futex: Add another early deadlock detection check

commit 866293ee54227584ffcb4a42f69c1f365974ba7f upstream.

Dave Jones trinity syscall fuzzer exposed an issue in the deadlock
detection code of rtmutex:
  http://lkml.kernel.org/r/20140429151655.GA14277@redhat.com

That underlying issue has been fixed with a patch to the rtmutex code,
but the futex code must not call into rtmutex in that case because
    - it can detect that issue early
    - it avoids a different and more complex fixup for backing out

If the user space variable got manipulated to 0x80000000 which means
no lock holder, but the waiters bit set and an active pi_state in the
kernel is found we can figure out the recursive locking issue by
looking at the pi_state owner. If that is the current task, then we
can safely return -EDEADLK.

The check should have been added in commit 59fa62451 (futex: Handle
futex_pi OWNER_DIED take over correctly) already, but I did not see
the above issue caused by user space manipulation back then.

Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Cc: Dave Jones <davej@redhat.com>
Cc: Linus Torvalds <torvalds@linux-foundation.org>
Cc: Peter Zijlstra <peterz@infradead.org>
Cc: Darren Hart <darren@dvhart.com>
Cc: Davidlohr Bueso <davidlohr@hp.com>
Cc: Steven Rostedt <rostedt@goodmis.org>
Cc: Clark Williams <williams@redhat.com>
Cc: Paul McKenney <paulmck@linux.vnet.ibm.com>
Cc: Lai Jiangshan <laijs@cn.fujitsu.com>
Cc: Roland McGrath <roland@hack.frob.com>
Cc: Carlos ODonell <carlos@redhat.com>
Cc: Jakub Jelinek <jakub@redhat.com>
Cc: Michael Kerrisk <mtk.manpages@gmail.com>
Cc: Sebastian Andrzej Siewior <bigeasy@linutronix.de>
Link: http://lkml.kernel.org/r/20140512201701.097349971@linutronix.de
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

Conflicts:
	kernel/futex.c

Change-Id: Iee5dc11c39019eef9707d47c20d952f65ff41ad6
perf: remove duplicate call when removing per cpu events

* derp, adcd5a5 forgot to remove it - could be bad if left in there

Change-Id: Iee5dc11c39019eef9707d47c20d952f65ff41ad7
futexes: Increase hash table size for better performance

Currently, the futex global hash table suffers from its fixed,
smallish (for today's standards) size of 256 entries, as well as
its lack of NUMA awareness. Large systems, using many futexes,
can be prone to high amounts of collisions; where these futexes
hash to the same bucket and lead to extra contention on the same
hb->lock. Furthermore, cacheline bouncing is a reality when we
have multiple hb->locks residing on the same cacheline and
different futexes hash to adjacent buckets.

This patch keeps the current static size of 16 entries for small
systems, or otherwise, 256 * ncpus (or larger as we need to
round the number to a power of 2). Note that this number of CPUs
accounts for all CPUs that can ever be available in the system,
taking into consideration things like hotpluging. While we do
impose extra overhead at bootup by making the hash table larger,
this is a one time thing, and does not shadow the benefits of
this patch.

Furthermore, as suggested by tglx, by cache aligning the hash
buckets we can avoid access across cacheline boundaries and also
avoid massive cache line bouncing if multiple cpus are hammering
away at different hash buckets which happen to reside in the
same cache line.

Also, similar to other core kernel components (pid, dcache,
tcp), by using alloc_large_system_hash() we benefit from its
NUMA awareness and thus the table is distributed among the nodes
instead of in a single one.

For a custom microbenchmark that pounds on the uaddr hashing --
making the wait path fail at futex_wait_setup() returning
-EWOULDBLOCK for large amounts of futexes, we can see the
following benefits on a 80-core, 8-socket 1Tb server:

 +---------+--------------------+------------------------+-----------------------+-------------------------------+
 | threads | baseline (ops/sec) | aligned-only (ops/sec) | large table (ops/sec) | large table+aligned (ops/sec) |
 +---------+--------------------+------------------------+-----------------------+-------------------------------+
 |     512 |              32426 | 50531  (+55.8%)        | 255274  (+687.2%)     | 292553  (+802.2%)             |
 |     256 |              65360 | 99588  (+52.3%)        | 443563  (+578.6%)     | 508088  (+677.3%)             |
 |     128 |             125635 | 200075 (+59.2%)        | 742613  (+491.1%)     | 835452  (+564.9%)             |
 |      80 |             193559 | 323425 (+67.1%)        | 1028147 (+431.1%)     | 1130304 (+483.9%)             |
 |      64 |             247667 | 443740 (+79.1%)        | 997300  (+302.6%)     | 1145494 (+362.5%)             |
 |      32 |             628412 | 721401 (+14.7%)        | 965996  (+53.7%)      | 1122115 (+78.5%)              |
 +---------+--------------------+------------------------+-----------------------+-------------------------------+

