hrtimer: Don't reinitialize a cpu_base's lock on CPU_UP

The current code makes the assumption that a cpu_base lock cannot
be held if a CPU is offline, which is tragically wrong.

If a hrtimer is not queued, then it will not be migrated by
migrate_hrtimers() when a CPU is offlined. Therefore, the
hrtimer's cpu_base may still point to a CPU which has
subsequently gone offline if the timer wasn't enqueued at the
time the CPU went down.

Normally this wouldn't be a problem, but a cpu_base's lock is
blindly reinitialized each time a CPU is brought up. If a CPU is
brought online during the period that another thread is
performing a hrtimer operation on a stale hrtimer, then the lock
will be reinitialized under its feet, and a SPIN_BUG() like the
following will be observed:

 [  448.212369] BUG: spinlock already unlocked on CPU#3,
 swapper/3/0
[  448.217368]  lock: 0xc47b1a40, .magic: dead4ead, .owner:
swapper/3/0, .owner_cpu: -1
[  448.217398] [<c0014398>] (unwind_backtrace+0x0/0x120) from
[<c0269ab0>] (do_raw_spin_unlock+0x44/0xdc)
[  448.217419] [<c0269ab0>] (do_raw_spin_unlock+0x44/0xdc) from
[<c071bbb0>] (_raw_spin_unlock_irqrestore+0xc/0x38)
[  448.217438] [<c071bbb0>]
(_raw_spin_unlock_irqrestore+0xc/0x38) from [<c00aa498>]
(hrtimer_try_to_cancel+0xf8/0x10c)
[  448.217455] [<c00aa498>] (hrtimer_try_to_cancel+0xf8/0x10c)
from [<c00aa4bc>] (hrtimer_cancel+0x10/0x20)
[  448.217475] [<c00aa4bc>] (hrtimer_cancel+0x10/0x20) from
[<c00e6934>] (rcu_idle_exit_common+0x5c/0xe0)
[  448.217494] [<c00e6934>] (rcu_idle_exit_common+0x5c/0xe0) from
[<c00e6ae8>] (rcu_idle_exit+0x9c/0xb4)
[  448.217514] [<c00e6ae8>] (rcu_idle_exit+0x9c/0xb4) from
[<c000f2dc>] (cpu_idle+0x98/0xf0)
[  448.217529] [<c000f2dc>] (cpu_idle+0x98/0xf0) from
[<000081ac>] (0x81ac)

CRs-Fixed: 460670
Change-Id: I588f6a864054abe6d4c249aad815c6d2f5a54077
Signed-off-by: Michael Bohan <mbohan@codeaurora.org>
msm: camera: Fix camera crash in msm_open_config

Add proper check before accessing mctl handle to
avoid camera crash.

Change-Id: I1413f086ab7d94fe223a814bb16867d1dcc0a4bf
CRs-Fixed: 481757
Signed-off-by: Aditya Jonnalagadda <ajonnala@codeaurora.org>
msm_fb: display: issue completion when disabling vsync irq

When vsync irq is disabled, vsync_wait_cnt is reset to zero and
completion is issued out as they are done in isr to make sure all
wait_for_completion is released.

Change-Id: I689f0c8cde43404d0caf5bb4644efa6385798d0e
Signed-off-by: Huaibin Yang <huaibiny@codeaurora.org>
msm: audio: qdsp6v2: Add size safety check to ACDB driver

Check that the size sent by userspace is not larger
then the internal amount allowed. This protects
against overflowing the stack due to an invalid size.

Change-Id: I8230fdb00a7b57d398929e8ab0eb6587476f3db1
CRs-fixed: 470222
Signed-off-by: Ben Romberger <bromberg@codeaurora.org>
msm: camera: Fix camera crash when ctrl_q is empty

Add proper error condition if the list is empty and
return error value to upper layers instead of BUG_ON.

Change-Id: I89237e7a27d5fb1e1fd5f1a8a2dfd7ea9a1afff5
CRs-Fixed: 481759
Signed-off-by: Suresh Vankadara <svankada@codeaurora.org>
msm:rq_stats: Register for Cpufreq policy notification

Currently the load of the system is calculated using the max
frequency that is read during startup(It does not get updated
when the policy changes). As a result, the average load of the
system is incorrectly calculated and the system might not bring
the cpus online to manage the additional load. This
reduces the performance of the system.

To fix this issue, register rq_stats to receive cpufreq policy
notifications. Update the policy's max frequency when a
notification is received and use that value to calculate the load.

Change-Id: Icc78e28c736c170e198f723fd96c13dfb2dafe8a
Signed-off-by: Archana Sathyakumar <asathyak@codeaurora.org>
Signed-off-by: Anji Jonnala <anjir@codeaurora.org>
cpufreq: Resolve CPUFREQ_NOTIFY issue

When the cpufreq_stat receives the frequency policy notification,
it checks if the frequency table and stats table are present for the cpu.
If both are present, it returns with -EBUSY error to the notification.
Due to this, none of the other registered modules receive this
notification.

If the stat table and sysfs nodes are already created, return 0 instead
of returning EBUSY error.

Change-Id: I1fd4a46e6a65edfc6253c4271288f10912ae2ad7
Signed-off-by: Archana Sathyakumar <asathyak@codeaurora.org>
msm: camera: Release mutex lock in case of failure

Release mutex lock in camera driver in case of a
failure.

