Merge "msm: ipa: Update IPA SRAM mapping"
diff --git a/arch/arm64/boot/dts/qcom/sdmmagpie-pinctrl.dtsi b/arch/arm64/boot/dts/qcom/sdmmagpie-pinctrl.dtsi
index 059b599..b2db82b 100644
--- a/arch/arm64/boot/dts/qcom/sdmmagpie-pinctrl.dtsi
+++ b/arch/arm64/boot/dts/qcom/sdmmagpie-pinctrl.dtsi
@@ -1,4 +1,4 @@
-/* Copyright (c) 2018, The Linux Foundation. All rights reserved.
+/* Copyright (c) 2018-2019, The Linux Foundation. All rights reserved.
  *
  * This program is free software; you can redistribute it and/or modify
  * it under the terms of the GNU General Public License version 2 and
@@ -417,20 +417,20 @@
 			fpc_reset_low: reset_low {
 				mux {
 					pins = "gpio91";
-					function = "fpc_reset_gpio_low";
+					function = "gpio";
 				};
 				config {
 					pins = "gpio91";
 					drive-strength = <2>;
 					bias-disable;
 					output-low;
-					};
+				};
 			};
 
 			fpc_reset_high: reset_high {
 				mux {
 					pins = "gpio91";
-					function = "fpc_reset_gpio_high";
+					function = "gpio";
 				};
 
 				config {
@@ -444,6 +444,7 @@
 			fpc_int_low: int_low {
 				mux {
 					pins = "gpio90";
+					function = "gpio";
 				};
 				config {
 					pins = "gpio90";
diff --git a/arch/arm64/boot/dts/qcom/sm6150-pinctrl.dtsi b/arch/arm64/boot/dts/qcom/sm6150-pinctrl.dtsi
index c7399a9..8b4ad9d 100644
--- a/arch/arm64/boot/dts/qcom/sm6150-pinctrl.dtsi
+++ b/arch/arm64/boot/dts/qcom/sm6150-pinctrl.dtsi
@@ -193,20 +193,20 @@
 			fpc_reset_low: reset_low {
 				mux {
 					pins = "gpio101";
-					function = "fpc_reset_gpio_low";
+					function = "gpio";
 				};
 				config {
 					pins = "gpio101";
 					drive-strength = <2>;
 					bias-disable;
 					output-low;
-					};
+				};
 			};
 
 			fpc_reset_high: reset_high {
 				mux {
 					pins = "gpio101";
-					function = "fpc_reset_gpio_high";
+					function = "gpio";
 				};
 
 				config {
@@ -220,6 +220,7 @@
 			fpc_int_low: int_low {
 				mux {
 					pins = "gpio93";
+					function = "gpio";
 				};
 				config {
 					pins = "gpio93";
diff --git a/drivers/base/core.c b/drivers/base/core.c
index d46e84d..6a34a31 100644
--- a/drivers/base/core.c
+++ b/drivers/base/core.c
@@ -1582,7 +1582,7 @@ static void cleanup_glue_dir(struct device *dev, struct kobject *glue_dir)
 		return;
 
 	mutex_lock(&gdp_mutex);
-	if (!kobject_has_children(glue_dir))
+	if (!kobject_has_children(glue_dir) && kref_read(&glue_dir->kref) == 1)
 		kobject_del(glue_dir);
 	kobject_put(glue_dir);
 	mutex_unlock(&gdp_mutex);
diff --git a/drivers/char/adsprpc.c b/drivers/char/adsprpc.c
index ff9a527..b592b8b 100644
--- a/drivers/char/adsprpc.c
+++ b/drivers/char/adsprpc.c
@@ -216,10 +216,12 @@ struct smq_invoke_ctx {
 	int tgid;
 	remote_arg_t *lpra;
 	remote_arg64_t *rpra;
+	remote_arg64_t *lrpra;		/* Local copy of rpra for put_args */
 	int *fds;
 	unsigned int *attrs;
 	struct fastrpc_mmap **maps;
 	struct fastrpc_buf *buf;
+	struct fastrpc_buf *lbuf;
 	size_t used;
 	struct fastrpc_file *fl;
 	uint32_t sc;
@@ -1251,6 +1253,7 @@ static void context_free(struct smq_invoke_ctx *ctx)
 		fastrpc_mmap_free(ctx->maps[i], 0);
 	mutex_unlock(&ctx->fl->map_mutex);
 	fastrpc_buf_free(ctx->buf, 1);
+	fastrpc_buf_free(ctx->lbuf, 1);
 	ctx->magic = 0;
 	ctx->ctxid = 0;
 
