usb: gadget: f_fs: Fix enumeration in fullspeed mode

ffs_func_eps_enable always take the highspeed usb_endpoint_descriptor
if it is available. Choose the correct usb_endpoint_descriptor
depending on the gadget speed instead.

Change-Id: I5b8444cfdf1b6fe1eef25525fb7a0a0f617a353e
Signed-off-by: Benoit Goby <benoit@android.com>
f_fs: ffs_func_free: cleanup requests allocated by autoconfig

functionfs was leaking request objects created by autoconfig.

Bug: 8659094

Change-Id: I641326cb5cb26e0a2ffa082cd2be2c21c66c38e5
Signed-off-by: Peter Korsgaard <peter.korsgaard@barco.com>
Signed-off-by: Felipe Balbi <balbi@ti.com>
Signed-off-by: Benoit Goby <benoit@android.com>
misc: uidstat: avoid create_stat() race and blockage.

* create_stat() race would lead to:
  [   58.132324] proc_dir_entry 'uid_stat/10061' already registered

* blocking kmalloc reported by sbranden
 tcp_read_sock()
  uid_stat_tcp_rcv()
    create_stat()
      kmalloc(GFP_KERNEL)

Signed-off-by: JP Abgrall <jpa@google.com>
ashmem: avoid deadlock between read and mmap calls

Avoid holding ashmem_mutex across code that can page fault.  Page faults
grab the mmap_sem for the process, which are also held by mmap calls
prior to calling ashmem_mmap, which locks ashmem_mutex.  The reversed
order of locking between the two can deadlock.

The calls that can page fault are read() and the ASHMEM_SET_NAME and
ASHMEM_GET_NAME ioctls.  Move the code that accesses userspace pages
outside the ashmem_mutex.

Bug: 9261835
Change-Id: If1322e981d29c889a56cdc9dfcbc6df2729a45e9
Signed-off-by: Todd Poynor <toddpoynor@google.com>
Revert "ARM: vfp: Move exception address fixup into vfphw.S"

This reverts commit 0dbef5cd404e7d167ee5da71320ec31452cb13fd.
Upstream patch 15ac49b65024f55c4371a53214879a9c77c4fbf9
(81155539833d8c492261a8fdd91e3e6579c274dd in v3.4 stable) fixes
vfp exception handling, revert our local fix.

Change-Id: I518fb46fc5b4f5b8a51d1f1152fdd8e1acb6fe5d
Signed-off-by: Colin Cross <ccross@android.com>
ARM: Fix undefined instruction exception handling

commit 15ac49b65024f55c4371a53214879a9c77c4fbf9 upstream.

While trying to get a v3.5 kernel booted on the cubox, I noticed that
VFP does not work correctly with VFP bounce handling.  This is because
of the confusion over 16-bit vs 32-bit instructions, and where PC is
supposed to point to.

The rule is that FP handlers are entered with regs->ARM_pc pointing at
the _next_ instruction to be executed.  However, if the exception is
not handled, regs->ARM_pc points at the faulting instruction.

This is easy for ARM mode, because we know that the next instruction and
previous instructions are separated by four bytes.  This is not true of
Thumb2 though.

Since all FP instructions are 32-bit in Thumb2, it makes things easy.
We just need to select the appropriate adjustment.  Do this by moving
the adjustment out of do_undefinstr() into the assembly code, as only
the assembly code knows whether it's dealing with a 32-bit or 16-bit
instruction.

Acked-by: Will Deacon <will.deacon@arm.com>
Signed-off-by: Russell King <rmk+kernel@arm.linux.org.uk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
ARM: 7627/1: Predicate preempt logic on PREEMP_COUNT not PREEMPT alone

commit 568dca15aa2a0f4ddee255894ec393a159f13147 upstream.

Patrik Kluba reports that the preempt count becomes invalid due
to the preempt_enable() call being unbalanced with a
preempt_disable() call in the vfp assembly routines. This happens
because preempt_enable() and preempt_disable() update preempt
counts under PREEMPT_COUNT=y but the vfp assembly routines do so
under PREEMPT=y. In a configuration where PREEMPT=n and
DEBUG_ATOMIC_SLEEP=y, PREEMPT_COUNT=y and so the preempt_enable()
call in VFP_bounce() keeps subtracting from the preempt count
until it goes negative.