Change-Id: Idc7de63b320df69754ad26fa9ae9639a08c96fc4
Signed-off-by: Suresh Vankadara <svankada@codeaurora.org>
msm: camera: Fix event queue drain issue

when camera daemon is killed, then command processing
timeout happens and there is a possibility of pending
event payload data. It creates a problem for further
command processing due to mismatch of event ids.
Drain the event payload queue when there is a timeout
for any event.

Change-Id: I046baf5ecc8abc8e795f96f8a1701da5c8506b88
CRs-Fixed: 467053
Signed-off-by: Suresh Vankadara <svankada@codeaurora.org>
mfd: pm8xxx-misc: Add API to read PMIC registers

This API reads the PMIC registers at runtime and can be called
from process/interrupt context. It is currently enabled for PM8921.

Change-Id: I63a80293e37725569d075de814f27f67382976ca
Signed-off-by: Anirudh Ghayal <aghayal@codeaurora.org>
radio-iris: Configure repeat count for PS string

- When FM Rx tuned to a station, not receiving complete PS string.
  SOC is not waiting for complete PS string. it is sending PS event
  even if it has part of PS string as well.
- Added support for setting repeat count for PS string
  to get refined PS string from receiver.

CRs-Fixed: 474719
Change-Id: Id89194d7536ac512eb31b9d9658c8624388e19ab
Signed-off-by: Venkateshwarlu Domakonda <Venkateshwarlu@codeaurora.org>
msm_fb: display: disable mdp blt mode

The switch of blt mode may cause mdp hang on some targets. To avoid
blt switch, we won't allocate the pipe that requires blt
mode. Basically this implies two things: downscaling is done by
rotator and gpu composition is used in case of blt mode is needed.

This implementation is to calculate mdp clk requirement based on the
req data passed from userspace before setting the actural pipe
data. If overlay_set asks for mdp clk that is greater than
mdp_max_clk, meaning blt is needed, overlay_set returns before pipe
allocation or pipe data change, so this way can avoid mdp to work on
wrong pipe data.

Change-Id: I22e73d08bed920b366c18ee21b132339cf2a0347
Signed-off-by: Huaibin Yang <huaibiny@codeaurora.org>
msm: vidc: Update sub_anchor_mv buffer size

The sub_anchor_mv size is not sufficient if the height
is more than 1088 in video clips, this change will amend
the buffer size to avoid video hardware resulting iommu
crash failures for such clips.

Change-Id: Ie59f04b9edaa9d2364d4e5014d2eb6f882728c76
Signed-off-by: Maheshwar Ajja <majja@codeaurora.org>
msm: wcnss: Dump PMIC regulator contol registers

Code changes are done to dump additional PMIC registers which
are related to WCNSS(RIVA)during the WCNSS SSR or WDI timeout.
These changes help to check PMIC status during the SSR. These
changes needed to debug the multiple crash issues where WCNSS
SSR dumps are insufficient to conclude why FIQ is not reaching
the WCNSS from HOST and why SPM is stuck.

Change-Id: Ibcd767c8832e2df268591e03da93ccf1bd819c68
CRs-fixed: 487483
Signed-off-by: Naresh Jayaram <njayar@codeaurora.org>
ASoc: msm: Fix for pcm_read getting struck in alsa core.

Advance hardware pointer by period size even if the packet
coming from qdsp6 is of less size. QDSP6 sometimes
(for rapid device switches) gives packets worth less
than period size and this results in hw_ptr appl_ptr mismatch.

CRs-Fixed: 486276
CRs-Fixed: 488449
Change-Id: I893f9a52e4cd507fd72e4a7aba3c5fa76527d1bf
Signed-off-by: Sidipotu Ashok <sashok@codeaurora.org>
mmc: msm_sdcc: fix a type mismatch in msmsdccc_config_dma()

msmsdcc_prep_xfer() function returns a signed integer value but
caller function msmsdcc_config_dma() is storing this value in an unsigned
integer variable which is obviously not the correct thing to do.

CRs-Fixed: 476578
Change-Id: I39159e2f4f73c7f54de359cbe4faba5e902915ff
Signed-off-by: Subhash Jadavani <subhashj@codeaurora.org>
msm: camera: Fix mctl release crash issue.

After mctl release initialize pointer to NULL to
avoid crash.

Change-Id: Ia3e0b1b809f85760a92b5248f402df589c6ace04
Signed-off-by: Suresh Vankadara <svankada@codeaurora.org>
msm: camera: Add NULL pointer check for regulator

To avoid potential crashes, Null pointer check is added
before regulator calls are made

Change-Id: I3c745ff0600971d07d10b7a537e6f2375a2bf4ab
Signed-off-by: Aditya Jonnalagadda <ajonnala@codeaurora.org>
msm: camera: Check if client is NULL before calling ion_free

NULL check was added inorder to prevent a target reboot in ion_free
in case client is already NULL

Change-Id: I263f56ff06ad7907c459b4f7254fc1435a41c61d
Signed-off-by: Aditya Jonnalagadda <ajonnala@codeaurora.org>
mm-camera: Changes to remove unused code for security issue reported

Changes to remove MSM_CAM_IOCTL_SET_MEM_MAP_INFO Ioctl support.
This will avoid physical memory mapping to userspace.

Change-Id: If014e6d152786b508c8e7ee6c53631913cd4cfcf
Signed-off-by: Guruprasad Gaonkar <ggaonk@codeaurora.org>