USB: diag_bridge: Fix a possible freed memory access

The platform device is freed in disconnect.  Don't access pdev
in diag_bridge_delete() which gets called after disconnect. Store
pdev->id in the corresponding driver's private structure.

CRs-Fixed: 470151
Change-Id: I2d97b508f227d6ccc3a87e03481293fa1054bbbc
Signed-off-by: Pavankumar Kondeti <pkondeti@codeaurora.org>
msm: kgsl: fix paren placement leading to fence timeout

The incorrect paren placement can lead to a fence timeout
because the last_timestamp is always written. As a result
the last_timestamp could be corrupted by writing an old
value leading to a future timestamp_cmp indicating that a
signaled sync pt was unsignaled.

Change-Id: I4650a467bfdd98a905f86fbec7d833596c67ba19
Signed-off-by: Jeff Boody <jboody@codeaurora.org>
diag: Bring diag up to date

diag on A-Family mainline is out of date. This change
brings the diag code up to date. This change includes
the following changes:

1. diag: dci: Add new Logs and Events API for DCI
2. diag: dci: Clear DCI Cleint Event/Log mask on Exit
3. diag: dci: Process DCI packet during USB disconnect
4. diag: Fix diag hdlc decoding support for messages starting with 0x7e
5. diag: dci: Remove Event Code from DCI Event
6. diag: Fix incorrect response for Log On Demand request
7. diag: Add concurrency protection to writes on smd data channels
8. diag: Add support for sending DIAG_CTRL_MSG_DIAG_MODE
9. diag: Add Support for Callback mode to communicate with remote processors

Change-Id: Ic61bd3408af4533e5d86d73da73100c3f6c5f215
Signed-off-by: Dixon Peterson <dixonp@codeaurora.org>
gpu: ion: Minimize allocation fallback delay

When we allocate from iommu heap we first try to allocate 1M pages. If
that fails we try 64K pages, which falls back to 4K pages. However,
we don't want to incur too much overhead when allocating with fallbacks
so we don't want the higher order page allocation to retry, perform
reclaim, or run memory compaction.

Configure the GFP flags to ensure that when we allocate pages greater
than order 0 we don't try to do any retries, reclaim, access emergency
pools, or run memory compaction. This will ensure lower memory allocation
latency for applications.

CRs-Fixed: 470389
Change-Id: Ibb3483dddbedbc733a1f7968821e7bc47bedffcd
Signed-off-by: Olav Haugan <ohaugan@codeaurora.org>
power: pm8921-bms: Prevent SoC from rising during discharge

In a previous patch, scale_soc_while_chg was made to not be called when
catch_up_sec equals zero to prevent a kernel divide by zero bug.

However, this caused SoC to increase at times with multiple calls to
calculate_state_of_charge in quick succession.

Fix this by always calling scale_soc_while_chg and skip calculations only
when catch_up_sec is equal to zero.

Change-Id: Ic8c459aea41fde7f7b8762c51c3da71274bed16e
Signed-off-by: Xiaozhe Shi <xiaozhes@codeaurora.org>
power: pm8921-bms: restrict soc decrease to one percent

The calculated soc could decrease up to 3% within one
calculation period. This will happen when UUC and CC increase
by 1% percent while the adjusting algorithm reduces the OCV
to cause RC to decrease by 1%.

Update the reporting side of the code to restrict the decrease
of soc by 1%. There will be ample time to catch up to calculated
soc.

Importantly, when the device is resumed after a long time, we don't
want to restrict the soc decrease. So when the device goes to suspend
forget the last soc reported so the next soc report is unrestricted.

Change-Id: I100516237ee9ab4176ca29c067f094db200652f8
Signed-off-by: Abhijeet Dharmapurikar <adharmap@codeaurora.org>
power: pm8921-bms: introduce configurable corrections

There are situations when the corrections can cause linearity issues.
Provide a scheme to limit the corrections via a configurable parameters.
The corrections were introduced to prevent battery dipping below UVLO.
If the battery were in the flat portion of the SOC curve a small error
in OCV measurement could drift the SOC by a large amount. Corrections
are important if the OCV falls in this range. Hence introduce two
parameters to limit the corrections based on a OCV threshold - one when
it is above 3.8 volts, where corrections could be low and the other
when the OCV is lower and 3.8 (flat portion) where corrections should be
high.

Also there are instances when the SOC appears stuck at 1% for a long
time. This is because the algorithm doesn't allow the soc to drop to 0%
if the estimated soc is high. Provide a configurable level for the
estimated SOC below which, the calculated soc can go to 0%.

Change-Id: I265e1ea41681813ec6add6eea2a440c6e239a5dc
Signed-off-by: Abhijeet Dharmapurikar <adharmap@codeaurora.org>
power: pm8921-bms: update correction algorithm

Correct only when the soc estimate is lower than 15. This way we won't
affect linearity and accuracy for most part. The corrections will
come in only when the soc est gets low.

Change-Id: I0661c9a7b1e45610ca4e922edacac0f7cb3f388a
Signed-off-by: Abhijeet Dharmapurikar <adharmap@codeaurora.org>
power: pm8921-bms: api for battery insertion/removal

Provide api to clean up the history values the driver remembers to
report the soc. These apis will be called when the battery is removed.
Similarly provide api to initiate battery SOC calculations upon battery
insertion.

Change-Id: Ie9f3f5f45c789efc2ba6d39226401691912c764c
Signed-off-by: Abhijeet Dharmapurikar <adharmap@codeaurora.org>
power: pm8921-charger: tune IR compensation algorithm

It was observed that the IR compensation scheme was overcharging the
battery and based on the battery type and inaccuracies in the adc
readings it could overcharge the battery to a point where the protection
circuits of the battery would kick in. Prevent this by changing the
round up method of compensating to a round down method.

