hwmon: qpnp-adc-current: Fix potential race condition

There should be no synchronous Voltage and Current readings
initiated on IADC_USR when a single VADC_USR conversion is
in progress. If a synchronous Voltage and Current read
occures while a VADC_USR is in progress it results in an
invalid state for that single conversion on the VADC_USR.
There is a potential race condition where the above scenario
can occur that is due to an IADC conversion occuring before
the VADC_IADC USR sync conversion is complete and ends up
using the mode select as a VADC_IADC sync request.
Therefore use a single lock for both IADC and
synchronous VADC_IADC request.

Change-Id: Idb451b813bc5f08b7239d371fc0f8fa5e17429b1
Signed-off-by: Siddartha Mohanadoss <smohanad@codeaurora.org>
radio: iris: Avoid inconsistent free

There is memory leak chance if we exit
from function early. Ensure to use free before
exiting from function.

Change-Id: I17dbecffc5713d95c66ecec0bffb5ed3c8660fe8
CRs-Fixed: 540334
Signed-off-by: Ayaz Ahmad <aahmad@codeaurora.org>
ARM: dts: msm: Add CX regulator Phandle to MDP node

The Phandle might change for different
versions of the msm8974 chip. Add the proper
Phandle of CX regulator to 8974 v2 and
8974pro versions.

Change-Id: Ifce120fcb349360e36c4ea74bcaf5ea14e1dece5
Signed-off-by: Chandan Uddaraju <chandanu@codeaurora.org>
kernel: rng: Change master id to 54 in rng vector

This fix prevents BKE Limiter from activating during boot due to
rng.

CRs-Fixed: 570296
Change-Id: Ie52f02a4af9cd824533e80ae3722496d09497529
Signed-off-by: Liam Fernandez <liam@codeaurora.org>
ASoC: wcd9320: Prevent calling PA event unnecessarily during ANC

When Headphone ANC is enabled, do not call the headphone PA event
in pre-power down case, only in post-power down.
Headphone PA event will only process this call in post-power
down case.

Change-Id: I61ba96ae038c2e0aa4dc3d01048f33e6a5e97d86
Signed-off-by: Damir Didjusto <damird@codeaurora.org>
pwm: qpnp: provide both nsec/usec-supported pwm config() functions

Now implement pwm_config() to support nanosecond parameters, which
has better granularity in some situation, for example, if the number
of backlight brightness levels is 256, using microseond parameters
will only get nearly 50 levels.

But Qualcomm platform should support 384 seconds pwm-period at most,
the above standard API couldn't satisfy the requirement of the bigger
period, so we also provide pwm_config_us() this such platform related
API.

CRs-Fixed: 545809
Change-Id: Ia3ea9904141f69c1f40a8619ba8d9fe891e3460a
Signed-off-by: Xu Kai <kaixu@codeaurora.org>
defconfig: remove support for /dev/mem and /dev/kmem on perf builds

Keeping /dev/mem and /dev/kmem exposed to userspace allows userspace
to peek/poke to these areas and is a security risk. Remove support for
/dev/mem and /dev/kmem on perf builds.

Change-Id: Ibceabb7697bc220761aa55e028f0245037c7cc0c
CRs-Fixed: 530719
Signed-off-by: Sarang Joshi <spjoshi@codeaurora.org>
msm: ipc: Possible memory corruption due to Sign Conversion

msm_ipc_router_skb_to_buf() takes an unsigned argument and assigns the
same to a signed local variable. This might cause issues when the value
of the argument is too high.

Change the datatype of the local variable to unsigned.

CRs-Fixed: 550606
Change-Id: I257a095681dd82fba05367fd6faf25820e95c719
Signed-off-by: Zaheerulla Meer <zmeer@codeaurora.org>
Bluetooth: Replace sprintf with snprintf

Change will replace sprintf with snprintf, since sprintf is a
banned function.

CRs-FIxed: 548220
Change-Id: I32f5ab1f3707e5bbe43c31a7ad4611b67557b267
Signed-off-by: Juffin Alex Varghese <jalex@codeaurora.org>
mdss: Fix null point dereference in mdss_mdp_pp_init

Fixed null point dereference in case of memory allocation
failure in mdss_mdp_pp_init.

Change-Id: I3593a583da355915b731ac30b1f38aaa010eba85
Signed-off-by: Krishna Chaitanya Parimi<cparimi@codeaurora.org>
msm: ultrasound: support multiple devices, conflicting with USF

The USF input device can have a number of devices,
conflicting with it.
The first registered device (primary) is real TSC device.
Optionally, later registered devices are simulated ones.
The input events from the multiple devices should be
controlled by USF.

CR-Fixed: 583511
Change-Id: I07983546c6e70e562bdf3f833ab1ba17b2b9e399
Signed-off-by: Baruch Eruchimovitch <baruche@codeaurora.org>
radio: iris: Prevent probable overflow

casting a unsigned int into an integer, integer to
unsigned int may cause buffer overflow.

