find5: update to CAF_A8064AAAAANLYA16420012

msm_fb: display: Add support to YCBYCR MDP format

Add support of MDP_YCBYCR_H2V1 interleaved YUV format to MDP
for a-family targets.

Change-Id: I5afb84a95693d1ced114152364782a10c4d56bc2
Signed-off-by: Mayank Chopra <makchopra@codeaurora.org>

msm: rotator: Add support to YCBYCR rotator format

Add support for MDP_YCBYCR_H2V1 interleaved YUV format in rotator
block.

Change-Id: I4bb192aaab1e72f6e5687ae222a5f9ea2c254bd4
Signed-off-by: Mayank Chopra <makchopra@codeaurora.org>

msm: kgsl: Use a read/lock for the context idr

Everybody loves a rcu but in this case we are dangerously mixing rcu's
and atomic operations. Add a read/write lock to explicitly protect the
idr. Also fix a few spots where the idr was used without protection.

Change-Id: Ic2f1e5c45692683b52a9f662ccdd2fb59bc7ae0e
Signed-off-by: Jordan Crouse <jcrouse@codeaurora.org>
Signed-off-by: Harsh Vardhan Dwivedi <hdwivedi@codeaurora.org>

msm: kgsl: Add a missing refcount put for kgsl_context

Fix a potential memory leak by putting in the missing kgsl_context_put()
in fault trace detect.

Change-Id: Ic0b43c831a88ac3e45bbe484bde843b46b6f09f6
Signed-off-by: Harsh Vardhan Dwivedi <hdwivedi@codeaurora.org>

msm-camera: Fix various small issues in Actuator driver

Bound check and validate userspace parameters direction,
number of steps and direction sign. Also fix possible
memory leak in certain error cases.

Change-Id: I05a3f63583845851df36b122f2079d345657cb99
CRs-Fixed: 511349
Signed-off-by: Katta Santhisindhu <kattas@codeaurora.org>

Conflicts:
	drivers/media/video/msm/actuators/msm_actuator.c

net: rmnet_usb: Duplicate skb when there is no tailroom

If the skb to be transmitted has no trailroom for mux padding,
then copy the skb into a new expanded skb with tailroom.

CRs-Fixed: 545483
Change-Id: I6d41c7b80246aac928e8466091cc3e925ecf550c
Signed-off-by: Pavankumar Kondeti <pkondeti@codeaurora.org>

cfg80211: Add AP stopped interface

AP stopped interface can be used to indicate that the AP mode has
stopped functioning, WLAN driver may have encountered errors that has
forced the driver to stop the AP mode.

When the driver is in P2P-Go mode, and when it goes thru automatic
recovery from firmware crashes, it uses this interface to notify the
userspace that the group has been deleted.

CRs-Fixed: 453060
Change-Id: Ifcd8d4f0c0b26f56a56fb8560aa474297b7521d4
Signed-off-by: Sameer Thalappil <sameert@codeaurora.org>

cfg80211: Reset beacon interval when stop AP fails

When SSR happens at WLAN driver, the cfg80211 stop AP can fail at driver.
Make sure that the beacon interval is reset, even when this API fails.

Change-Id: I459f55ce5f4bc44c4d0e20170bd50a83c2d609b4
Signed-off-by: Sameer Thalappil <sameert@codeaurora.org>

msm: vidc: return error in case of init failure

Return error if error comes in video driver
initialization.

Change-Id: I54c516808587fb7d94c3d517f8c72c6c9aa9d91d
CRs-fixed: 542535
Signed-off-by: Pushkaraj Patil <ppatil@codeaurora.org>

msm-camera: Bound check num_cid from userspace in csid driver

Upper and lower bound checks are enforced for num_cid
which is passed from userspace with lower as 1 and
max of 16.

Change-Id: I69a405995d2f53c3a0b0a72b50460bebfdf38442
CRs-Fixed: 511358
Signed-off-by: Katta Santhisindhu <kattas@codeaurora.org>

msm: camera: Add debugfs support for VFE.

Add debugfs support in VFE driver and enable user to perform the
following actions at runtime thorugh debugfs:
- dump the VFE registers.
- print the VFE configuration.

