ALSA: core: Fix crash by avoiding appl_ptr crossing 32-bit boundary

Incase of A2DP usecase using proxy driver, appl_ptr has
boundary value as 0x60000000 frames in sw_params for stereo(2 channels).
When this value crosses 0x40000000, then userspace calculating
appl_ptr at bytes results in crossing 32-bit value 0x100000000,
and points to 0x0 offset which can result in crash or pop.
To avoid above scenario, set the sw_params appl_ptr boundary value
within 0x40000000. Added proper check at sw_params update
to set this value correctly within 32-bit boundary(frames).

Change-Id: I537a04156699d90549a0a468ae19539ecd552d3b
CRs-Fixed: 483203
Signed-off-by: Laxminath Kasam <lkasam@codeaurora.org>
sock_diag: Fix out-of-bounds access to sock_diag_handlers[]

Userland can send a netlink message requesting SOCK_DIAG_BY_FAMILY
with a family greater or equal then AF_MAX -- the array size of
sock_diag_handlers[]. The current code does not test for this
condition therefore is vulnerable to an out-of-bound access opening
doors for a privilege escalation.

CRs-fixed: 519050
Change-Id: I1466c4f56f3f4df90cf8a1ae17afa80c89b813e8
Git-repo: git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
Git-commit: 6e601a53566d84e1ffd25e7b6fe0b6894ffd79c0
Signed-off-by: Mathias Krause <minipli@googlemail.com>
Acked-by: Eric Dumazet <edumazet@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sarang Joshi <spjoshi@codeaurora.org>
ARM: 7527/1: uaccess: explicitly check __user pointer when !CPU_USE_DOMAINS

The {get,put}_user macros don't perform range checking on the provided
__user address when !CPU_HAS_DOMAINS.

This patch reworks the out-of-line assembly accessors to check the user
address against a specified limit, returning -EFAULT if is is out of
range.

[will: changed get_user register allocation to match put_user]
[rmk: fixed building on older ARM architectures]

CRs-Fixed: 504011
Change-Id: I3818045a136fcdf72deb1371b132e090fd7ed643
Reported-by: Catalin Marinas <catalin.marinas@arm.com>
Signed-off-by: Will Deacon <will.deacon@arm.com>
Cc: stable@vger.kernel.org
Signed-off-by: Russell King <rmk+kernel@arm.linux.org.uk>
Git-commit: 8404663f81d212918ff85f493649a7991209fa04
Git-repo: git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
Signed-off-by: Laura Abbott <lauraa@codeaurora.org>
ASoC:msm: Increase Proxy buffering

-Proxy buffering can overflow if BT
playback setup takes a lot of time
-Fix this by increasing the proxy
buffer size so that we will end
up buffering the additional data that
can come in during this time

Change-Id: I736937ad03684a3b9aff586b8f676ec60259a442
Signed-off-by: Alexy Joseph <alexyj@codeaurora.org>
seq_file: Allocate memory using vmalloc when kmalloc failed

When dumpstate access /proc/xxx/binder, this binder include lots of info,
it will use seq_read in kernel, in this function, it will trigger
high order memory alloc, when read binder info or other large file,
this will cause memory presure when system don't have contious high order
memory, it will lead to high kswap workload to reclaim the page. so change
kmalloc to vmalloc, it can avoid contiously high order memory allocating.

CRs-fixed: 514982

Change-Id: I463d5f72c24b7bb298e14b0da49c5fc96091ecc1
Patch-mainline: linux-arm-kernel(lkml) @ Thu, 31 Jan 2013 14:11:32 +0800
Link : https://lkml.org/lkml/2013/1/31/20
Signed-off-by: Srinivasarao P <spathi@codeaurora.org>
msm: kgsl: Fix long IB time calculation problem.

Remove unnecessary addition of GPU used time to calculate
IB duration.

Change-Id: Ic7e18882038f21a087a2348d6f4fab5aed2bb8cf
Signed-off-by: Rajesh Kemisetti <rajeshk@codeaurora.org>
msm: kgsl: Set alignment to 0 when low on mapped memory

If CPU map returns error due to low memory then we need to set
the alignment to 0 and instead of setting it to PAGE_OFFSET. This
is because we then simply search of a free memory gap at page
boundary and disrerard alignment requirement since memory is
low.

Change-Id: I828f5d0120d6d530e0e8857bcd96c9d5f266da10
Signed-off-by: Shubhraprakash Das <sadas@codeaurora.org>
msm: kgsl: Set proper pagetable address immediately after recovery

Update the MMU with proper pagetable address immediately after
recovery to avoid any translations with old pagetable.

Change-Id: Ib929598363e48a42b8ae174ed9718402541f5b09
Signed-off-by: Rajesh Kemisetti <rajeshk@codeaurora.org>
msm: kgsl: Don't refer the NULL context

This fix ensure the BIRT test case will not
cause any device crash.

