msm: mdss: wait for ping pong during unblank kickoff

During panel unblank a kickoff is done to turn on the panel so that the
first update is not delayed. However since buffer sync and display
commit is not called on this, need to make sure that the update finishes
completely including the workqueue that signals the fences. Signaling
the sync fence can potentially cause timeline to be ahead and end up
signaling the acquire fences early leading to source tearing on command
mode panels.

Change-Id: I56edf8355e1c635c3da24f20405c3ae4fe31cf2e
Signed-off-by: Adrian Salido-Moreno <adrianm@codeaurora.org>
USB: android: Handle error conditions if usb_add_config fails

This is missing changes of commit 0f12d93e06af8 (USB: android: Handle error
conditions if usb_add_config fails" when cherry-picking this.

Change-Id: I9ce4f28c6af73420f6b8dda0f8538d2da114087d
Signed-off-by: Devin Kim <dojip.kim@lge.com>
bluetooth: unlock spin on bluesleep_stop before controling the hsuart power

Kernel migh be in sleep to wait for rpm communication when it controls the
hsuart power. So should unlock the spin before controling the hsuart
power.

Change-Id: Ic051ee95df8be3e7dcea1bc71cba85bdbab34bef
Signed-off-by: Devin Kim <dojip.kim@lge.com>
msm_serial_hs: Fix the unbalanced clk_count

If clock vote is failed, clk_count is added. It may cause the unbalanced
clk_count. Also it's possible to be nagative clk_count on unvote. So do
not decrease the clk_count if it's already zero.

Change-Id: Ic63efd9447a18caaa8fabada4d4cae90558c8785
Signed-off-by: Devin Kim <dojip.kim@lge.com>
msm_serial_hs: check the returned value of clock vote

If voting clock is failed, we should not access the registers.
It may cause a crash to access the unclocked register.

Change-Id: Ifb75dd68696719905b373c4a276c4dc2d917f2fe
Signed-off-by: Devin Kim <dojip.kim@lge.com>
msm_serial_hs: vote for clocks in tty functions

to avoid accessing the unclocked registers.

Change-Id: I17af31b54e2c6288a5284b51670506c44a344fe8
Signed-off-by: Devin Kim <dojip.kim@lge.com>
msm_serial_hs: Fix race condition with BAM rx pipe

Crash observed due to the race condition with bam
rx pipe during sps_disconnect and sps_transfer_one
operations executed at the same time on two CPUs.

Because of this race condition rx bam descriptor
pointer becomes NULL and accessing of this pointer
leads to crash.

This patch waits for sps_transfer_one function to
complete, if it is in progress, before calling
sps_disconnect function from the set_termios.

https://www.codeaurora.org/cgit/quic/la/kernel/msm-3.10/commit/drivers/tty/serial/msm_serial_hs.c?h=msm-3.10&id=478fe086cb075301da4488e3e9e02683b2409084

CRs-Fixed: 534029
Change-Id: I7581062a17a3dc7ede8eb58e4d25e3b517812ab2
Signed-off-by: Kiran Gunda <kgunda@codeaurora.org>
Signed-off-by: Devin Kim <dojip.kim@lge.com>
Signed-off-by: Patrick Tjin <pattjin@google.com>
msm: kgsl: always check kgsl_active_count_get() result

Getting an active count can fail if the hardware doesn't
actually wake up. Make active count get functions __mustcheck
to remind people of this and fix existing calls to
handle the error.

Change-Id: I5a0202c824ac7e436b9061da6d8f638e44e8b7f6
Signed-off-by: Jeremy Gebben <jgebben@codeaurora.org>
msm: kgsl: remove KGSL_IOCTL_WAKE from context destruction

Adreno context destruction never needs the hardware on
to destroy the current context.

For z180, always take an active count while destroying.

Since this is the last ioctl to use KGSL_IOCTL_WAKE, remove
it entirely.

Change-Id: I97368c7f3c28f16538cc5f48b802b681d7af96ef
Signed-off-by: Jeremy Gebben <jgebben@codeaurora.org>
net: wireless: bcmdhd: add debug code to print packet statistics

	I add the debug code to print packets statistics after resuming
	host.
	This will print only once after resume to see what packet cause
	to wake up host.

