora.org>
cpufreq: Avoid using smp_processor_id() in preemptible context

Even though this work item runs on only one cpu at a time (due to
queue_work_on()) it is possible for the work item to be preempted
and so use of smp_processor_id() is illegal.

[<c00151b0>] (unwind_backtrace+0x0/0x120) from [<c0279058>]
(debug_smp_processor_id+0xbc/0xf0)
[<c0279058>] (debug_smp_processor_id+0xbc/0xf0) from [<c0454b54>]
(dbs_refresh_callback+0xc/0x188)
[<c0454b54>] (dbs_refresh_callback+0xc/0x188) from [<c0087290>]
(process_one_work+0x354/0x648)
[<c0087290>] (process_one_work+0x354/0x648) from [<c0089754>]
(worker_thread+0x1a8/0x2a8)
[<c0089754>] (worker_thread+0x1a8/0x2a8) from [<c008e480>]
(kthread+0x90/0xa0)
[<c008e480>] (kthread+0x90/0xa0) from [<c000f438>]
(kernel_thread_exit+0x0/0x8)

The intent of the code is to determine which CPU this work item
is running on, which we can easily do by passing that information
in a wrapper struct around the work struct. Do this so we avoid
this problem.

(cherry picked from commit c8fc30160f2fcfb2578e13e05202fb387c993a14)

BUG: using smp_processor_id() in preemptible [00000000]
Change-Id: I19336fa48ee2b5851dbe6a904f8a60c01b7334d9
code: kworker/3:1/4162 caller is dbs_refresh_callback+0xc/0x188
Signed-off-by: Stephen Boyd <sboyd@codeaurora.org>
msm: kgsl: Detect and avoid malformed ioctl codes

Because we were using _IO_NR, one could construct a malformed ioctl
code that would avoid allocating memory yet go to a function that
expected that memory. Still use _IO_NR to index the array of ioctls,
but check that the full values match before jumping to the helper
function.

CRs-fixed: 385592
Change-Id: Ic0dedbaded469035bd0a2bb0f20fecb2a3045ca5
Signed-off-by: Jordan Crouse <jcrouse@codeaurora.org>
radio-tavarua: Add support for WCN2243 v2.1 SOC

Enable support for WCN2243 v2.1 SoC which is respin of
WCN2243 v2.0 with the bug fixes.

Signed-off-by: Venkateshwarlu Domakonda <Venkateshwarlu@codeaurora.org>
Signed-off-by: Ram Mohan Korukonda <rkorukon@codeaurora.org>
(cherry picked from commit a6757832d554710798747bf3b46e560370bc0427)

Change-Id: Ia7a5132c74d1faf8b16c3cce20bd5dd0cf25acd6
Signed-off-by: Gopal Goberu <ggober@codeaurora.org>
radio-tavarua: Configure channel spacing for enhanced search

Enhanced search algorithm detects 50Khz channel spacing frequencies
in a band with 100khz channel spacing.
Update channel spacing for enhanced Search algorithm on WCN2243 2.1.

Change-Id: If133895e33679a1bc84df8d25841e7e13aa36629
CRs-Fixed: 450643
Signed-off-by: Venkateshwarlu Domakonda <Venkateshwarlu@codeaurora.org>
msm: camera: Fix lens lock issue in actuator.

The actuator is not able to move beyond one region boundary.
This is because when there is region boundary between current
lens position and destination lens position, the lens is first moved
to region boundary and then moved to the destination target position.
Once region boundary(target lens position in this case) is reached
we should not assume it is the end of total lens movement. So
condition check (curr_lens_pos == target_lens_pos) is wrong. Hence
removing the inaccurate condition check.

Change-Id: I0346277b4e9a3f1e0e4ce7bd11c8dbaacfc288f7
Signed-off-by: Rajakumar Govindaram <rajakuma@codeaurora.org>
mfd: marimba: Add support for WCN2243 v2.1 SOC

Enable support for WCN2243 v2.1 SoC which is respin of
WCN2243 v2.0 with the bug fixes.

Signed-off-by: Venkateshwarlu Domakonda <Venkateshwarlu@codeaurora.org>
Signed-off-by: Ram Mohan Korukonda <rkorukon@codeaurora.org>
(cherry picked from commit 4fba7869611da238a59779c70f1f73c470796061)

Change-Id: I624649fcff8392b3eebbe5f6c181574d98ea0e89
Signed-off-by: Gopal Goberu <ggober@codeaurora.org>
msm: msm-batt: report fake usb disconnection when cur_volt < batt_min

Android doesn't initiate graceful shutdown if USB connected even
if battery voltage is less than minimum operating voltage. To work
around this behavior, let the battery module report fake usb
disconnection when voltage is very low.

