Merge android-4.4.131 (d5d6526) into msm-4.4

* refs/heads/tmp-d5d6526
  Linux 4.4.131
  serial: mctrl_gpio: Add missing module license
  serial: mctrl_gpio: export mctrl_gpio_disable_ms and mctrl_gpio_init
  x86/smpboot: Don't use mwait_play_dead() on AMD systems
  x86/ipc: Fix x32 version of shmid64_ds and msqid64_ds
  libceph: validate con->state at the top of try_write()
  ASoC: fsl_esai: Fix divisor calculation failure at lower ratio
  ARM: amba: Don't read past the end of sysfs "driver_override" buffer
  ARM: amba: Fix race condition with driver_override
  ARM: amba: Make driver_override output consistent with other buses
  scsi: sd: Defer spinning up drive while SANITIZE is in progress
  kobject: don't use WARN for registration failures
  mtd: cfi: cmdset_0002: Do not allow read/write to suspend erase block.
  mtd: cfi: cmdset_0001: Workaround Micron Erase suspend bug.
  mtd: cfi: cmdset_0001: Do not allow read/write to suspend erase block.
  ALSA: hda/realtek - Add some fixes for ALC233
  ALSA: hda: Hardening for potential Spectre v1
  ALSA: seq: oss: Hardening for potential Spectre v1
  ALSA: seq: oss: Fix unbalanced use lock for synth MIDI device
  ALSA: core: Report audio_tstamp in snd_pcm_sync_ptr
  ALSA: control: Hardening for potential Spectre v1
  ALSA: rme9652: Hardening for potential Spectre v1
  ALSA: hdspm: Hardening for potential Spectre v1
  ALSA: asihpi: Hardening for potential Spectre v1
  ALSA: opl3: Hardening for potential Spectre v1
  tty: Use __GFP_NOFAIL for tty_ldisc_get()
  tty: n_gsm: Fix DLCI handling for ADM mode if debug & 2 is not set
  tty: n_gsm: Fix long delays with control frame timeouts in ADM mode
  tty: Don't call panic() at tty_ldisc_init()
  drm/virtio: fix vq wait_event condition
  virtio_console: free buffers after reset
  virtio: add ability to iterate over vqs
  ALSA: usb-audio: Skip broken EU on Dell dock USB-audio
  USB: Increment wakeup count on remote wakeup.
  usb: core: Add quirk for HP v222w 16GB Mini
  USB: serial: cp210x: add ID for NI USB serial console
  USB: serial: ftdi_sio: use jtag quirk for Arrow USB Blaster
  USB: serial: simple: add libtransistor console
  usbip: vhci_hcd: Fix usb device and sockfd leaks
  usbip: usbip_host: fix to hold parent lock for device_attach() calls
  ext4: fix bitmap position validation
  ext4: add validity checks for bitmap block numbers
  ext4: set h_journal if there is a failure starting a reserved handle
  ext4: prevent right-shifting extents beyond EXT_MAX_BLOCKS
  goldfish: pipe: ANDROID: Allocate memory with GFP_KERNEL.
  goldfish: pipe: ANDROID: Do not crash
  goldfish: pipe: ANDROID: remove redundant casting
  goldfish: pipe: ANDROID: Add 'pipe' to pipe functions
  goldfish: pipe: ANDROID: fix whitespace
  goldfish: pipe: ANDROID: rename global variables
  goldfish: pipe: ANDROID: remove a redundant target
  goldfish: pipe: ANDROID: add blank lines
  goldfish: pipe: ANDROID: replace 'BUG_ON' with 'BUILD_BUG_ON'
  goldfish: pipe: ANDROID: use the 'BIT' macro for wakeup flags
  goldfish: pipe: ANDROID: fix logging format strings
  Linux 4.4.130
  s390/uprobes: implement arch_uretprobe_is_alive()
  s390/cio: update chpid descriptor after resource accessibility event
  cdrom: information leak in cdrom_ioctl_media_changed()
  scsi: mptsas: Disable WRITE SAME
  ipv6: add RTA_TABLE and RTA_PREFSRC to rtm_ipv6_policy
  net: af_packet: fix race in PACKET_{R|T}X_RING
  tcp: md5: reject TCP_MD5SIG or TCP_MD5SIG_EXT on established sockets
  net: fix deadlock while clearing neighbor proxy table
  tipc: add policy for TIPC_NLA_NET_ADDR
  llc: fix NULL pointer deref for SOCK_ZAPPED
  llc: hold llc_sap before release_sock()
  sctp: do not check port in sctp_inet6_cmp_addr
  vlan: Fix reading memory beyond skb->tail in skb_vlan_tagged_multi
  pppoe: check sockaddr length in pppoe_connect()
  packet: fix bitfield update race
  team: fix netconsole setup over team
  team: avoid adding twice the same option to the event list
  tcp: don't read out-of-bounds opsize
  llc: delete timers synchronously in llc_sk_free()
  net: validate attribute sizes in neigh_dump_table()
  l2tp: check sockaddr length in pppol2tp_connect()
  KEYS: DNS: limit the length of option strings
  bonding: do not set slave_dev npinfo before slave_enable_netpoll in bond_enslave
  s390: correct module section names for expoline code revert
  s390: correct nospec auto detection init order
  s390: add sysfs attributes for spectre
  s390: report spectre mitigation via syslog
  s390: add automatic detection of the spectre defense
  s390: move nobp parameter functions to nospec-branch.c
  s390/entry.S: fix spurious zeroing of r0
  s390: do not bypass BPENTER for interrupt system calls
  s390: Replace IS_ENABLED(EXPOLINE_*) with IS_ENABLED(CONFIG_EXPOLINE_*)
  s390: introduce execute-trampolines for branches
  s390: run user space and KVM guests with modified branch prediction
  s390: add options to change branch prediction behaviour for the kernel
  s390/alternative: use a copy of the facility bit mask
  s390: add optimized array_index_mask_nospec
  s390: scrub registers on kernel entry and KVM exit
  KVM: s390: wire up bpb feature
  s390: enable CPU alternatives unconditionally
  s390: introduce CPU alternatives
  Revert "ath10k: send (re)assoc peer command when NSS changed"
  jbd2: fix use after free in kjournald2()
  ath9k_hw: check if the chip failed to wake up
  Input: drv260x - fix initializing overdrive voltage
  r8152: add Linksys USB3GIGV1 id
  staging: ion : Donnot wakeup kswapd in ion system alloc
  perf: Return proper values for user stack errors
  x86/tsc: Prevent 32bit truncation in calc_hpet_ref()
  cifs: do not allow creating sockets except with SMB1 posix exensions
  UPSTREAM: tracing: always define trace_{irq,preempt}_{enable_disable}
  ANDROID: staging: ion: Obey kptr_restrict
  ANDROID: sdcardfs: Set s_root to NULL after putting
  ANDROID: sdcardfs: d_make_root calls iput
  ANDROID: sdcardfs: Check for private data earlier

