ARM: Improve vmalloc address checking in show_data()

There is an unhandled corner case with the current check
which has recently been hit. The nbytes argument may be
large enough for the range being dumped to cross a
boundary between page-table mappings, and dump addresses
which are vmalloc'd in the neighboring mapping.

Check every address being dumped to see if its vmalloc'd,
not just the address passed to show_data().

CRs-Fixed: 625442
Change-Id: I255b093808177321f5202dcacea337ee333bfc63
Signed-off-by: Matt Wagantall <mattw@codeaurora.org>
cma: Remove potential deadlock situation

A report was given of a deadlock situation on the cma_mutex:

mutex_lock(cma_mutex)   (*2)
dma_release_from_contiguous
ion_secure_cma_free_chunk
ion_secure_cma_shrinker
shrink_slab
try_to_free_pages
migrate_pages
alloc_contig_range
mutex_lock(cma_mutex)  (*1)
dma_alloc_from_contiguous
ion_alloc

We may need to free CMA allocations while a current CMA allocation is in
progress if CMA is freed from a shrinker. cma_mutex currently protects
two things: the bitmap indicating which pages are allocated/free and
serialization of isolation/migration calls on allocation. There is
no need to take the mutex on free calls though as the pages are
freed back into the system via the regular __free_page call. Move
the free_contig_range call outside the cma_mutex to break the
chain dependency. We can safely free the pages back into the system
before changing the bitmap without any risk of races.

Change-Id: I4989eb2891e502b08db8117a51bd86652e902778
CRs-Fixed: 619644
Signed-off-by: Laura Abbott <lauraa@codeaurora.org>
cma: Make locking finer grained

CMA locking is currently very coarse. The cma_mutex protects both
the bitmap and avoids concurrency with alloc_contig_range. There
are several situations which may result in a deadlock on the CMA
mutex currently, mostly involving AB/BA situations with alloc and
free. Fix this issue by protecting the bitmap with a mutex per CMA
region and use the existing mutex for protecting against concurrency
with alloc_contig_range.

Change-Id: I6863ba7ab7fae07c68fee23b0aa4c869244fe2a1
Signed-off-by: Laura Abbott <lauraa@codeaurora.org>
dma-contiguous: Retrun 'zero' pfn in case of error

When CMA allocator gets error return from the page
allocator framework, except for the -EBUSY case, it
will bail out. Caller depends on the 'pfn' for
confirming allocation successful or not. Return 0
for those error case.

CRs-Fixed: 647635
Change-Id: Ica4e04a9f9f18b1a29035ba2bae9deecfd68a5e8
Signed-off-by: Chintan Pandya <cpandya@codeaurora.org>
mmc: core: Fix clock frequency transitions during invalid states

eMMC and SD card specifications restrict the usage of a class of
commands while commands in other class are in progress. For example,
during erase operations the SD/eMMC spec. allows only CMD35, CMD36,
CMD38. If clock scaling is enabled and decide to scale up the clocks
it may be possible that CMD19/21 tuning commands are sent in between
erase commands, which is illegal as per specification.

Fix such illegal transactions to the card and also make clock scaling
statistics accountable only for read/write commands instead of time
consuming commands, like CMD38 erase, where transactions are independent
of bus frequency.

Change-Id: Iffba175787837e7f95bde8970f19d0f0f9d7d67d
Signed-off-by: Sujit Reddy Thumma <sthumma@codeaurora.org>
ASoC: msm: qdsp6v2: Avoid DS1 and SRS topology on low latency path

Currently, the low latency path go through tuning of the post
processing with the default as well as third party post
processing topologies such as DS1 and TruMedia topology. Avoid
enabling the DS1 and TruMedia topology on low latency path
retaining the tuning functionality on the default topology.

CRs-Fixed: 643857
Change-Id: I8ae6b4ecb0be530c8d72218d39498cff7f8a7fd9
Signed-off-by: Subhash Chandra Bose Naripeddy <snariped@codeaurora.org>
ASoC: msm: Use 16K sample rate for RFECNS

To enable record with an RFECNS device use a 16K
sample rate

Change-Id: Ib9c6a4605f6a7f9e5f4c25280e0cc646459815fc
Signed-off-by: Ben Romberger <bromberg@codeaurora.org>
soc: qcom: smd: Validate read and write addresses

The address from which data has to be read and the address to which the
SMD data has to be written is calculated based on the head and tail
indices for that SMD FIFO. If the indices are corrupted, then the
calculated pointer may be outside of the FIFO and may even be outside of
the range of SMEM.