Reviewed-by: Darren Hart <dvhart@linux.intel.com>
Reviewed-by: Peter Zijlstra <peterz@infradead.org>
Reviewed-by: Paul E. McKenney <paulmck@linux.vnet.ibm.com>
Reviewed-by: Waiman Long <Waiman.Long@hp.com>
Reviewed-and-tested-by: Jason Low <jason.low2@hp.com>
Reviewed-by: Thomas Gleixner <tglx@linutronix.de>
Signed-off-by: Davidlohr Bueso <davidlohr@hp.com>
Cc: Mike Galbraith <efault@gmx.de>
Cc: Jeff Mahoney <jeffm@suse.com>
Cc: Linus Torvalds <torvalds@linux-foundation.org>
Cc: Scott Norton <scott.norton@hp.com>
Cc: Tom Vaden <tom.vaden@hp.com>
Cc: Aswin Chandramouleeswaran <aswin@hp.com>
Link: http://lkml.kernel.org/r/1389569486-25487-3-git-send-email-davidlohr@hp.com
Signed-off-by: Ingo Molnar <mingo@kernel.org>
Signed-off-by: Paul Reioux <reioux@gmail.com>

Modified for Nexus 9

Signed-off-by: Paul Reioux <reioux@gmail.com>

Conflicts:
	kernel/futex.c

Conflicts:
	kernel/futex.c

Conflicts:
	kernel/futex.c

Change-Id: If6cf6e35942947e0e96d5c20acfe98c68cc7c6c8
futex-prevent-requeue-pi-on-same-futex.patch futex: Forbid uaddr == u…

…addr2 in futex_requeue(..., requeue_pi=1)

If uaddr == uaddr2, then we have broken the rule of only requeueing from
a non-pi futex to a pi futex with this call.  If we attempt this, then
dangling pointers may be left for rt_waiter resulting in an exploitable
condition.

This change brings futex_requeue() in line with futex_wait_requeue_pi()
which performs the same check as per commit 6f7b0a2a5c0f ("futex: Forbid
uaddr == uaddr2 in futex_wait_requeue_pi()")

[ tglx: Compare the resulting keys as well, as uaddrs might be
  	different depending on the mapping ]

Fixes CVE-2014-3153.

Change-Id: I3d40911aca262eaefc3852327fa12bec416cd27d
Reported-by: Pinkie Pie
Signed-off-by: Will Drewry <wad@chromium.org>
Signed-off-by: Kees Cook <keescook@chromium.org>
Cc: stable@vger.kernel.org
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Reviewed-by: Darren Hart <dvhart@linux.intel.com>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
drv2605: expose vibrator to kernel
disable crc check

Signed-off-by: flar2 <asegaert@gmail.com>
Added fsync on/off support.

Signed-off-by: Francisco Franco <franciscofranco.1990@gmail.com>
Signed-off-by: flar2 <asegaert@gmail.com>
soc: qcom: smd: Register SMD & SMSM IRQs with IRQF_NO_SUSPEND flag

During system suspend/resume path IRQs are temporarily disabled unless
the IRQF_NO_SUSPEND flag is specified. If a wakeup-enabled interrupt
comes in during this timeframe, it will be masked until the suspend
process is complete leading to delayed processing.

Register the SMD and SMSM wakeup enable IRQs with IRQF_NO_SUSPEND flags
to avoid delaying the interrupt during system suspend/resume path.

CRs-Fixed: 724932
Change-Id: Ib93c911f4a4e70638ebf23bc22ee7f5a685dca70
Signed-off-by: Arun Kumar Neelakantam <aneela@codeaurora.org>
Signed-off-by: flar2 <asegaert@gmail.com>
qcom: rpm-smd: Mask the interrupt before sending the sleep set.

Sending a sleep set would cause an SMD interrupt to fire. If the
interrupt was previously affine to a different CPU, it could cause a
premature wakeup of that CPU. Prevent this by masking the interrupt
before sending the sleep set.