@@ -1396,7 +1399,7 @@ static void fastrpc_file_list_dtor(struct fastrpc_apps *me)
 
 static int get_args(uint32_t kernel, struct smq_invoke_ctx *ctx)
 {
-	remote_arg64_t *rpra;
+	remote_arg64_t *rpra, *lrpra;
 	remote_arg_t *lpra = ctx->lpra;
 	struct smq_invoke_buf *list;
 	struct smq_phy_page *pages, *ipage;
@@ -1405,7 +1408,7 @@ static int get_args(uint32_t kernel, struct smq_invoke_ctx *ctx)
 	int outbufs = REMOTE_SCALARS_OUTBUFS(sc);
 	int handles, bufs = inbufs + outbufs;
 	uintptr_t args;
-	size_t rlen = 0, copylen = 0, metalen = 0;
+	size_t rlen = 0, copylen = 0, metalen = 0, lrpralen = 0;
 	int i, oix;
 	int err = 0;
 	int mflags = 0;
@@ -1453,7 +1456,20 @@ static int get_args(uint32_t kernel, struct smq_invoke_ctx *ctx)
 	metalen = copylen = (size_t)&ipage[0] + (sizeof(uint64_t) * M_FDLIST) +
 				 (sizeof(uint32_t) * M_CRCLIST);
 
-	/* calculate len requreed for copying */
+	/* allocate new local rpra buffer */
+	lrpralen = (size_t)&list[0];
+	if (lrpralen) {
+		err = fastrpc_buf_alloc(ctx->fl, lrpralen, 0, 0, 0, &ctx->lbuf);
+		if (err)
+			goto bail;
+	}
+	if (ctx->lbuf->virt)
+		memset(ctx->lbuf->virt, 0, lrpralen);
+
+	lrpra = ctx->lbuf->virt;
+	ctx->lrpra = lrpra;
+
+	/* calculate len required for copying */
 	for (oix = 0; oix < inbufs + outbufs; ++oix) {
 		int i = ctx->overps[oix]->raix;
 		uintptr_t mstart, mend;
@@ -1504,13 +1520,13 @@ static int get_args(uint32_t kernel, struct smq_invoke_ctx *ctx)
 
 	/* map ion buffers */
 	PERF(ctx->fl->profile, GET_COUNTER(perf_counter, PERF_MAP),
-	for (i = 0; rpra && i < inbufs + outbufs; ++i) {
+	for (i = 0; rpra && lrpra && i < inbufs + outbufs; ++i) {
 		struct fastrpc_mmap *map = ctx->maps[i];
 		uint64_t buf = ptr_to_uint64(lpra[i].buf.pv);
 		size_t len = lpra[i].buf.len;
 
