mmc: block: stop bkops during shutdown

[   42.885198] SysRq : Emergency Remount R/O
[   43.003988] mmc0: mmc_bus_shutdown: invoked ###
[   43.033289] mmc0: mmc_bus_shutdown: done ###
[   43.118486] mmc0: sdhci_request: sending cmd8 after bus shutdown !!!
[   43.147955] [<c0659ca4>] (sdhci_request+0x4c/0x260) from
				[<c063ee24>] (mmc_start_request+0x27c/0x2b0)
[   43.157152] [<c063ee24>] (mmc_start_request+0x27c/0x2b0) from
				[<c063eec4>] (mmc_wait_for_req+0x6c/0x13c)
[   43.166618] [<c063eec4>] (mmc_wait_for_req+0x6c/0x13c) from
				[<c0645ed4>] (mmc_send_cxd_data+0xe0/0x114)
[   43.175991] [<c0645ed4>] (mmc_send_cxd_data+0xe0/0x114) from
				[<c0645f24>] (mmc_send_ext_csd+0x1c/0x20)
[   43.185277] [<c0645f24>] (mmc_send_ext_csd+0x1c/0x20) from
				[<c063df28>] (mmc_read_bkops_status+0x98/0xdc)
[   43.194823] [<c063df28>] (mmc_read_bkops_status+0x98/0xdc) from
				[<c06417ac>] (mmc_start_bkops+0x168/0x324)
[   43.204461] [<c06417ac>] (mmc_start_bkops+0x168/0x324) from
				[<c01a9584>] (process_one_work+0x200/0x400)
[   43.213835] [<c01a9584>] (process_one_work+0x200/0x400) from
				[<c01a9934>] (worker_thread+0x184/0x2a4)
[   43.223039] [<c01a9934>] (worker_thread+0x184/0x2a4) from
				[<c01ae010>] (kthread+0x80/0x90)
[   43.231286] [<c01ae010>] (kthread+0x80/0x90) from
				[<c0106c4c>] (kernel_thread_exit+0x0/0x8)
[   45.648206] wcnss crash shutdown 0
[   45.650599] Rebooting in 5 seconds..

In the above log, it is seen that the bkops thread runs after
mmc_bus_shutdown is completed and sends CMD8. Hence, cancel
bkops work during shutdown to prevent sending commands after
mmc bus is shutdown.

CRs-fixed: 593813
Change-Id: I3e8e9eb228bd03603d04561eb478d60664f50aaa
Signed-off-by: Asutosh Das <asutoshd@codeaurora.org>
mmc: sdhci-msm: Fix clock gating while voltage switch is in progress

CLK_PWRSAVE bit in vendor specific register gates the output clock to
card automatically if there are no data/cmd operations.

According the SD3.0 voltage switch sequence the host should provide
clock to the card for atleast one millisecond before DAT[3:0] lines
are pulled high by the card. In this case if power save bit is enabled
it might auto-gate clocks even before the card completes voltage
switch sequence.

Fix this by disabling power save operation when the clocks are turned
off and enable only when clock rate is >400KHz i.e., end of initialization.

CRs-Fixed: 589992
Change-Id: If82d6d2e303b8d1189b76712e514f41fe6e2cf8b
Signed-off-by: Sujit Reddy Thumma <sthumma@codeaurora.org>
qseecom: Check for invalid registration of secapp region

Check the validity of response result field returned by QSEE
when issuing a request to register the secure app region
information.

Change-Id: Idc5ee7cf3c0a25ca37f23ef9d1718fdb05af6533
Signed-off-by: Mona Hossain <mhossain@codeaurora.org>
qseecom: Add frequency scaling in send_service_cmd()

Addes DFAB and SFAB bus frequency scaling in qseecom send_service
command function. This is required for RPMB listener services

Change-Id: I7496dfafe1fa571de68b30529ee6db49c8200232
Signed-off-by: AnilKumar Chimata <anilc@codeaurora.org>
qseecom: Add new IOCTLs to support secure UI feature

User space sends the buffer to TZ to use it for secure UI features.
Buffer shall be protected based on the use case, two APIs are
introduced to support this feature.

- QSEECOM_IOCTL_SEND_MODFD_RESP: is called to modify the listener
response data with physical address replaced at a mentioned offset,
so as to be usable by TZ. Option to protect &/ unprotect the buffer
is provided from user space (based on use case).

- QSEECOM_IOCTL_UNPROTECT_BUF: is called to explicitly unprotect the
protected buffer (use case specific).

Change-Id: If129e7bc0131eee4ec361923c6c1c74de37be130
Signed-off-by: Hariprasad Dhalinarasimha <hnamgund@codeaurora.org>
qseecom:  Validate inputs from user space

Validate send_cmd, send_modfd_cmd and send_mdfd_resp
input parameters: cmd and response pointers and buffer
lengths and offsets  issued to modify data.