Also it was observed that a down correction causes the battery terminal
voltage to drop even further - this was because when vddmax is lowered
it results in the battery consuming less current bringing the terminal
voltage even lower. The algorithm quickly adds an up correction to the
vddmax the next time around. Add some hysteresis in the scheme i.e. don't
increase the vddmax unless the battery voltage at the terminals is below
the desired voltage by 13mV (instead of 10).

Change-Id: I2a908457f5a693216e55c0928043c433305a22cb
Signed-off-by: Abhijeet Dharmapurikar <adharmap@codeaurora.org>
power: pm8xxx-ccadc: implement quick calibration

There are certain systems that wakeup every so often to do some
housekeeping work. We don't want to run a full calibration
when the system wakeups.

For such systems runs a quick calibration with just two samples.
Use the periodic_wakeup flag to indicate such a system.

CRs-Fixed: 454221
Change-Id: Ifc86414f7fab4d0921e3289d6e52b9e077a1f625
Signed-off-by: Abhijeet Dharmapurikar <adharmap@codeaurora.org>
msm_serial_hs: Cleanup code to configure/unconfigure UART GPIOs

With current approach UART GPIOs are configure/unconfigure from
board files by using GPIOLib APIs. UART driver uses gpio_config
pdata based function pointer to call per uart device related API
from board file for the same. Hence correct this approach and
pass only UART GPIOs numbers to UART driver using pdata and
configure/unconfigure those GPIOs using GPIOLib APIs once UART
port is being opened and closed respectively.

CRs-Fixed: 460961
Change-Id: I4bb007b2b476525cb50dd2eb5788c735aae0e32d
Signed-off-by: Mayank Rana <mrana@codeaurora.org>
msm_fb: display: fix iommu page fault when iommu buffer freed

There has possibility that pipe commit come very close to next vsync.
This may cause two consecutive pipe_commits happen within same vsync
period which cause iommu page fault when previous iommu buffer is
freed since mdp stil fetching it. Set ION_IOMMU_UNMAP_DELAYED flag
at ion_map_iommu() to add delay un mapping iommu buffer to fix this problem.
Otherwise four buffer mechanism is needed to avoid this problem..
Also ion_unmap_iommu() may take long time to free an ion buffer. Move
mdp4_overlay_iommu_unmap_freelist(mixer) called after stage_commit()
to increase chance to have pipe_commit (up to stage_commit) is completed
within same vsync period
This patch also fix an potential race condition at wait_for_completion
between show_event thread and wait4vsync thread.

Change-Id: I089950ac61c0bd3c4207b8925817577e42fbb258
Signed-off-by: Kuogee Hsieh <khsieh@codeaurora.org>
defconfig: msm8960: Enable IPC Router Security feature

This feature will enforce the security policies as configured by the
user-space security script.

Change-Id: I641df5b996c7774c1a1c96bc554846360f2863a3
Signed-off-by: Karthikeyan Ramasubramanian <kramasub@codeaurora.org>
ASoC: msm8960: Fix button detection voltage thresholds

Recent measurements show that the button threshold voltages
have changed. Adjust the button voltages accordingly.

CRs-fixed: 450688
CRs-fixed: 456196
Change-Id: I057b84b670768b8028c22bbbe25b337f77624a30
Signed-off-by: Simmi Pateriya <simmip@codeaurora.org>
tspp: fix tspp_close_channel to clean channel filters

Fix tspp_close_channel to clean all relevant channel filters from both
filter tables, regardless of channel source.

Change-Id: I4f725f4ea8d3cf45ebb46b338d54bd346893c310
CRs-Fixed: 468184
Signed-off-by: Liron Kuch <lkuch@codeaurora.org>
msm_fb: display: prepare clocks before enable AHB clock

Clocks need to be prepared before enabled and unprepared after
clock disabled.

CRs-fixed: 466843
Change-Id: I5180c98a2c5fd4bd867272ee1d2bf274ff15d215
Signed-off-by: Kuogee Hsieh <khsieh@codeaurora.org>
msm_fb: display: silent blending error warning message

If there had no any pipe blending stage changes, then do not
call belnding set up to avoid unnecessary warning messges.

CRs-fixed: 467556
Change-Id: I07520b3b0917375c41405e736dcb9eb8a3daddc1
Signed-off-by: Kuogee Hsieh <khsieh@codeaurora.org>
msm: camera: Set mctl client to NULL after destroy

After ion client is destroyed, mctl client is set
to NULL to avoid possibility of invalide client reuse.

Change-Id: Iacd752608affa2f17706d449200ad3fb9b650090
CRs-Fixed: 466520
Signed-off-by: Raju P.L.S.S.S.N <rplsssn@codeaurora.org>
usb: gadget: u_ether: Fix memory corruption in TX path

When data aggregation is enabled, multiple skb buffers are copied
into a single USB request buffer.  When ever a USB request queue
is failed, make sure that req->length is reset to 0.  Otherwise
when the same request is used again, the stale length field is used
to access the request buffer.  This would lead to memory corruption.

The xmit function keeps the partial request at the beginning of the
queue.  Always put the idle request at the back of the queue.

CRs-Fixed: 469436
Change-Id: Idcd31e667b0bf261ab9a88f4a34464ccdf503e1b
Signed-off-by: Pavankumar Kondeti <pkondeti@codeaurora.org>