msm: bam_dmux: modify DL low memory algorithm

Bam_dmux maintains a pool of dynamically allocated buffers for the BAM DMA
engine to use as destination memory for Downlink (DL) data.  The allocation
requests for the buffers are done using flags to indicate delays are
tolerable and either the memory or an error should be returned immediately
to bam_dmux as the buffers are normally allocated within various hot paths
inside of the driver.  If a low memory allocation failure is encountered
when attempting to replenish the pool of buffers, bam_dmux will either
attempt the memory allocations later when the next scheduled pool refilling
occurs if there is at least one buffer remaining in the pool, or will
schedule a delayed task to retry the buffer allocation until atleast one
buffer can be put into the pool.

This mechanism of handling low memory situations has two flaws.  First, the
allocation type used by bam_dmux does not trigger the standard low memory
recovery mechanism within the memory management subsystem.  Second, the
peripeheral on the otherside do the DMA engine has a limited hardware based
flow control mechanism that will not release flow control with only one
buffer queued to the DMA engine.

To assist in system recovery, and avoid a data stall, create a cold path
that is tolerant of memory allocation delays and is triggered when the hot
path encounters an allocation failure.

CRs-Fixed: 589665
Change-Id: If72b0eaef285ac6dfd99e97bef1cd7df154e3a48
Signed-off-by: Jeffrey Hugo <jhugo@codeaurora.org>
MDP: correct clock calculation logic for up-scaling scenario

Part of yscale calculation logic in mdp4_calc_req_mdp_clk
function is only applicable for downscale scenarios. The
incorrect clock calculation was unnecessarily creating
blt mode requirement even for upscale scenarios.

Change-Id: I036be2ceb2f59fb159885b2d15b208706808198b
Signed-off-by: Nirmal Abraham <nabrah@codeaurora.org>
msm: ADSPRPC: Fix bugs in hlist usage

Use hlist_for_each_entry_safe to iterate over nodes when deleting them.
Don't assume that for_each loop will find a node to delete.

Change-Id: Ia3bf5c88844b865d8cfb7e02ce6008a1b9f8e2b4
Signed-off-by: Mitchel Humpherys <mitchelh@codeaurora.org>
Acked-by: Anatoly Yakovenko <anatolyy@qti.qualcomm.com>
msm: rpm-regulator-smd: correct use-after-free in rpm_vreg_device_remove

Modify the rpm_vreg_device_remove() function so that the reg
pointer is not dereferenced after being freed.

Change-Id: I0bc2c38a00c5d6b783f52c0ae0f1faa31d3a1e4d
CRs-Fixed: 564463
Signed-off-by: David Collins <collinsd@codeaurora.org>
Signed-off-by: Swetha Chikkaboraiah <schikk@codeaurora.org>
msm: acpuclock-cortex: Fix off by one error for large frequency tables

If a frequency table was greater than a certain size, data will be written
past the end of an array. Fix the loop conditions to prevent this.

Change-Id: Idb33ac1a1580fe4d09d3be3eeba24abd4cb0184d
CRs-fixed: 561651
Signed-off-by: Patrick Daly <pdaly@codeaurora.org>
Signed-off-by: Swetha Chikkaboraiah <schikk@codeaurora.org>
msm: buspm: Correct size type in buspm_xfer_req

Variable size inside buspm_xfer_req
can be negative and thus would be a
large positive number resulting in arbitary
Kernel read. This patch corrects this value.

CRs-Fixed: 563529
Change-Id: I877db6960530d6c7d1486da9cfdc15a43e57e152
Signed-off-by: Sana Venkat Raju <c_vsana@codeaurora.org>
ipv6: introdcue __ipv6_addr_needs_scope_id and ipv6_iface_scope_id helper functions

[net-next commit b7ef213ef65256168df83ddfbb8131ed9adc10f9]

__ipv6_addr_needs_scope_id checks if an ipv6 address needs to supply
a 'sin6_scope_id != 0'. 'sin6_scope_id != 0' was enforced in case
of link-local addresses. To support interface-local multicast these
checks had to be enhanced and are now consolidated into these new helper
functions.

v2:
a) migrated to struct ipv6_addr_props

v3:
a) reverted changes for ipv6_addr_props
b) test for address type instead of comparing scope

v4:
a) unchanged

CRs-Fixed: 573548
Change-Id: Id6fc54cec61f967928e08a9eba4f857157d973a3
Suggested-by: YOSHIFUJI Hideaki <yoshfuji@linux-ipv6.org>
Cc: YOSHIFUJI Hideaki <yoshfuji@linux-ipv6.org>
Acked-by: YOSHIFUJI Hideaki <yoshfuji@linux-ipv6.org>
Signed-off-by: Hannes Frederic Sowa <hannes@stressinduktion.org>
Acked-by: YOSHIFUJI Hideaki <yoshfuji@linux-ipv6.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
Git-commit: 6607cf0ded9a5f456295477bb1215351fce38d23
Git-repo: https://android.googlesource.com/kernel/common/
Signed-off-by: Subash Abhinov Kasiviswanathan <subashab@codeaurora.org>
net: ipv6: Add IPv6 support to the ping socket.