Conflicts:
	drivers/staging/android/ion/ion.c
	drivers/staging/android/ion/ion_cma_heap.c
	drivers/staging/android/ion/ion_system_heap.c

Change-Id: I8155103b3787bb800f85291cc7378a8e29a8436f
Signed-off-by: Srinivasarao P <spathi@codeaurora.org>

2 files changed, 34 insertions, 8 deletions

diff --git a/drivers/mtd/chips/cfi_cmdset_0001.c b/drivers/mtd/chips/cfi_cmdset_0001.c
index 286b97a304cf..4509ee0b294a 100644
--- a/drivers/mtd/chips/cfi_cmdset_0001.c
+++ b/drivers/mtd/chips/cfi_cmdset_0001.c
@@ -45,6 +45,7 @@
 #define I82802AB	0x00ad
 #define I82802AC	0x00ac
 #define PF38F4476	0x881c
+#define M28F00AP30	0x8963
 /* STMicroelectronics chips */
 #define M50LPW080       0x002F
 #define M50FLW080A	0x0080
@@ -375,6 +376,17 @@ static void cfi_fixup_major_minor(struct cfi_private *cfi,
 		extp->MinorVersion = '1';
 }
 
+static int cfi_is_micron_28F00AP30(struct cfi_private *cfi, struct flchip *chip)
+{
+	/*
+	 * Micron(was Numonyx) 1Gbit bottom boot are buggy w.r.t
+	 * Erase Supend for their small Erase Blocks(0x8000)
+	 */
+	if (cfi->mfr == CFI_MFR_INTEL && cfi->id == M28F00AP30)
+		return 1;
+	return 0;
+}
+
 static inline struct cfi_pri_intelext *
 read_pri_intelext(struct map_info *map, __u16 adr)
 {
@@ -825,21 +837,30 @@ static int chip_ready (struct map_info *map, struct flchip *chip, unsigned long
 		     (mode == FL_WRITING && (cfip->SuspendCmdSupport & 1))))
 			goto sleep;
 
