Import vzw defconfig

Change-Id: Iffd74deeb8636e0a894a004959ddff3e69ec630f
msm: mdss: Sanitize overlay kickoff inputs

Overlay kickoff in certain situations can be called without a ctl
attached to the frame buffer device. These situations need to
be captured and logical path should return safely.

CRs-fixed: 619588
Change-Id: Ibee6b59be667b7e5c9841ffb49c67d86bde45026
Signed-off-by: Sree Sesha Aravind Vadrevu <svadrevu@codeaurora.org>
Enable sprint NFC driver

Change-Id: I6a8f0324346c831fc12499cd6937a9c87d080aa7
net/l2tp: don't fall back on UDP [get|set]sockopt

The l2tp [get|set]sockopt() code has fallen back to the UDP functions
for socket option levels != SOL_PPPOL2TP since day one, but that has
never actually worked, since the l2tp socket isn't an inet socket.

As David Miller points out:

  "If we wanted this to work, it'd have to look up the tunnel and then
   use tunnel->sk, but I wonder how useful that would be"

Since this can never have worked so nobody could possibly have depended
on that functionality, just remove the broken code and return -EINVAL.

Change-Id: Iccb3384e7090e8c7cbcd717c12465c45d22c4393
Reported-by: Sasha Levin <sasha.levin@oracle.com>
Acked-by: James Chapman <jchapman@katalix.com>
Acked-by: David Miller <davem@davemloft.net>
Cc: Phil Turnbull <phil.turnbull@oracle.com>
Cc: Vegard Nossum <vegard.nossum@oracle.com>
Cc: Willy Tarreau <w@1wt.eu>
Cc: stable@vger.kernel.org
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
audience: set sleep delay to 0 to fix delay upon making phone calls.

With this change there is no longer a 10 second period where callers can't
hear each other.

Forked from Team-Hydra, credits to albinoman for this fix
ASoC: qcom: qdsp6v2: fix crash due to asynchronous read/write

Whenever an async read command is issued to dsp when
the driver is not enabled, there is a crash in userspace.
The read command is disallowed in the driver and an error
is propagated to userspace which results in the crash.
The driver is re-enabled in a subsequent asynchronous write
command anyway, so the async read command can be allowed.
Ensure that read is allowed by removing a superfluous check.

CRs-Fixed: 675131
Signed-off-by: Satya Krishna Pindiproli <satyak@codeaurora.org>
Change-Id: I5d0598e37d08ac1090f98c24be49fd99c132e22f
config pn544
sched: fix race between try_to_wake_up() and move_task()

Until a task's state has been seen as interruptible/uninterruptible
and it is no longer on_cpu, it is possible that the task may move
to another CPU (load balancing may cause this). Here is an example
where the race condition results in incorrect operation:

- cpu 0 calls put_prev_task on task A, task A's state is TASK_RUNNING
- cpu 0 runs task B, which attempts to wake up A
- cpu 0 begins try_to_wake_up(), recording src_cpu for task A as cpu 0
- cpu 1 then pulls task A (perhaps due to idle balance)
- cpu 1 runs task A, which then sleeps, becoming INTERRUPTIBLE
- cpu 0 continues in try_to_wake_up(), thinking task A's previous
  cpu is 0, where it is actually 1
- if select_task_rq returns cpu 0, task A will be woken up on cpu 0
  without properly updating its cpu to 0 in set_task_cpu()

Change-Id: I870f7ffefe30ba2aae1114fd5e66d1a73e6a54fb
CRs-Fixed: 665958
Signed-off-by: Steve Muckle <smuckle@codeaurora.org>
asoc: msm: Check headset insertion for consistency

 * It's possible to get a noisy reading during polling when
   transitioning to PLUG_TYPE_HEADSET. Poll again to double
   check that it's really a headset.
 * This helps when music is at full volume and a headphone
   is inserted. Double-checking the reading vastly improves
   the case where a noisy reading causes a mic to be detected.

Change-Id: I6e0863a46cdfd5316d798bc9b8348927fa403890
msm_bam_rmnet: Fix potential memory corruption

Usage of legacy string manipulation function sprintf could lead to
memory corruption as the number of bytes to be written to the
destination is not bounded. Replace sprintf with snprintf where the
number of bytes to be written is explicitly specified.

CRs-fixed: 672202
Change-Id: Iab7516ad0e2540eb619fe96e26a3516c7adf86cc
Signed-off-by: Subash Abhinov Kasiviswanathan <subashab@codeaurora.org>
msm: kgsl: Do not return invalid power stats when the device is off

adreno_power_stats() was returning unitialized data when the device
state was not active. Leave early from the function if the device
is not active and return 0s instead.

Change-Id: Ic0dedbadf6201cadb4472327c4ce7f9d9d32b82d
Signed-off-by: Jordan Crouse <jcrouse@codeaurora.org>
Signed-off-by: Prabhat Awasthi <pawasthi@codeaurora.org>
net: Zeroing the structure ethtool_wolinfo in ethtool_get_wol()

memset() the structure ethtool_wolinfo that has padded bytes
but the padded bytes have not been zeroed out.

