msm: board-8660: Add new heap for qse comm

Add new 3MB carveout heap required for Qualcomm
Secure Executive (QSE) communications.

(cherry picked from commit 6ab47250eb1815d968d952824c9402cddd639e15)

Change-Id: Iffdd1defadf7e9e39494880df566f34531713e7c
Signed-off-by: Olav Haugan <ohaugan@codeaurora.org>
defconfig: 8660: Enable qseecom driver

replace tzcom driver with qseecom

CRs-fixed: 342002
Signed-off-by: Mona Hossain <mhossain@codeaurora.org>
(cherry picked from commit b8409d65e32c3296c059e8590f85376946da86ef)

Change-Id: Ib387fb9ca1925a17370b23f7cf0a1488580172b2
Signed-off-by: Ram Kumar Chakravarthy Chebathini <rcheba@codeaurora.org>
msm: clock-8x60: Add IOMMU clock aliases for the video driver

The video driver needs control of some IOMMU clocks for secure video
playback. Add the necessary aliases to the clk_lookup table.

(cherry picked from commit 966922b3dc1649163c699e9b10da236341420aaf)

Change-Id: Ibdaf3d1f05aa0dd3e1feb0a5f2a07892b0eba586
Signed-off-by: Riaz Ur Rahaman <riazr@codeaurora.org>
msm: vidc: Enable CP for 8660

Set secure_session flag using a dedicated function.For secure session
the order in the open call is first to open the client
followed by calling the secure session. In release the unsecure of session
needs to be done before closing the client.

(cherry picked from commit 766f87ae9589bf9db1135077e9a8c03b3ba05c78)

Change-Id: Icaed4b6e860b470a15c75b071316dc5393905e16
Signed-off-by: Riaz Ur Rahaman <riazr@codeaurora.org>
Bluetooth: Lock sockets when closing HCI device

When a Bluetooth device is powered down while RFCOMM connections are
open, there are race conditions where RFCOMM tries to use an HCI
connection after the data structures have been deleted.  Since the
powerdown procedure runs in process context, it is possible to lock
sockets before accessing them to close connections.  This change adds
that locking, which will serialize socket access between processors
during powerdown.

CRs-fixed: 336893
Signed-off-by: Mat Martineau <mathewm@codeaurora.org>
(cherry picked from commit 3b9239a8f435f80a07364fdaefb5490197fb1079)

Change-Id: Ib60748e380b16b640be94ac6bc575c23748b0114
Signed-off-by: Ram Kumar Chakravarthy Chebathini <rcheba@codeaurora.org>
msm_fb: hdmi: check for multiple hpd on/off calls

HPD on/off may be called from userspace and from
kernel asynchronously which may result in system
crash or reset. Returning in case HPD is already on/off.

CRs-Fixed: 333739
Signed-off-by: Ajay Singh Parmar <aparmar@codeaurora.org>
(cherry picked from commit 14b56ad8f78a974de534aa02523624304983acfc)

Change-Id: I8f1d3ce5f0bdadc5b11dc161f224f6d4165777f8
Signed-off-by: Ram Kumar Chakravarthy Chebathini <rcheba@codeaurora.org>
msm_fb: display: initialize is_flag variable

This local variable needs to have init value, otherwize it is always
true, possible for mdp4_overlay_perf_level to return incorrect value.

CRs-fixed: 338543
Signed-off-by: Huaibin Yang <huaibiny@codeaurora.org>
(cherry picked from commit e5c9f6e5f9fe550e228cc5b34dbde086b151a613)

Change-Id: Ie8d93808f7f07b6606bbf421dd57a58b7ed50142
Signed-off-by: Ram Kumar Chakravarthy Chebathini <rcheba@codeaurora.org>
Revert "Oh my - RIP Daz's G300"

This reverts commit 7dff41063abc8c571169120add9300386f88c8c2.
defconfig: mmc: Enable CONFIG_MMC_TEST for all MSM targets

Now that all the test cases in mmc_test.c run as expected
on MSM targets, enable CONFIG_MMC_TEST as kernel module to
test SD/MMC cards.

CRs-Fixed: 344293
Signed-off-by: Sujit Reddy Thumma <sthumma@codeaurora.org>
(cherry picked from commit 61c0aacbd3683d09bb86161744610dfebe9e7cc6)

Change-Id: Idc89b5573932549fa02e937d0042397f04ddd788
Signed-off-by: Ram Kumar Chakravarthy Chebathini <rcheba@codeaurora.org>
wcnss: remove LVS1 vote from APPS

LVS1 is now turned ON by bootloader; and APPS don't need to vote for this.
RPM was turning ON this rail irrespective of any votes, it doesn't need
to do that anymore.

