video: msm: mdss: comment clk_rate debugging
msm: mdp: fix duplicate definitions

Change-Id: I3847f3ee34ff4cd5bb0417cc207282cbbc2b37cb
msm: vibrator: Add min/max voltage sysfs entries

Change-Id: Icea99bb76aab73c5ab5bdb0112fbdc081bc62ba6
Signed-off-by: Scott Mertz <smertz@cyngn.com>
Find7: Follow qcom device tree API's about panel's using split

Change-Id: I7690cbcc1ad6139b006b5ae9c939a8c9988e75eb
msm: mdss: wait for ping pong during unblank kickoff

During panel unblank a kickoff is done to turn on the panel so that the
first update is not delayed. However since buffer sync and display
commit is not called on this, need to make sure that the update finishes
completely including the workqueue that signals the fences. Signaling
the sync fence can potentially cause timeline to be ahead and end up
signaling the acquire fences early leading to source tearing on command
mode panels.

Change-Id: I56edf8355e1c635c3da24f20405c3ae4fe31cf2e
Signed-off-by: Adrian Salido-Moreno <adrianm@codeaurora.org>
msm: mdss: add wait4pingpong in stop func

stop function may shut down mdp clocks while display thread kicked off
a frame and is waiting for pingpong done. Adding this wait to avoid
the race condition.

Change-Id: I7f081dd952cf2f7218e5471e6f735b8e09ba75fa
Signed-off-by: Huaibin Yang <huaibiny@codeaurora.org>
Signed-off-by: Naseer Ahmed <naseer@codeaurora.org>
msm: mdss: add missing argument to overlay kickoff

Change-Id: I2d2baafbec550f3ff39270b6166b511fe63af1b7
Revert "msm: mdp: fix duplicate definitions"

This reverts commit 31e62950cf7d907b2e887547167ad93eab4f2e79.

Change-Id: I795cc3ef4203e2f2e2e7dacef705558aa4433c97
msm: vidc: fix cluster control

Change-Id: I5fd327c6897016c8c13b002e3e03603a7e3cfc66
net-fixes: flow_dissector: prevent an infinite loop (CVE-2013-4348)

Jason Wang found that a malicious packet could make skb_flow_dissect()
loop forever. We must check that IP header has a valid ihl to avoid
this loop. It involves IPIP encapsulation and ihl = 0 to trigger.

Given this bug is critical, I cooked a patch before having
a fix in upstream kernel.

Tested:

 Compiled/booted
 Ran some tests on bnx2x and explicitely disabled hardware provided rxhash
 ethtool -K eth1 rxhash off
 ethtool -K eth2 rxhash off

Google-Bug-Id: 11465355
Effort: net-fixes
Change-Id: I813e4dc48cecb05f8edfa218304e1f13fd764323
Signed-off-by: Ed Tam <etam@google.com>
Signed-off-by: Patrick Tjin <pattjin@google.com>
msm: jpeg: Handle ERESTARTSYS properly

ERESTARTSYS return code for wait_* functions should be
propogated all the way to ioctl call.

Bug: 11856490
Signed-off-by: Shuzhen Wang <shuzhenw@codeaurora.org>
Revert "msm: jpeg: Handle ERESTARTSYS properly"

This reverts commit b90c643341b58ba18877aa0181defdb57b3225c6.

Change-Id: I1a25a1211d0b897c0dda8b75ac53b42f61f4ce6a
Revert "Revert "msm: jpeg: Handle ERESTARTSYS properly""

This reverts commit 8e37eb274b986628da2ebad0947a52c7c0325225.

Change-Id: I4b33e161d379445a008196ea4a93b4c919d4a97b
sync: Fix a race condition between release_obj and print_obj

Before this change, a timeline would only be removed from the timeline
list *after* the sync driver had its release_obj() called. However, the
driver's release_obj() may free resources needed by print_obj().

Although the timeline list is locked when print_obj() is called, it is
not locked when release_obj() is called. If one CPU was in print_obj()
when another was in release_obj(), the print_obj() may make unsafe
accesses.

It is not actually necessary to hold the timeline list lock when calling
release_obj() if the call is made after the timeline is unlinked from
the list, since there is no possibility another thread could be in --
or enter -- print_obj() for that timeline.

This change moves the release_obj() call to after the timeline is
unlinked, preventing the above race from occurring.

Signed-off-by: Alistair Strachan <alistair.strachan@imgtec.com>
msm: camera_v2: Handle vfe camif irq before axi irq

For each irq status, axi bits (image/stats) could be set as well
as camif sof bit. In this case, axi bits should be handled first
to better reflect the order of events: buf done of frame N before
SOF of frame N+1.

