msm: cpufreq: Move the enabling of the CPU/L2 clocks to CPU_STARTING

It is a requirement of PLLs in MSM SoCs that the PLL power
supplies be enabled while the PLL is running. If the PLL is
locked and outputs enabled, turning off the regulator(s)
supplying the PLL will cause the PLL to enter an unpredictable
state.

Now in the CPU_UP_PREPARE notifier, the CPU clocks are prepared
and enabled, causing the source HFPLLs to also turn on. Note
that the CPU isn't clocked yet. It is possible that execution is
pre-empted and the CPU running the notifier enters power
collapse. If all other CPUs also enter power collapse, then it
is possible for an RPM notification to go out, allowing the RPM
to transition the Apps processor to its sleep set. This can
result in the HFPLL supplies being turned off while the HFPLL is
running, violating the requirement mentioned above. Once the CPU
is unclamped, the CPU is effectively unclocked, due to the HFPLL
being in an unknown state.

There is a check that is enabled in the PM code's CPU_UP_PREPARE
notifier callback. This check ensures that the problematic RPM
notification cannot occur until the core that is being brought
online also enters power collapse. However, there is no ordering
guarantee between that PM's hotplug notifier callback's execution
and the cpufreq hotplug notifier callback's execution. This
ordering depends on program link order, which is unreliable.

It is necessary to ensure that once the HFPLL is enabled, the
RPM cannot transition apps to its sleep set. Move the enabling
of the CPU clocks to the CPU_STARTING notifier, which runs on
the CPU bring brought online. The CPU_STARTING notifier is
guaranteed to run after the CPU_UP_PREPARE notifier, which
implies that the aforementioned do-not-notify-rpm check is
executed *before* the HFPLL is enabled. Therefore even if all
cores enter power collapse after the HFPLL is enabled, the
HFPLL supplies are guaranteed to stay on, or the CPU clock
is switched to the safe source and the HFPLL is turned off.

CRs-Fixed: 622738
Change-Id: I136841405806c07e755919859e649ded0c719abb
Signed-off-by: Vikram Mulukutla <markivx@codeaurora.org>
ASoC: wcd9xxx: Correct wrong check conditions

1) For targets where micbias is shared, we do not
use vddio to identify special headset. We want
micbias to be enabled always with any headset
inserted for such targets. Currently, if headset is
inserted during recording, we check for this vddio
flag as well. Since, it is null for the above mentioned
targets, we never touch the code to enable micbias
always for any type of headset.

2) Again for the above mentioned targets, if micbias
is enabled by voice call, and we insert the headset.
Now if headset is removed, we try force diable of
micbias. This results in Tx mute. The count to disable
micbias needs to be corrected.

Change-Id: I022a54578c47485ebf7eef27c405e31ea6395ecf
Signed-off-by: Simmi Pateriya <simmip@codeaurora.org>
msm: ultrasound: add support for stream parameters

Add new IOCTLs to get and set ultrasound stream parameters in DSP
using shared memory.

Change-Id: I627e9e40e29c6233dab4295e2c355a718e30bd01
Acked-by: Hadar Sivan <hsivan@qti.qualcomm.com>
Signed-off-by: Lior Barenboim <liorb@codeaurora.org>
msm: vidc: Increase I-frame period to INT_MAX

There is no restriction on I-frame and IDR period
values, so set them to INT_MAX.

Change-Id: I364ead16c3b8b8463fc8180159e5ee1f9fa10f37
Signed-off-by: Arun Menon <avmenon@codeaurora.org>
SELinux: Fix kernel BUG on empty security contexts.

Setting an empty security context (length=0) on a file will
lead to incorrectly dereferencing the type and other fields
of the security context structure, yielding a kernel BUG.
As a zero-length security context is never valid, just reject
all such security contexts whether coming from userspace
via setxattr or coming from the filesystem upon a getxattr
request by SELinux.

Setting a security context value (empty or otherwise) unknown to
SELinux in the first place is only possible for a root process
(CAP_MAC_ADMIN), and, if running SELinux in enforcing mode, only
if the corresponding SELinux mac_admin permission is also granted
to the domain by policy.  In Fedora policies, this is only allowed for
specific domains such as livecd for setting down security contexts
that are not defined in the build host policy.