CRs-fixed: 341984
Signed-off-by: Sameer Thalappil <sameert@codeaurora.org>
(cherry picked from commit e187c3d85bebcfa9177cd0bd0a345ffd97fa75f6)

Conflicts:

	drivers/net/wireless/wcnss/wcnss_riva.c

Change-Id: Id40bfb2c9bcbbd6c7b9a82360a55903153681df0
Signed-off-by: Ram Kumar Chakravarthy Chebathini <rcheba@codeaurora.org>
ASoC: msm: avoid routing setup on established path

During voice call, it was found that ADM COPP is left opened.
Since there is no music playback nor recording, ADM COPP should
not be opened. The problem is due to user-space application issue
mixer command again to join front-end and back-end when front-end
and back-end are already joined and active. PCM routing driver
just blindly create ADM COPP again as the condition of active
front-end and back-end is met. Update logic to avoid routing
setup twice.

CRs-fixed: 339027
Signed-off-by: Patrick Lai <plai@codeaurora.org>
(cherry picked from commit 6231458cedbfae1bb96f04046cf470b8ece42c6a)

Change-Id: I91a5e5bd2f60b245c837cb185f88c4fc75e456a9
Signed-off-by: Ram Kumar Chakravarthy Chebathini <rcheba@codeaurora.org>
mmc: msm_sdcc: Power down slots after reboot

Some reboot methods (eg. adb reboot) may not power
down SDCC slots. This can result in cards being
in unexpected states after reboot. Explicitly reset
slot voltage regulator on reboot.

CRs-Fixed: 341840
Change-Id: I8cdb52bc58e34900378af468794760653f3babad
Signed-off-by: Oluwafemi Adeyemi <aadeyemi@codeaurora.org>
ASoC: neo1973: fix neo1973 wm8753 initialization

commit b2ccf065f7b23147ed135a41b01d05a332ca6b7e upstream.

The neo1973 driver had wrong codec name which prevented the "sound card"
from appearing.

Signed-off-by: Denis 'GNUtoo' Carikli <GNUtoo@no-log.org>
Signed-off-by: Mark Brown <broonie@opensource.wolfsonmicro.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
aio: fix the "too late munmap()" race

commit c7b285550544c22bc005ec20978472c9ac7138c6 upstream.

Current code has put_ioctx() called asynchronously from aio_fput_routine();
that's done *after* we have killed the request that used to pin ioctx,
so there's nothing to stop io_destroy() waiting in wait_for_all_aios()
from progressing.  As the result, we can end up with async call of
put_ioctx() being the last one and possibly happening during exit_mmap()
or elf_core_dump(), neither of which expects stray munmap() being done
to them...

We do need to prevent _freeing_ ioctx until aio_fput_routine() is done
with that, but that's all we care about - neither io_destroy() nor
exit_aio() will progress past wait_for_all_aios() until aio_fput_routine()
does really_put_req(), so the ioctx teardown won't be done until then
and we don't care about the contents of ioctx past that point.

Since actual freeing of these suckers is RCU-delayed, we don't need to
bump ioctx refcount when request goes into list for async removal.
All we need is rcu_read_lock held just over the ->ctx_lock-protected
area in aio_fput_routine().

Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
Reviewed-by: Jeff Moyer <jmoyer@redhat.com>
Acked-by: Benjamin LaHaise <bcrl@kvack.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
aio: fix io_setup/io_destroy race

commit 86b62a2cb4fc09037bbce2959d2992962396fd7f upstream.

Have ioctx_alloc() return an extra reference, so that caller would drop it
on success and not bother with re-grabbing it on failure exit.  The current
code is obviously broken - io_destroy() from another thread that managed
to guess the address io_setup() would've returned would free ioctx right
under us; gets especially interesting if aio_context_t * we pass to
io_setup() points to PROT_READ mapping, so put_user() fails and we end
up doing io_destroy() on kioctx another thread has just got freed...

Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
Acked-by: Benjamin LaHaise <bcrl@kvack.org>
Reviewed-by: Jeff Moyer <jmoyer@redhat.com>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
PCI: ignore pre-1.1 ASPM quirking when ASPM is disabled

commit 4949be16822e92a18ea0cc1616319926628092ee upstream.

Right now we won't touch ASPM state if ASPM is disabled, except in the case
where we find a device that appears to be too old to reliably support ASPM.
Right now we'll clear it in that case, which is almost certainly the wrong
thing to do. The easiest way around this is just to disable the blacklisting
when ASPM is disabled.

