msm: kgsl: Do not allow events with bogus timestamp

Do not register an event if the timestamp of that event is greater
than the highest timestamp assigned to the context or global in
case of global event

Change-Id: If12ad2dbc579bbcf7e99b3179ab8f911dc9b41aa
Signed-off-by: Shubhraprakash Das <sadas@codeaurora.org>
msm: kgsl: allow creation of events from the future

For contexts created with the KGSL_CONTEXT_USER_GENERATED_TS,
allow events to be created for timestamps that have not
been issued yet. Presumably these contexts know what they
are doing.

Change-Id: Iccf2e549b38e1a11850d26ee64b7279ab0b8a1ae
Signed-off-by: Jeremy Gebben <jgebben@codeaurora.org>
msm: mdss: hdmi: Proper HDMI feature check

Checks for the proper HDMI feature before providing the
corresponding feature data to avoid invalid memory access.

CRs-Fixed: 542785
Change-Id: I943bee9e843e0504effdfddfaf2dea82c22388f6
Signed-off-by: Ajay Singh Parmar <aparmar@codeaurora.org>
Signed-off-by: Ajay Dudani <adudani@codeaurora.org>
msm: mdss: hdmi: Security check for EDID 3D data parsing

While parsing EDID (Extended display identification data) received
from TV for 3D data and other, proper buffer overflow check is done
to avoid data overflow or overwrite.
Also, replace snprintf with scnprintf for better memory copy results.

CRs-Fixed: 542823
Change-Id: I2603beea6eb88a92b013a1a45d960a4c3ba6c09b
Signed-off-by: Ajay Singh Parmar <aparmar@codeaurora.org>
Signed-off-by: Ajay Dudani <adudani@codeaurora.org>
msm: qdsp6v2: memset stack buffer allocation.

This is needed to avoid garbage data in uninitialized variables.

Change-Id: Ic4b4d7481644c2add187a9122a4e7cfe7255b379
CRs-Fixed: 553304
Signed-off-by: Asish Bhattacharya <asishb@codeaurora.org>
Signed-off-by: Ajay Dudani <adudani@codeaurora.org>
msm: mdss: hdmi: Proper permissions for CEC logical address

Do not give universal access to CEC (Consumer Electronics Control)
sysfs nodes for logical and physical addresses to avoid unauthorized
access.

CRs-Fixed: 547968
Change-Id: I2ba57f050cc92a361586064dfd5e5659ab07c2f7
Signed-off-by: Ajay Singh Parmar <aparmar@codeaurora.org>
Signed-off-by: Ajay Dudani <adudani@codeaurora.org>
msm: kgsl: Flush the UCHE when context changes

Add commands to flush the GPU UCHE when a new context submits
commands to GPU. The ensures that the new context does not use
stale data present in UCHE.

Change-Id: I123a323be5f3fb9d1f9f96fed5bb68b8d0d27d76
CRs-Fixed: 607976
Signed-off-by: Shubhraprakash Das <sadas@codeaurora.org>
msm: kgsl: Enhance GFT to avoid hang->recover->hang cycle

If GFT recovered more than X times in Y ms invalidate the context
and do not attempt recovery. this is to prevent the case where GFT keeps
recovering continuously.

Change-Id: I9326a4cf0c8d1b6b92497ae5cd086e4b8bb7e89f
Signed-off-by: Tarun Karra <tkarra@codeaurora.org>
staging: android: ashmem: Avoid deadlock with mmap/shrink

Both ashmem_mmap and ashmem_shrink take the ashmem_lock. It may
be possible for ashmem_mmap to invoke ashmem_shrink:

-000|mutex_lock(lock = 0x0)
-001|ashmem_shrink(?, sc = 0x0) <--- try to take ashmem_mutex again
-002|shrink_slab(shrink = 0xDA5F1CC0, nr_pages_scanned = 0, lru_pages
-002|=
-002|124)
-003|try_to_free_pages(zonelist = 0x0, ?, ?, ?)
-004|__alloc_pages_nodemask(gfp_mask = 21200, order = 1, zonelist =
-004|0xC11D0940,
-005|new_slab(s = 0xE4841E80, ?, node = -1)
-006|__slab_alloc.isra.43.constprop.50(s = 0xE4841E80, gfpflags =
-006|2148925462, ad
-007|kmem_cache_alloc(s = 0xE4841E80, gfpflags = 208)
-008|shmem_alloc_inode(?)
-009|alloc_inode(sb = 0xE480E800)
-010|new_inode_pseudo(?)
-011|new_inode(?)
-012|shmem_get_inode(sb = 0xE480E800, dir = 0x0, ?, dev = 0, flags =
-012|187)
-013|shmem_file_setup(?, ?, flags = 187)
-014|ashmem_mmap(?, vma = 0xC5D64210) <---- Acquire ashmem_mutex
-015|mmap_region(file = 0xDF8E2C00, addr = 1772974080, len = 233472,
-015|flags = 57,
-016|sys_mmap_pgoff(addr = 0, len = 230400, prot = 3, flags = 1, fd =
-016|157, pgoff
-017|ret_fast_syscall(asm)
-->|exception
-018|NUR:0x40097508(asm)
---|end of frame

Avoid this deadlock by using mutex_trylock in ashmem_shrink; if the mutex
is already held, do not attempt to shrink.

Change-Id: I222bbf55856d5849da813b730de0636c80966c8e
Reported-by: Matt Wagantall <mattw@codeaurora.org>
Reported-by: Syed Rameez Mustafa <rameezmustafa@codeaurora.org>
Reported-by: Osvaldo Banuelos <osvaldob@codeaurora.org>
Reported-by: Subbaraman Narayanamurthy <subbaram@codeaurora.org>
Signed-off-by: Laura Abbott <lauraa@codeaurora.org>
ASoC: wcd9320: remove hard coded mad mic bias

Currently MICBIAS1 is hard coded as bias needs to be turned on
by MAD HW. Expose a control to user space to set MIC input needs
be used by MAD. Based on the mic, set the correct mic bias to be
used by MAD HW by scanning machine audio routes.

CRs-Fixed: 538266
Change-Id: Ib85be87e50554b9587f7bafb5b58333a88df6766
Signed-off-by: Kiran Kandi <kkandi@codeaurora.org>
Signed-off-by: Eric Laurent <elaurent@google.com>
sched: Fix migration thread runtime bogosity

commit 8f6189684eb4e85e6c593cd710693f09c944450a upstream.

Make stop scheduler class do the same accounting as other classes,

Migration threads can be caught in the act while doing exec balancing,
leading to the below due to use of unmaintained ->se.exec_start.  The
load that triggered this particular instance was an apparently out of
control heavily threaded application that does system monitoring in
what equated to an exec bomb, with one of the VERY frequently migrated
tasks being ps.

%CPU   PID USER     CMD
99.3    45 root     [migration/10]
97.7    53 root     [migration/12]
97.0    57 root     [migration/13]
90.1    49 root     [migration/11]
89.6    65 root     [migration/15]
88.7    17 root     [migration/3]
80.4    37 root     [migration/8]
78.1    41 root     [migration/9]
44.2    13 root     [migration/2]

Signed-off-by: Mike Galbraith <mgalbraith@suse.de>
Signed-off-by: Peter Zijlstra <a.p.zijlstra@chello.nl>
Link: http://lkml.kernel.org/r/1344051854.6739.19.camel@marge.simpson.net
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Cc: Steven Rostedt <rostedt@goodmis.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
ASoC: msm: Fix AUXPCM Sample Rate settings

Fix strings for defining sample rates of AUXPCM.
This wrong string causes mixer settings to fail
for anything other than default 8000.

Bug: 13763881

Signed-off-by: Ravi Kumar Alamanda <ralama@codeaurora.org>
Handle 'sk' being NULL in UID-based routing.

Bug: 15413527
Change-Id: If33bebb7b52c0ebfa8dac2452607bce0c2b0faa0
Signed-off-by: Sreeram Ramachandran <sreeram@google.com>
cgroup: Take css_set_lock from cgroup_css_sets_empty()

As indicated in the comment above cgroup_css_sets_empty it needs the
css_set_lock. But neither of the 2 call points have it, so rather then fixing
the callers just take the lock inside cgroup_css_sets_empty().

