sched: Fix reference to stale task_struct in try_to_wake_up()

try_to_wake_up() currently drops p->pi_lock and later checks for need
to notify cpufreq governor on task migrations or wakeups. However the
woken task could exit between the time p->pi_lock is released and the
time the test for notification is run. As a result, the test for
notification could refer to an exited task. task_notify_on_migrate(p)
could thus lead to invalid memory reference.

Fix this by running the test for notification with task's pi_lock
held.

Change-Id: I1c7a337473d2d8e79342a015a179174ce00702e1
Signed-off-by: Srivatsa Vaddagiri <vatsa@codeaurora.org>
avtimer: msm: fix to avoid timejump in avtimer

In VT call, observe timestamp jump in avtimer
causing issue in camera timestamps.
By doing division with clk_div on avtimer tick,
timestamp is calculate correctly now.

Change-Id: I8d1c8d162ee28b6430c9c2e6ca323e212bacfbf2
CRs-Fixed: 726296
Signed-off-by: Laxminath Kasam <lkasam@codeaurora.org>
avtimer: Update include path for q6core change

Change-Id: I5953b2c035e48933a7117c85fbcb4c94126a6de3
avtimer: avoid timer query from clients during SSR

Update AV timer driver to schecdule a workqueue to
make sure the ADSP on modem is up while honouring the
requests from client for timer query.

Change-Id: I3c3283e778c836fce1a68cf8a5dc439124ef2f1f
Signed-off-by: Santosh Mardi <gsantosh@codeaurora.org>
Signed-off-by: Laxminath Kasam <lkasam@codeaurora.org>
ASoC: msm: update platform driver to handle new SSR design.

Update PCM platform driver to handle the reset events during
SSR and also unblock the write wait according to
the new SSR design

Change-Id: Id0b4950ffc0eb130dbfdce36375629a683752044
CRs-Fixed: 661491
Signed-off-by: Santosh Mardi <gsantosh@codeaurora.org>
ASoC: msm: qdsp6v2: requeue read buffers in mmap device switch

When device switch happens, ASM might return a 0 length
buffer. For MMAP style capture cases, buffers need to be
re-queued at the event handler for this case, otherwise
ASM will have no buffers to read data into after the
device is over successful.

CRs-fixed: 700614
Change-Id: I2b8930a3058bbe3979405d5de04d3371291db42d
Signed-off-by: Banajit Goswami <bgoswami@codeaurora.org>
ASoC: msm: qdsp6v2: move hw_params into prepare

Asoc framework supports parallelization of operations
which reduces the startup latency.
Moving hw_params into prepare further reduces this start
up latency.

Change-Id: If38df2ba22daa94afdff8a7cd90263f4a1fafae7
Signed-off-by: Anish Kumar <kanish@codeaurora.org>
ASoC: msm: q6dspv2: add pause/resume support for audio record

Add support for pause/resume functionality for audio capture
path. When application calls stop()for for pausing, suspend
the ASM stream, so that hardware resources can be released.
Again when resuming capture streams with prepare()->start(),
ASM open and the routing call should not be called again.

CRs-fixed: 692084
Change-Id: I59e014696ab0a8c473b87361ac9b739adf538d32
Signed-off-by: Banajit Goswami <bgoswami@codeaurora.org>
ASoC: msm: qdsp6v2: check proxy port is open when closing

The current logic opens the afe proxy port only if the
proxy instance virtual port is opened. If only
pcm instance virtual port is opened and a close of the
afe proxy port is attempted, this causes the device to
crash due to a wait event timeout as the driver tries
to close an unopened afe port.
The change ensures that only if both the virtual ports
are opened, which in effect starts the proxy port,
the afe close commands for the proxy port is sent to DSP,
else return immediately.

Change-Id: I9450001c608208f3d8da22b2881a88db1c21d950
Signed-off-by: Aravind Kumar <akumark@codeaurora.org>
ASoC: msm: qdsp6v2: clear old memhandle list when SSR happens

When SSR triggers, ASM gets RESET_EVENT callback.
Clear custom topology related old memhandle list here.
Otherwise for next ASM session opened after SSR,
old memhandle is sent to DSP and result in no audio.
Also, for ASM session while unmap during SSR, APR
command fail is expected, even then go ahead and
clear old mem handles relating to session.
Add changes to clear it from list.

