msm: bam_dmux: tune downlink polling parameters

This change disables the BAM DMUX adaptive timer - this is to address
concerns about drops in TCP throughput for some use cases with the timer
enabled.  It also sets the aggregation to 3ms to save power while not
compromising performance. Power tests show a savings of 3-4% (compared to
having the timer poll the BAM pipe every 1 ms) for LTE (40Mbps downlink and
25Mbps uplink) and HSPA (7Mbps downlink and 384Kbps uplink) with no
degradation in performance.

Change-Id: Ia51eae773723e60d8b051766ad80bfb0a16f5f6d
Signed-off-by: Anurag Singh <anursing@codeaurora.org>
msm: bam_dmux: add loopback support

Bam dmux is currently very difficult to isolate and provide measurements
for common metrics, such as throughput and latency.

Add hooks into bam_dmux to allow for a seperate dynamically
loadable loopback module. This allows bam dmux to be isolated, and to
provide more accurate measurements of the above metrics.

Change-Id: I174d900dea73cca27d32a54a908f43728059be30
Signed-off-by: Brent Hronik <bhronik@codeaurora.org>
msm: bam_dmux: Fix race condition during SSR

BAM DMUX drivers set the global flags to identify the SSR during
SUBSYS_BEFORE_SHUTDOWN notification, but the flags change is not reflected
in some code paths like msm_bam_dmux_write().

Add the SSR flag check and SRCU locking to complete all pending bam dmux
writes before returning the control in SSR call back function for
SUBSYS_BEFORE_SHUTDOWN notification.

CRs-Fixed: 584805
Change-Id: I26647b485977943f272c44f7450ed6c4a4aa62f3
Signed-off-by: Arun Kumar Neelakantam <aneela@codeaurora.org>
msm: bam_dmux: modify DL low memory algorithm

Bam_dmux maintains a pool of dynamically allocated buffers for the BAM DMA
engine to use as destination memory for Downlink (DL) data.  The allocation
requests for the buffers are done using flags to indicate delays are
tolerable and either the memory or an error should be returned immediately
to bam_dmux as the buffers are normally allocated within various hot paths
inside of the driver.  If a low memory allocation failure is encountered
when attempting to replenish the pool of buffers, bam_dmux will either
attempt the memory allocations later when the next scheduled pool refilling
occurs if there is at least one buffer remaining in the pool, or will
schedule a delayed task to retry the buffer allocation until atleast one
buffer can be put into the pool.

This mechanism of handling low memory situations has two flaws.  First, the
allocation type used by bam_dmux does not trigger the standard low memory
recovery mechanism within the memory management subsystem.  Second, the
peripeheral on the otherside do the DMA engine has a limited hardware based
flow control mechanism that will not release flow control with only one
buffer queued to the DMA engine.

To assist in system recovery, and avoid a data stall, create a cold path
that is tolerant of memory allocation delays and is triggered when the hot
path encounters an allocation failure.

CRs-Fixed: 589665
Change-Id: If72b0eaef285ac6dfd99e97bef1cd7df154e3a48
Signed-off-by: Jeffrey Hugo <jhugo@codeaurora.org>
qseecom: Validate the incoming length from user space

Check if there is no integer overflow before using req_len and
resp_len (received from user space). If an overflow is detected
then exit the operation.

Change-Id: I0459a6992bb3b280db42be63a275c55fa6105b1c
Signed-off-by: Hariprasad Dhalinarasimha <hnamgund@codeaurora.org>
ASoC: wcd9xxx: Don't change button threshold registers

If registers which effect button detection are changed
when mbhc is still in recovering state, sometimes release
interrupt is not getting triggered.So don't modify registers
which effect button detection.

CRs-Fixed: 576855
Change-Id: I307ea4a112d81fecfe23eb58733913b4453284cd
Signed-off-by: Yeleswarapu, Nagaradhesh <nagaradh@codeaurora.org>
msm: ipc: Possible memory corruption due to Sign Conversion

msm_ipc_router_skb_to_buf() takes an unsigned argument and assigns the
same to a signed local variable. This might cause issues when the value
of the argument is too high.

Change the datatype of the local variable to unsigned.

CRs-Fixed: 550606
Change-Id: I257a095681dd82fba05367fd6faf25820e95c719
Signed-off-by: Zaheerulla Meer <zmeer@codeaurora.org>
msm: qdsp6v2: NULL pointer check on userspace data argument in kernel

The null pointer check is required to ensure that userspace data
in kernalspace is not null.

Change-Id: I9e522c393ae643626a4bae03731a73f5d6db6458
CRs-Fixed: 563752
Signed-off-by: Mohammad Johny Shaik <mjshai@codeaurora.org>
mmc: card: fix arbitrary write via read handler in mmc_block_test

In mmc_block_test, the debug_fs based read function handlers write to an
arbitrary buffer which is given by any user. We add an access_ok check
to verify that the address pointed by *buffer is not in kernel space.
Only if the buffer is valid, do we continue the read handler.