Change-Id: I381836d08aaa48357486fbdc6a122eb5b42bfa0b
Signed-off-by: Mona Hossain <mhossain@codeaurora.org>
qseecom: Remove debug  messages

Remove unnecessary debug  messages.

Change-Id: Ida80fbc1376f15753f8329c44550b14d8f4de163
Signed-off-by: Mona Hossain <mhossain@codeaurora.org>
Signed-off-by: Zhen Kong <zkong@codeaurora.org>
qseecom:  Check for case where listener service is not found

When listerner service is not in the list of registered listeners,
the resulting ptr will a NULL. Check for this case of NULL ptr
to indicate missing listener service.

Change-Id: I0d2c7b01143c40711f71bf434493ac5301314cf2
Signed-off-by: Mona Hossain <mhossain@codeaurora.org>
Signed-off-by: Zhen Kong <zkong@codeaurora.org>
qseecom: Copy userspace buffer into kernel space before dereferencing

ION memory is used for user space to kernel space data passing.
This is directly accessible in kernel. But, if the IOCTL is called
from user space without using User space library, then data might
be pointing to some other memory location, in which case, it would
not be possible to dereference this location in kernel & hence it
would be accessing invalid memory.

Change-Id: Ic50c76ee8b2a696dbb786fce3a68cdc782e15268
Signed-off-by: Hariprasad Dhalinarasimha <hnamgund@codeaurora.org>
qseecom: Fix error handling path in receive_req()

This patch fixes the error handling path in receive_req() function
called from userspace. Issue seen if user is calling the receive_req
function without calling the listener registration. qseecom_find_svc()
should return NULL if there are no services found.

Change-Id: Id51d8f48d7266b5acbc845f7b9ac0068d16b1ede
CRs-fixed: 496927
Signed-off-by: AnilKumar Chimata <anilc@codeaurora.org>
qseecom: Fix issues with qssecom_remove/exit APIs

Clean-up the qseecom_remove() function by removing the null pointer
dereference. Change the logic by removing the unnecessary code and
also modified the qseecom_exit() function with proper calls.

Change-Id: Ibcca1b3c2c37024661505de2550e202b507703aa
Signed-off-by: AnilKumar Chimata <anilc@codeaurora.org>
qseecom: Check input buffer from IOCTL

IOCTL messages come with pointers to buffer, check these
buffer pointers prior to accessing it.

Change-Id: Ibd724a35682a6f8e4f6900c8404854a8b55c0c9a
Signed-off-by: Hariprasad Dhalinarasimha <hnamgund@codeaurora.org>
msm: msm_bus: Don't program bw regs in dual config

When in dual configuration mode, don't program the bw registers
since they are already programmed at boot up.

Change-Id: I74d559f997b6374df7b68ffd022aa6d36beb7a9d
Signed-off-by: Girish Mahadevan <girishm@codeaurora.org>
msm: msm_bus: Arbitrate IB for dual config masters

Arbitrate the IBs on nodes marked as dual config. This will prevent cases
where the last client's requests is always used to apply dual config rules.

Change-Id: I06f9a16e5f32c1cda7a5d04a72a6e5cf7dc9fae6
Signed-off-by: Girish Mahadevan <girishm@codeaurora.org>
devfreq: update simpleondemand
msm: camera: Add defensive check in ISPIF driver

In case of error handling, call ispif release only if ispif handle
is valid. In case of mm-qcamara-daemon crash when camera is not open,
these handles are not valid. Hence it leads to kernel crash in ispif
release handler.

Change-Id: Ifb402b6907052594d12fcf9495694e6c5184af1b
Signed-off-by: Sreesudhan Ramakrish Ramkumar <srramku@codeaurora.org>
msm: camera: Add retry mechanism to detect camera sensor

When device power up, probe happens where camera sensors
connected in each slot are detected by reading its chip id. Add
retry mechanism to try 3 times to read chip id for detecting
camera sensors.

Change-Id: Id2788f32fd7255eb9ca748ddce6e92267a1326ef
Signed-off-by: Wei Ding <weiding@codeaurora.org>
msm: camera: Fix file perm
msm: camera_v2: cci: check for NULL pointer

in function "msm_cci_subdev_g_chip_ident"
check for NULL pointer and return error
instead of assert

Change-Id: Ia27751c4d6f3d5ead1749e396ffa5c2773f1582b
Signed-off-by: Georgi Hristov <ghristov@codeaurora.org>
ARM: dts: msm: Modify bus vector for RNG client on msm8974

Modify the RNG (Random Number Generator) bus vector to use a different
originating master id, this change helps alleviate some slowdowns in boot
time noticed in targets where CPU is artificially bus throttled below a
threshold frequency.

Change-Id: Idf2a1d128f56e6aafebcbf0184ef2454d385be34
Signed-off-by: Girish Mahadevan <girishm@codeaurora.org>