Promotion of kernel.lnx.4.4-161103.

CRs      Change ID                                   Subject
--------------------------------------------------------------------------------------------------------------
1084491   Ia9350b9c7810db7eb900957b4ce5dac046ab5e0d   ARM: dts: msm: Add qcom,dump-size entry for dumping CPU
1084491   I37ca3aae0471fcd60499615df77093d5b5451bf8   Documentation: arm: add cache DT bindings
1078910   I9cb454cebb74df291479cecc3533d2c684363f77   ion: disable system contig heap
1077179   I5bc6a5a46311206818d70567e31fd84adc0128be   leds: qpnp-flash-v2: Fix strobe control settings
1077868   Id568f76e03b93cf411366abf01ea857fb80ff1bf   ARM: dts: msm: correct cpu nodes information for msmtrit
1083761   Ib38ecabb3c4bf40fcf5ad368fbbdbe4c44edbf3b   msm: vidc: Scale bus bw along with venus clocks
1084236   I4c13601b0fded6de9d8f897c6d471c6a40c90e4d   sched/hmp: Automatically add children threads to colocat
1070067   I0d4b9f72a12e91b16f3844ac70db33b7de5e5263   usb_bam: Avoid uninitialized variable errors
1080024   I92bd53432a11241228d2e5ac89a3b20d19b05a31   CHROMIUM: dm: boot time specification of dm=
1049826   I3e11ca7f6df4bb0d928512f81f3e3dc40fed791a   msm: camera: cpp: Validate frame message before manipula
1080024   I952d86fd1475f0825f9be1386e3497b36127abd0   ANDROID: dm: Rebase on top of 4.1
1082476 1750919   I3a79950b76c1c38e487471f21dc60590b032dd3f   msm: vidc: Correct debugfs directory name
1080024   I4ba1043965d25ec444a833283392ac2394c845f3   Revert "init: do_mounts: Add a dummy definition for dm_t
1084009   Ie1a5038458b0b93dfec3e5bfc350686eb1f8eb1b   ASoC: wcd934x: Initialize mbhc pointer before access
1080688   Ia60fc3ecb5c2aba19effe1c8242f2d89fdef3ebd   ARM: dts: msm: specify SPI configuration for msmfalcon.
1083524   Ic26fa36bf84bce020ad07ad87de50e684dd7fa5a   ARM: dts: msm: Add initial support for msmcobalt V2 QRD
1075835 1075868   I06426109ab39d33e2b11514082c0bc989c4c8167   coresight: tmc: avoid null pointer dereference
1072541   If2b3e241076a4e0eeb87eeb4361398313fca6962   dwc3: gadget: Remove disabling events and ep0 from gadge
1081711   Iee908c56ec530569b35dafa060139e0428efc781   soc: qcom: scm: add check to avoid buffer overflow
1025311   Ie432af1fefc79f88ec67d212f8b9880355c4266d   cfg80211: support virtual interfaces with different beac
1043802   I3eb92f83b42b0fa28dc73f6e0d4f74ef50375855   ARM: dts: msm: add support for QBT1000 on msmcobalt
1082843   I6ab3992958a659995b7d5020287fd6e47e28f2a4   clk: msm: clock-debug: Print VDD level in clock_state tr
1082816   I475d1219ae62378a90c69642f2320149d0f13885   ASoc: wcd934x: correct MAD micbias setting
967547   I92b10e62be8129ead5859a285bf964ab0a3ae2fd   driver core: fix race between creating/querying glue dir
1084935   I31e8e0b5e9ae240ca031f625cf7c49f1bfe165d4   msm: secure_buffer: fix scm call argument layout
1074738   Ie7f8cee59b90f16f8a844d618a6f903b3e3c2f27   msm: mdss: lock mutex before setting backlight

Change-Id: Id13d60a1768a89563fa5209fc5fe3abfc2ea7bb0
CRs-Fixed: 1077179, 1075868, 1082476, 1083761, 1081711, 1043802, 1084935, 1049826, 1070067, 1082816, 1025311, 1074738, 1083524, 1075835, 1080024, 1750919, 1072541, 1084491, 1084009, 1077868, 967547, 1084236, 1080688, 1078910, 1082843

