defconfig: Enable needed 4.3 features

Change-Id: Ie5edc15a2a7877252df59cebc7a3e28752e0182d
msm: video: increase MM heap size for smoothstreaming

Change-Id: If835fcd6a3dcab11956115cdac9db6a18f356689
msm: vidc: Validate userspace buffer count before using it

Validate the number of buffers count variable before
using it to avoid structure overflow error.

Change-Id: I61582c93e0f26ec6842e437134fb8a42bdbc36ff
CRs-fixed: 563654
Signed-off-by: Pachika, Vikas Reddy <vpachi@codeaurora.org>
msm: vidc: Validate userspace buffer count

Makesure the number of buffers count is less than
the maximum limit to avoid structure overflow errors.

Change-Id: Icf3850de36325637ae43ac95f1c8f0f63e201d31
CRs-fixed: 563694
Signed-off-by: Pachika, Vikas Reddy <vpachi@codeaurora.org>
msm: vidc: Use min_dpb from resource tracker in smooth streaming mode

Get min_dpb from resource tracker always if smooth streaming
mode is enabled to handle number of output buffers properly.

Change-Id: Ic46f76061f3895fda44e1d8e94198f898e5edf9b
Signed-off-by: Deepak Verma <dverma@codeaurora.org>
ALSA: usb-audio: Fix the mixer control range limiting issue

- mixer_ctl_set() function is limiting the volume level
  to particular range. This results in incorrect initial
  volume setting for that device.
- In USB mixer while calculating the dBmin/dBmax values
  resolution factor is hardcoded to 256 which results in
  populating the wrong values for dBmin/dBmax.
- Fix is to use appropriate resolution factor while
  calculating the dBmin/dBmax values.

CRs-Fixed: 515012
Prev-Change-Id: I502355af66f850bb65380c27333c3341fa43a947
Signed-off-by: Deepa Madiregama <dmadireg@codeaurora.org>

Change-Id: I79c14014ad6828a802f6978b796d8a4a91c87e46
ASoC: msm: qdsp6: Fix pop noise seen with touch tone during playback

Issue: When a session is opened for playback of the touch tone and
	routed through the COPP, the PBE and IIR params are being
	reconfigured in the COPP every time a session is open.

Rootcause:Configuring the PBE/IIR in the COPP every time a session
           is open.
Fix: Configuring the PBE and IIR param in the COPP one time a session
      is open

CRs-Fixed: 541722
Prev-Change-Id: If0d1a8c6893a94186e1c6c2a75432d2f4a89f842
Signed-off-by: Satish Kamuju <skamuj@codeaurora.org>

Change-Id: If51d472b554e358f2eada257b7cebb97682683b0
ALSA: pcm: check for integer overflow during multiplication

Channel info data structure is parsed from userspace and if
user does not set the no. of channels correctly, it could lead
to security vulnerability if we don't check for overflow when the
no. of channels is multiplied with pcm bit width. Add a condition
to check for overflow during multiplication.

CRs-fixed: 537818
Prev-Change-Id: Ia3c31406dd8b7627ea704c076643c0348582da28
Signed-off-by: Phani Kumar Uppalapati <phaniu@codeaurora.org>

Change-Id: I577e28017baae43f0ca49141916381c7e791a281
ASoC: msm: qdsp6v2: Copy frame data based on frame length

Copying data based on count will result in copying
uninitialized data to userspace which can potentially
disclose sensitive data. Fix by copying data based on
frame instead.

CRs-Fixed: 552528, 552531
Prev-Change-Id: I307b285ef2aefe00b953cf650582e9ff7e03ceb1
Signed-off-by: Shiv Maliyappanahalli <smaliyap@codeaurora.org>

Conflicts:

	sound/soc/msm/qdsp6v2/msm-pcm-voip-v2.c

Change-Id: Ie468d0ccdbd6e253af9bbc7731559856fa302e6e
ALSA: core: Fix crash by avoiding appl_ptr crossing 32-bit boundary

Incase of A2DP usecase using proxy driver, appl_ptr has
boundary value as 0x60000000 frames in sw_params for stereo(2 channels).
When this value crosses 0x40000000, then userspace calculating
appl_ptr at bytes results in crossing 32-bit value 0x100000000,
and points to 0x0 offset which can result in crash or pop.
To avoid above scenario, set the sw_params appl_ptr boundary value
within 0x40000000. Added proper check at sw_params update
to set this value correctly within 32-bit boundary(frames).

Prev-Change-Id: I537a04156699d90549a0a468ae19539ecd552d3b
CRs-Fixed: 483203
Signed-off-by: Laxminath Kasam <lkasam@codeaurora.org>

Change-Id: Ife1e9debfce7cc62c88ca9587006f0e4e44a7a64
ASoC: msm: qdsp6v2: Fix buffer overflow in voice driver

Userspace registers calibration data with acdb driver
through ioctls. Voice driver registers the calibration
data with CVD by querying acdb data from acdb driver and
copies the calibration data in apr message.

The size of the calibration data can be controlled by userspace
and can result in buffer overflow if the calibration size is
greater than the destination buffer size.
Reject acdb data if the size is greater than the size of
destination buffer.

Prev-Change-Id: I1b495390d67907afc608ed8233bf916777d38e11
CRs-fixed: 548872
Signed-off-by: Shiv Maliyappanahalli <smaliyap@codeaurora.org>

Conflicts:

	sound/soc/msm/qdsp6v2/q6voice.c

Change-Id: Ic50d948134a72ab416be1a46ba59e33beb04827d
add extra free kbytes tunable

Add a userspace visible knob to tell the VM to keep an extra amount
of memory free, by increasing the gap between each zone's min and
low watermarks.

