msm: wlan: update  db.txt with information from compliance team

Update the db.txt with new information from regulatory compliance
team.

Change-Id: I22d123c28becb87228f96116456fd2b969440fd3
Signed-off-by: Arif Hussain <arifhussain@codeaurora.org>
CRs-Fixed: 571151
Merge "Merge "Merge "msm: camera: Added bounds check for index parameter"""
Merge "Merge "msm: camera: Added bounds check for index parameter""
Merge "Merge "Merge "msm: camera: Added bounds check for index parameter"""
radio: tavarua: Added NULL checks for input arguments.

Added NULL checks for input arguments.

Change-Id: Ie39c2b3254c95925723735423c81b99da59ee6ad
CRs-fixed: 548405
Signed-off-by: Satish Kodishala <skodisha@codeaurora.org>
Merge "radio: iris: Avoid inconsistent free"
Merge "radio: iris: Use kernel API to copy data from user space"
Merge "radio: iris: Prevent loss of data"
Merge "Merge "radio: iris: Prevent loss of data""
ASoC:wcd9304:Modified code to acquire codec_resource_lock only once.

POP noise is heard as DAC is enabled during fast insertion/removal of
headset, due to wrong handling of codec_resource_lock. There is no need
to acquire the lock separately for HPHL and HPHR channel, hence modified
such that lock is acquired only once for both HPHL and HPHR PA's.

Change-Id: Ibceced072a9b19f0ecd0b156057973520f241a4f
CRs-Fixed: 580366
Signed-off-by: Asish Bhattacharya <asishb@codeaurora.org>
Merge "Merge "Merge "radio: iris: Prevent loss of data"""
idr: fix a subtle bug in idr_get_next()

The iteration logic of idr_get_next() is borrowed mostly verbatim from
idr_for_each().  It walks down the tree looking for the slot matching
the current ID.  If the matching slot is not found, the ID is
incremented by the distance of single slot at the given level and
repeats.

The implementation assumes that during the whole iteration id is aligned
to the layer boundaries of the level closest to the leaf, which is true
for all iterations starting from zero or an existing element and thus is
fine for idr_for_each().

However, idr_get_next() may be given any point and if the starting id
hits in the middle of a non-existent layer, increment to the next layer
will end up skipping the same offset into it.  For example, an IDR with
IDs filled between [64, 127] would look like the following.

          [  0  64 ... ]
       /----/   |
       |        |
      NULL    [ 64 ... 127 ]

If idr_get_next() is called with 63 as the starting point, it will try
to follow down the pointer from 0.  As it is NULL, it will then try to
proceed to the next slot in the same level by adding the slot distance
at that level which is 64 - making the next try 127.  It goes around the
loop and finds and returns 127 skipping [64, 126].

Note that this bug also triggers in idr_for_each_entry() loop which
deletes during iteration as deletions can make layers go away leaving
the iteration with unaligned ID into missing layers.

Fix it by ensuring proceeding to the next slot doesn't carry over the
unaligned offset - ie.  use round_up(id + 1, slot_distance) instead of
id += slot_distance.

Signed-off-by: Tejun Heo <tj@kernel.org>
Reported-by: David Teigland <teigland@redhat.com>
Cc: KAMEZAWA Hiroyuki <kamezawa.hiroyu@jp.fujitsu.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

Change-Id: Ifb6d64747e7f08e2f5d7609bd66a48405f0c9b95
Signed-off-by: Prakash Kamliya <pkamliya@codeaurora.org>
Merge "defconfig: remove support for /dev/mem and /dev/kmem on perf builds"
Merge "radio: tavarua: Added NULL checks for input arguments."
Update on Program TILE video frame size in dma ISR.
Earlier DMAP interrupt was enabled for each pipe,
which caused exessive logs.
Now DMAP interrupt is called for each frame.

Change-Id: Iceba4d6d781d81eb60a7b87936ef49d01eaaad78
Signed-off-by: raghavendra ambadas <rambad@codeaurora.org>
netfilter: x_tables: fix ordering of jumpstack allocation and table update

During kernel stability testing on an SMP ARMv7 system, Yalin Wang
reported the following panic from the netfilter code:

  1fe0: 0000001c 5e2d3b10 4007e779 4009e110 60000010 00000032 ff565656 ff545454
  [<c06c48dc>] (ipt_do_table+0x448/0x584) from [<c0655ef0>] (nf_iterate+0x48/0x7c)
  [<c0655ef0>] (nf_iterate+0x48/0x7c) from [<c0655f7c>] (nf_hook_slow+0x58/0x104)
  [<c0655f7c>] (nf_hook_slow+0x58/0x104) from [<c0683bbc>] (ip_local_deliver+0x88/0xa8)
  [<c0683bbc>] (ip_local_deliver+0x88/0xa8) from [<c0683718>] (ip_rcv_finish+0x418/0x43c)
  [<c0683718>] (ip_rcv_finish+0x418/0x43c) from [<c062b1c4>] (__netif_receive_skb+0x4cc/0x598)
  [<c062b1c4>] (__netif_receive_skb+0x4cc/0x598) from [<c062b314>] (process_backlog+0x84/0x158)
  [<c062b314>] (process_backlog+0x84/0x158) from [<c062de84>] (net_rx_action+0x70/0x1dc)
  [<c062de84>] (net_rx_action+0x70/0x1dc) from [<c0088230>] (__do_softirq+0x11c/0x27c)
  [<c0088230>] (__do_softirq+0x11c/0x27c) from [<c008857c>] (do_softirq+0x44/0x50)
  [<c008857c>] (do_softirq+0x44/0x50) from [<c0088614>] (local_bh_enable_ip+0x8c/0xd0)
  [<c0088614>] (local_bh_enable_ip+0x8c/0xd0) from [<c06b0330>] (inet_stream_connect+0x164/0x298)
  [<c06b0330>] (inet_stream_connect+0x164/0x298) from [<c061d68c>] (sys_connect+0x88/0xc8)
  [<c061d68c>] (sys_connect+0x88/0xc8) from [<c000e340>] (ret_fast_syscall+0x0/0x30)
  Code: 2a000021 e59d2028 e59de01c e59f011c (e7824103)
  ---[ end trace da227214a82491bd ]---
  Kernel panic - not syncing: Fatal exception in interrupt

This comes about because CPU1 is executing xt_replace_table in response
to a setsockopt syscall, resulting in:

	ret = xt_jumpstack_alloc(newinfo);
		--> newinfo->jumpstack = kzalloc(size, GFP_KERNEL);

	[...]

	table->private = newinfo;
	newinfo->initial_entries = private->initial_entries;

Meanwhile, CPU0 is handling the network receive path and ends up in
ipt_do_table, resulting in:

	private = table->private;

	[...]

	jumpstack  = (struct ipt_entry **)private->jumpstack[cpu];

On weakly ordered memory architectures, the writes to table->private
and newinfo->jumpstack from CPU1 can be observed out of order by CPU0.
Furthermore, on architectures which don't respect ordering of address
dependencies (i.e. Alpha), the reads from CPU0 can also be re-ordered.

This patch adds an smp_wmb() before the assignment to table->private
(which is essentially publishing newinfo) to ensure that all writes to
newinfo will be observed before plugging it into the table structure.
A dependent-read barrier is also added on the consumer sides, to ensure
the same ordering requirements are also respected there.

CRs-Fixed: 591149

Change-Id: Ica3ec69cd6e2f77945a1a7303f92887feecf42e9
Cc: Paul E. McKenney <paulmck@linux.vnet.ibm.com>
Reported-by: Wang, Yalin <Yalin.Wang@sonymobile.com>
Tested-by: Wang, Yalin <Yalin.Wang@sonymobile.com>
Signed-off-by: Will Deacon <will.deacon@arm.com>
Acked-by: Eric Dumazet <edumazet@google.com>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Git-commit: b416c144f46af1a30ddfa4e4319a8f077381ad63
Git-repo: https://www.codeaurora.org/cgit/quic/la/kernel/msm/common/
Signed-off-by: Vijaya Kumar T M <vtmuni@codeaurora.org>
csdio: Remove the driver

The driver is a legacy driver that is not used any longer
and its implementation is neither correct nor compiles.

Change-Id: I9862c0f93ccad6079a616f6997987d4e187a137c
Signed-off-by: Hamad Kadmany <hkadmany@codeaurora.org>
Merge "Merge "radio: tavarua: Added NULL checks for input arguments.""
msm: kgsl: Skip hang check for 2d devices
kgsl hung check is used for 3d device but while creating a 2d
device we are creating a hung timer and check for hung in 3d
device, Which is not logically correct. Some time it causes kernal panic
when device type is 2d and we try to access 3d device registers etc

Change-Id: I82d7c4ca542f33529357c336daa36a66153adcd3
Signed-off-by: Gaurav Gagrani <ggagrani@codeaurora.org>
driver core: fix possible missing of device probe

Inside bus_add_driver(), one device might be added(device_add()) into
the bus or probed which is triggered by deferred probe
just after completing of driver_attach() and before
'klist_add_tail(&priv->knode_bus, &bus->p->klist_drivers)',
so the device won't be probed by this driver.

This patch moves the below line

	'klist_add_tail(&priv->knode_bus, &bus->p->klist_drivers)'

before driver_attach() inside bus_add_driver() to fix the
problem.

CRs-Fixed: 588802
Change-Id: I9250b399d57a89870d1df220b97fdca275e2e1a9
Signed-off-by: Ming Lei <ming.lei@canonical.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Git-commit: 190888ac01d059e38ffe77a2291d44cafa9016fb
Git-repo: git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
Signed-off-by: Sagar Dharia <sdharia@codeaurora.org>
Signed-off-by: Swetha Chikkaboraiah <schikk@codeaurora.org>