kernel: alarm: setup the RTC immediately for poweroff alarm

Currently we setup the RTC for poweroff alarm when the system
performs shutdown. But if the phone is shut down unexpectedly
before that, the poweroff alarm can't work. So we can do that
immediately.

CR-fixed: 532743
Change-Id: Ib26a56fba8cd64efe94f2f07ee232482228429dc
Signed-off-by: Figo Wang <figow@codeaurora.org>
power: qpnp-charger: allow vinmin to be lowered to 4.0 V

Currently the minimum input voltage is limited to a minimum
value of 4.2 V. Some chargers in combination with cables
having high resistance may require the input voltage minum
to be lower than 4.2.

Fix this by allowing up to 4.0 V for the minimum input voltage
settings.

Change-Id: I6f1dfa2453c7b95ecc2ccdf2aac23981c0e4dd0a
CRs-Fixed: 584999
Signed-off-by: David Keitel <dkeitel@codeaurora.org>
msm: camera: Fix unterminated of_device_id table

Add a NULL table entry at end for msm, ispif and
msm_generic_buf_mgr device tree match tables.

Change-Id: I05f08c77a8a25112cd17955e98018ac88b7a834c
CRs-Fixed: 582110
Signed-off-by: Hariram Purushothaman <hpurus@codeaurora.org>
msm: ipa: teth_bridge: bug fix in get_aggr_capabilities ioctl

Incorrect input validation may cause a kernel memory disclosure to user
space. This fix adds the correct input validation.

Change-Id: Ia0a3f6bae3c9efc48136bad9974516929e76f4fb
CRs-Fixed: 555453
Signed-off-by: Gidon Studinski <gidons@codeaurora.org>
msm: rpm-smd: use data type correctly for a variable

Change variable data type from signed int to unsigned int.

CRs-fixed: 556055
Change-Id: I6bb363b31d4fab26d84f89e775101c6051fe9e10
Signed-off-by: Anil kumar mamidala <amami@codeaurora.org>
msm: mdss: release mdp dsi clock only when reset

Earlier, we were releasing all the MDP clocks during
lk to kernel transition.   We only need to release
the mdp dsi clock.

Change-Id: Iafa43afc1194e5f7cb50445a9542a21b16ffaef5
Signed-off-by: Xiaoming Zhou <zhoux@codeaurora.org>
msm: mdp3: implement asynchronous frame events

Asynchronous frame events from MDP allows commit thread to be unblocked
once the frame contents have been flushed to MDP HW and new frame can be
programmed while waiting for DMA transfer to complete.

Change-Id: If2ecc3cedfd92e20b2e98b0ac4f6f3608ce78579
Signed-off-by: Terence Hampson <thampson@codeaurora.org>
ARM: dts: msm: fix NFC i2c dts entry on PVT device

Make default params explicit

Change-Id: I957b8ad8f9fa7b6e12a05ec59df740f572d3540a
Signed-off-by: Houston Hoffman <hhoffman@codeaurora.org>
msm-camera: Fixed MIPI raw snaspshot issue 8x10

Removed clearing of interrupt mask register after the streamon is done
add a reset logic for VFE after all the streams are inactive.

Change-Id: Ib8999baae8f75498dcc813aa01fbb44f8c104e94
CRs-Fixed: 583125
Signed-off-by: Chandan Gera <cgera@codeaurora.org>
input: misc: mma8x5x cannot change polling delay

Change polling delay of accelerometer mma8x5x will not take effect
because driver never use this new delay.

Change-Id: I8dcc457de46970b90ffcedd0c76dca4da5010884
Signed-off-by: Bingzhe Cai <bingzhec@codeaurora.org>
msm: wfd:Wait for one more vsync cycle, if VSG running out of input frames

If VSG running out of input frames, it will re-encode previous frames.
With this change, instead of encoding pervious frame VSG will push timer to
half of capturing frame rate. If it find new frame, it will be encoded
Otherwise will re-encode previous frame.

