msm: ehci-hsic: Add support to disable internal clock gating

EHCI cores on latest MSMs have internal clock gating enabled
by default. Stability issues (random enumeration failures)
have been observed with some CORES where clock gating feature
doesn't work as expected. Hence add support to disable clock
gating in hardware.

Change-Id: I5209a68409ad04cba53c14c0e813aa0b925cf98e
CRs-Fixed: 538509
Signed-off-by: ChandanaKishori Chiluveru <cchilu@codeaurora.org>
msm: rpm: do not disable the interupt during suspend

If an edge wake up interrupt happens during suspend path,
the flow handler will mask it and set as pending. This
lead to suspend sequence abort when the check for all
pending edge interrupt happens. Do not disable the
interrupt (wake up interrupt to CPU0 in krait SS, #54)
during suspend.

CRs-fixed: 583318
Change-Id: I3a5afec98d445da2dfc1f16fc20d9f3e96acc17f
Signed-off-by: Murali Nalajala <mnalajal@codeaurora.org>
msm: kgsl: Add a missing refcount put for kgsl_context

Fix a potential memory leak by putting in the missing
kgsl_context_put() in ft detect for kgsl_context

Change-Id: I2673cdcc5a8ab9caf4d9adbfd9b3aa528348d945
Signed-off-by: Prakash Kamliya <pkamliya@codeaurora.org>
ASoC:wcd9304:Modified code to acquire codec_resource_lock only once.

POP noise is heard as DAC is enabled during fast insertion/removal of
headset, due to wrong handling of codec_resource_lock. There is no need
to acquire the lock separately for HPHL and HPHR channel, hence modified
such that lock is acquired only once for both HPHL and HPHR PA's.

Change-Id: Ibceced072a9b19f0ecd0b156057973520f241a4f
CRs-Fixed: 580366
Signed-off-by: Asish Bhattacharya <asishb@codeaurora.org>
netfilter: x_tables: fix ordering of jumpstack allocation and table update

During kernel stability testing on an SMP ARMv7 system, Yalin Wang
reported the following panic from the netfilter code:

  1fe0: 0000001c 5e2d3b10 4007e779 4009e110 60000010 00000032 ff565656 ff545454
  [<c06c48dc>] (ipt_do_table+0x448/0x584) from [<c0655ef0>] (nf_iterate+0x48/0x7c)
  [<c0655ef0>] (nf_iterate+0x48/0x7c) from [<c0655f7c>] (nf_hook_slow+0x58/0x104)
  [<c0655f7c>] (nf_hook_slow+0x58/0x104) from [<c0683bbc>] (ip_local_deliver+0x88/0xa8)
  [<c0683bbc>] (ip_local_deliver+0x88/0xa8) from [<c0683718>] (ip_rcv_finish+0x418/0x43c)
  [<c0683718>] (ip_rcv_finish+0x418/0x43c) from [<c062b1c4>] (__netif_receive_skb+0x4cc/0x598)
  [<c062b1c4>] (__netif_receive_skb+0x4cc/0x598) from [<c062b314>] (process_backlog+0x84/0x158)
  [<c062b314>] (process_backlog+0x84/0x158) from [<c062de84>] (net_rx_action+0x70/0x1dc)
  [<c062de84>] (net_rx_action+0x70/0x1dc) from [<c0088230>] (__do_softirq+0x11c/0x27c)
  [<c0088230>] (__do_softirq+0x11c/0x27c) from [<c008857c>] (do_softirq+0x44/0x50)
  [<c008857c>] (do_softirq+0x44/0x50) from [<c0088614>] (local_bh_enable_ip+0x8c/0xd0)
  [<c0088614>] (local_bh_enable_ip+0x8c/0xd0) from [<c06b0330>] (inet_stream_connect+0x164/0x298)
  [<c06b0330>] (inet_stream_connect+0x164/0x298) from [<c061d68c>] (sys_connect+0x88/0xc8)
  [<c061d68c>] (sys_connect+0x88/0xc8) from [<c000e340>] (ret_fast_syscall+0x0/0x30)
  Code: 2a000021 e59d2028 e59de01c e59f011c (e7824103)
  ---[ end trace da227214a82491bd ]---
  Kernel panic - not syncing: Fatal exception in interrupt