-		rpra[i].buf.pv = 0;
-		rpra[i].buf.len = len;
+		rpra[i].buf.pv = lrpra[i].buf.pv = 0;
+		rpra[i].buf.len = lrpra[i].buf.len = len;
 		if (!len)
 			continue;
 		if (map) {
@@ -1538,7 +1554,7 @@ static int get_args(uint32_t kernel, struct smq_invoke_ctx *ctx)
 			pages[idx].addr = map->phys + offset;
 			pages[idx].size = num << PAGE_SHIFT;
 		}
-		rpra[i].buf.pv = buf;
+		rpra[i].buf.pv = lrpra[i].buf.pv = buf;
 	}
 	PERF_END);
 	for (i = bufs; i < bufs + handles; ++i) {
@@ -1556,7 +1572,7 @@ static int get_args(uint32_t kernel, struct smq_invoke_ctx *ctx)
 	/* copy non ion buffers */
 	PERF(ctx->fl->profile, GET_COUNTER(perf_counter, PERF_COPY),
 	rlen = copylen - metalen;
-	for (oix = 0; rpra && oix < inbufs + outbufs; ++oix) {
+	for (oix = 0; rpra && lrpra && oix < inbufs + outbufs; ++oix) {
 		int i = ctx->overps[oix]->raix;
 		struct fastrpc_mmap *map = ctx->maps[i];
 		size_t mlen;
@@ -1575,7 +1591,8 @@ static int get_args(uint32_t kernel, struct smq_invoke_ctx *ctx)
 		VERIFY(err, rlen >= mlen);
 		if (err)
 			goto bail;
-		rpra[i].buf.pv = (args - ctx->overps[oix]->offset);
+		rpra[i].buf.pv = lrpra[i].buf.pv =
+			 (args - ctx->overps[oix]->offset);
 		pages[list[i].pgidx].addr = ctx->buf->phys -
 					    ctx->overps[oix]->offset +
 					    (copylen - rlen);
@@ -1607,7 +1624,8 @@ static int get_args(uint32_t kernel, struct smq_invoke_ctx *ctx)
 		if (map && (map->attr & FASTRPC_ATTR_COHERENT))
 			continue;
 
-		if (rpra && rpra[i].buf.len && ctx->overps[oix]->mstart) {
+		if (rpra && lrpra && rpra[i].buf.len &&
+			ctx->overps[oix]->mstart) {
 			if (map && map->buf) {
 				dma_buf_begin_cpu_access(map->buf,
 					DMA_BIDIRECTIONAL);
@@ -1620,10 +1638,11 @@ static int get_args(uint32_t kernel, struct smq_invoke_ctx *ctx)
 		}
 	}
 	PERF_END);
-	for (i = bufs; rpra && i < bufs + handles; i++) {
-		rpra[i].dma.fd = ctx->fds[i];
-		rpra[i].dma.len = (uint32_t)lpra[i].buf.len;
-		rpra[i].dma.offset = (uint32_t)(uintptr_t)lpra[i].buf.pv;
+	for (i = bufs; rpra && lrpra && i < bufs + handles; i++) {
+		rpra[i].dma.fd = lrpra[i].dma.fd = ctx->fds[i];
+		rpra[i].dma.len = lrpra[i].dma.len = (uint32_t)lpra[i].buf.len;
+		rpra[i].dma.offset = lrpra[i].dma.offset =
+			 (uint32_t)(uintptr_t)lpra[i].buf.pv;
 	}
 
  bail:
@@ -1640,7 +1659,7 @@ static int put_args(uint32_t kernel, struct smq_invoke_ctx *ctx,
 	uint64_t *fdlist;
 	uint32_t *crclist = NULL;
 
-	remote_arg64_t *rpra = ctx->rpra;
+	remote_arg64_t *rpra = ctx->lrpra;
 	int i, inbufs, outbufs, handles;
 	int err = 0;
 
@@ -1743,7 +1762,7 @@ static void inv_args(struct smq_invoke_ctx *ctx)
 {
 	int i, inbufs, outbufs;
 	uint32_t sc = ctx->sc;
-	remote_arg64_t *rpra = ctx->rpra;
+	remote_arg64_t *rpra = ctx->lrpra;
 
 	inbufs = REMOTE_SCALARS_INBUFS(sc);
 	outbufs = REMOTE_SCALARS_OUTBUFS(sc);
diff --git a/drivers/gpu/drm/msm/dsi-staging/dsi_display.c b/drivers/gpu/drm/msm/dsi-staging/dsi_display.c
index bda2a87..81dd3ae 100644
--- a/drivers/gpu/drm/msm/dsi-staging/dsi_display.c
+++ b/drivers/gpu/drm/msm/dsi-staging/dsi_display.c
@@ -4914,11 +4914,14 @@ static int dsi_display_bind(struct device *dev,
 		return 0;
 
