msm: bam_dmux: modify DL low memory algorithm

Bam_dmux maintains a pool of dynamically allocated buffers for the BAM DMA
engine to use as destination memory for Downlink (DL) data.  The allocation
requests for the buffers are done using flags to indicate delays are
tolerable and either the memory or an error should be returned immediately
to bam_dmux as the buffers are normally allocated within various hot paths
inside of the driver.  If a low memory allocation failure is encountered
when attempting to replenish the pool of buffers, bam_dmux will either
attempt the memory allocations later when the next scheduled pool refilling
occurs if there is at least one buffer remaining in the pool, or will
schedule a delayed task to retry the buffer allocation until atleast one
buffer can be put into the pool.

This mechanism of handling low memory situations has two flaws.  First, the
allocation type used by bam_dmux does not trigger the standard low memory
recovery mechanism within the memory management subsystem.  Second, the
peripeheral on the otherside do the DMA engine has a limited hardware based
flow control mechanism that will not release flow control with only one
buffer queued to the DMA engine.

To assist in system recovery, and avoid a data stall, create a cold path
that is tolerant of memory allocation delays and is triggered when the hot
path encounters an allocation failure.

CRs-Fixed: 589665
Change-Id: If72b0eaef285ac6dfd99e97bef1cd7df154e3a48
Signed-off-by: Jeffrey Hugo <jhugo@codeaurora.org>
MDP: correct clock calculation logic for up-scaling scenario

Part of yscale calculation logic in mdp4_calc_req_mdp_clk
function is only applicable for downscale scenarios. The
incorrect clock calculation was unnecessarily creating
blt mode requirement even for upscale scenarios.

Change-Id: I036be2ceb2f59fb159885b2d15b208706808198b
Signed-off-by: Nirmal Abraham <nabrah@codeaurora.org>
msm: rpm-regulator-smd: correct use-after-free in rpm_vreg_device_remove

Modify the rpm_vreg_device_remove() function so that the reg
pointer is not dereferenced after being freed.

Change-Id: I0bc2c38a00c5d6b783f52c0ae0f1faa31d3a1e4d
CRs-Fixed: 564463
Signed-off-by: David Collins <collinsd@codeaurora.org>
Signed-off-by: Swetha Chikkaboraiah <schikk@codeaurora.org>
msm: acpuclock-cortex: Fix off by one error for large frequency tables

If a frequency table was greater than a certain size, data will be written
past the end of an array. Fix the loop conditions to prevent this.

Change-Id: Idb33ac1a1580fe4d09d3be3eeba24abd4cb0184d
CRs-fixed: 561651
Signed-off-by: Patrick Daly <pdaly@codeaurora.org>
Signed-off-by: Swetha Chikkaboraiah <schikk@codeaurora.org>
msm: buspm: Correct size type in buspm_xfer_req

Variable size inside buspm_xfer_req
can be negative and thus would be a
large positive number resulting in arbitary
Kernel read. This patch corrects this value.

CRs-Fixed: 563529
Change-Id: I877db6960530d6c7d1486da9cfdc15a43e57e152
Signed-off-by: Sana Venkat Raju <c_vsana@codeaurora.org>
msm: bam_dmux: Revert "msm: bam_dmux: Reverts commit causing crash after data enable"

Fail to access the BAM register while BAM HW reset causing drivers
to enter unknow state and crash the system after enabling the data call.

This reverts commit a1ece5a22d0403581910e8ceb78f63cd1b8be832 to re-apply
all CR fixes and avoid the BAM HW reset while BAM DMUX disconnect.

Change-Id: Ib97ce3bb01aa39c0703be6e2466c84ab0083b6fb
Signed-off-by: Arun Kumar Neelakantam <aneela@codeaurora.org>
msm: Remove old unused sdio related code

Cleanup mach-msm by removing unused sdio related code.

Signed-off-by: Venkat Gopalakrishnan <venkatg@codeaurora.org>
 ASoC: Fix for incorrect removal detection of headphone

 - Resume of FM playback takes about 5 seconds after end
  of voice call.Since the mic voltage is greater than
  the max headset voltage, a removal interrupt is triggered.
 - Increased the max voltage to fix this issue.

CRs-Fixed: 583301

Change-Id: Ic2381baecf48c9942b6c952bae60dfaa10c03425
Signed-off-by: Shreyas Nagasandra Chandrasekhar <snagas@codeaurora.org>
msm-camera: Validate VFE command id

Validating VFE command id to avoid memory related corruptions.

Change-Id: I35ce2ed8514e0112b996ce05be6e6f505cdb6e60
CRs-Fixed: 563542
Signed-off-by: Katta Santhisindhu <kattas@codeaurora.org>
Merge "wlan: Store avoid channel list"
Merge "Merge "wlan: Store avoid channel list""
Merge "Merge "wcnss: Fix Integer overflow""
Merge "Merge "Merge "wcnss: Fix Integer overflow"""
Merge "Merge "msm: kgsl: Verify the user address before reading a perfcounter group""
Merge "Merge "Merge "msm: kgsl: Verify the user address before reading a perfcounter group"""
Merge "Merge "msm: kgsl: Verify the user address before reading a perfcounter group""
Merge "Merge "Merge "msm: kgsl: Verify the user address before reading a perfcounter group"""
Merge "Merge "msm: kgsl: Verify the user address before reading a perfcounter group""
Merge "Merge "Merge "msm: kgsl: Verify the user address before reading a perfcounter group"""
msm: audio: initialize the structure before sending to user space

If uninitialzied structure is passed from kernel to user space, it
may contain contain sensitive information that will be leaked.

CRs-fixed: 550054
Change-Id: I2e93ed20898e0dc804aa1ffe6791f0cfddfba288
Signed-off-by: Fred Oh <fred@codeaurora.org>