Revert "mmc: sdhci: retune on cmd or data CRC error"

This reverts commit 6ec99eb687b989ef4af701475d4a162e990964f9.

Change-Id: Ic4186af897484a346bba5930fac4f8bd5bb7e0a0
Signed-off-by: Shruthi Krishna <skrish@codeaurora.org>
msm: ipc: Serialize SMD XPRT CLOSE and OPEN events

When a remote subsystem resets, IPC Router's SMD XPRT Layer queues a CLOSE
event. When the concerned subsytem powers up and the channel is reopened,
SMD XPRT Layer queues a OPEN event. When the remote subsytem resets and
powers up quickly, the following race condition exists:
a) IPC Router is scheduled out while handling the CLOSE event, leaving a
   stale XPRT
b) IPC Router's SMD XPRT Layer queues a OPEN event
c) IPC Router's SMD XPRT Layer reads a HELLO message, finds a stale
   XPRT and queues a DATA event on the stale XPRT
This race condition causes a kernel panic.

Fix this race condition, by not handling any other SMD XPRT event until
the CLOSE event is complete.

CRs-Fixed: 488331
Change-Id: I2283e163413d1896bd6842530b8a6a2b537e22de
Signed-off-by: Karthikeyan Ramasubramanian <kramasub@codeaurora.org>
msm: ipc: Clean-up code redundancy

The receive message operation for the socket interface and the kernel
interface has redundant code.

Clean-up redundant code.

Change-Id: Ibe52816f5b567feab4d6247a3dba1945e209c626
Signed-off-by: Arun Kumar Neelakantam <aneela@codeaurora.org>
msm: ipc: Initialize unused elements of control message to 0

Initialize the entire control message to 0, so that unused elements of
a control message are initialized to 0. This will prevent any uninitialized
elements from leaking information to the remote subsystems.

Change-Id: I910f3956e8f282e614216c45f7af92d741d887f8
Signed-off-by: Karthikeyan Ramasubramanian <kramasub@codeaurora.org>
msm: ipc: Send Resume_Tx from the client/server context

Resume_tx is passed by IPC Router as soon as it detects confirm_rx
field being set in received message. In a scenario where the local port
towards which the confirm_rx is directed is not in a state of accepting
messages, this behavior of IPC Router makes the remote port send more
data towards the local port. In addition, in a multi-hop scenario the
resume_tx message holds the destination node_id as the value of the
neighbouring node_id which is incorrect.

Pass Resume_Tx from the context of the thread to which the local port is
associated. Pass the right node_id as destination node_id in the
Resume_Tx message.

Change-Id: I6a05a85978c38831bd95210b3617c5d015eac5e4
Signed-off-by: Zaheerulla Meer <zmeer@codeaurora.org>
msm: ipc: Fix memory leak

When IPC Router detects a data packet from an unknown remote port,
the router creates a remote port. In case of failure while creating the
remote port, router doesn't free the memory allocated to the data packet.
This leads to memory leak beacuse once the above mentioned failure
occurs, the data packet never gets used.

Fix the memory leak in case of failure while creating the remote port.

Change-Id: I168329db88afb6159b1eda64fbd4bbeb95fbd94f
Signed-off-by: Zaheerulla Meer <zmeer@codeaurora.org>
msm: ipc: Cleanup a routing table entry under subsystem restart

Currently when a remote subsystem restarts, the routing table entry
corresponding to that remote subsystem is recycled. This causes some
subsystems to be not reachable if the system's network topology is
not meshed.

Remove the routing table entry for a restarting subsystem so that
it gets added again either through HELLO message from that subsystem or
through first NEW_SERVER message from that subsystem.

Change-Id: I2957ebfb2b66610f68e000e42e2c07d463c89eb6
Signed-off-by: Karthikeyan Ramasubramanian <kramasub@codeaurora.org>
msm: ipc: Pass the local service events to local clients

When a service gets registered or unregistered locally, the concerned
events are sent only to the remote subsystems.

Pass the local service events to local clients so that clients and
services can be started in any order.

Change-Id: I1f672cb3e7cac2ae2f26922add0320ffd84a38ad
Signed-off-by: Karthikeyan Ramasubramanian <kramasub@codeaurora.org>
msm: ipc: Add support to handle version 2 header

IPC Router Message header is 32 bytes in size since each element uses
4 bytes in size regardless of the data range being represented.

Add a version 2 header format that compacts the header into 16 bytes.

Change-Id: I5e6cfc0672ca1dc3365b31c26d2ce4b3c6230cfc
Signed-off-by: Karthikeyan Ramasubramanian <kramasub@codeaurora.org>
msm: ipc: Fix SKB ownership for failure case

When a client writes to IPC Router and if the write fails, then in
certain scenarios both the client and IPC Router take up the ownership
of the SKB. These failure scenarios lead to a double-free and
segmentation fault.

Fix these scenarios by resolving the ownership issue. If the write to
IPC Router is successful, then IPC Router will keep the ownership of the
SKBs and free the packets. If the write fails, then the client will keep
the ownership of the SKBs and free the packets.

CRs-Fixed: 530180
Change-Id: Iaba47f5da377cdf0a6b16ae02d99eab91a9a6221
Signed-off-by: Zaheerulla Meer <zmeer@codeaurora.org>
msm: ipc: Possible memory corruption due to Sign Conversion

msm_ipc_router_skb_to_buf() takes an unsigned argument and assigns the
same to a signed local variable. This might cause issues when the value
of the argument is too high.

Change the datatype of the local variable to unsigned.

