msm: vidc: Validate userspace buffer count

Makesure the number of buffers count is less than
the maximum limit to avoid structure overflow errors.

Change-Id: Icf3850de36325637ae43ac95f1c8f0f63e201d31
CRs-fixed: 563694
Signed-off-by: Pachika, Vikas Reddy <vpachi@codeaurora.org>
msm: vidc: Validate userspace buffer count before using it

Validate the number of buffers count variable before
using it to avoid structure overflow error.

Change-Id: I61582c93e0f26ec6842e437134fb8a42bdbc36ff
CRs-fixed: 563654
Signed-off-by: Pachika, Vikas Reddy <vpachi@codeaurora.org>
cfg80211: discard regulatory hints from country IEs with undefined wiphy

Regulatory hints are processed in a worker thread and by the
time this thread gets a chance to schedule driver can deregister
the wiphy on which the country IE was discovered. There is no need
to process the hints which are coming from such invalid wiphy
devices and we should drop them.

Change-Id: I44f6f7b29ed1d0927151a88f3ea9e0c17044bd7e
CRs-Fixed: 588103
Signed-off-by: Mihir Shete <smihir@codeaurora.org>
Merge "msm: vidc: Validate userspace buffer count"
Merge "msm: vidc: Validate userspace buffer count before using it"
msm: ocmem: Call restore_sec_config() after every power collapse

As the QRIB is enabled, after every power collapse of ocmem, the
QRIB is reset to the maximum security state. Due to this the apps
processor cannot access the ocmem register space.

The restore_sec_config() scm call needs to be called before any
register is accessed after a power collapse to ensure that the
security configuration is restored. The clocks need to be turned
on before every call that is made into TZ to ensure that there
is no power collapse.

CRs-Fixed: 651324, 660089
Change-Id: Ieb6b635142057e219de29e811c93749f6500cec5
Signed-off-by: Neeti Desai <neetid@codeaurora.org>
Merge "msm: ocmem: Call restore_sec_config() after every power collapse"
msm: kgsl: Enable protected mode for A3XX

Enable protected register mode for A3XX with these commits from
msm-3.10:

msm: kgsl: Enable protected register mode for A3XX
msm: kgsl: Print the register that causes a protected mode error
msm: kgsl: Unprotect the VBIF performance counters

Change-Id: Ic0dedbad950ffbd063fd861d9440bb5dce8d5fb1
Signed-off-by: Jordan Crouse <jcrouse@codeaurora.org>
msm: kgsl: Protect SMMU registers from being written by the GPU

Put the SMMU register range in protected mode to shield them from
IB1/IB2 writes from userspace.

CRs-Fixed: 599971
Change-Id: Ic0dedbad8c03fc1c54ff73221231e2440d3c34dd
Signed-off-by: Jordan Crouse <jcrouse@codeaurora.org>
msm: kgsl: Protect CP_STATE_DEBUG_INDEX

Put CP_STATE_DEBUG_INDEX and CP_STATE_DEBUG_DATA under protection
to keep it from being written from an IB1. Doing so however opens
up a subtle "feature" in the microcode: memory read opcodes turn off
protected mode in the microcode to do the read and then turns it
back on regardless of the initial state. This is a problem if the
memory read happens while protected mode is turned off and then we
try to access a protected register which then complains and goes boom.

To account for this irregularity explicitly turn back off protected
mode in all the places where we know this will be a problem.

Change-Id: Ic0dedbad1397ca9b80132241ac006560a615e042
Signed-off-by: Jordan Crouse <jcrouse@codeaurora.org>
Merge "cfg80211: discard regulatory hints from country IEs with undefined wiphy"
arm: mach-msm: Remove the unused rmt_storage code

The rmt_storage module is no longer used.
Remove the unused module and cleanup the makefile and kconfig.

CRs-Fixed: 549951
Change-Id: Ie9ebaa2209ea9fa0df05dc892504fcb882f00f29
Signed-off-by: Nikhilesh Reddy <reddyn@codeaurora.org>
Merge "msm: kgsl: Enable protected mode for A3XX"
Merge "msm: kgsl: Protect SMMU registers from being written by the GPU"
Merge "msm: kgsl: Protect CP_STATE_DEBUG_INDEX"
ASoC: wcd9xxx: Notify mbhc when TX3 path is enabled

On Tapan, ADC2/3 both being the same, it is possible that
polling noise can be captured in the recorded audio when
IN3 path is used for the recording with headset inserted.
Notify MBHC when IN3/TX3 path is enabled so that micbias
source can be switched to VDDIO to avoid polling noise to
be captured in the recorded audio.

CRs-fixed: 573616
Change-Id: I7db0ff91021e069bcc510d1d9cdbc8f2b0ee72c7
Signed-off-by: Phani Kumar Uppalapati <phaniu@codeaurora.org>
perf: Treat attr.config as u64 in perf_swevent_init()

Trinity discovered that we fail to check all 64 bits of
attr.config passed by user space, resulting to out-of-bounds
access of the perf_swevent_enabled array in
sw_perf_event_destroy().

Introduced in commit b0a873ebb ("perf: Register PMU
implementations").

Signed-off-by: Tommi Rantala <tt.rantala@gmail.com>
Cc: Peter Zijlstra <a.p.zijlstra@chello.nl>
Cc: davej@redhat.com
Cc: Paul Mackerras <paulus@samba.org>
Cc: Arnaldo Carvalho de Melo <acme@ghostprotocols.net>
Signed-off-by: Ingo Molnar <mingo@kernel.org>
Patch-mainline: linux-kernel @ 04/13/13, 19:49
Signed-off-by: Deepak Katragadda <dkatraga@codeaurora.com>
Merge "ASoC: wcd9xxx: Notify mbhc when TX3 path is enabled"
Merge "arm: mach-msm: Remove the unused rmt_storage code"
USB: Set power supply online status to false after cable disconnect

During bootup, power supply online status is set to true in
qpnp_charger_probe() as soon as usb cable insert is detected by
PMIC without waiting for notification from USB driver.
Later when usb cable is disconnected before charger detection
mechanism starts, online status is not set to false by USB.
As part of cable disconnect, USB checks in msm_otg_notify_charger()
whether the cur_power is same as requested mA, if both are same
then USB does not call power_supply_set_online() to set it to false.

Fix the issue by setting power supply online status to false for
the scenario when usb cable is disconected during bootup before
charger detection mechanism is completed.

CRs-fixed: 634183
Change-Id: Ibd57a40c7364e13bb10870e9e6343224e01171d7
Signed-off-by: Saket Saurabh <ssaurabh@codeaurora.org>