msm: mdss: fb: null check mfd data

Add appropriate null check for mfd data structure
before accessing it's members. This prevents null
pointer accesses in the driver.

Change-Id: Id301d4a90c9a52049944c7e3b31aa1a34ad292d7
CRs-Fixed: 526286
Signed-off-by: Manoj Rao <manojraj@codeaurora.org>
Signed-off-by: franciscofranco <franciscofranco.1990@gmail.com>
qup_i2c: Handle scenario if runtime PM is disable

If  runtime PM is not supported, make sure
the I2C clock and GPIOs enabled at the start
of the transfer(RD/WR)
This is done by i2c_qup_pm_resume_runtime()

CRs-Fixed: 492194
Change-Id: Iaa901a0f0d0cd58318e3f6dd64e1db73c73b630f
Signed-off-by: Dilip Kota <c_dkota@codeaurora.org>
Signed-off-by: Sana Venkat Raju <c_vsana@codeaurora.org>
Signed-off-by: franciscofranco <franciscofranco.1990@gmail.com>
i2c_qup: Improve implementation of PM callbacks

Refactor PM callbacks and remove redundant variable.
Add support for configuration of clockcontrol event.
Now the clock's state may be set by pm calls (as before)
or by a transfer's begining and ending.
Runtime-PM is still used in autosuspend configuration for
expensive NoC voting/unvoting since that may go to remote
processor.

CRs-Fixed: 592435
Change-Id: I54f7c67f768336f66765a04006b4c8e4734ac277
Signed-off-by: Gilad Avidov <gavidov@codeaurora.org>
Signed-off-by: Sagar Dharia <sdharia@codeaurora.org>
Signed-off-by: Sana Venkat Raju <c_vsana@codeaurora.org>
Signed-off-by: franciscofranco <franciscofranco.1990@gmail.com>
i2c_qup: Fix for unhandled IRQ

I2C qup driver handle scenario where runtime
PM is not enabled and enables clocks explicitly.
But it checks runtime PM suspended state in ISR
routine before processing further which can lead to issue
of unhandled valid IRQ sometimes because I2C client
can initiate transaction very early after system
resume and runtime PM is not enabled.

Add atomic flag to synchronize between active transaction
request when clocks are enabled and ISR.

CRs-Fixed: 670480
Change-Id: I175bc29a7b5b6e713ab6ec28deb34b2b0d23fa8a
Signed-off-by: Sana Venkat Raju <c_vsana@codeaurora.org>
Signed-off-by: Alok Chauhan <alokc@codeaurora.org>
Signed-off-by: franciscofranco <franciscofranco.1990@gmail.com>
USB: android: Add support for USB UICC mass storage

USB UICC cards can support multiple partitions which can be
exposed to the host via USB mass storage function. The number
of partitions of UICC card may vary for each target. Hence
create a device tree property to accept the required luns.

CRs-Fixed: 639635
Change-Id: I5bf5e9acd9fed72adffe469b602ab2d431ccfa3e
Signed-off-by: Pavankumar Kondeti <pkondeti@codeaurora.org>
Signed-off-by: franciscofranco <franciscofranco.1990@gmail.com>
USB: android: release spinlock before queuing work in android_setup

In android_setup we release spinlock after scheduling the work but there
is no need for holding the spinlock during the schedule_work call
is executed this can lead to spinlock timeouts in case where schedule
work takes more time.

So before scheduling work in android_setup we release spinlock to avoid
potential spinlock lockup or timeout.

CRs-Fixed: 661220
Change-Id: Ibf8ff7f07caf20edf9e646fdcef540fbc6441aec
Signed-off-by: Tarun Gupta <tarung@codeaurora.org>
Signed-off-by: Vijayavardhan Vennapusa <vvreddy@codeaurora.org>
Signed-off-by: ChandanaKishori Chiluveru <cchilu@codeaurora.org>
Signed-off-by: franciscofranco <franciscofranco.1990@gmail.com>
usb: android: Skip the work when set_config arrives with same value twice

Some USB hosts may send SET_CONFIGURATION with same value twice.
The current code implementation processing the 2nd set_config and
schedules the work. The android_work() issues disconnect event to
userspace if SetConfiguration with non-zero value is sent twice.
The userspace applications may disconnect the USB and the device
doesn't connect to the host.

Fix this by avoiding the android_work for the second time SET_CONFIGURATION
request when it receives SetConfiguration request with same configuration
value twice from the host.

CRs-Fixed: 661220
Change-Id: Ic450315a9067b9b679b4936480d125e4e4b7cdf7
Signed-off-by: ChandanaKishori Chiluveru <cchilu@codeaurora.org>
Signed-off-by: franciscofranco <franciscofranco.1990@gmail.com>
usb: gadget: Ignore the second set_config from the host

Some USB hosts may send SET_CONFIGURATION with same value twice.
The current code implementation of android_work() issues disconnect
event to userspace if SetConfiguration with non-zero value is sent
twice. The Userspace application may disconnect USB and it causes
fail to connect to the USB host.

Fix this by ignoring the second time SET_CONFIGURATION request
from the host only for the same configuration value twice.

