kernel: alarm: setup the RTC immediately for poweroff alarm

Currently we setup the RTC for poweroff alarm when the system
performs shutdown. But if the phone is shut down unexpectedly
before that, the poweroff alarm can't work. So we can do that
immediately.

CR-fixed: 532743
Change-Id: Ib26a56fba8cd64efe94f2f07ee232482228429dc
Signed-off-by: Figo Wang <figow@codeaurora.org>
power: qpnp-charger: allow vinmin to be lowered to 4.0 V

Currently the minimum input voltage is limited to a minimum
value of 4.2 V. Some chargers in combination with cables
having high resistance may require the input voltage minum
to be lower than 4.2.

Fix this by allowing up to 4.0 V for the minimum input voltage
settings.

Change-Id: I6f1dfa2453c7b95ecc2ccdf2aac23981c0e4dd0a
CRs-Fixed: 584999
Signed-off-by: David Keitel <dkeitel@codeaurora.org>
msm: camera: Fix unterminated of_device_id table

Add a NULL table entry at end for msm, ispif and
msm_generic_buf_mgr device tree match tables.

Change-Id: I05f08c77a8a25112cd17955e98018ac88b7a834c
CRs-Fixed: 582110
Signed-off-by: Hariram Purushothaman <hpurus@codeaurora.org>
msm: camera: Maintain buffer queue in isp buf manager

we encountered a problem where we are trying to free one
of buffers from previous ion session and this is resulting
in a BUG_ON because of mismatch of ion_handles.

Inorder to avoid this we are now maintaining a queue for
all the buffers during prepare buf and we unprepare only
if the buffer is present in this queue.

Change-Id: Id40840b54930d4f90458ad2c888c5c7853ec239b
Signed-off-by: Aditya Jonnalagadda <ajonnala@codeaurora.org>
msm: camera: check buffer validity in isp buf mgr

When someone asks for buffer from isp_buf_mgr, check
if buffer is valid. This is done by verifying if it is
present in the list of buffers for this session.

This will potentially avoid few kinds of page faults.

Change-Id: Ica4724769b9dd4532ddfe468b6a4309f1968812b
Signed-off-by: Aditya Jonnalagadda <ajonnala@codeaurora.org>
msm: ipa: teth_bridge: bug fix in get_aggr_capabilities ioctl

Incorrect input validation may cause a kernel memory disclosure to user
space. This fix adds the correct input validation.

Change-Id: Ia0a3f6bae3c9efc48136bad9974516929e76f4fb
CRs-Fixed: 555453
Signed-off-by: Gidon Studinski <gidons@codeaurora.org>
msm: rpm-smd: use data type correctly for a variable

Change variable data type from signed int to unsigned int.

CRs-fixed: 556055
Change-Id: I6bb363b31d4fab26d84f89e775101c6051fe9e10
Signed-off-by: Anil kumar mamidala <amami@codeaurora.org>
msm: mdss: release mdp dsi clock only when reset

Earlier, we were releasing all the MDP clocks during
lk to kernel transition.   We only need to release
the mdp dsi clock.

Change-Id: Iafa43afc1194e5f7cb50445a9542a21b16ffaef5
Signed-off-by: Xiaoming Zhou <zhoux@codeaurora.org>
msm: mdp3: implement asynchronous frame events

Asynchronous frame events from MDP allows commit thread to be unblocked
once the frame contents have been flushed to MDP HW and new frame can be
programmed while waiting for DMA transfer to complete.

Change-Id: If2ecc3cedfd92e20b2e98b0ac4f6f3608ce78579
Signed-off-by: Terence Hampson <thampson@codeaurora.org>
ARM: dts: msm: fix NFC i2c dts entry on PVT device

Make default params explicit

Change-Id: I957b8ad8f9fa7b6e12a05ec59df740f572d3540a
Signed-off-by: Houston Hoffman <hhoffman@codeaurora.org>
msm-camera: Fixed MIPI raw snaspshot issue 8x10

Removed clearing of interrupt mask register after the streamon is done
add a reset logic for VFE after all the streams are inactive.