This comes about because CPU1 is executing xt_replace_table in response
to a setsockopt syscall, resulting in:

	ret = xt_jumpstack_alloc(newinfo);
		--> newinfo->jumpstack = kzalloc(size, GFP_KERNEL);

	[...]

	table->private = newinfo;
	newinfo->initial_entries = private->initial_entries;

Meanwhile, CPU0 is handling the network receive path and ends up in
ipt_do_table, resulting in:

	private = table->private;

	[...]

	jumpstack  = (struct ipt_entry **)private->jumpstack[cpu];

On weakly ordered memory architectures, the writes to table->private
and newinfo->jumpstack from CPU1 can be observed out of order by CPU0.
Furthermore, on architectures which don't respect ordering of address
dependencies (i.e. Alpha), the reads from CPU0 can also be re-ordered.

This patch adds an smp_wmb() before the assignment to table->private
(which is essentially publishing newinfo) to ensure that all writes to
newinfo will be observed before plugging it into the table structure.
A dependent-read barrier is also added on the consumer sides, to ensure
the same ordering requirements are also respected there.

CRs-Fixed: 591149

Change-Id: Ica3ec69cd6e2f77945a1a7303f92887feecf42e9
Cc: Paul E. McKenney <paulmck@linux.vnet.ibm.com>
Reported-by: Wang, Yalin <Yalin.Wang@sonymobile.com>
Tested-by: Wang, Yalin <Yalin.Wang@sonymobile.com>
Signed-off-by: Will Deacon <will.deacon@arm.com>
Acked-by: Eric Dumazet <edumazet@google.com>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Git-commit: b416c144f46af1a30ddfa4e4319a8f077381ad63
Git-repo: https://www.codeaurora.org/cgit/quic/la/kernel/msm/common/
Signed-off-by: Vijaya Kumar T M <vtmuni@codeaurora.org>
msm: kgsl: Skip hang check for 2d devices
kgsl hung check is used for 3d device but while creating a 2d
device we are creating a hung timer and check for hung in 3d
device, Which is not logically correct. Some time it causes kernal panic
when device type is 2d and we try to access 3d device registers etc

Change-Id: I82d7c4ca542f33529357c336daa36a66153adcd3
Signed-off-by: Gaurav Gagrani <ggagrani@codeaurora.org>
cfg80211: discard regulatory hints from country IEs with undefined wiphy

Regulatory hints are processed in a worker thread and by the
time this thread gets a chance to schedule driver can deregister
the wiphy on which the country IE was discovered. There is no need
to process the hints which are coming from such invalid wiphy
devices and we should drop them.

Change-Id: I44f6f7b29ed1d0927151a88f3ea9e0c17044bd7e
CRs-Fixed: 588103
Signed-off-by: Mihir Shete <smihir@codeaurora.org>
radio: iris: Maintain different FM states

Unexpected disabled event gets queued when FM is turned
on after turning off FM, sending SSR command. Therefore
FM fails to turn on.Maintain different states FM OFF,
FM RECV TURNING ON, FM TRANS TURNING ON, FM_OFF,
FM CALIBRATION and only queue unexpected disabled event
when either Receiver or Transmitter is enabled.

CRs-Fixed: 518378

Change-Id: Iffa55bef3dc5ce605cf270ad41f4c9a8b8d70392
Signed-off-by: Ayaz Ahmad <aahmad@codeaurora.org>
radio: iris: Avoid memory leak and NULL pointer dereferencing

 - Avoid memory leak by freeing allocated memory
 - Do not derefer NULL pointer

CRs-Fixed: 537955
Signed-off-by: Ayaz Ahmad <aahmad@codeaurora.org>
Change-Id: I7624d73e5c25233e9d03c67e4204c611b9a8fff6
radio: iris: Allow task to be interrupted

Not allowing task to be interrupted can cause
delay in response to upper layer. Allow task pending
to be interrupted when corresponding command's status
is received.

