msm: kgsl: Hold driver process mutex till sysfs entries deleted

sysfs entries deletion logic is not under the driver
process mutex lock, there was a Camera test case
where a single process was trying to call
kgsl_open/kgsl_release very rapidly from multiple
thread, sometimes sysfs entries remained valid
and kgsl_open was trying to create new sysfs
entries for same process id. This caused
WARNING in kernel logs "sysfs: cannot create
duplicate filename '/devices/virtual/kgsl/kgsl/proc/277'"
This change holds the driver process mutex
lock till sysfs entries are deleted.

Change-Id: I0f66314e704c2b53657961303f76e2bd4f34e5b5
Signed-off-by: Prakash Kamliya <pkamliya@codeaurora.org>
msm_fb:hdmi:Add support to read audio capability

This change adds a sysfs node to read back the audio
capability of the sink from EDID.

Change-Id: I82acc0d5f72ec769e6c48f25c7e6bd68528b4dfb
Signed-off-by: Sandeep Panda <spanda@codeaurora.org>
msm_fb:hdmi:Security checks for EDID block read.

Ensure data is read from within limits of buffer
for data block collection/video data block in EDID.
This prevents EDID data from being read past the end
of data block collection offset.
Ensure the 3D formats are only read from the proper
buffer region for vendor specific data block. This
prevents illegal data being read from the EDID data.

Change-Id: Id411f7e93aaf9293341a87cb4ca5431005e2bb18
Signed-off-by: Sandeep Panda <spanda@codeaurora.org>
Config-8960: Disable Bluez dependant modules

Since MR2 comes with Bluedroid stack, disable Bluez dependant
modules from kernel.

CRs-Fixed: 542077
Change-Id: Ie2e1ef786c45d31b6705ddf1dd02eecfff2ba365
Signed-off-by: Juffin Alex Varghese <jalex@codeaurora.org>
msm: kgsl: Remove drawctxt_active from setstate default

drawctxt_active is cleared after the old context is removed
during context switch.  Unfortunately, the context restore calls
adreno_use_default_setstate() which always returns true if
drawctxt_active is NULL, effectively always forcing us down the
software path.

Remove the check - adreno_use_default_setstate() already checks to see
if the GPU is idle and that is a more reliable verification that the
software path is worth going down.

Change-Id: Ic0dedbad57d7783bc23dd925a277a63cd2d78a7e
Signed-off-by: Jordan Crouse <jcrouse@codeaurora.org>
Signed-off-by: Hareesh Gundu <hareeshg@codeaurora.org>
netfilter: Enable TOS matching in the kernel

This patch enabled kernel config CONFIG_NETFILTER_XT_MATCH_DSCP.
This adds a netfilter kernel configuration for matching TOS
packets for IPV4 packets. This will be required in certain QOS
filtering scenarios when the filter match is based on TOS.

CRs-Fixed: 542806
Change-Id: I59f311709daba8859db317cc152f96bc09f345b1
Acked-by: Sudharsan Coimbatore Premkumar <supremku@qti.qualcomm.com>
Signed-off-by: Harout Hedeshian <harouth@codeaurora.org>
ASoC: msm: qdsp6: Fix pop noise seen with touch tone during playback

Issue: When a session is opened for playback of the touch tone and
	routed through the COPP, the PBE and IIR params are being
	reconfigured in the COPP every time a session is open.

Rootcause:Configuring the PBE/IIR in the COPP every time a session
           is open.
Fix: Configuring the PBE and IIR param in the COPP one time a session
      is open

CRs-Fixed: 541722
Change-Id: If0d1a8c6893a94186e1c6c2a75432d2f4a89f842
Signed-off-by: Satish Kamuju <skamuj@codeaurora.org>
msm: kgsl: Get an active count before snapshotting GPU

Acquire an active count before attempting to capture a snapshot.
Doing so prevents instances of not being able to snapshot because of
switched off clocks.

CRs-fixed: 511878
Change-Id: Ib80b57c127566e274d4018001561f4da7ea38265
Signed-off-by: Hareesh Gundu <hareeshg@codeaurora.org>
msm: kgsl: always check ft and hw gates in kgsl_active_count_get

The device state can fluctuate during recovery and resume, so
it is safer to check the gates unconditionally rather than
trust the state. The gates are left open until recovery
or suspend starts.

Change-Id: Idad91976ceba0904425e54c71faf88b4fccb8fdd
Signed-off-by: Jeremy Gebben <jgebben@codeaurora.org>
msm: kgsl: Do not wait for FT gate in fault tolerance state

When device start fails, device is in INIT state and FT is triggered.
In FT we trigger snapshot which waits on ft_gate when active count is
0 and device is not in active state. This causes a deadlock. This
change does not wait for FT gate in FT state and thereby prevents
the deadlock.

CRs-Fixed: 526206
Change-Id: Id9e0a7c3f3f9367d0b3cc17e45fbba4b42bebf64
Signed-off-by: Tarun Karra <tkarra@codeaurora.org>
mm/page_alloc.c: fix watermark check in __zone_watermark_ok()

The watermark check consists of two sub-checks.  The first one is:

	if (free_pages <= min + lowmem_reserve)
		return false;

The check assures that there is minimal amount of RAM in the zone.  If
CMA is used then the free_pages is reduced by the number of free pages
in CMA prior to the over-mentioned check.

	if (!(alloc_flags & ALLOC_CMA))
		free_pages -= zone_page_state(z, NR_FREE_CMA_PAGES);

This prevents the zone from being drained from pages available for
non-movable allocations.