Fix this by always using PREEMPT_COUNT to decided when to update
preempt counts in the ARM assembly code.

Signed-off-by: Stephen Boyd <sboyd@codeaurora.org>
Reported-by: Patrik Kluba <pkluba@dension.com>
Tested-by: Patrik Kluba <pkluba@dension.com>
Signed-off-by: Russell King <rmk+kernel@arm.linux.org.uk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
msm: SSR: Remove useless warning

This is a warning so that developers know to add more restart
order lists to SSR when a new chip is added. This is mostly
irrelevant now because we assume either entire SoC restart on SSR
or independent restart on SSR, not group restarts. Remove this
warning as it is mostly a reminder that nobody is listening for.

Change-Id: Icbf955cb18395d8d5d086b2167c5c329588b9256
Signed-off-by: Stephen Boyd <sboyd@codeaurora.org>
cpufreq: interactive: resched timer if max freq raised

When the policy max freq is raised, and before the timer is
rescheduled in idle callback, the cpu freq may stuck at a
lower freq.

The target_freq shall be updated too, else on a high load
situation, the new_freq is always equal to target_freq and
which will cause freq stuck at a lower freq too.

Reschedule the timer on gov limits callback.

Change-Id: I6c187001ab43e859731429b64f75a74eebc37a24
Signed-off-by: Lianwei Wang <a22439@motorola.com>
ASoC: msm: qdsp6v2: Fix bug in device V2 command

Add missing braces for Device V2 command failure case.
Crs-fixed: 492994

Change-Id: Ieacbbe94897a4fb73e6ffadc7d1bdcadb2b35dd2
Signed-off-by: Venkat Sudhir <vsudhir@codeaurora.org>
msm: rotator: Pass ION flags correctly for 2-pass buffer allocation

With updated ION interface, ION_SECURE needs to be passed as a
separate flag. Also, 2-pass buffer for secure session needs to be
allocated from CP heap instead of non-secure heap.

CRs-fixed: 502038
Change-Id: I8c5f945dc4d90ce640872e2cd0505ac32e82011d
Signed-off-by: Padmanabhan Komanduru <pkomandu@codeaurora.org>
msm: kgsl: Lower bounds check the number of power levels

A misconfigured board file could cause an out-of-bounds
array access through this value.

Change-Id: I64bbad0c096a2efe65376991537d810141370d72
CRs-Fixed: 439230
Signed-off-by: Lucille Sylvester <lsylvest@codeaurora.org>
msm_fb: display: Add pseudo-planar 422 H1V2 support in the MDP4

Rotator outputs pseudo-planar 422 H1V2 for interleaved inputs
on 90 degree rotation. Add changes to support MDP_Y_CRCB_H1V2
in MDP4.

CRs-Fixed: 371303
Signed-off-by: Mayank Chopra <makchopra@codeaurora.org>

Conflicts:

	drivers/video/msm/mdp4_overlay.c

Change-Id: I730a3196df8d0c204e6334c2c8b9199d15cbb16a
Signed-off-by: Mayank Chopra <makchopra@codeaurora.org>
msm: rotator: Add pseudo-planar 422 H1V2 dst format for MDP4

Rotator outputs pseudo-planar 422 H1V2 for interleaved inputs
on 90 degree rotation.Add changes to support MDP_Y_CRCB_H1V2,
MDP_Y_CBCR_H1V2 in MDP4.

CRs-Fixed: 371303
Change-Id: I42ea86992fc77cd335437a47611e9f640f30ed25
Signed-off-by: Mayank Goyal <goyalm@codeaurora.org>
Signed-off-by: Mayank Chopra <makchopra@codeaurora.org>
msm_fb: display: Fix interleaved 422 input format register settings

Check to update chroma sample information in source format register is
based on fetch plane value, which does not take into account for
interleaved 422 input format. Remove this check and set chroma sample
values for RGB formats as well.