Change-Id: Ib8641b3dde6a7b41c4d63631b6b8ed1bac374317
Signed-off-by: Kiran Kumar H N <hurlisal@codeaurora.org>

msm: kgsl: Try fault tolerance even if there is no active context

No active context means that GPU could have failed when executing
commands that set an active context. In this case there are no bad
commands. This sort of hang can mostly be attributed to power
fluctuations or memory barriers which in all likelyhood can pass
after a reset. So treat no active context as a recoverable hang
scenario as well.

Change-Id: I0481a480bdb895f67daa2ed32df49eb1afe29029
Signed-off-by: Shubhraprakash Das <sadas@codeaurora.org>
Signed-off-by: Lynus Vaz <lvaz@codeaurora.org>
Signed-off-by: Ananta Kishore K <akollipa@codeaurora.org>

msm: kgsl: Remove drawctxt_active from setstate default

drawctxt_active is cleared after the old context is removed
during context switch.  Unfortunately, the context restore calls
adreno_use_default_setstate() which always returns true if
drawctxt_active is NULL, effectively always forcing us down the
software path.

Remove the check - adreno_use_default_setstate() already checks to see
if the GPU is idle and that is a more reliable verification that the
software path is worth going down.

Change-Id: Ic0dedbad57d7783bc23dd925a277a63cd2d78a7e
Signed-off-by: Jordan Crouse <jcrouse@codeaurora.org>
Signed-off-by: Hareesh Gundu <hareeshg@codeaurora.org>

msm: kgsl: Fix the KGSL driver to compile when CONFIG_DEBUG_FS=n

Fix a compilation error when CONFIG_DEBUG_FS is disabled. Add an
initialization flag to the process struct rather than rely on a
pointer to the debugfs node which will always be NULL if debugfs
is not available.

CRs-fixed: 542231
Change-Id: Ic0dedbadf0241fd476e56d6e116a811697b38190
Signed-off-by: Jordan Crouse <jcrouse@codeaurora.org>

Increase ION MMHeap from 56MB to 72MB

Increase ION MMHeap size from 56MB to 72MB to support
1080p widevine playback over 720p WFD session.
The Heap size is made a multiple of 4MB due to
CMA Alignment requirement.

Change-Id: I3dfed71a535c392441673f940bccfb6e87872958
Signed-off-by: Nirmal Abraham <nabrah@codeaurora.org>

msm: vidc: Validate input data before processing

User controlled data needs to be validated before
processing, otherwise it may corrupt existing data
and other programming variables which may further
lead to crash in kernel space.
This change validates user specified buffer's data,
such as offset and data length, before performing
any operations in kernel.

Change-Id: Idb2a5c4c270cdbb55adfc0c22b9296b7dd359de9
CRs-fixed: 547695
Signed-off-by: Deepak Verma <dverma@codeaurora.org>

msm: kgsl: Handle failure of find_process_private()

Handle the case of NULL return from find_process_private() upon
its failure by failing from get_process_private().

CRs-fixed: 542831
Change-Id: I8a365368ecf68f0d1aa01199aca76bc7ac49e154
Signed-off-by: Harsh Vardhan Dwivedi <hdwivedi@codeaurora.org>

msm: ipc: Fix SKB ownership for failure case

When a client writes to IPC Router and if the write fails, then in
certain scenarios both the client and IPC Router take up the ownership
of the SKB. These failure scenarios lead to a double-free and
segmentation fault.

Fix these scenarios by resolving the ownership issue. If the write to
IPC Router is successful, then IPC Router will keep the ownership of the
SKBs and free the packets. If the write fails, then the client will keep
the ownership of the SKBs and free the packets.

CRs-Fixed: 530180
Change-Id: Iaba47f5da377cdf0a6b16ae02d99eab91a9a6221
Signed-off-by: Zaheerulla Meer <zmeer@codeaurora.org>

ASoC: msm:Initialize local variable output_meta_data.

