msm: socinfo: Add support for socinfo v7

A new socinfo format version 7 is added with support for pmic_model and
pmic_die_revision. Adding the corresponding socinfo API to support them.

Change-Id: I6da3ec41da307c72946945bdb10a31e65205a7e1
Signed-off-by: Jin Hong <jinh@codeaurora.org>
(cherry picked from commit 9b556c3aea6433415759e4af4feda74c58c4c3ad)

Signed-off-by: Sudhir Sharma <sudsha@codeaurora.org>
msm: socinfo: add support for msm8226

Add dummy socinfo and support to get socinfo from bootloader for
msm8226

Signed-off-by: Syed Rameez Mustafa <rameezmustafa@codeaurora.org>
(cherry picked from commit d6084d3139d432f53f8c1b465dd81d7073b7a3c6)

Conflicts:

	arch/arm/mach-msm/include/mach/socinfo.h
	arch/arm/mach-msm/socinfo.c

Change-Id: I945a1ff75706df9220177fc350a568491fb26f5b
Signed-off-by: Sudhir Sharma <sudsha@codeaurora.org>
msm: socinfo: Add support for detecting Krait Pass 3.

Add an API for checking whether the current CPU is Krait
Pass 3.

Signed-off-by: Joel King <joelking@codeaurora.org>
(cherry picked from commit 824bd1f08f70d90239538f1c23e50d2178546ec3)

Change-Id: I628b294a6fe8e61fbb6b888cd4848146f2a71a82
Signed-off-by: Sudhir Sharma <sudsha@codeaurora.org>
msm: socinfo: Add support for APQ8064AB.

Add the SoC ID and cpu_is wrapper for identifying the
APQ8064AB SoC.

Signed-off-by: Jay Chokshi <jchokshi@codeaurora.org>
(cherry picked from commit b2de509d17aa80c58d531b477956f73071a5840e)

Change-Id: I94608a5530eb267d4ed8215164d07c660ace0d31
Signed-off-by: Sudhir Sharma <sudsha@codeaurora.org>
msm: socinfo: Add support for MSM8930AB

Add the MSM SoC ID information and cpu_is function for
supporting the MSM8930AB target.

Change-Id: I669bf77389fde84d2278f132fae804bf77c37b74
Signed-off-by: Stepan Moskovchenko <stepanm@codeaurora.org>
Signed-off-by: Neha Pandey <nehap@codeaurora.org>
msm: socinfo: Add missing MSM8930AA ID

Add a missing MSM8930AA SoC identifier.

Change-Id: Ia6eaca2d2d7ea488252c0c45287bd4d0b192eed4
Signed-off-by: Stepan Moskovchenko <stepanm@codeaurora.org>
Signed-off-by: Neha Pandey <nehap@codeaurora.org>
msm: ocmem: Add support for locking and unlocking regions

Add the common infrastucture required for locking and unlocking
OCMEM regions. This works with both the secure processor (TZ) mode
and in non-secure mode.

In non-secure mode the OCMEM driver is responsible for setting up
the region modes, the graphics OCMEM MPU and clearing OCMEM
regions using the DM clearing engine.

Signed-off-by: Naveen Ramaraj <nramaraj@codeaurora.org>
(cherry picked from commit e43d9bb7845ab199ff5242f185304f4e146eca8e)

Conflicts:

	arch/arm/mach-msm/include/mach/ocmem_priv.h
	arch/arm/mach-msm/ocmem_sched.c

Change-Id: I08e6b9788844d3cd583f166e54afd5edf38435dd
Signed-off-by: Sudhir Sharma <sudsha@codeaurora.org>
msm: ocmem: Update the memory macro size for 1K interleaving

OCMEM has 1K interleaving enabled by default when initialized.
Update the memory macro size in the driver to account for this
behavior.

Change-Id: I16821067ff30268e074ead3ec986fb0952f464f5
Signed-off-by: Naveen Ramaraj <nramaraj@codeaurora.org>
(cherry picked from commit 956732ba26cdbe821d0b191eb7d6acc7b9118edc)
(cherry picked from commit 50b1a0ecd05481f8fad9a983e7297c877ceaefda)
msm: ocmem: Turn ON the memory macros in Normal Pass through mode

Currently the default ON state for the OCMEM memory macros is to force
the core and peripheral logic to remain ON. Change this to Normal
Pass-through mode which allows the upstream sleep controller to decide
the actual power state of the macros.

