msm: mdp: Free secure memory based on pipe config

When there is no secure pipe configured, we can unmap secure
memory instead of relying on unset with secure flag set from
userspace.

Bug: 11857675

Signed-off-by: Naseer Ahmed <naseer@codeaurora.org>
mako: touch: PLG137 firmware E044 update

Improved ghost touch issues by
- Upgraded baseline check algorithm
- Adjusted touch sensitivity

It doesn't help in all cases for b/9236385

Bug: 7725315
Bug: 9236385
Change-Id: I1850427bac84620f34cad61bdfd9b16bbf692e32
Signed-off-by: Jongrak Kwon <jongrak.kwon@lge.com>
seq_file: always update file->f_pos in seq_lseek()

This issue was first pointed out by Jiaxing Wang several months ago, but no
further comments:
https://lkml.org/lkml/2013/6/29/41

As we know pread() does not change f_pos, so after pread(), file->f_pos
and m->read_pos become different. And seq_lseek() does not update file->f_pos
if offset equals to m->read_pos, so after pread() and seq_lseek()(lseek to
m->read_pos), then a subsequent read may read from a wrong position, the
following program produces the problem:

    char str1[32] = { 0 };
    char str2[32] = { 0 };
    int poffset = 10;
    int count = 20;

    /*open any seq file*/
    int fd = open("/proc/modules", O_RDONLY);

    pread(fd, str1, count, poffset);
    printf("pread:%s\n", str1);

    /*seek to where m->read_pos is*/
    lseek(fd, poffset+count, SEEK_SET);

    /*supposed to read from poffset+count, but this read from position 0*/
    read(fd, str2, count);
    printf("read:%s\n", str2);

out put:
pread:
 ck_netbios_ns 12665
read:
 nf_conntrack_netbios

/proc/modules:
nf_conntrack_netbios_ns 12665 0 - Live 0xffffffffa038b000
nf_conntrack_broadcast 12589 1 nf_conntrack_netbios_ns, Live 0xffffffffa0386000

So we always update file->f_pos to offset in seq_lseek() to fix this issue.

cherry-picked from https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/fs/seq_file.c?id=05e16745c0c471bba313961b605b6da3b21a853d

Signed-off-by: Jiaxing Wang <hello.wjx@gmail.com>
Signed-off-by: Gu Zheng <guz.fnst@cn.fujitsu.com>
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>

Conflicts:
	fs/seq_file.c

Change-Id: If419b92498e2c3e08669a4342e9b9ebf99ad3768
Signed-off-by: Devin Kim <dojip.kim@lge.com>
seq_file: always clear m->count when we free m->buf

Once we'd freed m->buf, m->count should become zero - we have no valid
contents reachable via m->buf.

cherry-picked from https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/fs/seq_file.c?id=801a76050bcf8d4e500eb8d048ff6265f37a61c8

Change-Id: I4c1d3e69db4ecf5362e2a5d05bfd7db754dc6dc6
Reported-by: Charley (Hao Chuan) Chu <charley.chu@broadcom.com>
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Devin Kim <dojip.kim@lge.com>
fs/dcache.c: Fix the too small buffer for dname

temp[64] is used for internal temporary buffer in dynamic_dname().
This is for dname. But It's too small. dname's size may be > 64.
In that case, it returns as -ENAMETOOLONG. So Increase the buffer size
to 256 for avoiding this issue.

