hwmon: qpnp-adc: Fix potential errors

There is a possibility of potential out of bound array
access errors and uninitialized variable access from code
inspection. Add additional checks in voltage ADC and
TSENS to check for such errors.

Change-Id: I1213cd76fb636aa457c88d3bdc3740b692f01cce
Signed-off-by: Siddartha Mohanadoss <smohanad@codeaurora.org>
thermal: msm: tsens: Notify thermal framework on threshold cross

Notify thermalsys framework and thereby the driver, using the new
sensor api. Notification is done in the interrupt handler context to
the thermal framework.

Change-Id: Ifdb958105d8d0d9d8987a4e64114101ee44047d2
Signed-off-by: Praveen Chidambaram <pchidamb@codeaurora.org>
usb: ehci-msm: Fix LOW Speed device enumeration issue

Disable ULPI_TX_PKT_EN_CLR_FIX which is valid only for HSIC core.
It otherwise causes enumeration failures with low speed devices.

Change-Id: I987bba3a8e0d609b6de6b5d33e11ca3bb0e03b1c
Signed-off-by: Manu Gautam <mgautam@codeaurora.org>
Merge of Sony Release 14.1.G.1.531

Change-Id: I50f41a60e703eec0c1f1d5ff7d879ea9fb5795b8
sync: signal pt before sync_timeline object gets destroyed

There is a race condition

Assume we have *one* sync_fence object, with *one* sync_pt
which belongs to *one* sync_timeline, given this condition,
sync_timeline->kref will have two counts, one for sync_timeline
(implicit) and another for sync_pt.

Assume following is the situation on CPU

Theead-1 : (Thread which calls sync_timeline_destroy())
  -> (some function calls)
   -> sync_timeline_destory()
    -> sync_timeline_signal() (CPU is inside this
function after putting reference to sync_timeline)

At this time Thread-2 comes and does following

Thread-2 : (fclose on fence fd)
> sync_fence_release() -> because of fclose() on fence object
 -> sync_fence_free()
  -> sync_pt_free()
   -> kref_put(&pt->parent->kref, sync_timeline_free);
    -> sync_timeline_free() (CPU is inside this because
this time kref will be zero after _put)

Thread-2 will free sync_timeline object before Thread-1
has finished its work inside sync_timeline_signal.

With this change we signals all sync_pt before putting
reference to sync_timeline object.

Change-Id: Ic680e4d0bbef1c46bcb7cfba693395645241d203
Signed-off-by: Prakash Kamliya <pkamliya@codeaurora.org>
Signed-off-by: Rom Lemarchand <romlem@google.com>
msm: msm_bus: Fix the type error causing bandwidth overflow

On legacy chipsets, long int was being used to store
return value after calculating interleaved bw. However,
NoCs support 64-bit integers ab/ib values. problme occurs
if client request for higher bw and if difference of ab
value exceeds the range of 32 bit integer, the Value
overflows and turns negative, which leads to wrong bw calculation.

This patch fixes this integer overflow by correcting argument
type to store bw.

CRs-Fixed: 537213
Change-Id: I8c6c79ba245a988c2c54ccaca3f3eaf5cb857ce5
Signed-off-by: Alok Chauhan <alokc@codeaurora.org>
msm: msm_bus: send correct value to bw division function

While calculating bw for existing client request
sometimes it can go to negative if client unregisters
or send request with lesser ab/ib values. Bus driver
will divide bandwidth if interleaving enabled.

Added a macro wrapper to handle negative bw values
since the division utility function can't handle
negative values

CRs-Fixed: 521940
Change-Id: Ic3a216b8efb535593fe02ad3228d71808d2e0f98
Signed-off-by: Alok Chauhan <alokc@codeaurora.org>
ASoC: msm: qdsp6v2: Clear ION handle after freeing

Once ion memory is freed ion handle should be set to
NULL to avoid double free or any unintended access.
This change clears the ION handle after freeing up
the memory.

