Merge "msm: kgsl: prevent race between mmap() and free on timestamp"
Merge "msm: kgsl: add guard page support for imported memory"
Merge "msm: kgsl: fix kgsl_mem_entry refcounting"
Merge "msm: kgsl: Use the correct length when looking for address collision"
Merge "msm: kgsl: Prevent race conditions when freeing memory"
Merge "msm: kgsl: Only reference the rb_node after taking spinlock"
Merge "msm: kgsl: Only initialize process structure once"
Merge "msm: kgsl: Do not hold memory spinlock when calling find region function"
Revert "Revert "ARM: 7169/1: topdown mmap support""

This reverts commit f27e4f0e730b99ca4dabed0b408d96dbf73a8fac.

An alternate fix has been proposed where userspace programs
set ADDR_COMPAT_LAYOUT. Bring back the topdown mmap support.

Change-Id: Ibd6e74d406db3a5ddb609e2d2a7a6e9dc2080eca
Signed-off-by: Laura Abbott <lauraa@codeaurora.org>
msm: ipc: Do not load any subsystem by default

Some users of IPC Router like IPC Router Security Configuration (IRSC)
open up a socket, perform some configuration/lookup operation quickly and
then close the socket. This causes the IPC Router to load a subsystem by
default and then unload it immediately. This behavior causes the subsystem
to lock up sometimes during the boot process.

Remove loading and unloading a subsystem by default during the socket
create and close operation.

CRs-Fixed: 480156
Change-Id: I9c1c01c18a538a462bcf65902e496bc773a03991
Signed-off-by: Karthikeyan Ramasubramanian <kramasub@codeaurora.org>
Signed-off-by: Sridhar Gujje <sgujje@codeaurora.org>
msm: ipc: Load default subsystem under appropriate scenario

Only client and service ports are used for communication with the remote
subsystems. Load the default subsystem only when the clients lookup their
services or when the local services get registered with the IPC Router.

CRs-Fixed: 480156
Change-Id: I18729bb849c656a826de4f67f9ffe159dd3cf5f6
Signed-off-by: Karthikeyan Ramasubramanian <kramasub@codeaurora.org>
Signed-off-by: Sridhar Gujje <sgujje@codeaurora.org>
timer: Don't reinitialize the cpu base lock during CPU_UP_PREPARE

An inactive timer's base can refer to a offline cpu's base.

In the current code, cpu_base's lock is blindly reinitialized
each time a CPU is brought up. If a CPU is brought online
during the period that another thread is trying to modify an
inactive timer on that CPU with holding its timer base lock,
then the lock will be reinitialized under its feet. This leads
to following SPIN_BUG().

<0> BUG: spinlock already unlocked on CPU#3, kworker/u:3/1466
<0> lock: 0xe3ebe000, .magic: dead4ead, .owner: kworker/u:3/1466,
 .owner_cpu: 1
<4> [<c0013dc4>] (unwind_backtrace+0x0/0x11c) from [<c026e794>]
(do_raw_spin_unlock+0x40/0xcc)
<4> [<c026e794>] (do_raw_spin_unlock+0x40/0xcc) from [<c076c160>]
(_raw_spin_unlock+0x8/0x30)
<4> [<c076c160>] (_raw_spin_unlock+0x8/0x30) from [<c009b858>]
(mod_timer+0x294/0x310)
<4> [<c009b858>] (mod_timer+0x294/0x310) from [<c00a5e04>]
(queue_delayed_work_on+0x104/0x120)
<4> [<c00a5e04>] (queue_delayed_work_on+0x104/0x120) from [<c04eae00>]
(sdhci_msm_bus_voting+0x88/0x9c)
<4> [<c04eae00>] (sdhci_msm_bus_voting+0x88/0x9c) from [<c04d8780>]
(sdhci_disable+0x40/0x48)
<4> [<c04d8780>] (sdhci_disable+0x40/0x48) from [<c04bf300>]
(mmc_release_host+0x4c/0xb0)
<4> [<c04bf300>] (mmc_release_host+0x4c/0xb0) from [<c04c7aac>]
(mmc_sd_detect+0x90/0xfc)
<4> [<c04c7aac>] (mmc_sd_detect+0x90/0xfc) from [<c04c2504>]
(mmc_rescan+0x7c/0x2c4)
<4> [<c04c2504>] (mmc_rescan+0x7c/0x2c4) from [<c00a6a7c>]
(process_one_work+0x27c/0x484)
<4> [<c00a6a7c>] (process_one_work+0x27c/0x484) from [<c00a6e94>]
(worker_thread+0x210/0x3b0)
<4> [<c00a6e94>] (worker_thread+0x210/0x3b0) from [<c00aad9c>]
(kthread+0x80/0x8c)
<4> [<c00aad9c>] (kthread+0x80/0x8c) from [<c000ea80>]
(kernel_thread_exit+0x0/0x8)

As an example, this particular crash occurred when CPU #3 is executing
mod_timer() on an inactive timer whose base is refered to offlined CPU #2.
The code locked the timer_base corresponding to CPU #2. Before it could
proceed, CPU #2 came online and reinitialized the spinlock corresponding
to its base. Thus now CPU #3 held a lock which was reinitialized. When
CPU #3 finally ended up unlocking the old cpu_base corresponding to CPU #2,
we hit the above SPIN_BUG().

