touchscreen: ancora: Update touchscreen API

* We dont need BOARD_USES_LEGACY_TOUCHSCREEN define in boardconfig anymore
touchscreen: ancora: Add missing BTN_TOUCH
mmc: msm_sdcc: Remove unnecessary delay in interrupt context

msmsdcc_request_end when called with interrupts disabled inside an
interrupt handler adds an unnecessary 5ms delay on command timeouts,
which impacts system performance. Remove this delay.

Change-Id: I90aec109fe84f7b9f9a9362b5ee2d8d1310833af
Signed-off-by: Venkat Gopalakrishnan <venkatg@codeaurora.org>
USB: msm_otg: Fix host mode suspend bug

Capturing BSV bit before ID test msm_otg_set_vbus_state()
is leading to return suspend call without entering
USB into LPM. In host mode since there is no need for
BSV check, clear the BSV bit so that USB suspend can
go through.

This happens when a target enters host mode with no devices
attached, USB OTG will never enter LPM, as the BSV bit will
always be set.

CRs-Fixed: 493539
Change-Id: I491b7ec058e799ca4e9aa6b34c44ea1908e8dbf0
Signed-off-by: Sujeet Kumar <ksujeet@codeaurora.org>
USB: msm_otg: Fix a bug in charger detection procedure

USB PHY is put into non-driving mode and pull-down resistors on DP
and DM are disabled before starting the charger detection.  The
PHY is put into driving mode at the end of the charger detection
without enabling the pull-down resistors.  Due to this DP is
pulled high when a dedicated charger is connected.  USB controller
is not allowing PHY suspend if line state is non-zero when charger
is connected.  Enable pull-down resistors at the end of charger
detection to resolve this issue.

CRs-Fixed: 509608
Change-Id: Ic1fc663b397e29e62d526b4146e92c93c84240ac
Signed-off-by: Pavankumar Kondeti <pkondeti@codeaurora.org>
defconfig: ancora: Set ROW scheduler as default
msm: kgsl: Force the ME off before reading the microcode

On A3XX reading the microcode while the CP is running is dangerous
beyond words.  By setting the offset address for the read, we are
essentially changing the instruction pointer for the ME while it
is running causing opcode errors, gpu faults and/or system errors.

We do not want to stop the CP at the beginning of the snapshot
process beacuse doing so changes the RBBM status and the state of
the CP registers which may damage the debug effort.  But by the
time we get to the microcode read we no longer care about the state
of the registers so we can freely halt the ME just before starting
the read.

Conflicts:
	drivers/gpu/msm/adreno_a3xx_snapshot.c

Change-Id: Ic0dedbad85d7ec26915f054dd597e226e8101a29
Signed-off-by: Jordan Crouse <jcrouse@codeaurora.org>
Signed-off-by: Sunil Khatri <sunilkh@codeaurora.org>
msm: kgsl: Increase the timeout value for fault detection

Increment the timeout value for detecting faults from 50ms to
200ms. The fault detection mechanism is a backup to hardware
fault detection. 50ms is small since it has been observed that
this mechanism triggers false positives with 50ms.

CRs-Fixed: 672164
Change-Id: I8f382051e06bdc47f152309a2868092e1980604e
Signed-off-by: Shubhraprakash Das <sadas@codeaurora.org>
Signed-off-by: Tarun Karra <tkarra@codeaurora.org>
Signed-off-by: Sunil Khatri <sunilkh@codeaurora.org>
msm: kgsl: Don't hold the refernce to the process private in kgsl create context

There is a possible race condition for dev_priv where the kgsl_release
is called, while adreno_ft_detect has reference for the same context.
This change will avoid to use dev_priv in context destroy, which is
already freed in kgsl_release.

CRs-Fixed: 688521
Change-Id: I0411873b605c4e264057eaa3f79c6439004c427c
Signed-off-by: Gaurav Gagrani <ggagrani@codeaurora.org>
n_tty: Fix n_tty_write crash when echoing in raw mode

The tty atomic_write_lock does not provide an exclusion guarantee for
the tty driver if the termios settings are LECHO & !OPOST. And since
it is unexpected and not allowed to call TTY buffer helpers like
tty_insert_flip_string concurrently, this may lead to crashes when
concurrect writers call pty_write. In that case the following two
writers:
* the ECHOing from a workqueue and
* pty_write from the process
race and can overflow the corresponding TTY buffer like follows.