15 files changed, 143 insertions, 71 deletions

diff --git a/drivers/base/core.c b/drivers/base/core.c
index 3ac683dff7de..bbe8e2efc677 100644
--- a/drivers/base/core.c
+++ b/drivers/base/core.c
@@ -841,11 +841,29 @@ static struct kobject *get_device_parent(struct device *dev,
 	return NULL;
 }
 
+static inline bool live_in_glue_dir(struct kobject *kobj,
+				    struct device *dev)
+{
+	if (!kobj || !dev->class ||
+	    kobj->kset != &dev->class->p->glue_dirs)
+		return false;
+	return true;
+}
+
+static inline struct kobject *get_glue_dir(struct device *dev)
+{
+	return dev->kobj.parent;
+}
+
+/*
+ * make sure cleaning up dir as the last step, we need to make
+ * sure .release handler of kobject is run with holding the
+ * global lock
+ */
 static void cleanup_glue_dir(struct device *dev, struct kobject *glue_dir)
 {
 	/* see if we live in a "glue" directory */
-	if (!glue_dir || !dev->class ||
-	    glue_dir->kset != &dev->class->p->glue_dirs)
+	if (!live_in_glue_dir(glue_dir, dev))
 		return;
 
 	mutex_lock(&gdp_mutex);
@@ -853,11 +871,6 @@ static void cleanup_glue_dir(struct device *dev, struct kobject *glue_dir)
 	mutex_unlock(&gdp_mutex);
 }
 
-static void cleanup_device_parent(struct device *dev)
-{
-	cleanup_glue_dir(dev, dev->kobj.parent);
-}
-
 static int device_add_class_symlinks(struct device *dev)
 {
 	struct device_node *of_node = dev_of_node(dev);
@@ -1033,6 +1046,7 @@ int device_add(struct device *dev)
 	struct kobject *kobj;
 	struct class_interface *class_intf;
 	int error = -EINVAL;
+	struct kobject *glue_dir = NULL;
 
 	dev = get_device(dev);
 	if (!dev)
@@ -1077,8 +1091,10 @@ int device_add(struct device *dev)
 	/* first, register with generic layer. */
 	/* we require the name to be set before, and pass NULL */
 	error = kobject_add(&dev->kobj, dev->kobj.parent, NULL);
-	if (error)
+	if (error) {
+		glue_dir = get_glue_dir(dev);
 		goto Error;
+	}
 
 	/* notify platform of device entry */
 	if (platform_notify)
@@ -1159,9 +1175,10 @@ done:
 	device_remove_file(dev, &dev_attr_uevent);
  attrError:
 	kobject_uevent(&dev->kobj, KOBJ_REMOVE);
+	glue_dir = get_glue_dir(dev);
 	kobject_del(&dev->kobj);
  Error:
-	cleanup_device_parent(dev);
+	cleanup_glue_dir(dev, glue_dir);
 	put_device(parent);
 name_error:
 	kfree(dev->p);
@@ -1237,6 +1254,7 @@ EXPORT_SYMBOL_GPL(put_device);
 void device_del(struct device *dev)
 {
 	struct device *parent = dev->parent;
+	struct kobject *glue_dir = NULL;
 	struct class_interface *class_intf;
 