[backport of net-next 6d0bfe22611602f36617bc7aa2ffa1bbb2f54c67]

This adds the ability to send ICMPv6 echo requests without a
raw socket. The equivalent ability for ICMPv4 was added in
2011.

Instead of having separate code paths for IPv4 and IPv6, make
most of the code in net/ipv4/ping.c dual-stack and only add a
few IPv6-specific bits (like the protocol definition) to a new
net/ipv6/ping.c. Hopefully this will reduce divergence and/or
duplication of bugs in the future.

Caveats:

- Setting options via ancillary data (e.g., using IPV6_PKTINFO
  to specify the outgoing interface) is not yet supported.
- There are no separate security settings for IPv4 and IPv6;
  everything is controlled by /proc/net/ipv4/ping_group_range.
- The proc interface does not yet display IPv6 ping sockets
  properly.

Tested with a patched copy of ping6 and using raw socket calls.
Compiles and works with all of CONFIG_IPV6={n,m,y}.

CRs-Fixed: 573548
Change-Id: I0081b4654dd54b12c8f233e00e18943582aa2142
Signed-off-by: Lorenzo Colitti <lorenzo@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
[lorenzo@google.com: backported to 3.4]
Signed-off-by: Lorenzo Colitti <lorenzo@google.com>
Git-commit: 1f0675844e3b63a765e5bd32bc5af051ccd951c0
Git-repo: https://android.googlesource.com/kernel/common
[subashab@codeaurora.org : resolve trivial merge conflicts]
Signed-off-by: Subash Abhinov Kasiviswanathan <subashab@codeaurora.org>
Signed-off-by: Ian Maund <imaund@codeaurora.org>
net: ipv6: add missing lock in ping_v6_sendmsg

Bug: 9469865
CRs-Fixed: 573548
Change-Id: I5e9db559d22e35d27fa1df948b70c70ed8b42115
Signed-off-by: Lorenzo Colitti <lorenzo@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Git-commit: 3a018d2e8fc2910e5fb2077cde81cad659e2c7f9
Git-repo: https://android.googlesource.com/kernel/common/
Signed-off-by: Subash Abhinov Kasiviswanathan <subashab@codeaurora.org>
net: ipv6: fix wrong ping_v6_sendmsg return value

[net-next commit fbfe80c890a1dc521d0b629b870e32fcffff0da5]

ping_v6_sendmsg currently returns 0 on success. It should return
the number of bytes written instead.

Bug: 9469865
CRs-Fixed: 573548
Change-Id: I82b7d3a37ba91ad24e6dbd97a4880745ce16ad31
Signed-off-by: Lorenzo Colitti <lorenzo@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Git-commit: 68221869132d78d712d402efd53633ae8aebda20
Git-repo: https://android.googlesource.com/kernel/common/
Signed-off-by: Subash Abhinov Kasiviswanathan <subashab@codeaurora.org>
msm: kgsl: Verify the user address before reading a perfcounter group

In adreno_perfcounter_read_group some user input verification is
occuring on a user pointer before copy_from_user is called
resulting in a possible segmentation fault if called with improper
input data.

CRs-fixed: 553314
Change-Id: Ic0dedbad4c5e4b2610368d51ff591d1f716712f4
Signed-off-by: Jordan Crouse <jcrouse@codeaurora.org>
msm: bam_dmux: Revert "msm: bam_dmux: Reverts commit causing crash after data enable"

Fail to access the BAM register while BAM HW reset causing drivers
to enter unknow state and crash the system after enabling the data call.

This reverts commit a1ece5a22d0403581910e8ceb78f63cd1b8be832 to re-apply
all CR fixes and avoid the BAM HW reset while BAM DMUX disconnect.

Change-Id: Ib97ce3bb01aa39c0703be6e2466c84ab0083b6fb
Signed-off-by: Arun Kumar Neelakantam <aneela@codeaurora.org>
msm: Remove old unused sdio related code

Cleanup mach-msm by removing unused sdio related code.

Signed-off-by: Venkat Gopalakrishnan <venkatg@codeaurora.org>
wcnss: Fix Integer overflow

Integer overflow can lead to buffer
overflow in wcnss_wlan_write

Change-Id: I9e6f3439e1c8509bdb9c8c14b9aefe5611de8b03
CRs-Fixed: 547969
Signed-off-by: Arif Hussain <arifhussain@codeaurora.org>
 ASoC: Fix for incorrect removal detection of headphone

 - Resume of FM playback takes about 5 seconds after end
  of voice call.Since the mic voltage is greater than
  the max headset voltage, a removal interrupt is triggered.
 - Increased the max voltage to fix this issue.

CRs-Fixed: 583301

Change-Id: Ic2381baecf48c9942b6c952bae60dfaa10c03425
Signed-off-by: Shreyas Nagasandra Chandrasekhar <snagas@codeaurora.org>
msm-camera: Validate VFE command id

Validating VFE command id to avoid memory related corruptions.

Change-Id: I35ce2ed8514e0112b996ce05be6e6f505cdb6e60
CRs-Fixed: 563542
Signed-off-by: Katta Santhisindhu <kattas@codeaurora.org>
Merge "wlan: Store avoid channel list"
Merge "Merge "wlan: Store avoid channel list""
Merge "wcnss: Fix Integer overflow"
Merge "msm: kgsl: Verify the user address before reading a perfcounter group"