The local variable output_meta_data is not initialized if
prtd->meta_data_mode is false. It can lead unexpected behavior

Change-Id: I64f87342b02a3fb7b5c09c376f72ef7e0ca1efd6
CRs-Fixed:548200
Signed-off-by: Mohammad Johny Shaik <mjshai@codeaurora.org>
Signed-off-by: Satish Kamuju <skamuj@codeaurora.org>

msm: ipc: Append alignment bytes to loopback packet

When messages are looped back to the local port, the sender does not
append the alignment bytes while the receiver is discarding the
alignment bytes. This leads to receiver receiving an incomplete message.

Fix this issue by appending the alignment bytes in the loopback path.

Change-Id: Ie340e5311e15e39558a8fe9c95a54da686df4371
Signed-off-by: Karthikeyan Ramasubramanian <kramasub@codeaurora.org>

msm: ipc: Update the check for minimum packet size

IPC Router checks for the minimum packet size of the incoming message to
be at least 32 bytes. With IPC Router version 2 header, this check is
invalid for some packets.

Update the check for the minimum incoming packet size based on the
transport on which the packet is received.

Change-Id: Iacebfe876db2e5c3513d18fcfae425ea9bd6a7cd
Signed-off-by: Karthikeyan Ramasubramanian <kramasub@codeaurora.org>

msm-camera: Bound check for step position value in Actuator driver.

Bound check of curr_step_pos value of step_position_table in
Actuator driver.

Change-Id: I9462e197d46cde5b31ea4e80c22a836851128093
Signed-off-by: Katta Santhisindhu <kattas@codeaurora.org>

Conflicts:
	drivers/media/video/msm/actuators/msm_actuator.c

netfilter: Enable TOS matching in the kernel

This patch enabled kernel config CONFIG_NETFILTER_XT_MATCH_DSCP.
This adds a netfilter kernel configuration for matching TOS
packets for IPV4 packets. This will be required in certain QOS
filtering scenarios when the filter match is based on TOS.

CRs-Fixed: 542806
Change-Id: I59f311709daba8859db317cc152f96bc09f345b1
Acked-by: Sudharsan Coimbatore Premkumar <supremku@qti.qualcomm.com>
Signed-off-by: Harout Hedeshian <harouth@codeaurora.org>

ASoC: msm: qdsp6: Fix pop noise seen with touch tone during playback

Issue: When a session is opened for playback of the touch tone and
	routed through the COPP, the PBE and IIR params are being
	reconfigured in the COPP every time a session is open.

Rootcause:Configuring the PBE/IIR in the COPP every time a session
           is open.
Fix: Configuring the PBE and IIR param in the COPP one time a session
      is open

CRs-Fixed: 541722
Change-Id: If0d1a8c6893a94186e1c6c2a75432d2f4a89f842
Signed-off-by: Satish Kamuju <skamuj@codeaurora.org>

msm: kgsl: Get an active count before snapshotting GPU

Acquire an active count before attempting to capture a snapshot.
Doing so prevents instances of not being able to snapshot because of
switched off clocks.

CRs-fixed: 511878
Change-Id: Ib80b57c127566e274d4018001561f4da7ea38265
Signed-off-by: Hareesh Gundu <hareeshg@codeaurora.org>

mm/page_alloc.c: fix watermark check in __zone_watermark_ok()

The watermark check consists of two sub-checks.  The first one is:

	if (free_pages <= min + lowmem_reserve)
		return false;

The check assures that there is minimal amount of RAM in the zone.  If
CMA is used then the free_pages is reduced by the number of free pages
in CMA prior to the over-mentioned check.

	if (!(alloc_flags & ALLOC_CMA))
		free_pages -= zone_page_state(z, NR_FREE_CMA_PAGES);

This prevents the zone from being drained from pages available for
non-movable allocations.

The second check prevents the zone from getting too fragmented.

	for (o = 0; o < order; o++) {
		free_pages -= z->free_area[o].nr_free << o;
		min >>= 1;
		if (free_pages <= min)
			return false;
	}

The field z->free_area[o].nr_free is equal to the number of free pages
including free CMA pages.  Therefore the CMA pages are subtracted twice.
This may cause a false positive fail of __zone_watermark_ok() if the CMA
area gets strongly fragmented.  In such a case there are many 0-order
free pages located in CMA.  Those pages are subtracted twice therefore
they will quickly drain free_pages during the check against
fragmentation.  The test fails even though there are many free non-cma
pages in the zone.