 	/* Notify clients of device removal.  This call must come
@@ -1281,8 +1299,9 @@ void device_del(struct device *dev)
 		blocking_notifier_call_chain(&dev->bus->p->bus_notifier,
 					     BUS_NOTIFY_REMOVED_DEVICE, dev);
 	kobject_uevent(&dev->kobj, KOBJ_REMOVE);
-	cleanup_device_parent(dev);
+	glue_dir = get_glue_dir(dev);
 	kobject_del(&dev->kobj);
+	cleanup_glue_dir(dev, glue_dir);
 	put_device(parent);
 }
 EXPORT_SYMBOL_GPL(device_del);
diff --git a/drivers/clk/msm/clock-debug.c b/drivers/clk/msm/clock-debug.c
index d0ff821eb203..00a86ba55171 100644
--- a/drivers/clk/msm/clock-debug.c
+++ b/drivers/clk/msm/clock-debug.c
@@ -1,6 +1,6 @@
 /*
  * Copyright (C) 2007 Google, Inc.
- * Copyright (c) 2007-2014, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2007-2014, 2016, The Linux Foundation. All rights reserved.
  *
  * This software is licensed under the terms of the GNU General Public
  * License version 2, as published by the Free Software Foundation, and
@@ -355,8 +355,12 @@ static int trace_clocks_show(struct seq_file *m, void *unused)
 		return 1;
 	}
 	list_for_each_entry(c, &clk_list, list) {
+		int vlevel = 0;
+
+		if (c->num_fmax)
+			vlevel = find_vdd_level(c, c->rate);
 		trace_clock_state(c->dbg_name, c->prepare_count, c->count,
-					c->rate);
+					c->rate, vlevel);
 		total_cnt++;
 	}
 	mutex_unlock(&clk_list_lock);
diff --git a/drivers/hwtracing/coresight/coresight-tmc.c b/drivers/hwtracing/coresight/coresight-tmc.c
index 766b052ade1d..294444d5f59e 100644
--- a/drivers/hwtracing/coresight/coresight-tmc.c
+++ b/drivers/hwtracing/coresight/coresight-tmc.c
@@ -792,11 +792,14 @@ static int tmc_enable(struct tmc_drvdata *drvdata, enum tmc_mode mode)
 		   drvdata->out_mode == TMC_ETR_OUT_MODE_USB) {
 		drvdata->usbch = usb_qdss_open("qdss", drvdata,
 					       usb_notifier);
-		if (IS_ERR(drvdata->usbch)) {
+		if (IS_ERR_OR_NULL(drvdata->usbch)) {
 			dev_err(drvdata->dev, "usb_qdss_open failed\n");
 			ret = PTR_ERR(drvdata->usbch);
 			pm_runtime_put(drvdata->dev);
 			mutex_unlock(&drvdata->mem_lock);
+			if (!ret)
+				ret = -ENODEV;
+
 			return ret;
 		}
 	} else if (drvdata->config_type == TMC_CONFIG_TYPE_ETB ||
@@ -1846,12 +1849,13 @@ static int tmc_probe(struct amba_device *adev, const struct amba_id *id)
 	struct device_node *np = adev->dev.of_node;
 	struct coresight_cti_data *ctidata;
 
-	if (np) {
-		pdata = of_get_coresight_platform_data(dev, np);
-		if (IS_ERR(pdata))
-			return PTR_ERR(pdata);
-		adev->dev.platform_data = pdata;
-	}
+	if (!np)
+		return -ENODEV;
+
+	pdata = of_get_coresight_platform_data(dev, np);
+	if (IS_ERR(pdata))
+		return PTR_ERR(pdata);
+	adev->dev.platform_data = pdata;
 
