Compilation issue fix

 Defined INSTALLED_KERNEL_TARGET
 Added files to ggc_wrapper.py
 Disabled SELINUX

Change-Id: I7a1702dfcaac32caff94a7cd1929483c005fc15e
Signed-off-by: Samjith Sadasivan <samjit@codeaurora.org>
msm_bam_rmnet: Fix potential memory corruption

Usage of legacy string manipulation function sprintf could lead to
memory corruption as the number of bytes to be written to the
destination is not bounded. Replace sprintf with snprintf where the
number of bytes to be written is explicitly specified.

CRs-fixed: 672202
Change-Id: Iab7516ad0e2540eb619fe96e26a3516c7adf86cc
Signed-off-by: Subash Abhinov Kasiviswanathan <subashab@codeaurora.org>
n_tty: Fix n_tty_write crash when echoing in raw mode

The tty atomic_write_lock does not provide an exclusion guarantee for
the tty driver if the termios settings are LECHO & !OPOST. And since
it is unexpected and not allowed to call TTY buffer helpers like
tty_insert_flip_string concurrently, this may lead to crashes when
concurrect writers call pty_write. In that case the following two
writers:
* the ECHOing from a workqueue and
* pty_write from the process
race and can overflow the corresponding TTY buffer like follows.

If we look into tty_insert_flip_string_fixed_flag, there is:
  int space = __tty_buffer_request_room(port, goal, flags);
  struct tty_buffer *tb = port->buf.tail;
  ...
  memcpy(char_buf_ptr(tb, tb->used), chars, space);
  ...
  tb->used += space;

so the race of the two can result in something like this:
          A                             B
   __tty_buffer_request_room
                                  __tty_buffer_request_room
   memcpy(buf(tb->used), ...)
   tb->used += space;
                                 memcpy(buf(tb->used), ...) ->BOOM

B's memcpy is past the tty_buffer due to the previous A's tb->used
increment.

Since the N_TTY line discipline input processing can output
concurrently with a tty write, obtain the N_TTY ldisc output_lock to
serialize echo output with normal tty writes. This ensures the tty
buffer helper tty_insert_flip_string is not called concurrently and
everything is fine.

Note that this is nicely reproducible by an ordinary user using
forkpty and some setup around that (raw termios + ECHO). And it is
present in kernels at least after commit
d945cb9cce20ac7143c2de8d88b187f62db99bdc (pty: Rework the pty layer to
use the normal buffering logic) in 2.6.31-rc3.

js: add more info to the commit log
js: switch to bool
js: lock unconditionally
js: lock only the tty->ops->write call

Signed-off-by: Peter Hurley <peter@hurleysoftware.com>
Signed-off-by: Jiri Slaby <jslaby@suse.cz>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Change-Id: I9e235db6ec2bb950f26bd8a23f6145dab5dc0a15
Git-commit: 4291086b1f081b869c6d79e5b7441633dc3ace00
Git-repo: git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
Signed-off-by: Avijit Kanti Das <avijitnsec@codeaurora.org>
[rsiddoji@codeaurora.org: resolve trivial merge conflicts]
Signed-off-by: Ravi Kumar S <rsiddoji@codeaurora.org>
ASoC: msm: Flexible period size for pcm playback

PCM driver was configured for fixed buffer
size on the playback path. With this, varying
the buffer sizes on the playback path was not
possible. To fix this, support for flexible
period sizes is added by setting different
values for min and max buffer sizes

Change-Id: I7f69db4940f67e5e3a795101af1b1682afbdb530
Signed-off-by: Alexy Joseph <alexyj@codeaurora.org>
Signed-off-by: Mekala Natarajan <mekalan@codeaurora.org>
ASoC: msm: Reduce maximum number of VOIP periods

Change-Id: I7c12a1fbae39ebee86f526549afe82451f87fd1b
ASoC: msm: Add routing info for VOIP_EXT_EC_REF

Change-Id: Ic9db1ec35255643c3cca7a351be0f1481c60f086
net: Zeroing the structure ethtool_wolinfo in ethtool_get_wol()

memset() the structure ethtool_wolinfo that has padded bytes
but the padded bytes have not been zeroed out.