Change-Id: I70464e8fcf699794b403091d2721c3fbed048dc4
Signed-off-by: Naveen Ramaraj <nramaraj@codeaurora.org>
(cherry picked from commit 87e6a9dfab1711e4175819c9a9109a5e85a8bff5)
(cherry picked from commit 4a4bed5c3c4af2566c07ffe7c5db45406d5d1833)
msm: ocmem: Export API symbols to modules

Add EXPORT_SYMBOLS() for OCMEM API functions so that they
can be invoked from dynamically loaded modules.

Signed-off-by: Naveen Ramaraj <nramaraj@codeaurora.org>
(cherry picked from commit fdfb0ccdf25219aa7b19dfe2cd055d8761682233)

Change-Id: I050685cdb6fc963168325894d28fff03f769e9ec
Signed-off-by: Sudhir Sharma <sudsha@codeaurora.org>
msm: spm: Add msm_spm_get_vdd API

Add msm_spm_get_vdd() API to return the core active voltage

Signed-off-by: Praveen Chidambaram <pchidamb@codeaurora.org>
(cherry picked from commit 4133ba1e1c9384910cd6db56130b654af115651d)

Change-Id: I76bcfbcb0eefda09757e9db86ba4adb76a44f2f7
Signed-off-by: Neha Pandey <nehap@codeaurora.org>
msm: spm-v2: Add support for AVS

Changing the voltage with the AVS feature enabled requires
certain care. First, temporarily disable AVS before writing any
registers which would change the voltage. Then kick the PMIC
state machine back to the idle state so that our write to the
VCTL register takes effect immediately. We don't need to check
the state machine for idle, instead we should just confirm that
the SPM has sent the voltage we wanted to send and then we can
program AVS to allow up to 4 12.5mV steps down from the voltage
programmed in VCTL. Once this is all done reenable AVS so that
the voltage can be decreased after the AVS_DELAY counts down.

Change-Id: I1c23fd0549e401152fd16de9032ceaf7c3e067c4
Signed-off-by: Praveen Chidambaram <pchidamb@codeaurora.org>
Signed-off-by: Stephen Boyd <sboyd@codeaurora.org>
Signed-off-by: Anji Jonnala <anjir@codeaurora.org>
msm: spm-v2: Disable AVS operations on unsupported targets

Do not enable/disable AVS on targets where it is not enabled at boot.
Enabling it on targets when AVS isn't enabled and the AVS control
parameters aren't configured, causes undefined behavior and random
crashes.

Change-Id: Id0c4e10618437eed1b383145a6a4f25bbd901647
Signed-off-by: Anji Jonnala <anjir@codeaurora.org>
signal: Define __ARCH_HAS_SA_RESTORER so we know whether to clear sa_restorer

Vaguely based on upstream commit 574c4866e33d 'consolidate kernel-side
struct sigaction declarations'.

flush_signal_handlers() needs to know whether sigaction::sa_restorer
is defined, not whether SA_RESTORER is defined.  Define the
__ARCH_HAS_SA_RESTORER macro to indicate this.

Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
Cc: Al Viro <viro@zeniv.linux.org.uk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
ptrace: introduce signal_wake_up_state() and ptrace_signal_wake_up()

commit 910ffdb18a6408e14febbb6e4b6840fd2c928c82 upstream.

Cleanup and preparation for the next change.

signal_wake_up(resume => true) is overused. None of ptrace/jctl callers
actually want to wakeup a TASK_WAKEKILL task, but they can't specify the
necessary mask.

Turn signal_wake_up() into signal_wake_up_state(state), reintroduce
signal_wake_up() as a trivial helper, and add ptrace_signal_wake_up()
which adds __TASK_TRACED.

This way ptrace_signal_wake_up() can work "inside" ptrace_request()
even if the tracee doesn't have the TASK_WAKEKILL bit set.

