mmc: queue: scale down the max_segs if memory allocation fails

In low memory conditions at runtime, allocation of max_segs may
fail. Retry with a scaled down max_segs until allocation succeeds.

CRs-fixed: 583267
Change-Id: I072724afa44854dacc58654e6329531c1bb11120
Signed-off-by: Subhash Jadavani <subhashj@codeaurora.org>
Signed-off-by: Asutosh Das <asutoshd@codeaurora.org>
msm: vidc: add support to set VP8 QP range

QP range differs from codec to codec. This change adds support
for VP8 QP min and max range.

Change-Id: Ia44cf885a8b6f71b7eef51076968021ae68d7a7e
CRs-Fixed: 578892
Signed-off-by: Jorge Solano Altamirano <jsolano@codeaurora.org>
usb: gadget: mbim: protect packets queue corruption

The f_mbim usb function driver maintain a packets queue sent from the
host as encapsulated commands which need to be read by the QBI using the
mbim_read fops.

In case of excessive messages arriving from the host we end up with simple
race condition between the queue writer and queue reader which end up in
corruption of the queue and packet loss.

Simply add a missing lock protection upon reading (deleting) a packet from
queue.

CRs-Fixed: 576720
Change-Id: I8aff04745f02cbefd3d6b83d944cad9aa1726ebf
Signed-off-by: Ido Shayevitz <idos@codeaurora.org>
drivers: qpnp-bms: Use disable_irq_nosync() in IRQ context

Do not use disable_irq() as it waits for the irq handler
to complete causing a deadlock.

CRs-Fixed: 591227
Change-Id: I0a1d29845b3bced2fda6080765c20dff678050d4
Signed-off-by: Anirudh Ghayal <aghayal@codeaurora.org>
spi_qsd: Remove check for unaligned  length during input_irq

QUP_IRQ complete is triggered before dmov_rx callback.
Which will initiate SPI to start next transfer, due to
this earlier DMOV_CMD is blocked and results in kernel panic.

Current Implementation  make sure that transfer complete waits
For DMOV callback only in case of aligned lengths ,This patch
ensures transfer trigger only after DMOV RX call back for
unaligned length also.

CRs-Fixed: 583126
Change-Id: I306a705d0eaf0eac33b2dbf335992254351cce20
Signed-off-by: Sana Venkat Raju <c_vsana@codeaurora.org>
msm: kgsl: Fix the api type in adreno drawctxt flags

Adding the missed type field in adreno draw ctxt create
which was giving incorrect data type.

CRs-Fixed: 590103

Signed-off-by: Anoop Kumar Yerukala <ayeruk@codeaurora.org>
Signed-off-by: Prabhat Awasthi <pawasthi@codeaurora.org>
Change-Id: I6f464a3b6cc1fec3891d1189f85c7fe9ac65764e
msm: kgsl: protect syncpoint events with a reference count

Replace the event spinlock with krefs to avoid the possiblity
of calling a sleeping function while holding the spinlock and
to generally make the whole cmdbatch cancel loop a lot more
stable.

Change-Id: I08ba54fa4c5a11c05e3503dfc6a4ee040733e5a6
Signed-off-by: Jeff Boody <jboody@codeaurora.org>
Signed-off-by: Jordan Crouse <jcrouse@codeaurora.org>
msm: kgsl: fix race condition setting the event->handle

A race condition existed for setting the event->handle since the
async event can signal at any time after it has been registered.
When the event signals the reference count for the synclist and
the async callback are decremented causing the event to be freed.
The kgsl_cmdbatch_add_sync_fence function needs to take another
reference to ensure that the handle can be set before the event
is freed.

Change-Id: I0d8a02246e42dce014661d6f14c685415f1704cd
Signed-off-by: Jeff Boody <jboody@codeaurora.org>
msm: mdss: On sharing dma pipe increment pipe ref_cnt

When DMA pipe is being shared and if mdss_mdp_pipe_map is called,
there could be a race condition when the pipe being shared
is unmapped, will lead to map failure as map is used for operations
on pipe which are already having positive ref_cnt.
This can result in potential map failure and attempt to free of
unmapped pipe resulting in crash.

Hence in this scenario of shared pipe usage atomic_inc should
be used instead of mdss_mdp_pipe_map.

CRs-Fixed: 590736
Change-Id: Ibaba20ac96662b5cd8aba3585f10d9cfe6e72d22
Signed-off-by: Justin Philip <jphili@codeaurora.org>
msm: kgsl: Pass the right timeout to adreno_drawctxt_wait()

adreno_drawctxt_wait() expects the passed in timeout to be in
milliseconds and converts it to jiffies.  Unfortunately, so does
the caller so the timeout is shorter than it should be.