Change-Id: Ibb84673dfa92458c1ef45da12e63dd041abd0c39
CRs-Fixed: 569318
Signed-off-by: Ayaz Ahmad <aahmad@codeaurora.org>
radio: iris: Add NULL pointer check

Dereferencing a NULL pointer may cause kernel crash,
Check for NULL pointer before dereferencing

Change-Id: I43b1aa8054646f29833f82b7203192aa3494d912
CRs-Fixed: 548404
Signed-off-by: Ayaz Ahmad <aahmad@codeaurora.org>
radio: iris: Removed reference to user provided pointer.

Removed reference to user provided capability structure
pointer.

Change-Id: Ie16abbe9143cad19a8fc535972de18823af4ef51
CRs-fixed: 539042
Signed-off-by: Satish Kodishala <skodisha@codeaurora.org>
radio: iris: Bound check user space values

There is no bound check for arguments passed
from user space to kernel space. This may cause
fatal exceptions.

Change-Id: I9fe9376cc953bb57cf15f3a28d4ba2dbd940f4a1
CRs-Fixed: 546081
Signed-off-by: Ayaz Ahmad <aahmad@codeaurora.org>
msm: camera: Make AXI stop/abort/reset and overflow recovery
mutually exclusive.

This would avoid potential problems when AXI bus is stopped when
recovery is in progress and vice versa.

Change-Id: I44ef2c4f7b54f81aef5be41293a5f70099307a13
CRs-Fixed: 561680,586602
Signed-off-by: Alok Kediya <kediya@codeaurora.org>
Merge "Merge "csdio: Remove the driver""
Revert "Update on Program TILE video frame size in dma ISR."

This reverts commit 88ac781cec1034301882099f1f11984b73831d92.

Change-Id: Idecc76ededc625d77ae3c8fd3f9e0da512b4848f
Signed-off-by: raghavendra ambadas <rambad@codeaurora.org>
Revert "msm_fb: display: update video tile framesize register"

This reverts commit 80f8dfbbbb20adde0fc0c164c19bd5ea50c2ddf1.

Change-Id: I1270e0296808a53e5a2559c19526cec67b5dbc33
Signed-off-by: raghavendra ambadas <rambad@codeaurora.org>
Revert "msm_fb: display: Program TILE video frame size in dma ISR"

This reverts commit 472d090f0b745f09d515b81961291971996b6fd3.

Change-Id: Ic38c8d634cec7200df58dcf108b4f37b4fe06f70
Signed-off-by: raghavendra ambadas <rambad@codeaurora.org>
msm: kgsl: Protect against a potential overflow in kgsl_sg_alloc

Avoid allocating a scatterlist so large that it overflows the size
passed to the memory allocators.

CRs-fixed: 564448
Change-Id: Ic0dedbad2ab421ddec8f3be38d61c9bdf9ae5bd4
Signed-off-by: Jordan Crouse <jcrouse@codeaurora.org>
msm: kgsl: avoid zero length scatterlist allocation

During sglist allocation we calculate sglen as
per below

sglen_alloc = PAGE_ALIGN(size) >> PAGE_SHIFT;

sglen_alloc can be zero if size falls within the
last page. For example, when size = 0xFFFF_FF7B,
PAGE_ALIGN(0xFFFF_FF7B) will be 0, considering
0x1000 (4kb) PAGE_SIZE. if kzalloc() with
zero size, it will return ZERO_SIZE_PTR which is
not NULL and we always do NULL check. Dereferencing
ZERO_SIZE_PTR will lead to a distinct access fault.

Signed-off-by: Gaurav Gagrani <ggagrani@codeaurora.org>

Change-Id: Ibcc6198438c13b5111be0faa736328db92511597
CRs-Fixed: 563106
Signed-off-by: Prakash Kamliya <pkamliya@codeaurora.org>