Change-Id: I45734c6fa52b7f69c0d68c5b3cd221185a516248
Signed-off-by: Mahesh Sivasubramanian <msivasub@codeaurora.org>
Signed-off-by: flar2 <asegaert@gmail.com>
net: wireless: bcmdhd: Enable dongle_isolation for PCIe/built-in type driver

b/17755061 Wi-Fi stuck in Off position

Signed-off-by: Ritter Yeh <ryeh@broadcom.com>
Signed-off-by: Iliyan Malchev <malchev@google.com>
Change-Id: I70dc1385266fe26ef3a57116e653efab03fc33cf
Signed-off-by: flar2 <asegaert@gmail.com>
net: wirelss: bcmdhd fixed pcie suspend/resume issue

Sometimes, system doesn't recover the config registers during resume
due to wakelock.  So, we need to save and restore the config registers in DHD

b/18220535 [WiFi] - Watchdog reset after PCIE link down and Event Hang

Signed-off-by: Ecco park <eccopark@broadcom.com>
Change-Id: Ib796b4833119a27bd79e3a667e40ee1e4d4878df
Signed-off-by: flar2 <asegaert@gmail.com>
net: wireless: bcmdhd: Allow preallocation for WLFC_INFO

Bug: 18303260

Change-Id: I1602fa0706270071abe36797039af74670f1c734
Signed-off-by: Dmitry Shmidt <dimitrysh@google.com>

Conflicts:
	drivers/net/wireless/bcmdhd/Makefile
Signed-off-by: flar2 <asegaert@gmail.com>
net: wireless: bcmdhd enable STATIC MEMORY ALLOCATION

b/18187102 APR: kernel BUG at mm/vmalloc.c
Signed-off-by: Ecco park <eccopark@broadcom.com>
Signed-off-by: Iliyan Malchev <malchev@google.com>
Change-Id: I9b53792487a0078ecd3240ad92e96dd702a1724b
Signed-off-by: flar2 <asegaert@gmail.com>
net: wirelss: bcmdhd fixed disconnect issue for connecting status

Sometimes Framework issues connect and disconnect rapidly and continuously
with different APs.  In this case, the timing gap between connect and
disconnect is less than 20ms.  For this scenario, FW doesn't do anything
when DHD executes dissasoc while state of FW is associating status.  In
order to cancel current assoc procedure correctly, we need to call
scan_abort function, not DISASSOC.  FW will clean up ongoing assoc
procedure if FW is associating status.

b/18470879 Device stop responding after conducting rapid fire testing
           for making connection

Change-Id: Ib440da06eb10313c478c004d1d73ed1b4e29a201
Signed-off-by: Ecco park <eccopark@broadcom.com>
Signed-off-by: Iliyan Malchev <malchev@google.com>

Conflicts:
	drivers/net/wireless/bcmdhd/wl_cfg80211.c
Signed-off-by: flar2 <asegaert@gmail.com>
net: wirelss: bcmdhd fix roaming bug

1) Bug : 18541286 wifi stuck on connected to an AP when N6 was miles away
we should update BSSID in wl_bss_roaming_done, not wl_notify_status for roaming case
It causes out-of-sync between FW and DHD
Signed-off-by: Ecco park <eccopark@broadcom.com>

Change-Id: I75e706d63aa962c8c2640797e2af6811990c989d
Signed-off-by: flar2 <asegaert@gmail.com>
net: wireless: bcmdhd abort ongoing-scan for disconnection

sometimes we cannot get WLC_E_DEAUTH due to ongoing-scan
We need to abort ongoing-scan for disconnection

Bug: 18634452
Signed-off-by: Ecco park <eccopark@broadcom.com>
Change-Id: I2c416738418ce4915dcfbaa57bb3d701269eecc8
Signed-off-by: flar2 <asegaert@gmail.com>
net: wireless: bcmdhd reduce kernel logging

Bug : 18226601
Signed-off-by: Ecco park <eccopark@broadcom.com>

Change-Id: Iec8172bf803b76517136d1a8903027b5ed162d31
Signed-off-by: flar2 <asegaert@gmail.com>
Revert "qcom: rpm-smd: Mask the interrupt before sending the sleep set."

This reverts commit 2ec46991c8364772259a162d865eb930f472d805.
Revert "soc: qcom: smd: Register SMD & SMSM IRQs with IRQF_NO_SUSPEND flag"

This reverts commit de4ed2c1e92c2bef6b4006b4f0f8d3403d27566d.
msm: kgsl: enable CPU IRQ while suspending context

Make sure that CPU interrupt is enabled before calling adreno
suspend_context when moving from NAP/SLEEP to SLUMBER state.
We send commands to GPU in adreno_drawctxt_switch() which will generate
GPU interrupt. Since CPU interrupt is not enabled, adreno_idle() will
fail because pending interrupt will not be served by CPU this causes
false GPU hang.

CRs-Fixed: 547813

Change-Id: Ia4b730b8f8cda1e820f571ffb7ddb00336ca1a8c
Signed-off-by: Gaurav Gagrani <ggagrani@codeaurora.org>
Signed-off-by: flar2 <asegaert@gmail.com>