The following was caused by the small buffer.
WARNING: at /kernel/mm/page_alloc.c:2470 __alloc_pages_nodemask+0x24c/0x938()
CPU: 2 PID: 505 Comm: android.bg Not tainted 3.10.0-g2f73780-00003-g2ff41d9-dirty #13
[<c010ba3c>] (unwind_backtrace+0x0/0x11c) from [<c0109cac>] (show_stack+0x10/0x14)
[<c0109cac>] (show_stack+0x10/0x14) from [<c01939a0>] (warn_slowpath_common+0x48/0x68)
[<c01939a0>] (warn_slowpath_common+0x48/0x68) from [<c0193a7c>] (warn_slowpath_null+0x18/0x20)
[<c0193a7c>] (warn_slowpath_null+0x18/0x20) from [<c0222454>] (__alloc_pages_nodemask+0x24c/0x938)
[<c0222454>] (__alloc_pages_nodemask+0x24c/0x938) from [<c0222b50>] (__get_free_pages+0x10/0x24)
[<c0222b50>] (__get_free_pages+0x10/0x24) from [<c024faf8>] (kmalloc_order_trace+0x24/0xf0)
[<c024faf8>] (kmalloc_order_trace+0x24/0xf0) from [<c024fe20>] (__kmalloc+0x30/0x244)
[<c024fe20>] (__kmalloc+0x30/0x244) from [<c02723c8>] (seq_read+0x270/0x464)
[<c02723c8>] (seq_read+0x270/0x464) from [<c0256a18>] (vfs_read+0xa4/0x134)
[<c0256a18>] (vfs_read+0xa4/0x134) from [<c0256de8>] (SyS_read+0x38/0x68)
[<c0256de8>] (SyS_read+0x38/0x68) from [<c0106140>] (ret_fast_syscall+0x0/0x30)

Change-Id: I74f5217ba3c4be73e91f33f900f1f0c26810cc05
Signed-off-by: Devin Kim <dojip.kim@lge.com>
android: configs: Grab the android/configs from kernel/common

This is a squash of all changes from kernel/common android-3.4 up to
  5e35d66 android: configs: add IPV6 ROUTE INFO

Change-Id: I848f1865ec7da1dfc3338a3e9d7f944a6f00f2a6
Signed-off-by: JP Abgrall <jpa@google.com>
mako_defconfig: canonicalize the defconfig with make savedefconfig

make mako_defconfig
make savedefconfig
cp defconfig arch/arm/configs/mako_defconfig

There is no change in the generated .config

Change-Id: I704f6dca31f29f5537f040430a390e7e10ad478b
Signed-off-by: JP Abgrall <jpa@google.com>
SELinux: include definition of new capabilities

The kernel has added CAP_WAKE_ALARM and CAP_EPOLLWAKEUP.  We need to
define these in SELinux so they can be mediated by policy.

Change-Id: I8a3e0db15ec5f4eb05d455a57e8446a8c2b484c2
Signed-off-by: Eric Paris <eparis@redhat.com>
Signed-off-by: James Morris <james.l.morris@oracle.com>
[sds: rename epollwakeup to block_suspend to match upstream merge]
Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
(cherry picked from commit c6a020c889756568d0e2f3ab0c1f04ad9fcb320c)
android: configs: Add CONFIG_NETFILTER_XT_TARGET_IDLETIMER

Signed-off-by: Ashish Sharma <ashishsharma@google.com>
mako_defconfig: enable IDLETIMER target for netfilters

Merged the base config from android/configs.
Ignored the following:
 CONFIG_OABI_COMPAT is not set
  -> b/8711265, symptom not seen on mako.
 CONFIG_USB_OTG_WAKELOCK=y
   -> OTG was not supported originally.
 CONFIG_ANDROID_INTF_ALARM_DEV=y
  -> mako has its own alarm dev.

Change-Id: Ic68f94b88945b09a78aefed61e9d854268542061
Signed-off-by: JP Abgrall <jpa@google.com>
mako: touch: fix i2c error after firmware upgrade

After firmware upgrade, there should be some delay to
prevent i2c error. Added booting_delay to avoid the i2c error.

Change-Id: Icbc9c656d2f7db1329e83553cc5c1e20033600e5
Signed-off-by: Jongrak Kwon <jongrak.kwon@lge.com>
mako: touch: add error checking for reading descriptor

Previous code didn't check errors for reading descriptors.
Normally there's no error during reading descriptors but
touch device won't be working until complete power recycle
once it happens.

