msm: bam_dmux: modify DL low memory algorithm

Bam_dmux maintains a pool of dynamically allocated buffers for the BAM DMA
engine to use as destination memory for Downlink (DL) data.  The allocation
requests for the buffers are done using flags to indicate delays are
tolerable and either the memory or an error should be returned immediately
to bam_dmux as the buffers are normally allocated within various hot paths
inside of the driver.  If a low memory allocation failure is encountered
when attempting to replenish the pool of buffers, bam_dmux will either
attempt the memory allocations later when the next scheduled pool refilling
occurs if there is at least one buffer remaining in the pool, or will
schedule a delayed task to retry the buffer allocation until atleast one
buffer can be put into the pool.

This mechanism of handling low memory situations has two flaws.  First, the
allocation type used by bam_dmux does not trigger the standard low memory
recovery mechanism within the memory management subsystem.  Second, the
peripeheral on the otherside do the DMA engine has a limited hardware based
flow control mechanism that will not release flow control with only one
buffer queued to the DMA engine.

To assist in system recovery, and avoid a data stall, create a cold path
that is tolerant of memory allocation delays and is triggered when the hot
path encounters an allocation failure.

CRs-Fixed: 589665
Change-Id: If72b0eaef285ac6dfd99e97bef1cd7df154e3a48
Signed-off-by: Jeffrey Hugo <jhugo@codeaurora.org>
MDP: correct clock calculation logic for up-scaling scenario

Part of yscale calculation logic in mdp4_calc_req_mdp_clk
function is only applicable for downscale scenarios. The
incorrect clock calculation was unnecessarily creating
blt mode requirement even for upscale scenarios.

Change-Id: I036be2ceb2f59fb159885b2d15b208706808198b
Signed-off-by: Nirmal Abraham <nabrah@codeaurora.org>
msm: ADSPRPC: Fix bugs in hlist usage

Use hlist_for_each_entry_safe to iterate over nodes when deleting them.
Don't assume that for_each loop will find a node to delete.

Change-Id: Ia3bf5c88844b865d8cfb7e02ce6008a1b9f8e2b4
Signed-off-by: Mitchel Humpherys <mitchelh@codeaurora.org>
Acked-by: Anatoly Yakovenko <anatolyy@qti.qualcomm.com>
msm: rpm-regulator-smd: correct use-after-free in rpm_vreg_device_remove

Modify the rpm_vreg_device_remove() function so that the reg
pointer is not dereferenced after being freed.

Change-Id: I0bc2c38a00c5d6b783f52c0ae0f1faa31d3a1e4d
CRs-Fixed: 564463
Signed-off-by: David Collins <collinsd@codeaurora.org>
Signed-off-by: Swetha Chikkaboraiah <schikk@codeaurora.org>
msm: acpuclock-cortex: Fix off by one error for large frequency tables

If a frequency table was greater than a certain size, data will be written
past the end of an array. Fix the loop conditions to prevent this.

Change-Id: Idb33ac1a1580fe4d09d3be3eeba24abd4cb0184d
CRs-fixed: 561651
Signed-off-by: Patrick Daly <pdaly@codeaurora.org>
Signed-off-by: Swetha Chikkaboraiah <schikk@codeaurora.org>
msm: buspm: Correct size type in buspm_xfer_req

Variable size inside buspm_xfer_req
can be negative and thus would be a
large positive number resulting in arbitary
Kernel read. This patch corrects this value.

CRs-Fixed: 563529
Change-Id: I877db6960530d6c7d1486da9cfdc15a43e57e152
Signed-off-by: Sana Venkat Raju <c_vsana@codeaurora.org>
wlan: Fix for mtrace vos api for SME.

SME implementation of MTRACE currently uses PE Api's.
With this change MTRACE in SME will use voss api's instead
of PE.