Change-Id: Ib8999baae8f75498dcc813aa01fbb44f8c104e94
CRs-Fixed: 583125
Signed-off-by: Chandan Gera <cgera@codeaurora.org>
input: misc: mma8x5x cannot change polling delay

Change polling delay of accelerometer mma8x5x will not take effect
because driver never use this new delay.

Change-Id: I8dcc457de46970b90ffcedd0c76dca4da5010884
Signed-off-by: Bingzhe Cai <bingzhec@codeaurora.org>
msm: wfd:Wait for one more vsync cycle, if VSG running out of input frames

If VSG running out of input frames, it will re-encode previous frames.
With this change, instead of encoding pervious frame VSG will push timer to
half of capturing frame rate. If it find new frame, it will be encoded
Otherwise will re-encode previous frame.

CRs-Fixed: 571771
Change-Id: Ie1c970b4e251c2165e77134b746c4ee0e3a90fba
Signed-off-by: Srinu Gorle <sgorle@codeaurora.org>
defconfig: msm8974: Disable CONFIG_MSM_L2_ERP_1BIT_PANIC

Single-bit L2 parity errors are fully correctable. Continue to log
these errors, but no longer panic on them.

Unrecoverable errors will continue to be treated as fatal.

Change-Id: I82e0407daaad1e177770216abbbe54e702490277
Signed-off-by: Matt Wagantall <mattw@codeaurora.org>
netfilter: x_tables: fix ordering of jumpstack allocation and table update

During kernel stability testing on an SMP ARMv7 system, Yalin Wang
reported the following panic from the netfilter code:

  1fe0: 0000001c 5e2d3b10 4007e779 4009e110 60000010 00000032 ff565656 ff545454
  [<c06c48dc>] (ipt_do_table+0x448/0x584) from [<c0655ef0>] (nf_iterate+0x48/0x7c)
  [<c0655ef0>] (nf_iterate+0x48/0x7c) from [<c0655f7c>] (nf_hook_slow+0x58/0x104)
  [<c0655f7c>] (nf_hook_slow+0x58/0x104) from [<c0683bbc>] (ip_local_deliver+0x88/0xa8)
  [<c0683bbc>] (ip_local_deliver+0x88/0xa8) from [<c0683718>] (ip_rcv_finish+0x418/0x43c)
  [<c0683718>] (ip_rcv_finish+0x418/0x43c) from [<c062b1c4>] (__netif_receive_skb+0x4cc/0x598)
  [<c062b1c4>] (__netif_receive_skb+0x4cc/0x598) from [<c062b314>] (process_backlog+0x84/0x158)
  [<c062b314>] (process_backlog+0x84/0x158) from [<c062de84>] (net_rx_action+0x70/0x1dc)
  [<c062de84>] (net_rx_action+0x70/0x1dc) from [<c0088230>] (__do_softirq+0x11c/0x27c)
  [<c0088230>] (__do_softirq+0x11c/0x27c) from [<c008857c>] (do_softirq+0x44/0x50)
  [<c008857c>] (do_softirq+0x44/0x50) from [<c0088614>] (local_bh_enable_ip+0x8c/0xd0)
  [<c0088614>] (local_bh_enable_ip+0x8c/0xd0) from [<c06b0330>] (inet_stream_connect+0x164/0x298)
  [<c06b0330>] (inet_stream_connect+0x164/0x298) from [<c061d68c>] (sys_connect+0x88/0xc8)
  [<c061d68c>] (sys_connect+0x88/0xc8) from [<c000e340>] (ret_fast_syscall+0x0/0x30)
  Code: 2a000021 e59d2028 e59de01c e59f011c (e7824103)
  ---[ end trace da227214a82491bd ]---
  Kernel panic - not syncing: Fatal exception in interrupt

This comes about because CPU1 is executing xt_replace_table in response
to a setsockopt syscall, resulting in:

	ret = xt_jumpstack_alloc(newinfo);
		--> newinfo->jumpstack = kzalloc(size, GFP_KERNEL);

	[...]

	table->private = newinfo;
	newinfo->initial_entries = private->initial_entries;

Meanwhile, CPU0 is handling the network receive path and ends up in
ipt_do_table, resulting in:

	private = table->private;

	[...]

	jumpstack  = (struct ipt_entry **)private->jumpstack[cpu];

On weakly ordered memory architectures, the writes to table->private
and newinfo->jumpstack from CPU1 can be observed out of order by CPU0.
Furthermore, on architectures which don't respect ordering of address
dependencies (i.e. Alpha), the reads from CPU0 can also be re-ordered.