Change-Id: Ibbcdca293f4da05b21d16674f605aac729905959
Signed-off-by: Hareesh Gundu <hareeshg@codeaurora.org>
m7: Improve resume performance

 * Fix various delays, disable unsupported MDP footswitch.
 * Add fix from stock for resuming with multiple cores

Change-Id: Ia38bd3ac04ea091b3320ba6d206f5efcc34c4d5c
m7: Update defconfig

 * Enable various standard options for performance and debugging

Change-Id: I547b11c08e217eb95b3b2b853b59ff2403b1f676
msm: kgsl: GPU fault tolerance timer

GPU fault tolerance timer with a 50ms interval is introduced to detect
the condition where GPU is stalled, when GPU state is active we check
for GPU stall and if a stall is detected fault tolerance is triggered.
Using a timer is a better design because this removes dependency
on userspace to call waittimestamp.

Conflicts:

    drivers/gpu/msm/adreno.c
    drivers/gpu/msm/kgsl_pwrctrl.c

CRs-Fixed: 477979
Change-Id: I22b1316ad3edb271c1241b93e7a36373dfc70234
Signed-off-by: Tarun Karra <tkarra@codeaurora.org>
Signed-off-by: Hareesh Gundu <hareeshg@codeaurora.org>
msm: kgsl: Check long IB only for valid context

Do not check for long IB if the hang is detected in a NULL context,
hang in NULL context can happen when we are switching from NULL to
active context and hang is detected in commands that write an
active context to memstore, long IB in this scenario is not possible.

Change-Id: I7711c86b91c6c2ce0b4aa0543572c26d10c83030
Signed-off-by: Tarun Karra <tkarra@codeaurora.org>
Signed-off-by: Hareesh Gundu <hareeshg@codeaurora.org>
gpu: msm: Use correct timeout in ringbuffer drain

Change-Id: I0ff266cdcf10e2e803490692d3cc2db635f81a25
m7: Resync GPU configuration with upstream

Change-Id: If38e295240f0dc8760640bd1a17ba1f8f8cf7f76

Conflicts:
	arch/arm/mach-msm/board-m7-gpu.c
trace: cpu_freq_switch: Add profiler for CPU frequency switch times

It is sometimes useful to profile how long CPU frequency switches
take, and traces have already been added for this purpose. Make
use of these and the trace_stat framework to generate statistical
histograms of frequency switch times in the following format:

 # cat /sys/kernel/debug/tracing/trace_stat/cpu_freq_switch
  CPU START_KHZ  END_KHZ COUNT AVG_US MIN_US MAX_US
    |         |        |     |      |      |      |
    0    384000  1512000     3   2787   1648   3418
    0    486000   384000     1   1129   1129   1129
    0   1458000   384000     1   3174   3174   3174
    0   1512000   384000     1   3265   3265   3265
    0   1512000   486000     1   3235   3235   3235
    0   1512000  1458000     1    213    213    213
    0   1512000  1512000     1      0      0      0

Profiling is disabled by default (since it does incur some
overhead). It can be enabled or re-disabled echoing 1 or 0
to /sys/kernel/debug/tracing/cpu_freq_switch_profile_enabled

Change-Id: I3ef7f9d681b7bd13bcaa031003b10312afe1aefe
Signed-off-by: Matt Wagantall <mattw@codeaurora.org>
(cherry picked from commit a629fb0b67b57cc6759da51b9c12750758736c80)
trace: power: add cpu_frequency_switch_{start, end}

It is sometimes useful to profile how long CPU frequency switches
take, since they often involve variable overhead (PLL lock times,
voltage increase time, etc.). Add additional traces to to make this
possible.

Since the overhead involved may differ based on the frequencies
being switched between, record both the start and the end frequencies
as part of the trace.

Change-Id: I2de743fc357dad3590fd4980f65f38f6073d426e
Signed-off-by: Matt Wagantall <mattw@codeaurora.org>
(cherry picked from commit 0fe22de09613ce497561f51151b2c50b6c4a1c3e)
(cherry picked from commit 9ab0adbcac4df4d681617a8368329d2f4cad4171)
tracing: ftrace events for user faults and undefined instructions

New ftrace events (user_fault and undef_instr) for data, prefetch
or undefined instruction aborts. The new ftrace events are under
events/exception.

Change-Id: Iea328b71a1f623861cac9b45d858c3bbe09e1b82
Signed-off-by: Pushkar Joshi <pushkarj@codeaurora.org>
drivers: cpufreq: Send a uevent when governor changes

 * Useful so userspace tools can reconfigure.

Change-Id: Ib423910b8b9ac791ebe81a75bf399f58272f64f2