Change-Id: Id54cb4ec234af335af5a0a6deb3add3a66f8e1a5
Signed-off-by: c00187401 <c00187401@notesmail.huawei.com>

Change-Id: I9f7ed0d2b476c58fa5c31d32031dca158a2c16e7

Change-Id: Id3ef8a85e3041372393ce05a0072bfc832a07b12

Merge "audio: soc: fix mic mute when lte fallback occured after call answered" into android-msm-sawshark-3.18

echo path is closed when disabling volte call.
this cause the mic mute.
add assert if both cs_voice and volte bit is set, echo path should not be closed.

Change-Id: I948c538231fbdd3952c5418034ba5dbe97e554f0

Change-Id: I92f6bceb87946b53ab9bf5e77f6efcb3c3b4171c

In the switch to the RPM partition, and read/write data will lead to emmc cmd probability of time-out, resulting in
all emmc operation is invalid, so need to increase the flush cache operation to solve this problem.

Err logs such as:
mmc0: mmc_blk_part_switch succeed, 0 -> 3
<7>[ 166.531101] mmc0: starting CMD23 arg 80000001 flags 00000095
<7>[ 166.531127] sdhci [sdhci_irq()]: *** mmc0 got interrupt: 0x00000001
<7>[ 166.531148] mmc0: req done (CMD23): 0: 00000900 00000000 00000000 00000000
<7>[ 166.531165] mmc0: starting CMD25 arg 00000000 flags 00000035
<7>[ 166.531179] mmc0: blksz 512 blocks 1 flags 00000100 tsac 1200 ms nsac 8000
<7>[ 166.531223] sdhci [sdhci_irq()]: *** mmc0 got interrupt: 0x00000001
<7>[ 166.560478] mmc0: accumulated busy time is 51554 usec
<7>[ 166.560506] mmc0: status: load = 51% - total_time=100216 busy_time = 51554, clk=50000000
<7>[ 166.560522] mmc0: target freq = 177770000 (kworker/u8:4)
<7>[ 167.873427] sdhci [sdhci_irq()]: *** mmc0 got interrupt: 0x00108000
<3>[ 167.873457] mmc0: data txfr (0x00100000) error: -110 after 1342 ms
<6>[ 167.873467] sdhci: =========== REGISTER DUMP (mmc0)===========
<6>[ 167.873478] sdhci: Sys addr: 0x00000088 | Version: 0x00002e02
<6>[ 167.873489] sdhci: Blk size: 0x00000200 | Blk cnt: 0x00000000
<6>[ 167.873500] sdhci: Argument: 0x00000000 | Trn mode: 0x00000023
<6>[ 167.873511] sdhci: Present: 0x03e80000 | Host ctl: 0x00000034
<6>[ 167.873522] sdhci: Power: 0x0000000b | Blk gap: 0x00000000
<6>[ 167.873533] sdhci: Wake-up: 0x00000000 | Clock: 0x00000007
<6>[ 167.873543] sdhci: Timeout: 0x0000000b | Int stat: 0x00000000
<6>[ 167.873555] sdhci: Int enab: 0x03ff800b | Sig enab: 0x03ff000b
<6>[ 167.873565] sdhci: AC12 err: 0x00000000 | Slot int: 0x00000000
<6>[ 167.873576] sdhci: Caps: 0x242dc8b2 | Caps_1: 0x00008007
<6>[ 167.873587] sdhci: Cmd: 0x0000193a | Max curr: 0x00000000
<6>[ 167.873598] sdhci: Resp 1: 0x00000000 | Resp 0: 0x00000900
<6>[ 167.873609] sdhci: Resp 3: 0x00000900 | Resp 2: 0x00000000
<6>[ 167.873618] sdhci: Host ctl2: 0x00000008
<6>[ 167.873629] sdhci: ADMA Err: 0x00000000 | ADMA Ptr: 0xae86c008
<6>[ 167.873639] ----------- VENDOR REGISTER DUMP -----------
<6>[ 167.873652] Data cnt: 0x00000000 | Fifo cnt: 0x00000000 | Int sts: 0x000c0000
<6>[ 167.873665] DLL cfg: 0x665d6400 | DLL sts: 0x00000028 | SDCC ver: 0x1000002e
<6>[ 167.873677] Vndr func: 0x00018a1e | Vndr adma err : addr0: 0x00000000 addr1: 0x00000000
<6>[ 167.873685] Vndr func2: 0xfa8018a8
<6>[ 167.873928] mmc0: clk: 50000000 clk-gated: 0 claimer: qseecomd pwr: 10 host->irq = 8192
<6>[ 167.873940] mmc0: rpmstatus[pltfm](runtime-suspend:usage_count:disable_depth)(0:1:0)
<6>[ 167.873949] sdhci: ===========================================
<7>[ 167.873989] mmc0: accumulated busy time is 1313486 usec
<7>[ 167.874004] mmc0: req done (CMD25): 0: 00000900 00000000 00000000 00000000
<7>[ 167.874016] mmc0: 0 bytes transferred: -110
<3>[ 167.874106] sdhci_msm 7824900.sdhci: mmc_blk_ioctl_rpmb_cmd: data error -110
<7>[ 167.874192] mmc0: invalid state for clock scaling - skipping
<7>[ 167.874212] mmc0: clock change to 177770000 finished successfully (kworker/u8:4)
<7>[ 167.874531] mmc0: starting CMD6 arg 03b33801 flags 0000049d
<7>[ 167.874582] sdhci [sdhci_irq()]: *** mmc0 got interrupt: 0x00018000
<7>[ 167.875383] mmc0: req failed (CMD6): -110, retrying...
<7>[ 167.875549] sdhci [sdhci_irq()]: *** mmc0 got interrupt: 0x00018000

