Merge "gpu: ion: fix use-after-free in ion_heap_freelist_drain"
[media] v4l2-ioctl.c: handle PREPARE_BUF like QUERYBUF

The core code for PREPARE_BUF didn't take the multiplanar case into account,
which might cause page faults. Handle PREPARE_BUF just like QUERYBUF and
QBUF/DQBUF.

Signed-off-by: Hans Verkuil <hans.verkuil@cisco.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>
Git-commit: 96b1a70226cd43f69c63a7ba2a769bece08cf64e
Git-repo:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable.git

Change-Id: Ica94027b4189627b3e8e76e40e9fc1a6f71932cb
Signed-off-by: Vinay Kalia <vkalia@codeaurora.org>
msm: vidc: Check if buffers are mapped before validating buffer_info

When buffers are not mapped by the driver (i.e. buffer being used by
kernel client), inst->registered_buffers is usually empty.  As a result,
in *_dqbuf(), binfo is always NULL.  This commit bypasses the NULL check
if buffers aren't being mapped by the driver.

CRs-Fixed: 610866
Change-Id: I111150564549a74f077ba8a7115129f497d734fc
Signed-off-by: Deva Ramasubramanian <dramasub@codeaurora.org>
nl80211: vendor command support

Add support for vendor-specific commands to nl80211. This is
intended to be used for really vendor-specific functionality
that can't be implemented in a generic fashion for any reason.
It's *NOT* intended to be used for any normal/generic feature
or any optimisations that could be implemented across drivers.
Currently, only vendor commands (with replies) are supported,
no dump operations or vendor-specific notifications.
Also add a function wdev_to_ieee80211_vif() to mac80211 which
is needed for mac80211-based drivers wanting to implement any
vendor commands.

Change-Id: Ic4729180ea31b39e7313633f216a06b96a29ee39
CRs-fixed: 576020
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Git-commit: ad7e718c9b4f717823fd920a0103f7b0fb06183f
Git-repo: https://git.kernel.org/cgit/linux/kernel/git/linville/wireless-next.git
Signed-off-by: Leo Chang <leochang@codeaurora.org>
nl80211: support vendor-specific events

In addition to vendor-specific commands, also support vendor-specific
events. These must be registered with cfg80211 before they can be used.
They're also advertised in nl80211 in the wiphy information so that
userspace knows can be expected. The events themselves are sent on a
new multicast group called "vendor".

Change-Id: I184aaa9f9e8461aee572f7d0a35916cd668c2218
CRs-fixed: 576020
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Git-commit: 567ffc3509b2d3f965a49a18631d3da7f9a96d4f
Git-repo: https://git.kernel.org/cgit/linux/kernel/git/linville/wireless-next.git
Signed-off-by: Leo Chang <leochang@codeaurora.org>
msm: peripheral-loader: Change IOMAP_SIZE from SZ_4M to SZ_1M

The ioremap call made for zeroing out trailing memory is currently
requesting for a 4M memory region. This is resulting in vmalloc
allocation failures on some platforms.
Instead, request for 1M memory locations and zero out the area
in smaller chunks to make this failure less probable.

CRs-Fixed: 613426

Change-Id: I554dc42cbb37ec893306bd1cc625230216b9b6c9
Signed-off-by: Deepak Katragadda <dkatraga@codeaurora.org>
msm: mdss: Fix assertive display HW range checks

Fix off by one error leading to log spam. 'nad_cfgs' is the upper bound of
the zero-indexed mixer/AD/dspp pipe enumeration.

Change-Id: I963d175aad23a8eb621772d6c9bd06676fa2e27e
Signed-off-by: Carl Vanderlip <carlv@codeaurora.org>
Signed-off-by: Ping Li <quicpingli@codeaurora.org>
msm: vidc: eliminate race condition in dynamic buffer mode

Function get_same_fd_buffer returned a pointer to
registered buffer, which shared the same fd as the
current buffer being mapped. While this buffer was
being accessed in map_and_register_buf(), it was
not guarded by the inst lock. So if the buffer was
erroneously freed, while it's still being accessed
in map_and_register_buf(), we may see a kernel
panic due to garbage values. To avoid this race
condition, introduce more checks in get_same_fd_buffer()
and return only the required handle information back to
map_and_register_buf.

