msm: vidc: add sleep of 100us before clock disable

ARM9 execute following sequence when venus is idle
1. Disable ARM9 watchdog
2. Set bit 30 of A_VENUS_CPU_CS_SCIACMDARG0 register
   to indicate venus is idle
3. Write HFI_MSG_SYS_IDLE to message queue
4. Raise interrupt to host
5. ARM9 execute wait for interrupt instruction to go
   into low power state. This will internally drain the
   ARM9 write buffer which can generate bus transaction.
6. ARM9 in idle

Host clock gate venus based on following sequence
1. Host receive HFI_MSG_SYS_IDLE from the msg queue
2. Host check both cmd / msg queue are empty by
   comparing the queue read/write pointers.
3. Host check bit 30 of A_VENUS_CPU_CS_SCIACMDARG0
   register to confirm it indicate idle
4. Host clock gate whole venus

As the host clock gate venus in step 4, ARM9 is still
in step 5&6. The sleep will ensure that step 5 and 6
are completed before host clock gates venus.

CRs-Fixed: 589417
CRs-Fixed: 595251
Change-Id: Idf1f788718adea2dacceca97afa4ba4fe4562ddd
Signed-off-by: Vikash Garodia <vgarodia@codeaurora.org>
Bluetooth: Replace sprintf with snprintf

Change will replace sprintf with snprintf, since sprintf is a
banned function.

CRs-FIxed: 548220
Change-Id: I32f5ab1f3707e5bbe43c31a7ad4611b67557b267
Signed-off-by: Juffin Alex Varghese <jalex@codeaurora.org>
msm: net: add the fix for the skb data alloc fail case

In some cases, the skb->data alloc fail, then it will get a wrong
point value from the kmalloc_caches array. The value is little then
0x10,but in the slab reference, these value are all zero value. So
change the zero judgement.

CRs-Fixed: 573650
Change-Id: Iba138838821f515b131029cf240a5a99959bb2ff
Signed-off-by: Pan Fang <fangpan@codeaurora.org>
idr: fix a subtle bug in idr_get_next()

The iteration logic of idr_get_next() is borrowed mostly verbatim from
idr_for_each().  It walks down the tree looking for the slot matching
the current ID.  If the matching slot is not found, the ID is
incremented by the distance of single slot at the given level and
repeats.

The implementation assumes that during the whole iteration id is aligned
to the layer boundaries of the level closest to the leaf, which is true
for all iterations starting from zero or an existing element and thus is
fine for idr_for_each().

However, idr_get_next() may be given any point and if the starting id
hits in the middle of a non-existent layer, increment to the next layer
will end up skipping the same offset into it.  For example, an IDR with
IDs filled between [64, 127] would look like the following.

          [  0  64 ... ]
       /----/   |
       |        |
      NULL    [ 64 ... 127 ]

If idr_get_next() is called with 63 as the starting point, it will try
to follow down the pointer from 0.  As it is NULL, it will then try to
proceed to the next slot in the same level by adding the slot distance
at that level which is 64 - making the next try 127.  It goes around the
loop and finds and returns 127 skipping [64, 126].

Note that this bug also triggers in idr_for_each_entry() loop which
deletes during iteration as deletions can make layers go away leaving
the iteration with unaligned ID into missing layers.

Fix it by ensuring proceeding to the next slot doesn't carry over the
unaligned offset - ie.  use round_up(id + 1, slot_distance) instead of
id += slot_distance.

Signed-off-by: Tejun Heo <tj@kernel.org>
Reported-by: David Teigland <teigland@redhat.com>
Cc: KAMEZAWA Hiroyuki <kamezawa.hiroyu@jp.fujitsu.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

Change-Id: Ifb6d64747e7f08e2f5d7609bd66a48405f0c9b95
Signed-off-by: Prakash Kamliya <pkamliya@codeaurora.org>
sched/debug: Make sysrq prints of sched debug data optional

Calls to sysrq_sched_debug_show() can yield rather verbose output
which contributes to log spew and, under heavy load, may increase
the chances of a watchdog bark.