Change-Id: Ica24c8057519c6f50a131958cac6de05506fcc27

move qrtable20 and qrtable30 to the end of profile init.

Change-Id: I9b151c4c5a7c18e1ad2075391333e16f22919356

1.enable empty sochold and set convgcfg according to battery id.
2.update mp2661 uvlo to 2500mv.
3.change alert from repsoc to vfsoc when soc is below 6%.

Change-Id: I7a31e9559ce05b8ebafc4248dd4315e640881bcf

add condition of capacity to avoid setting repeat charging flag
when battery full is 4200mv and usb plugins.

Change-Id: I38d3b9e349c12182bef4e2e54bf33afda85263cf

1.add battery id driver.
2.add battery profile below 0 degree according to battery id.

Change-Id: Icb5d46704f7b81335bf62cd56457fca705e616e2

Merge "hwversion: add pinctl header file to prevent compilation errors" into android-msm-sawshark-3.18

Change-Id: I483c8527bf5beef867d6adfc6ca98f82bbab534c

It fixed wifi driver NULL pointer issue.

Change-Id: Ib3df0d70500e3a2422e778ef15bec749dba13eda

The msm_otg_probe sets charger type to USB and healthd will detect the charger type.
If the type is unknown, healthd indicates that there is no charger driver registered
and display charger parameters wrongly, for example, chg type is empty.
The issue happens as follows:
1), when usb is connected, the watch is booting and the type is USB.
2), before the starting of healthd, disconnect the usb and the type is unknown.
So set charger type to USB when usb is disconnected.

Change-Id: Ia96b257cd958aea224159c9ce08fb4081981b44b

Merge "driver: nfc: when the clock that nfc need is not up in suspend, do not turn off the clock." into android-msm-sawshark-3.18

When the nfc chip is in the RF field,the clock that nfc need will be turned on by PMIC.
In this case standby,nfc driver will turn off clock causes the card to fail.