CRs-Fixed: 592823, 589762, 592580, 590719, 589450, 593497
Change-Id: I10fc8190e929c7a4a344b1d393233e6cbcfcee97
Signed-off-by: Laxminath Kasam <lkasam@codeaurora.org>
ASoC: qdsp6v2: update perf mode flag for LL capture cases

Read perf mode flag from platform data and update to the
audio client structure, so that the right settings can be
applied to ADM for Low-latency capture use-case.
Also, update the correct bit value for ASM perf mode flag
sent to DSP.

Change-Id: If1f8b9e657a409fd9d2af19ff004a797fd987788
Signed-off-by: Banajit Goswami <bgoswami@codeaurora.org>
ASoC: msm: qdsp6v2: update rtac driver with asm handle

rtac driver uses the asm session handle to communicate with DSP
this handle is supplied to rtac driver in q6asm_audio_client_alloc
function. But the rtac driver is not updated when the asm session
is de-allocated. This change is about updating rtac driver with
asm session handle during q6asm_audio_client_free.

Change-Id: I10bab5830d8e29d17907511c757c4d2bcf09c0cc
Signed-off-by: Srikanth Uyyala <suyyala@codeaurora.org>
ASoC: msm: qdsp6v2: Fix for cmd status overwrite

There is a race condition between offload callback thread
and HAL thread which can cause an eos ack notification to
be overwritten by a stop command request. Fix this by
using separate status vars for commands originating from
different thread contexts

Change-Id: I87dc0e34f4c50d48a25f4d7eaccd876b2ae827f0
Signed-off-by: Haynes Mathew George <hgeorge@codeaurora.org>
ASoC: msm: compr: Ensure drain sequence is executed

This change ensures drain sequence is executed even if
a pause/resume commands are sent from userspace while
the control thread is waiting for all buffers to be consumed
by DSP.
CRs-Fixed: 711920

Change-Id: I6ffcc072e00fa1865b0484f54fa6b070c1a73cf2
Signed-off-by: Haynes Mathew George <hgeorge@codeaurora.org>
ASoC: msm: qdsp6v2: Add the matrix mixer call during ASM loopback

Add support for matrix mixer command. The render window start and
end are set up before RUN CMD for ASM loopback is issued. This
will ensure that audio data is not dropped and audio quality
is good.

CRs-fixed: 667925
Change-Id: I406d86e9805d9f57613c0349f11cfc729ef7a24c
Signed-off-by: Damir Didjusto <damird@codeaurora.org>
ASoC: msm: qdsp6v2: Cleanup of compress offload drivers

Clean up the format specifiers for compress offload drivers
and add compat ioctl support

Change-Id: I0829830336ec62c66658d6a5199d73b61249f791
Signed-off-by: Damir Didjusto <damird@codeaurora.org>
Signed-off-by: Gopikrishnaiah Anandan <agopik@codeaurora.org>
ALSA: control: Fix missing VOLATILE flag at creating controls

The SNDRV_CTL_ELEM_ACCESS_VOLATILE bit flag wasn't properly inherited
at creating control elements via snd_ctl_new1().

Signed-off-by: Takashi Iwai <tiwai@suse.de>

ALSA: PCM: Fix some races at disconnection

Fix races at PCM disconnection:
- while a PCM device is being opened or closed
- while the PCM state is being changed without lock in prepare,
  hw_params, hw_free ops

Reported-by: Matthieu CASTET <matthieu.castet@parrot.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: Takashi Iwai <tiwai@suse.de>

ALSA: Avoid endless sleep after disconnect

When disconnect callback is called, each component should wake up
sleepers and check card->shutdown flag for avoiding the endless sleep
blocking the proper resource release.