This is useful for realtime applications that call system
calls and have a bound on the number of allocations that happen
in any short time period.  In this application, extra_free_kbytes
would be left at an amount equal to or larger than than the
maximum number of allocations that happen in any burst.

It may also be useful to reduce the memory use of virtual
machines (temporarily?), in a way that does not cause memory
fragmentation like ballooning does.

[ccross]
Revived for use on old kernels where no other solution exists.
The tunable will be removed on kernels that do better at avoiding
direct reclaim.

Prev-Change-Id: I765a42be8e964bfd3e2886d1ca85a29d60c3bb3e
Signed-off-by: Rik van Riel<riel@redhat.com>
Signed-off-by: Colin Cross <ccross@android.com>

Conflicts:

	mm/page_alloc.c

Change-Id: I23d3e46647605898fe34f9af27d722cb249f3353
msm: vidc: Initialize kernel space stack variables

This change initializes kernel space stack variables
that are passed between kernel space and user space
using ioctls.
Non initialization of these variables may lead to
leakage of memory values from the kernel stack to
user space.

Change-Id: Icb195470545ee48b55671ac09798610178e833e1
CRs-fixed: 556771,563420
Signed-off-by: Deepak Verma <dverma@codeaurora.org>

Conflicts:
	drivers/video/msm/vidc/common/enc/venc.c
vidc: Modify shift value for extended PAR width.

Currently extended pixel aspect ratio register shift
value for width is 15. Due to this the actual width
value returned by core is getting doubled while
sending to user space. Now correct values are returned
by modifying the shift value to 16.

CRs-fixed: 362985
Change-Id: I996bfc79b327492a791017fd5b33638f82240d76
Signed-off-by: Rajeshwar Kurapaty <rkurapat@codeaurora.org>
msm: vidc: Validate input data before processing

User controlled data needs to be validated before
processing, otherwise it may corrupt existing data
and other programming variables which may further
lead to crash in kernel space.
This change validates user specified buffer's data,
such as offset and data length, before performing
any operations in kernel.

Change-Id: Idb2a5c4c270cdbb55adfc0c22b9296b7dd359de9
CRs-fixed: 547695
Signed-off-by: Deepak Verma <dverma@codeaurora.org>
ARM: Use -mcpu=cortex-a15 when targeting MSM Krait CPUs

Enable compiler optimizations specific to the Cortex-A15
processor when targeting MSM Krait CPUs. This is necessary
take advantage of the UDIV/SDIV instructions supported by
these processors. To accomplish this, we need to remove the
-march=armv7-a ISA restriction from the compiler options
because 'cortex-a15' is a superset of 'armv7-a'.

Change-Id: I6215aecc11fb4f77c971de7b84f68649ef234357
Signed-off-by: Stepan Moskovchenko <stepanm@codeaurora.org>
cpufreq: msm: remove gov_mutex from stop.

The stop could end up calling set_frequency callback. The set_frequency
callback takes the same gov_mutex lock and we end up in a deadlock.

Fix this by removing the locks around stop.

Signed-off-by: Abhijeet Dharmapurikar <adharmap@codeaurora.org>
(cherry picked from commit 5106c477a747279dbf045eed5a6ab4f68ac3501c)

Signed-off-by: Ram Kumar Chakravarthy Chebathini <rcheba@codeaurora.org>
(cherry picked from commit e0fa1831db0c57a8be8d5471ee3382b0f8a9165e)

Change-Id: I306f9cd2c05ce1e9c4c36d22d16b775a42881f0d
Signed-off-by: Sudhir Sharma <sudsha@codeaurora.org>
cpufreq: msm: fix race in cpufreq.

__cpufreq_driver_target expects to be called with the rw semaphore
held. We are not doing this when the frequency is asked to be changed
by dcvs.

Use cpufreq_driver_target variant of that function which gets the
rw semaphore before setting the frequency.

Signed-off-by: Abhijeet Dharmapurikar <adharmap@codeaurora.org>
(cherry picked from commit 54fc08ea6d33c6c561167f369cba060fe33755c9)

Signed-off-by: Ram Kumar Chakravarthy Chebathini <rcheba@codeaurora.org>
(cherry picked from commit a63446bcd75909db632ffc8ff3c4e6a96c8593c5)

Change-Id: I33cdac0aaac7fb44acf6f9eb451a80ff94175c46
Signed-off-by: Sudhir Sharma <sudsha@codeaurora.org>
msm: dcvs: update dcvs if the governor limits change.

We had seen issues where dcvs goes out of sync with the actual
freq the cpu is running at. The root cause was if the userspace
changes the limits on the governor, the governor ends up changing
the frequency without notifying dcvs.

Provide an api for the governor to call dcvs when a frequency change
happens.

Signed-off-by: Abhijeet Dharmapurikar <adharmap@codeaurora.org>
(cherry picked from commit 68c970e38fcb700d851301dbacc56da9387294c6)

Signed-off-by: Ram Kumar Chakravarthy Chebathini <rcheba@codeaurora.org>
(cherry picked from commit a7d720e513cfae2d3f9c03c25f2ce2f10c2e9de7)

Change-Id: I3f321df0270e997531d1a4cf3ee2251f86aef0bc
Signed-off-by: Sudhir Sharma <sudsha@codeaurora.org>
msm: Add support for ION Flushing without virtual address

Video has very large buffers to be flushed. Due to lack of
vmalloc space, ion_map_kernel cannot be called on each of
the video buffers. With this change the ion handle can be
flushed without the need of the kernel mapping.

Change-Id: If026f21e44a2cce6c2b8c232fc80a69d0dabcd14
Signed-off-by: Neeti Desai <neetid@codeaurora.org>