CRs-Fixed: 661220
Change-Id: Iec8dd7824fa9f371ea147784cf9137aa88a7128e
Signed-off-by: ChandanaKishori Chiluveru <cchilu@codeaurora.org>
Signed-off-by: franciscofranco <franciscofranco.1990@gmail.com>
msm: camera_v2: Create jpeg debugfs

This fixes kmsg errors because jpeg debugfs creation fails. The
device is online for only a few millisecs so the real use of the
interface is questionable, thus a full fix in ion with a camera
subdir not nessecary.

Signed-off-by: franciscofranco <franciscofranco.1990@gmail.com>
net: fib: fix incorrect call_rcu_bh()

After IP route cache removal, I believe rcu_bh() has very little use and
we should remove this RCU variant, since it adds some cycles in fast
path.

Anyway, the call_rcu_bh() use in fib_true is obviously wrong, since
some users only assert rcu_read_lock().

Change-Id: Ie22d933518d579f4d018a4efec9d3a39c7b64681
Signed-off-by: Eric Dumazet <edumazet@google.com>
Cc: "Paul E. McKenney" <paulmck@linux.vnet.ibm.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Git-commit: 0c03eca3d995e73d691edea8c787e25929ec156d
Git-repo: git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
Signed-off-by: Osvaldo Banuelos <osvaldob@codeaurora.org>
Signed-off-by: franciscofranco <franciscofranco.1990@gmail.com>
msm: mdss: Add error handling in mdss_fb_no_update_notify_timer_cb

Return in case mfd is NULL to avoid NULL pointer dereference.

CRs-Fixed: 563125
Change-Id: I82415ed5f1f7b3d27796e9e3a0c96178aa54bdc5
Signed-off-by: Jayant Shekhar <jshekhar@codeaurora.org>
Signed-off-by: franciscofranco <franciscofranco.1990@gmail.com>
msm: mdss: Fix for bus bandwidth issue

Fixing possible large values handling.

Change-Id: Id9e4aafa2a922c2c90def037b110826344487fcd
Signed-off-by: Radhika Ranjan Soni <rrsoni@codeaurora.org>
Signed-off-by: franciscofranco <franciscofranco.1990@gmail.com>
usb: dwc3: otg: Don't set psy type to BATTERY if no charger connected

USB driver incorrectly sets USB power supply type to BATTERY on
charger disconnect. Some userspace client may fail to work properly
by assuming that usb_psy i.e. '/sys/class/power_supply/usb' is
of type battery and subsequent reading of battery status from this
USB supply will fail. Hence, set this to POWER_SUPPLY_TYPE_UNKNOWN.

CRs-fixed: 676051
Change-Id: I0a93b607f8cb328486397fa7bc96ff2177db5a77
Signed-off-by: Manu Gautam <mgautam@codeaurora.org>
Signed-off-by: franciscofranco <franciscofranco.1990@gmail.com>
staging: binder: add vm_fault handler

An issue was observed when a userspace task exits.
The page which hits error here is the zero page.
In binder mmap, the whole of vma is not mapped.
On a task crash, when debuggerd reads the binder regions,
the unmapped areas fall to do_anonymous_page in handle_pte_fault,
due to the absence of a vm_fault handler. This results in
zero page being mapped. Later in zap_pte_range, vm_normal_page
returns zero page in the case of VM_MIXEDMAP and it results in the
error.

BUG: Bad page map in process mediaserver  pte:9dff379f pmd:9bfbd831
page:c0ed8e60 count:1 mapcount:-1 mapping:  (null) index:0x0
page flags: 0x404(referenced|reserved)
addr:40c3f000 vm_flags:10220051 anon_vma:  (null) mapping:d9fe0764 index:fd
vma->vm_ops->fault:   (null)
vma->vm_file->f_op->mmap: binder_mmap+0x0/0x274
CPU: 0 PID: 1463 Comm: mediaserver Tainted: G        W    3.10.17+ #1
[<c001549c>] (unwind_backtrace+0x0/0x11c) from [<c001200c>] (show_stack+0x10/0x14)
[<c001200c>] (show_stack+0x10/0x14) from [<c0103d78>] (print_bad_pte+0x158/0x190)
[<c0103d78>] (print_bad_pte+0x158/0x190) from [<c01055f0>] (unmap_single_vma+0x2e4/0x598)
[<c01055f0>] (unmap_single_vma+0x2e4/0x598) from [<c010618c>] (unmap_vmas+0x34/0x50)
[<c010618c>] (unmap_vmas+0x34/0x50) from [<c010a9e4>] (exit_mmap+0xc8/0x1e8)
[<c010a9e4>] (exit_mmap+0xc8/0x1e8) from [<c00520f0>] (mmput+0x54/0xd0)
[<c00520f0>] (mmput+0x54/0xd0) from [<c005972c>] (do_exit+0x360/0x990)
[<c005972c>] (do_exit+0x360/0x990) from [<c0059ef0>] (do_group_exit+0x84/0xc0)
[<c0059ef0>] (do_group_exit+0x84/0xc0) from [<c0066de0>] (get_signal_to_deliver+0x4d4/0x548)
[<c0066de0>] (get_signal_to_deliver+0x4d4/0x548) from [<c0011500>] (do_signal+0xa8/0x3b8)

Add a vm_fault handler which returns VM_FAULT_SIGBUS, and prevents the
wrong fallback to do_anonymous_page.