Change-Id: Ie3cb329cd85f59f592c5c9994c9db84c58f487ca
Signed-off-by: Jongrak Kwon <jongrak.kwon@lge.com>
cfg80211: add flags to define country IE processing rules
802.11 cards may have different country IE parsing behavioural
preferences and vendors may want to support these. These preferences
were managed by the WIPHY_FLAG_CUSTOM_REGULATORY and the
WIPHY_FLAG_STRICT_REGULATORY flags and their combination.
Instead of using this existing notation, split out the country IE
behavioural preferences to a new flag. This will allow us to add more
customizations easily and make the code more maintainable. Also add
a new flag to disable country IE hints issued by the CORE as the
first customization.

Change-Id: I66ba4a92ac0f029a115eea0a274b02db11279787
CRs-Fixed: 542802
Signed-off-by: Mihir Shete <smihir@codeaurora.org>
prima: release v3.2.3.16

    git://codeaurora.org/external/wlan/prima.git

    bbb00be wlan : Revision 3.2.3.16
    e5cb4d6 wlan: Initilize country IE prefrence flag
    04b4db0 wlan: VOS ASSERT in csrRoamCompletion due to Assoc ref count.
    10801e4 wifi: Scan list not updated with correct APs on band change.
    6157d55 wlan : Revision 3.2.3.15
    118d50b wlan: Fix to pass global temporary dynamic IPv6 addr
    9c5a189 wlan: Fix for handling IPv6 notifier block rightly.
    ff6ea2c Registering IPv6 notifier to notify change in IP.
    8482b36 wlan : Revision 3.2.3.14
    515bf61 wlan : Updated TDLS parameters in ini
    8178e94 wlan: Flush scan results on PNO indication event.

Signed-off-by: Ed Tam <etam@google.com>
fix false disconnect due to a signal sent to the reading process

- In the current implementation, when a signal is sent to the reading process,
  read is cancelled by calling usb_ep_dequeue, which lead into calling
  acc_complete_out with ECONNRESET, but the current logic treats it as
  disconnection, which makes the device inaccessible until cable is actually
  disconnected.
- The fix calls disconnect only when ESHUTDOWN error is passed.
- If data has already arrived while trying cancelling, the data is marked
  as available, and it will be read out on the next read. This is necessary
  as USB bulk is assumed to guarantee no data loss.

Signed-off-by: keunyoung <keunyoung@google.com>
prima: release v3.2.3.18
    git://codeaurora.org/external/wlan/prima.git

    ddf6376 wlan : Revision 3.2.3.18
    c7f2ee4 wlan: adding cfg.ini parameter to configure to RA filter.
    b55e3a1 wlan : Revision 3.2.3.17
    82b2600 wlan: Remove extra line & error handling
    479d343 wlan: Check for WatchDog reset status during queue selection
    9322c18 wlan: Use HDD context flag to check SSR status
    1c12443 wlan: Remove "isMcAddrListFilter" INI param
    9297d6c wlan: Multicast Address Filter cleanup
    375d30f wlan: Updating the Channel list based on 11d from Nv.bin.
    666d726 wlan: Additional Scan IE data is not as per interface.

Signed-off-by: Ed Tam <etam@google.com>
staging: android: ashmem: Avoid deadlock with mmap/shrink
Both ashmem_mmap and ashmem_shrink take the ashmem_lock. It may
be possible for ashmem_mmap to invoke ashmem_shrink:

