mmc: sdhci-msm: set core in proper mode before reset

During probe disable the HC mode since the reset is done in
SDCC mode. HC mode will get set after the reset is complete
before the rest of the initialization is done.

CRs-fixed: 548485
Change-Id: I1fdc633c218447c15c8caad24e2805e7510088f2
Signed-off-by: Stepan Moskovchenko <stepanm@codeaurora.org>
Signed-off-by: Ajay Dudani <adudani@codeaurora.org>
ASoC: msm: qdsp6v2: Don't update state variables for no-wait commands

Some of the afe commands that are sent to dsp are asynchronous
and the thread will not go into sleep. Do not modify any state
variable that are used for the synchronous commands to avoid
possible race conditions.

CRs-fixed: 538366
Change-Id: I10cf75ceb6749ffbdb05461ac0b3bdf944d59299
Signed-off-by: Phani Kumar Uppalapati <phaniu@codeaurora.org>
Signed-off-by: Ajay Dudani <adudani@codeaurora.org>
msm_bam_rmnet: Check for sufficient headroom

Check for sufficient headroom before attempting transmit. Prevent
crash when skb_push() with insufficient headroom. Added module parameter
to track number of times packet expansion required.

CRs-Fixed: 538716
Change-Id: I09126f885b38a47a3ebc2556b5458343acd19d03
Signed-off-by: Harout Hedeshian <harouth@codeaurora.org>
Signed-off-by: Ajay Dudani <adudani@codeaurora.org>
mm: panic on the first bad page table entry access

Sometimes having a number of bad page table entries precipitates in
a crash much later. Because of this, we do not have any context for
the point at which the first bad pte entry was encountered. Hence,
panic on first such instance to help gather context for debug.

Change-Id: Idddf2b977214eb1463d08e16630e98264b9af487
Signed-off-by: Pushkar Joshi <pushkarj@codeaurora.org>
Signed-off-by: Ajay Dudani <adudani@codeaurora.org>
msm: mdss: hdmi-cec: bounds check cec frame size

Ensure that the frame size for the HDMI-CEC message
frame size doesn't exceed the maximum size when
reading message from userspace through sysfs interface.
This avoids potential overflow in cec send msg routine.

Change-Id: I891f23ed70ed5a6c0e3af1f47869effa079ffac8
CRs-Fixed: 520140
Signed-off-by: Manoj Rao <manojraj@codeaurora.org>
Signed-off-by: Ajay Dudani <adudani@codeaurora.org>
mmc: sdhci-msm: Add retry mechanism in case of tuning failure

The specification indicates that the tuning process is normally
shorter than 40 exections of tuning command. Hence, retry the
tuning sequence for at least 3 times before returning the error.

Change-Id: I21724a73af7b997e128b56a2600bdcb12e414996
Signed-off-by: Sahitya Tummala <stummala@codeaurora.org>
Signed-off-by: Ajay Dudani <adudani@codeaurora.org>
mmc: sdhci: propagate execute_tuning error to the caller

Propagate error from host operation execute_tuning to the
caller so that necessary action can be taken accordingly.

Change-Id: I66cf12d974ac1cff914bd866183d0beca66a4cdd
Signed-off-by: Sahitya Tummala <stummala@codeaurora.org>
Signed-off-by: Ajay Dudani <adudani@codeaurora.org>
spi_qsd: set device's runtime PM status to 'suspended'

Sometimes system suspend is initiated before runtime
PM's auto-suspend delay expires and causing devices to
not suspended runtime. As part of system suspend if
device is not suspended runtime then clocks and gpios
are manages by system suspend.

If spi client does initiate transaction request immediately
after system resume then spi doesn't resume run-time
immediately as spi controller's device state is not in
'suspended state'.

Keep device's runtime PM status to suspended during
system suspend.

CRs-Fixed: 512718
Change-Id: I5c0cb39c0b91782d8686c1b3da81125169ccf9be
Signed-off-by: Alok Chauhan <alokc@codeaurora.org>
Signed-off-by: Ajay Dudani <adudani@codeaurora.org>
msm: msm_bus: send correct value to bw division function

While calculating bw for existing client request
sometimes it can go to negative if client unregisters
or send request with lesser ab/ib values. Bus driver
will divide bandwidth if interleaving enabled.

Added a macro wrapper to handle negative bw values
since the division utility function can't handle
negative values

CRs-Fixed: 521940
Change-Id: Ic3a216b8efb535593fe02ad3228d71808d2e0f98
Signed-off-by: Alok Chauhan <alokc@codeaurora.org>
Signed-off-by: Ajay Dudani <adudani@codeaurora.org>
msm: mdss: initialize pipe to NULL

Initialize the pipe pointer to NULL.
So that even if the selection of pipe from pipe-pool
fails, the function returns NULL instead of an
uninitialized value.

