arm: Don't disable interrupts during WFE fixup

Disabling interrupts during the Krait WFE fixup can result
in deadlock if a thread tries to acquire a spinlock that is
released from an interrupt context. Instead of disabling
interrupts, modify the interrupt handler to reset the fixup
condition to put the processor into a safe state in the
event that the interrupt came in during the fixup window.

CRs-Fixed: 383670
Signed-off-by: Stepan Moskovchenko <stepanm@codeaurora.org>
(cherry picked from commit 1fd137804b489f7a0b4103d846cda13a07e26cdf)

Change-Id: Ie6d1adc42cc0a68bbbaeaa35f18cdda074d66cd5
Signed-off-by: Srivalli Oguri <oguri@codeaurora.org>
Bluetooth: Fix RFCOMM session reference counting issue

There is an imbalance in the rfcomm_session_hold / rfcomm_session_put
operations which causes the following crash:

[  685.010159] BUG: unable to handle kernel paging request at 6b6b6b6b
[  685.010169] IP: [<c149d76d>] rfcomm_process_dlcs+0x1b/0x15e
[  685.010181] *pdpt = 000000002d665001 *pde = 0000000000000000
[  685.010191] Oops: 0000 [#1] PREEMPT SMP
[  685.010247]
[  685.010255] Pid: 947, comm: krfcommd Tainted: G         C  3.0.16-mid8-dirty #44
[  685.010266] EIP: 0060:[<c149d76d>] EFLAGS: 00010246 CPU: 1
[  685.010274] EIP is at rfcomm_process_dlcs+0x1b/0x15e
[  685.010281] EAX: e79f551c EBX: 6b6b6b6b ECX: 00000007 EDX: e79f40b4
[  685.010288] ESI: e79f4060 EDI: ed4e1f70 EBP: ed4e1f68 ESP: ed4e1f50
[  685.010295]  DS: 007b ES: 007b FS: 00d8 GS: 00e0 SS: 0068
[  685.010303] Process krfcommd (pid: 947, ti=ed4e0000 task=ed43e5e0 task.ti=ed4e0000)
[  685.010308] Stack:
[  685.010312]  ed4e1f68 c149eb53 e5925150 e79f4060 ed500000 ed4e1f70 ed4e1f80 c149ec10
[  685.010331]  00000000 ed43e5e0 00000000 ed4e1f90 ed4e1f9c c149ec87 0000bf54 00000000
[  685.010348]  00000000 ee03bf54 c149ec37 ed4e1fe4 c104fe01 00000000 00000000 00000000
[  685.010367] Call Trace:
[  685.010376]  [<c149eb53>] ? rfcomm_process_rx+0x6e/0x74
[  685.010387]  [<c149ec10>] rfcomm_process_sessions+0xb7/0xde
[  685.010398]  [<c149ec87>] rfcomm_run+0x50/0x6d
[  685.010409]  [<c149ec37>] ? rfcomm_process_sessions+0xde/0xde
[  685.010419]  [<c104fe01>] kthread+0x63/0x68
[  685.010431]  [<c104fd9e>] ? __init_kthread_worker+0x42/0x42
[  685.010442]  [<c14dae82>] kernel_thread_helper+0x6/0xd

This issue has been brought up earlier here:

https://lkml.org/lkml/2011/5/21/127

The issue appears to be the rfcomm_session_put in rfcomm_recv_ua. This
operation doesn't seem be to required as for the non-initiator case we
have the rfcomm_process_rx doing an explicit put and in the initiator
case the last dlc_unlink will drive the reference counter to 0.

There have been several attempts to fix these issue:

6c2718d Bluetooth: Do not call rfcomm_session_put() for RFCOMM UA on closed socket
683d949 Bluetooth: Never deallocate a session when some DLC points to it

but AFAICS they do not fix the issue just make it harder to reproduce.

