msm_serial_hs: Fix race condition with BAM rx pipe

Crash observed due to the race condition with bam
rx pipe during sps_disconnect and sps_transfer_one
operations executed at the same time on two CPUs.

Because of this race condition rx bam descriptor
pointer becomes NULL and accessing of this pointer
leads to crash.

This patch waits for sps_transfer_one function to
complete, if it is in progress, before calling
sps_disconnect function from the set_termios.

CRs-Fixed: 534029
Change-Id: I7581062a17a3dc7ede8eb58e4d25e3b517812ab2
Signed-off-by: Kiran Gunda <kgunda@codeaurora.org>
(cherry picked from commit 4d15f1a82f1b91dd0bcc92c4ef78037a5826369c)
msm: camera: Fix possible NULL pointer dereference.

The result of memory allocation in msm_isp_get_buf is not checked for
success before use. This can lead to NULL pointer dereference.

Change-Id: I83cb56bbcd5e7526bf57a6de1077a30f9a2b5349
Signed-off-by: Petar Sivenov <psiven@codeaurora.org>
(cherry picked from commit 9e8878ce756668f6d393a3a780e516be71f93514)
ehci-msm2: Add boundary check in echi driver

This change adds boundary check before copying data from userspace
buffer to ehci local buffer.
The third parameter passed to copy_from_user() should be minimum of the two
values between userpsace buffer size count and (local_buffer size - 1). The
last one byte in local_buffer should be reserved for null terminator.

CRs-Fixed: 547910
Change-Id: I1cbf34068166ba26bdab58914f75b777ffff4bdf
Signed-off-by: Saket Saurabh <ssaurabh@codeaurora.org>
(cherry picked from commit 6e23290c7be953fdb0378e4763660e6e0be76f7e)
hsic_sysmon_test: Add check for userspace buffer size count

hsic_sysmon_test local buffer size limit is 4096 bytes. If user space
tries to write data with size greater than 4096 bytes, memory corruption
would happen. Hence, add check for userspace buffer size count before
writing data from userspace buffer to hsic_sysmon_test local buffer.

CRs-Fixed: 547489
Change-Id: I25de15b2abea44ff4cecac827d86b2da8a57c40e
Signed-off-by: Saket Saurabh <ssaurabh@codeaurora.org>
(cherry picked from commit b57469cdac944f86db3146086ea07764ac0930a0)
mdss: Fix null point dereference in mdss_mdp_pp_init

Fixed null point dereference in case of memory allocation
failure in mdss_mdp_pp_init.

Change-Id: I3593a583da355915b731ac30b1f38aaa010eba85
Signed-off-by: Krishna Chaitanya Parimi<cparimi@codeaurora.org>
(cherry picked from commit 4a8fd0e32a814afd9078c483e3e8fed92888b17a)
msm: camera2: cpp: Release vb2 buffer in cpp driver on error

When duplicate output is enabled, there is potential issue if
error is encountered in second output buffer. Under error condition
related to second output buffer is hit, the first output buffer is
not released properly.

Change-Id: I56f375a5783c54c450f5673818d15b393f469ef1
Signed-off-by: Rajakumar Govindaram <rajakuma@codeaurora.org>
(cherry picked from commit d51062694fa8b0a8a6809b686bf6174d1a59ba3b)
msm: camera: Cleanup msm generic buf queue handling

Clean-up the msm camera generic buff queue when all
client closes the handle and also provide init-deinit
ioctl for cpp to open-close the buff mngr handle.

Change-Id: Ie484174e0ffaee02e85c9c9cda8ac26103aaddd0
CRs-Fixed: 582261
Signed-off-by: Hariram Purushothaman <hpurus@codeaurora.org>
(cherry picked from commit 5e14286c08a06d6b645dbd3d6fe6cc96a938c7aa)
msm: cpr-regulator: change device tree vendor prefix to 'qti'

New policy requires changing device tree vendor prefix from 'qcom'
to 'qti'. Also change device tree files for msm8610, msm8226 and msm8926.