CRs-Fixed: 410647
Signed-off-by: Krishna Vanka <kvanka@codeaurora.org>
(cherry picked from commit 3775173e3c8b95c9ae1e3e6e2445ae89afef5df8)

Change-Id: Ia099dca16a1c2b6f1e6719ef5fabcc855f7f00d8
Signed-off-by: Gopal Goberu <ggober@codeaurora.org>
staging: android: ashmem: Avoid deadlock with mmap/shrink

Both ashmem_mmap and ashmem_shrink take the ashmem_lock. It may
be possible for ashmem_mmap to invoke ashmem_shrink:

-000|mutex_lock(lock = 0x0)
-001|ashmem_shrink(?, sc = 0x0) <--- try to take ashmem_mutex again
-002|shrink_slab(shrink = 0xDA5F1CC0, nr_pages_scanned = 0, lru_pages
-002|=
-002|124)
-003|try_to_free_pages(zonelist = 0x0, ?, ?, ?)
-004|__alloc_pages_nodemask(gfp_mask = 21200, order = 1, zonelist =
-004|0xC11D0940,
-005|new_slab(s = 0xE4841E80, ?, node = -1)
-006|__slab_alloc.isra.43.constprop.50(s = 0xE4841E80, gfpflags =
-006|2148925462, ad
-007|kmem_cache_alloc(s = 0xE4841E80, gfpflags = 208)
-008|shmem_alloc_inode(?)
-009|alloc_inode(sb = 0xE480E800)
-010|new_inode_pseudo(?)
-011|new_inode(?)
-012|shmem_get_inode(sb = 0xE480E800, dir = 0x0, ?, dev = 0, flags =
-012|187)
-013|shmem_file_setup(?, ?, flags = 187)
-014|ashmem_mmap(?, vma = 0xC5D64210) <---- Acquire ashmem_mutex
-015|mmap_region(file = 0xDF8E2C00, addr = 1772974080, len = 233472,
-015|flags = 57,
-016|sys_mmap_pgoff(addr = 0, len = 230400, prot = 3, flags = 1, fd =
-016|157, pgoff
-017|ret_fast_syscall(asm)
-->|exception
-018|NUR:0x40097508(asm)
---|end of frame

Avoid this deadlock by using mutex_trylock in ashmem_shrink; if the mutex
is already held, do not attempt to shrink.

Change-Id: I222bbf55856d5849da813b730de0636c80966c8e
Reported-by: Matt Wagantall <mattw@codeaurora.org>
Reported-by: Syed Rameez Mustafa <rameezmustafa@codeaurora.org>
Reported-by: Osvaldo Banuelos <osvaldob@codeaurora.org>
Reported-by: Subbaraman Narayanamurthy <subbaram@codeaurora.org>
Signed-off-by: Laura Abbott <lauraa@codeaurora.org>
drivers/staging: msm8610: Reduce android log buffer sizes

Savings of 768KB in the total kernel static size
which translates to an increase in the android userspace memory
Useful for memory constrained devices like msm8610, msm8226

Change-Id: I3766a6db0acb2247ea202c2c416b32643587ca21
Signed-off-by: Bhargav Upperla <bhargavuln@codeaurora.org>
mm: Hold a file reference in madvise_remove

commit 9ab4233dd08036fe34a89c7dc6f47a8bf2eb29eb upstream.

Otherwise the code races with munmap (causing a use-after-free
of the vma) or with close (causing a use-after-free of the struct
file).

The bug was introduced by commit 90ed52ebe481 ("[PATCH] holepunch: fix
mmap_sem i_mutex deadlock")

Cc: Hugh Dickins <hugh@veritas.com>
Cc: Miklos Szeredi <mszeredi@suse.cz>
Cc: Badari Pulavarty <pbadari@us.ibm.com>
Cc: Nick Piggin <npiggin@suse.de>
Signed-off-by: Andy Lutomirski <luto@amacapital.net>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
[bwh: Backported to 3.2:
 - Adjust context
 - madvise_remove() calls vmtruncate_range(), not do_fallocate()]
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
sock_diag: Fix out-of-bounds access to sock_diag_handlers[]

Userland can send a netlink message requesting SOCK_DIAG_BY_FAMILY
with a family greater or equal then AF_MAX -- the array size of
sock_diag_handlers[]. The current code does not test for this
condition therefore is vulnerable to an out-of-bound access opening
doors for a privilege escalation.

Signed-off-by: Mathias Krause <minipli <at> googlemail.com>