msm: vidc: handle dynamic buffers in pendingq during flush

In dynamic buffer mode, if flush was received before
stream-on, driver would have incremented the ref count
for output buffers, but not yet sent to firmware. So,
after flush done, there would be no fbd from firmware
and the reference to these buffers would not be removed.
So when the buffers are dequeued, driver fails to
unmap and free the output buffers.
Subsequently, after flush done, when client queues
the same output buffers again to driver, the ref
count is increased and becomes 2. This results in
the driver holding the buffers with itself, thereby
entering in to a deadlock situation and starving the
firmware of output buffers. This results in a video
freeze.

Change-Id: I0c3d13124bd48b900e56e14666eaed2f0e7ee9d6
Signed-off-by: Arun Menon <avmenon@codeaurora.org>
msm: msm_bus: Fix inadvertent stomp on BKE_EN register

While setting the QoS mode of fixed mode masters bad masking
operations is causing accidental stomp on the upper nibble of the
BKE_EN register.

Change-Id: I5675e1dbc6fd5a01faac49c903e12a9c95e32254
Signed-off-by: Girish Mahadevan <girishm@codeaurora.org>
wcnss: Reduce the pil_retry count value

wcnss driver doing multiple pil retry which causing boot process
block upto all pil retry finish. reduce the pil retry count so
it will not delay other boot process.

Change-Id: I753e5d381a3559eaee30fddd50ecc65a30815f64
CRs-Fixed: 688990
Signed-off-by: Hardik Kantilal Patel <hkpatel@codeaurora.org>
ARM: dts: msm: Update the vifeed back routing

Codec clock should be enabled when vifeedback path for speaker
protection is enabled.
Change adds the routing entries to enable the codec clock for
speaker protection vi capture feedback path for 8974.

Change-Id: I6230f5a40a20a3d5e81d194a622083ece8873b79
CRs-fixed: 591723
Signed-off-by: Gopikrishnaiah Anandan <agopik@codeaurora.org>
misc: Kill logspam

Change-Id: Ida0b1eaeda4c678f0103675b44a8cc845f3dacbf
ASoC: msm: Rampup volume on each start

Rampup volume on each trigger start call to compress driver.
This helps in reducing pops heard by the listener after a seek/pause+resume

Change-Id: I0d82c5a9a8ed2b64683e8c0855da2208c90d8199
Signed-off-by: Haynes Mathew George <hgeorge@codeaurora.org>
CRs-Fixed: 692337
ASoC: msm8974: Add VoWLAN dia link

Add VoWLAN dai link to the machine driver
to enable Voice over WLAN.

CRs-fixed: 662362
Change-Id: I3ada1f10436e5724670052901b648f46885d3bf6
Signed-off-by: Vicky Sehrawat <vickys@codeaurora.org>
bacon: Enable NET_KEY & NETFILTER_XT_TARGET_TCPMSS

IPsec VPN requires PF_KEYv2 socket to work,
so enable it.

TCPMSS patching is also required after the VPN is
connected, otherwise large TCP packets may get dropped.

Change-Id: I758fa9b7779395fcc5cb52f8561ac28b09715535
find7: Enable NET_KEY & NETFILTER_XT_TARGET_TCPMSS

IPsec VPN requires PF_KEYv2 socket to work,
so enable it.

TCPMSS patching is also required after the VPN is
connected, otherwise large TCP packets may get dropped.

Change-Id: Iecb4f58cb2453282d23fde4a24b4a6f50547c1d2
crypto: msm: add suspend/resume callback for qcedev driver

Make chanegs to add suspend/resume callback for qcedev driver, and
disable ce clocks when entering suspend and re-enable clocks in resume.

Change-Id: Ibeab1e7cb531af79ae973d7ff0d0ed2d776f6d6f
Signed-off-by: Zhen Kong <zkong@codeaurora.org>
Signed-off-by: William Clark <wclark@codeaurora.org>
crypto: msm: Fix SHA-1/256 zero length input data issue

Crypto module generating wrong hash value for zero length input data
using SHA1 and SHA256 functions. This patch fixes the issue to generate
proper hash value.

Change-Id: I795969cf2d3e3887064d56e35cbb488937051ac8
Signed-off-by: AnilKumar Chimata <anilc@codeaurora.org>
msm: kgsl: Do not return invalid power stats when the device is off

adreno_power_stats() was returning unitialized data when the device
state was not active. Leave early from the function if the device
is not active and return 0s instead.

Change-Id: Ic0dedbadf6201cadb4472327c4ce7f9d9d32b82d
Signed-off-by: Jordan Crouse <jcrouse@codeaurora.org>
Signed-off-by: Prabhat Awasthi <pawasthi@codeaurora.org>
mmc: core: Fix null pointer dereference due to race conditions

Fix race condition between mmcqd thread and the mmc_queue_suspend
updating a shared variable mq->flags, which can lead to potential
null pointer dereference as following-

Unable to handle kernel NULL pointer dereference at
virtual address 00000020
pgd = c0004000
[00000020] *pgd=00000000
mmcqd/0:  186] Internal error: Oops: 5 [#1] PREEMPT SMP ARM
CPU: 0    Tainted: G        W     (3.4.0-1251694-eng #1)
PC is at mmc_blk_err_check+0x20c/0x3b8
LR is at mmc_start_req+0x198/0x718

cpu0		|	cpu1
x |= 1		|	x |= 2

final value of x can be x = 1 or x = 2

Change-Id: Ie0fff6d6dba5aebb3584cba9fb98de24515c4cd8
Signed-off-by: Sujit Reddy Thumma <sthumma@codeaurora.org>
net: Zeroing the structure ethtool_wolinfo in ethtool_get_wol()

memset() the structure ethtool_wolinfo that has padded bytes
but the padded bytes have not been zeroed out.