Change-Id: I0b8f5b84211a3893c3bac4cce143172c327a7aa2
Signed-off-by: Octavian Purdila <octavian.purdila@intel.com>
Signed-off-by: Gopala Krishna Murala <gopala.krishna.murala@intel.com>
Acked-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Signed-off-by: Srivalli Oguri <oguri@codeaurora.org>
ASoC: wcd9310: enhance mbhc button release detection performance

Enhance button release detection performance by adopting dynamic release
threshold adjusting logic.
Button release is now detected more quickly.

Change-Id: Idad06b673599a5dec53b62ffdab9b9217bd9b3ff
Signed-off-by: Joonwoo Park <joonwoop@codeaurora.org>

Conflicts:

	sound/soc/codecs/wcd9310.c
ASoC: wcd9310: enhance mbhc button press detection performance

If interrupt handler is not quicker than voltage ramp up by button
release, driver requested measurement won't see stable voltage.
Enhance button press detection performance by comparing voltage
measurements from codec hardware only.

CRs-fixed: 376825
Change-Id: Ie52b8a8cb3be3e2de50b8c60a0d3bcd1067de847
Signed-off-by: Joonwoo Park <joonwoop@codeaurora.org>

Conflicts:

	sound/soc/codecs/wcd9310.c
ASoC: wcd9310/9304: Pull down Mic Bias output by default.

If Mic Bias is high Z by default and when the LDOH is enabled,
the Mic Bias output can pull-up to a non-zero voltage if there
is no loading or if the load leakage is very small.  Pulling
down the Mic Bias output so it is not in high Z to eliminate
the floating voltage.

CRs-Fixed: 368898
Signed-off-by: Kuirong Wang <kuirongw@codeaurora.org>
(cherry picked from commit ccb29c6c7e8779ac6574f581d1f930a9a4cf6eb5)

Conflicts:

	sound/soc/codecs/wcd9304.c

Change-Id: I93ab762a9a8b03f003cc23b993fd54dee9b9b886
Signed-off-by: Srivalli Oguri <oguri@codeaurora.org>
msm_fb: display: switch blt mode on/off without turning off TG

Turning off dtv TG may cause blink. MDP requires h/w idle to change
blt mode, turning off TG can make sure mdp h/w is idle. If turning off
TG is not desired, one way to do is to check busy bits of overlay and
dmae and once they are both idle, the mode can be changed.

CRs-fixed: 363717
Signed-off-by: Huaibin Yang <huaibiny@codeaurora.org>
Signed-off-by: Ajay Singh Parmar <aparmar@codeaurora.org>
(cherry picked from commit 43da18d00abc2a61834b6650a49bf7edcf4f4df0)

Conflicts:

	drivers/video/msm/mdp4_overlay_dtv.c

Change-Id: I8aeea1439a83b71e5980080a5396cc9c9fa8556b
Signed-off-by: Ramakrishna Prasad N <crpn@codeaurora.org>
video: msm_fb: Increase display timeout to 2 seconds

One second time out for no frame update, as in current implementation,
does not allow CABL to reach minimum backlight level possible because
histograms dont get generated after one second. So increase time out
period to two seconds which seem to be sufficient for complete black to
complete white and vice versa transitions.

CRs-fixed: 370804
Signed-off-by: Pravin Tamkhane <pravint@codeaurora.org>
Signed-off-by: Carl Vanderlip <carlv@codeaurora.org>
(cherry picked from commit 1bb4edf9242b0397975636a4442318713a53b5e6)

Change-Id: I298dbc94c32035bc7872341a028af979d74fe38f
Signed-off-by: Ramakrishna Prasad N <crpn@codeaurora.org>
msm: devices-msm7x27a: Add panic notifier for 7627a/8625

When panic occurs we want to flush the inner and outer
caches.

Change-Id: I9cb0e4e93a348be508de63363b6761457f1de249
Signed-off-by: Vikas Reddy Pachika <vpachi@codeaurora.org>
bluetooth: Check for hcon during during sock_close

It is possible that during BT OFF operation the hcon
could be released from a tasklet context while we are
trying to send the l2cap disconnect req. Make sure
that hcon is valid before dereferencing it during
l2cap disconnect req.

