msm: vidc: unprepare clocks during power collapse

If any clock is still prepared (only disabled), apps will
not vote for XO shutdown. Unprepared clocks will remove the
vote and facilitate XO shutdown.
During power collapse, video drivers now disable and
unprepare venus clocks.
There was minimal power savings during internal tests,
but customer reported to have impact of 13mA without
the change.
The change add different clock states. Clock state
transitions with clock api is shown below
====================  clk_prepare_enable()    ==================
|DISABLED_UNPREPARED| ----------------------  |ENABLED_PREPARED|
====================  clk_disable_unprepare() ==================
   ||                                                   ||
   || clk_unprepare() ================    clk_disable() ||
    -----------------|DISABLED_PREPARED| ---------------
      clk_prepare()   ================    clk_enable()

Change-Id: Id23302e359abcdf91c993835c6353fb251c96fe6
CRs-Fixed: 604629
Signed-off-by: Vikash Garodia <vgarodia@codeaurora.org>
ASoC: Correct the mixer control name

Change the mixer to match userspace mixer control.
Fix the null pointer dereference caused in soc core.
This null pointer exception was found in monkey run.

Change-Id: I41c0d61216b1dd63a295f36593be81697e8a90cb
Signed-off-by: Anish Kumar <kanish@codeaurora.org>
Signed-off-by: Abhishek Ranjan <aranja@codeaurora.org>
SELinux: Fix kernel BUG on empty security contexts.

Setting an empty security context (length=0) on a file will
lead to incorrectly dereferencing the type and other fields
of the security context structure, yielding a kernel BUG.
As a zero-length security context is never valid, just reject
all such security contexts whether coming from userspace
via setxattr or coming from the filesystem upon a getxattr
request by SELinux.

Setting a security context value (empty or otherwise) unknown to
SELinux in the first place is only possible for a root process
(CAP_MAC_ADMIN), and, if running SELinux in enforcing mode, only
if the corresponding SELinux mac_admin permission is also granted
to the domain by policy.  In Fedora policies, this is only allowed for
specific domains such as livecd for setting down security contexts
that are not defined in the build host policy.

[On Android, this can only be set by root/CAP_MAC_ADMIN processes,
and if running SELinux in enforcing mode, only if mac_admin permission
is granted in policy.  In Android 4.4, this would only be allowed for
root/CAP_MAC_ADMIN processes that are also in unconfined domains. In current
AOSP master, mac_admin is not allowed for any domains except the recovery
console which has a legitimate need for it.  The other potential vector
is mounting a maliciously crafted filesystem for which SELinux fetches
xattrs (e.g. an ext4 filesystem on a SDcard).  However, the end result is
only a local denial-of-service (DOS) due to kernel BUG.  This fix is
queued for 3.14.]

Reproducer:
su
setenforce 0
touch foo
setfattr -n security.selinux foo

Caveat:
Relabeling or removing foo after doing the above may not be possible
without booting with SELinux disabled.  Any subsequent access to foo
after doing the above will also trigger the BUG.

BUG output from Matthew Thode:
[  473.893141] ------------[ cut here ]------------
[  473.962110] kernel BUG at security/selinux/ss/services.c:654!
[  473.995314] invalid opcode: 0000 [#6] SMP
[  474.027196] Modules linked in:
[  474.058118] CPU: 0 PID: 8138 Comm: ls Tainted: G      D   I
3.13.0-grsec #1
[  474.116637] Hardware name: Supermicro X8ST3/X8ST3, BIOS 2.0
07/29/10
[  474.149768] task: ffff8805f50cd010 ti: ffff8805f50cd488 task.ti:
ffff8805f50cd488
[  474.183707] RIP: 0010:[<ffffffff814681c7>]  [<ffffffff814681c7>]
context_struct_compute_av+0xce/0x308
[  474.219954] RSP: 0018:ffff8805c0ac3c38  EFLAGS: 00010246
[  474.252253] RAX: 0000000000000000 RBX: ffff8805c0ac3d94 RCX:
0000000000000100
[  474.287018] RDX: ffff8805e8aac000 RSI: 00000000ffffffff RDI:
ffff8805e8aaa000
[  474.321199] RBP: ffff8805c0ac3cb8 R08: 0000000000000010 R09:
0000000000000006
[  474.357446] R10: 0000000000000000 R11: ffff8805c567a000 R12:
0000000000000006
[  474.419191] R13: ffff8805c2b74e88 R14: 00000000000001da R15:
0000000000000000
[  474.453816] FS:  00007f2e75220800(0000) GS:ffff88061fc00000(0000)
knlGS:0000000000000000
[  474.489254] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[  474.522215] CR2: 00007f2e74716090 CR3: 00000005c085e000 CR4:
00000000000207f0
[  474.556058] Stack:
[  474.584325]  ffff8805c0ac3c98 ffffffff811b549b ffff8805c0ac3c98
ffff8805f1190a40
[  474.618913]  ffff8805a6202f08 ffff8805c2b74e88 00068800d0464990
ffff8805e8aac860
[  474.653955]  ffff8805c0ac3cb8 000700068113833a ffff880606c75060
ffff8805c0ac3d94
[  474.690461] Call Trace:
[  474.723779]  [<ffffffff811b549b>] ? lookup_fast+0x1cd/0x22a
[  474.778049]  [<ffffffff81468824>] security_compute_av+0xf4/0x20b
[  474.811398]  [<ffffffff8196f419>] avc_compute_av+0x2a/0x179
[  474.843813]  [<ffffffff8145727b>] avc_has_perm+0x45/0xf4
[  474.875694]  [<ffffffff81457d0e>] inode_has_perm+0x2a/0x31
[  474.907370]  [<ffffffff81457e76>] selinux_inode_getattr+0x3c/0x3e
[  474.938726]  [<ffffffff81455cf6>] security_inode_getattr+0x1b/0x22
[  474.970036]  [<ffffffff811b057d>] vfs_getattr+0x19/0x2d
[  475.000618]  [<ffffffff811b05e5>] vfs_fstatat+0x54/0x91
[  475.030402]  [<ffffffff811b063b>] vfs_lstat+0x19/0x1b
[  475.061097]  [<ffffffff811b077e>] SyS_newlstat+0x15/0x30
[  475.094595]  [<ffffffff8113c5c1>] ? __audit_syscall_entry+0xa1/0xc3
[  475.148405]  [<ffffffff8197791e>] system_call_fastpath+0x16/0x1b
[  475.179201] Code: 00 48 85 c0 48 89 45 b8 75 02 0f 0b 48 8b 45 a0 48
8b 3d 45 d0 b6 00 8b 40 08 89 c6 ff ce e8 d1 b0 06 00 48 85 c0 49 89 c7
75 02 <0f> 0b 48 8b 45 b8 4c 8b 28 eb 1e 49 8d 7d 08 be 80 01 00 00 e8
[  475.255884] RIP  [<ffffffff814681c7>]
context_struct_compute_av+0xce/0x308
[  475.296120]  RSP <ffff8805c0ac3c38>
[  475.328734] ---[ end trace f076482e9d754adc ]---