Change-Id: I05bd98f088a2b0d09f59c94c9f6c8d826a78cad9
CRs-Fixed:  592922
wlan: avoid race condition while accessing wpalPacketAvailableCB

wpalPacketAvailableCB can be called from the MC_Thread as well
as the RX_Thread, the race condition can occur when the callback
is called from the MC_Thread and immediately set to NULL after
the function returns and in between that the RX_Thread running
on another core has detected a low resource condition and set
wpalPacketAvailableCB before the MC_Thread sets it to NULL.
To avoid the race conditions always set/reset the values to
wpalPacketAvailableCB in RX_thread only.

Change-Id: Idb1700287186df4b3ede45324cfa2062b1b81d9e
CRs-Fixed: 599184
wlan: Support for MTRACE.

This fix will move MTRACE funcionality from PE to VOSS

Change-Id: I901f139aa22ccf45ec080cff3ab7506384458251
CRs-Fixed:  592922
wlan: Fix for handling IPv6 notifier block rightly.

Correct the register and unregister sequence of IPv6
notifier block.

CRs-Fixed: 600300
Change-Id: Id90112f346349fe48aa36de104efb532433af2aa
wlan: Fix for unregistering IPv4 notifier rightly.

Correct the register and unregister sequence of IPv4
notifier block.

Change-Id: Ib8d77153adb2d71295e2a77a8e228ec55f967f2a
CRs-Fixed: 599742
ipv6: introdcue __ipv6_addr_needs_scope_id and ipv6_iface_scope_id helper functions

[net-next commit b7ef213ef65256168df83ddfbb8131ed9adc10f9]

__ipv6_addr_needs_scope_id checks if an ipv6 address needs to supply
a 'sin6_scope_id != 0'. 'sin6_scope_id != 0' was enforced in case
of link-local addresses. To support interface-local multicast these
checks had to be enhanced and are now consolidated into these new helper
functions.

v2:
a) migrated to struct ipv6_addr_props

v3:
a) reverted changes for ipv6_addr_props
b) test for address type instead of comparing scope

v4:
a) unchanged

CRs-Fixed: 573548
Change-Id: Id6fc54cec61f967928e08a9eba4f857157d973a3
Suggested-by: YOSHIFUJI Hideaki <yoshfuji@linux-ipv6.org>
Cc: YOSHIFUJI Hideaki <yoshfuji@linux-ipv6.org>
Acked-by: YOSHIFUJI Hideaki <yoshfuji@linux-ipv6.org>
Signed-off-by: Hannes Frederic Sowa <hannes@stressinduktion.org>
Acked-by: YOSHIFUJI Hideaki <yoshfuji@linux-ipv6.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
Git-commit: 6607cf0ded9a5f456295477bb1215351fce38d23
Git-repo: https://android.googlesource.com/kernel/common/
Signed-off-by: Subash Abhinov Kasiviswanathan <subashab@codeaurora.org>
net: ipv6: Add IPv6 support to the ping socket.

[backport of net-next 6d0bfe22611602f36617bc7aa2ffa1bbb2f54c67]

This adds the ability to send ICMPv6 echo requests without a
raw socket. The equivalent ability for ICMPv4 was added in
2011.

Instead of having separate code paths for IPv4 and IPv6, make
most of the code in net/ipv4/ping.c dual-stack and only add a
few IPv6-specific bits (like the protocol definition) to a new
net/ipv6/ping.c. Hopefully this will reduce divergence and/or
duplication of bugs in the future.

Caveats:

- Setting options via ancillary data (e.g., using IPV6_PKTINFO
  to specify the outgoing interface) is not yet supported.
- There are no separate security settings for IPv4 and IPv6;
  everything is controlled by /proc/net/ipv4/ping_group_range.
- The proc interface does not yet display IPv6 ping sockets
  properly.

Tested with a patched copy of ping6 and using raw socket calls.
Compiles and works with all of CONFIG_IPV6={n,m,y}.