Change-Id: I37d76fe2641c111fa4376eff8f7e45f6795414ca
Signed-off-by: Gopikrishnaiah Anandan <agopik@codeaurora.org>
Soc: msm: qdsp6v2: Fix invalid params handling

Alloc and free apis should sanity check all input params.
If allocation fails set client and ion handle to NULL.

Change-Id: Ide3bd782eb90ee8b033e39de232929a1ca7174b7
Signed-off-by: Gopikrishnaiah Anandan <agopik@codeaurora.org>
smp: Relax irqs_disable() warning in smp_call_function_single()

The change that long-ago added the interrupts-disabled warning in
smp_call_function_single() cited the following deadlock as the reason:
	CPU A				CPU B
	Disable interrupts
					smp_call_function()
					Take call_lock
					Send IPIs
					Wait for all cpus to acknowledge IPI
					CPU A has not responded, spin waiting
					for cpu A to respond, holding call_lock
	smp_call_function()
	Spin waiting for call_lock
	Deadlock			Deadlock

Such a deadlock is not possible however, in the event that
smp_call_function_single() is called for the currently-executing CPU.
While not a common usecase, relaxing the warning may simplify some
driver implementations.

The 'acpuclock-krait' driver in the MSM ARM sub-architecture provides
one example, where smp_call_function_single() is sometimes called from
a cpuidle path with interrupts disabled, but only ever from the target
CPU. Other callers of that same function may cross-call, but only do so
when interrupts are enabled.

Change-Id: I647b3b46fe6aa4dfb06f7750396986b80b92d700
Signed-off-by: Matt Wagantall <mattw@codeaurora.org>
ASoC: qdsp6v2: Fixed AAC dual-mono param_size

Corrected the calculation of the param_size field
within the asm_aac_dual_mono_mapping_param struct.

CRs-Fixed: 521690
Change-Id: If1590e16d9253fcd6cadb01ae444a0ac98baa9f8
Signed-off-by: Kenneth Westfield <kwestfie@codeaurora.org>
diag: Fix race condition in diagchar driver

diag driver maintains socket logging process in global driver
structure which is manipulated in switch_logging and in close
file_operation.
There is a possibility of race while clearing the socket logging
process in close operation and sending signal in switch_logging
operation. Adding lock to serialize the two operations.

CRs-Fixed: 495063
Change-Id: I0064509c9ace18a8ff40c5a744363546a9021612
Signed-off-by: Ashay Jaiswal <ashayj@codeaurora.org>
wcnss: Invoke PIL only after completing intialization

Delay PIL operation until all data structures used by WCNSS SMD
interrupt handler are initialized. There could be a race condition,
where the SMD interrupt handler is called even before the WCNSS
trigger function is completed.

Change-Id: I6d83e7a67ebb3e7b6efe2b3fbfc2708cca355916
CRs-Fixed: 496402
Signed-off-by: Sameer Thalappil <sameert@codeaurora.org>
wcnss: Add SAW2 SPM register to register dump list

When a WDI timeout happens, WLAN driver will initiate SSR; dumping these
registers before performing the reset helps to debug the root cause of
the timeout. Add SAW2 SPM register to the dump list.

Change-Id: Ic2f46be1efe7daf2e854425e05e1581eb1dd3dff
Signed-off-by: Sameer Thalappil <sameert@codeaurora.org>
wcnss: Add PLL status register to register dump list

When a WDI timeout or Watchdog bite happens at WCNSS, log certain WCNSS
register before SSR. Dumping these registers before performing the reset
helps to debug the root cause of the timeout or bite. Add PLL status to
the register dump, recently we have seen WCNSS reset failures becuase
of PLL lock issues.

Change-Id: I7557a46260e6dbd888b4bb1191442fda0bc3c986
Signed-off-by: Sameer Thalappil <sameert@codeaurora.org>
wcnss:  Add WMAC registers to register dump list

When a WDI timeout or Watchdog bite happens at WCNSS, certain WCNSS
registers are logged for debug purpose. Add WLAN domain registers
TXP PHY aborts and MCU WLAN bridge error timeout registers to this
list. This is helpful for debugging the A2XB split timeout issues.