Change-Id: If3fd2d872a1b1ab9521d937b86a29fc468a8bbfe
Signed-off-by: Avijit Kanti Das <avijitnsec@codeaurora.org>
Fix build for GCC 4.7

Change-Id: I4e9265369174d82b55fd435bc47887972f99c9d4
msm: vidc: cache-flush encoder output buffers after alloc

Flush output buffers explcitly during registering. This ensures
any pending CPU writes (i.e meset to 0 after allocation) are
committed right away, or else this may get flushed _after_
hardware has written the bitstream.

Change-Id: I958466011e7d96c7b5e2691403c8386309997429
Signed-off-by: Praveen Chavan <pchavan@codeaurora.org>
Signed-off-by: c_sridur <sridur@codeaurora.org>
tracing/syscalls: Fix perf syscall tracing when syscall_nr == -1

syscall_get_nr can return -1 in the case that the task is not executing
a system call.

This patch fixes perf_syscall_{enter,exit} to check that the syscall
number is valid before using it as an index into a bitmap.

Link: http://lkml.kernel.org/r/1345137254-7377-1-git-send-email-will.deacon@arm.com

Change-Id: I12f99dea41390b9631f98f925dc1d572aa4fc22d
Cc: Jason Baron <jbaron@redhat.com>
Cc: Wade Farnsworth <wade_farnsworth@mentor.com>
Cc: Frederic Weisbecker <fweisbec@gmail.com>
Signed-off-by: Will Deacon <will.deacon@arm.com>
Signed-off-by: Steven Rostedt <rostedt@goodmis.org>
tracing/syscalls: Ignore numbers outside NR_syscalls' range

ARM has some private syscalls (for example, set_tls(2)) which lie
outside the range of NR_syscalls.  If any of these are called while
syscall tracing is being performed, out-of-bounds array access will
occur in the ftrace and perf sys_{enter,exit} handlers.

 # trace-cmd record -e raw_syscalls:* true && trace-cmd report
 ...
 true-653   [000]   384.675777: sys_enter:            NR 192 (0, 1000, 3, 4000022, ffffffff, 0)
 true-653   [000]   384.675812: sys_exit:             NR 192 = 1995915264
 true-653   [000]   384.675971: sys_enter:            NR 983045 (76f74480, 76f74000, 76f74b28, 76f74480, 76f76f74, 1)
 true-653   [000]   384.675988: sys_exit:             NR 983045 = 0
 ...

 # trace-cmd record -e syscalls:* true
 [   17.289329] Unable to handle kernel paging request at virtual address aaaaaace
 [   17.289590] pgd = 9e71c000
 [   17.289696] [aaaaaace] *pgd=00000000
 [   17.289985] Internal error: Oops: 5 [#1] PREEMPT SMP ARM
 [   17.290169] Modules linked in:
 [   17.290391] CPU: 0 PID: 704 Comm: true Not tainted 3.18.0-rc2+ #21
 [   17.290585] task: 9f4dab00 ti: 9e710000 task.ti: 9e710000
 [   17.290747] PC is at ftrace_syscall_enter+0x48/0x1f8
 [   17.290866] LR is at syscall_trace_enter+0x124/0x184

Fix this by ignoring out-of-NR_syscalls-bounds syscall numbers.

Commit cd0980fc8add "tracing: Check invalid syscall nr while tracing syscalls"
added the check for less than zero, but it should have also checked
for greater than NR_syscalls.

Link: http://lkml.kernel.org/p/1414620418-29472-1-git-send-email-rabin@rab.in

Change-Id: Ic7ab546938e4655d73791d4cf371ffd9244c3e4d
Fixes: cd0980fc8add "tracing: Check invalid syscall nr while tracing syscalls"
Cc: stable@vger.kernel.org # 2.6.33+
Signed-off-by: Rabin Vincent <rabin@rab.in>
Signed-off-by: Steven Rostedt <rostedt@goodmis.org>
msm: wlan: Fix dangling pAdapter pointer in HDD.

On getting response from FW , SME calls hdd in
hdd_tx_per_hit_cb with pAdapter as argument.But
by that pAdapter in hdd might be removed.
As a part of fix, instead of passing pAdapter,
sessionId is passed. So when SME gets response from
FW , it will call hdd with sessionId and in hdd based
on sessionId a valid pAdapter would be used.