[On Android, this can only be set by root/CAP_MAC_ADMIN processes,
and if running SELinux in enforcing mode, only if mac_admin permission
is granted in policy.  In Android 4.4, this would only be allowed for
root/CAP_MAC_ADMIN processes that are also in unconfined domains. In current
AOSP master, mac_admin is not allowed for any domains except the recovery
console which has a legitimate need for it.  The other potential vector
is mounting a maliciously crafted filesystem for which SELinux fetches
xattrs (e.g. an ext4 filesystem on a SDcard).  However, the end result is
only a local denial-of-service (DOS) due to kernel BUG.  This fix is
queued for 3.14.]

Reproducer:
su
setenforce 0
touch foo
setfattr -n security.selinux foo

Caveat:
Relabeling or removing foo after doing the above may not be possible
without booting with SELinux disabled.  Any subsequent access to foo
after doing the above will also trigger the BUG.

BUG output from Matthew Thode:
[  473.893141] ------------[ cut here ]------------
[  473.962110] kernel BUG at security/selinux/ss/services.c:654!
[  473.995314] invalid opcode: 0000 [#6] SMP
[  474.027196] Modules linked in:
[  474.058118] CPU: 0 PID: 8138 Comm: ls Tainted: G      D   I
3.13.0-grsec #1
[  474.116637] Hardware name: Supermicro X8ST3/X8ST3, BIOS 2.0
07/29/10
[  474.149768] task: ffff8805f50cd010 ti: ffff8805f50cd488 task.ti:
ffff8805f50cd488
[  474.183707] RIP: 0010:[<ffffffff814681c7>]  [<ffffffff814681c7>]
context_struct_compute_av+0xce/0x308
[  474.219954] RSP: 0018:ffff8805c0ac3c38  EFLAGS: 00010246
[  474.252253] RAX: 0000000000000000 RBX: ffff8805c0ac3d94 RCX:
0000000000000100
[  474.287018] RDX: ffff8805e8aac000 RSI: 00000000ffffffff RDI:
ffff8805e8aaa000
[  474.321199] RBP: ffff8805c0ac3cb8 R08: 0000000000000010 R09:
0000000000000006
[  474.357446] R10: 0000000000000000 R11: ffff8805c567a000 R12:
0000000000000006
[  474.419191] R13: ffff8805c2b74e88 R14: 00000000000001da R15:
0000000000000000
[  474.453816] FS:  00007f2e75220800(0000) GS:ffff88061fc00000(0000)
knlGS:0000000000000000
[  474.489254] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[  474.522215] CR2: 00007f2e74716090 CR3: 00000005c085e000 CR4:
00000000000207f0
[  474.556058] Stack:
[  474.584325]  ffff8805c0ac3c98 ffffffff811b549b ffff8805c0ac3c98
ffff8805f1190a40
[  474.618913]  ffff8805a6202f08 ffff8805c2b74e88 00068800d0464990
ffff8805e8aac860
[  474.653955]  ffff8805c0ac3cb8 000700068113833a ffff880606c75060
ffff8805c0ac3d94
[  474.690461] Call Trace:
[  474.723779]  [<ffffffff811b549b>] ? lookup_fast+0x1cd/0x22a
[  474.778049]  [<ffffffff81468824>] security_compute_av+0xf4/0x20b
[  474.811398]  [<ffffffff8196f419>] avc_compute_av+0x2a/0x179
[  474.843813]  [<ffffffff8145727b>] avc_has_perm+0x45/0xf4
[  474.875694]  [<ffffffff81457d0e>] inode_has_perm+0x2a/0x31
[  474.907370]  [<ffffffff81457e76>] selinux_inode_getattr+0x3c/0x3e
[  474.938726]  [<ffffffff81455cf6>] security_inode_getattr+0x1b/0x22
[  474.970036]  [<ffffffff811b057d>] vfs_getattr+0x19/0x2d
[  475.000618]  [<ffffffff811b05e5>] vfs_fstatat+0x54/0x91
[  475.030402]  [<ffffffff811b063b>] vfs_lstat+0x19/0x1b
[  475.061097]  [<ffffffff811b077e>] SyS_newlstat+0x15/0x30
[  475.094595]  [<ffffffff8113c5c1>] ? __audit_syscall_entry+0xa1/0xc3
[  475.148405]  [<ffffffff8197791e>] system_call_fastpath+0x16/0x1b
[  475.179201] Code: 00 48 85 c0 48 89 45 b8 75 02 0f 0b 48 8b 45 a0 48
8b 3d 45 d0 b6 00 8b 40 08 89 c6 ff ce e8 d1 b0 06 00 48 85 c0 49 89 c7
75 02 <0f> 0b 48 8b 45 b8 4c 8b 28 eb 1e 49 8d 7d 08 be 80 01 00 00 e8
[  475.255884] RIP  [<ffffffff814681c7>]
context_struct_compute_av+0xce/0x308
[  475.296120]  RSP <ffff8805c0ac3c38>
[  475.328734] ---[ end trace f076482e9d754adc ]---