CRs-Fixed: 573548
Change-Id: I0081b4654dd54b12c8f233e00e18943582aa2142
Signed-off-by: Lorenzo Colitti <lorenzo@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
[lorenzo@google.com: backported to 3.4]
Signed-off-by: Lorenzo Colitti <lorenzo@google.com>
Git-commit: 1f0675844e3b63a765e5bd32bc5af051ccd951c0
Git-repo: https://android.googlesource.com/kernel/common
[subashab@codeaurora.org : resolve trivial merge conflicts]
Signed-off-by: Subash Abhinov Kasiviswanathan <subashab@codeaurora.org>
Signed-off-by: Ian Maund <imaund@codeaurora.org>
net: ipv6: add missing lock in ping_v6_sendmsg

Bug: 9469865
CRs-Fixed: 573548
Change-Id: I5e9db559d22e35d27fa1df948b70c70ed8b42115
Signed-off-by: Lorenzo Colitti <lorenzo@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Git-commit: 3a018d2e8fc2910e5fb2077cde81cad659e2c7f9
Git-repo: https://android.googlesource.com/kernel/common/
Signed-off-by: Subash Abhinov Kasiviswanathan <subashab@codeaurora.org>
net: ipv6: fix wrong ping_v6_sendmsg return value

[net-next commit fbfe80c890a1dc521d0b629b870e32fcffff0da5]

ping_v6_sendmsg currently returns 0 on success. It should return
the number of bytes written instead.

Bug: 9469865
CRs-Fixed: 573548
Change-Id: I82b7d3a37ba91ad24e6dbd97a4880745ce16ad31
Signed-off-by: Lorenzo Colitti <lorenzo@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Git-commit: 68221869132d78d712d402efd53633ae8aebda20
Git-repo: https://android.googlesource.com/kernel/common/
Signed-off-by: Subash Abhinov Kasiviswanathan <subashab@codeaurora.org>
wlan: memory overflow/corruption in ftm test

In iw_ftm_setchar_getnone() iotctl_private_iw_point() cannnnot
be used to allocate memory to store data from userspace as
IW_SETCHAR_GETNONE is defined as odd number which assigns set_args
to zero.we assisgn memory using kzalloc here to hold userspace data

Change-Id: Ie2de8ab8c9b4ced301ab03f72302f390fa0ec488
CRs-fixed: 591712
wlan: Start split scan under STA+SAP concurrent mode

Start the spilt scan under concurrent mode similar like
P2pGo and P2pCli for SAP as well.

CRs-fixed: 600529
msm: kgsl: Verify the user address before reading a perfcounter group

In adreno_perfcounter_read_group some user input verification is
occuring on a user pointer before copy_from_user is called
resulting in a possible segmentation fault if called with improper
input data.

CRs-fixed: 553314
Change-Id: Ic0dedbad4c5e4b2610368d51ff591d1f716712f4
Signed-off-by: Jordan Crouse <jcrouse@codeaurora.org>
wlan:Incorrect 11n link rate displayed on GUI

Incorrect link rate is displayed on GUI when STA
associates to a 11n supported AP.As a part of this
change getting MCS Rate set only when when rssi is
good or if we are  always reporting max speed.
Change-Id: I1cd67fd84c88dc67ef17ff3c0f97cf4b202f9a6d
CRs-fixed: 602300
msm: bam_dmux: Revert "msm: bam_dmux: Reverts commit causing crash after data enable"

Fail to access the BAM register while BAM HW reset causing drivers
to enter unknow state and crash the system after enabling the data call.

This reverts commit a1ece5a22d0403581910e8ceb78f63cd1b8be832 to re-apply
all CR fixes and avoid the BAM HW reset while BAM DMUX disconnect.

Change-Id: Ib97ce3bb01aa39c0703be6e2466c84ab0083b6fb
Signed-off-by: Arun Kumar Neelakantam <aneela@codeaurora.org>