Change-Id: I57c8c9d14ffa3ddd3671f406cfa2011eb23e66e4
Signed-off-by: Ke Liu <keliu@codeaurora.org>
(cherry picked from commit 098f1ae38782290aabc11307f684bf055dee47e0)
msm: cpr-regulator: change cpr_read_efuse_row api

Add a flag in cpr_read_efuse_row api to make it choose
to read register directly or read through SCM.

Change-Id: I3031dfd1c7cfffb880c49e5f1708b1436fdd2897
Signed-off-by: Ke Liu <keliu@codeaurora.org>
(cherry picked from commit 074001ecaa931aa502d64f69703b22cd4666865e)
msm: cpr-regulator: add support for conditional minimum voltage

Certain targets have VDD_APC minimum voltage constraints which are
imposed if the mem-accel fuse has not been programmed. Add two new
device tree properties to capture the row offset and expected value
of the mem-accel fuse as well as to capture the minimum VDD_APC voltage
to enforce if the mem-accel fuse has not been programmed with the
expected value.

CRs-Fixed: 580585
Change-Id: Ifd770b33d74b2bc9cf37dd2b1817e1424a5ee8f3
Signed-off-by: Ke Liu <keliu@codeaurora.org>
(cherry picked from commit a819253a496870a8dfbafb020f16bb8183ee985c)
ARM: dts: msm: specify conditional VDD_APC minimum voltage for msm8226

Restrict the minimum APC voltage to 1.14V when the mem-accel fuse has not
be programmed as expected.

CRs-Fixed: 580585
Change-Id: Ia506efb15c7599d79c5561163879d82910db84f8
Signed-off-by: Ke Liu <keliu@codeaurora.org>
(cherry picked from commit 783230be2a98a932437873bf3bffd5809c4af502)
ARM: dts: msm: reduce CPR turbo floor voltage for msm8226

The device tree property qti,cpr-cond-min-voltage = <1140000> along with
an appropriate qti,cpr-cond-min-volt-fuse property value ensure that the
CPR turbo floor voltage is restricted to 1.14 V on devices that cannot
operate at lower voltages.

Therefore, reduce the default CPR turbo floor voltage to 1.1 V in order
to save power on devices that can operate at the lower voltage.

Change-Id: Ic939d4a7b1c4da0a28dd779fe6a900310ae9fab7
Signed-off-by: Ke Liu <keliu@codeaurora.org>
(cherry picked from commit cb3b958479130b1229c934e1405244f7d5d491cf)
msm: cpr-regulator: modify the dts definition for cond-min-volt

Previously, cpr-cond-min-volt-fuse defined the fuse row number and the
value used to compare with the whole row efuse value. The cpr-regulator
driver would then conditionally apply a higher CPR floor voltage for all
voltage corners if the efuse value differed from the expected value.

However, only a subset of the bits in the efuse are used for the
cond-min-volt feature. If any of the other bits in the fuse are set, then
the cpr-regulator driver incorrectly applies the higher floor voltage even
if the cond-min-volt bits are set correctly.

Modify the cpr-regulator driver and the cpr-regulator device tree
properties so that only specific bits in the fuse are compared to the
expected value. If the value of the cond-min-volt bits in the fuse is
not equal to the value defined in device tree, then set the MIN_VOLTAGE
flag.

Change-Id: I7de04e17dfa93fcb638e29a1dcc5e9072de26cb8
Signed-off-by: Wu Fenglin <fenglinw@codeaurora.org>
Signed-off-by: Ke Liu <keliu@codeaurora.org>
(cherry picked from commit 0ec7fc93482a7b8505f6c42e3093fa2ff96a0a71)
msm: cpr-regulator: add pvs voltage uplift workaround

There are some parts which require higher than expected voltage. Add a
workaround to check the condition in fuse and uplift the voltage and
quotient accordingly.