Cc: <stable@vger.kernel.org>
Signed-off-by: Takashi Iwai <tiwai@suse.de>

ALSA: PCM: Remove redundant null check before kfree

kfree on a null pointer is a no-op.

Signed-off-by: Sachin Kamat <sachin.kamat@linaro.org>
Signed-off-by: Takashi Iwai <tiwai@suse.de>

ALSA: fix oops in snd_pcm_info() caused by ASoC DPCM

commit a4461f41b94cb52e0141af717dcf4ef6558c8e2e upstream.

Unable to handle kernel NULL pointer dereference at virtual address 00000008
pgd = d5300000
[00000008] *pgd=0d265831, *pte=00000000, *ppte=00000000
Internal error: Oops: 17 [#1] PREEMPT ARM
CPU: 0 PID: 2295 Comm: vlc Not tainted 3.11.0+ #755
task: dee74800 ti: e213c000 task.ti: e213c000
PC is at snd_pcm_info+0xc8/0xd8
LR is at 0x30232065
pc : [<c031b52c>]    lr : [<30232065>]    psr: a0070013
sp : e213dea8  ip : d81cb0d0  fp : c05f7678
r10: c05f7770  r9 : fffffdfd  r8 : 00000000
r7 : d8a968a8  r6 : d8a96800  r5 : d8a96200  r4 : d81cb000
r3 : 00000000  r2 : d81cb000  r1 : 00000001  r0 : d8a96200
Flags: NzCv  IRQs on  FIQs on  Mode SVC_32  ISA ARM  Segment user
Control: 10c5387d  Table: 15300019  DAC: 00000015
Process vlc (pid: 2295, stack limit = 0xe213c248)
[<c031b52c>] (snd_pcm_info) from [<c031b570>] (snd_pcm_info_user+0x34/0x9c)
[<c031b570>] (snd_pcm_info_user) from [<c03164a4>] (snd_pcm_control_ioctl+0x274/0x280)
[<c03164a4>] (snd_pcm_control_ioctl) from [<c0311458>] (snd_ctl_ioctl+0xc0/0x55c)
[<c0311458>] (snd_ctl_ioctl) from [<c00eca84>] (do_vfs_ioctl+0x80/0x31c)
[<c00eca84>] (do_vfs_ioctl) from [<c00ecd5c>] (SyS_ioctl+0x3c/0x60)
[<c00ecd5c>] (SyS_ioctl) from [<c000e500>] (ret_fast_syscall+0x0/0x48)
Code: e1a00005 e59530dc e3a01001 e1a02004 (e5933008)
---[ end trace cb3d9bdb8dfefb3c ]---

This is provoked when the ASoC front end is open along with its backend,
(which causes the backend to have a runtime assigned to it) and then the
SNDRV_CTL_IOCTL_PCM_INFO is requested for the (visible) backend device.

Resolve this by ensuring that ASoC internal backend devices are not
visible to userspace, just as the commentry for snd_pcm_new_internal()
says it should be.

Signed-off-by: Russell King <rmk+kernel@arm.linux.org.uk>
Acked-by: Mark Brown <broonie@linaro.org>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

ALSA: control: Protect user controls against concurrent access

commit 07f4d9d74a04aa7c72c5dae0ef97565f28f17b92 upstream.

The user-control put and get handlers as well as the tlv do not protect against
concurrent access from multiple threads. Since the state of the control is not
updated atomically it is possible that either two write operations or a write
and a read operation race against each other. Both can lead to arbitrary memory
disclosure. This patch introduces a new lock that protects user-controls from
concurrent access. Since applications typically access controls sequentially
than in parallel a single lock per card should be fine.

Signed-off-by: Lars-Peter Clausen <lars@metafoo.de>
Acked-by: Jaroslav Kysela <perex@perex.cz>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

ALSA: control: Fix replacing user controls

commit 82262a46627bebb0febcc26664746c25cef08563 upstream.

There are two issues with the current implementation for replacing user
controls. The first is that the code does not check if the control is actually a
user control and neither does it check if the control is owned by the process
that tries to remove it. That allows userspace applications to remove arbitrary
controls, which can cause a user after free if a for example a driver does not
expect a control to be removed from under its feed.

