diag: Remove invalid check for payload

Call back data type does support commands which is less than
4 bytes in size. This patch removes the unnecessary check for
the call back data type.

Change-Id: Ie70196d8dd0b0b3d023bc2505fbb1cb3e582a1af
CRs-fixed: 623552
Signed-off-by: Katish Paran <kparan@codeaurora.org>
msm: cpufreq: Move the enabling of the CPU/L2 clocks to CPU_STARTING

It is a requirement of PLLs in MSM SoCs that the PLL power
supplies be enabled while the PLL is running. If the PLL is
locked and outputs enabled, turning off the regulator(s)
supplying the PLL will cause the PLL to enter an unpredictable
state.

Now in the CPU_UP_PREPARE notifier, the CPU clocks are prepared
and enabled, causing the source HFPLLs to also turn on. Note
that the CPU isn't clocked yet. It is possible that execution is
pre-empted and the CPU running the notifier enters power
collapse. If all other CPUs also enter power collapse, then it
is possible for an RPM notification to go out, allowing the RPM
to transition the Apps processor to its sleep set. This can
result in the HFPLL supplies being turned off while the HFPLL is
running, violating the requirement mentioned above. Once the CPU
is unclamped, the CPU is effectively unclocked, due to the HFPLL
being in an unknown state.

There is a check that is enabled in the PM code's CPU_UP_PREPARE
notifier callback. This check ensures that the problematic RPM
notification cannot occur until the core that is being brought
online also enters power collapse. However, there is no ordering
guarantee between that PM's hotplug notifier callback's execution
and the cpufreq hotplug notifier callback's execution. This
ordering depends on program link order, which is unreliable.

It is necessary to ensure that once the HFPLL is enabled, the
RPM cannot transition apps to its sleep set. Move the enabling
of the CPU clocks to the CPU_STARTING notifier, which runs on
the CPU bring brought online. The CPU_STARTING notifier is
guaranteed to run after the CPU_UP_PREPARE notifier, which
implies that the aforementioned do-not-notify-rpm check is
executed *before* the HFPLL is enabled. Therefore even if all
cores enter power collapse after the HFPLL is enabled, the
HFPLL supplies are guaranteed to stay on, or the CPU clock
is switched to the safe source and the HFPLL is turned off.

CRs-Fixed: 622738
Change-Id: I136841405806c07e755919859e649ded0c719abb
Signed-off-by: Vikram Mulukutla <markivx@codeaurora.org>
ASoC: wcd9xxx: Correct wrong check conditions

1) For targets where micbias is shared, we do not
use vddio to identify special headset. We want
micbias to be enabled always with any headset
inserted for such targets. Currently, if headset is
inserted during recording, we check for this vddio
flag as well. Since, it is null for the above mentioned
targets, we never touch the code to enable micbias
always for any type of headset.

2) Again for the above mentioned targets, if micbias
is enabled by voice call, and we insert the headset.
Now if headset is removed, we try force diable of
micbias. This results in Tx mute. The count to disable
micbias needs to be corrected.

Change-Id: I022a54578c47485ebf7eef27c405e31ea6395ecf
Signed-off-by: Simmi Pateriya <simmip@codeaurora.org>
msm: ultrasound: add support for stream parameters

Add new IOCTLs to get and set ultrasound stream parameters in DSP
using shared memory.

Change-Id: I627e9e40e29c6233dab4295e2c355a718e30bd01
Acked-by: Hadar Sivan <hsivan@qti.qualcomm.com>
Signed-off-by: Lior Barenboim <liorb@codeaurora.org>
ASoC: compr: Disable soft-pause for compress playback

Soft-pause (i.e pause ack after a timeout) adversely affects
audio/video sync during pause/resume use cases leading to some
frame drops. Disable this feature for compress playback.

Change-Id: I3ce444dadf1e4b94c1e8d6f017a1c639b082285f
Signed-off-by: Haynes Mathew George <hgeorge@codeaurora.org>
CRs-Fixed: 636328
msm: vidc: Increase I-frame period to INT_MAX

There is no restriction on I-frame and IDR period
values, so set them to INT_MAX.