Change-Id: I13dd21b35de784f2bab200c1ae0dd4f4c10ebad0
CRs-Fixed: 515142
Signed-off-by: Sameer Thalappil <sameert@codeaurora.org>
wcnss: Synchronize request_firmware() with suspend

Register for PM notifiers to avoid calling into request_firmware()
when the suspend/resume is in progress. Soon after a subsystem restart,
device can go to suspend mode, and wakeup when WCNSS opens the SMD
port to start NV download. So make sure that userspace is fully thawed
before starting NV download.

Change-Id: Iec0b742fd4c4bc8390ee69ca880ca17ccbb3f124
CRs-Fixed: 529272
Signed-off-by: Sameer Thalappil <sameert@codeaurora.org>
wcnss: Fix AXIM select and CTRL select bit fields

When a WDI timeout happens, WLAN driver will initiate SSR. Dumping
these registers before performing the reset helps to debug the root
cause of the timeout. Fix AXIM select and CTRL select bit fields
of testbus register while doing the A2XB testbus register dump.

Change-Id: Ic9c7ddf2e4cee07b43cc8fe06afca04755856eeb
CRs-Fixed: 540586
Signed-off-by: Sameer Thalappil <sameert@codeaurora.org>
tty: Fix race condition if flushing tty flip buffers

As Ilya Zykov identified in his patch 'PROBLEM: Race condition in
tty buffer's function flush_to_ldisc()', a race condition exists
which allows a parallel flush_to_ldisc() to flush and free the tty
flip buffers while those buffers are in-use. For example,

  CPU 0                         |  CPU 1                                  |  CPU 2
                                | flush_to_ldisc()                        |
                                |  grab spin lock                         |
tty_buffer_flush()              |                                         | flush_to_ldisc()
 wait for spin lock             |                                         |  wait for spin lock
                                |   if (!test_and_set_bit(TTYP_FLUSHING)) |
                                |    while (next flip buffer)             |
                                |     ...                                 |
                                |     drop spin lock                      |
  grab spin lock                |                                         |
   if (test_bit(TTYP_FLUSHING)) |                                         |
    set_bit(TTYP_FLUSHPENDING)  |      receive_buf()                      |
    drop spin lock              |                                         |
                                |                                         |   grab spin lock
                                |                                         |    if (!test_and_set_bit(TTYP_FLUSHING))
                                |                                         |    if (test_bit(TTYP_FLUSHPENDING))
                                |                                         |    __tty_buffer_flush()

CPU 2 has just flushed and freed all tty flip buffers while CPU 1 is
transferring data from the head flip buffer.

The original patch was rejected under the assumption that parallel
flush_to_ldisc() was not possible. Because of necessary changes to
the workqueue api, work items can execute in parallel on SMP.

This patch differs slightly from the original patch by testing for
a pending flush _after_ each receive_buf(), since TTYP_FLUSHPENDING
can only be set while the lock is dropped around receive_buf().

Change-Id: Iffe9515db564931438d00aaf9319cc20dfb7fd80
Reported-by: Ilya Zykov <linux@izyk.ru>
Signed-off-by: Peter Hurley <peter@hurleysoftware.com>
Acked-by: Ilya Zykov <linux@izyk.ru>
Cc: Jiri Slaby <jslaby@suse.cz>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Git-commit: 39f610e40eecc39e4c34e047fd6904ca6b525520
Git-repo: git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
[rameezmustafa@codeaurora.org: backport to kernel 3.4]
Signed-off-by: Syed Rameez Mustafa <rameezmustafa@codeaurora.org>
USB: f_mtp: Set maximum burst value to two for superspeed mode

Currently burst value is set to zero for superspeed in mtp driver.
MTP throughput can be improved by setting max burst vlaue to non
zero value in superspeed mode. Hence set max burst vlaue to two for
both IN and OUT bulk endpoints in superspeed mode.

CRs-Fixed: 532070
Change-Id: Ib78b8fec5d1ab934f4d4ec80b7e008149707ce0f
Signed-off-by: Vijayavardhan Vennapusa <vvreddy@codeaurora.org>