Merge Motorola vendor-qcom-opensource-wlan-prima driver

* Motorola package version: MM-KXB21.14-L1.32

Change-Id: I99a479522f2e5754e2d6ca84124e4918dee4bd01
prima: Add make entries for prima

Change-Id: I2bb5444c37fb66f7bd92ae70c3aa5baa5dcd2dbb
falcon: Add fully generated defconfig

* Motorola package version: MM-KXB21.14-L1.32

Change-Id: I8a8bb312b80b32afe43ed5dc08842c4e332303cd
falcon: Enable XZ compression

Change-Id: I222f208bacc3621d43ac035a7dc1eae5d73275e1
falcon: Disable modules whitelist

Change-Id: I8c975d2fe7e58ea54245f395d08d3d965b8fcabe
falcon: Update defconfig

Change-Id: I1c0a81f44c52a0266ccff2fdeaba0ccb306f5c4e
msm: smd: fix in-tree compilation

In-tree compilation for arch/arm/mach-msm/smd_init_dt.c was hitting this
error:

arch/arm/mach-msm/smd_init_dt.c:24:25: fatal error: smd_private.h: No such
file or directory
 #include <smd_private.h>

This was due to using <> instead of "" style include.

Change-Id: I462d259410377244cd551db910df9e15521544ed
Signed-off-by: Kumar Gala <galak@codeaurora.org>
ASoC: msm: fix in-tree compilation for RTAC

In-tree compilation for sound/soc/msm/qdsp6v2/rtac.c was hitting this
error:

sound/soc/msm/qdsp6v2/rtac.c:27:21: fatal error: q6voice.h: No such file
or directory
 #include <q6voice.h>

This was due to using <> instead of "" style include.

Change-Id: Ie96cc91bd29e44c55b9fb0cbc36e25786d6f8823
Signed-off-by: Kumar Gala <galak@codeaurora.org>
msm: Fix compiling kernel in place

A number of files incorrectly used system include notation <> for header
files that are local.  Fix thoses cases to now be #include "FILE.h" instead
of #include <FILE.h>

Change-Id: I1467268b10b33b6fd29bc36b2312378a0b1dde32
Signed-off-by: Kumar Gala <galak@codeaurora.org>
ALSA: Export audio effects header

Export audio_effects.h for userland to use

Change-Id: Ib4b040a87bcf89542d8c9dfb363fcd5f9a1bfc76
futex-prevent-requeue-pi-on-same-futex.patch futex: Forbid uaddr == uaddr2 in futex_requeue(..., requeue_pi=1)

If uaddr == uaddr2, then we have broken the rule of only requeueing
from a non-pi futex to a pi futex with this call. If we attempt this,
then dangling pointers may be left for rt_waiter resulting in an
exploitable condition.

This change brings futex_requeue() into line with
futex_wait_requeue_pi() which performs the same check as per commit
6f7b0a2a5 (futex: Forbid uaddr == uaddr2 in futex_wait_requeue_pi())

[ tglx: Compare the resulting keys as well, as uaddrs might be
  	different depending on the mapping ]

Fixes CVE-2014-3153.

Reported-by: Pinkie Pie
Signed-off-by: Will Drewry <wad@chromium.org>
Signed-off-by: Kees Cook <keescook@chromium.org>
Cc: stable@vger.kernel.org
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Git-commit: 5b3bbe42f5874081123fa3aa4dd85d5e5c806f54
Git-repo: https://android.googlesource.com/kernel/common.git
Signed-off-by: Ian Maund <imaund@codeaurora.org>
futex: Validate atomic acquisition in futex_lock_pi_atomic()

We need to protect the atomic acquisition in the kernel against rogue
user space which sets the user space futex to 0, so the kernel side
acquisition succeeds while there is existing state in the kernel
associated to the real owner.

Verify whether the futex has waiters associated with kernel state. If
it has, return -EINVAL. The state is corrupted already, so no point in
cleaning it up. Subsequent calls will fail as well. Not our problem.

[ tglx: Use futex_top_waiter() and explain why we do not need to try
  	restoring the already corrupted user space state. ]

Signed-off-by: Darren Hart <dvhart@linux.intel.com>
Cc: Kees Cook <keescook@chromium.org>
Cc: Will Drewry <wad@chromium.org>
Cc: stable@vger.kernel.org
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Git-commit: 550c7910f0e2fd4f130fec2f17541f3614fdfaf9
Git-repo: https://android.googlesource.com/kernel/common.git
Signed-off-by: Ian Maund <imaund@codeaurora.org>
futex: Always cleanup owner tid in unlock_pi

If the owner died bit is set at futex_unlock_pi, we currently do not
cleanup the user space futex. So the owner TID of the current owner
(the unlocker) persists. That's observable inconsistant state,
especially when the ownership of the pi state got transferred.

Clean it up unconditionally.

Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Cc: Kees Cook <keescook@chromium.org>
Cc: Will Drewry <wad@chromium.org>
Cc: Darren Hart <dvhart@linux.intel.com>
Cc: stable@vger.kernel.org
Git-commit: a2ec8e3dcdc6c93f574a0e22039b791cc5e14fa6
Git-repo: https://android.googlesource.com/kernel/common.git
Signed-off-by: Ian Maund <imaund@codeaurora.org>
futex: Make lookup_pi_state more robust

The current implementation of lookup_pi_state has ambigous handling of
the TID value 0 in the user space futex. We can get into the kernel
even if the TID value is 0, because either there is a stale waiters
bit or the owner died bit is set or we are called from the requeue_pi
path or from user space just for fun.

The current code avoids an explicit sanity check for pid = 0 in case
that kernel internal state (waiters) are found for the user space
address. This can lead to state leakage and worse under some
circumstances.

Handle the cases explicit:

     Waiter | pi_state | pi->owner | uTID      | uODIED | ?

[1]  NULL   | ---      | ---       | 0         | 0/1    | Valid
[2]  NULL   | ---      | ---       | >0        | 0/1    | Valid

[3]  Found  | NULL     | --        | Any       | 0/1    | Invalid

[4]  Found  | Found    | NULL      | 0         | 1      | Valid
[5]  Found  | Found    | NULL      | >0        | 1      | Invalid

[6]  Found  | Found    | task      | 0         | 1      | Valid

[7]  Found  | Found    | NULL      | Any       | 0      | Invalid

[8]  Found  | Found    | task      | ==taskTID | 0/1    | Valid
[9]  Found  | Found    | task      | 0         | 0      | Invalid
[10] Found  | Found    | task      | !=taskTID | 0/1    | Invalid

[1]  Indicates that the kernel can acquire the futex atomically. We
     came came here due to a stale FUTEX_WAITERS/FUTEX_OWNER_DIED bit.

[2]  Valid, if TID does not belong to a kernel thread. If no matching
     thread is found then it indicates that the owner TID has died.

[3]  Invalid. The waiter is queued on a non PI futex

[4]  Valid state after exit_robust_list(), which sets the user space
     value to FUTEX_WAITERS | FUTEX_OWNER_DIED.

[5]  The user space value got manipulated between exit_robust_list()
     and exit_pi_state_list()

[6]  Valid state after exit_pi_state_list() which sets the new owner in
     the pi_state but cannot access the user space value.

[7]  pi_state->owner can only be NULL when the OWNER_DIED bit is set.

[8]  Owner and user space value match

[9]  There is no transient state which sets the user space TID to 0
     except exit_robust_list(), but this is indicated by the
     FUTEX_OWNER_DIED bit. See [4]

[10] There is no transient state which leaves owner and user space
     TID out of sync.

Backport to 3.13
  conflicts: kernel/futex.c

Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Signed-off-by: John Johansen <john.johansen@canonical.com>
Cc: Kees Cook <keescook@chromium.org>
Cc: Will Drewry <wad@chromium.org>
Cc: Darren Hart <dvhart@linux.intel.com>
Cc: stable@vger.kernel.org
Git-commit: b50939f89dae691f8da9e0fd22e0eae0db1c0ae4
Git-repo: https://android.googlesource.com/kernel/common.git
Signed-off-by: Ian Maund <imaund@codeaurora.org>
msm: vidc: add LTR support for video encoder

Enable LTR support for VP8 codec to add robust error resilience.

Change-Id: I3b87c5cdaef836a6d02d5b9fe71b7165b7f13581
Signed-off-by: Ashray Kulkarni <ashrayk@codeaurora.org>
msm: vidc: Add generic LTR mode support

Use generic LTR HFI APIs for h264 and vp8 formats.

Change-Id: I9f307046d7ec6de4eb6d43704686be902356882a
Signed-off-by: Ashray Kulkarni <ashrayk@codeaurora.org>
[media] v4l2: Add enum for frame level QP extra-data

This option is intended to be used to request as extra-data
the frame level QP.

Change-Id: Icaf88bd5a48ac394d1ed7ded8dc320cfeebc2765
Signed-off-by: Jorge Solano Altamirano <jsolano@codeaurora.org>
msm: vidc: Add support to request frame level QP information

The resulting QP information for H264 is the slice level
QP averaged over whole frame; for all other codecs its
frame level QP.

Change-Id: I288904b05d886c1e94fc113b8bd3fba5b13b48f3
Signed-off-by: Jorge Solano Altamirano <jsolano@codeaurora.org>
[media] v4l2: Add enums to request frame bits info as extra-data

This option is intended to be used to request as extra-data
the size in bits from frame header and frame itself.

Change-Id: I207045cda8c8038981bcf4548eb3d221502a67e1
Signed-off-by: Jorge Solano Altamirano <jsolano@codeaurora.org>
msm: vidc: Add support to request frame bits info as extra-data

Provides information regarding number of bits in the frame (i.e frame
size expressed in bits) & also the number of bits in frame header (i.e
frame header size expressed in bits).
Number of bits in header is reported as:
For H264, sum of all slice headers bits for all the slices in the frame.
For all other codecs, number of bits in the frame header.

Change-Id: I6caeca025ff0ce059a20891a6d657b47c4b452b3
Signed-off-by: Jorge Solano Altamirano <jsolano@codeaurora.org>