Change-Id: I364ead16c3b8b8463fc8180159e5ee1f9fa10f37
Signed-off-by: Arun Menon <avmenon@codeaurora.org>
msm-camera: Avoid adding top up to calulated ab/ib for single stream.

Avoiding topup for ab/ib for single stream

Change-Id: Ie6fb6716ea1b30604d801936bea3da5a96d8a6fc
Signed-off-by: Chandan Gera <cgera@codeaurora.org>
SELinux: Fix kernel BUG on empty security contexts.

Setting an empty security context (length=0) on a file will
lead to incorrectly dereferencing the type and other fields
of the security context structure, yielding a kernel BUG.
As a zero-length security context is never valid, just reject
all such security contexts whether coming from userspace
via setxattr or coming from the filesystem upon a getxattr
request by SELinux.

Setting a security context value (empty or otherwise) unknown to
SELinux in the first place is only possible for a root process
(CAP_MAC_ADMIN), and, if running SELinux in enforcing mode, only
if the corresponding SELinux mac_admin permission is also granted
to the domain by policy.  In Fedora policies, this is only allowed for
specific domains such as livecd for setting down security contexts
that are not defined in the build host policy.

[On Android, this can only be set by root/CAP_MAC_ADMIN processes,
and if running SELinux in enforcing mode, only if mac_admin permission
is granted in policy.  In Android 4.4, this would only be allowed for
root/CAP_MAC_ADMIN processes that are also in unconfined domains. In current
AOSP master, mac_admin is not allowed for any domains except the recovery
console which has a legitimate need for it.  The other potential vector
is mounting a maliciously crafted filesystem for which SELinux fetches
xattrs (e.g. an ext4 filesystem on a SDcard).  However, the end result is
only a local denial-of-service (DOS) due to kernel BUG.  This fix is
queued for 3.14.]

Reproducer:
su
setenforce 0
touch foo
setfattr -n security.selinux foo

Caveat:
Relabeling or removing foo after doing the above may not be possible
without booting with SELinux disabled.  Any subsequent access to foo
after doing the above will also trigger the BUG.

BUG output from Matthew Thode:
[  473.893141] ------------[ cut here ]------------
[  473.962110] kernel BUG at security/selinux/ss/services.c:654!
[  473.995314] invalid opcode: 0000 [#6] SMP
[  474.027196] Modules linked in:
[  474.058118] CPU: 0 PID: 8138 Comm: ls Tainted: G      D   I
3.13.0-grsec #1
[  474.116637] Hardware name: Supermicro X8ST3/X8ST3, BIOS 2.0
07/29/10
[  474.149768] task: ffff8805f50cd010 ti: ffff8805f50cd488 task.ti:
ffff8805f50cd488
[  474.183707] RIP: 0010:[<ffffffff814681c7>]  [<ffffffff814681c7>]
context_struct_compute_av+0xce/0x308
[  474.219954] RSP: 0018:ffff8805c0ac3c38  EFLAGS: 00010246
[  474.252253] RAX: 0000000000000000 RBX: ffff8805c0ac3d94 RCX:
0000000000000100
[  474.287018] RDX: ffff8805e8aac000 RSI: 00000000ffffffff RDI:
ffff8805e8aaa000
[  474.321199] RBP: ffff8805c0ac3cb8 R08: 0000000000000010 R09:
0000000000000006
[  474.357446] R10: 0000000000000000 R11: ffff8805c567a000 R12:
0000000000000006
[  474.419191] R13: ffff8805c2b74e88 R14: 00000000000001da R15:
0000000000000000
[  474.453816] FS:  00007f2e75220800(0000) GS:ffff88061fc00000(0000)
knlGS:0000000000000000
[  474.489254] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[  474.522215] CR2: 00007f2e74716090 CR3: 00000005c085e000 CR4:
00000000000207f0
[  474.556058] Stack:
[  474.584325]  ffff8805c0ac3c98 ffffffff811b549b ffff8805c0ac3c98
ffff8805f1190a40
[  474.618913]  ffff8805a6202f08 ffff8805c2b74e88 00068800d0464990
ffff8805e8aac860
[  474.653955]  ffff8805c0ac3cb8 000700068113833a ffff880606c75060
ffff8805c0ac3d94
[  474.690461] Call Trace:
[  474.723779]  [<ffffffff811b549b>] ? lookup_fast+0x1cd/0x22a
[  474.778049]  [<ffffffff81468824>] security_compute_av+0xf4/0x20b
[  474.811398]  [<ffffffff8196f419>] avc_compute_av+0x2a/0x179
[  474.843813]  [<ffffffff8145727b>] avc_has_perm+0x45/0xf4
[  474.875694]  [<ffffffff81457d0e>] inode_has_perm+0x2a/0x31
[  474.907370]  [<ffffffff81457e76>] selinux_inode_getattr+0x3c/0x3e
[  474.938726]  [<ffffffff81455cf6>] security_inode_getattr+0x1b/0x22
[  474.970036]  [<ffffffff811b057d>] vfs_getattr+0x19/0x2d
[  475.000618]  [<ffffffff811b05e5>] vfs_fstatat+0x54/0x91
[  475.030402]  [<ffffffff811b063b>] vfs_lstat+0x19/0x1b
[  475.061097]  [<ffffffff811b077e>] SyS_newlstat+0x15/0x30
[  475.094595]  [<ffffffff8113c5c1>] ? __audit_syscall_entry+0xa1/0xc3
[  475.148405]  [<ffffffff8197791e>] system_call_fastpath+0x16/0x1b
[  475.179201] Code: 00 48 85 c0 48 89 45 b8 75 02 0f 0b 48 8b 45 a0 48
8b 3d 45 d0 b6 00 8b 40 08 89 c6 ff ce e8 d1 b0 06 00 48 85 c0 49 89 c7
75 02 <0f> 0b 48 8b 45 b8 4c 8b 28 eb 1e 49 8d 7d 08 be 80 01 00 00 e8
[  475.255884] RIP  [<ffffffff814681c7>]
context_struct_compute_av+0xce/0x308
[  475.296120]  RSP <ffff8805c0ac3c38>
[  475.328734] ---[ end trace f076482e9d754adc ]---