Change-Id: I35fe9bb70df8de92cb4d3b15c851aa9131a0e8d9
Signed-off-by: Lee Susman <lsusman@codeaurora.org>
ARM: dts: msm: Add NFC device for PVT device

Add nfc nci device to the device tree for PVT device

Change-Id: Ib582efaead9a6dba038b332f30ef8e3a40211fd4
Signed-off-by: Houston Hoffman <hhoffman@codeaurora.org>
msm: gpiomux: add the hisense nfc gpio

Add the nfc gpio for the hisense device, and add the
compatibility of mtp device.

Change-Id: I40f5a2aad3ea682ad553b5974c1cc34803cff842
Signed-off-by: Houston Hoffman <hhoffman@codeaurora.org>
Signed-off-by: Pan Fang <fangpan@codeaurora.org>
msm: gpiomux: remove conflict between nfc and camera on Hisense

stop camera from holding pin8 low
enable nfc to use pin8 for i2c

Change-Id: I0cb9e1fbc9de40fdac728cb66d9a0bc422c98e22
Signed-off-by: Houston Hoffman <hhoffman@codeaurora.org>
ARM: dts: msm: remove dtsi entry for hisense v1 device

This entry generates kernel error messages on PVT devices

Change-Id: Ieeeb77a9e406330b7503113848784942f7a70777
Signed-off-by: Houston Hoffman <hhoffman@codeaurora.org>
NFC: Implement GP clock for 8610 qrd V2 skuaa devices

Enable General purpose clock 1 for 8610 qrd skuaa V2 devices from nfc-nci device.

Change-Id: Ia4f88b670d691d0202f452b3228eacf333b4e812
Signed-off-by: Houston Hoffman <hhoffman@codeaurora.org>
msm: clock-8x10: Update lookup table for NFC clocks for PVT

I2C clock and GP clock configuration
for QCA199x NFCC on PVT devices.

Change-Id: Ie9bee72e0b62255e3d2610c60f5f69fcdf69bfdc
Signed-off-by: Houston Hoffman <hhoffman@codeaurora.org>
msm: rpm-smd: use data type correctly for a variable

Change variable data type from signed int to unsigned int.

CRs-fixed: 556055
Change-Id: I6bb363b31d4fab26d84f89e775101c6051fe9e10
Signed-off-by: Anil kumar mamidala <amami@codeaurora.org>
radio: iris: Allow task to be interrupted

Not allowing task to be interrupted can cause
delay in response to upper layer. Allow task pending
to be interrupted when corresponding command's status
is received.

Change-Id: I1ff383327b646042b1f1e66547eda6900186710b
CRs-Fixed: 569318
Signed-off-by: Ayaz Ahmad <aahmad@codeaurora.org>
mdss: mdp3: enhance vsync event report for mdp3

It is possible for client to register for vsync event before we
have commited a frame to display. It is in this case that we need
to fake vsync as it is not possible to get real vsync until we have
sent frame to be displayed.

Change-Id: Ied1821c847f22dbe703745fee1443c1dabdc4682
Signed-off-by: Terence Hampson <thampson@codeaurora.org>
mdp3: Enable sw vsync when dma is not active

Recently in an attempt to enhance sync event reporting we
prevented sw vsync when dma is turned of from toggleing display
off and on.

Change-Id: I71c9be55d36dc92e513d9f5ead4d1e42157285c6
Signed-off-by: Terence Hampson <thampson@codeaurora.org>
ext4: make sure the journal sb is written in ext4_clear_journal_err()

After we transfer set the EXT4_ERROR_FS bit in the file system
superblock, it's not enough to call jbd2_journal_clear_err() to clear
the error indication from journal superblock --- we need to call
jbd2_journal_update_sb_errno() as well.  Otherwise, when the root file
system is mounted read-only, the journal is replayed, and the error
indicator is transferred to the superblock --- but the s_errno field
in the jbd2 superblock is left set (since although we cleared it in
memory, we never flushed it out to disk).

This can end up confusing e2fsck.  We should make e2fsck more robust
in this case, but the kernel shouldn't be leaving things in this
confused state, either.

Change-Id: I7a7cd58880209fbd54f4ded5f2b62de492cae9e0
Signed-off-by: "Theodore Ts'o" <tytso@mit.edu>
Cc: stable@kernel.org
Git-commit: d796c52ef0b71a988364f6109aeb63d79c5b116b
Git-repo: git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
Signed-off-by: Osvaldo Banuelos <osvaldob@codeaurora.org>