Change-Id: I59f821320e5e97fc2334ae7617a0045edb5cc970
Signed-off-by: Wu Fenglin <fenglinw@codeaurora.org>
Signed-off-by: Ke Liu <keliu@codeaurora.org>
(cherry picked from commit 8a82877d54a240c3d0847b9ef5f17575738af303)
ARM: dts: msm: enable pvs voltage uplift workaround for msm8226

Some 8x26 parts have lower pvs voltage than expected. Enable uplift
workaround of 50 mV on those parts under the specified conditions.

Change-Id: I3d8689ca0c5d576b1dd9057e36f67ea3622b80a1
Signed-off-by: Wu Fenglin <fenglinw@codeaurora.org>
(cherry picked from commit 29038e82483ea7693bea90abdc044e8645293745)
msm: bam_dmux: modify DL low memory algorithm

Bam_dmux maintains a pool of dynamically allocated buffers for the BAM DMA
engine to use as destination memory for Downlink (DL) data.  The allocation
requests for the buffers are done using flags to indicate delays are
tolerable and either the memory or an error should be returned immediately
to bam_dmux as the buffers are normally allocated within various hot paths
inside of the driver.  If a low memory allocation failure is encountered
when attempting to replenish the pool of buffers, bam_dmux will either
attempt the memory allocations later when the next scheduled pool refilling
occurs if there is at least one buffer remaining in the pool, or will
schedule a delayed task to retry the buffer allocation until atleast one
buffer can be put into the pool.

This mechanism of handling low memory situations has two flaws.  First, the
allocation type used by bam_dmux does not trigger the standard low memory
recovery mechanism within the memory management subsystem.  Second, the
peripeheral on the otherside do the DMA engine has a limited hardware based
flow control mechanism that will not release flow control with only one
buffer queued to the DMA engine.

To assist in system recovery, and avoid a data stall, create a cold path
that is tolerant of memory allocation delays and is triggered when the hot
path encounters an allocation failure.

CRs-Fixed: 589665
Change-Id: If72b0eaef285ac6dfd99e97bef1cd7df154e3a48
Signed-off-by: Jeffrey Hugo <jhugo@codeaurora.org>
(cherry picked from commit c481cc46953b7d28c6b9befb973c01125309ee66)
crypto: msm: Remove invalid check in qcedev driver

Unsigned int variable is compared for < 0, which is an invalid if
condition. This patch removes the check.

Change-Id: I76c10223672db2c387e025697dd8bd921e5ddc1b
Signed-off-by: AnilKumar Chimata <anilc@codeaurora.org>
(cherry picked from commit f7beddb9b8f15dbd4685125d696f354559d58a88)
crypto: msm: Fix issues related to non-zero byteoffset input

Fix buffer overflow for a non-zero byteoffset value.

Also fixes memory leak issue by adding data_len check in check_params.
One of the scenarios data_len can be less than byteoffset which results
in memory leak with huge data length, which might cause the kernel panic.

Change-Id: I3f773673219f45dad4f17499b1ee0feda2aff1f7
Signed-off-by: AnilKumar Chimata <anilc@codeaurora.org>
(cherry picked from commit 99e535307c7cccd77dda37397c51c3add7e3262c)
msm: platform: qpnp-clkdiv: fix potential null pointer dereference

Add a return statement in the spmi resource null check in
qpnp_clkdiv_probe().  This is needed in order to avoid
dereferencing a null pointer in a subsequent statement.

Change-Id: Iaf5d5797016c96a136e93c8e5837f7f8f31d1e47
CRs-Fixed: 563655
Signed-off-by: David Collins <collinsd@codeaurora.org>
(cherry picked from commit a9cc12fd00c1e38ed8a861caf542bf790fc966e7)
crypto: msm: Fix null pointer exception in qcrypto_count_sg()

Fixes null pointer exception in count scatter gather function. Scatter
gather list pointer become NULL if the sg pointer reaches last but one
node, which results in NULL pointer exception.

Change-Id: I634baf30074e6e53ffa22635565da54e9ae43150
Signed-off-by: AnilKumar Chimata <anilc@codeaurora.org>
(cherry picked from commit 1bfc38ee002bbbbce5a0fdbf228a6b79f52c7685)