CRs-fixed: 383345
Signed-off-by: Sunny Kapdi <sunnyk@codeaurora.org>
(cherry picked from commit 059f5ba91071172970d8db0a1a954c57c23e53d8)

Change-Id: Ifa61bf4f3cbe7e62df47adf05e4e4472667d2993
Signed-off-by: Ramakrishna Prasad N <crpn@codeaurora.org>
msm: board-8930: Update the PM8038 MPP init data

PM8038 MPP3 is not used for USB or HDMI control.
Therefore, remove the erroneous MPP initialization.

CRs-fixed: 376505
Signed-off-by: Jay Chokshi <jchokshi@codeaurora.org>
(cherry picked from commit cee3d06b09e1367030c621cdaca553901d41afe8)

Change-Id: Id0883eb1147577256a50a0a95cc0b68da8bd5d62
Signed-off-by: Ramakrishna Prasad N <crpn@codeaurora.org>
msm: kgsl: Do bounds checking on user supplied GPU addresses

Add bounds checking to kgsl_sharedmem_find_region to ensure that GPU
addresses supplied by the user via KGSL_IOCTL_SHAREMEM_FREE and
KGSL_IOCTL_CFF_SYNCMEM are within a valid range for the MMU scheme of
choice.

CRs-Fixed: 380296
Signed-off-by: Jordan Crouse <jcrouse@codeaurora.org>
(cherry picked from commit e22e21d93260cee3aff0dff7247635d9624c8aa5)

Change-Id: Ic0dedbad2d55d1029ff512bc4e7bf3acd1e67841
Signed-off-by: Jordan Crouse <jcrouse@codeaurora.org>
ASoC: msm: update BTSCO rate put function.

The value for the amix command with the numeric strings is
the actual value not the order of the string in the array
of text so the put function has to be updated to handle it.
For example,  the following amix comand:
amix 'Internal BTSCO SampleRatee' 16000'
The value passed from the alsa-lib is not 2, i.e., the 2nd
paramater in the command string:
static const char *btsco_rate_text[] = {"8000", "16000"};
Instead, it is 16000.

CRs-fixed: 364832

Signed-off-by: Kuirong Wang <kuirongw@codeaurora.org>
(cherry picked from commit fd8e0b303ba46207f24a3738f8859e84044833fd)

Conflicts:

	sound/soc/msm/mdm9615.c
	sound/soc/msm/msm8930.c
	sound/soc/msm/msm8960.c

Change-Id: I58156f13bec3e4a297d0d4cecc1bf26fb7c7c040
Signed-off-by: Ramakrishna Prasad N <crpn@codeaurora.org>
msm_fb: display: no early suspend for writeback panel

Writeback panel is not real physical panel and no power consumption
concern, so it is removed from early suspend registration to avoid
open fb2 error during suspend/resume.

CRs-fixed: 371137
Signed-off-by: Huaibin Yang <huaibiny@codeaurora.org>
(cherry picked from commit efb6c143ea951dab6dc72586100999d5b94c1c8d)

Conflicts:

	drivers/video/msm/msm_fb.c

Change-Id: I004cd5f80bf200bb29b992b0fd445e3b7d2f1e35
Signed-off-by: Ramakrishna Prasad N <crpn@codeaurora.org>
power: pm8921-bms: fix ccadc accuracy

The bms ccadc counters are incremented/decremented every 56 ticks of the
sleep clock not 55. Correct the tick count.

Also sleep clock is derived by dividing the 19.2Mhz clock by 586. Hence
the HZ count of the sleep clock should be 32764 instead of 32768. Fix
this too.

