cpufreq: interactive: Fix null pointer dereference in interactive governor

For the sync_freq feature currently we check pcpu->policy->cur frequency
for each online cpu.  But for a CPU that isn't using interactive governor
or for an offline CPU, pcpu->policy can be null or an invalid value.
This patch tries to avoid that scenario by using pcpu->target_freq
instead of policy->cur to get the frequency of an online CPU.

Kernel crash without this patch:
[   20.132373] Unable to handle kernel NULL pointer dereference at virtual address 00000028
[   20.132375] pgd = c34f34c0
[   20.132377] pgd = ef6f2440
[   20.132383] [00000028] *pgd=00000000
[   20.132385]
[   20.132388] [00000028] *pgd=2e98f003, *pmd=00000000
[   20.132390] Internal error: Oops: 205 [#1] PREEMPT SMP ARM
[   20.132394] Modules linked in:
[   20.132398] CPU: 0 PID: 1560 Comm: chown Tainted: G        W    3.10.0-perf-gb12057b-00001-ga2c6c16-dirty #7
[   20.132401] task: ef9af300 ti: ee49c000 task.ti: ee49c000
[   20.132411] PC is at cpufreq_interactive_timer+0x10c/0x650
[   20.132415] LR is at cpufreq_interactive_timer+0x128/0x650
<snip>
[   20.133002] [<c07eb204>] (cpufreq_interactive_timer+0x10c/0x650) from [<c02804d8>] (call_timer_fn+0x80/0x198)
[   20.133012] [<c02804d8>] (call_timer_fn+0x80/0x198) from [<c0280acc>] (run_timer_softirq+0x1f8/0x270)
[   20.133019] [<c0280acc>] (run_timer_softirq+0x1f8/0x270) from [<c0279e20>] (__do_softirq+0x12c/0x2d4)
[   20.133025] [<c0279e20>] (__do_softirq+0x12c/0x2d4) from [<c027a2d4>] (irq_exit+0x74/0xc8)
[   20.133034] [<c027a2d4>] (irq_exit+0x74/0xc8) from [<c0206a00>] (handle_IRQ+0x68/0x8c)
[   20.133041] [<c0206a00>] (handle_IRQ+0x68/0x8c) from [<c02004b8>] (gic_handle_irq+0x3c/0x60)
[   20.133051] [<c02004b8>] (gic_handle_irq+0x3c/0x60) from [<c0ac6900>] (__irq_svc+0x40/0x70)
<snip>

Change-Id: Ie834f5d383de4d41e0fe6fbd40c8b0a0c05d82f5
Signed-off-by: Vijay Ganti <viganti@codeaurora.org>
arm: if there's no handler we need to restore sigmask, syscall or no syscall

Change-Id: Id43457ef30eaf9e90048644fae1d89030cb6fec9
CRs-fixed: 592079
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
Git-commit: 7dfae72027cd8345247e675a3b27439df95fe06e
Git-repo: git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux-stable.git
Signed-off-by: Joonwoo Park <joonwoop@codeaurora.org>
arm: new way of handling ERESTART_RESTARTBLOCK

new "syscall start" flag; handled in syscall_trace() by switching
syscall number to that of syscall_restart(2).  Restarts of that
kind (ERESTART_RESTARTBLOCK) are handled by setting that bit;
syscall number is not modified until the actual call.

Change-Id: I0dac789dbb0cf26f5bf6a562f440305189676bd2
CRs-fixed: 592079
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
Git-commit: 6b5c8045ecc7e726cdaa2a9d9c8e5008050e1252
Git-repo: git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux-stable.git
Signed-off-by: Joonwoo Park <joonwoop@codeaurora.org>
msm: msm_bus: Modify IB aggregation at master

The IB aggregation at master assumed that the sel_clk pointers were set
before trying to access them, but there could be clients that register
but don't do any transaction at all which could lead to data aborts during
the IB aggregation. Change this to directly access the allocated pnode
entry instead of relying on sel_clk pointer.

Change-Id: Iefffdd5ff835496fa54d3de97e416a62735154a2
Signed-off-by: Girish Mahadevan <girishm@codeaurora.org>
ARM: dts: Reintroduce dual config for CPU on msm8974

Reintroduce the dual configuration mode for CPU masters on msm8974.
This will enable throttling of CPU in certain low bandwidth usecases
to alleviate timeline issues for other real time masters in the SOC.