[sds:  commit message edited to note Android implications and
to generate a unique Change-Id for gerrit]

Change-Id: I4d5389f0cfa72b5f59dada45081fa47e03805413
Reported-by:  Matthew Thode <mthode@mthode.org>
Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
Cc: stable@vger.kernel.org
Signed-off-by: Paul Moore <pmoore@redhat.com>
Signed-off-by: Sivasri Kumar Vanka <sivasri@codeaurora.org>
ASoC: msm8974: Rearrange Listen DAI links

Move Listen DAI links to the end of existing
Front-End DAI links in machine driver. This
change is required to avoid issues with PCM
device ID with other FE after Listen.

Change-Id: I2e4118096802f79a9bf105180f186b228c8cd21e
Signed-off-by: Chaithanya Krishna Bacharaju <chaithan@codeaurora.org>
ASoC: msm: Add MultiKeyword support for Listen

Listen is a Voice activation and recognition feature.
Currently Listen feature supports recognition of single
keyword for a given session. This change adds support
for MultiKeyword in Listen interface header. Userspace
hal will use this interface header to determine Sound
Model version based on App ID.

Change-Id: I35e5205d78c169370e06548835700f51fec3489d
Signed-off-by: Chaithanya Krishna Bacharaju <chaithan@codeaurora.org>
ASoC: msm: qdsp6v2: Userspace interaction cleanup

Listen ioctl function transfers data to/from userspace
and additionally implements logic to process ioctl command.
Ioctl function should delegate the processing to internal
functions for supporting compat mode.
This change moves the processing into internal function.

Change-Id: Iffb86d2aa85579340eecd48f396c5fa839f521d5
Signed-off-by: Chaithanya Krishna Bacharaju <chaithan@codeaurora.org>
ASoC: msm: Add MultiKeyword support for Listen

Listen is a Voice activation and recognition feature.
Currently Listen feature supports recognition of single
keyword for a given session. This change adds support
for MultiKeyword detection for each Listen session.

Change-Id: I614dcbe101eeb42e8420496d39edace74010f5c8
Signed-off-by: Chaithanya Krishna Bacharaju <chaithan@codeaurora.org>
wcnss: Reset IRIS card before Starting IRIS XO configuration

Set iris_reset bit of PMU CFG register to reset the IRIS
card before Starting IRIS XO configuration.

Change-Id: Id1cfd7e3e3df29919089725b2233c6f95afbbfb5
CRs-Fixed: 664642
Signed-off-by: Hardik Kantilal Patel <hkpatel@codeaurora.org>
Merge "ASoC: Correct the mixer control name"
msm: mdss: add dynamic clk status check to pipe idle verification

Dynamic clk status of pipe can indicate if that pipe is active or not.
This status in conjunction VBIF halt status of pipe describes the idle
state of the pipe. Add support to parse necessary offsets from DT and
use them to find idle state of the pipe.