	Bug : 11374623
Signed-off-by: Ecco Park <eccopark@broadcom.com>
qseecom: Ensure incoming "app_name" does not corrupt the kernel stack

Printing a string with that does not have null terminated character,
would lead to overflow, as the print continues until it finds a null
terminated character.
Avoid this issue by explicitly assigning a string with null termination.

Change-Id: I9528db2ba046c514d829097d08c09540588bb1a2
Signed-off-by: Hariprasad Dhalinarasimha <hnamgund@codeaurora.org>
Signed-off-by: Ajay Dudani <adudani@codeaurora.org>
qseecom: Change __copy_from_user to copy_from_user

__copy_from_user does not do address check, so use
copy_from_user instead.

Change-Id: I575c0f3c44b55a521c0d42828988c518c0640a29
Signed-off-by: Hariprasad Dhalinarasimha <hnamgund@codeaurora.org>
Signed-off-by: Ajay Dudani <adudani@codeaurora.org>
crypto: msm: Check destination buffer write access

Use VERIFY_WRITE to check write access to destination buffers
before writing to them.

Change-Id: If9708695e85659bb25e13762c54dd50abd9577c7
Signed-off-by: Mona Hossain <mhossain@codeaurora.org>
Signed-off-by: Ajay Dudani <adudani@codeaurora.org>
crypto: msm: Verify source and destination data lengths

Check to confirm the sum of length of the source
and destination segments is equal to the total length
sent by client.

Change-Id: Ib10b8f792591631060135022d81f1f08c424ee66
Signed-off-by: Mona Hossain <mhossain@codeaurora.org>
Signed-off-by: Ajay Dudani <adudani@codeaurora.org>
crypto: msm: Validate total data length

Verify sum of all data segments equals the total data length.

Change-Id: I0fb9d856281d52c58536e77512f8cae75544d1bc
Signed-off-by: Mona Hossain <mhossain@codeaurora.org>
Signed-off-by: Ajay Dudani <adudani@codeaurora.org>
crypto: msm: Ensure sha_init is called for HASH operation

Validate that the sha_ctx is initialized before any SHA operation
(update, final) requests is issued by client.

Change-Id: I83ac2000d860dfef5532910a2a73cd927b68e95f
Signed-off-by: Mona Hossain <mhossain@codeaurora.org>
Signed-off-by: Ajay Dudani <adudani@codeaurora.org>
msm: mdss: Account for null ctl passed to line count

Line count could be passed a null ctl structure,
which would cause a kernel panic. To prevent this,
line count will just return 0 if a null parameter
is passed.

Change-Id: I2b52533e6b67b842542de5b81be5b43fccc364dc
CRs-Fixed: 551701
Signed-off-by: Casey Piper <cpiper@codeaurora.org>
Signed-off-by: Ajay Dudani <adudani@codeaurora.org>
msm: camera: To prevent the unbounded copy

To prevent the unbounded copy in EEPROM driver
to avoid kernel memory disclosure

Change-Id: Ib7f8719351ff72720c55394fdd0fcd5e876e2c09
CRs-fixed: 553389
Signed-off-by: Cherian Deepak <dcheri@codeaurora.org>
Signed-off-by: Ajay Dudani <adudani@codeaurora.org>
msm: audio: initialize the structure before sending to user space

If uninitialzied structure is passed from kernel to user space, it
may contain sensitive information that will be leaked.

Change-Id: Ie7c4568c78df8cbd1efeff559848058c2163b0b8
Signed-off-by: Fred Oh <fred@codeaurora.org>
Signed-off-by: Ajay Dudani <adudani@codeaurora.org>
ASoC: qdsp6: Add support for gapless audio playback

Update ASM driver to support for gapless audio playback in
tunnel mode.

Bug: 11185660

Signed-off-by: Ravi Kumar Alamanda <ralama@codeaurora.org>
Signed-off-by: Subhash Chandra Bose Naripeddy <snariped@codeaurora.org>