CRs-Fixed: 571771
Change-Id: Ie1c970b4e251c2165e77134b746c4ee0e3a90fba
Signed-off-by: Srinu Gorle <sgorle@codeaurora.org>
netfilter: x_tables: fix ordering of jumpstack allocation and table update

During kernel stability testing on an SMP ARMv7 system, Yalin Wang
reported the following panic from the netfilter code:

  1fe0: 0000001c 5e2d3b10 4007e779 4009e110 60000010 00000032 ff565656 ff545454
  [<c06c48dc>] (ipt_do_table+0x448/0x584) from [<c0655ef0>] (nf_iterate+0x48/0x7c)
  [<c0655ef0>] (nf_iterate+0x48/0x7c) from [<c0655f7c>] (nf_hook_slow+0x58/0x104)
  [<c0655f7c>] (nf_hook_slow+0x58/0x104) from [<c0683bbc>] (ip_local_deliver+0x88/0xa8)
  [<c0683bbc>] (ip_local_deliver+0x88/0xa8) from [<c0683718>] (ip_rcv_finish+0x418/0x43c)
  [<c0683718>] (ip_rcv_finish+0x418/0x43c) from [<c062b1c4>] (__netif_receive_skb+0x4cc/0x598)
  [<c062b1c4>] (__netif_receive_skb+0x4cc/0x598) from [<c062b314>] (process_backlog+0x84/0x158)
  [<c062b314>] (process_backlog+0x84/0x158) from [<c062de84>] (net_rx_action+0x70/0x1dc)
  [<c062de84>] (net_rx_action+0x70/0x1dc) from [<c0088230>] (__do_softirq+0x11c/0x27c)
  [<c0088230>] (__do_softirq+0x11c/0x27c) from [<c008857c>] (do_softirq+0x44/0x50)
  [<c008857c>] (do_softirq+0x44/0x50) from [<c0088614>] (local_bh_enable_ip+0x8c/0xd0)
  [<c0088614>] (local_bh_enable_ip+0x8c/0xd0) from [<c06b0330>] (inet_stream_connect+0x164/0x298)
  [<c06b0330>] (inet_stream_connect+0x164/0x298) from [<c061d68c>] (sys_connect+0x88/0xc8)
  [<c061d68c>] (sys_connect+0x88/0xc8) from [<c000e340>] (ret_fast_syscall+0x0/0x30)
  Code: 2a000021 e59d2028 e59de01c e59f011c (e7824103)
  ---[ end trace da227214a82491bd ]---
  Kernel panic - not syncing: Fatal exception in interrupt

This comes about because CPU1 is executing xt_replace_table in response
to a setsockopt syscall, resulting in:

	ret = xt_jumpstack_alloc(newinfo);
		--> newinfo->jumpstack = kzalloc(size, GFP_KERNEL);

	[...]

	table->private = newinfo;
	newinfo->initial_entries = private->initial_entries;

Meanwhile, CPU0 is handling the network receive path and ends up in
ipt_do_table, resulting in:

	private = table->private;

	[...]

	jumpstack  = (struct ipt_entry **)private->jumpstack[cpu];

On weakly ordered memory architectures, the writes to table->private
and newinfo->jumpstack from CPU1 can be observed out of order by CPU0.
Furthermore, on architectures which don't respect ordering of address
dependencies (i.e. Alpha), the reads from CPU0 can also be re-ordered.

This patch adds an smp_wmb() before the assignment to table->private
(which is essentially publishing newinfo) to ensure that all writes to
newinfo will be observed before plugging it into the table structure.
A dependent-read barrier is also added on the consumer sides, to ensure
the same ordering requirements are also respected there.

Change-Id: Ia320d52510d7184c0f13d7f130102dbe685e8d6f
Cc: Paul E. McKenney <paulmck@linux.vnet.ibm.com>
Reported-by: Wang, Yalin <Yalin.Wang@sonymobile.com>
Tested-by: Wang, Yalin <Yalin.Wang@sonymobile.com>
Signed-off-by: Will Deacon <will.deacon@arm.com>
Acked-by: Eric Dumazet <edumazet@google.com>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Git-commit: b416c144f46af1a30ddfa4e4319a8f077381ad63
Git-repo: git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
Signed-off-by: Osvaldo Banuelos <osvaldob@codeaurora.org>
ext4: make sure the journal sb is written in ext4_clear_journal_err()

After we transfer set the EXT4_ERROR_FS bit in the file system
superblock, it's not enough to call jbd2_journal_clear_err() to clear
the error indication from journal superblock --- we need to call
jbd2_journal_update_sb_errno() as well.  Otherwise, when the root file
system is mounted read-only, the journal is replayed, and the error
indicator is transferred to the superblock --- but the s_errno field
in the jbd2 superblock is left set (since although we cleared it in
memory, we never flushed it out to disk).

