Merge android-4.4.177 (0c3b8c4) into msm-4.4

* refs/heads/tmp-0c3b8c4
  Linux 4.4.177
  KVM: X86: Fix residual mmio emulation request to userspace
  KVM: nVMX: Ignore limit checks on VMX instructions using flat segments
  KVM: nVMX: Sign extend displacements of VMX instr's mem operands
  drm/radeon/evergreen_cs: fix missing break in switch statement
  media: uvcvideo: Avoid NULL pointer dereference at the end of streaming
  rcu: Do RCU GP kthread self-wakeup from softirq and interrupt
  PM / wakeup: Rework wakeup source timer cancellation
  nfsd: fix wrong check in write_v4_end_grace()
  nfsd: fix memory corruption caused by readdir
  NFS: Don't recoalesce on error in nfs_pageio_complete_mirror()
  NFS: Fix an I/O request leakage in nfs_do_recoalesce
  md: Fix failed allocation of md_register_thread
  perf intel-pt: Fix overlap calculation for padding
  perf auxtrace: Define auxtrace record alignment
  perf intel-pt: Fix CYC timestamp calculation after OVF
  NFS41: pop some layoutget errors to application
  dm: fix to_sector() for 32bit
  ARM: s3c24xx: Fix boolean expressions in osiris_dvs_notify
  powerpc/83xx: Also save/restore SPRG4-7 during suspend
  powerpc/powernv: Make opal log only readable by root
  powerpc/wii: properly disable use of BATs when requested.
  powerpc/32: Clear on-stack exception marker upon exception return
  jbd2: fix compile warning when using JBUFFER_TRACE
  jbd2: clear dirty flag when revoking a buffer from an older transaction
  serial: 8250_pci: Have ACCES cards that use the four port Pericom PI7C9X7954 chip use the pci_pericom_setup()
  serial: 8250_pci: Fix number of ports for ACCES serial cards
  perf bench: Copy kernel files needed to build mem{cpy,set} x86_64 benchmarks
  i2c: tegra: fix maximum transfer size
  parport_pc: fix find_superio io compare code, should use equal test.
  intel_th: Don't reference unassigned outputs
  kernel/sysctl.c: add missing range check in do_proc_dointvec_minmax_conv
  mm/vmalloc: fix size check for remap_vmalloc_range_partial()
  dmaengine: usb-dmac: Make DMAC system sleep callbacks explicit
  clk: ingenic: Fix round_rate misbehaving with non-integer dividers
  ext2: Fix underflow in ext2_max_size()
  ext4: fix crash during online resizing
  cpufreq: pxa2xx: remove incorrect __init annotation
  cpufreq: tegra124: add missing of_node_put()
  crypto: pcbc - remove bogus memcpy()s with src == dest
  Btrfs: fix corruption reading shared and compressed extents after hole punching
  btrfs: ensure that a DUP or RAID1 block group has exactly two stripes
  m68k: Add -ffreestanding to CFLAGS
  scsi: target/iscsi: Avoid iscsit_release_commands_from_conn() deadlock
  scsi: virtio_scsi: don't send sc payload with tmfs
  s390/virtio: handle find on invalid queue gracefully
  clocksource/drivers/exynos_mct: Clear timer interrupt when shutdown
  clocksource/drivers/exynos_mct: Move one-shot check from tick clear to ISR
  regulator: s2mpa01: Fix step values for some LDOs
  regulator: s2mps11: Fix steps for buck7, buck8 and LDO35
  ACPI / device_sysfs: Avoid OF modalias creation for removed device
  tracing: Do not free iter->trace in fail path of tracing_open_pipe()
  CIFS: Fix read after write for files with read caching
  crypto: arm64/aes-ccm - fix logical bug in AAD MAC handling
  stm class: Prevent division by zero
  tmpfs: fix uninitialized return value in shmem_link
  net: set static variable an initial value in atl2_probe()
  mac80211_hwsim: propagate genlmsg_reply return code
  phonet: fix building with clang
  ARC: uacces: remove lp_start, lp_end from clobber list
  tmpfs: fix link accounting when a tmpfile is linked in
  arm64: Relax GIC version check during early boot
  ASoC: topology: free created components in tplg load error
  net: mv643xx_eth: disable clk on error path in mv643xx_eth_shared_probe()
  pinctrl: meson: meson8b: fix the sdxc_a data 1..3 pins
  net: systemport: Fix reception of BPDUs
  scsi: libiscsi: Fix race between iscsi_xmit_task and iscsi_complete_task
  assoc_array: Fix shortcut creation
  ARM: 8824/1: fix a migrating irq bug when hotplug cpu
  Input: st-keyscan - fix potential zalloc NULL dereference
  i2c: cadence: Fix the hold bit setting
  Input: matrix_keypad - use flush_delayed_work()
  ARM: OMAP2+: Variable "reg" in function omap4_dsi_mux_pads() could be uninitialized
  s390/dasd: fix using offset into zero size array error
  gpu: ipu-v3: Fix CSI offsets for imx53
  gpu: ipu-v3: Fix i.MX51 CSI control registers offset
  crypto: ahash - fix another early termination in hash walk
  crypto: caam - fixed handling of sg list
  stm class: Fix an endless loop in channel allocation