 	drvdata = devm_kzalloc(dev, sizeof(*drvdata), GFP_KERNEL);
 	if (!drvdata)
diff --git a/drivers/leds/leds-qpnp-flash-v2.c b/drivers/leds/leds-qpnp-flash-v2.c
index 325bdb35e8a3..51fd79f101c8 100644
--- a/drivers/leds/leds-qpnp-flash-v2.c
+++ b/drivers/leds/leds-qpnp-flash-v2.c
@@ -58,6 +58,7 @@
 #define	FLASH_LED_HDRM_VOL_MASK			GENMASK(7, 4)
 #define	FLASH_LED_CURRENT_MASK			GENMASK(6, 0)
 #define	FLASH_LED_ENABLE_MASK			GENMASK(2, 0)
+#define	FLASH_HW_STROBE_MASK			GENMASK(2, 0)
 #define	FLASH_LED_SAFETY_TMR_MASK		GENMASK(7, 0)
 #define	FLASH_LED_INT_RT_STS_MASK		GENMASK(7, 0)
 #define	FLASH_LED_ISC_WARMUP_DELAY_MASK		GENMASK(1, 0)
@@ -72,7 +73,7 @@
 #define	FLASH_LED_THERMAL_THRSH_MASK		GENMASK(2, 0)
 #define	FLASH_LED_THERMAL_OTST_MASK		GENMASK(2, 0)
 #define	FLASH_LED_MOD_CTRL_MASK			BIT(7)
-#define	FLASH_LED_HW_SW_STROBE_SEL_MASK		BIT(2)
+#define	FLASH_LED_HW_SW_STROBE_SEL_BIT		BIT(2)
 #define	FLASH_LED_VPH_DROOP_FAULT_MASK		BIT(4)
 #define	FLASH_LED_LMH_MITIGATION_EN_MASK	BIT(0)
 #define	FLASH_LED_CHGR_MITIGATION_EN_MASK	BIT(4)
@@ -811,7 +812,7 @@ static int qpnp_flash_led_switch_disable(struct flash_switch_data *snode)
 			}
 		}
 
-		if (led->fnode[i].trigger & FLASH_LED_HW_SW_STROBE_SEL_MASK) {
+		if (led->fnode[i].trigger & FLASH_LED_HW_SW_STROBE_SEL_BIT) {
 			rc = qpnp_flash_led_hw_strobe_enable(&led->fnode[i],
 					led->pdata->hw_strobe_option, false);
 			if (rc < 0) {
@@ -831,7 +832,7 @@ static int qpnp_flash_led_switch_set(struct flash_switch_data *snode, bool on)
 {
 	struct qpnp_flash_led *led = dev_get_drvdata(&snode->pdev->dev);
 	int rc, i, addr_offset;
-	u8 val;
+	u8 val, mask;
 
 	if (snode->enabled == on) {
 		dev_warn(&led->pdev->dev, "Switch node is already %s!\n",
@@ -869,9 +870,13 @@ static int qpnp_flash_led_switch_set(struct flash_switch_data *snode, bool on)
 			continue;
 
 		addr_offset = led->fnode[i].id;
+		if (led->fnode[i].trigger & FLASH_LED_HW_SW_STROBE_SEL_BIT)
+			mask = FLASH_HW_STROBE_MASK;
+		else
+			mask = FLASH_LED_HW_SW_STROBE_SEL_BIT;
 		rc = qpnp_flash_led_masked_write(led,
 			FLASH_LED_REG_STROBE_CTRL(led->base + addr_offset),
-			FLASH_LED_ENABLE_MASK, led->fnode[i].trigger);
+			mask, led->fnode[i].trigger);
 		if (rc < 0)
 			return rc;
 
@@ -899,7 +904,7 @@ static int qpnp_flash_led_switch_set(struct flash_switch_data *snode, bool on)
 			}
 		}
 
-		if (led->fnode[i].trigger & FLASH_LED_HW_SW_STROBE_SEL_MASK) {
+		if (led->fnode[i].trigger & FLASH_LED_HW_SW_STROBE_SEL_BIT) {
 			rc = qpnp_flash_led_hw_strobe_enable(&led->fnode[i],
 					led->pdata->hw_strobe_option, true);
 			if (rc < 0) {
@@ -1389,7 +1394,7 @@ static int qpnp_flash_led_parse_each_led_dt(struct qpnp_flash_led *led,
 	}
 	fnode->trigger = (strobe_sel << 2) | (edge_trigger << 1) | active_high;
 
-	if (fnode->trigger & FLASH_LED_HW_SW_STROBE_SEL_MASK) {
+	if (fnode->trigger & FLASH_LED_HW_SW_STROBE_SEL_BIT) {
 		if (of_find_property(node, "qcom,hw-strobe-gpio", NULL)) {
 			fnode->hw_strobe_gpio = of_get_named_gpio(node,
 						"qcom,hw-strobe-gpio", 0);
diff --git a/drivers/md/dm-ioctl.c b/drivers/md/dm-ioctl.c
index 80a439543259..bc5e9a5b1f30 100644
--- a/drivers/md/dm-ioctl.c
+++ b/drivers/md/dm-ioctl.c
@@ -1923,6 +1923,45 @@ void dm_interface_exit(void)
 	dm_hash_exit();
 }
 