Signed-off-by: Hans de Goede <hdegoede@redhat.com>
Change-Id: If7aea71824f6d0e3f2cc6c1ce236c3ae6be2037b
cgroup: Fix use after free of cgrp (cgrp->css_sets)

Running a 3.4 kernel + Fedora-18 (systemd) userland on my Allwinner A10
(arm cortex a8), I'm seeing repeated, reproducable list_del list corruption
errors when build with CONFIG_DEBUG_LIST, and the backtrace always shows
free_css_set_work as the function making the problematic list_del call.

I've tracked this doen to a use after free of the cgrp struct, specifically
of the cgrp->css_sets list_head, which gets cleared by free_css_set_work.

Since free_css_set_work runs form a workqueue, it is possible for it to not be
done with clearing the list when the cgrp gets free-ed. To avoid this the code
adding the links increases cgrp->count, and the freeing code running from the
workqueue decreases cgrp->count *after* doing list_del, and then if the count
goes to 0 calls cgroup_wakeup_rmdir_waiter().

However cgroup_rmdir() is missing a check for cgrp->count != 0, causing it
to still continue with the rmdir (which leads to the free-ing of the cgrp),
before free_css_set_work is done. Sometimes the free-ed memory is re-used
before free_css_set_work gets around to unlinking link->cgrp_link_list,
triggering the list_del list corruption messages.

This patch fixes this by properly checking for cgrp->count != 0 and waiting
for the cgroup_rmdir_waitq in that case.

Change-Id: I9dbc02a0a75d5dffa1b65d67456e00139dea57c3
Signed-off-by: Hans de Goede <hdegoede@redhat.com>
Enable setting security contexts on rootfs inodes.

rootfs (ramfs) can support setting of security contexts
by userspace due to the vfs fallback behavior of calling
the security module to set the in-core inode state
for security.* attributes when the filesystem does not
provide an xattr handler.  No xattr handler required
as the inodes are pinned in memory and have no backing
store.

This is useful in allowing early userspace to label individual
files within a rootfs while still providing a policy-defined
default via genfs.

Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
ASoC: msm: Condition change to feed buffer on resume

Feed data to the DSP on a CMD_RUN ack by looking at the number
of bytes sent to the DSP and not the number of bytes consumed

Change-Id: I5eb3c04b84ffe9c6cea76515557d6d9be85ea11a
Signed-off-by: Haynes Mathew George <hgeorge@codeaurora.org>
ASoC: msm: qdsp6v2: Wait for stream to be available in gapless playback

Compressed driver operates on two streams in gapless mode and switches
between the two streams. If compressed playback operates on larger
buffers and the clip being played is small enough to fit in one
buffer, the driver could run into a scenario where three streams
need to be handled. Three streams results in no audio because stream
switching logic is corrupted. Fix is to block the next track call if
stream one has not completed playback.

CRs-Fixed: 594977
Change-Id: I6c83e859fa38f177ec7f4fa4ea92937d34df933a
Signed-off-by: Krishnankutty Kolathappilly <kkolat@codeaurora.org>
Signed-off-by: Haynes Mathew George <hgeorge@codeaurora.org>
ASoC: msm: qdsp6v2: ASM changes to use stream id as token parameter

Gapless compressed offload playback operates on two streams.
Platform driver needs to know the stream for which the command
callback is recieved. Use the token parameter in apr header to
pass the stream for ASM commands for which DSP expects stream and
session.

Change-Id: Ibd8f5b6a52f57ccf8cc7eea15eb460b2f9796120
Signed-off-by: Krishnankutty Kolathappilly <kkolat@codeaurora.org>
Signed-off-by: Haynes Mathew George <hgeorge@codeaurora.org>
ASoC: msm: Check stream id for ASM callbacks in compress driver

Send stream id to DSP for asm commands which requires stream and
session information. Stream and session id is added as token
parameter for DSP commands. Use token parameter to interpret the
stream for which the callback is received.

Change-Id: I58a40d84f60f4a4172ec7ee79302c8bfb24c910b
Signed-off-by: Krishnankutty Kolathappilly <kkolat@codeaurora.org>
Signed-off-by: Haynes Mathew George <hgeorge@codeaurora.org>