  ASoC: fsl_esai: fix register setting issue in RIGHT_J mode
  9p/net: fix memory leak in p9_client_create
  9p: use inode->i_lock to protect i_size_write() under 32-bit
  media: videobuf2-v4l2: drop WARN_ON in vb2_warn_zero_bytesused()
  It's wrong to add len to sector_nr in raid10 reshape twice
  fs/9p: use fscache mutex rather than spinlock
  ALSA: bebob: use more identical mod_alias for Saffire Pro 10 I/O against Liquid Saffire 56
  tcp/dccp: remove reqsk_put() from inet_child_forget()
  gro_cells: make sure device is up in gro_cells_receive()
  net/hsr: fix possible crash in add_timer()
  vxlan: Fix GRO cells race condition between receive and link delete
  vxlan: test dev->flags & IFF_UP before calling gro_cells_receive()
  ipvlan: disallow userns cap_net_admin to change global mode/flags
  missing barriers in some of unix_sock ->addr and ->path accesses
  net: Set rtm_table to RT_TABLE_COMPAT for ipv6 for tables > 255
  mdio_bus: Fix use-after-free on device_register fails
  net/x25: fix a race in x25_bind()
  net/mlx4_core: Fix qp mtt size calculation
  net/mlx4_core: Fix reset flow when in command polling mode
  tcp: handle inet_csk_reqsk_queue_add() failures
  route: set the deleted fnhe fnhe_daddr to 0 in ip_del_fnhe to fix a race
  ravb: Decrease TxFIFO depth of Q3 and Q2 to one
  pptp: dst_release sk_dst_cache in pptp_sock_destruct
  net/x25: reset state in x25_connect()
  net/x25: fix use-after-free in x25_device_event()
  net: sit: fix UBSAN Undefined behaviour in check_6rd
  net: hsr: fix memory leak in hsr_dev_finalize()
  l2tp: fix infoleak in l2tp_ip6_recvmsg()
  KEYS: restrict /proc/keys by credentials at open time
  netfilter: nf_conntrack_tcp: Fix stack out of bounds when parsing TCP options
  netfilter: nfnetlink_acct: validate NFACCT_FILTER parameters
  netfilter: nfnetlink_log: just returns error for unknown command
  netfilter: x_tables: enforce nul-terminated table name from getsockopt GET_ENTRIES
  udplite: call proper backlog handlers
  ARM: dts: exynos: Do not ignore real-world fuse values for thermal zone 0 on Exynos5420
  Revert "x86/platform/UV: Use efi_runtime_lock to serialise BIOS calls"
  ARM: dts: exynos: Add minimal clkout parameters to Exynos3250 PMU
  futex,rt_mutex: Restructure rt_mutex_finish_proxy_lock()
  iscsi_ibft: Fix missing break in switch statement
  Input: elan_i2c - add id for touchpad found in Lenovo s21e-20
  Input: wacom_serial4 - add support for Wacom ArtPad II tablet
  MIPS: Remove function size check in get_frame_info()
  perf symbols: Filter out hidden symbols from labels
  s390/qeth: fix use-after-free in error path
  dmaengine: dmatest: Abort test in case of mapping error
  dmaengine: at_xdmac: Fix wrongfull report of a channel as in use
  irqchip/mmp: Only touch the PJ4 IRQ & FIQ bits on enable/disable
  ARM: pxa: ssp: unneeded to free devm_ allocated data
  autofs: fix error return in autofs_fill_super()
  autofs: drop dentry reference only when it is never used
  fs/drop_caches.c: avoid softlockups in drop_pagecache_sb()
  mm, memory_hotplug: test_pages_in_a_zone do not pass the end of zone
  mm, memory_hotplug: is_mem_section_removable do not pass the end of a zone
  x86_64: increase stack size for KASAN_EXTRA
  x86/kexec: Don't setup EFI info if EFI runtime is not enabled
  cifs: fix computation for MAX_SMB2_HDR_SIZE
  platform/x86: Fix unmet dependency warning for SAMSUNG_Q10
  scsi: libfc: free skb when receiving invalid flogi resp
  nfs: Fix NULL pointer dereference of dev_name
  gpio: vf610: Mask all GPIO interrupts
  net: stmmac: dwmac-rk: fix error handling in rk_gmac_powerup()
  net: hns: Fix wrong read accesses via Clause 45 MDIO protocol
  net: altera_tse: fix msgdma_tx_completion on non-zero fill_level case
  xtensa: SMP: limit number of possible CPUs by NR_CPUS
  xtensa: SMP: mark each possible CPU as present
  xtensa: smp_lx200_defconfig: fix vectors clash
  xtensa: SMP: fix secondary CPU initialization
  xtensa: SMP: fix ccount_timer_shutdown
  iommu/amd: Fix IOMMU page flush when detach device from a domain
  ipvs: Fix signed integer overflow when setsockopt timeout
  IB/{hfi1, qib}: Fix WC.byte_len calculation for UD_SEND_WITH_IMM
  perf tools: Handle TOPOLOGY headers with no CPU
  vti4: Fix a ipip packet processing bug in 'IPCOMP' virtual tunnel
  media: uvcvideo: Fix 'type' check leading to overflow
  ip6mr: Do not call __IP6_INC_STATS() from preemptible context
  net: dsa: mv88e6xxx: Fix u64 statistics
  netlabel: fix out-of-bounds memory accesses
  hugetlbfs: fix races and page leaks during migration
  MIPS: irq: Allocate accurate order pages for irq stack