The second issue is that on one hand when a control is replaced the
user_ctl_count limit is not checked and on the other hand the user_ctl_count is
increased (even though the number of user controls does not change). This allows
userspace, once the user_ctl_count limit as been reached, to repeatedly replace
a control until user_ctl_count overflows. Once that happens new controls can be
added effectively bypassing the user_ctl_count limit.

Both issues can be fixed by instead of open-coding the removal of the control
that is to be replaced to use snd_ctl_remove_user_ctl(). This function does
proper permission checks as well as decrements user_ctl_count after the control
has been removed.

Note that by using snd_ctl_remove_user_ctl() the check which returns -EBUSY at
beginning of the function if the control already exists is removed. This is not
a problem though since the check is quite useless, because the lock that is
protecting the control list is released between the check and before adding the
new control to the list, which means that it is possible that a different
control with the same settings is added to the list after the check. Luckily
there is another check that is done while holding the lock in snd_ctl_add(), so
we'll rely on that to make sure that the same control is not added twice.

Signed-off-by: Lars-Peter Clausen <lars@metafoo.de>
Acked-by: Jaroslav Kysela <perex@perex.cz>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

ALSA: control: Don't access controls outside of protected regions

commit fd9f26e4eca5d08a27d12c0933fceef76ed9663d upstream.

A control that is visible on the card->controls list can be freed at any time.
This means we must not access any of its memory while not holding the
controls_rw_lock. Otherwise we risk a use after free access.

Signed-off-by: Lars-Peter Clausen <lars@metafoo.de>
Acked-by: Jaroslav Kysela <perex@perex.cz>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

ALSA: control: Handle numid overflow

commit ac902c112d90a89e59916f751c2745f4dbdbb4bd upstream.

Each control gets automatically assigned its numids when the control is created.
The allocation is done by incrementing the numid by the amount of allocated
numids per allocation. This means that excessive creation and destruction of
controls (e.g. via SNDRV_CTL_IOCTL_ELEM_ADD/REMOVE) can cause the id to
eventually overflow. Currently when this happens for the control that caused the
overflow kctl->id.numid + kctl->count will also over flow causing it to be
smaller than kctl->id.numid. Most of the code assumes that this is something
that can not happen, so we need to make sure that it won't happen

Signed-off-by: Lars-Peter Clausen <lars@metafoo.de>
Acked-by: Jaroslav Kysela <perex@perex.cz>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

ALSA: control: Make sure that id->index does not overflow

commit 883a1d49f0d77d30012f114b2e19fc141beb3e8e upstream.

The ALSA control code expects that the range of assigned indices to a control is
continuous and does not overflow. Currently there are no checks to enforce this.
If a control with a overflowing index range is created that control becomes
effectively inaccessible and unremovable since snd_ctl_find_id() will not be
able to find it. This patch adds a check that makes sure that controls with a
overflowing index range can not be created.

Signed-off-by: Lars-Peter Clausen <lars@metafoo.de>
Acked-by: Jaroslav Kysela <perex@perex.cz>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

ALSA: compress: fix the states to check for allowing read

for reading compressed data, we need to allow when we are paused, draining or
stopped.

Signed-off-by: Vinod Koul <vinod.koul@intel.com>
Cc: Charles Keepax <ckeepax@opensource.wolfsonmicro.com>
Cc: Richard Fitzgerald <rf@opensource.wolfsonmicro.com>
Reviewed-by: Mark Brown <broonie@opensource.wolfsonmicro.com>
Signed-off-by: Takashi Iwai <tiwai@suse.de>

ALSA: pcm - Optimize the call of snd_pcm_update_hw_ptr() in read/write loop

In the PCM read/write loop, the driver calls snd_pcm_update_hw_ptr()
at each time at the beginning of the loop.  Russell King reported that
this hogs CPU significantly.