Change-Id: If3fd2d872a1b1ab9521d937b86a29fc468a8bbfe
Signed-off-by: Avijit Kanti Das <avijitnsec@codeaurora.org>
n_tty: Fix n_tty_write crash when echoing in raw mode

The tty atomic_write_lock does not provide an exclusion guarantee for
the tty driver if the termios settings are LECHO & !OPOST. And since
it is unexpected and not allowed to call TTY buffer helpers like
tty_insert_flip_string concurrently, this may lead to crashes when
concurrect writers call pty_write. In that case the following two
writers:
* the ECHOing from a workqueue and
* pty_write from the process
race and can overflow the corresponding TTY buffer like follows.

If we look into tty_insert_flip_string_fixed_flag, there is:
  int space = __tty_buffer_request_room(port, goal, flags);
  struct tty_buffer *tb = port->buf.tail;
  ...
  memcpy(char_buf_ptr(tb, tb->used), chars, space);
  ...
  tb->used += space;

so the race of the two can result in something like this:
          A                             B
   __tty_buffer_request_room
                                  __tty_buffer_request_room
   memcpy(buf(tb->used), ...)
   tb->used += space;
                                 memcpy(buf(tb->used), ...) ->BOOM

B's memcpy is past the tty_buffer due to the previous A's tb->used
increment.

Since the N_TTY line discipline input processing can output
concurrently with a tty write, obtain the N_TTY ldisc output_lock to
serialize echo output with normal tty writes. This ensures the tty
buffer helper tty_insert_flip_string is not called concurrently and
everything is fine.

Note that this is nicely reproducible by an ordinary user using
forkpty and some setup around that (raw termios + ECHO). And it is
present in kernels at least after commit
d945cb9cce20ac7143c2de8d88b187f62db99bdc (pty: Rework the pty layer to
use the normal buffering logic) in 2.6.31-rc3.

js: add more info to the commit log
js: switch to bool
js: lock unconditionally
js: lock only the tty->ops->write call

Signed-off-by: Peter Hurley <peter@hurleysoftware.com>
Signed-off-by: Jiri Slaby <jslaby@suse.cz>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Change-Id: I9e235db6ec2bb950f26bd8a23f6145dab5dc0a15
Git-commit: 4291086b1f081b869c6d79e5b7441633dc3ace00
Git-repo: git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
Signed-off-by: Avijit Kanti Das <avijitnsec@codeaurora.org>
[rsiddoji@codeaurora.org: resolve trivial merge conflicts]
Signed-off-by: Ravi Kumar S <rsiddoji@codeaurora.org>
PM / devfreq: Check for GPU busy time before sending the sample

Sometimes GPU busy time is very low during sampling. Accumulate
the statistics and send them with the next sample.

Change-Id: I77e568b48afc3a4922c7c341d9478705b7ae3a30
Signed-off-by: Suman Tatiraju <sumant@codeaurora.org>
mmc: core: Fix power class config for HS400

Use the correct power class field from the extended CSD register
for HS400 mode as defined in the eMMC5.0 specification.

CRs-fixed: 690341
Change-Id: Ie10e35941fd3c6ee49c686f721bf5af6fcd74862
Signed-off-by: Venkat Gopalakrishnan <venkatg@codeaurora.org>
Input: gpio_keys: report SW_LID instead of SW_FLIP

Froked from intervigilium
msm: mdss: Add backlight attenuation mechanism in AD auto strength mode

AD backlight attenuation provides the ability to modulate backlight based
on calibration before feeding it to AD core for strength computation.

Change-Id: Iea011807b25882463b1142e17324fa0509007aa4
Signed-off-by: Ping Li <quicpingli@codeaurora.org>
msm: mdss: Sanitize overlay kickoff inputs

Overlay kickoff in certain situations can be called without a ctl
attached to the frame buffer device. These situations need to
be captured and logical path should return safely.

CRs-fixed: 619588
Change-Id: Ibee6b59be667b7e5c9841ffb49c67d86bde45026
Signed-off-by: Sree Sesha Aravind Vadrevu <svadrevu@codeaurora.org>
audience: set sleep delay to 0 to fix delay upon making phone calls.

With this change there is no longer a 10 second period where callers can't
hear each other.

Forked from Team-Hydra, credits to albinoman for this fix
asoc: msm: Check headset insertion for consistency

 * It's possible to get a noisy reading during polling when
   transitioning to PLUG_TYPE_HEADSET. Poll again to double
   check that it's really a headset.
 * This helps when music is at full volume and a headphone
   is inserted. Double-checking the reading vastly improves
   the case where a noisy reading causes a mic to be detected.

Change-Id: I6e0863a46cdfd5316d798bc9b8348927fa403890