 	/* defer bind if ext bridge driver is not loaded */
-	for (i = 0; i < display->ext_bridge_cnt; i++) {
-		if (!of_drm_find_bridge(display->ext_bridge[i].node_of)) {
-			pr_err("defer for bridge[%d] %s\n", i,
-				display->ext_bridge[i].node_of->full_name);
-			return -EPROBE_DEFER;
+	if (display->panel && display->panel->host_config.ext_bridge_mode) {
+		for (i = 0; i < display->ext_bridge_cnt; i++) {
+			if (!of_drm_find_bridge(
+					display->ext_bridge[i].node_of)) {
+				pr_debug("defer for bridge[%d] %s\n", i,
+				  display->ext_bridge[i].node_of->full_name);
+				return -EPROBE_DEFER;
+			}
 		}
 	}
 
@@ -5763,6 +5766,9 @@ int dsi_display_drm_ext_bridge_init(struct dsi_display *display,
 	struct drm_bridge *prev_bridge = bridge;
 	int rc = 0, i;
 
+	if (display->panel && !display->panel->host_config.ext_bridge_mode)
+		return 0;
+
 	for (i = 0; i < display->ext_bridge_cnt; i++) {
 		struct dsi_display_ext_bridge *ext_bridge_info =
 				&display->ext_bridge[i];
diff --git a/drivers/platform/msm/ipa/ipa_v3/ipa_i.h b/drivers/platform/msm/ipa/ipa_v3/ipa_i.h
index 8465449..bf145d7 100644
--- a/drivers/platform/msm/ipa/ipa_v3/ipa_i.h
+++ b/drivers/platform/msm/ipa/ipa_v3/ipa_i.h
@@ -2485,6 +2485,8 @@ int ipa_create_gsi_smmu_mapping(int res_idx, bool wlan_smmu_en,
 		phys_addr_t pa, struct sg_table *sgt, size_t len, bool device,
 		unsigned long *iova);
 
+void ipa3_release_wdi3_gsi_smmu_mappings(u8 dir);
+
 /*
  * Tethering bridge (Rmnet / MBIM)
  */
diff --git a/drivers/platform/msm/ipa/ipa_v3/ipa_uc_wdi.c b/drivers/platform/msm/ipa/ipa_v3/ipa_uc_wdi.c
index 6f04ab6..7ab7534 100644
--- a/drivers/platform/msm/ipa/ipa_v3/ipa_uc_wdi.c
+++ b/drivers/platform/msm/ipa/ipa_v3/ipa_uc_wdi.c
@@ -869,6 +869,36 @@ int ipa_create_uc_smmu_mapping(int res_idx, bool wlan_smmu_en,
 	return 0;
 }
 
+void ipa3_release_wdi3_gsi_smmu_mappings(u8 dir)
+{
+	struct ipa_smmu_cb_ctx *cb = ipa3_get_smmu_ctx(IPA_SMMU_CB_AP);
+	int i, j, start, end;
+
+	if (dir == IPA_WDI3_TX_DIR) {
+		start = IPA_WDI_TX_RING_RES;
+		end = IPA_WDI_TX_DB_RES;
+	} else {
+		start = IPA_WDI_RX_RING_RES;
+		end = IPA_WDI_RX_COMP_RING_WP_RES;
+	}
+
+	for (i = start; i <= end; i++) {
+		if (wdi_res[i].valid) {
+			for (j = 0; j < wdi_res[i].nents; j++) {
+				iommu_unmap(cb->mapping->domain,
+					wdi_res[i].res[j].iova,
+					wdi_res[i].res[j].size);
+				ipa3_ctx->wdi_map_cnt--;
+			}
+			kfree(wdi_res[i].res);
+			wdi_res[i].valid = false;
+		}
+	}
+
+	if (ipa3_ctx->wdi_map_cnt == 0)
+		cb->next_addr = cb->va_end;
+}
+
 int ipa_create_gsi_smmu_mapping(int res_idx, bool wlan_smmu_en,
 		phys_addr_t pa, struct sg_table *sgt, size_t len, bool device,
 		unsigned long *iova)
diff --git a/drivers/platform/msm/ipa/ipa_v3/ipa_wdi3_i.c b/drivers/platform/msm/ipa/ipa_v3/ipa_wdi3_i.c
index 467357c..7e53015 100644
--- a/drivers/platform/msm/ipa/ipa_v3/ipa_wdi3_i.c
+++ b/drivers/platform/msm/ipa/ipa_v3/ipa_wdi3_i.c
@@ -12,9 +12,6 @@
 #include "ipa_i.h"
 #include <linux/ipa_wdi3.h>
 