Crs-fixed: 381923
Signed-off-by: Abhijeet Dharmapurikar <adharmap@codeaurora.org>
(cherry picked from commit b787b29843f63fcb75700cad8e69afcdd5d7da36)

Change-Id: Iac3a21f7a9ac7a544e4fc7ff0d48aca35d896630
Signed-off-by: Ramakrishna Prasad N <crpn@codeaurora.org>
FMEM: Disable FMEM

Turn off deprecated FMEM.

CRs-fixed: 385962
Signed-off-by: Hanumant Singh <hanumant@codeaurora.org>
(cherry picked from commit 60ceaa1e2dbe6226183b58387c401104df8f4b5d)

Conflicts:

	arch/arm/mach-msm/board-8064.c
	arch/arm/mach-msm/board-8930.c

Change-Id: I4b0c7a24311e360d9540bd6fe9c7931996f4485b
Signed-off-by: Ramakrishna Prasad N <crpn@codeaurora.org>
bluetooth: Add support for LE conn param

Added support to let the userspace know about the updated
LE connection parameters. On receiving successful connection
complete and connection parameters update event from the BT
Controller, send a mgmt event to the userspace bluetoothd.

CRs-fixed: 380271
Signed-off-by: Sunny Kapdi <sunnyk@codeaurora.org>
(cherry picked from commit a42b50244cdb71f93bf842a28b0fc1cecc622c55)

Change-Id: I47594d79bfd6e6774bb060fdb12a019795376a2f
Signed-off-by: Ramakrishna Prasad N <crpn@codeaurora.org>
msm: kgsl: Increase REG_RBBM_CNTL value to 0xFFFF for A200

Increase number of clocks that RBBM will wait before de-asserting
the Register Clock Active signal. This fixes kernel panics during
stability tests on multiple devices

Change-Id: I50ad69f28b50444e88239c2332bd5756db1ae089
CRs-fixed: 372793
Signed-off-by: Rammohan Basavaraju <rammoh@codeaurora.org>
Bluetooth: Avoid putting LE Conn into sniff/active

LE connections don't have sniff/active connection
mode, unlike BR/EDR. Make sure that the link which
has been requested to enter sniff/active mode is not
an LE connection.

CRs-fixed: 376972
Signed-off-by: Sunny Kapdi <sunnyk@codeaurora.org>
(cherry picked from commit 39eaba3542ab177a997762e81963392260f904ca)

Change-Id: Ib25944556e99f7e648a39548be8ca08d7cbd632f
Signed-off-by: Srivalli Oguri <oguri@codeaurora.org>
msm: ipc: Fix race condition between route & close_port operations

QMI Client is closing the interface port with IPC Router, while the
IPC Router is handling an incoming QMI message from modem for that
client. There is a race condition between these two operations. This in
turn leads to IPC Router trying to lock the wakelock which has been
destroyed as part of close operation. IPC Router gains exclusive
access to the interface port information, so that close operation
does not happen in parallel to the route operation.

CRs-Fixed: 367561
Signed-off-by: Karthikeyan Ramasubramanian <kramasub@codeaurora.org>
(cherry picked from commit be9954bc046aa9238f17fd2d420973a273906b81)

Change-Id: Ieff91b8959003a4d19e7c8d6a6aa2f1b39698990
Signed-off-by: Srivalli Oguri <oguri@codeaurora.org>
msm: ipc: Update the work item in the read path

IPC Message Router schedules a work item to read incoming messages
from the remote subsystems. Once a message is read, the work item
queues itself again in the workqueue. The queued work item performs
an uninterruptible wait for further messages. This causes the "loadavg"
to be consistently greater than 1. So refactor the read path such that
the read work item is queued only after the message has arrived.

CRs-Fixed: 383657
Signed-off-by: Karthikeyan Ramasubramanian <kramasub@codeaurora.org>
(cherry picked from commit 872ecd84746547eb5d82c04080439b46fc2426d7)

Change-Id: If91e8738bad8b33f91af55ec69795693e20b3d3e
Signed-off-by: Srivalli Oguri <oguri@codeaurora.org>