CPU #0			CPU #3				       CPU #2
------			-------				       -------
.....			 ......				      <Offline>
			mod_timer()
			 lock_timer_base
			  spin_lock_irqsave(&base->lock)

cpu_up(2)		 .....				        ......
							 init_timers_cpu()
.....		 	 spin_unlock_irqrestore(&base->lock)     ......
			   <spin_bug>

Allocation of per_cpu timer vector bases is done only once under
"tvec_base_done[]" check. In the current code, spinlock_initialization
of base->lock isn't under this check. When a CPU is up each time the base
lock is reinitialized. Move base spinlock initialization under the check.

CRs-Fixed: 471127
Change-Id: I73b48440fffb227a60af9180e318c851048530dd
Signed-off-by: Tirupathi Reddy <tirupath@codeaurora.org>
Signed-off-by: Sridhar Gujje <sgujje@codeaurora.org>
diag: Fix diag crash due to memory corruption

Diag allocates memory based on the count received from userspace.
Add check to validate the memory pointer before derefencing it.

CRs-Fixed: 487981
Change-Id: Ibfee22d02bb2312192de7c811d9917ecab728269
Signed-off-by: Ashay Jaiswal <ashayj@codeaurora.org>
Signed-off-by: Sridhar Gujje <sgujje@codeaurora.org>
msm: pm: send notification only for SPC and PC

Today the pm notification is sent for all the power
modes of each CPU. This is not necessary for shallow
power modes.

This change is to send the notification for only
standalone power collapse for each core and idle
power collapse of core0.

Change-Id: I9b3df3d72e43d645387c94b1b9c5da3bcf2f2e5f
Signed-off-by: Venkat Devarasetty <vdevaras@codeaurora.org>
Signed-off-by: Sridhar Gujje <sgujje@codeaurora.org>
msm: audio: qdsp6v2: Fix for kernel crash during stability

- Userspace calling AYSN_READ during flush, READ_DONE ack for
  this is coming after FLUSH_DONE which is hitting BUG_ON as
  buffers are removed from in_queue/out_queue during flush.
- Fix is to avoid sending READ requests to DSP until flush
  is complete.

CRs-Fixed: 485288
Change-Id: Ia2a64471a3507b3f5565b695c40cc6dd9081930d
Signed-off-by: Deepa Madiregama <dmadireg@codeaurora.org>
Signed-off-by: Sridhar Gujje <sgujje@codeaurora.org>
media: dvb: Fix parsing of SDMX results

When playing from memory, it may happen that demux thread
is stalled while parsing SDMX results due to PULL mode.
While thread is stalled it is possible that user asked to
add new filter and therefore the SDMX filter count increases.

When thread gets back from stalling, it may parse additional
filters result even-though they were not processed by SDMX yet,
hence parsing un-initialized data.

Change-Id: Idb9430ec07f5869585ed1ae9ab3d43c4d31ff4d2
Signed-off-by: Hamad Kadmany <hkadmany@codeaurora.org>
Signed-off-by: Sridhar Gujje <sgujje@codeaurora.org>
arm: board-8930-pmic: Pass WLED compensation resistor value

Pass WLED compensation resitor value via platform data.

Change-Id: I318b2edc817f50181bd2b7c08cb01b15b72cc5e6
Signed-off-by: Shantanu Jain <shjain@codeaurora.org>
Signed-off-by: Sridhar Gujje <sgujje@codeaurora.org>
led: leds-pm8xxx: Add support to control compensation resistor

Add support to control compensation resistor of WLED
passed from the board file platform data.

Change-Id: Id5f36d49a532d8216ea9bc1415e67135d40ee18d
Signed-off-by: Shantanu Jain <shjain@codeaurora.org>
Signed-off-by: Sridhar Gujje <sgujje@codeaurora.org>
power: pm8921-bms: Update the FCC learning algorithm

1. Add configurable parameters to
	- enable/disable fcc learning
	- minimum soc to start FCC learning
	- minimum ocv (pc) to start FCC learning
	- minimum cycles to update fcc vs temp. table

2. New FCC is calculated using the cc count-
	FCC_NEW = (cc_end - cc_start) / (soc2 - soc1)
	cc_end = CC count when charing ends
	cc_start = CC count when charging starts
	soc1, soc2 = starting and ending SOC_rbatt value

3. Add a new sysfs entries to update the learnt fcc values
   to userspace. These values are restored back on
   reboot.

CRs-Fixed: 417288
Change-Id: I0dc713d59ef9c45f96b9f0b5844252758bd09320
Signed-off-by: Anirudh Ghayal <aghayal@codeaurora.org>
Signed-off-by: Sridhar Gujje <sgujje@codeaurora.org>
defconfig: wcnss: Enable wcnss pre-alloc memory

Enable support for pre-alloc memory for WLAN driver.

Change-Id: I0a18cfcfeb23538e6e0b2f5144f686b26170e1d1
CRs-Fixed: 369983
Signed-off-by: Sameer Thalappil <sameert@codeaurora.org>
Signed-off-by: Sridhar Gujje <sgujje@codeaurora.org>