Validate the read and write addresses to be with in the limits of
receive and send FIFO limits respectively.

CRs-Fixed: 550527
Change-Id: Ie5578f6aee73ea2b1435fea7c2a0a6dda14bff82
Signed-off-by: Zaheerulla Meer <zmeer@codeaurora.org>
msm: hotplug: Terminate load thresh table
msm: vidc: update max P frames num for encode

Remove the restriction on the max number of
P frame interval.

Change-Id: I637372d7b0d409602df251bad4a135b25514dc95
Signed-off-by: Arun Menon <avmenon@codeaurora.org>
Signed-off-by: houst0nn <houstonn@gmail.com>
msm: vidc: update max P frames num for encode

Remove the restriction on the max number of
P frame interval.

Change-Id: I637372d7b0d409602df251bad4a135b25514dc95
Signed-off-by: Arun Menon <avmenon@codeaurora.org>
Signed-off-by: houst0nn <houstonn@gmail.com>
msm: camera: Exit gracefully while camera daemon crashes

Add camera daemon shutdown handling in all camera
sub devices to exit camera gracefully and it helps
to restart camera.

Change-Id: I39643a16f100b873275efe3a0c6184fe54e52830
Signed-off-by: Suresh Vankadara <svankada@codeaurora.org>
msm: camera2: cpp: Set exact size for firmware loading.

The poll reads after during and after firmware loading fails.
This is because the exact size of firmware changes with the
version of the firmware. This change uses the firmware size
based on actual firmware file being loaded.

Change-Id: I949954347a48d0b388b11b3c81fd5d1a4627cbf7
Signed-off-by: Rajakumar Govindaram <rajakuma@codeaurora.org>
(cherry picked from commit 7f0705c6eb86ceca1adec45bbaeb44bcd0b87079)
msm: camera: Cleanup msm generic buf queue handling

Clean-up the msm camera generic buff queue when all
client closes the handle and also provide init-deinit
ioctl for cpp to open-close the buff mngr handle.

Change-Id: Ie484174e0ffaee02e85c9c9cda8ac26103aaddd0
CRs-Fixed: 582261
Signed-off-by: Hariram Purushothaman <hpurus@codeaurora.org>
msm: camera: Cleanup msm generic buf queue handling

Clean-up the msm camera generic buff queue when all
client closes the handle and also provide init-deinit
ioctl for cpp to open-close the buff mngr handle.

Change-Id: Ie484174e0ffaee02e85c9c9cda8ac26103aaddd0
CRs-Fixed: 582261
Signed-off-by: Hariram Purushothaman <hpurus@codeaurora.org>
msm: ispif: Clean up typecasts/format specifiers

Clean up typecasts and format specifiers in msm_ispif.c

Change-Id: I53b8aec6f5a2a5f0271ca2f5cab5de6d72c186c2
Signed-off-by: Seemanta Dutta <seemanta@codeaurora.org>
msm: camera: Add defensive check in ISPIF driver

In case of error handling, call ispif release only if ispif handle
is valid. In case of mm-qcamara-daemon crash when camera is not open,
these handles are not valid. Hence it leads to kernel crash in ispif
release handler.

Change-Id: Ifb402b6907052594d12fcf9495694e6c5184af1b
Signed-off-by: Sreesudhan Ramakrish Ramkumar <srramku@codeaurora.org>
msm: camera_v2: cci: check for NULL pointer

in function "msm_cci_subdev_g_chip_ident"
check for NULL pointer and return error
instead of assert

Change-Id: Ia27751c4d6f3d5ead1749e396ffa5c2773f1582b
Signed-off-by: Georgi Hristov <ghristov@codeaurora.org>
msm: camera: Limit print in default case of JPEG

Change JPEG_PR_ERR to pr_err_ratelimited in default
case in JPEG ioctl. JPEG_PR_ERR would keep prinitng
when passing invalid parameters in ioctl which will
cause watchdog reset.

Change-Id: Ia8871fda4f10e44e3d2c1216765e26c2e9823038
CRs-fixed: 588260
Signed-off-by: Yiduo Wang <yiduow@codeaurora.org>
msm: camera: Fix possible NULL pointer dereference.

The result of memory allocation in msm_isp_get_buf is not checked for
success before use. This can lead to NULL pointer dereference.

Change-Id: I83cb56bbcd5e7526bf57a6de1077a30f9a2b5349
Signed-off-by: Petar Sivenov <psiven@codeaurora.org>