Change-Id: I50b484f2b2fbff17766ea14315132a9d6531e86b
CRs-Fixed: 699843
Signed-off-by: Kaushik, Sushant <skaushik@codeaurora.org>
ASoC: msm: qdsp6v2: check proxy port is open when closing

The current logic opens the afe proxy port only if the
proxy instance virtual port is opened. If only
pcm instance virtual port is opened and a close of the
afe proxy port is attempted, this causes the device to
crash due to a wait event timeout as the driver tries
to close an unopened afe port.
The change ensures that only if both the virtual ports
are opened, which in effect starts the proxy port,
the afe close commands for the proxy port is sent to DSP,
else return immediately.

Change-Id: I9450001c608208f3d8da22b2881a88db1c21d950
Signed-off-by: Aravind Kumar <akumark@codeaurora.org>
qseecom: fix secure app loading failure by kernel mode qseecom client

Make a change to fix secure app loading failure due to premature
kzfree() from __qseecom_load_fw(), when kernel mode qseecom client
tries to load app.

CRs-fixed: 694541

Change-Id: I1ac39ee885c12e08e863d976321dda2380ace852
Signed-off-by: William Clark <wclark@codeaurora.org>
crypto: msm: check potential integer overflow

According to the specification of AEAD, AEAD request crypt length is
not a fixed maximum and associated length is also same. This could
lead to potential integer overflow, thus allocating less memory. So
we need to check potential integer overflow on AEAD request length.

CRs-Fixed: 726872
Change-Id: Ie7708000bfd8c57e2fba8e02230a7ce9cdc9634c
Signed-off-by: William Clark <wclark@codeaurora.org>
net: core: Support UID-based routing.

This contains the following commits:

1. 0149763 net: core: Add a UID range to fib rules.
2. 1650474 net: core: Use the socket UID in routing lookups.
3. 0b16771 net: ipv4: Add the UID to the route cache.
4. ee058f1 net: core: Add a RTA_UID attribute to routes.
    This is so that userspace can do per-UID route lookups.

Bug: 15413527
Change-Id: I1285474c6734614d3bda6f61d88dfe89a4af7892
Signed-off-by: Lorenzo Colitti <lorenzo@google.com>
Git-commit: 0b428749ce5969bc06c73855e360141b4e7126e8
Git-repo: https://android.googlesource.com/kernel/common.git
Signed-off-by: Ian Maund <imaund@codeaurora.org>
Handle 'sk' being NULL in UID-based routing.

Bug: 15413527
Change-Id: If33bebb7b52c0ebfa8dac2452607bce0c2b0faa0
Signed-off-by: Sreeram Ramachandran <sreeram@google.com>
Git-commit: 0836a0c191f580ed69254e0b287cdce58481e978
Git-repo: https://android.googlesource.com/kernel/common.git
Signed-off-by: Ian Maund <imaund@codeaurora.org>
usb: gadget: f_audio_source: Fixed USB Audio Class Interface Descriptor

Fixed Android Issue #56549.

When both Vendor Class and Audio Class are activated for AOA 2.0,
the baInterfaceNr of the AudioControl Interface Descriptor points
to wrong interface numbers. They should be pointing to
Audio Control Device and Audio Streaming interfaces.

Replaced baInterfaceNr with the correct value.

Change-Id: Ib20f20c1d65887bac051b7ff9453dc53fc23a8d0
Signed-off-by: Anson Jacob <ansonkuzhumbil@gmail.com>
usb: msm_otg: allow peripheral mode switch in more host states

The current code allows peripheral mode switch in only A_HOST state
using user mode otg control debug interface. The target can also be
in A_WAIT_BCON and A_SUSPEND while operating as a host. Allow peripheral
mode switch in these states as well. Also check the PMIC id status
when the otg control is set to PMIC.

Change-Id: I6557b38ce5615e5c7ac3e670086bbfa98507bda7
Signed-off-by: ChandanaKishori Chiluveru <cchilu@codeaurora.org>
USB: option: add VIA Telecom CDS7 chipset device id

commit d77302739d900bbca5e901a3b7ac48c907ee6c93 upstream.

This VIA Telecom baseband processor is used is used by by u-blox in both the
FW2770 and FW2760 products and may be used in others as well.

This patch has been tested on both of these modem versions.

Signed-off-by: Brennan Ashton <bashton@brennanashton.com>
Signed-off-by: Johan Hovold <johan@kernel.org>
Signed-off-by: Zefan Li <lizefan@huawei.com>