-000|mutex_lock(lock = 0x0)
-001|ashmem_shrink(?, sc = 0x0) <--- try to take ashmem_mutex again
-002|shrink_slab(shrink = 0xDA5F1CC0, nr_pages_scanned = 0, lru_pages
-002|=
-002|124)
-003|try_to_free_pages(zonelist = 0x0, ?, ?, ?)
-004|__alloc_pages_nodemask(gfp_mask = 21200, order = 1, zonelist =
-004|0xC11D0940,
-005|new_slab(s = 0xE4841E80, ?, node = -1)
-006|__slab_alloc.isra.43.constprop.50(s = 0xE4841E80, gfpflags =
-006|2148925462, ad
-007|kmem_cache_alloc(s = 0xE4841E80, gfpflags = 208)
-008|shmem_alloc_inode(?)
-009|alloc_inode(sb = 0xE480E800)
-010|new_inode_pseudo(?)
-011|new_inode(?)
-012|shmem_get_inode(sb = 0xE480E800, dir = 0x0, ?, dev = 0, flags =
-012|187)
-013|shmem_file_setup(?, ?, flags = 187)
-014|ashmem_mmap(?, vma = 0xC5D64210) <---- Acquire ashmem_mutex
-015|mmap_region(file = 0xDF8E2C00, addr = 1772974080, len = 233472,
-015|flags = 57,
-016|sys_mmap_pgoff(addr = 0, len = 230400, prot = 3, flags = 1, fd =
-016|157, pgoff
-017|ret_fast_syscall(asm)
-->|exception
-018|NUR:0x40097508(asm)
---|end of frame

Avoid this deadlock by using mutex_trylock in ashmem_shrink; if the mutex
is already held, do not attempt to shrink.

Change-Id: I222bbf55856d5849da813b730de0636c80966c8e
Reported-by: Matt Wagantall <mattw@codeaurora.org>
Reported-by: Syed Rameez Mustafa <rameezmustafa@codeaurora.org>
Reported-by: Osvaldo Banuelos <osvaldob@codeaurora.org>
Reported-by: Subbaraman Narayanamurthy <subbaram@codeaurora.org>
Signed-off-by: Laura Abbott <lauraa@codeaurora.org>
(cherry picked from commit 45f4598)
(cherry picked from commit 580c2c0)
sync: signal pt before sync_timeline object gets destroyed

There is a race condition

Assume we have *one* sync_fence object, with *one* sync_pt
which belongs to *one* sync_timeline, given this condition,
sync_timeline->kref will have two counts, one for sync_timeline
(implicit) and another for sync_pt.

Assume following is the situation on CPU

Theead-1 : (Thread which calls sync_timeline_destroy())
  -> (some function calls)
   -> sync_timeline_destory()
    -> sync_timeline_signal() (CPU is inside this
function after putting reference to sync_timeline)

At this time Thread-2 comes and does following

Thread-2 : (fclose on fence fd)
> sync_fence_release() -> because of fclose() on fence object
 -> sync_fence_free()
  -> sync_pt_free()
   -> kref_put(&pt->parent->kref, sync_timeline_free);
    -> sync_timeline_free() (CPU is inside this because
this time kref will be zero after _put)

Thread-2 will free sync_timeline object before Thread-1
has finished its work inside sync_timeline_signal.

With this change we signals all sync_pt before putting
reference to sync_timeline object.

Change-Id: Ic680e4d0bbef1c46bcb7cfba693395645241d203
Signed-off-by: Prakash Kamliya <pkamliya@codeaurora.org>
Signed-off-by: Rom Lemarchand <romlem@google.com>
(cherry picked from commit e8f37db3a6ac62781a0bd79b201f79311d88ee7d)
Revert "mako: touch: add error checking for reading descriptor"

Due to the side effect of the patch, firmware update might not be
recommenced when the firmware's in bad state. The firmware could be
in bad state when the firmware update's started in recovery mode and
system reboots before it's finished.

The error checking was added to detect I2C error after firmware update
but I2C error doesn't actually happen because of
e900ac0de811f62612480aa38fc3ac2d13fa2055, so revert it.

b/13532017

This reverts commit ca1e3b0e5f134aa837c8b808779eb2426ff96944.

Change-Id: I8916f7ca5ab9fe8a4685334349a882b580c26179
Signed-off-by: Jongrak Kwon <jongrak.kwon@lge.com>
(cherry picked from commit 236a463041d19e8b370ea2d45cb852a46d5d9d55)
Revert "mako: touch: PLG137 firmware E044 update"

Bug: 13911624

This reverts commit 520f5f3b8cfcf3532f43f29217f6efefe7563d1f.