Change-Id: If3fd2d872a1b1ab9521d937b86a29fc468a8bbfe
Signed-off-by: Avijit Kanti Das <avijitnsec@codeaurora.org>
n_tty: Fix n_tty_write crash when echoing in raw mode

The tty atomic_write_lock does not provide an exclusion guarantee for
the tty driver if the termios settings are LECHO & !OPOST. And since
it is unexpected and not allowed to call TTY buffer helpers like
tty_insert_flip_string concurrently, this may lead to crashes when
concurrect writers call pty_write. In that case the following two
writers:
* the ECHOing from a workqueue and
* pty_write from the process
race and can overflow the corresponding TTY buffer like follows.

If we look into tty_insert_flip_string_fixed_flag, there is:
  int space = __tty_buffer_request_room(port, goal, flags);
  struct tty_buffer *tb = port->buf.tail;
  ...
  memcpy(char_buf_ptr(tb, tb->used), chars, space);
  ...
  tb->used += space;

so the race of the two can result in something like this:
          A                             B
   __tty_buffer_request_room
                                  __tty_buffer_request_room
   memcpy(buf(tb->used), ...)
   tb->used += space;
                                 memcpy(buf(tb->used), ...) ->BOOM

B's memcpy is past the tty_buffer due to the previous A's tb->used
increment.

Since the N_TTY line discipline input processing can output
concurrently with a tty write, obtain the N_TTY ldisc output_lock to
serialize echo output with normal tty writes. This ensures the tty
buffer helper tty_insert_flip_string is not called concurrently and
everything is fine.

Note that this is nicely reproducible by an ordinary user using
forkpty and some setup around that (raw termios + ECHO). And it is
present in kernels at least after commit
d945cb9cce20ac7143c2de8d88b187f62db99bdc (pty: Rework the pty layer to
use the normal buffering logic) in 2.6.31-rc3.

js: add more info to the commit log
js: switch to bool
js: lock unconditionally
js: lock only the tty->ops->write call

Signed-off-by: Peter Hurley <peter@hurleysoftware.com>
Signed-off-by: Jiri Slaby <jslaby@suse.cz>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Change-Id: I9e235db6ec2bb950f26bd8a23f6145dab5dc0a15
Git-commit: 4291086b1f081b869c6d79e5b7441633dc3ace00
Git-repo: git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
Signed-off-by: Avijit Kanti Das <avijitnsec@codeaurora.org>
[rsiddoji@codeaurora.org: resolve trivial merge conflicts]
Signed-off-by: Ravi Kumar S <rsiddoji@codeaurora.org>
msm_bam_rmnet: Fix potential memory corruption

Usage of legacy string manipulation function sprintf could lead to
memory corruption as the number of bytes to be written to the
destination is not bounded. Replace sprintf with snprintf where the
number of bytes to be written is explicitly specified.

CRs-fixed: 672202
Change-Id: Iab7516ad0e2540eb619fe96e26a3516c7adf86cc
Signed-off-by: Subash Abhinov Kasiviswanathan <subashab@codeaurora.org>
ASoC: msm: qdspv2: Fix junk characters in session name

Initialize MVM session name array to zero to avoid junk
characters at the end.

Change-Id: I441e5dbeb4052c937bb99f9c4c96a91c410db553
CRs-fixed: 702741
Signed-off-by: Karthik Reddy Katta <a_katta@codeaurora.org>
ASoC: msm: qdsp6v2: Add a new waitqueue state for mem map/unmap

All of the commands being sent to the DSP are using cmd_state flag
which can be overwritten when several commands are sent at the same
time. This results in Memory map command timing out. The change will
separate the memory flag from flags for other commands so that they
do not overwrite each other.

Change-Id: If42ff7c34180eb0004c97ffc0eb656f0c30be0d8
CRs-fixed: 673781
Signed-off-by: Damir Didjusto <damird@codeaurora.org>
Signed-off-by: Gopikrishnaiah Anandan <agopik@codeaurora.org>
Revert "input: touch: synaptics: Reset the device when blanking display"

This reverts commit e1786f2ab98c5d1062b33959ebd9523609c9468f.

Change-Id: Ic2db4b74cc10cf32f320388401aa2dcb40b14824
arm/dt: Don't mess with vdd during idle screen PC

 * This is causing problems with our touchscreen. Don't
   mess with this regulator as it can cause mass chaos
   due to desync between panel and TS.

Change-Id: Ibfdc6455bf1ae003811bf60d01fcc1a6639559d2