This can end up confusing e2fsck.  We should make e2fsck more robust
in this case, but the kernel shouldn't be leaving things in this
confused state, either.

Change-Id: I7a7cd58880209fbd54f4ded5f2b62de492cae9e0
Signed-off-by: "Theodore Ts'o" <tytso@mit.edu>
Cc: stable@kernel.org
Git-commit: d796c52ef0b71a988364f6109aeb63d79c5b116b
Git-repo: git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
Signed-off-by: Osvaldo Banuelos <osvaldob@codeaurora.org>
msm: vidc: Fix a race condition in masking interrupts

Fix a race condition when interaction with firmware happens
in following sequence:

1. Firmware writes IDLE message into the message queue.
2. Driver writes a new command into command queue.
3. Firmware reads this command and starts processing it.
4. Driver checks if command queue is empty and finds it empty.
5. Firmware writes the response (of the command sent in 2) in
   message queue. Firmware also writes another IDLE message and
   sets the idle register.
6. Driver check if the IDLE register is set and finds it set.
7. Driver masks the interrupts. Since interrupts are masked,
   driver misses the response written by firmware in 5.

This race condition is fixed by checking if message queue is
empty or not between 6 and 7.

Change-Id: I9b73ff35f6d408a021f3b03080210da315679d0e
Signed-off-by: Vinay Kalia <vkalia@codeaurora.org>
diag: dci: Safeguard to prevent integer overflow

At certain point in diag driver there can be integer overflow
thus can lead to memory leak. Added a safegaurd for it.

Change-Id: I9347405d8f1f95ed42fe0abf35cbf4c362281bdf
CRs-fixed: 565160
Signed-off-by: Katish Paran <kparan@codeaurora.org>
radio: iris: Allow task to be interrupted

Not allowing task to be interrupted can cause
delay in response to upper layer. Allow task pending
to be interrupted when corresponding command's status
is received.

Change-Id: I1ff383327b646042b1f1e66547eda6900186710b
CRs-Fixed: 569318
Signed-off-by: Ayaz Ahmad <aahmad@codeaurora.org>
radio: iris: Add NULL pointer check

Dereferencing a NULL pointer may cause kernel crash,
Check for NULL pointer before dereferencing

Change-Id: Ic3368d619d23c76702d95e0f69e41394e423a296
CRs-Fixed: 548404
Signed-off-by: Ayaz Ahmad <aahmad@codeaurora.org>
radio: iris: Bound check user space values

There is no bound check for arguments passed
from user space to kernel space. This may cause
fatal exceptions.

Change-Id: Ia44c3b035afbd0723fe2052d7a0e8697930a2016
CRs-Fixed: 546081
Signed-off-by: Ayaz Ahmad <aahmad@codeaurora.org>
msm: vidc: fix corruption of registered buffer list

The buffer list for output buffers is accessed from
different threads leading to race conditions. Consider
the case of firmware throwing up a fatal error, which gets
propagated to v4l2 client. The v4l2 client closes the
driver fd, which will trigger msm_vidc_release_buffers
to release all output buffers and free node from
the registered buffer list. During this time, if
firmware sends a release reference event, the buffer
node being accessed in msm_vidc_release_buffers could
be freed, triggering kernel panic.

Change-Id: I522edff06a62dbc2ab60d6cca5990babb18d5c6c
Signed-off-by: Arun Menon <avmenon@codeaurora.org>
msm_serial_hs: Enhancing IPC logs

Move required logs from DEBUG level to INFO level
and reduce the tx/rx data to be logged only first and
last 10 bytes in INFO level.

Change-Id: I8e01ae77f7da3386fc77713b28443b19c0704eb0
CRs-Fixed: 593862
Signed-off-by: Dilip Kota <c_dkota@codeaurora.org>