Make printing of this data optional with the introduction of a
new Kconfig, CONFIG_SYSRQ_SCHED_DEBUG.

Change-Id: I5f54d901d0dea403109f7ac33b8881d967a899ed
Signed-off-by: Matt Wagantall <mattw@codeaurora.org>
lib: spinlock_debug: increase spin dump timeout to one second

Increase spin dump timeout so that it is back in sync with the
upstream value.

Change-Id: I4b8896b69dadd66196090d86e40da89766b048e6
Signed-off-by: Syed Rameez Mustafa <rameezmustafa@codeaurora.org>
ext4: fix the free blocks calculation for ext3 file systems w/ uninit_bg

Ext3 filesystems that are converted to use as many ext4 file system
features as possible will enable uninit_bg to speed up e2fsck times.
These file systems will have a native ext3 layout of inode tables and
block allocation bitmaps (as opposed to ext4's flex_bg layout).
Unfortunately, in these cases, when first allocating a block in an
uninitialized block group, ext4 would incorrectly calculate the number
of free blocks in that block group, and then errorneously report that
the file system was corrupt:

EXT4-fs error (device vdd): ext4_mb_generate_buddy:741: group 30, 32254 clusters in bitmap, 32258 in gd

This problem can be reproduced via:

    mke2fs -q -t ext4 -O ^flex_bg /dev/vdd 5g
    mount -t ext4 /dev/vdd /mnt
    fallocate -l 4600m /mnt/test

The problem was caused by a bone headed mistake in the check to see if a
particular metadata block was part of the block group.

Many thanks to Kees Cook for finding and bisecting the buggy commit
which introduced this bug (commit fd034a84e1, present since v3.2).

Change-Id: I122951d5528178c8af75e3f7425b5eae9ccdb036
Reported-by: Sander Eikelenboom <linux@eikelenboom.it>
Reported-by: Kees Cook <keescook@chromium.org>
Signed-off-by: "Theodore Ts'o" <tytso@mit.edu>
Tested-by: Kees Cook <keescook@chromium.org>
Cc: stable@kernel.org
CRs-Fixed: 576063
Git-commit: b0dd6b70f0fda17ae9762fbb72d98e40a4f66556
Git-repo: git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
Signed-off-by: Matt Wagantall <mattw@codeaurora.org>
ext4: make sure the journal sb is written in ext4_clear_journal_err()

After we transfer set the EXT4_ERROR_FS bit in the file system
superblock, it's not enough to call jbd2_journal_clear_err() to clear
the error indication from journal superblock --- we need to call
jbd2_journal_update_sb_errno() as well.  Otherwise, when the root file
system is mounted read-only, the journal is replayed, and the error
indicator is transferred to the superblock --- but the s_errno field
in the jbd2 superblock is left set (since although we cleared it in
memory, we never flushed it out to disk).

This can end up confusing e2fsck.  We should make e2fsck more robust
in this case, but the kernel shouldn't be leaving things in this
confused state, either.

Change-Id: I7a7cd58880209fbd54f4ded5f2b62de492cae9e0
Signed-off-by: "Theodore Ts'o" <tytso@mit.edu>
Cc: stable@kernel.org
Git-commit: d796c52ef0b71a988364f6109aeb63d79c5b116b
Git-repo: git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
Signed-off-by: Osvaldo Banuelos <osvaldob@codeaurora.org>
ext4: fix memory leak in xattr

If we take the 2nd retry path in ext4_expand_extra_isize_ea, we
potentionally return from the function without having freed these
allocations.  If we don't do the return, we over-write the previous
allocation pointers, so we leak either way.

Spotted with Coverity.