  applicom: Fix potential Spectre v1 vulnerabilities
  x86/CPU/AMD: Set the CPB bit unconditionally on F17h
  net: phy: Micrel KSZ8061: link failure after cable connect
  net: avoid use IPCB in cipso_v4_error
  net: Add __icmp_send helper.
  xen-netback: fix occasional leak of grant ref mappings under memory pressure
  net: nfc: Fix NULL dereference on nfc_llcp_build_tlv fails
  bnxt_en: Drop oversize TX packets to prevent errors.
  team: Free BPF filter when unregistering netdev
  sky2: Disable MSI on Dell Inspiron 1545 and Gateway P-79
  net-sysfs: Fix mem leak in netdev_register_kobject
  staging: lustre: fix buffer overflow of string buffer
  isdn: isdn_tty: fix build warning of strncpy
  ncpfs: fix build warning of strncpy
  sockfs: getxattr: Fail with -EOPNOTSUPP for invalid attribute names
  cpufreq: Use struct kobj_attribute instead of struct global_attr
  USB: serial: ftdi_sio: add ID for Hjelmslund Electronics USB485
  USB: serial: cp210x: add ID for Ingenico 3070
  USB: serial: option: add Telit ME910 ECM composition
  x86/uaccess: Don't leak the AC flag into __put_user() value evaluation
  mm: enforce min addr even if capable() in expand_downwards()
  mmc: spi: Fix card detection during probe
  powerpc: Always initialize input array when calling epapr_hypercall()
  KVM: arm/arm64: Fix MMIO emulation data handling
  arm/arm64: KVM: Feed initialized memory to MMIO accesses
  KVM: nSVM: clear events pending from svm_complete_interrupts() when exiting to L1
  cfg80211: extend range deviation for DMG
  mac80211: don't initiate TDLS connection if station is not associated to AP
  ibmveth: Do not process frames after calling napi_reschedule
  net: altera_tse: fix connect_local_phy error path
  scsi: csiostor: fix NULL pointer dereference in csio_vport_set_state()
  serial: fsl_lpuart: fix maximum acceptable baud rate with over-sampling
  mac80211: fix miscounting of ttl-dropped frames
  ARC: fix __ffs return value to avoid build warnings
  ASoC: imx-audmux: change snprintf to scnprintf for possible overflow
  ASoC: dapm: change snprintf to scnprintf for possible overflow
  usb: gadget: Potential NULL dereference on allocation error
  usb: dwc3: gadget: Fix the uninitialized link_state when udc starts
  thermal: int340x_thermal: Fix a NULL vs IS_ERR() check
  ALSA: compress: prevent potential divide by zero bugs
  ASoC: Intel: Haswell/Broadwell: fix setting for .dynamic field
  drm/msm: Unblock writer if reader closes file
  scsi: libsas: Fix rphy phy_identifier for PHYs with end devices attached
  libceph: handle an empty authorize reply
  Revert "bridge: do not add port to router list when receives query with source 0.0.0.0"
  ARCv2: Enable unaligned access in early ASM code
  net/mlx4_en: Force CHECKSUM_NONE for short ethernet frames
  sit: check if IPv6 enabled before calling ip6_err_gen_icmpv6_unreach()
  team: avoid complex list operations in team_nl_cmd_options_set()
  net/packet: fix 4gb buffer limit due to overflow check
  batman-adv: fix uninit-value in batadv_interface_tx()
  KEYS: always initialize keyring_index_key::desc_len
  KEYS: user: Align the payload buffer
  RDMA/srp: Rework SCSI device reset handling
  isdn: avm: Fix string plus integer warning from Clang
  leds: lp5523: fix a missing check of return value of lp55xx_read
  atm: he: fix sign-extension overflow on large shift
  isdn: i4l: isdn_tty: Fix some concurrency double-free bugs
  MIPS: jazz: fix 64bit build
  scsi: isci: initialize shost fully before calling scsi_add_host()
  scsi: qla4xxx: check return code of qla4xxx_copy_from_fwddb_param
  MIPS: ath79: Enable OF serial ports in the default config
  net: hns: Fix use after free identified by SLUB debug
  mfd: mc13xxx: Fix a missing check of a register-read failure
  mfd: wm5110: Add missing ASRC rate register
  mfd: qcom_rpm: write fw_version to CTRL_REG
  mfd: ab8500-core: Return zero in get_register_interruptible()
  mfd: db8500-prcmu: Fix some section annotations
  mfd: twl-core: Fix section annotations on {,un}protect_pm_master
  mfd: ti_am335x_tscadc: Use PLATFORM_DEVID_AUTO while registering mfd cells
  KEYS: allow reaching the keys quotas exactly
  numa: change get_mempolicy() to use nr_node_ids instead of MAX_NUMNODES
  ceph: avoid repeatedly adding inode to mdsc->snap_flush_list
  Revert "ANDROID: arm: process: Add display of memory around registers when displaying regs."
  ANDROID: mnt: Propagate remount correctly
  ANDROID: cuttlefish_defconfig: Add support for AC97 audio
  ANDROID: overlayfs: override_creds=off option bypass creator_cred
  FROMGIT: binder: create node flag to request sender's security context