Change-Id: I61bb1c566108452c0fa5d4f858868863efcc5e40

Change-Id: I54c49fa710442aee97758fe68f91aa7e6048b5d7

【for CVE-2016-8401/CVE-2016-8402/CVE-2016-8403/CVE-2016-8404/CVE-2016-8406/CVE-2016-8407】
The format specifier %p can leak kernel addresses while not valuing the kptr_restrict system 
settings. Use %pK instead of %p, which also evaluates whether kptr_restrict is set.

Change-Id: I7d98ed7cf4fbc034bb3a12bf31ebf0ccf25c4b2b

【for CVE-2016-8401/CVE-2016-8402/CVE-2016-8403/CVE-2016-8404/CVE-2016-8406/CVE-2016-8407】
The format specifier %p can leak kernel addresses while not valuing the kptr_restrict 
system settings.Use %pK instead of %p, which also evaluates whether kptr_restrict is set.

Change-Id: I972c1fc5da7f7bc94ecd4159f325c1aa376ae4c7

【for CVE-2016-8399】
In ping_common_sendmsg(), when len < icmph_len, memcpy_fromiovec()
will access invalid memory because msg->msg_iov only has 1 element
and memcpy_fromiovec() attempts to increment it.

Change-Id: Ie20c51f82f408611f7a1837e5d040e17520eb8a2

uart clk use xo clk and stop system to enter cpu idle, so disable it

Change-Id: I8f3b7b1e565b24e2e1652e95301f90b0639f606a

Change-Id: Ie3f1bfacc22a1f91c40045d30064d9770a75c5c1

* changes:
  percpu: fix synchronization between chunk->map_extend_work and chunk destruction
  percpu: fix synchronization between synchronous map extension and chunk destruction
  Revert "ecryptfs: forbid opening files without mmap handler"
  staging/android/ion : fix a race condition in the ion driver

Atomic allocations can trigger async map extensions which is serviced
by chunk->map_extend_work.  pcpu_balance_work which is responsible for
destroying idle chunks wasn't synchronizing properly against
chunk->map_extend_work and may end up freeing the chunk while the work
item is still in flight.

This patch fixes the bug by rolling async map extension operations
into pcpu_balance_work.

Signed-off-by: Tejun Heo <tj@kernel.org>
Reported-and-tested-by: Alexei Starovoitov <alexei.starovoitov@gmail.com>
Reported-by: Vlastimil Babka <vbabka@suse.cz>
Reported-by: Sasha Levin <sasha.levin@oracle.com>
Cc: stable@vger.kernel.org # v3.18+
Fixes: 9c824b6a ("percpu: make sure chunk->map array has available space")

For non-atomic allocations, pcpu_alloc() can try to extend the area
map synchronously after dropping pcpu_lock; however, the extension
wasn't synchronized against chunk destruction and the chunk might get
freed while extension is in progress.

This patch fixes the bug by putting most of non-atomic allocations
under pcpu_alloc_mutex to synchronize against pcpu_balance_work which
is responsible for async chunk management including destruction.

Signed-off-by: Tejun Heo <tj@kernel.org>
Reported-and-tested-by: Alexei Starovoitov <alexei.starovoitov@gmail.com>
Reported-by: Vlastimil Babka <vbabka@suse.cz>
Reported-by: Sasha Levin <sasha.levin@oracle.com>
Cc: stable@vger.kernel.org # v3.18+
Fixes: 1a4d7607 ("percpu: implement asynchronous chunk population")

This reverts commit 2f36db71.

It fixed a local root exploit but also introduced a dependency on
the lower file system implementing an mmap operation just to open a
file,
which is a bit of a heavy hammer.  The right fix is to have mmap depend
on the existence of the mmap handler instead.

Change-Id: Iaeb253f55225d7913d5cbb4387a56e47032a4b6f
Signed-off-by: Jeff Mahoney <jeffm@suse.com>
Cc: stable@vger.kernel.org
Signed-off-by: Tyler Hicks <tyhicks@canonical.com>

There is a use-after-free problem in the ion driver.
This is caused by a race condition in the ion_ioctl()
function.