CRs-Fixed: 501035
Change-Id: If8fd47b6d47b326efd1cb70ce9701ac1d457dcfd
Signed-off-by: Mayank Chopra <makchopra@codeaurora.org>
msm: ipc: Serialize SMD XPRT CLOSE and OPEN events

When a remote subsystem resets, IPC Router's SMD XPRT Layer queues a CLOSE
event. When the concerned subsytem powers up and the channel is reopened,
SMD XPRT Layer queues a OPEN event. When the remote subsytem resets and
powers up quickly, the following race condition exists:
a) IPC Router is scheduled out while handling the CLOSE event, leaving a
   stale XPRT
b) IPC Router's SMD XPRT Layer queues a OPEN event
c) IPC Router's SMD XPRT Layer reads a HELLO message, finds a stale
   XPRT and queues a DATA event on the stale XPRT
This race condition causes a kernel panic.

Fix this race condition by not handling any other SMD XPRT event until
the CLOSE event is complete.

CRs-Fixed: 488331
Change-Id: I2283e163413d1896bd6842530b8a6a2b537e22de
Signed-off-by: Zaheerulla Meer <zmeer@codeaurora.org>
usb: gadget: composite: Fix a bug in delayed status handling

The SET_CONFIGURATION control request's status phase is delayed
till the new config change is handled by the file-storage thread.
If the cable is disconnected or the bus is reset before the
previous config is handled, then composite driver is not notified
about the delayed status.  As a result of which, the delayed_status
field of composite device structure remains non-zero.  The status
phase of next SET_CONFIGURATION control request is not sent.
This makes the gadget unusable.

Calling usb_composite_setup_continue() after the disconnect or reset
does not make any sense.  If the host sends another control request
before the status phase of the previous control request is sent, the
delayed_status must be reset to zero.  This is not straight forward
as the UDC handles some control requests without delegating them to
the composite driver.  A simple fix would be resetting the delayed
status value after the disconnect/reset.

CRs-Fixed: 501527
Change-Id: I67c832afc88c9e7d025247e539b7223fd83644d7
Signed-off-by: Pavankumar Kondeti <pkondeti@codeaurora.org>
usb: serial: csvt: Fix TIOCMSET ioctl implementation

The current code is incorrectly converting TTY DTR/RTS
signals to CDC ACM bit definitions.  Due to this DTR
is never dropped when DUN call is disconnected.

CRs-Fixed: 478719
Change-Id: If45a09ff201252dd891b92a85420726a9de49dc6
Signed-off-by: Pavankumar Kondeti <pkondeti@codeaurora.org>
ext4: protect group inode free counting with group lock

Now when we set the group inode free count, we don't have a proper
group lock so that multiple threads may decrease the inode free
count at the same time. And e2fsck will complain something like:

Free inodes count wrong for group #1 (1, counted=0).
Fix? no

Free inodes count wrong for group #2 (3, counted=0).
Fix? no

Directories count wrong for group #2 (780, counted=779).
Fix? no

Free inodes count wrong for group #3 (2272, counted=2273).
Fix? no

So this patch try to protect it with the ext4_lock_group.

btw, it is found by xfstests test case 269 and the volume is
mkfsed with the parameter
"-O ^resize_inode,^uninit_bg,extent,meta_bg,flex_bg,ext_attr"
and I have run it 100 times and the error in e2fsck doesn't
show up again.

Change-Id: Icfa95256688b50734e9152cbdc84a851a39b8ed5
Signed-off-by: Tao Ma <boyu.mt@taobao.com>
Signed-off-by: "Theodore Ts'o" <tytso@mit.edu>
radix-tree: fix contiguous iterator

commit fffaee365fded09f9ebf2db19066065fa54323c3 upstream.

This patch fixes bug in macro radix_tree_for_each_contig().

If radix_tree_next_slot() sees NULL in next slot it returns NULL, but following
radix_tree_next_chunk() switches iterating into next chunk. As result iterating
becomes non-contiguous and breaks vfs "splice" and all its users.

Signed-off-by: Konstantin Khlebnikov <khlebnikov@openvz.org>
Reported-and-bisected-by: Hans de Bruin <jmdebruin@xmsnet.nl>
Reported-and-bisected-by: Ondrej Zary <linux@rainbow-software.org>
Reported-bisected-and-tested-by: Toralf Förster <toralf.foerster@gmx.de>
Link: https://lkml.org/lkml/2012/6/5/64
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>