CRs-Fixed: 673147
Change-Id: I43730a51b6c819538b46c5e4dc5c96c8a384098d
Signed-off-by: Vinayak Menon <vinayakm.list@gmail.com>
Patch-mainline: linux-arm-kernel @ 06/02/14, 18:17
Signed-off-by: Vignesh Radhakrishnan <vigneshr@codeaurora.org>
Signed-off-by: Subbaraman Narayanamurthy <subbaram@codeaurora.org>
Signed-off-by: franciscofranco <franciscofranco.1990@gmail.com>
nl80211: nl80211hdr_put() doesn't return an ERR_PTR

There are a few places which check nl80211hdr_put() for an ERR_PTR
but actually it returns NULL on error and never error values.  In
nl80211_testmode_dump() the return wasn't checked at all so I have
added one.

Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
[some whitespace changes]
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Git-commit: cb35fba360dfc3496e5d8a47e23ec5ccdfd90925
Git-repo: git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
Change-Id: I5da1aafea35110a1ce606d402b1b96859d34b869
[akholaif@codeaurora.org: resolved conflicts manually]
Signed-off-by: Ahmad Kholaif <akholaif@codeaurora.org>

Signed-off-by: franciscofranco <franciscofranco.1990@gmail.com>
nl80211: fix error path in nl80211_get_key()

Coverity pointed out that in the (practically impossible)
error case we leak the message - fix this.

Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Git-commit: 9fe271af7d4de96471c5aaee2f4d0d1576050497
Git-repo: git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
Change-Id: I78c3631eabd04e86872faf65fa1e401dadb35a75
Signed-off-by: Ahmad Kholaif <akholaif@codeaurora.org>
Signed-off-by: franciscofranco <franciscofranco.1990@gmail.com>
cfg80211: ignore supported rates for nonexistant bands on scan

Fixes wpa_supplicant p2p_find on 5GHz-only devices

Signed-off-by: Felix Fietkau <nbd@openwrt.org>
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Git-commit: 1b09cd82d8c479700ef6185665839d1020b02519
Git-repo: git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
Change-Id: Icadd03bfff17c5fd8da3e15e7b69b42a730e0ef0
Signed-off-by: Ahmad Kholaif <akholaif@codeaurora.org>
Signed-off-by: franciscofranco <franciscofranco.1990@gmail.com>
cpufreq: interactive: fix derp.

Signed-off-by: franciscofranco <franciscofranco.1990@gmail.com>
cpufreq: interactive: fix another derp, I was probably drunk when I merged the patch before.

Signed-off-by: franciscofranco <franciscofranco.1990@gmail.com>
kthread: Fix the race condition when kthread is parked

While stressing the CPU hotplug path, sometimes we hit a problem
as shown below.

[57056.416774] ------------[ cut here ]------------
[57056.489232] ksoftirqd/1 (14): undefined instruction: pc=c01931e8
[57056.489245] Code: e594a000 eb085236 e15a0000 0a000000 (e7f001f2)
[57056.489259] ------------[ cut here ]------------
[57056.492840] kernel BUG at kernel/kernel/smpboot.c:134!
[57056.513236] Internal error: Oops - BUG: 0 [#1] PREEMPT SMP ARM
[57056.519055] Modules linked in: wlan(O) mhi(O)
[57056.523394] CPU: 0 PID: 14 Comm: ksoftirqd/1 Tainted: G        W  O 3.10.0-g3677c61-00008-g180c060 #1
[57056.532595] task: f0c8b000 ti: f0e78000 task.ti: f0e78000
[57056.537991] PC is at smpboot_thread_fn+0x124/0x218
[57056.542750] LR is at smpboot_thread_fn+0x11c/0x218
[57056.547528] pc : [<c01931e8>]    lr : [<c01931e0>]    psr: 200f0013
[57056.547528] sp : f0e79f30  ip : 00000000  fp : 00000000
[57056.558983] r10: 00000001  r9 : 00000000  r8 : f0e78000
[57056.564192] r7 : 00000001  r6 : c1195758  r5 : f0e78000  r4 : f0e5fd00
[57056.570701] r3 : 00000001  r2 : f0e79f20  r1 : 00000000  r0 : 00000000

This issue was always seen in the context of "ksoftirqd". It seems to
be happening because of a potential race condition in __kthread_parkme
where just after completing the parked completion, before the
ksoftirqd task has been scheduled again, it can go into running state.

Fix this by waiting for the task state to parked after waiting the
parked completion.

CRs-Fixed: 659674
Change-Id: If3f0e9b706eeb5d30d5a32f84378d35bb03fe794
Signed-off-by: Subbaraman Narayanamurthy <subbaram@codeaurora.org>
Signed-off-by: franciscofranco <franciscofranco.1990@gmail.com>