Change-Id: I54be4d4c5470616a59a772c587fe6d5f32575c32
CRs-Fixed: 539008
Signed-off-by: Ayaz Ahmad <aahmad@codeaurora.org>
radio: iris: Avoid memory leak and NULL pointer dereferencing

 - Avoid memory leak by freeing allocated memory
 - Do not derefer NULL pointer

CRs-Fixed: 537955
Signed-off-by: Ayaz Ahmad <aahmad@codeaurora.org>
Change-Id: I7624d73e5c25233e9d03c67e4204c611b9a8fff6
msm: ultrasound: add verifications of some input parameters

Some security vulnerabilities were found.
To fix them, additional verifications of some input parameters
are required.

CRs-Fixed: 554575, 554560, 555030
Change-Id: Ie87a433bcda89c3e462cfd511c168e8306056020
Signed-off-by: Baruch Eruchimovitch <baruche@codeaurora.org>
ion: replace userspace handle cookies with idr

Userspace handles should not leak kernel virtual addresses to
userspace.  They have to be validated by looking them up in an
rbtree anyways, so replace them with an idr and validate them
by using idr_find to convert the id number to the struct
ion_handle pointer.

Change-Id: Iab5667ba6f3a73256fec3949b23a9a6f8e14a283
Signed-off-by: Colin Cross <ccross@android.com>
Git-commit: 1126d98d8e34d771afcc72ce5d1c37ad4d474402
Git-repo: https://android.googlesource.com/kernel/common
[mitchelh@codeaurora.org: conflicts due to msm changes]
Signed-off-by: Mitchel Humpherys <mitchelh@codeaurora.org>
ion: don't use id 0 for handle cookie

ion userspace clients think that the cookie is a pointer, so they
use NULL to check if the handle has been initialized.  Set the first
id number to 1.

Change-Id: Ifb9af6029a8b08f57e41bc6160cc11e11001a2a9
Signed-off-by: Colin Cross <ccross@android.com>
Git-commit: 66df93b4c9e78cf433b76d7fe3da4cc7fd06c36b
Git-repo: https://android.googlesource.com/kernel/common
Signed-off-by: Mitchel Humpherys <mitchelh@codeaurora.org>
ion: add new ion_user_handle_t type for the user-space token

Declare new ion_user_handle_t type to contain the token returned to user-space.
This allows a 2-step migration of the user-space code to a new kernel header
first, then will allow us to change the definition of the ion_user_handle_type_t
to int without breaking the API.

Change-Id: I4200b6600df8e56fe98cf1580a13a65cb25ec646
Signed-off-by: Rom Lemarchand <romlem@google.com>
(cherry picked from commit ebb8269bbb05b06ecedca3e21b3e65f23d48eadd)
Git-commit: 29f271de6ffdf6a96375cd244986617e87afc8d0
Git-repo: https://android.googlesource.com/kernel/common
Signed-off-by: Mitchel Humpherys <mitchelh@codeaurora.org>
ion: hold reference to handle after ion_uhandle_get

commit 1262ab1846cf76f7549c66ef709120dbfbe6d49f (ion: replace
userspace handle cookies with idr) broke the locking in ion.
The ION_IOC_FREE and ION_IOC_MAP ioctls were relying on
ion_handle_validate to detect the case where a call raced
with another ION_IOC_FREE which may have freed the struct
ion_handle.

Rename ion_uhandle_get to ion_handle_get_by_id, and have it
take the client lock and return with an extra reference to
the handle.  Make each caller put its reference once it
is done with the handle.

Also modify users of ion_handle_validate to continue to hold
the client lock after calling ion_handle_validate until
they are done with the handle, and warn if ion_handle_validate
is called without the client lock held.

Change-Id: I56da5624fca3bed4ee24806b6ec39de903543341
Signed-off-by: Colin Cross <ccross@android.com>
Git-commit: 33a57aa073dac709bcdcba23bc4e2e7fcc6330f6
Git-repo: https://android.googlesource.com/kernel/common
[mitchelh@codeaurora.org: minor merge conflicts due to some missing
 casts since we haven't brought in the change that makes
 ion_user_handle_t an int.]
Signed-off-by: Mitchel Humpherys <mitchelh@codeaurora.org>
ion: export a few handle-related APIs

There are a few APIs (ion_handle_put and ion_handle_get_by_id) that are
useful for implementing Ion extensions (e.g. custom ioctl
handlers). Remove the `static' to make these APIs available to other Ion
code.

Change-Id: Ice8767853f628d8178e96a36db3da02fa97f3235
Signed-off-by: Mitchel Humpherys <mitchelh@codeaurora.org>
msm: kgsl: Don't enable VBIF counters for targets that don't use them

Only targets with separate bus control need the VBIF counters enabled
by default.

Change-Id: I3a7fcedebf7a7cc80bc1bec5a7fd298b49b9b165
Signed-off-by: Lucille Sylvester <lsylvest@codeaurora.org>