Signed-off-by: Oleg Nesterov <oleg@redhat.com>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
ptrace: ensure arch_ptrace/ptrace_request can never race with SIGKILL

commit 9899d11f654474d2d54ea52ceaa2a1f4db3abd68 upstream.

putreg() assumes that the tracee is not running and pt_regs_access() can
safely play with its stack.  However a killed tracee can return from
ptrace_stop() to the low-level asm code and do RESTORE_REST, this means
that debugger can actually read/modify the kernel stack until the tracee
does SAVE_REST again.

set_task_blockstep() can race with SIGKILL too and in some sense this
race is even worse, the very fact the tracee can be woken up breaks the
logic.

As Linus suggested we can clear TASK_WAKEKILL around the arch_ptrace()
call, this ensures that nobody can ever wakeup the tracee while the
debugger looks at it.  Not only this fixes the mentioned problems, we
can do some cleanups/simplifications in arch_ptrace() paths.

Probably ptrace_unfreeze_traced() needs more callers, for example it
makes sense to make the tracee killable for oom-killer before
access_process_vm().

While at it, add the comment into may_ptrace_stop() to explain why
ptrace_stop() still can't rely on SIGKILL and signal_pending_state().

Reported-by: Salman Qazi <sqazi@google.com>
Reported-by: Suleiman Souhlal <suleiman@google.com>
Suggested-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Oleg Nesterov <oleg@redhat.com>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
signal: always clear sa_restorer on execve

commit 2ca39528c01a933f6689cd6505ce65bd6d68a530 upstream.

When the new signal handlers are set up, the location of sa_restorer is
not cleared, leaking a parent process's address space location to
children.  This allows for a potential bypass of the parent's ASLR by
examining the sa_restorer value returned when calling sigaction().

Based on what should be considered "secret" about addresses, it only
matters across the exec not the fork (since the VMAs haven't changed
until the exec).  But since exec sets SIG_DFL and keeps sa_restorer,
this is where it should be fixed.

Given the few uses of sa_restorer, a "set" function was not written
since this would be the only use.  Instead, we use
__ARCH_HAS_SA_RESTORER, as already done in other places.

Example of the leak before applying this patch:

  $ cat /proc/$$/maps
  ...
  7fb9f3083000-7fb9f3238000 r-xp 00000000 fd:01 404469 .../libc-2.15.so
  ...
  $ ./leak
  ...
  7f278bc74000-7f278be29000 r-xp 00000000 fd:01 404469 .../libc-2.15.so
  ...
  1 0 (nil) 0x7fb9f30b94a0
  2 4000000 (nil) 0x7f278bcaa4a0
  3 4000000 (nil) 0x7f278bcaa4a0
  4 0 (nil) 0x7fb9f30b94a0
  ...

[akpm@linux-foundation.org: use SA_RESTORER for backportability]
Signed-off-by: Kees Cook <keescook@chromium.org>
Reported-by: Emese Revfy <re.emese@gmail.com>
Cc: Emese Revfy <re.emese@gmail.com>
Cc: PaX Team <pageexec@freemail.hu>
Cc: Al Viro <viro@zeniv.linux.org.uk>
Cc: Oleg Nesterov <oleg@redhat.com>
Cc: "Eric W. Biederman" <ebiederm@xmission.com>
Cc: Serge Hallyn <serge.hallyn@canonical.com>
Cc: Julien Tinnes <jln@google.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
kernel/signal.c: use __ARCH_HAS_SA_RESTORER instead of SA_RESTORER

commit 522cff142d7d2f9230839c9e1f21a4d8bcc22a4a upstream.

__ARCH_HAS_SA_RESTORER is the preferred conditional for use in 3.9 and
later kernels, per Kees.

Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Cc: Emese Revfy <re.emese@gmail.com>
Cc: Emese Revfy <re.emese@gmail.com>
Cc: PaX Team <pageexec@freemail.hu>
Cc: Al Viro <viro@zeniv.linux.org.uk>
Cc: Oleg Nesterov <oleg@redhat.com>
Cc: "Eric W. Biederman" <ebiederm@xmission.com>
Cc: Serge Hallyn <serge.hallyn@canonical.com>
Cc: Julien Tinnes <jln@google.com>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Cc: Ben Hutchings <ben@decadent.org.uk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Bluetooth: Fix not closing SCO sockets in the BT_CONNECT2 state

commit eb20ff9c91ddcb2d55c1849a87d3db85af5e88a9 upstream.