Change-Id: Ic32f217ce40ee6ead4edd191811f9ce9f4e7e7ce
Signed-off-by: Girish Mahadevan <girishm@codeaurora.org>
msm: mdss: Return suspend without delay in NOTIFY UPDATE

NOTIFY_UPDATE returns Suspend after 4 seconds delay.
Delay would cause HISTOGRAM_STOP ioctl to be called late.

Return suspend case without setting timer for no delay.

Change-Id: I356086de96cab85cd203bf1ad529ecf0b3bbfce3
Signed-off-by: Krishna Chaitanya Parimi <cparimi@codeaurora.org>
msm: mdss: Reset pipe's mfd parameter during pipe free

There is a corner case with dma pipe. If its set call
fails as line mode (for mdp) and is configured
subsequently as block mode (for rotation), mfd parameter
of the dma pipe structure does not get reset during set
failure cleanup. This causes unnecessary force dma
cleanup call in rotatorp lay which gets hang and
results in rotator fence timeout.

Change-Id: Ia090e9eebf43ab6e28a2746f8fe57e2c3da34e59
Signed-off-by: Mayank Chopra <makchopra@codeaurora.org>
msm: lpm_levels: fix driver compilation issue

Assigning an unsinged long value to unsinged int is not
correct and it cause driver compilation failure. Fix by
assigning a proper value.

Change-Id: Ia8d214425c3ba07006e748bc74365da6bc22f224
Signed-off-by: Murali Nalajala <mnalajal@codeaurora.org>
ion: remove unused function

Somehow, during [83c50939e88d0 gpu: ion: optimize zero'ing of pages] we
retained some cruft. Remove it.

Change-Id: I38f2ef5d6cd1baa3fe8a758a0bf8164695e2b657
Signed-off-by: Mitchel Humpherys <mitchelh@codeaurora.org>
gpu: ion: fix use-after-free in ion_heap_freelist_drain

The `buffer' variable is being used after being freed. Fix this.

Change-Id: Iea3471fa7dc7535bbf0620c1639fea2008d7cf19
Signed-off-by: Mitchel Humpherys <mitchelh@codeaurora.org>
msm: lpm: remove redundant assignment

Removed the redundant cpu level is assignment.

Change-Id: I1aecc4f3d1eb55cd9e057c82f63b8f145401c0fc
Signed-off-by: Venkat Devarasetty <vdevaras@codeaurora.org>
msm: mdss: Check extra mmb allocated to a pipe

If set call to a pipe changes smp configuration such that
calculated no. of  mmb blocks are less than allocated mmb
blocks, fail this set call. This ensures pipe disconnection
and smp configuration is possible in next commit cycle.
Also, check that no extra mmb is left allocated to any plane
when pipe's format changes. If so, fail the set call to let
correct smp configuration happen in next commit cycle.

Change-Id: Iec2b8cb18088587655cf0c68dc81e3ac7b819cbc
Signed-off-by: Mayank Chopra <makchopra@codeaurora.org>
audio: ocmem: fix the ocmem driver crash during video playback

Triggering SSR during wait for client callback by the audio
ocmem driver causes de-reference of freed memory in ocmem_free
function. Fixed by assigning NULL to the ocmem buffer pointer after every
ocmem_free function call.

CRs-Fixed: 589762
Signed-off-by: Anish Kumar <kanish@codeaurora.org>
Change-Id: I53208de26a4d22f6b60d118e47d16a3ad29a8040
ASoC: compress: Update lock for dpcm calls

Compress driver calls into the dpcm framework when
usecase is started/stopped.When calling dpcm framework
api's it should acquire dpcm mutex.
This change replaces the card mutex with dpcm mutex when
dpcm apis are called.

CRs-fixed: 596103
Change-Id: I66abb823e07a0d7eb5d9687927526d785959410f
Signed-off-by: Gopikrishnaiah Anandan <agopik@codeaurora.org>
ASoC: msm: hold lock while allocating and freeing ASM clients

ASM client allocation and free have to happen atomically to avoid
ASM APR being in wrong state. So hold lock while allocating and freeing
ASM clients.

CRs-Fixed: 554249

Change-Id: Ie6d2e87445cc06de990c9e8bed6dbf88ac79cd3a
Signed-off-by: Kiran Kandi <kkandi@codeaurora.org>
ARM: dts: msm: Increase OCMEM BW request for video decode

There are framedrops observed on high bitrate clips because
OCMEM BW is not sufficient for these clips. Increase OCMEM BW
to avoid framedrops.

Change-Id: I7f3238036259e43a12899f2f7c73318328ae8eca
CRs-fixed: 571634
Signed-off-by: Vinay Kalia <vkalia@codeaurora.org>