Merge in SM-G7102_LA_KK_Opensource
staging: Add prima wlan driver

Import from motorola msm8226 kernel
https://github.com/CyanogenMod/android_kernel_motorola_msm8226
staging: prima: Update prima from kk_3.5_rb1.16
cfg80211: Add wiphy flag to disable 11D hints

Original commit:
https://github.com/CyanogenMod/android_kernel_motorola_msm8226/commit/da4d82de71d28ef1c78b4090f2feaba0c33a77f6
defconfig: Add prima/pronto config
WLAN subsystem: Sysctl support for key TCP/IP parameters

It has been observed that default values for some of key tcp/ip
parameters are affecting the tput/performance of the system. Hence
extending configuration capabilities to TCP/Ip stack through
sysctl interface

CRs-Fixed: 507581

Signed-off-by: Kiran Kumar Lokere <klokere@codeaurora.org>

Change-Id: Ia92fc229c0a4a8c3f7e4e02cf7e3c8849719ddff
msm: Create shadow files under /sys/kernel/ipv4

The TCP delayed ack parameters can be configured from user space
application which runs with non-root credentials and does not have
direct write access to /proc entries. This commit creates shadow
files under /sys/kernel/ipv4 which maps to /proc/sys/net/ipv4.

CRs-Fixed: 628139
Signed-off-by: Ravi Joshi <ravij@codeaurora.org>

Change-Id: Ib7242aaae930dbc02133e44c04e182ebc52bc89f
net: guard tcp_set_keepalive() to tcp sockets

Its possible to use RAW sockets to get a crash in
tcp_set_keepalive() / sk_reset_timer()

Fix is to make sure socket is a SOCK_STREAM one.

Change-Id: Ieeb498a3e623cfcb54e1c865a3c0229e4acf1e87
Reported-by: Dave Jones <davej@redhat.com>
Signed-off-by: Eric Dumazet <edumazet@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
ms013g: Disable Samsung MTP mode
ms013g: Disable Samsung rooting restrictions

Signed-off-by: Rox- <r.rozic97@gmail.com>
include/sound: Export audio_effects.h header file

Needed to build libqcompostprocbundle and libqcomvisualizer
Thanks @percy-g2
ASoC: msm: Allow DOLBY_DAP to be selected on MSM8226

Signed-off-by: Robert Rozic <r.rozic97@gmail.com>
ASoC: qcom: qdsp6v2: fix crash due to asynchronous read/write

Whenever an async read command is issued to dsp when
the driver is not enabled, there is a crash in userspace.
The read command is disallowed in the driver and an error
is propagated to userspace which results in the crash.
The driver is re-enabled in a subsequent asynchronous write
command anyway, so the async read command can be allowed.
Ensure that read is allowed by removing a superfluous check.

CRs-Fixed: 675131
Signed-off-by: Satya Krishna Pindiproli <satyak@codeaurora.org>
Change-Id: I5d0598e37d08ac1090f98c24be49fd99c132e22f
msm: ADSPRPC: Always map buffers into IOMMU if one is present

Original commit :
https://github.com/CyanogenMod/android_kernel_motorola_msm8226/commit/ec5759a2bab402e590c938649adcd781201bcb72
futex: Validate atomic acquisition in futex_lock_pi_atomic()

We need to protect the atomic acquisition in the kernel against rogue
user space which sets the user space futex to 0, so the kernel side
acquisition succeeds while there is existing state in the kernel
associated to the real owner.

Verify whether the futex has waiters associated with kernel state. If
it has, return -EINVAL. The state is corrupted already, so no point in
cleaning it up. Subsequent calls will fail as well. Not our problem.

[ tglx: Use futex_top_waiter() and explain why we do not need to try
  	restoring the already corrupted user space state. ]

Signed-off-by: Darren Hart <dvhart@linux.intel.com>
Cc: Kees Cook <keescook@chromium.org>
Cc: Will Drewry <wad@chromium.org>
Cc: stable@vger.kernel.org
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Git-commit: 550c7910f0e2fd4f130fec2f17541f3614fdfaf9
Git-repo: https://android.googlesource.com/kernel/common.git
Signed-off-by: Ian Maund <imaund@codeaurora.org>
futex: Always cleanup owner tid in unlock_pi

If the owner died bit is set at futex_unlock_pi, we currently do not
cleanup the user space futex. So the owner TID of the current owner
(the unlocker) persists. That's observable inconsistant state,
especially when the ownership of the pi state got transferred.

