pyramid: display: Clean up

Signed-off-by: Sultanxda <sultanxda@gmail.com>
usb: msm_otg: Enable self-powered USB OTG

Signed-off-by: Sultanxda <sultanxda@gmail.com>
Revert "cable_detect: Use AC charging for unknown connection types"

This reverts commit 69549a0cfe17a6b2fd818b989a4a55b54409a7bc.
n_tty: Fix n_tty_write crash when echoing in raw mode

The tty atomic_write_lock does not provide an exclusion guarantee for
the tty driver if the termios settings are LECHO & !OPOST.  And since
it is unexpected and not allowed to call TTY buffer helpers like
tty_insert_flip_string concurrently, this may lead to crashes when
concurrect writers call pty_write. In that case the following two
writers:
* the ECHOing from a workqueue and
* pty_write from the process
race and can overflow the corresponding TTY buffer like follows.

If we look into tty_insert_flip_string_fixed_flag, there is:
  int space = __tty_buffer_request_room(port, goal, flags);
  struct tty_buffer *tb = port->buf.tail;
  ...
  memcpy(char_buf_ptr(tb, tb->used), chars, space);
  ...
  tb->used += space;

so the race of the two can result in something like this:
              A                                B
__tty_buffer_request_room
                                  __tty_buffer_request_room
memcpy(buf(tb->used), ...)
tb->used += space;
                                  memcpy(buf(tb->used), ...) ->BOOM

B's memcpy is past the tty_buffer due to the previous A's tb->used
increment.

Since the N_TTY line discipline input processing can output
concurrently with a tty write, obtain the N_TTY ldisc output_lock to
serialize echo output with normal tty writes.  This ensures the tty
buffer helper tty_insert_flip_string is not called concurrently and
everything is fine.

Note that this is nicely reproducible by an ordinary user using
forkpty and some setup around that (raw termios + ECHO). And it is
present in kernels at least after commit
d945cb9cce20ac7143c2de8d88b187f62db99bdc (pty: Rework the pty layer to
use the normal buffering logic) in 2.6.31-rc3.

js: add more info to the commit log
js: switch to bool
js: lock unconditionally
js: lock only the tty->ops->write call

Change-Id: I7f5d6d28ff8bcfea9d1cdf9e628d4c5e32d2afe8
References: CVE-2014-0196
Reported-and-tested-by: Jiri Slaby <jslaby@suse.cz>
Signed-off-by: Peter Hurley <peter@hurleysoftware.com>
Signed-off-by: Jiri Slaby <jslaby@suse.cz>
Cc: Linus Torvalds <torvalds@linux-foundation.org>
Cc: Alan Cox <alan@lxorguk.ukuu.org.uk>
Cc: <stable@vger.kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
[bwh: Backported to 3.2: output_lock is a member of struct tty_struct]
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
video: msm: Add multiplier to MDP bandwidth calculation

 * We have major underruns on 8660 without higher bandwidth. Scale it by
   2x to achieve a solid framerate with no underrun.

Change-Id: Iabf9cb12696452a8b51aa818b8e5d6682bac7ed5
video: msm: Allow timeouts for DSI operations

Based off of https://github.com/CyanogenMod/android_kernel_samsung_msm8660-common/commit/996fdd8d496e1c8bc6eea4abd38a066cc8d3304a

Signed-off-by: Sultanxda <sultanxda@gmail.com>
Revert "mach-msm: Add fastcharge by Yank555"

This reverts commit 494a07aaed2583d4d002e982680c1c7138863373.
msm: htc_battery: Use fast (5 sec) timer while on battery power

Previously, the battery driver would refresh itself every 60 seconds, resulting in grossly inaccurate battery readings. Refresh battery driver every 5 seconds while on battery power, and silence resulting logspam.

Signed-off-by: Sultanxda <sultanxda@gmail.com>
kgsl: Sync with CAF kk_2.7-stable

Signed-off-by: Sultanxda <sultanxda@gmail.com>
msm: kgsl: Cleanup the memory free list

Tighten up the memory free list code and remove the memory unused
debugfs file.  Outside of the cleanup the functional changes are
a) move the mutex to a spinlock for speed, and b) only return the
last entry in the list for given pid/gpu address combination.

Conflicts:
	drivers/gpu/msm/kgsl.c
	drivers/gpu/msm/kgsl.h
	drivers/gpu/msm/kgsl_debugfs.c
	drivers/gpu/msm/kgsl_iommu.c

Change-Id: Ic0dedbad9595302e2b42de2807fa82c425d1717f
Signed-off-by: Jordan Crouse <jcrouse@codeaurora.org>
Signed-off-by: Gaurav Gagrani <ggagrani@codeaurora.org>
msm: kgsl: Fix GPUMMU mapping.

Change "msm: kgsl: allow consistent CPU and GPU mappings" broke the older,
GPUMMU mapping. Revert it partially to keep older targets working.