This patch adds an smp_wmb() before the assignment to table->private
(which is essentially publishing newinfo) to ensure that all writes to
newinfo will be observed before plugging it into the table structure.
A dependent-read barrier is also added on the consumer sides, to ensure
the same ordering requirements are also respected there.

Change-Id: Ia320d52510d7184c0f13d7f130102dbe685e8d6f
Cc: Paul E. McKenney <paulmck@linux.vnet.ibm.com>
Reported-by: Wang, Yalin <Yalin.Wang@sonymobile.com>
Tested-by: Wang, Yalin <Yalin.Wang@sonymobile.com>
Signed-off-by: Will Deacon <will.deacon@arm.com>
Acked-by: Eric Dumazet <edumazet@google.com>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Git-commit: b416c144f46af1a30ddfa4e4319a8f077381ad63
Git-repo: git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
Signed-off-by: Osvaldo Banuelos <osvaldob@codeaurora.org>
ext4: make sure the journal sb is written in ext4_clear_journal_err()

After we transfer set the EXT4_ERROR_FS bit in the file system
superblock, it's not enough to call jbd2_journal_clear_err() to clear
the error indication from journal superblock --- we need to call
jbd2_journal_update_sb_errno() as well.  Otherwise, when the root file
system is mounted read-only, the journal is replayed, and the error
indicator is transferred to the superblock --- but the s_errno field
in the jbd2 superblock is left set (since although we cleared it in
memory, we never flushed it out to disk).

This can end up confusing e2fsck.  We should make e2fsck more robust
in this case, but the kernel shouldn't be leaving things in this
confused state, either.

Change-Id: I7a7cd58880209fbd54f4ded5f2b62de492cae9e0
Signed-off-by: "Theodore Ts'o" <tytso@mit.edu>
Cc: stable@kernel.org
Git-commit: d796c52ef0b71a988364f6109aeb63d79c5b116b
Git-repo: git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
Signed-off-by: Osvaldo Banuelos <osvaldob@codeaurora.org>
wcnss: Add two registers to wcnss dump

When a WDI timeout or Watchdog bite happens at WCNSS, certain WCNSS
registers are logged for debug purpose.  Add alarms txctl and alarms
tactl registers to the dump

Change-Id: Id79345666dd7e5b3d43b13fff5d8230e4fd38655
CRs-fixed: 587892
Acked-by: Yuanyuan Liu <yuanliu@qca.qualcomm.com>
Signed-off-by: Sameer Thalappil <sameert@codeaurora.org>
msm: vidc: Fix a race condition in masking interrupts

Fix a race condition when interaction with firmware happens
in following sequence:

1. Firmware writes IDLE message into the message queue.
2. Driver writes a new command into command queue.
3. Firmware reads this command and starts processing it.
4. Driver checks if command queue is empty and finds it empty.
5. Firmware writes the response (of the command sent in 2) in
   message queue. Firmware also writes another IDLE message and
   sets the idle register.
6. Driver check if the IDLE register is set and finds it set.
7. Driver masks the interrupts. Since interrupts are masked,
   driver misses the response written by firmware in 5.

This race condition is fixed by checking if message queue is
empty or not between 6 and 7.

Change-Id: I9b73ff35f6d408a021f3b03080210da315679d0e
Signed-off-by: Vinay Kalia <vkalia@codeaurora.org>
diag: dci: Safeguard to prevent integer overflow

At certain point in diag driver there can be integer overflow
thus can lead to memory leak. Added a safegaurd for it.

Change-Id: I9347405d8f1f95ed42fe0abf35cbf4c362281bdf
CRs-fixed: 565160
Signed-off-by: Katish Paran <kparan@codeaurora.org>
radio: iris: Allow task to be interrupted

Not allowing task to be interrupted can cause
delay in response to upper layer. Allow task pending
to be interrupted when corresponding command's status
is received.

Change-Id: I1ff383327b646042b1f1e66547eda6900186710b
CRs-Fixed: 569318
Signed-off-by: Ayaz Ahmad <aahmad@codeaurora.org>