Clean it up unconditionally.

Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Cc: Kees Cook <keescook@chromium.org>
Cc: Will Drewry <wad@chromium.org>
Cc: Darren Hart <dvhart@linux.intel.com>
Cc: stable@vger.kernel.org
Git-commit: a2ec8e3dcdc6c93f574a0e22039b791cc5e14fa6
Git-repo: https://android.googlesource.com/kernel/common.git
Signed-off-by: Ian Maund <imaund@codeaurora.org>
futex: Make lookup_pi_state more robust

The current implementation of lookup_pi_state has ambigous handling of
the TID value 0 in the user space futex. We can get into the kernel
even if the TID value is 0, because either there is a stale waiters
bit or the owner died bit is set or we are called from the requeue_pi
path or from user space just for fun.

The current code avoids an explicit sanity check for pid = 0 in case
that kernel internal state (waiters) are found for the user space
address. This can lead to state leakage and worse under some
circumstances.

Handle the cases explicit:

     Waiter | pi_state | pi->owner | uTID      | uODIED | ?

[1]  NULL   | ---      | ---       | 0         | 0/1    | Valid
[2]  NULL   | ---      | ---       | >0        | 0/1    | Valid

[3]  Found  | NULL     | --        | Any       | 0/1    | Invalid

[4]  Found  | Found    | NULL      | 0         | 1      | Valid
[5]  Found  | Found    | NULL      | >0        | 1      | Invalid

[6]  Found  | Found    | task      | 0         | 1      | Valid

[7]  Found  | Found    | NULL      | Any       | 0      | Invalid

[8]  Found  | Found    | task      | ==taskTID | 0/1    | Valid
[9]  Found  | Found    | task      | 0         | 0      | Invalid
[10] Found  | Found    | task      | !=taskTID | 0/1    | Invalid

[1]  Indicates that the kernel can acquire the futex atomically. We
     came came here due to a stale FUTEX_WAITERS/FUTEX_OWNER_DIED bit.

[2]  Valid, if TID does not belong to a kernel thread. If no matching
     thread is found then it indicates that the owner TID has died.

[3]  Invalid. The waiter is queued on a non PI futex

[4]  Valid state after exit_robust_list(), which sets the user space
     value to FUTEX_WAITERS | FUTEX_OWNER_DIED.

[5]  The user space value got manipulated between exit_robust_list()
     and exit_pi_state_list()

[6]  Valid state after exit_pi_state_list() which sets the new owner in
     the pi_state but cannot access the user space value.

[7]  pi_state->owner can only be NULL when the OWNER_DIED bit is set.

[8]  Owner and user space value match

[9]  There is no transient state which sets the user space TID to 0
     except exit_robust_list(), but this is indicated by the
     FUTEX_OWNER_DIED bit. See [4]

[10] There is no transient state which leaves owner and user space
     TID out of sync.

Backport to 3.13
  conflicts: kernel/futex.c

Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Signed-off-by: John Johansen <john.johansen@canonical.com>
Cc: Kees Cook <keescook@chromium.org>
Cc: Will Drewry <wad@chromium.org>
Cc: Darren Hart <dvhart@linux.intel.com>
Cc: stable@vger.kernel.org
Git-commit: b50939f89dae691f8da9e0fd22e0eae0db1c0ae4
Git-repo: https://android.googlesource.com/kernel/common.git
Signed-off-by: Ian Maund <imaund@codeaurora.org>
Input: gpio_keys: report SW_LID instead of SW_FLIP

Change-Id: Icd9b3898bda4fc6778035c7b4f404ab2e3db6fcb
Signed-off-by: Roman Birg <roman@cyngn.com>
msm: vidc: add support to set VP8 QP range

QP range differs from codec to codec. This change adds support
for VP8 QP min and max range.

Change-Id: Ia44cf885a8b6f71b7eef51076968021ae68d7a7e
CRs-Fixed: 578892
Signed-off-by: Jorge Solano Altamirano <jsolano@codeaurora.org>
msm: vidc: add LTR support for video encoder

Enable LTR support for VP8 codec to add robust error resilience.

Change-Id: I3b87c5cdaef836a6d02d5b9fe71b7165b7f13581
Signed-off-by: Ashray Kulkarni <ashrayk@codeaurora.org>