If we look into tty_insert_flip_string_fixed_flag, there is:
  int space = __tty_buffer_request_room(port, goal, flags);
  struct tty_buffer *tb = port->buf.tail;
  ...
  memcpy(char_buf_ptr(tb, tb->used), chars, space);
  ...
  tb->used += space;

so the race of the two can result in something like this:
          A                             B
   __tty_buffer_request_room
                                  __tty_buffer_request_room
   memcpy(buf(tb->used), ...)
   tb->used += space;
                                 memcpy(buf(tb->used), ...) ->BOOM

B's memcpy is past the tty_buffer due to the previous A's tb->used
increment.

Since the N_TTY line discipline input processing can output
concurrently with a tty write, obtain the N_TTY ldisc output_lock to
serialize echo output with normal tty writes. This ensures the tty
buffer helper tty_insert_flip_string is not called concurrently and
everything is fine.

Note that this is nicely reproducible by an ordinary user using
forkpty and some setup around that (raw termios + ECHO). And it is
present in kernels at least after commit
d945cb9cce20ac7143c2de8d88b187f62db99bdc (pty: Rework the pty layer to
use the normal buffering logic) in 2.6.31-rc3.

js: add more info to the commit log
js: switch to bool
js: lock unconditionally
js: lock only the tty->ops->write call

Signed-off-by: Peter Hurley <peter@hurleysoftware.com>
Signed-off-by: Jiri Slaby <jslaby@suse.cz>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Change-Id: I9e235db6ec2bb950f26bd8a23f6145dab5dc0a15
Git-commit: 4291086b1f081b869c6d79e5b7441633dc3ace00
Git-repo: git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
Signed-off-by: Avijit Kanti Das <avijitnsec@codeaurora.org>
[rsiddoji@codeaurora.org: resolve trivial merge conflicts]
Signed-off-by: Ravi Kumar S <rsiddoji@codeaurora.org>
msm_bam_rmnet: Fix potential memory corruption

Usage of legacy string manipulation function sprintf could lead to
memory corruption as the number of bytes to be written to the
destination is not bounded. Replace sprintf with snprintf where the
number of bytes to be written is explicitly specified.

CRs-fixed: 672202
Change-Id: Iab7516ad0e2540eb619fe96e26a3516c7adf86cc
Signed-off-by: Subash Abhinov Kasiviswanathan <subashab@codeaurora.org>
fs: exFAT: Update to v1.2.9
tcp: Fix integer-overflows in TCP veno

[ Upstream commit 45a07695bc64b3ab5d6d2215f9677e5b8c05a7d0 ]

In veno we do a multiplication of the cwnd and the rtt. This
may overflow and thus their result is stored in a u64. However, we first
need to cast the cwnd so that actually 64-bit arithmetic is done.

A first attempt at fixing 76f1017757aa0 ([TCP]: TCP Veno congestion
control) was made by 159131149c2 (tcp: Overflow bug in Vegas), but it
failed to add the required cast in tcp_veno_cong_avoid().

Fixes: 76f1017757aa0 ([TCP]: TCP Veno congestion control)
Signed-off-by: Christoph Paasch <christoph.paasch@uclouvain.be>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
tcp: Fix integer-overflow in TCP vegas

[ Upstream commit 1f74e613ded11517db90b2bd57e9464d9e0fb161 ]

In vegas we do a multiplication of the cwnd and the rtt. This
may overflow and thus their result is stored in a u64. However, we first
need to cast the cwnd so that actually 64-bit arithmetic is done.

Then, we need to do do_div to allow this to be used on 32-bit arches.

Cc: Stephen Hemminger <stephen@networkplumber.org>
Cc: Neal Cardwell <ncardwell@google.com>
Cc: Eric Dumazet <eric.dumazet@gmail.com>
Cc: David Laight <David.Laight@ACULAB.COM>
Cc: Doug Leith <doug.leith@nuim.ie>
Fixes: 8d3a564da34e (tcp: tcp_vegas cong avoid fix)
Signed-off-by: Christoph Paasch <christoph.paasch@uclouvain.be>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>