USB: f_mtp: Set maximum burst value to two for superspeed mode

Currently burst value is set to zero for superspeed in mtp driver.
MTP throughput can be improved by setting max burst vlaue to non
zero value in superspeed mode. Hence set max burst vlaue to two
for both IN and OUT bulk endpoints in superspeed mode.

Signed-off-by: Pranav Vashi <neobuddy89@gmail.com>
tty: serial: Use "no_log" readl/writel variants in hsl_read/write

hsl_read and hsl_write both directly call ioread32/iowrite32, which
leads to either a __raw_readl or __raw_writel call. These
readl/writel call are logged to the register trace buffer (RTB) by
default and generate a very large amount of output. This patch
directly calls __raw_readl_no_log and __raw_writel_no_log in
hsl_read and hsl_write to avoid logging these events to the RTB.

Signed-off-by: David Garibaldi <dgaribal@codeaurora.org>
Signed-off-by: Pranav Vashi <neobuddy89@gmail.com>
tty: Fix race condition if flushing tty flip buffers

As Ilya Zykov identified in his patch 'PROBLEM: Race condition in
tty buffer's function flush_to_ldisc()', a race condition exists
which allows a parallel flush_to_ldisc() to flush and free the tty
flip buffers while those buffers are in-use. For example,

  CPU 0                         |  CPU 1                                  |  CPU 2
                                | flush_to_ldisc()                        |
                                |  grab spin lock                         |
tty_buffer_flush()              |                                         | flush_to_ldisc()
 wait for spin lock             |                                         |  wait for spin lock
                                |   if (!test_and_set_bit(TTYP_FLUSHING)) |
                                |    while (next flip buffer)             |
                                |     ...                                 |
                                |     drop spin lock                      |
  grab spin lock                |                                         |
   if (test_bit(TTYP_FLUSHING)) |                                         |
    set_bit(TTYP_FLUSHPENDING)  |      receive_buf()                      |
    drop spin lock              |                                         |
                                |                                         |   grab spin lock
                                |                                         |    if (!test_and_set_bit(TTYP_FLUSHING))
                                |                                         |    if (test_bit(TTYP_FLUSHPENDING))
                                |                                         |    __tty_buffer_flush()

CPU 2 has just flushed and freed all tty flip buffers while CPU 1 is
transferring data from the head flip buffer.

The original patch was rejected under the assumption that parallel
flush_to_ldisc() was not possible. Because of necessary changes to
the workqueue api, work items can execute in parallel on SMP.

This patch differs slightly from the original patch by testing for
a pending flush _after_ each receive_buf(), since TTYP_FLUSHPENDING
can only be set while the lock is dropped around receive_buf().

Signed-off-by: Peter Hurley <peter@hurleysoftware.com>
Acked-by: Ilya Zykov <linux@izyk.ru>
Cc: Jiri Slaby <jslaby@suse.cz>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Syed Rameez Mustafa <rameezmustafa@codeaurora.org>
Signed-off-by: Pranav Vashi <neobuddy89@gmail.com>
Revert "msm: tty: update receive room just before writing data to the ldisc"

This change seems to be a hack introduced for some corner cases seen on
certain old fusion targets. The change is no longer applicable and is
being reverted to bring the driver closer to the upstream implementation.
The presence of this causes several merge conflicts when pulling upstream
fixes. It has already been reverted on mainline.

Signed-off-by: Syed Rameez Mustafa <rameezmustafa@codeaurora.org>
Signed-off-by: Pranav Vashi <neobuddy89@gmail.com>
n_tty: Don't lose characters when PARMRK is enabled

When PARMRK is set and large transfers of characters that will get
marked are being received, n_tty could drop data silently (i.e.
without reporting any error to the client). This is because
characters have the potential to take up to three bytes in the line
discipline (when they get marked with parity or framing errors), but
the amount of free space reported to tty_buffer flush_to_ldisc (via
tty->receive_room) is based on the pre-marked data size.

With this patch, the n_tty layer will no longer assume that each byte
will only take up one byte in the line discipline. Instead, it will
make an overly conservative estimate that each byte will take up
three bytes in the line discipline when PARMRK is set.

Signed-off-by: Jaeden Amero <jaeden.amero@ni.com>
Acked-by: Alan Cox <alan@linux.intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Syed Rameez Mustafa <rameezmustafa@codeaurora.org>
Signed-off-by: Pranav Vashi <neobuddy89@gmail.com>
n_tty: Fix unsafe update of available buffer space

receive_room is used to control the amount of data the flip
buffer work can push to the read buffer. This update is unsafe:

  CPU 0                        |  CPU 1
                               |
                               | n_tty_read()
                               |   n_tty_set_room()
                               |     left = <calc of space>
n_tty_receive_buf()            |
  <push data to buffer>        |
  n_tty_set_room()             |
    left = <calc of space>     |
    tty->receive_room = left   |
                               |     tty->receive_room = left

receive_room is now updated with a stale calculation of the
available buffer space, and the subsequent work loop will likely
overwrite unread data in the input buffer.

Update receive_room atomically with the calculation of the
available buffer space.