Bug: 11614033
Change-Id: Ie40552678306ba948bfa7dd791a01a38e38a4c31
Signed-off-by: Shuzhen Wang <shuzhenw@codeaurora.org>
seq_file: always update file->f_pos in seq_lseek()

This issue was first pointed out by Jiaxing Wang several months ago, but no
further comments:
https://lkml.org/lkml/2013/6/29/41

As we know pread() does not change f_pos, so after pread(), file->f_pos
and m->read_pos become different. And seq_lseek() does not update file->f_pos
if offset equals to m->read_pos, so after pread() and seq_lseek()(lseek to
m->read_pos), then a subsequent read may read from a wrong position, the
following program produces the problem:

    char str1[32] = { 0 };
    char str2[32] = { 0 };
    int poffset = 10;
    int count = 20;

    /*open any seq file*/
    int fd = open("/proc/modules", O_RDONLY);

    pread(fd, str1, count, poffset);
    printf("pread:%s\n", str1);

    /*seek to where m->read_pos is*/
    lseek(fd, poffset+count, SEEK_SET);

    /*supposed to read from poffset+count, but this read from position 0*/
    read(fd, str2, count);
    printf("read:%s\n", str2);

out put:
pread:
 ck_netbios_ns 12665
read:
 nf_conntrack_netbios

/proc/modules:
nf_conntrack_netbios_ns 12665 0 - Live 0xffffffffa038b000
nf_conntrack_broadcast 12589 1 nf_conntrack_netbios_ns, Live 0xffffffffa0386000

So we always update file->f_pos to offset in seq_lseek() to fix this issue.

cherry-picked from https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/fs/seq_file.c?id=05e16745c0c471bba313961b605b6da3b21a853d

Signed-off-by: Jiaxing Wang <hello.wjx@gmail.com>
Signed-off-by: Gu Zheng <guz.fnst@cn.fujitsu.com>
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>

Conflicts:
	fs/seq_file.c

Change-Id: If419b92498e2c3e08669a4342e9b9ebf99ad3768
Signed-off-by: Devin Kim <dojip.kim@lge.com>
seq_file: always clear m->count when we free m->buf

Once we'd freed m->buf, m->count should become zero - we have no valid
contents reachable via m->buf.

cherry-picked from https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/fs/seq_file.c?id=801a76050bcf8d4e500eb8d048ff6265f37a61c8

Change-Id: I4c1d3e69db4ecf5362e2a5d05bfd7db754dc6dc6
Reported-by: Charley (Hao Chuan) Chu <charley.chu@broadcom.com>
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Devin Kim <dojip.kim@lge.com>
fs/dcache.c: Fix the too small buffer for dname

temp[64] is used for internal temporary buffer in dynamic_dname().
This is for dname. But It's too small. dname's size may be > 64.
In that case, it returns as -ENAMETOOLONG. So Increase the buffer size
to 256 for avoiding this issue.

The following was caused by the small buffer.
WARNING: at /kernel/mm/page_alloc.c:2470 __alloc_pages_nodemask+0x24c/0x938()
CPU: 2 PID: 505 Comm: android.bg Not tainted 3.10.0-g2f73780-00003-g2ff41d9-dirty #13
[<c010ba3c>] (unwind_backtrace+0x0/0x11c) from [<c0109cac>] (show_stack+0x10/0x14)
[<c0109cac>] (show_stack+0x10/0x14) from [<c01939a0>] (warn_slowpath_common+0x48/0x68)
[<c01939a0>] (warn_slowpath_common+0x48/0x68) from [<c0193a7c>] (warn_slowpath_null+0x18/0x20)
[<c0193a7c>] (warn_slowpath_null+0x18/0x20) from [<c0222454>] (__alloc_pages_nodemask+0x24c/0x938)
[<c0222454>] (__alloc_pages_nodemask+0x24c/0x938) from [<c0222b50>] (__get_free_pages+0x10/0x24)
[<c0222b50>] (__get_free_pages+0x10/0x24) from [<c024faf8>] (kmalloc_order_trace+0x24/0xf0)
[<c024faf8>] (kmalloc_order_trace+0x24/0xf0) from [<c024fe20>] (__kmalloc+0x30/0x244)
[<c024fe20>] (__kmalloc+0x30/0x244) from [<c02723c8>] (seq_read+0x270/0x464)
[<c02723c8>] (seq_read+0x270/0x464) from [<c0256a18>] (vfs_read+0xa4/0x134)
[<c0256a18>] (vfs_read+0xa4/0x134) from [<c0256de8>] (SyS_read+0x38/0x68)
[<c0256de8>] (SyS_read+0x38/0x68) from [<c0106140>] (ret_fast_syscall+0x0/0x30)

Change-Id: I74f5217ba3c4be73e91f33f900f1f0c26810cc05
Signed-off-by: Devin Kim <dojip.kim@lge.com>
msm: thermal: Fix kernel thermal sysfs nodes permission

Fix the permission of the sysfs nodes exposed by the kernel
thermal monitor (KTM).The KTM sysfs nodes had wrong permissions
defined, which restricted access to thermal-engine/thermald with
SELinux policy. The sysfsnodes permissions are fixed in order to
allow access to thermal userspace processes with SELinux policy.

Bug: 12450712

Change-Id: I6f088f0bca889acbf0fd6a1d1dac09edc89c366c
Signed-off-by: Ram Chandrasekar <rkumbako@codeaurora.org>
Signed-off-by: Mekala Natarajan <mekalan@codeaurora.org>
SELinux: include definition of new capabilities

The kernel has added CAP_WAKE_ALARM and CAP_EPOLLWAKEUP.  We need to
define these in SELinux so they can be mediated by policy.

Change-Id: I8a3e0db15ec5f4eb05d455a57e8446a8c2b484c2
Signed-off-by: Eric Paris <eparis@redhat.com>
Signed-off-by: James Morris <james.l.morris@oracle.com>
[sds: rename epollwakeup to block_suspend to match upstream merge]
Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>