Change-Id: Ib04c0a983cba6ffe9532862bcaf516877e49746a
CRs-Fixed: 524466
Signed-off-by: Manoj Rao <manojraj@codeaurora.org>
Signed-off-by: Ajay Dudani <adudani@codeaurora.org>
msm: mdss: hdmi: Proper HDMI feature check

Checks for the proper HDMI feature before providing the
corresponding feature data to avoid invalid memory access.

CRs-Fixed: 542785
Change-Id: I943bee9e843e0504effdfddfaf2dea82c22388f6
Signed-off-by: Ajay Singh Parmar <aparmar@codeaurora.org>
Signed-off-by: Ajay Dudani <adudani@codeaurora.org>
msm: mdss: hdmi: Security check for EDID 3D data parsing

While parsing EDID (Extended display identification data) received
from TV for 3D data and other, proper buffer overflow check is done
to avoid data overflow or overwrite.
Also, replace snprintf with scnprintf for better memory copy results.

CRs-Fixed: 542823
Change-Id: I2603beea6eb88a92b013a1a45d960a4c3ba6c09b
Signed-off-by: Ajay Singh Parmar <aparmar@codeaurora.org>
Signed-off-by: Ajay Dudani <adudani@codeaurora.org>
msm: qmi: Fix access-after-free condition

In case, the sending of a message from handle_resume_tx fails, the
transaction is freed and the failure info is printed in the kernel log
which results in an access-after-free condition.

Free the txn after printing the error message.

CRs-Fixed: 525365
Change-Id: I111634948fa2e8a9737b77a658283ae6d1562531
Signed-off-by: Zaheerulla Meer <zmeer@codeaurora.org>
Signed-off-by: Ajay Dudani <adudani@codeaurora.org>
mmc: print an error on FLUSH timeout

Up until now the FLUSH timeout error was not printed and there
was no way to know if the FLUSH completed successfully or not.
Printing the FLUSH failure will help to identify if FS corruption
happened due to this timeout.

Change-Id: Ibbb51d030d7130d63974a1b4319ad4a24621c595
Signed-off-by: Maya Erez <merez@codeaurora.org>
Signed-off-by: Konstantin Dorfman <kdorfman@codeaurora.org>
Signed-off-by: Ajay Dudani <adudani@codeaurora.org>
msm: audio: qdsp6v2: Change acdb_mmap size variable to unsigned

The acdb_mmap fuction does a size calculation but
stores the result in an int which makes negitive
numbers possible. Changing the variable to unsigned
ensures that the size used is never out of bounds.

Change-Id: Iffd9c1440d2f28b703a77993fdbb3ccd18f30694
CRs-fixed: 548145
Signed-off-by: Ben Romberger <bromberg@codeaurora.org>
Signed-off-by: Ajay Dudani <adudani@codeaurora.org>
msm: msm_bus: Fix the type error causing bandwidth overflow

On legacy chipsets, long int was being used to store
return value after calculating interleaved bw. However,
NoCs support 64-bit integers ab/ib values. problme occurs
if client request for higher bw and if difference of ab
value exceeds the range of 32 bit integer, the Value
overflows and turns negative, which leads to wrong bw calculation.

This patch fixes this integer overflow by correcting argument
type to store bw.

CRs-Fixed: 537213
Change-Id: I8c6c79ba245a988c2c54ccaca3f3eaf5cb857ce5
Signed-off-by: Alok Chauhan <alokc@codeaurora.org>
Signed-off-by: Ajay Dudani <adudani@codeaurora.org>
msm: qdsp6v2: memset stack buffer allocation.

This is needed to avoid garbage data in uninitialized variables.

Change-Id: Ic4b4d7481644c2add187a9122a4e7cfe7255b379
CRs-Fixed: 553304
Signed-off-by: Asish Bhattacharya <asishb@codeaurora.org>
Signed-off-by: Ajay Dudani <adudani@codeaurora.org>
msm: qdsp: memset stack buffer allocation.

This is needed to avoid garbage data in uninitialized variables.

Change-Id: I456be431ee2e22fa5cd5fd2951d7079e177e3646
CRs-Fixed: 553262
Signed-off-by: Asish Bhattacharya <asishb@codeaurora.org>
Signed-off-by: Ajay Dudani <adudani@codeaurora.org>
msm: mdss: hdmi: Proper permissions for CEC logical address

Do not give universal access to CEC (Consumer Electronics Control)
sysfs nodes for logical and physical addresses to avoid unauthorized
access.

CRs-Fixed: 547968
Change-Id: I2ba57f050cc92a361586064dfd5e5659ab07c2f7
Signed-off-by: Ajay Singh Parmar <aparmar@codeaurora.org>
Signed-off-by: Ajay Dudani <adudani@codeaurora.org>
msm: kgsl: Handle failure of find_process_private()

Handle the case of NULL return from find_process_private() upon
its failure by failing from get_process_private().

CRs-fixed: 542831
Change-Id: I8a365368ecf68f0d1aa01199aca76bc7ac49e154
Signed-off-by: Harsh Vardhan Dwivedi <hdwivedi@codeaurora.org>
Signed-off-by: Ajay Dudani <adudani@codeaurora.org>