[sds:  commit message edited to note Android implications and
to generate a unique Change-Id for gerrit]

Change-Id: I4d5389f0cfa72b5f59dada45081fa47e03805413
Reported-by:  Matthew Thode <mthode@mthode.org>
Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
Cc: stable@vger.kernel.org
Signed-off-by: Paul Moore <pmoore@redhat.com>
Signed-off-by: Sivasri Kumar Vanka <sivasri@codeaurora.org>
msm: mdss: add error check for iommu attach API

Iommu device attach api returns error code if it fails.
MDP driver will check this error code and fall back to
recovery path if device attach fails.

Change-Id: I2b9d2d3aa16bc814739e466e9fc5a2c51c7b2b4b
Signed-off-by: Dhaval Patel <pdhaval@codeaurora.org>
ARM: dts: msm8974pro: Update BW votes to reflect clock plan

Either 931MHz or 800MHz is the turbo BIMC frequency, but both
do not exist in the same build.  Just request 931MHz.

Change-Id: I4b587e08689f9baa6e1088388d2748a298e7c916
Signed-off-by: Lucille Sylvester <lsylvest@codeaurora.org>
ARM: dts: msm: Add NFC to msm8974pro-ab device tree

enable nfc on 8974-ab devices with pm8941.

Change-Id: I4165f52da25839dacf00232edde3ceac0d0adef1
Signed-off-by: Houston Hoffman <hhoffman@codeaurora.org>
msm: camera2: cpp: Change bus scale vector call sequence

The cpp driver can set the bus scale vector when cpp module is
actually included. This will avoid unnecessary power consumption
due to setting the bus scale vector.

Change-Id: I898bb33f4433d8b70f63c07facd6e22d58196211
Signed-off-by: Rajakumar Govindaram <rajakuma@codeaurora.org>
msm: camera: Free queue data during camera close

CPP hardware is singleton, only one hardware used for processing
frames of different camera if more than one camera is running at
the same time. When camera is closed ensure that processing frame
queue and event data queue is empty.

Change-Id: Ie8e41431dd9b7acd29bac0f59fe2d4afa243ec2c
Signed-off-by: Sreesudhan Ramakrish Ramkumar <srramku@codeaurora.org>
Signed-off-by: Rajakumar Govindaram <rajakuma@codeaurora.org>
msm: camera2: cpp: Support queue and timer clean up.

The timer callback is triggered after the node shutdown under
some error conditions. The timer callback should be avoided
in such cases. If in some race condition the timer callback is
triggered then it needs to check the state before timeout
processing.

Change-Id: Ic5663c69f556f30592ff6eb20f99c7c4a5ac859d
Signed-off-by: Rajakumar Govindaram <rajakuma@codeaurora.org>
ASoC: msm: qdsp6v2: adding volume per dev-id

Add volume mixer control per device id for pcm use case.