Not tested with IOMMU targets.
msm: kgsl: hold a process_private refcount in process_mem_print

There is a possible race condition where the process can be going
away while its debugfs 'mem' file is being read, which could cause
memory corruption.

Conflicts:
	drivers/gpu/msm/kgsl.c
	drivers/gpu/msm/kgsl_device.h

CRs-Fixed: 627780
Change-Id: I697486faeb3f186fd1220d0acc1e449a4f7b77b0
Signed-off-by: Jeremy Gebben <jgebben@codeaurora.org>
Signed-off-by: Hareesh Gundu <hareeshg@codeaurora.org>
msm: kgsl: Look up the process struct in process_mem_open()

The pointer to an active process struct stands the risk of going stale
if process_mem_open() is called just before the debugfs dentry is
destroyed.  Instead of storing and using the pointer pass the process pid
to process_mem_open() and do a lookup to ensure that we always get active
processes.

Conflicts:
	drivers/gpu/msm/kgsl.c
	drivers/gpu/msm/kgsl_debugfs.c

Change-Id: Ic0dedbad3a3b54dc96251663fdf89c466fef3ca5
Signed-off-by: Jordan Crouse <jcrouse@codeaurora.org>
Signed-off-by: Gaurav Gagrani <ggagrani@codeaurora.org>
msm: kgsl: prevent kgsl_get_pagetable from returning a destroyed pt

A race condition exists between kref_get_pagetable and
kref_put_pagetable such that is is possible to put the last
reference to a pagetable slightly before it has been removed
from the list. By checking kref_get_unless_zero we can determine
if the last reference has already been released. This is safe
because the list is protected by a ptlock.

Change-Id: If6a75e9ca0dec6a12bda5739f835c936a4c3a3b4
Signed-off-by: Jeff Boody <jboody@codeaurora.org>
msm: kgsl: Fix spinlock recursion in destroy pagetable

pagetable list is protected by ptlock. Few functions
while iterating over a pagetable list takes same ptlock,
kgsl_destroy_pagetable() also need same lock. This will
cause spinlock recursion if kgsl_destroy_pagetable()
called while iterating over a list. Created two versions
of same function one is with lock and other is without
lock.

CRs-Fixed: 621172
Change-Id: I61440f99022fce8629a57bb5661e2eef9613187b
Signed-off-by: Prakash Kamliya <pkamliya@codeaurora.org>
Signed-off-by: Gaurav Gagrani <ggagrani@codeaurora.org>
i2c: tps65200: Use fast charge rate when slow charge is requested

For AC-charge rate over USB.

Signed-off-by: Sultanxda <sultanxda@gmail.com>
Avoid to create duplicate filename for misc devices.

There has two bugs.
1. For example, the 'psaux' device will use '1' as minor number to
register misc device, but misc deriver doesn't set the '1' as used.
It's the root casue for duplicate filename.
2. From warning message, minor number '1' is the one of duplicate
fileanme, it meanes the number of dynamic minor is not enough.

The symptom of creating duplicate filename:
------------[ cut here ]------------
     WARNING: at fs/sysfs/dir.c:508 sysfs_add_one+0x7c/0x9c()
     sysfs: cannot create duplicate filename '/dev/char/10:1'
[<c00148b8>] (unwind_backtrace+0x0/0x11c) from
[<c007f828>] (warn_slowpath_common+0x48/0x60)
[<c007f898>] (warn_slowpath_fmt+0x2c/0x3c)
[<c018696c>] (sysfs_add_one+0x7c/0x9c)
[<c01874b4>] (sysfs_do_create_link+0x10c/0x1f8)
[<c03bd6c0>] (device_add+0x1ac/0x5e4)
[<c03be24c>] (device_create_vargs+0x8c/0xd0)
[<c03be2ac>] (device_create+0x1c/0x24)
[<c037c7a4>] (misc_register+0xb4/0x118)
[<c0e30c1c>] (init_log+0x10/0x4c)
[<c0e009d8>] (do_one_initcall+0x90/0x160)
[<c0e00b94>] (kernel_init+0xec/0x1a8)
[<c000f468>] (kernel_thread_exit+0x0/0x8)
---[ end trace da227214a82491b9 ]---

BUG 8889112

Change-Id: I186a945a56fc831f59e19509365a0ae8a481bb2d
Signed-off-by: singhome_lee <singhome_lee@asus.com>
i2c: tps65200: Clean up for pyramid

Signed-off-by: Sultanxda <sultanxda@gmail.com>
i2c: tps65200: Increase max current intake to 1250mA

The datasheet for the tps65200 states that the maximum supported current intake is 1250mA. This makes the battery charge much faster compared to before.

Signed-off-by: Sultanxda <sultanxda@gmail.com>
msm_thermal: Add loop protection

During idle, the low-clear case looped itself tens of times, doing nothing.

Signed-off-by: Sultanxda <sultanxda@gmail.com>