[ Fixed by tytso to set is and bs to NULL after freeing these
  pointers, in case in the retry loop we later end up triggering an
  error causing a jump to cleanup, at which point we could have a double
  free bug. -- Ted ]

Change-Id: I49b8ca41a6c6d44b563eb23306870258a3affd3b
Signed-off-by: Dave Jones <davej@fedoraproject.org>
Signed-off-by: "Theodore Ts'o" <tytso@mit.edu>
Reviewed-by: Eric Sandeen <sandeen@redhat.com>
Cc: stable@vger.kernel.org
Git-commit: 6e4ea8e33b2057b85d75175dd89b93f5e26de3bc
Git-repo: git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
Signed-off-by: Osvaldo Banuelos <osvaldob@codeaurora.org>
jbd2: Fix use after free after error in jbd2_journal_dirty_metadata()

When jbd2_journal_dirty_metadata() returns error,
__ext4_handle_dirty_metadata() stops the handle. However callers of this
function do not count with that fact and still happily used now freed
handle. This use after free can result in various issues but very likely
we oops soon.

The motivation of adding __ext4_journal_stop() into
__ext4_handle_dirty_metadata() in commit 9ea7a0df seems to be only to
improve error reporting. So replace __ext4_journal_stop() with
ext4_journal_abort_handle() which was there before that commit and add
WARN_ON_ONCE() to dump stack to provide useful information.

Change-Id: Ibfd59e399f4a11abc378a237e10b3741bef2a15e
Reported-by: Sage Weil <sage@inktank.com>
Signed-off-by: Jan Kara <jack@suse.cz>
Signed-off-by: "Theodore Ts'o" <tytso@mit.edu>
Cc: stable@vger.kernel.org	# 3.2+
Git-commit: 91aa11fae1cf8c2fd67be0609692ea9741cdcc43
Git-repo: git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
Signed-off-by: Osvaldo Banuelos <osvaldob@codeaurora.org>
fat: limit the number of error prints

Use fat_fs_error_ratelimit instead of fat_fs_error so as to
avoid large number of prints.

Change-Id: I2e21e6bd0c8e7e79d3ced9c213668c405fd6260d
Signed-off-by: Asutosh Das <asutoshd@codeaurora.org>
Signed-off-by: Manish Kumar <manishku@codeaurora.org>
of: address: Don't fail a lookup just because a node has no reg property

Sometimes it doesn't make any sense for a node to have an address.
In this case device lookup will always be unsuccessful because we
currently assume every node will have a reg property. This patch
changes the semantics so that the resource address and the lookup
address will only be compared if one exists.

Things like AUXDATA() rely on of_dev_lookup to return the lookup
entry of a particular device in order to do things like apply
platform_data to a device. However, this is currently broken for
nodes which do not have a reg property, meaning that platform_data
can not be passed in those cases.

Change-Id: I1222ecf84bc551a3b3cbdc59db255a96ade2e36b
Acked-by: Rob Herring <rob.herring@calxeda.com>
Acked-by: Arnd Bergmann <arnd@arndb.de>
Signed-off-by: Lee Jones <lee.jones@linaro.org>
Git-commit: 84774e615749acfce6b2f679b95924dffb5f5de1
Git-repo: git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
Signed-off-by: Manu Gautam <mgautam@codeaurora.org>
msm: lpm_levels: Support for RPM PC on all cores

When more than one core is online, the current model prevent entering
idle power collapse on all cores and the deepest sleep mode that a
cpu could enter is standalone power collapse. To achieve better power
savings when several cores are online all the time, it is important for
multiple cores to enter a deeper system sleep state by configuring L2
and RPM.

Each core entering the deepest sleep mode increments a counter. The
last core to enter the deepest sleep mode will acquire a lock and will
be responsible for configuring the system low power mode.  cpus. The
last core going down will configure the system wide resources with the
lock held. If a core were to wakeup during this time, it would have to
wait for the lock to be released before it can continue to resume. The
last core releases the lock after configuring the system resources at
which point, the core that resumed from power collapse would reset the
system resources before continuing to run to ensure that the shared
resources are programmed for a safe state.

With this change the idle PC becomes more of a soft state where each
core identifies that its safe to enter a system sleep state. The
decision to enter a system sleep mode is based on the next wakeup event
across all cores. With not all cores encoutering latency associated with
system sleep modes, the residency of idle PC mode will be lower than
what it has been previously acheived. However, the residency of the
system sleep states should be unaffected.