-#define IPA_WDI3_TX_DIR 1
-#define IPA_WDI3_RX_DIR 2
-
 #define UPDATE_RP_MODERATION_CONFIG 1
 #define UPDATE_RP_MODERATION_THRESHOLD 8
 
@@ -135,8 +132,8 @@ static int ipa3_setup_wdi3_gsi_channel(u8 is_smmu_enabled,
 		&ep->gsi_evt_ring_hdl);
 	if (result != GSI_STATUS_SUCCESS) {
 		IPAERR("fail to alloc RX event ring\n");
-		/* TODO: release the gsi_smmu_mapping here if smmu enabled */
-		return -EFAULT;
+		result = -EFAULT;
+		goto fail_smmu_mapping;
 	}
 
 	ep->gsi_mem_info.evt_ring_len = gsi_evt_ring_props.ring_len;
@@ -204,7 +201,6 @@ static int ipa3_setup_wdi3_gsi_channel(u8 is_smmu_enabled,
 	result = gsi_alloc_channel(&gsi_channel_props, ipa3_ctx->gsi_dev_hdl,
 		&ep->gsi_chan_hdl);
 	if (result != GSI_STATUS_SUCCESS) {
-		/* TODO: release the gsi_smmu_mapping here if smmu enabled */
 		goto fail_get_gsi_ep_info;
 	}
 
@@ -371,10 +367,6 @@ static int ipa3_setup_wdi3_gsi_channel(u8 is_smmu_enabled,
 				result = -EFAULT;
 				goto fail_write_scratch;
 			}
-			/*
-			 * TODO: for all access over PCIe for MDM,
-			 * there is no SMMU
-			 */
 			ch_scratch.wdi3.wifi_rp_address_low = (u32)va;
 			ch_scratch.wdi3.wifi_rp_address_high =
 				(u32)((u64)va >> 32);
@@ -436,6 +428,8 @@ static int ipa3_setup_wdi3_gsi_channel(u8 is_smmu_enabled,
 fail_get_gsi_ep_info:
 	gsi_dealloc_evt_ring(ep->gsi_evt_ring_hdl);
 	ep->gsi_evt_ring_hdl = ~0;
+fail_smmu_mapping:
+	ipa3_release_wdi3_gsi_smmu_mappings(dir);
 	return result;
 }
 
@@ -666,21 +660,22 @@ int ipa3_disconn_wdi3_pipes(int ipa_ep_idx_tx, int ipa_ep_idx_rx)
 	ep_tx = &ipa3_ctx->ep[ipa_ep_idx_tx];
 	ep_rx = &ipa3_ctx->ep[ipa_ep_idx_rx];
 
+	IPA_ACTIVE_CLIENTS_INC_EP(ipa3_get_client_mapping(ipa_ep_idx_tx));
 	/* tear down tx pipe */
 	result = ipa3_reset_gsi_channel(ipa_ep_idx_tx);
 	if (result != GSI_STATUS_SUCCESS) {
 		IPAERR("failed to reset gsi channel: %d.\n", result);
-		return result;
+		goto exit;
 	}
 	result = gsi_reset_evt_ring(ep_tx->gsi_evt_ring_hdl);
 	if (result != GSI_STATUS_SUCCESS) {
 		IPAERR("failed to reset evt ring: %d.\n", result);
-		return result;
+		goto exit;
 	}
 	result = ipa3_release_gsi_channel(ipa_ep_idx_tx);
 	if (result) {
 		IPAERR("failed to release gsi channel: %d\n", result);
-		return result;
+		goto exit;
 	}
 