[sds:  commit message edited to note Android implications and
to generate a unique Change-Id for gerrit]

Change-Id: I4d5389f0cfa72b5f59dada45081fa47e03805413
Reported-by:  Matthew Thode <mthode@mthode.org>
Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
Cc: stable@vger.kernel.org
Signed-off-by: Paul Moore <pmoore@redhat.com>
Signed-off-by: Sivasri Kumar Vanka <sivasri@codeaurora.org>
mdss: Start wait for hist ready state past first kickoff

When the first histogram kickoff is done past reset, it might
be too late into the waiting period of completion. This
would cause a timeout even though data for the frame is made
available and interrupt is generated after timeout. This
causes a histogram read call to return with an error and
delay reading the data.

Edit to make the wait for ready to start after the first
kickoff. Add additional completion to denote first kickoff
and start wait after first kickoff wait has completed.

Change-Id: Ic9156b4d8852520715324707290287eb09df6195
Signed-off-by: Krishna Chaitanya Parimi <cparimi@codeaurora.org>
unix: fix a race condition in unix_release()

As reported by Jan, and others over the past few years, there is a
race condition caused by unix_release setting the sock->sk pointer
to NULL before properly marking the socket as dead/orphaned.  This
can cause a problem with the LSM hook security_unix_may_send() if
there is another socket attempting to write to this partially
released socket in between when sock->sk is set to NULL and it is
marked as dead/orphaned.  This patch fixes this by only setting
sock->sk to NULL after the socket has been marked as dead; I also
take the opportunity to make unix_release_sock() a void function
as it only ever returned 0/success.

Dave, I think this one should go on the -stable pile.

Special thanks to Jan for coming up with a reproducer for this
problem.

CRs-Fixed: 660580
Change-Id: I0e39b84464cf3f4c9daf8677bba444d0d6d94825
Reported-by: Jan Stancek <jan.stancek@gmail.com>
Signed-off-by: Paul Moore <pmoore@redhat.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Git-commit: ded34e0fe8fe8c2d595bfa30626654e4b87621e0
Git-repo: https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/
Signed-off-by: Vignesh Radhakrishnan <vigneshr@codeaurora.org>
msm: mdss: add error check for iommu attach API

Iommu device attach api returns error code if it fails.
MDP driver will check this error code and fall back to
recovery path if device attach fails.

