nl80211/cfg80211: add VHT MCS support

Add support for reporting and calculating VHT MCSes.

Note that I'm not completely sure that the bitrate
calculations are correct, nor that they can't be
simplified.

Change-Id: Id4c132850a85ff59f0fc16396763ed717689bec0
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Git-commit: db9c64cf8d9d3fcbc34b09d037f266d1fc9f928c
Git-repo:
git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
Signed-off-by: Sameer Thalappil <sameert@codeaurora.org>
msm_fb: display: clean pipes from commit queue at suspend

There has possibility that pipes pending at queue and suspend
comes without commit executed. At resume, pipes pending at queue
will be committed with new pipes just added which may cause iommu
page fault due to pipes may had been move to other mixer. This
patch remove pipes from pending queue at suspend.

CRs-fixed: 440254
Change-Id: If6a142d4c55453c0ceacc677399f58570abe47b8
Signed-off-by: Kuogee Hsieh <khsieh@codeaurora.org>

Conflicts:

	drivers/video/msm/mdp4_overlay_dsi_video.c
	drivers/video/msm/mdp4_overlay_dtv.c
	drivers/video/msm/mdp4_overlay_lcdc.c
	drivers/video/msm/mdp4_overlay_writeback.c

Signed-off-by: Vivek Panwar <vpanwa@codeaurora.org>
USB: Dump usb info during memory access violation

USB is accessing an invalid memory which results in EBI error.
To find the endpoint information and the address being accessed,
dump all the usb request info required for debugging memory access
violation issue from APP's proc using the trace framework.

CRs-Fixed: 430455
Change-Id: Ie99c31f43dfa9858a9ec2756903574888629e341
Signed-off-by: Chiranjeevi Velempati <cvelempa@codeaurora.org>
Signed-off-by: Rajkumar Raghupathy <raghup@codeaurora.org>
Merge "nl80211/cfg80211: add VHT MCS support"
msm: timer: Don't check state of clock while setting next timer event

The commit fd6681cd4d0782f6e6ac918ab337016f59c2520b introduced
a silent bug that incorrectly checks state of the clock while
setting the next timer event. The bug manifests only during
failure code path of msm idle operation, which is very rare.
Due to the bug, the driver isn't be able to reprogram the timer
device.

CRs-fixed: 468902
Change-Id: I4ec14ea9c3a5d318ef98d2b13bd55efd89538df5
Signed-off-by: Jay Chokshi <jchokshi@codeaurora.org>
Merge "USB: Dump usb info during memory access violation"
Merge "msm: timer: Don't check state of clock while setting next timer event"
Revert "msm_fb: display: wait4vsync before set suspend flag"

This reverts commit 38320721c3e64b210219fe77a35919afdee58a34

Change-Id: Ied0443f929d1101424db9fb62fc98cac9afb8913
Merge "msm_fb: display: clean pipes from commit queue at suspend"
Merge "Revert "msm_fb: display: wait4vsync before set suspend flag""
ipv4: fix the rcu race between free_fib_info and ip_route_output_slow

We hit a kernel OOPS.

<3>[23898.789643] BUG: sleeping function called from invalid context at
/data/buildbot/workdir/ics/hardware/intel/linux-2.6/arch/x86/mm/fault.c:1103
<3>[23898.862215] in_atomic(): 0, irqs_disabled(): 0, pid: 10526, name:
Thread-6683
<4>[23898.967805] HSU serial 0000:00:05.1: 0000:00:05.2:HSU serial prevented me
to suspend...
<4>[23899.258526] Pid: 10526, comm: Thread-6683 Tainted: G        W
3.0.8-137685-ge7742f9 #1
<4>[23899.357404] HSU serial 0000:00:05.1: 0000:00:05.2:HSU serial prevented me
to suspend...
<4>[23899.904225] Call Trace:
<4>[23899.989209]  [<c1227f50>] ? pgtable_bad+0x130/0x130
<4>[23900.000416]  [<c1238c2a>] __might_sleep+0x10a/0x110
<4>[23900.007357]  [<c1228021>] do_page_fault+0xd1/0x3c0
<4>[23900.013764]  [<c18e9ba9>] ? restore_all+0xf/0xf
<4>[23900.024024]  [<c17c007b>] ? napi_complete+0x8b/0x690
<4>[23900.029297]  [<c1227f50>] ? pgtable_bad+0x130/0x130
<4>[23900.123739]  [<c1227f50>] ? pgtable_bad+0x130/0x130
<4>[23900.128955]  [<c18ea0c3>] error_code+0x5f/0x64
<4>[23900.133466]  [<c1227f50>] ? pgtable_bad+0x130/0x130
<4>[23900.138450]  [<c17f6298>] ? __ip_route_output_key+0x698/0x7c0
<4>[23900.144312]  [<c17f5f8d>] ? __ip_route_output_key+0x38d/0x7c0
<4>[23900.150730]  [<c17f63df>] ip_route_output_flow+0x1f/0x60
<4>[23900.156261]  [<c181de58>] ip4_datagram_connect+0x188/0x2b0
<4>[23900.161960]  [<c18e981f>] ? _raw_spin_unlock_bh+0x1f/0x30
<4>[23900.167834]  [<c18298d6>] inet_dgram_connect+0x36/0x80
<4>[23900.173224]  [<c14f9e88>] ? _copy_from_user+0x48/0x140
<4>[23900.178817]  [<c17ab9da>] sys_connect+0x9a/0xd0
<4>[23900.183538]  [<c132e93c>] ? alloc_file+0xdc/0x240
<4>[23900.189111]  [<c123925d>] ? sub_preempt_count+0x3d/0x50

Function free_fib_info resets nexthop_nh->nh_dev to NULL before releasing
fi. Other cpu might be accessing fi. Fixing it by delaying the releasing.