Conflicts:
	arch/arm/kernel/irq.c
	drivers/media/v4l2-core/videobuf2-v4l2.c
	sound/core/compress_offload.c

Change-Id: I998f8d53b0c5b8a7102816034452b1779a3b69a3
Signed-off-by: Srinivasarao P <spathi@codeaurora.org>

4 files changed, 33 insertions, 16 deletions

diff --git a/arch/xtensa/configs/smp_lx200_defconfig b/arch/xtensa/configs/smp_lx200_defconfig
index 22eeacba37cc..199e05f85e89 100644
--- a/arch/xtensa/configs/smp_lx200_defconfig
+++ b/arch/xtensa/configs/smp_lx200_defconfig
@@ -35,6 +35,7 @@ CONFIG_SMP=y
 CONFIG_HOTPLUG_CPU=y
 # CONFIG_INITIALIZE_XTENSA_MMU_INSIDE_VMLINUX is not set
 # CONFIG_PCI is not set
+CONFIG_VECTORS_OFFSET=0x00002000
 CONFIG_XTENSA_PLATFORM_XTFPGA=y
 CONFIG_CMDLINE_BOOL=y
 CONFIG_CMDLINE="earlycon=uart8250,mmio32,0xfd050020,115200n8 console=ttyS0,115200n8 ip=dhcp root=/dev/nfs rw debug"
diff --git a/arch/xtensa/kernel/head.S b/arch/xtensa/kernel/head.S
index c7b3bedbfffe..e3823b4f9d08 100644
--- a/arch/xtensa/kernel/head.S
+++ b/arch/xtensa/kernel/head.S
@@ -286,12 +286,13 @@ should_never_return:
 
 	movi	a2, cpu_start_ccount
 1:
+	memw
 	l32i	a3, a2, 0
 	beqi	a3, 0, 1b
 	movi	a3, 0
 	s32i	a3, a2, 0
-	memw
 1:
+	memw
 	l32i	a3, a2, 0
 	beqi	a3, 0, 1b
 	wsr	a3, ccount
@@ -328,11 +329,13 @@ ENTRY(cpu_restart)
 	rsr	a0, prid
 	neg	a2, a0
 	movi	a3, cpu_start_id
+	memw
 	s32i	a2, a3, 0
 #if XCHAL_DCACHE_IS_WRITEBACK
 	dhwbi	a3, 0
 #endif
 1:
+	memw
 	l32i	a2, a3, 0
 	dhi	a3, 0
 	bne	a2, a0, 1b
diff --git a/arch/xtensa/kernel/smp.c b/arch/xtensa/kernel/smp.c
index 4d02e38514f5..54bb8e0473a0 100644
--- a/arch/xtensa/kernel/smp.c
+++ b/arch/xtensa/kernel/smp.c
@@ -80,7 +80,7 @@ void __init smp_prepare_cpus(unsigned int max_cpus)
 {
 	unsigned i;
 