The second check prevents the zone from getting too fragmented.

	for (o = 0; o < order; o++) {
		free_pages -= z->free_area[o].nr_free << o;
		min >>= 1;
		if (free_pages <= min)
			return false;
	}

The field z->free_area[o].nr_free is equal to the number of free pages
including free CMA pages.  Therefore the CMA pages are subtracted twice.
This may cause a false positive fail of __zone_watermark_ok() if the CMA
area gets strongly fragmented.  In such a case there are many 0-order
free pages located in CMA.  Those pages are subtracted twice therefore
they will quickly drain free_pages during the check against
fragmentation.  The test fails even though there are many free non-cma
pages in the zone.

This patch fixes this issue by subtracting CMA pages only for a purpose of
(free_pages <= min + lowmem_reserve) check.

Laura said:

  We were observing allocation failures of higher order pages (order 5 =
  128K typically) under tight memory conditions resulting in driver
  failure.  The output from the page allocation failure showed plenty of
  free pages of the appropriate order/type/zone and mostly CMA pages in
  the lower orders.

  For full disclosure, we still observed some page allocation failures
  even after applying the patch but the number was drastically reduced and
  those failures were attributed to fragmentation/other system issues.

Change-Id: Ic2c0c233993c41c630e24d71df5e12aa614588e5
CRs-Fixed:549847
Signed-off-by: Tomasz Stanislawski <t.stanislaws@samsung.com>
Signed-off-by: Kyungmin Park <kyungmin.park@samsung.com>
Tested-by: Laura Abbott <lauraa@codeaurora.org>
Cc: Bartlomiej Zolnierkiewicz <b.zolnierkie@samsung.com>
Acked-by: Minchan Kim <minchan@kernel.org>
Cc: Mel Gorman <mel@csn.ul.ie>
Tested-by: Marek Szyprowski <m.szyprowski@samsung.com>
Cc: <stable@vger.kernel.org>	[3.7+]
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Git-commit: 026b08147923142e925a7d0aaa39038055ae0156
Git-repo: https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git
Signed-off-by: Srinivasarao P <spathi@codeaurora.org>
arm: Move the secondary_startup to __CPUINIT section.

Because of addition 1MB alignment after head.txt section,
the secondary_startup needs to move to 1MB aligned section.

CRs-Fixed: 513919
Change-Id: I332d1e4ec95c877406c6ad3318e5f9a3c85cc10f
Signed-off-by: Venkatesh Yadav Abbarapu <quicvenkat@codeaurora.org>
Add security hooks to binder and implement the hooks for SELinux.

Add security hooks to the binder and implement the hooks for SELinux.
The security hooks enable security modules such as SELinux to implement
controls over binder IPC.  The security hooks include support for
controlling what process can become the binder context manager
(binder_set_context_mgr), controlling the ability of a process
to invoke a binder transaction/IPC to another process (binder_transaction),
controlling the ability a process to transfer a binder reference to
another process (binder_transfer_binder), and controlling the ability
of a process to transfer an open file to another process (binder_transfer_file).

This support is used by SE Android, http://selinuxproject.org/page/SEAndroid.

Change-Id: I9a64a87825df2e60b9c51400377af4a9cd1c4049
Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
Signed-off-by: Satya Durga Srinivasu Prabhala <satyap@codeaurora.org>
Merge "Add security hooks to binder and implement the hooks for SELinux."
Merge "ASoC: msm: qdsp6: Fix pop noise seen with touch tone during playback"
Merge "mm/page_alloc.c: fix watermark check in __zone_watermark_ok()"
sync: signal pt before sync_timeline object gets destroyed

There is a race condition

Assume we have *one* sync_fence object, with *one* sync_pt
which belongs to *one* sync_timeline, given this condition,
sync_timeline->kref will have two counts, one for sync_timeline
(implicit) and another for sync_pt.

Assume following is the situation on CPU

Theead-1 : (Thread which calls sync_timeline_destroy())
  -> (some function calls)
   -> sync_timeline_destory()
    -> sync_timeline_signal() (CPU is inside this
function after putting reference to sync_timeline)

At this time Thread-2 comes and does following

Thread-2 : (fclose on fence fd)
> sync_fence_release() -> because of fclose() on fence object
 -> sync_fence_free()
  -> sync_pt_free()
   -> kref_put(&pt->parent->kref, sync_timeline_free);
    -> sync_timeline_free() (CPU is inside this because
this time kref will be zero after _put)

Thread-2 will free sync_timeline object before Thread-1
has finished its work inside sync_timeline_signal.

With this change we signals all sync_pt before putting
reference to sync_timeline object.

Change-Id: I66d7359cc5dca0352fda49f81953028e98b95993
Signed-off-by: Prakash Kamliya <pkamliya@codeaurora.org>
Signed-off-by: Hareesh Gundu <hareeshg@codeaurora.org>
msm_fb:hdmi:Fix for sysfs Entry Information Leaks

These sysfs entries leak logical and physical addresses
within the kernel and may be read by any user.
The read permissions for the sysfs entries changed
to S_IRUSR from S_IRUGO.

Change-Id: Idfc58c3b639ea4dfa105ff146467a1c4f01edb6e
Signed-off-by: Sandeep Panda <spanda@codeaurora.org>
msm: mhl: 8334: Initialize return value

Initialize the variable holding the return code to
appropriate error value so that an incorrect return
code isn't sent  to the caller.

Change-Id: I38192e5503750113de62494f3bd512819d7d8b76
Signed-off-by: Krishna Chaitanya Parimi <cparimi@codeaurora.org>
msm: msm_fb: validating backlight level and scale value

Validating the value of backlight to be not more than the
max value and also ensuring that the backlight scale value
is not more than 1024, thereby ensuring that backlight
scaling factor is not more than 1

Change-Id: I6a6f4f0f0a8c272edcac5078276fb406ddee3e90
Signed-off-by: Krishna Chaitanya Parimi <cparimi@codeaurora.org>