+
+/**
+ * dm_ioctl_export - Permanently export a mapped device via the ioctl interface
+ * @md: Pointer to mapped_device
+ * @name: Buffer (size DM_NAME_LEN) for name
+ * @uuid: Buffer (size DM_UUID_LEN) for uuid or NULL if not desired
+ */
+int dm_ioctl_export(struct mapped_device *md, const char *name,
+		    const char *uuid)
+{
+	int r = 0;
+	struct hash_cell *hc;
+
+	if (!md) {
+		r = -ENXIO;
+		goto out;
+	}
+
+	/* The name and uuid can only be set once. */
+	mutex_lock(&dm_hash_cells_mutex);
+	hc = dm_get_mdptr(md);
+	mutex_unlock(&dm_hash_cells_mutex);
+	if (hc) {
+		DMERR("%s: already exported", dm_device_name(md));
+		r = -ENXIO;
+		goto out;
+	}
+
+	r = dm_hash_insert(name, uuid, md);
+	if (r) {
+		DMERR("%s: could not bind to '%s'", dm_device_name(md), name);
+		goto out;
+	}
+
+	/* Let udev know we've changed. */
+	dm_kobject_uevent(md, KOBJ_CHANGE, dm_get_event_nr(md));
+out:
+	return r;
+}
 /**
  * dm_copy_name_and_uuid - Copy mapped device name & uuid into supplied buffers
  * @md: Pointer to mapped_device
diff --git a/drivers/md/dm-table.c b/drivers/md/dm-table.c
index cb5d0daf53bb..b3d78bba3a79 100644
--- a/drivers/md/dm-table.c
+++ b/drivers/md/dm-table.c
@@ -11,6 +11,7 @@
 #include <linux/vmalloc.h>
 #include <linux/blkdev.h>
 #include <linux/namei.h>
+#include <linux/mount.h>
 #include <linux/ctype.h>
 #include <linux/string.h>
 #include <linux/slab.h>
diff --git a/drivers/media/platform/msm/camera_v2/pproc/cpp/msm_cpp.c b/drivers/media/platform/msm/camera_v2/pproc/cpp/msm_cpp.c
index e0d6977b24a6..106d76aae3bb 100644
--- a/drivers/media/platform/msm/camera_v2/pproc/cpp/msm_cpp.c
+++ b/drivers/media/platform/msm/camera_v2/pproc/cpp/msm_cpp.c
@@ -2344,21 +2344,19 @@ static int msm_cpp_cfg_frame(struct cpp_device *cpp_dev,
 		return -EINVAL;
 	}
 
-	if (!new_frame->partial_frame_indicator) {
-		if (cpp_frame_msg[new_frame->msg_len - 1] !=
-			MSM_CPP_MSG_ID_TRAILER) {
-			pr_err("Invalid frame message\n");
-			return -EINVAL;
-		}
+	if (cpp_frame_msg[new_frame->msg_len - 1] !=
+		MSM_CPP_MSG_ID_TRAILER) {
+		pr_err("Invalid frame message\n");
+		return -EINVAL;
+	}
 
-		if ((stripe_base + new_frame->num_strips * stripe_size + 1) !=
-			new_frame->msg_len) {
-			pr_err("Invalid frame message,len=%d,expected=%d\n",
-				new_frame->msg_len,
-				(stripe_base +
-				new_frame->num_strips * stripe_size + 1));
-			return -EINVAL;
-		}
+	if ((stripe_base + new_frame->num_strips * stripe_size + 1) !=
+		new_frame->msg_len) {
+		pr_err("Invalid frame message,len=%d,expected=%d\n",
+			new_frame->msg_len,
+			(stripe_base +
+			new_frame->num_strips * stripe_size + 1));
+		return -EINVAL;
 	}
 