Change-Id: I83c6f323d48a85bfc08ff7bcee47f7c3038ea7e1
Signed-off-by: Ujwal Patel <ujwalp@codeaurora.org>
Signed-off-by: Jayant Shekhar <jshekhar@codeaurora.org>
Signed-off-by: Anusha Koduru <kanusha@codeaurora.org>
msm: mdss: ensure pipe is halted before freeing buffers

When pipe is being detached from mixer, there is potential corner case
if underrun occurs at the same time which can cause pipe to flood the
VBIF. On the other hand unmapping a buffer requires VBIF to be idle to
sync TLB, so need to ensure pipe halt is done before freeing the pipe
buffers.

Change-Id: I9686b9d7d17d8dc2a8334157cfa8fa23ba5b47ee
Signed-off-by: Adrian Salido-Moreno <adrianm@codeaurora.org>
msm: mdss: Handle case when pipe is not idle during cleanup.

When pipe is not idle during cleanup, MDP can go into an unrecoverable
state, which can lead into other issues. If it gets to this point we
need to recover even if it means changing display contents for a
fraction of time. To handle this follow recovery sequence:
1. Setup the pipes that are not idle to solid fill mode so that nothing
   is fetched from memory on these pipes.
2. Stage them into mixer, flush and wait for a vsync to happen and reset
   sequence to take effect on these.
3. Finally, reattach the current frame pipes to restore display back to
   normal.

Change-Id: If545b56bf32a46699871381d86e80c1980ec3cc7
Signed-off-by: Jayant Shekhar <jshekhar@codeaurora.org>
Signed-off-by: Adrian Salido-Moreno <adrianm@codeaurora.org>
Signed-off-by: Anusha Koduru <kanusha@codeaurora.org>
mdss: Dynamic timeout calculation for cmd stop

Time out condition was hard coded to 60 fps. If dynamic fps
feature was used, an invalid timeout might occur.

Change-Id: I0abe52416c10ef4ae0af6f541d22c66f6c8a6b5e
Signed-off-by: Terence Hampson <thampson@codeaurora.org>
msm: mdss: enable fb_split feature for dual-dsi panels

Currently fb_split feature is limited to dual-pipe but single
interface, i.e eDP 2560x1600, panels. Extend use of this feature
to dual-dsi panels as well and by default enable equal split to
support dual-dsi portrait panels, i.e 1600x2560. Default settings
will be over-ridden by split settings from device tree if available.

Change-Id: I38279e1af7dcd1278fa203f51b8b33f82d0848af
Signed-off-by: Ujwal Patel <ujwalp@codeaurora.org>
Signed-off-by: Siddhartha Agrawal <agrawals@codeaurora.org>
msm: ultrasound: add support for stream parameters

Add new IOCTLs to get and set ultrasound stream parameters in DSP
using shared memory.

Change-Id: I627e9e40e29c6233dab4295e2c355a718e30bd01
Acked-by: Hadar Sivan <hsivan@qti.qualcomm.com>
Signed-off-by: Lior Barenboim <liorb@codeaurora.org>
msm: vidc: Query deblocker parameters from cluster

Various fields of h264_db_control were left uninitialised before being
sent to the firmware.  As a result, due to poor luck, the resulting
encoded bitstreams were invalid as the alpha and beta were not in the
acceptable range of [-6, 6].  This commit fills the uninitialised values
with values obtained by querying the cluster.

Change-Id: Ic217d007239bc059302bdcdf2aebad1c9ca88244
Signed-off-by: Deva Ramasubramanian <dramasub@codeaurora.org>
Signed-off-by: Arun Menon <avmenon@codeaurora.org>
unix: fix a race condition in unix_release()

As reported by Jan, and others over the past few years, there is a
race condition caused by unix_release setting the sock->sk pointer
to NULL before properly marking the socket as dead/orphaned.  This
can cause a problem with the LSM hook security_unix_may_send() if
there is another socket attempting to write to this partially
released socket in between when sock->sk is set to NULL and it is
marked as dead/orphaned.  This patch fixes this by only setting
sock->sk to NULL after the socket has been marked as dead; I also
take the opportunity to make unix_release_sock() a void function
as it only ever returned 0/success.

Dave, I think this one should go on the -stable pile.

Special thanks to Jan for coming up with a reproducer for this
problem.

CRs-Fixed: 660580
Change-Id: I0e39b84464cf3f4c9daf8677bba444d0d6d94825
Reported-by: Jan Stancek <jan.stancek@gmail.com>
Signed-off-by: Paul Moore <pmoore@redhat.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Git-commit: ded34e0fe8fe8c2d595bfa30626654e4b87621e0
Git-repo: https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/
Signed-off-by: Vignesh Radhakrishnan <vigneshr@codeaurora.org>
slim-ngd: NULL pointer check for client buffer

There is the chance of passing NULL pointer by the client
during the Slimbus/Codec transactions. Hence add NULL
pointer check for client buffer aswell.

CRs-Fixed: 608324
Change-Id: I161e8f04401afebb64ed72d5f392a67feb6ec13a
Signed-off-by: Kiran Gunda <kgunda@codeaurora.org>
Merge "msm: vidc: Query deblocker parameters from cluster"
Merge "wcnss: Reset IRIS card before Starting IRIS XO configuration"