 	memset(ep_tx, 0, sizeof(struct ipa3_ep_context));
@@ -690,23 +685,25 @@ int ipa3_disconn_wdi3_pipes(int ipa_ep_idx_tx, int ipa_ep_idx_rx)
 	result = ipa3_reset_gsi_channel(ipa_ep_idx_rx);
 	if (result != GSI_STATUS_SUCCESS) {
 		IPAERR("failed to reset gsi channel: %d.\n", result);
-		return result;
+		goto exit;
 	}
 	result = gsi_reset_evt_ring(ep_rx->gsi_evt_ring_hdl);
 	if (result != GSI_STATUS_SUCCESS) {
 		IPAERR("failed to reset evt ring: %d.\n", result);
-		return result;
+		goto exit;
 	}
 	result = ipa3_release_gsi_channel(ipa_ep_idx_rx);
 	if (result) {
 		IPAERR("failed to release gsi channel: %d\n", result);
-		return result;
+		goto exit;
 	}
 
 	ipa3_delete_dflt_flt_rules(ipa_ep_idx_rx);
 	memset(ep_rx, 0, sizeof(struct ipa3_ep_context));
 	IPADBG("rx client (ep: %d) disconnected\n", ipa_ep_idx_rx);
 
+exit:
+	IPA_ACTIVE_CLIENTS_DEC_EP(ipa3_get_client_by_pipe(ipa_ep_idx_tx));
 	return result;
 }
 
@@ -728,20 +725,23 @@ int ipa3_enable_wdi3_pipes(int ipa_ep_idx_tx, int ipa_ep_idx_rx)
 	ep_tx = &ipa3_ctx->ep[ipa_ep_idx_tx];
 	ep_rx = &ipa3_ctx->ep[ipa_ep_idx_rx];
 
+	IPA_ACTIVE_CLIENTS_INC_EP(ipa3_get_client_mapping(ipa_ep_idx_tx));
+
 	/* start gsi tx channel */
 	result = gsi_start_channel(ep_tx->gsi_chan_hdl);
 	if (result) {
 		IPAERR("failed to start gsi tx channel\n");
-		return -EFAULT;
+		result = -EFAULT;
+		goto exit;
 	}
 
 	/* start gsi rx channel */
 	result = gsi_start_channel(ep_rx->gsi_chan_hdl);
 	if (result) {
 		IPAERR("failed to start gsi rx channel\n");
-		return -EFAULT;
+		result = -EFAULT;
+		goto exit;
 	}
-	IPA_ACTIVE_CLIENTS_INC_SIMPLE();
 
 	/* enable data path */
 	result = ipa3_enable_data_path(ipa_ep_idx_rx);
@@ -749,7 +749,7 @@ int ipa3_enable_wdi3_pipes(int ipa_ep_idx_tx, int ipa_ep_idx_rx)
 		IPAERR("enable data path failed res=%d clnt=%d.\n", result,
 			ipa_ep_idx_rx);
 		result = -EFAULT;
-		goto fail;
+		goto exit;
 	}
 
 	result = ipa3_enable_data_path(ipa_ep_idx_tx);
@@ -757,11 +757,11 @@ int ipa3_enable_wdi3_pipes(int ipa_ep_idx_tx, int ipa_ep_idx_rx)
 		IPAERR("enable data path failed res=%d clnt=%d.\n", result,
 			ipa_ep_idx_tx);
 		result = -EFAULT;
-		goto fail;
+		goto exit;
 	}
 
-fail:
-	IPA_ACTIVE_CLIENTS_DEC_SIMPLE();
+exit:
+	IPA_ACTIVE_CLIENTS_DEC_EP(ipa3_get_client_mapping(ipa_ep_idx_tx));
 	return result;
 }
 
@@ -865,13 +865,13 @@ int ipa3_write_qmapid_wdi3_gsi_pipe(u32 clnt_hdl, u8 qmap_id)
 
 	if (result != GSI_STATUS_SUCCESS) {
 		IPAERR("failed to read channel scratch %d\n", result);
-		return result;
+		goto exit;
 	}
 	result = gsi_stop_channel(ep->gsi_chan_hdl);
 	if (result != GSI_STATUS_SUCCESS && result != -GSI_STATUS_AGAIN &&
 		result != -GSI_STATUS_TIMED_OUT) {
 		IPAERR("failed to stop gsi channel %d\n", result);
-		return result;
+		goto exit;
 	}
 
 	ch_scratch.wdi3.qmap_id = qmap_id;
@@ -879,14 +879,16 @@ int ipa3_write_qmapid_wdi3_gsi_pipe(u32 clnt_hdl, u8 qmap_id)
 			ch_scratch);
 	if (result != GSI_STATUS_SUCCESS) {
 		IPAERR("failed to write channel scratch %d\n", result);
-		return result;
+		goto exit;
 	}
 
 	result =  gsi_start_channel(ep->gsi_chan_hdl);
 	if (result != GSI_STATUS_SUCCESS) {
 		IPAERR("failed to start gsi channel %d\n", result);
-		return result;
+		goto exit;
 	}
 