Signed-off-by: Peter Hurley <peter@hurleysoftware.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Syed Rameez Mustafa <rameezmustafa@codeaurora.org>
Signed-off-by: Pranav Vashi <neobuddy89@gmail.com>
msm: actuator: fix to prevent untrusted pointer to lead DoS

fix to prevent untrusted userspace pointer in actuator kernel
driver to lead DoS

Signed-off-by: Vasko Kalanoski <vaskok@codeaurora.org>
Signed-off-by: Pranav Vashi <neobuddy89@gmail.com>
msm: actuator: fix to prevent kernel heap buffer overflow

fix to prevent kernel heap buffer overflow allows user
controlled data to be written to the heap via the
msm_camera actuator IOCTLs

Signed-off-by: Vasko Kalanoski <vaskok@codeaurora.org>
Signed-off-by: Pranav Vashi <neobuddy89@gmail.com>
msm: vidc: Add support for H.264 LEVEL 5.2

For high resolutions and bit rates, H.264 spec
defined new level. This change adds support to
pass LEVEL 5.2 to FW.

Signed-off-by: Praneeth Paladugu <ppaladug@codeaurora.org>
Signed-off-by: Pranav Vashi <neobuddy89@gmail.com>
msm: socinfo: fix memory leak in socinfo_init_sysdev

Under certain error paths in socinfo_init_sysdev the soc_dev_attr
struct does not get freed. Fix this memory leak.

Signed-off-by: Syed Rameez Mustafa <rameezmustafa@codeaurora.org>
Signed-off-by: Pranav Vashi <neobuddy89@gmail.com>
msm: msm_bus: Fix the type error causing bandwidth overflow

On legacy chipsets, long int was being used to store
return value after calculating interleaved bw. However,
NoCs support 64-bit integers ab/ib values. problme occurs
if client request for higher bw and if difference of ab
value exceeds the range of 32 bit integer, the Value
overflows and turns negative, which leads to wrong bw calculation.

This patch fixes this integer overflow by correcting argument
type to store bw.

Signed-off-by: Alok Chauhan <alokc@codeaurora.org>
Signed-off-by: Pranav Vashi <neobuddy89@gmail.com>
msm: msm_bus: send correct value to bw division function

While calculating bw for existing client request
sometimes it can go to negative if client unregisters
or send request with lesser ab/ib values. Bus driver
will divide bandwidth if interleaving enabled.

Added a macro wrapper to handle negative bw values
since the division utility function can't handle
negative values

Signed-off-by: Alok Chauhan <alokc@codeaurora.org>
Signed-off-by: Pranav Vashi <neobuddy89@gmail.com>
msm: msm_bus: Don't touch ID array in case of invalid IDs

Protect the bus ID array in case config data contains invalid
IDs which can cause out-of-bounds access.

Signed-off-by: Gagan Mac <gmac@codeaurora.org>
Signed-off-by: Pranav Vashi <neobuddy89@gmail.com>
msm: msm_bus: Add checks during bus client unregistration

During unregistration clients should withdraw all pending
requests. This was earlier done in update-request function.
However, that caused acpuclock client requests to be
incorrectly zeroed out.

It seems more appropriate to let the client ensure that
they correctly clean up their requests than to have bus
driver forcefully remove non-zero requests. Hence, a
warning has been added in the unregistration path.

Signed-off-by: Gagan Mac <gmac@codeaurora.org>
Signed-off-by: Pranav Vashi <neobuddy89@gmail.com>
msm: msm_bus: Correct the return value from register-client

On failure, return 0, and not a non-zero value as that can
be interpreted as a valid client ID.

Signed-off-by: Gagan Mac <gmac@codeaurora.org>
Signed-off-by: Pranav Vashi <neobuddy89@gmail.com>
msm: Fix NULL pointer dereference in sensors ADSP driver.

Memory is allocated on the heap via kzalloc for temp variable.
Then it is passed through error checking. Error checking is
incorrect however, because instead of immediately returning -ENOMEM,
the function continues without returning. temp could be potentially
NULL when passed in to memcpy, causing a NULL dereference and writing
to that location.

Signed-off-by: Satya Durga Srinivasu Prabhala <satyap@codeaurora.org>
Signed-off-by: Pranav Vashi <neobuddy89@gmail.com>
msm: ocmem: Do not return error when debugfs is disabled

The ocmem driver probe fails, when debugfs is disabled,
as it cannot create a debugfs root node. Do not return
and error, so that ocmem driver can function even when
debugfs is disabled

Signed-off-by: Neeti Desai <neetid@codeaurora.org>
Signed-off-by: Pranav Vashi <neobuddy89@gmail.com>
qseecom: Rename & unifiy some enum definitions.

Move the key management enum values into unified enum
Rename RPMB related enum definitions as per existing pattern.

Signed-off-by: Hariprasad Dhalinarasimha <hnamgund@codeaurora.org>
Signed-off-by: Pranav Vashi <neobuddy89@gmail.com>
iommu: msm: Add standalone support for secure SMMU

Add a configuration option that allows for testing of systems without
a secure environment. When turning on this option all the IOMMUs will
be programmed by the kernel regardless of whether the IOMMU is secure
or not. This allows for early testing during bringup.

Signed-off-by: Olav Haugan <ohaugan@codeaurora.org>
Signed-off-by: Pranav Vashi <neobuddy89@gmail.com>
iommu: msm: don't rely on structure format coming from TZ

The format of the secure fault register dump structure in TZ could
change over time. However, it should always adhere to the following
format (each row is 4 bytes wide):

    |-----------|
    | dump_size |
    | reg1_addr |
    | reg1_val  |
    | ...       |
    | regn_addr |
    | regn_val  |
    |-----------|

Rather than relying on the format of the structure, iterate over
the (addr, value) pairs.

Signed-off-by: Mitchel Humpherys <mitchelh@codeaurora.org>
Signed-off-by: Pranav Vashi <neobuddy89@gmail.com>