This patch fixes this issue by subtracting CMA pages only for a purpose of
(free_pages <= min + lowmem_reserve) check.

Laura said:

  We were observing allocation failures of higher order pages (order 5 =
  128K typically) under tight memory conditions resulting in driver
  failure.  The output from the page allocation failure showed plenty of
  free pages of the appropriate order/type/zone and mostly CMA pages in
  the lower orders.

  For full disclosure, we still observed some page allocation failures
  even after applying the patch but the number was drastically reduced and
  those failures were attributed to fragmentation/other system issues.

Change-Id: Ic2c0c233993c41c630e24d71df5e12aa614588e5
CRs-Fixed:549847
Signed-off-by: Tomasz Stanislawski <t.stanislaws@samsung.com>
Signed-off-by: Kyungmin Park <kyungmin.park@samsung.com>
Tested-by: Laura Abbott <lauraa@codeaurora.org>
Cc: Bartlomiej Zolnierkiewicz <b.zolnierkie@samsung.com>
Acked-by: Minchan Kim <minchan@kernel.org>
Cc: Mel Gorman <mel@csn.ul.ie>
Tested-by: Marek Szyprowski <m.szyprowski@samsung.com>
Cc: <stable@vger.kernel.org>	[3.7+]
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Git-commit: 026b08147923142e925a7d0aaa39038055ae0156
Git-repo: https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git
Signed-off-by: Srinivasarao P <spathi@codeaurora.org>

Add security hooks to binder and implement the hooks for SELinux.

Add security hooks to the binder and implement the hooks for SELinux.
The security hooks enable security modules such as SELinux to implement
controls over binder IPC.  The security hooks include support for
controlling what process can become the binder context manager
(binder_set_context_mgr), controlling the ability of a process
to invoke a binder transaction/IPC to another process (binder_transaction),
controlling the ability a process to transfer a binder reference to
another process (binder_transfer_binder), and controlling the ability
of a process to transfer an open file to another process (binder_transfer_file).

This support is used by SE Android, http://selinuxproject.org/page/SEAndroid.

Change-Id: I9a64a87825df2e60b9c51400377af4a9cd1c4049
Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
Signed-off-by: Satya Durga Srinivasu Prabhala <satyap@codeaurora.org>

Conflicts:
	drivers/staging/android/binder.c

msm: kgsl: Hold driver process mutex till sysfs entries deleted

sysfs entries deletion logic is not under the driver
process mutex lock, there was a Camera test case
where a single process was trying to call
kgsl_open/kgsl_release very rapidly from multiple
thread, sometimes sysfs entries remained valid
and kgsl_open was trying to create new sysfs
entries for same process id. This caused
WARNING in kernel logs "sysfs: cannot create
duplicate filename '/devices/virtual/kgsl/kgsl/proc/277'"
This change holds the driver process mutex
lock till sysfs entries are deleted.

Change-Id: I0f66314e704c2b53657961303f76e2bd4f34e5b5
Signed-off-by: Prakash Kamliya <pkamliya@codeaurora.org>
find5: kernel: power: sync USB insert handling with CAF

Enable enable_tcxo_warmup_delay by default
To fix the bug that sometimes charger plugin
is not recognized

Also cleanup oppo specific code a little bit

Change-Id: I609b0be8ed3045d2a636ec46e5f0e3edadf081a7
find5: kernel: touchscreen: oppo changes

Change-Id: I393df9746beaef241f8af7c7638a1fbc4f84e0b9
touchscreen: fix initial touch not recognized on S2W wakeup

When wakeup using S2W the intitial touch is not
recognized e.g. when trying to unlock

Change-Id: Ib1e6427b87ab678a2fcd13ba219b21c553dad30b
touchscreen: remove first-touch-filtering for virtual keys

This makes the recognition of touches on the capacitive buttons bad.
Many times the first touch is not recognized

Change-Id: I30c1e9d667a890bd00fad97a1bec27338b25e983