With the patch, we ran MTBF testing on Android mobile for 12 hours
and didn't trigger the issue.

Thank Eric for very detailed review/checking the issue.

CRs-fixed: 430941
Change-Id: I14480ff9085a8e13fe43ea14bfa53fb7b77384b3
Signed-off-by: Yanmin Zhang <yanmin_zhang@linux.intel.com>
Signed-off-by: Kun Jiang <kunx.jiang@intel.com>
Acked-by: Eric Dumazet <edumazet@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Git-commit: e49cc0da7283088c5e03d475ffe2fdcb24a6d5b1
Git-repo: git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
Signed-off-by: Jay Chokshi <jchokshi@codeaurora.org>
slimbus: Specify number of channels for the group in group handle

Use group handle instead of next element in channel's data structure
to identify how many channels were specified by a client in the group.
That way clients can specify different number of channels for shared
channels, and work with their own client-handle. Note that sequence of
channel still matters (so 2 clients sharing a channel should not
specify channels in different order, otherwise scheduling of the
channels will not be in the correct order)

CRs-Fixed: 415109
Change-Id: Idd636a500ee6449b16648a234b9e76fad21f2fcc
Signed-off-by: Sagar Dharia <sdharia@codeaurora.org>
ASoC: audio: Fix BE not disconnected even codec teardown

Scenario:
When FE1(LowLatency) comes in which opens BE1 and puts it in state
SND_SOC_DPCM_STATE_START. Similarly FE2(LPA) comes in with
connecting to same BE. Now FE2 is in SND_SOC_DPCM_STATE_PREPARE
state and waits for TRIGGER_START. Meanwhile FE1 is closed which
doesn't affect BE1 and FE2 which are connected.
Also, for FE2 pcm_close is called before TRIGGER_START itself.
In such a case, BE1 is not getting disconnected (afe_close is
not called) while Codec is teared down resulting in Slimbus
overflow.

Fix:
Whenever BE1 is found to be in SND_SOC_DPCM_STATE_START state
and FE1 being connected is not started yet, and close sequence
happens for this FE, then allow hw_free to happen for BE1 if
this is the only FE connected to this BE1. This allows BE to be
disconnected which calls afe_close then followed by Codec teardown
not resulting in any Slimbus overflows.

CRs-Fixed: 468118
Change-Id: I03a80a12c1fd0cf09bd2e3dfe1f1eb56589016d3
Signed-off-by: Laxminath Kasam <lkasam@codeaurora.org>
Merge "slimbus: Specify number of channels for the group in group handle"
Merge "ASoC: audio: Fix BE not disconnected even codec teardown"
USB: ci13xxx_udc: Don't free dTD immediately after active bit is cleared

USB controller may access the dTD one more time after clearing the active
bit in token field.  There is a possibility of software freeing it in this
window.  When this happens, USB controller may access incorrect memory and
leads to system level issues.

dTDs are freed when requests are freed by function drivers during
disconnect or unbind.  The above race condition will come into effect only
for zero length packets.  dTDs are dynamically created for sending zero
length packets on IN endpoints.  These dTDs are immediately freed after
active bit is cleared.  Defer this to next dTD completion.  It is safe to
assume that hardware will no longer access the previous dTD when the next
dTD is completed.

Don't allocate/free setup status phase and GET_STATUS data phase requests
dynamically.  Use  one request for both cases and allocate it during bind.

CRs-Fixed: 474557
Change-Id: I5d41c310e1bb35d93b5af7d90a24ce5aab24f5f9
Signed-off-by: Pavankumar Kondeti <pkondeti@codeaurora.org>
Merge "USB: ci13xxx_udc: Don't free dTD immediately after active bit is cleared"
Merge "ipv4: fix the rcu race between free_fib_info and ip_route_output_slow"
msm: 8930, 8960: Remove double reservation of MM_FW heap

Earlier, we used to double reserve MM_FW heap space considering
secure and non-secure use cases require dedicated heap. But
accounting their exclusive use-case, there is no further need
to double reserve. So, remove extra reservation.

CRs-Fixed: 478861
Change-Id: I461eeae33d37446c2378220748ddbdd90269b5d0
Signed-off-by: Chintan Pandya <cpandya@codeaurora.org>
Merge "msm: 8930, 8960: Remove double reservation of MM_FW heap"