Change-Id: I798c33dc344977c5db3bd74e5f863ca5cda14cb9
Signed-off-by: Arun Menon <avmenon@codeaurora.org>
msm: mdss: add retire fence support

Retire fence timeline should follow the actual panel vsync more closely.
For video mode the retire fence can be signaled along with the release
timeline with +1 offset, since this is signaled at vsync.
In case of command mode the panel vsync can be different from buffer
release timeline. To handle the command mode panel vsyncs better, create
a new timeline for the retire fence signaling.

Change-Id: If8a1eb717d733ca215275a8be4f0054091dbc147
Signed-off-by: Adrian Salido-Moreno <adrianm@codeaurora.org>
power: qpnp-charger: wake up upon fast charge after resuming

When state of charge based charge resume happens there is
a delay between enabling charging again in hardware and
the fast charge state being reached. During this time
the system may have gone to suspend and the necessary
information is not conveyed to userspace.

Fix this by enabling the fast charge interrupt as a
wakeup interrupt when the SOC based resume event occurs.
Disable it when within the fast charge interrupt handler.

Change-Id: I286b1c12dbf057de974afb4084d92c157f08eee4
CRs-Fixed: 606012
Signed-off-by: David Keitel <dkeitel@codeaurora.org>
Merge "msm: vidc: Check if buffers are mapped before validating buffer_info"
Merge "[media] v4l2-ioctl.c: handle PREPARE_BUF like QUERYBUF"
ASoC: msm8x10-wcd: Remove delayed work for mbhc start

Do not use delayed work for mbhc start, because this could
cause failure in finding mbhc calibration data due to
synchronization issues between mbhc start worker thread
and other audio use cases if they are running at the same
time.
Remove redundant logging in the codec read/write functions.

Change-Id: I79d71fa80d8d1c705f1f95f9eb2f00caa395bb50
Signed-off-by: Phani Kumar Uppalapati <phaniu@codeaurora.org>
msm: kgsl: Remove sscanf() from kgsl_pwrctrl.c

Replace sscanf() in kgsl_pwrctrl.c with a generic function to safely
convert 32 bit unsigned ints.

CRs-fixed: 563585
Change-Id: Ic0dedbad10e2264ec8fccab622d094d123b49b77
Signed-off-by: Jordan Crouse <jcrouse@codeaurora.org>
msm: kgsl: don't use sscanf()

Friends do not let friends use sscanf().

CRs-Fixed: 563605
Change-Id: Ic0dedbad56af5bbee4fc833701d8bc93b118efa9
Signed-off-by: Jordan Crouse <jcrouse@codeaurora.org>
Merge "arm: mach-msm: fix integer overflow in DFE_IOCTL_COMMAND"
Merge "msm: mdss: Fix assertive display HW range checks"
arm: mach-msm: fix integer overflow in DFE ioctls for reg arr rw

Added error checks for upper limit of param.num in DFE ioctls
for register array r/w

Change-Id: I62d2eac38024c6c64f8d2d0f6d65f409569b2a76
Acked-by: John Nicholas <jnichola@qti.qualcomm.com>
Signed-off-by: Venkatesh Yadav Abbarapu <quicvenkat@codeaurora.org>
msm: krait-regulator: handle efuse differences

Scaling factor version is valid for
- 8974 based devices when the version bits read 1
- 8974pro based devices when the version bits read 1 or 2
- 8084 based devices when the version bits read 0
- 8092 based devices when the version bits read 0

Moreover the three bit scaling factor data for
- 8974 based devices starts at bit 16
- 8974pro based devices starts at bit 16
- 8084 based devices starts at bit 14
- 8092 based devices starts at bit 14

Update the code to handle these differences.

CRs-Fixed: 614657
Change-Id: I30c65026341ece9a03f88514127b563417df46ee
Signed-off-by: Abhijeet Dharmapurikar <adharmap@codeaurora.org>
Merge "msm: kgsl: Remove unnecessary profile close check"