Change-Id: I2b9d2d3aa16bc814739e466e9fc5a2c51c7b2b4b
Signed-off-by: Dhaval Patel <pdhaval@codeaurora.org>
ARM: dts: msm8974pro: Update BW votes to reflect clock plan

Either 931MHz or 800MHz is the turbo BIMC frequency, but both
do not exist in the same build.  Just request 931MHz.

Change-Id: I4b587e08689f9baa6e1088388d2748a298e7c916
Signed-off-by: Lucille Sylvester <lsylvest@codeaurora.org>
ARM: dts: msm: Add NFC to msm8974pro-ab device tree

enable nfc on 8974-ab devices with pm8941.

Change-Id: I4165f52da25839dacf00232edde3ceac0d0adef1
Signed-off-by: Houston Hoffman <hhoffman@codeaurora.org>
msm: camera2: cpp: Change bus scale vector call sequence

The cpp driver can set the bus scale vector when cpp module is
actually included. This will avoid unnecessary power consumption
due to setting the bus scale vector.

Change-Id: I898bb33f4433d8b70f63c07facd6e22d58196211
Signed-off-by: Rajakumar Govindaram <rajakuma@codeaurora.org>
msm: camera: Free queue data during camera close

CPP hardware is singleton, only one hardware used for processing
frames of different camera if more than one camera is running at
the same time. When camera is closed ensure that processing frame
queue and event data queue is empty.

Change-Id: Ie8e41431dd9b7acd29bac0f59fe2d4afa243ec2c
Signed-off-by: Sreesudhan Ramakrish Ramkumar <srramku@codeaurora.org>
Signed-off-by: Rajakumar Govindaram <rajakuma@codeaurora.org>
msm: camera2: cpp: Support queue and timer clean up.

The timer callback is triggered after the node shutdown under
some error conditions. The timer callback should be avoided
in such cases. If in some race condition the timer callback is
triggered then it needs to check the state before timeout
processing.

Change-Id: Ic5663c69f556f30592ff6eb20f99c7c4a5ac859d
Signed-off-by: Rajakumar Govindaram <rajakuma@codeaurora.org>
ASoC: msm: qdsp6v2: adding volume per dev-id

Add volume mixer control per device id for pcm use case.

Change-Id: Ieab721541a5cdf494b7fad78abc06d4f667b4baf
Signed-off-by: Anish Kumar <kanish@codeaurora.org>
msm: kgsl: Add a flag to mark user mapped GPU buffers

Add a flag in /sys/kernel/debug/kgsl/kgsl-3do/proc/<pid>/mem
file to indicate for each GPU buffer if it is mapped to userspace
in <pid> or not.

CRs-fixed: 634962

Conflicts:

	drivers/gpu/msm/kgsl_debugfs.c

Change-Id: I8abda74ef5656aca6b1c0315af8deb77460fa5a9
Signed-off-by: Harsh Vardhan Dwivedi <hdwivedi@codeaurora.org>
Signed-off-by: Prabhat Awasthi <pawasthi@codeaurora.org>
nl80211: nl80211hdr_put() doesn't return an ERR_PTR

There are a few places which check nl80211hdr_put() for an ERR_PTR
but actually it returns NULL on error and never error values.  In
nl80211_testmode_dump() the return wasn't checked at all so I have
added one.

Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
[some whitespace changes]
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Git-commit: cb35fba360dfc3496e5d8a47e23ec5ccdfd90925
Git-repo: git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
Change-Id: I5da1aafea35110a1ce606d402b1b96859d34b869
[akholaif@codeaurora.org: resolved conflicts manually]
Signed-off-by: Ahmad Kholaif <akholaif@codeaurora.org>
nl80211: fix error path in nl80211_get_key()

Coverity pointed out that in the (practically impossible)
error case we leak the message - fix this.

Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Git-commit: 9fe271af7d4de96471c5aaee2f4d0d1576050497
Git-repo: git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
Change-Id: I78c3631eabd04e86872faf65fa1e401dadb35a75
Signed-off-by: Ahmad Kholaif <akholaif@codeaurora.org>