A handle has ref count of 1 and two tasks on different
cpus calls ION_IOC_FREE simultaneously.

cpu 0                                   cpu 1
-------------------------------------------------------
ion_handle_get_by_id()
(ref == 2)
                            ion_handle_get_by_id()
                            (ref == 3)

ion_free()
(ref == 2)

ion_handle_put()
(ref == 1)

                            ion_free()
                            (ref == 0 so ion_handle_destroy() is
                            called
                            and the handle is freed.)

                            ion_handle_put() is called and it
                            decreases the slub's next free pointer

The problem is detected as an unaligned access in the
spin lock functions since it uses load exclusive
 instruction. In some cases it corrupts the slub's
free pointer which causes a mis-aligned access to the
next free pointer.(kmalloc returns a pointer like
ffffc0745b4580aa). And it causes lots of other
hard-to-debug problems.

This symptom is caused since the first member in the
ion_handle structure is the reference count and the
ion driver decrements the reference after it has been
freed.

To fix this problem client->lock mutex is extended
to protect all the codes that uses the handle.

Change-Id: Ib0483f507c90645e28717bb2f98a6bd3eb055e60
Signed-off-by: Eun Taik Lee <eun.taik.lee@samsung.com>
Reviewed-by: Laura Abbott <labbott@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

1.clean legacy code of wireless charging
2.adjust print and variable format

Change-Id: I812f7b496a75717d67d51b81bc272f2c7bc063c4

Merge "Display: OLED: enable panel ACL feature when panel go out from the power off mode" into android-msm-sawshark-3.18

When system goto power off mode, the panel will be shut down.
so when power on panel, should enable the ACL feature again.

Change-Id: I8aa5d32535f290ac263bab4af61b3c1c746924d0

Merge "sawshark_defconfig: Enable CONFIG_UID_CPUTIME to support userspace getcup time." into android-msm-sawshark-3.18

Change-Id: If143fe98cbd961333154841a373545fe35bcc529
Signed-off-by: Zhang Wei <zhangwei519@huawei.com>

Change-Id: I2410dd85b194db4db35bbb8cea3167d701414133

Kernel panic when type "cat /sys/kernel/debug/shrinker"

Unable to handle kernel paging request at virtual address 0af37d40
pgd = d4dec000
[0af37d40] *pgd=00000000
Internal error: Oops: 5 [#1] PREEMPT SMP ARM
[<c0bb8f24>] (_raw_spin_lock) from [<c020aa08>] (list_lru_count_one+0x14/0x28)
[<c020aa08>] (list_lru_count_one) from [<c02309a8>] (super_cache_count+0x40/0xa0)
[<c02309a8>] (super_cache_count) from [<c01f6ab0>] (debug_shrinker_show+0x50/0x90)
[<c01f6ab0>] (debug_shrinker_show) from [<c024fa5c>] (seq_read+0x1ec/0x48c)
[<c024fa5c>] (seq_read) from [<c022e8f8>] (__vfs_read+0x20/0xd0)
[<c022e8f8>] (__vfs_read) from [<c022f0d0>] (vfs_read+0x7c/0x104)
[<c022f0d0>] (vfs_read) from [<c022f974>] (SyS_read+0x44/0x9c)
[<c022f974>] (SyS_read) from [<c0107580>] (ret_fast_syscall+0x0/0x3c)
Code: e1a04000 e3a00001 ebd66b39 f594f000 (e1943f9f)
---[ end trace 60c74014a63a9688 ]---
Kernel panic - not syncing: Fatal exception

shrink_control.nid is used but not initialzed, same for
shrink_control.memcg.

This reverts commit b0e7a582.

Change-Id: I108de88fa4baaef99a53c4e4c6a1d8c4b4804157
Reported-by: Xiaowen Liu <xiaowen.liu@freescale.com>
Signed-off-by: Dmitry Shmidt <dimitrysh@google.com>

This reverts commit f68c7efe.