msm: kgsl: Take the pagetable reference count only when needed

There could be a race condition where one thread is iterating
over ptlist inside kgsl_get_pagetable() with spinlock acquired
and going to call kref_put(). At the same time another thread is
inside kgsl_put_pagetable() without any spinlock calls kref_put()
and returns without calling kgsl_destroy_pagetable(). The decrement
of refcount by second thread leads to a situation where first thread
enters kgsl_destroy_pagetable_locked() and hence destroying the pt
node from list. This causes the destroyed pt node's next and prev
pointers set to POISON value resulting in kernel panic while executing
next iteration of ptlist.

Taking pt refcount while iterating over ptlist should be avoided if the
spinlock is already held and the pt is not returned to the caller. In
kgsl_get_pagetable(), since the loop is already holding the mutex, it
is safe to look at pt before taking a reference.

CRs-Fixed: 661374
Change-Id: Ide1f57cc1eb3cbf66fa399b6b72491755b999c7a
Signed-off-by: Prabhat Awasthi <pawasthi@codeaurora.org>
diag: dci: Do not update status if DCI support is not present

If same command is registered on multiple peripherals then
diag driver is returning wrong error status to client while
traversing the registration table. This patch does not update
the error status if DCI support is not present on that
peripheral.

CRs-Fixed: 683796
Change-Id: Ib0f7eb6e910998f616fd4105df0428ec59c334e5
Signed-off-by: Mohit Aggarwal <maggarwa@codeaurora.org>
power: qpnp-smbcharger: don't reset vddmax trim after EOC

Currently the vddmax trim is being calibrated during the constant
voltage charging in order to charge more accurately. However, when end
of charge happens, this trim is reset back to the original value. On
certain chips with very bad preset trims, this can actually cause the
charger to go into accidental reverse boost when USB is reinserted and
vbat is higher than vddmax by 60mV.

Fix this by not resetting the vddmax trim after EOC or USB removal.

CRs-Fixed: 657755
Change-Id: Iaf9c9eb786ee05e5f326fa87813fe867f6493829
Signed-off-by: Xiaozhe Shi <xiaozhes@codeaurora.org>
diag: dci: Mutex protect the list while traversal and node deletion

On receiving the response from peripherals for the sent command
DCI traverses and deletes from the list. The list is not lock
protected while traversal or deletion. This patch resolves the
same.

Change-Id: Ie93f3e035b35c4d39f1e19f9c42a48f4147fe145
CRs-Fixed: 715663
Signed-off-by: Katish Paran <kparan@codeaurora.org>
media: dvb: verify filter state when reusing decoder buffer

In case that user calls DMX_REUSE_DECODER_BUFFER ioctl after
the filter has stopped, feed->ts is NULL and so kernel will
dereference a NULL pointer.
Add checking of filter state to verify filter is active when
decoder buffer is reused and verify feed and feed->ts are not
NULL.

Change-Id: I6b8bb64cd7689e2f15813d3f777803df3bb0c849
Signed-off-by: Gilad Broner <gbroner@codeaurora.org>
ARM: dts: msm: Update bus bandwidth votes for sdhci on 8974

Some versions of 8974 supports eMMC HS400 mode providing maximum
throughput of 400MB/s. Update the list of bus bandwidth votes to
make sure appropriate vote is placed in this mode.

CRs-fixed: 656702
Change-Id: I5e3bed70d8c8c1c6423483f7469849823e3ebb2c
Signed-off-by: Sujit Reddy Thumma <sthumma@codeaurora.org>
Signed-off-by: Asutosh Das <asutoshd@codeaurora.org>
msm_serial_hs: Race Condition during Baud Rate Configuration

Race Condition:
==============
CPU 0:
1.) Rx BAM pipe got disconnected during Baud Rate Cnfg
2.) Rx tasklet got scheduled
3.) Tasklet is issuing Rx command to BAM
4.) BAM API aquired spinlock and accessed Null Pointer
This lead to Null Pointer Access and Crash
CPU 1:
5.) As part of baud rate configuration process CPU 1
called BAM Rx Connect API
6.) BAM API is trying acquire Spinlock
7.) Spinlock is not released by CPU0
This lead to BUG ON

Fix:
===
During Baud Rate Configuration, if Rx command is queued
set the flag for not issuing any Rx command to BAM
Adding rx_cmd_exec variable to avoid command getting
queued twice without callback for the first

Change-Id: I800180cba22b1d0326147a21f175d06e4641f6c4
Signed-off-by: Dilip Kota <c_dkota@codeaurora.org>
Signed-off-by: Naveen Kaje <nkaje@codeaurora.org>
msm_serial_hs: Avoid potential unclocked access by clients

Ensure that the port configuration, data transfer activities
occur when hardware resources are available by voting for them
as the client may call shutdown and clock off asynchronously.

CRs-Fixed: 616127
Change-Id: I7ab171c2176589a54b839cfee8bb33840b55abed
Signed-off-by: Naveen Kaje <nkaje@codeaurora.org>
Signed-off-by: Dilip Kota <c_dkota@codeaurora.org>
power: qpnp-charger: Add VCHG_LOOP_DBC_BYPASS property

Add a property VCHG_LOOP_DBC_BYPASS in battery power supply. It is used
for enabling/disabling the buck VCHG_LOOP debouncer timer.

Change-Id: If3f1ecb56abe2319e9defb6ef03a83b972632ef4
Signed-off-by: Fenglin Wu <fenglinw@codeaurora.org>
msm: vidc: Send resolution along with output buffer

Send the resolution along with output buffer to the client
to avoid a race condition where resolution might be changed
multiple times in driver before client requests for updated
resolution.

Change-Id: I8ebb99e3baa04da09f153195a674babcebcfea78
Signed-off-by: Pushkaraj Patil <ppatil@codeaurora.org>
msm: kgsl: Fix memory entry leak when calling adreno_convertaddr

When adreno_convertaddr is called the memory searched in this function
may have a memory entry associated with it if this allocation belongs
to user space. A reference to this memory entry is taken when
this function is called which should be returned when the caller is
done using the memory. Made changes to return a reference to the
entry when calling this function which is returned when caller is
done using the memory.

Change-Id: I610553fd4b119d3c47cbfcec970d50046dbb2863
Signed-off-by: Shubhraprakash Das <sadas@codeaurora.org>
Signed-off-by: Lynus Vaz <lvaz@codeaurora.org>
msm: kgsl: Keep track of kernel space mappings to memory

Add a counter to count number of times a memory descriptor is
mapped in the kernel and unmap the kernel mapping only when the
count reaches 0. There can be multiple threads using the kernel
mapping at the same time hence a counter is used to make sure
that we do not unmap the mapping before the last thread has
finished using it.

Change-Id: I9c53deb6af12fb1f6ed30e46b386e1cd60dafdda
Signed-off-by: Shubhraprakash Das <sadas@codeaurora.org>
Signed-off-by: Lynus Vaz <lvaz@codeaurora.org>
Merge "diag: dci: Mutex protect the list while traversal and node deletion"
Merge "media: dvb: verify filter state when reusing decoder buffer"
Merge "msm_serial_hs: Race Condition during Baud Rate Configuration"
Merge "msm_serial_hs: Avoid potential unclocked access by clients"
Merge "msm: kgsl: Fix memory entry leak when calling adreno_convertaddr"
Merge "msm: kgsl: Keep track of kernel space mappings to memory"
Merge "ARM: dts: msm: Update bus bandwidth votes for sdhci on 8974"
Merge "Merge "ARM: dts: msm: Update bus bandwidth votes for sdhci on 8974""