 	if (cpp_dev->iommu_state != CPP_IOMMU_STATE_ATTACHED) {
diff --git a/drivers/media/platform/msm/vidc/msm_vidc_common.c b/drivers/media/platform/msm/vidc/msm_vidc_common.c
index 3671d5fa6479..e612c6ed11c7 100644
--- a/drivers/media/platform/msm/vidc/msm_vidc_common.c
+++ b/drivers/media/platform/msm/vidc/msm_vidc_common.c
@@ -3705,6 +3705,10 @@ static void log_frame(struct msm_vidc_inst *inst, struct vidc_frame_data *data,
 		if (msm_comm_scale_clocks(inst->core))
 			dprintk(VIDC_WARN,
 				"Failed to scale clocks. Performance might be impacted\n");
+
+	if (msm_comm_vote_bus(inst->core))
+		dprintk(VIDC_WARN,
+			"Failed to scale bus. Performance might be impacted\n");
 }
 
 static int request_seq_header(struct msm_vidc_inst *inst,
diff --git a/drivers/media/platform/msm/vidc/msm_vidc_debug.c b/drivers/media/platform/msm/vidc/msm_vidc_debug.c
index efb90c69881f..011941c6d4eb 100644
--- a/drivers/media/platform/msm/vidc/msm_vidc_debug.c
+++ b/drivers/media/platform/msm/vidc/msm_vidc_debug.c
@@ -157,7 +157,7 @@ struct dentry *msm_vidc_debugfs_init_drv(void)
 	struct dentry *f = debugfs_create_##__type(__name, S_IRUGO | S_IWUSR, \
 		dir, __value);                                                \
 	if (IS_ERR_OR_NULL(f)) {                                              \
-		dprintk(VIDC_ERR, "Failed creating debugfs file '%pKd/%s'\n",  \
+		dprintk(VIDC_ERR, "Failed creating debugfs file '%pd/%s'\n",  \
 			dir, __name);                                         \
 		f = NULL;                                                     \
 	}                                                                     \
@@ -349,7 +349,7 @@ struct dentry *msm_vidc_debugfs_init_inst(struct msm_vidc_inst *inst,
 		dprintk(VIDC_ERR, "Invalid params, inst: %pK\n", inst);
 		goto failed_create_dir;
 	}
-	snprintf(debugfs_name, MAX_DEBUGFS_NAME, "inst_%pK", inst);
+	snprintf(debugfs_name, MAX_DEBUGFS_NAME, "inst_%p", inst);
 	dir = debugfs_create_dir(debugfs_name, parent);
 	if (!dir) {
 		dprintk(VIDC_ERR, "Failed to create debugfs for msm_vidc\n");
diff --git a/drivers/platform/msm/usb_bam.c b/drivers/platform/msm/usb_bam.c
index 43188c9d690e..5cb017fdf2d3 100644
--- a/drivers/platform/msm/usb_bam.c
+++ b/drivers/platform/msm/usb_bam.c
@@ -1323,6 +1323,9 @@ static void usb_bam_finish_suspend(enum usb_ctrl cur_bam)
 					__func__, ret);
 				goto no_lpm;
 			}
+		} else {
+			log_event_err("%s: pipe type is not B2B\n", __func__);
+			cons_empty = true;
 		}
 
 		spin_lock(&usb_bam_ipa_handshake_info_lock);
@@ -1959,8 +1962,8 @@ static void usb_bam_finish_resume(struct work_struct *w)
 
 	spin_unlock(&usb_bam_ipa_handshake_info_lock);
 	mutex_unlock(&info[cur_bam].suspend_resume_mutex);
-	log_event_dbg("%s: done..PM Runtime PUT %d, count: %d\n",
-			  __func__, idx, get_pm_runtime_counter(bam_dev));
+	log_event_dbg("%s: done..PM Runtime PUT :%d\n",
+			  __func__, get_pm_runtime_counter(bam_dev));
 	/* Put to match _get at the beginning of this routine */
 	pm_runtime_put(&ctx->usb_bam_pdev->dev);
 }
@@ -2762,16 +2765,14 @@ static void usb_bam_sps_events(enum sps_callback_case sps_cb_case, void *user)
 		log_event_dbg("%s: received SPS_CALLBACK_BAM_TIMER_IRQ\n",
 				__func__);
 