Signed-off-by: Matthew Garrett <mjg@redhat.com>
Signed-off-by: Jesse Barnes <jbarnes@virtuousgeek.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
firewire: cdev: fix 32 bit userland on 64 bit kernel compat corner cases

commit 9c1176b6a28850703ea6e3a0f0c703f6d6c61cd3 upstream.

Clemens points out that we need to use compat_ptr() in order to safely
cast from u64 to addresses of a 32-bit usermode client.

Before, our conversion went wrong
  - in practice if the client cast from pointer to integer such that
    sign-extension happened, (libraw1394 and libdc1394 at least were not
    doing that, IOW were not affected)
or
  - in theory on s390 (which doesn't have FireWire though) and on the
    tile architecture, regardless of what the client does.
The bug would usually be observed as the initial get_info ioctl failing
with "Bad address" (EFAULT).

Reported-by: Carl Karsten <carl@personnelware.com>
Reported-by: Clemens Ladisch <clemens@ladisch.de>
Signed-off-by: Stefan Richter <stefanr@s5r6.in-berlin.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
firewire: core: handle ack_busy when fetching the Config ROM

commit aaff12039ffd812d0c8bbff50b87b6f1f09bec3e upstream.

Some older Panasonic made camcorders (Panasonic AG-EZ30 and NV-DX110,
Grundig Scenos DLC 2000) reject requests with ack_busy_X if a request is
sent immediately after they sent a response to a prior transaction.
This causes firewire-core to fail probing of the camcorder with "giving
up on config rom for node id ...".  Consequently, programs like kino or
dvgrab are unaware of the presence of a camcorder.

Such transaction failures happen also with the ieee1394 driver stack
(of the 2.4...2.6 kernel series until 2.6.36 inclusive) but with a lower
likelihood, such that kino or dvgrab are generally able to use these
camcorders via the older driver stack.  The cause for firewire-ohci's or
firewire-core's worse behavior is not yet known.  Gap count optimization
in firewire-core is not the cause.  Perhaps the slightly higher latency
of transaction completion in the older stack plays a role.  (ieee1394:
AR-resp DMA context tasklet -> packet completion ktread -> user process;
firewire-core: tasklet -> user process.)

This change introduces retries and delays after ack_busy_X into
firewire-core's Config ROM reader, such that at least firewire-core's
probing and /dev/fw* creation are successful.  This still leaves the
problem that userland processes are facing transaction failures.
gscanbus's built-in retry routines deal with them successfully, but
neither kino's nor dvgrab's do ever succeed.

But at least DV capture with "dvgrab -noavc -card 0" works now.  Live
video preview in kino works too, but not actual capture.

One way to prevent Configuration ROM reading failures in application
programs is to modify libraw1394 to synthesize read responses by means
of firewire-core's Configuration ROM cache.  This would only leave
CMP and FCP transaction failures as a potential problem source for
applications.

Reported-and-tested-by: Thomas Seilund <tps@netmaster.dk>
Reported-and-tested-by: René Fritz <rene@colorcube.de>
Signed-off-by: Stefan Richter <stefanr@s5r6.in-berlin.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
rt2x00: fix random stalls

commit 3780d038fdf4b5ef26ead10b0604ab1f46dd9510 upstream.

Is possible that we stop queue and then do not wake up it again,
especially when packets are transmitted fast. That can be easily
reproduced with modified tx queue entry_num to some small value e.g. 16.

If mac80211 already hold local->queue_stop_reason_lock, then we can wait
on that lock in both rt2x00queue_pause_queue() and
rt2x00queue_unpause_queue(). After drooping ->queue_stop_reason_lock
is possible that __ieee80211_wake_queue() will be performed before
__ieee80211_stop_queue(), hence we stop queue and newer wake up it
again.

Another race condition is possible when between rt2x00queue_threshold()
check and rt2x00queue_pause_queue() we will process all pending tx
buffers on different cpu. This might happen if for example interrupt
will be triggered on cpu performing rt2x00mac_tx().

To prevent race conditions serialize pause/unpause by queue->tx_lock.

Signed-off-by: Stanislaw Gruszka <sgruszka@redhat.com>
Acked-by: Gertjan van Wingerde <gwingerde@gmail.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
vfs: fix return value from do_last()

commit 7f6c7e62fcc123e6bd9206da99a2163fe3facc31 upstream.

complete_walk() returns either ECHILD or ESTALE.  do_last() turns this into
ECHILD unconditionally.  If not in RCU mode, this error will reach userspace
which is complete nonsense.

Signed-off-by: Miklos Szeredi <mszeredi@suse.cz>
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>