CRs-Fixed: 550606
Change-Id: I257a095681dd82fba05367fd6faf25820e95c719
Signed-off-by: Zaheerulla Meer <zmeer@codeaurora.org>
idr: fix a subtle bug in idr_get_next()

The iteration logic of idr_get_next() is borrowed mostly verbatim from
idr_for_each().  It walks down the tree looking for the slot matching
the current ID.  If the matching slot is not found, the ID is
incremented by the distance of single slot at the given level and
repeats.

The implementation assumes that during the whole iteration id is aligned
to the layer boundaries of the level closest to the leaf, which is true
for all iterations starting from zero or an existing element and thus is
fine for idr_for_each().

However, idr_get_next() may be given any point and if the starting id
hits in the middle of a non-existent layer, increment to the next layer
will end up skipping the same offset into it.  For example, an IDR with
IDs filled between [64, 127] would look like the following.

          [  0  64 ... ]
       /----/   |
       |        |
      NULL    [ 64 ... 127 ]

If idr_get_next() is called with 63 as the starting point, it will try
to follow down the pointer from 0.  As it is NULL, it will then try to
proceed to the next slot in the same level by adding the slot distance
at that level which is 64 - making the next try 127.  It goes around the
loop and finds and returns 127 skipping [64, 126].

Note that this bug also triggers in idr_for_each_entry() loop which
deletes during iteration as deletions can make layers go away leaving
the iteration with unaligned ID into missing layers.

Fix it by ensuring proceeding to the next slot doesn't carry over the
unaligned offset - ie.  use round_up(id + 1, slot_distance) instead of
id += slot_distance.

Signed-off-by: Tejun Heo <tj@kernel.org>
Reported-by: David Teigland <teigland@redhat.com>
Cc: KAMEZAWA Hiroyuki <kamezawa.hiroyu@jp.fujitsu.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

Change-Id: Ifb6d64747e7f08e2f5d7609bd66a48405f0c9b95
Signed-off-by: Prakash Kamliya <pkamliya@codeaurora.org>
sched/debug: Make sysrq prints of sched debug data optional

Calls to sysrq_sched_debug_show() can yield rather verbose output
which contributes to log spew and, under heavy load, may increase
the chances of a watchdog bark.

Make printing of this data optional with the introduction of a
new Kconfig, CONFIG_SYSRQ_SCHED_DEBUG.

Change-Id: I5f54d901d0dea403109f7ac33b8881d967a899ed
Signed-off-by: Matt Wagantall <mattw@codeaurora.org>
lib: spinlock_debug: increase spin dump timeout to one second

Increase spin dump timeout so that it is back in sync with the
upstream value.

Change-Id: I4b8896b69dadd66196090d86e40da89766b048e6
Signed-off-by: Syed Rameez Mustafa <rameezmustafa@codeaurora.org>
usb: gadget: mass_storage: added sysfs entry for cdrom to LUNs

This patch adds a "cdrom" sysfs entry for each mass_storage LUN, just
like "ro" sysfs entry. This allows switching between USB and CD-ROM
emulation without reinserting the module or recompiling the kernel.

Change-Id: Idf83c74815b1ad370428ab9d3e5503d5f7bcd3b6
mdss: dsi: Resolving memory leak in parse dsi commands

Free buf variable before exiting function in error cases
in order to avoid possible memory leaks.

Change-Id: I8ebc3f0f3f40be85e312f9646374a074f1414bdb
Signed-off-by: Krishna Chaitanya Parimi <cparimi@codeaurora.org>
msm: mdss: Add support for macro tile formats

MDP now supports tile formats on APQ8084. Macro tile formats
are aligned with number of memory banks and access channels to
improve performance.

Change-Id: Ie566cc12b38f81d111f378f19883433bcc71fa48
Signed-off-by: Shalabh Jain <shalabhj@codeaurora.org>
Revert "mmc: core: do not reinsert prepeared FUA and FLUSH requests in stop flow".

This reverts commit 762211a18930d0a750849cc7f91f3fedb71c9b43.

Change-Id: I8fe3069ae73a45d6f63f2b0bc3b3c99018908f5a
Signed-off-by: Abhinay Reddy Vanipally <avanip@codeaurora.org>
mmc: queue: scale down the max_segs if memory allocation fails

In low memory conditions at runtime, allocation of max_segs may
fail. Retry with a scaled down max_segs until allocation succeeds.

CRs-fixed: 583267
Change-Id: I072724afa44854dacc58654e6329531c1bb11120
Signed-off-by: Subhash Jadavani <subhashj@codeaurora.org>
Signed-off-by: Asutosh Das <asutoshd@codeaurora.org>
msm: vidc: add sleep of 100us before clock disable

ARM9 execute following sequence when venus is idle
1. Disable ARM9 watchdog
2. Set bit 30 of A_VENUS_CPU_CS_SCIACMDARG0 register
   to indicate venus is idle
3. Write HFI_MSG_SYS_IDLE to message queue
4. Raise interrupt to host
5. ARM9 execute wait for interrupt instruction to go
   into low power state. This will internally drain the
   ARM9 write buffer which can generate bus transaction.
6. ARM9 in idle

Host clock gate venus based on following sequence
1. Host receive HFI_MSG_SYS_IDLE from the msg queue
2. Host check both cmd / msg queue are empty by
   comparing the queue read/write pointers.
3. Host check bit 30 of A_VENUS_CPU_CS_SCIACMDARG0
   register to confirm it indicate idle
4. Host clock gate whole venus

As the host clock gate venus in step 4, ARM9 is still
in step 5&6. The sleep will ensure that step 5 and 6
are completed before host clock gates venus.

CRs-Fixed: 589417
CRs-Fixed: 595251
Change-Id: Idf1f788718adea2dacceca97afa4ba4fe4562ddd
Signed-off-by: Vikash Garodia <vgarodia@codeaurora.org>