-		spin_lock(&ctx->usb_bam_lock);
-
 		bam = get_bam_type_from_core_name((char *)user);
 		if (bam < 0 || bam >= MAX_BAMS) {
 			log_event_err("%s: Invalid bam, type=%d ,name=%s\n",
 				__func__, bam, (char *)user);
-			spin_unlock(&ctx->usb_bam_lock);
 			return;
 		}
 		ctx = &msm_usb_bam[bam];
+		spin_lock(&ctx->usb_bam_lock);
 
 		ctx->is_bam_inactivity = true;
 		log_event_dbg("%s: Inactivity happened on bam=%s,%d\n",
diff --git a/drivers/soc/qcom/scm.c b/drivers/soc/qcom/scm.c
index 714c848ec9c0..b4713ac1b68b 100644
--- a/drivers/soc/qcom/scm.c
+++ b/drivers/soc/qcom/scm.c
@@ -56,9 +56,16 @@ DEFINE_MUTEX(scm_lmh_lock);
 #define SMC_ATOMIC_MASK 0x80000000
 #define IS_CALL_AVAIL_CMD 1
 
-#define SCM_BUF_LEN(__cmd_size, __resp_size)	\
-	(sizeof(struct scm_command) + sizeof(struct scm_response) + \
-		__cmd_size + __resp_size)
+#define SCM_BUF_LEN(__cmd_size, __resp_size) ({ \
+	size_t x =  __cmd_size + __resp_size; \
+	size_t y = sizeof(struct scm_command) + sizeof(struct scm_response); \
+	size_t result; \
+	if (x < __cmd_size || (x + y) < x) \
+		result = 0; \
+	else \
+		result = x + y; \
+	result; \
+	})
 /**
  * struct scm_command - one SCM command buffer
  * @len: total available memory for command and response
@@ -356,8 +363,7 @@ int scm_call_noalloc(u32 svc_id, u32 cmd_id, const void *cmd_buf,
 	int ret;
 	size_t len = SCM_BUF_LEN(cmd_len, resp_len);
 
-	if (cmd_len > scm_buf_len || resp_len > scm_buf_len ||
-	    len > scm_buf_len)
+	if (len == 0)
 		return -EINVAL;
 
 	if (!IS_ALIGNED((unsigned long)scm_buf, PAGE_SIZE))
@@ -780,7 +786,7 @@ int scm_call(u32 svc_id, u32 cmd_id, const void *cmd_buf, size_t cmd_len,
 	int ret;
 	size_t len = SCM_BUF_LEN(cmd_len, resp_len);
 
-	if (cmd_len > len || resp_len > len)
+	if (len == 0 || PAGE_ALIGN(len) < len)
 		return -EINVAL;
 
 	cmd = kzalloc(PAGE_ALIGN(len), GFP_KERNEL);
diff --git a/drivers/soc/qcom/secure_buffer.c b/drivers/soc/qcom/secure_buffer.c
index d9ebc1edda9c..afe6b2309e27 100644
--- a/drivers/soc/qcom/secure_buffer.c
+++ b/drivers/soc/qcom/secure_buffer.c
@@ -52,7 +52,7 @@ struct mem_prot_info {
 struct dest_vm_and_perm_info {
 	u32 vm;
 	u32 perm;
-	u32 *ctx;
+	u64 ctx;
 	u32 ctx_size;
 };
 