With deferred setup for SCO, it is possible that userspace closes the
socket when it is in the BT_CONNECT2 state, after the Connect Request is
received but before the Accept Synchonous Connection is sent.

If this happens the following crash was observed, when the connection is
terminated:

[  +0.000003] hci_sync_conn_complete_evt: hci0 status 0x10
[  +0.000005] sco_connect_cfm: hcon ffff88003d1bd800 bdaddr 40:98:4e:32:d7:39 status 16
[  +0.000003] sco_conn_del: hcon ffff88003d1bd800 conn ffff88003cc8e300, err 110
[  +0.000015] BUG: unable to handle kernel NULL pointer dereference at 0000000000000199
[  +0.000906] IP: [<ffffffff810620dd>] __lock_acquire+0xed/0xe82
[  +0.000000] PGD 3d21f067 PUD 3d291067 PMD 0
[  +0.000000] Oops: 0002 [#1] SMP
[  +0.000000] Modules linked in: rfcomm bnep btusb bluetooth
[  +0.000000] CPU 0
[  +0.000000] Pid: 1481, comm: kworker/u:2H Not tainted 3.9.0-rc1-25019-gad82cdd #1 Bochs Bochs
[  +0.000000] RIP: 0010:[<ffffffff810620dd>]  [<ffffffff810620dd>] __lock_acquire+0xed/0xe82
[  +0.000000] RSP: 0018:ffff88003c3c19d8  EFLAGS: 00010002
[  +0.000000] RAX: 0000000000000001 RBX: 0000000000000246 RCX: 0000000000000000
[  +0.000000] RDX: 0000000000000000 RSI: 0000000000000000 RDI: ffff88003d1be868
[  +0.000000] RBP: ffff88003c3c1a98 R08: 0000000000000002 R09: 0000000000000000
[  +0.000000] R10: ffff88003d1be868 R11: ffff88003e20b000 R12: 0000000000000002
[  +0.000000] R13: ffff88003aaa8000 R14: 000000000000006e R15: ffff88003d1be850
[  +0.000000] FS:  0000000000000000(0000) GS:ffff88003e200000(0000) knlGS:0000000000000000
[  +0.000000] CS:  0010 DS: 0000 ES: 0000 CR0: 000000008005003b
[  +0.000000] CR2: 0000000000000199 CR3: 000000003c1cb000 CR4: 00000000000006b0
[  +0.000000] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
[  +0.000000] DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000400
[  +0.000000] Process kworker/u:2H (pid: 1481, threadinfo ffff88003c3c0000, task ffff88003aaa8000)
[  +0.000000] Stack:
[  +0.000000]  ffffffff81b16342 0000000000000000 0000000000000000 ffff88003d1be868
[  +0.000000]  ffffffff00000000 00018c0c7863e367 000000003c3c1a28 ffffffff8101efbd
[  +0.000000]  0000000000000000 ffff88003e3d2400 ffff88003c3c1a38 ffffffff81007c7a
[  +0.000000] Call Trace:
[  +0.000000]  [<ffffffff8101efbd>] ? kvm_clock_read+0x34/0x3b
[  +0.000000]  [<ffffffff81007c7a>] ? paravirt_sched_clock+0x9/0xd
[  +0.000000]  [<ffffffff81007fd4>] ? sched_clock+0x9/0xb
[  +0.000000]  [<ffffffff8104fd7a>] ? sched_clock_local+0x12/0x75
[  +0.000000]  [<ffffffff810632d1>] lock_acquire+0x93/0xb1
[  +0.000000]  [<ffffffffa0022339>] ? spin_lock+0x9/0xb [bluetooth]
[  +0.000000]  [<ffffffff8105f3d8>] ? lock_release_holdtime.part.22+0x4e/0x55
[  +0.000000]  [<ffffffff814f6038>] _raw_spin_lock+0x40/0x74
[  +0.000000]  [<ffffffffa0022339>] ? spin_lock+0x9/0xb [bluetooth]
[  +0.000000]  [<ffffffff814f6936>] ? _raw_spin_unlock+0x23/0x36
[  +0.000000]  [<ffffffffa0022339>] spin_lock+0x9/0xb [bluetooth]
[  +0.000000]  [<ffffffffa00230cc>] sco_conn_del+0x76/0xbb [bluetooth]
[  +0.000000]  [<ffffffffa002391d>] sco_connect_cfm+0x2da/0x2e9 [bluetooth]
[  +0.000000]  [<ffffffffa000862a>] hci_proto_connect_cfm+0x38/0x65 [bluetooth]
[  +0.000000]  [<ffffffffa0008d30>] hci_sync_conn_complete_evt.isra.79+0x11a/0x13e [bluetooth]
[  +0.000000]  [<ffffffffa000cd96>] hci_event_packet+0x153b/0x239d [bluetooth]
[  +0.000000]  [<ffffffff814f68ff>] ? _raw_spin_unlock_irqrestore+0x48/0x5c
[  +0.000000]  [<ffffffffa00025f6>] hci_rx_work+0xf3/0x2e3 [bluetooth]
[  +0.000000]  [<ffffffff8103efed>] process_one_work+0x1dc/0x30b
[  +0.000000]  [<ffffffff8103ef83>] ? process_one_work+0x172/0x30b
[  +0.000000]  [<ffffffff8103e07f>] ? spin_lock_irq+0x9/0xb
[  +0.000000]  [<ffffffff8103fc8d>] worker_thread+0x123/0x1d2
[  +0.000000]  [<ffffffff8103fb6a>] ? manage_workers+0x240/0x240
[  +0.000000]  [<ffffffff81044211>] kthread+0x9d/0xa5
[  +0.000000]  [<ffffffff81044174>] ? __kthread_parkme+0x60/0x60
[  +0.000000]  [<ffffffff814f75bc>] ret_from_fork+0x7c/0xb0
[  +0.000000]  [<ffffffff81044174>] ? __kthread_parkme+0x60/0x60
[  +0.000000] Code: d7 44 89 8d 50 ff ff ff 4c 89 95 58 ff ff ff e8 44 fc ff ff 44 8b 8d 50 ff ff ff 48 85 c0 4c 8b 95 58 ff ff ff 0f 84 7a 04 00 00 <f0> ff 80 98 01 00 00 83 3d 25 41 a7 00 00 45 8b b5 e8 05 00 00
[  +0.000000] RIP  [<ffffffff810620dd>] __lock_acquire+0xed/0xe82
[  +0.000000]  RSP <ffff88003c3c19d8>
[  +0.000000] CR2: 0000000000000199
[  +0.000000] ---[ end trace e73cd3b52352dd34 ]---