-	for (i = 0; i < max_cpus; ++i)
+	for_each_possible_cpu(i)
 		set_cpu_present(i, true);
 }
 
@@ -93,6 +93,11 @@ void __init smp_init_cpus(void)
 	pr_info("%s: Core Count = %d\n", __func__, ncpus);
 	pr_info("%s: Core Id = %d\n", __func__, core_id);
 
+	if (ncpus > NR_CPUS) {
+		ncpus = NR_CPUS;
+		pr_info("%s: limiting core count by %d\n", __func__, ncpus);
+	}
+
 	for (i = 0; i < ncpus; ++i)
 		set_cpu_possible(i, true);
 }
@@ -192,9 +197,11 @@ static int boot_secondary(unsigned int cpu, struct task_struct *ts)
 	int i;
 
 #ifdef CONFIG_HOTPLUG_CPU
-	cpu_start_id = cpu;
-	system_flush_invalidate_dcache_range(
-			(unsigned long)&cpu_start_id, sizeof(cpu_start_id));
+	WRITE_ONCE(cpu_start_id, cpu);
+	/* Pairs with the third memw in the cpu_restart */
+	mb();
+	system_flush_invalidate_dcache_range((unsigned long)&cpu_start_id,
+					     sizeof(cpu_start_id));
 #endif
 	smp_call_function_single(0, mx_cpu_start, (void *)cpu, 1);
 
@@ -203,18 +210,21 @@ static int boot_secondary(unsigned int cpu, struct task_struct *ts)
 			ccount = get_ccount();
 		while (!ccount);
 
-		cpu_start_ccount = ccount;
+		WRITE_ONCE(cpu_start_ccount, ccount);
 
-		while (time_before(jiffies, timeout)) {
+		do {
+			/*
+			 * Pairs with the first two memws in the
+			 * .Lboot_secondary.
+			 */
 			mb();
-			if (!cpu_start_ccount)
-				break;
-		}
+			ccount = READ_ONCE(cpu_start_ccount);
+		} while (ccount && time_before(jiffies, timeout));
 
-		if (cpu_start_ccount) {
+		if (ccount) {
 			smp_call_function_single(0, mx_cpu_stop,
-					(void *)cpu, 1);
-			cpu_start_ccount = 0;
+						 (void *)cpu, 1);
+			WRITE_ONCE(cpu_start_ccount, 0);
 			return -EIO;
 		}
 	}
@@ -234,6 +244,7 @@ int __cpu_up(unsigned int cpu, struct task_struct *idle)
 	pr_debug("%s: Calling wakeup_secondary(cpu:%d, idle:%p, sp: %08lx)\n",
 			__func__, cpu, idle, start_info.stack);
 
+	init_completion(&cpu_running);
 	ret = boot_secondary(cpu, idle);
 	if (ret == 0) {
 		wait_for_completion_timeout(&cpu_running,
@@ -295,8 +306,10 @@ void __cpu_die(unsigned int cpu)
 	unsigned long timeout = jiffies + msecs_to_jiffies(1000);
 	while (time_before(jiffies, timeout)) {
 		system_invalidate_dcache_range((unsigned long)&cpu_start_id,
-				sizeof(cpu_start_id));
-		if (cpu_start_id == -cpu) {
+					       sizeof(cpu_start_id));
+		/* Pairs with the second memw in the cpu_restart */
+		mb();
+		if (READ_ONCE(cpu_start_id) == -cpu) {
 			platform_cpu_kill(cpu);
 			return;
 		}
diff --git a/arch/xtensa/kernel/time.c b/arch/xtensa/kernel/time.c
index b9ad9feadc2d..a992cb6a47db 100644
--- a/arch/xtensa/kernel/time.c
+++ b/arch/xtensa/kernel/time.c
@@ -87,7 +87,7 @@ static int ccount_timer_shutdown(struct clock_event_device *evt)
 		container_of(evt, struct ccount_timer, evt);
 
 	if (timer->irq_enabled) {
-		disable_irq(evt->irq);
+		disable_irq_nosync(evt->irq);
 		timer->irq_enabled = 0;
 	}
 	return 0;