The current code assumes that the pointer callback is very fast and
cheap, also not too much fine grained.  It's not true in all cases.
When the pointer advances short samples while the read/write copy has
been performed, the driver updates the hw_ptr and gets avail > 0
again.  Then it tries to read/write these small chunks.  This repeats
until the avail really gets to zero.

For avoiding this situation, a simple workaround is to call
snd_pcm_update_hw_ptr() only once at starting the loop, assuming that
the read/write copy is performed fast enough.  If the available count
becomes short, it goes to snd_pcm_wait_avail() anyway, and this
processes right.

Tested-by: Russell King <rmk+kernel@arm.linux.org.uk>
Signed-off-by: Takashi Iwai <tiwai@suse.de>

ALSA: pcm - Add proper state checks to snd_pcm_drain()

The handling for some PCM states is missing for snd_pcm_drain().
At least, XRUN streams should be simply dropped to SETUP, and a few
initial invalid states should be rejected.

Signed-off-by: Takashi Iwai <tiwai@suse.de>

ALSA: core: group read of pointer, tstamp and jiffies

Group read of hw_ptr, tstamp and jiffies in a sequence
for better correlation. Previous code took timestamp at the
end, which could introduce delays between audio time and
system time.

Signed-off-by: Pierre-Louis Bossart <pierre-louis.bossart@linux.intel.com>
Signed-off-by: Takashi Iwai <tiwai@suse.de>

ALSA: core: keep track of boundary wrap-around

Keep track of boundary crossing when hw_ptr
exceeds boundary limit and wraps-around. This
will help keep track of total number
of frames played/received at the kernel level

Signed-off-by: Pierre-Louis Bossart <pierre-louis.bossart@linux.intel.com>
Signed-off-by: Takashi Iwai <tiwai@suse.de>

ALSA: core: add hooks for audio timestamps

ALSA did not provide any direct means to infer the audio time for A/V
sync and system/audio time correlations (eg. PulseAudio).
Applications had to track the number of samples read/written and
add/subtract the number of samples queued in the ring buffer.  This
accounting led to small errors, typically several samples, due to the
two-step process.  Computing the audio time in the kernel is more
direct, as all the information is available in the same routines.

Also add new .audio_wallclock routine to enable fine-grain synchronization
between monotonic system time and audio hardware time.
Using the wallclock, if supported in hardware, allows for a
much better sub-microsecond precision and a common drift tracking for
all devices sharing the same wall clock (master clock).

Change-Id: Iffa98b047163fb3e250e0543cc91b66b5cc298dd
Signed-off-by: Pierre-Louis Bossart <pierre-louis.bossart@linux.intel.com>
Signed-off-by: Takashi Iwai <tiwai@suse.de>

ASoC: core: Support for compress ioctls

Compat driver should support compress ioctls when
COMPAT mode is enabled. Change adds support for
handling compress ioctls.

Change-Id: If7223ace326253240a1cd65bc9a111b8903977f1
Signed-off-by: Gopikrishnaiah Anandan <agopik@codeaurora.org>
ALSA: Add a reference counter to card instance

commit a0830dbd4e42b38aefdf3fb61ba5019a1a99ea85 upstream.

For more strict protection for wild disconnections, a refcount is
introduced to the card instance, and let it up/down when an object is
referred via snd_lookup_*() in the open ops.

The free-after-last-close check is also changed to check this refcount
instead of the empty list, too.

Change-Id: I932c59f53d2508b9e0eace74625e3654344a4e1c
Reported-by: Matthieu CASTET <matthieu.castet@parrot.com>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
ALSA: Fix card refcount unbalance

commit 8bb4d9ce08b0a92ca174e41d92c180328f86173f upstream.

There are uncovered cases whether the card refcount introduced by the
commit a0830dbd isn't properly increased or decreased:
- OSS PCM and mixer success paths
- When lookup function gets NULL

This patch fixes these places.

Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=50251

Change-Id: Iaf4f50e298417fcf6cc81c53679af0ade85e2b89
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
cm: Enable AVTIMER

Change-Id: Ie91a1e5a8982e1e65b9d1e5636aed80cdc5da3e3