Signed-off-by: Vinicius Costa Gomes <vinicius.gomes@openbossa.org>
Tested-by: Frederic Dalleau <frederic.dalleau@intel.com>
Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
staging: comedi: s626: fix continuous acquisition

commit e4317ce877a31dbb9d96375391c1c4ad2210d637 upstream.

For the s626 driver, there is a bug in the handling of asynchronous
commands on the AI subdevice when the stop source is `TRIG_NONE`.  The
command should run continuously until cancelled, but the interrupt
handler stops the command running after the first scan.

The command set-up function `s626_ai_cmd()` contains this code:

	switch (cmd->stop_src) {
	case TRIG_COUNT:
		/*  data arrives as one packet */
		devpriv->ai_sample_count = cmd->stop_arg;
		devpriv->ai_continous = 0;
		break;
	case TRIG_NONE:
		/*  continous acquisition */
		devpriv->ai_continous = 1;
		devpriv->ai_sample_count = 0;
		break;
	}

The interrupt handler `s626_irq_handler()` contains this code:

		if (!(devpriv->ai_continous))
			devpriv->ai_sample_count--;
		if (devpriv->ai_sample_count <= 0) {
			devpriv->ai_cmd_running = 0;
			/* ... */
		}

So `devpriv->ai_sample_count` is only decremented for the `TRIG_COUNT`
case, but `devpriv->ai_cmd_running` is set to 0 (and the command
stopped) regardless.

Fix this in `s626_ai_cmd()` by setting `devpriv->ai_sample_count = 1`
for the `TRIG_NONE` case.  The interrupt handler will not decrement it
so it will remain greater than 0 and the check for stopping the
acquisition will fail.

Signed-off-by: Ian Abbott <abbotti@mev.co.uk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>