+		/* Do not allow suspend iff read/write to EB address */
+		if ((adr & chip->in_progress_block_mask) ==
+		    chip->in_progress_block_addr)
+			goto sleep;
+
+		/* do not suspend small EBs, buggy Micron Chips */
+		if (cfi_is_micron_28F00AP30(cfi, chip) &&
+		    (chip->in_progress_block_mask == ~(0x8000-1)))
+			goto sleep;
 
 		/* Erase suspend */
-		map_write(map, CMD(0xB0), adr);
+		map_write(map, CMD(0xB0), chip->in_progress_block_addr);
 
 		/* If the flash has finished erasing, then 'erase suspend'
 		 * appears to make some (28F320) flash devices switch to
 		 * 'read' mode.  Make sure that we switch to 'read status'
 		 * mode so we get the right data. --rmk
 		 */
-		map_write(map, CMD(0x70), adr);
+		map_write(map, CMD(0x70), chip->in_progress_block_addr);
 		chip->oldstate = FL_ERASING;
 		chip->state = FL_ERASE_SUSPENDING;
 		chip->erase_suspended = 1;
 		for (;;) {
-			status = map_read(map, adr);
+			status = map_read(map, chip->in_progress_block_addr);
 			if (map_word_andequal(map, status, status_OK, status_OK))
 			        break;
 
@@ -1035,8 +1056,8 @@ static void put_chip(struct map_info *map, struct flchip *chip, unsigned long ad
 		   sending the 0x70 (Read Status) command to an erasing
 		   chip and expecting it to be ignored, that's what we
 		   do. */
-		map_write(map, CMD(0xd0), adr);
-		map_write(map, CMD(0x70), adr);
+		map_write(map, CMD(0xd0), chip->in_progress_block_addr);
+		map_write(map, CMD(0x70), chip->in_progress_block_addr);
 		chip->oldstate = FL_READY;
 		chip->state = FL_ERASING;
 		break;
@@ -1927,6 +1948,8 @@ static int __xipram do_erase_oneblock(struct map_info *map, struct flchip *chip,
 	map_write(map, CMD(0xD0), adr);
 	chip->state = FL_ERASING;
 	chip->erase_suspended = 0;
+	chip->in_progress_block_addr = adr;
+	chip->in_progress_block_mask = ~(len - 1);
 
 	ret = INVAL_CACHE_AND_WAIT(map, chip, adr,
 				   adr, len,
diff --git a/drivers/mtd/chips/cfi_cmdset_0002.c b/drivers/mtd/chips/cfi_cmdset_0002.c
index c3624eb571d1..31448a2b39ae 100644
--- a/drivers/mtd/chips/cfi_cmdset_0002.c
+++ b/drivers/mtd/chips/cfi_cmdset_0002.c
@@ -814,9 +814,10 @@ static int get_chip(struct map_info *map, struct flchip *chip, unsigned long adr
 		    (mode == FL_WRITING && (cfip->EraseSuspend & 0x2))))
 			goto sleep;
 
-		/* We could check to see if we're trying to access the sector
-		 * that is currently being erased. However, no user will try
-		 * anything like that so we just wait for the timeout. */
+		/* Do not allow suspend iff read/write to EB address */
+		if ((adr & chip->in_progress_block_mask) ==
+		    chip->in_progress_block_addr)
+			goto sleep;
 
 		/* Erase suspend */
 		/* It's harmless to issue the Erase-Suspend and Erase-Resume
@@ -2265,6 +2266,7 @@ static int __xipram do_erase_chip(struct map_info *map, struct flchip *chip)
 	chip->state = FL_ERASING;
 	chip->erase_suspended = 0;
 	chip->in_progress_block_addr = adr;
+	chip->in_progress_block_mask = ~(map->size - 1);
 
 	INVALIDATE_CACHE_UDELAY(map, chip,
 				adr, map->size,
@@ -2354,6 +2356,7 @@ static int __xipram do_erase_oneblock(struct map_info *map, struct flchip *chip,
 	chip->state = FL_ERASING;
 	chip->erase_suspended = 0;
 	chip->in_progress_block_addr = adr;
+	chip->in_progress_block_mask = ~(len - 1);
 
 	INVALIDATE_CACHE_UDELAY(map, chip,
 				adr, len,