-	return 0;
+exit:
+	IPA_ACTIVE_CLIENTS_DEC_EP(ipa3_get_client_mapping(clnt_hdl));
+	return result;
 }
diff --git a/drivers/pwm/pwm-qti-lpg.c b/drivers/pwm/pwm-qti-lpg.c
index 12aa3b3..2b01b5b 100644
--- a/drivers/pwm/pwm-qti-lpg.c
+++ b/drivers/pwm/pwm-qti-lpg.c
@@ -1,4 +1,4 @@
-/* Copyright (c) 2018, The Linux Foundation. All rights reserved.
+/* Copyright (c) 2018-2019, The Linux Foundation. All rights reserved.
  *
  * This program is free software; you can redistribute it and/or modify
  * it under the terms of the GNU General Public License version 2 and
@@ -458,14 +458,6 @@ static int qpnp_lpg_set_pwm_config(struct qpnp_lpg_channel *lpg)
 	if (lpg->src_sel == LUT_PATTERN)
 		return 0;
 
-	val = lpg->pwm_config.pwm_value & LPG_PWM_VALUE_LSB_MASK;
-	rc = qpnp_lpg_write(lpg, REG_LPG_PWM_VALUE_LSB, val);
-	if (rc < 0) {
-		dev_err(lpg->chip->dev, "Write LPG_PWM_VALUE_LSB failed, rc=%d\n",
-							rc);
-		return rc;
-	}
-
 	val = lpg->pwm_config.pwm_value >> 8;
 	mask = LPG_PWM_VALUE_MSB_MASK;
 	rc = qpnp_lpg_masked_write(lpg, REG_LPG_PWM_VALUE_MSB, mask, val);
@@ -475,6 +467,14 @@ static int qpnp_lpg_set_pwm_config(struct qpnp_lpg_channel *lpg)
 		return rc;
 	}
 
+	val = lpg->pwm_config.pwm_value & LPG_PWM_VALUE_LSB_MASK;
+	rc = qpnp_lpg_write(lpg, REG_LPG_PWM_VALUE_LSB, val);
+	if (rc < 0) {
+		dev_err(lpg->chip->dev, "Write LPG_PWM_VALUE_LSB failed, rc=%d\n",
+							rc);
+		return rc;
+	}
+
 	val = LPG_PWM_VALUE_SYNC;
 	rc = qpnp_lpg_write(lpg, REG_LPG_PWM_SYNC, val);
 	if (rc < 0) {
diff --git a/include/linux/ipa_wdi3.h b/include/linux/ipa_wdi3.h
index a6367ba..bdbeb2f 100644
--- a/include/linux/ipa_wdi3.h
+++ b/include/linux/ipa_wdi3.h
@@ -32,6 +32,9 @@ enum ipa_wdi_version {
 	IPA_WDI_3
 };
 
+#define IPA_WDI3_TX_DIR 1
+#define IPA_WDI3_RX_DIR 2
+
 /**
  * struct ipa_wdi_init_in_params - wdi init input parameters
  *
diff --git a/net/wireless/scan.c b/net/wireless/scan.c
index 3391c14..d0e7472 100644
--- a/net/wireless/scan.c
+++ b/net/wireless/scan.c
@@ -71,7 +71,7 @@ module_param(bss_entries_limit, int, 0644);
 MODULE_PARM_DESC(bss_entries_limit,
                  "limit to number of scan BSS entries (per wiphy, default 1000)");
 
-#define IEEE80211_SCAN_RESULT_EXPIRE	(7 * HZ)
+#define IEEE80211_SCAN_RESULT_EXPIRE	(30 * HZ)
 
 static void bss_free(struct cfg80211_internal_bss *bss)
 {