@@ -209,7 +209,7 @@ populate_dest_info(int *dest_vmids, int nelements, int *dest_perms,
 	for (i = 0; i < nelements; i++) {
 		dest_info[i].vm = dest_vmids[i];
 		dest_info[i].perm = dest_perms[i];
-		dest_info[i].ctx = NULL;
+		dest_info[i].ctx = 0x0;
 		dest_info[i].ctx_size = 0;
 	}
 
diff --git a/drivers/staging/android/ion/ion_heap.c b/drivers/staging/android/ion/ion_heap.c
index b8bf80f02f4c..43d3f92cd418 100644
--- a/drivers/staging/android/ion/ion_heap.c
+++ b/drivers/staging/android/ion/ion_heap.c
@@ -2,7 +2,7 @@
  * drivers/staging/android/ion/ion_heap.c
  *
  * Copyright (C) 2011 Google, Inc.
- * Copyright (c) 2011-2015, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2011-2016, The Linux Foundation. All rights reserved.
  *
  * This software is licensed under the terms of the GNU General Public
  * License version 2, as published by the Free Software Foundation, and
@@ -325,8 +325,9 @@ struct ion_heap *ion_heap_create(struct ion_platform_heap *heap_data)
 
 	switch (heap_data->type) {
 	case ION_HEAP_TYPE_SYSTEM_CONTIG:
-		heap = ion_system_contig_heap_create(heap_data);
-		break;
+		pr_err("%s: Heap type is disabled: %d\n", __func__,
+		       heap_data->type);
+		return ERR_PTR(-EINVAL);
 	case ION_HEAP_TYPE_SYSTEM:
 		heap = ion_system_heap_create(heap_data);
 		break;
@@ -366,7 +367,8 @@ void ion_heap_destroy(struct ion_heap *heap)
 
 	switch (heap->type) {
 	case ION_HEAP_TYPE_SYSTEM_CONTIG:
-		ion_system_contig_heap_destroy(heap);
+		pr_err("%s: Heap type is disabled: %d\n", __func__,
+		       heap->type);
 		break;
 	case ION_HEAP_TYPE_SYSTEM:
 		ion_system_heap_destroy(heap);
diff --git a/drivers/usb/dwc3/gadget.c b/drivers/usb/dwc3/gadget.c
index 687d51e25d4b..f32c23e97c70 100644
--- a/drivers/usb/dwc3/gadget.c
+++ b/drivers/usb/dwc3/gadget.c
@@ -2130,24 +2130,11 @@ static int dwc3_gadget_stop(struct usb_gadget *g)
 	struct dwc3		*dwc = gadget_to_dwc(g);
 	unsigned long		flags;
 
-	pm_runtime_get_sync(dwc->dev);
-	dbg_event(0xFF, "Stop gsync",
-		atomic_read(&dwc->dev->power.usage_count));
-	dwc3_gadget_disable_irq(dwc);
 
 	spin_lock_irqsave(&dwc->lock, flags);
-
-	__dwc3_gadget_ep_disable(dwc->eps[0]);
-	__dwc3_gadget_ep_disable(dwc->eps[1]);
-
 	dwc->gadget_driver	= NULL;
-
 	spin_unlock_irqrestore(&dwc->lock, flags);
 
-	pm_runtime_mark_last_busy(dwc->dev);
-	pm_runtime_put_autosuspend(dwc->dev);
-	dbg_event(0xFF, "Auto_susgsync", 0);
-
 	return 0;
 }
 
diff --git a/drivers/video/fbdev/msm/mdss_fb.c b/drivers/video/fbdev/msm/mdss_fb.c
index 0316f4e86d39..bcd23d3c19f2 100644
--- a/drivers/video/fbdev/msm/mdss_fb.c
+++ b/drivers/video/fbdev/msm/mdss_fb.c
@@ -2703,7 +2703,9 @@ static int mdss_fb_release_all(struct fb_info *info, bool release_all)
 		 * enabling ahead of unblank. for some special cases like
 		 * adb shell stop/start.
 		 */
+		mutex_lock(&mfd->bl_lock);
 		mdss_fb_set_backlight(mfd, 0);
+		mutex_unlock(&mfd->bl_lock);
 
 		ret = mdss_fb_blank_sub(FB_BLANK_POWERDOWN, info,
 			mfd->op_enable);