Change-Id: Ieab721541a5cdf494b7fad78abc06d4f667b4baf
Signed-off-by: Anish Kumar <kanish@codeaurora.org>
msm: kgsl: Add a flag to mark user mapped GPU buffers

Add a flag in /sys/kernel/debug/kgsl/kgsl-3do/proc/<pid>/mem
file to indicate for each GPU buffer if it is mapped to userspace
in <pid> or not.

CRs-fixed: 634962

Conflicts:

	drivers/gpu/msm/kgsl_debugfs.c

Change-Id: I8abda74ef5656aca6b1c0315af8deb77460fa5a9
Signed-off-by: Harsh Vardhan Dwivedi <hdwivedi@codeaurora.org>
Signed-off-by: Prabhat Awasthi <pawasthi@codeaurora.org>
nl80211: nl80211hdr_put() doesn't return an ERR_PTR

There are a few places which check nl80211hdr_put() for an ERR_PTR
but actually it returns NULL on error and never error values.  In
nl80211_testmode_dump() the return wasn't checked at all so I have
added one.

Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
[some whitespace changes]
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Git-commit: cb35fba360dfc3496e5d8a47e23ec5ccdfd90925
Git-repo: git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
Change-Id: I5da1aafea35110a1ce606d402b1b96859d34b869
[akholaif@codeaurora.org: resolved conflicts manually]
Signed-off-by: Ahmad Kholaif <akholaif@codeaurora.org>
nl80211: fix error path in nl80211_get_key()

Coverity pointed out that in the (practically impossible)
error case we leak the message - fix this.

Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Git-commit: 9fe271af7d4de96471c5aaee2f4d0d1576050497
Git-repo: git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
Change-Id: I78c3631eabd04e86872faf65fa1e401dadb35a75
Signed-off-by: Ahmad Kholaif <akholaif@codeaurora.org>
cfg80211: ignore supported rates for nonexistant bands on scan

Fixes wpa_supplicant p2p_find on 5GHz-only devices

Signed-off-by: Felix Fietkau <nbd@openwrt.org>
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Git-commit: 1b09cd82d8c479700ef6185665839d1020b02519
Git-repo: git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
Change-Id: Icadd03bfff17c5fd8da3e15e7b69b42a730e0ef0
Signed-off-by: Ahmad Kholaif <akholaif@codeaurora.org>
arm: mach-msm: Remove the unused rmt_storage code

The rmt_storage module is no longer used.
Remove the unused module and cleanup the makefile and kconfig.

CRs-Fixed: 549951
Change-Id: Ie9ebaa2209ea9fa0df05dc892504fcb882f00f29
Signed-off-by: Nikhilesh Reddy <reddyn@codeaurora.org>
cma: Allow option to use strict memblock_reserved memory

Despite all the performance optimizations, some clients are
still unable to use CMA because of the allocation latency.
Rather than make those clients use a separate set of APIs,
extend the CMA code to allow clients to keep the memory out of
the buddy allocator. Since the pages never actually go to the
buddy allocator, allocation and freeing is only based on the bitmap
allocator to find the appropriate region.

Change-Id: Ia31bb1212fd7b19280361128453c8d25369ce592
Signed-off-by: Laura Abbott <lauraa@codeaurora.org>
Signed-off-by: Mitchel Humpherys <mitchelh@codeaurora.org>
msm: mdss: check for fb node refcount before calling null commit

Add a frame buffer reference count check before calling
null commit to release the free list pipes. This avoids
unnecessary flickering on screen if a process tries to open
and close the fb node without performing any operation.

Change-Id: I96b824edccf27f0ddb796c420ef1feb49f65ddea
Signed-off-by: Dhaval Patel <pdhaval@codeaurora.org>
ping: prevent NULL pointer dereference on write to msg_name

A plain read() on a socket does set msg->msg_name to NULL. So check for
NULL pointer first.

Change-Id: I3773934fb633157ce5011d2f10900b7caef73733
Signed-off-by: Hannes Frederic Sowa <hannes@stressinduktion.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
Git-commit: cf970c002d270c36202bd5b9c2804d3097a52da0
Git-repo: git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
Signed-off-by: Avijit Kanti Das <avijitnsec@codeaurora.org>