Each core as its power collapsed disables the HFPLL and switches to
GFPLL in the event of a power collapse. During this time, each cores
removes its vote to keep L2 enabled. To ensure that there are enough
votes for keep L2 on, set the number of L2 votes to number of online
cpus in cpufreq.c

Change-Id: If6a8e181bdb9c7bae8066fb804de13caa48bad3b
Signed-off-by: Mahesh Sivasubramanian <msivasub@codeaurora.org>
msm: pm: Set affinity of PM irqs to next scheduled CPU

Modify the affinity of the interrupts associated with PM driver to the cpu
that will wakeup for the next expiring timer.

Change-Id: I6a1b25538a6d12bada3345a17b3ed4ff181ac089
Signed-off-by: Mahesh Sivasubramanian <msivasub@codeaurora.org>
lpm_levels: Do not consider latency during suspend

Currently, cpu mode selection does not consider pm_qos latency
values during suspend, allows cores to be power collapsed. But
the system mode selection considers pm_qos latency which causes
to not choose any deep sleep mode.

Change-Id: Ia9db8692e6eb081b29bb4d75a7c0816fec5695bc
Signed-off-by: Archana Sathyakumar <asathyak@codeaurora.org>
msm: lpm_levels: remove debug print

remove a pr_info that was added for debug purpose. This is
causing excessive logging issues.

CRs-fixed: 589307
Change-Id: I1f7bcb5282b51734cb7bf30ff933d65714445cba
Signed-off-by: Venkat Devarasetty <vdevaras@codeaurora.org>
msm: hotplug: Block hotplug removal of CPU0

Hotplug removal of CPU0 is not currently supported. Attempts to
remove it may result in undefined behaviour. Explicitly block
any such attempts before other hotplug notifiers get the chance
to run by setting the notifier priority to INT_MAX.

Change-Id: I9e1f5b4a0db554295a097220417f2bdf4c690f5f
Signed-off-by: Matt Wagantall <mattw@codeaurora.org>
msm: pm: Disable cpu clk during retention

The CPU clock source MUXes cannot switch while a CPU is in
retention, but callers of acpuclock APIs may not known that
the CPU is in retention.

Fix issue by disabling the cpu clk before entering retention and
re-enable them on exit. This would temporarily switch the CPU to 300Mhz
and clk api would buffer any clock requests until the clk is enabled
when the core comes out of retention.

CRs-fixed: 535967
Change-Id: I103e41fc8ef78cd412b7860bf525ea9cd99ff283
Signed-off-by: Mahesh Sivasubramanian <msivasub@codeaurora.org>
Signed-off-by: Anil kumar mamidala <amami@codeaurora.org>
msm: msm-pm: Remove timeout waiting for cpu to power collapse

The delays in the CPU_DYING notication path could result in the core
initiating the hotplug to send out CPU_DEAD notifications after
msm_pm_wait_cpu_shutdown() times out. This could result in a unknown
resets when regulator/clocks are disabled in the CPU_DEAD path. To
prevent unknown resets, wait infinitely to enter power collapse but
throw a warning after the 1ms mark.

The platform_cpu_kill() path is also executed in the reboot path when a
core tries to stop secondary cores. In these cases, platform_cpu_kill
shouldn't wait infinitely for the secondary cores to power collapse. To
circumvent this scenario, track dying cpus as a part of the hotplug
notification and skip waiting for the core to power collpase during
reboot path.

Change-Id: I6a7fbeeea0d50b5f1fc76a02a39f161b40a67b6c
Signed-off-by: Mahesh Sivasubramanian <msivasub@codeaurora.org>
msm: msm_rq_stats: remove is_smp() API

is_smp() API is unavailable on few target codes.
Until this API is defined use CONFIG_SMP to know
whether target supports SPM are not.

CRs-fixed: 579034
Change-Id: I5bd5c208b18aae27d7f36e77e9d5b38639c2c00e
Signed-off-by: Murali Nalajala <mnalajal@codeaurora.org>