Change-Id: Ic0dedbad85d50b32dba0fbf3ebb914335bf55166
Signed-off-by: Jordan Crouse <jcrouse@codeaurora.org>
msm: camera: Fix unterminated of_device_id table

Add a NULL table entry at end for msm, ispif and
msm_generic_buf_mgr device tree match tables.

Change-Id: I05f08c77a8a25112cd17955e98018ac88b7a834c
CRs-Fixed: 582110
Signed-off-by: Hariram Purushothaman <hpurus@codeaurora.org>
ARM: dts: msm: Increase OCMEM BW request for video decode

There are framedrops observed on high bitrate clips because
OCMEM BW is not sufficient for these clips. Increase OCMEM BW
to avoid framedrops.

Change-Id: I7f3238036259e43a12899f2f7c73318328ae8eca
CRs-fixed: 571634
Signed-off-by: Vinay Kalia <vkalia@codeaurora.org>
wcnss: Sample WCNSS TOP AHB clock on WCNSS WDOG bite

Sample the wcss_top_ahb_clk and determine whether or not the clock freq
is zero when the issue occurs. This will help confirm the reason for
the system reset when Apps tries to access PMU registers for logging
purposes.

Change-Id: Ia4f34a38b7e8d237b9e5ae935d9ce339ca2d6ed1
Signed-off-by: Yue Ma <yuem@codeaurora.org>
ASoC: msm: Add Buffer overflow check

The overflow check is required to ensure that user space data
in kernel may not go beyond buffer boundary.

Change-Id: I7d94a209c0b8818bfb9c65f8c13a5f5e36c49e2d
CRs-Fixed: 563086
Signed-off-by: Mohammad Johny Shaik <mjshai@codeaurora.org>
msm: buspm: Correct size type in buspm_xfer_req

Variable size inside buspm_xfer_req
can be negative and thus would be a
large positive number resulting in arbitary
Kernel read. This patch corrects this value.

CRs-Fixed: 563529
Change-Id: I877db6960530d6c7d1486da9cfdc15a43e57e152
Signed-off-by: Sana Venkat Raju <c_vsana@codeaurora.org>
qseecom: Add support for bus scaling

Add support for scaling bus to various level:
LOW, MEDIUM, HIGH.  Expose IOCTL to user space
clients to enable selecting a specific bus bandwidth
setting.

Signed-off-by: Mona Hossain <mhossain@codeaurora.org>
Signed-off-by: Zhen Kong <zkong@codeaurora.org>
msm: vidc: add sleep of 100us before clock disable

ARM9 execute following sequence when venus is idle
1. Disable ARM9 watchdog
2. Set bit 30 of A_VENUS_CPU_CS_SCIACMDARG0 register
   to indicate venus is idle
3. Write HFI_MSG_SYS_IDLE to message queue
4. Raise interrupt to host
5. ARM9 execute wait for interrupt instruction to go
   into low power state. This will internally drain the
   ARM9 write buffer which can generate bus transaction.
6. ARM9 in idle

Host clock gate venus based on following sequence
1. Host receive HFI_MSG_SYS_IDLE from the msg queue
2. Host check both cmd / msg queue are empty by
   comparing the queue read/write pointers.
3. Host check bit 30 of A_VENUS_CPU_CS_SCIACMDARG0
   register to confirm it indicate idle
4. Host clock gate whole venus

As the host clock gate venus in step 4, ARM9 is still
in step 5&6. The sleep will ensure that step 5 and 6
are completed before host clock gates venus.

CRs-Fixed: 589417
CRs-Fixed: 595251
Change-Id: Idf1f788718adea2dacceca97afa4ba4fe4562ddd
Signed-off-by: Vikash Garodia <vgarodia@codeaurora.org>
Asoc: Add support for codec bulk write for Helicon

Helicon can not use existing bulk_write function
as analog and digital codecs are in different busses.
So implement bulk write accordingly as per the codec interfaces

CRs-Fixed: 593609
Change-Id: Ibc16539cbd795fd998e88b6dc5b9060d70b498ac
Signed-off-by: Yeleswarapu, Nagaradhesh <nagaradh@codeaurora.org>
radio: iris: Fixed an issue with search stations list.

RDS search, search station list were getting excluded
while checking bounds for allowed search types. Fixed
check to include them.

CRs-fixed: 597996
Change-Id: Ia2d7cc8a1bbf8e861a0e23dfc8ca56181b42b810
Signed-off-by: Satish Kodishala <skodisha@codeaurora.org>
camera_v2: jpeg_10: Set state before hw start

The setting of driver state is now done before the JPEG
engine is started.

Signed-off-by: Kamen Kirov <kkirov@codeaurora.org>
CRs-fixed: 598605
Change-Id: I0960c925386d22efb11aebf99ad7718abd4f83e8