msm: msm_fb: remove mmio access through mmap

Disable access to mm io and add
appropriate range checks to ensure valid accesses
through framebuffer mmap. This prevents illegal
access into memory.

CRs-Fixed: 474706
Change-Id: If25166f2732433ef967e99c716440030b567aae9
Signed-off-by: Manoj Rao <manojraj@codeaurora.org>
msm: mdp: Revert MDP Port split changes

Revert MDP changes to avoid bus overflow
seen in camera usecases.

Change-Id: I1c687750bd22c8f64ab28a500562cbfbcb6a6048
Signed-off-by: Kiran Kumar H N <hurlisal@codeaurora.org>
Signed-off-by: Praveen Ac <praveenac@codeaurora.org>
msm: camera: Change CSI release sequence

CSIPhy is released before CSID in CSI release sequence

Change-Id: If6788ed35547417397d0547ac27d38769df70217
CRs-Fixed: 453591
Signed-off-by: Raju P.L.S.S.S.N <rplsssn@codeaurora.org>
msm-camera:Fix integer overflow when processing msm gesture ioctl.

Add check for integer overflow.

CRs-Fixed: 483781
Change-Id: I9534421f9780f5880ddc6e89fc2b451285ee60e0
Signed-off-by: Praveen Ac <praveenac@codeaurora.org>
USB: ci13xxx_udc: Fix kernel panic during composition switch

The control endpoint requests are not nuked properly during
composition switch.  The stale request is getting completed
during enumeration of the new composition.  Kernel panics if
completion handler access already freed data.  This is happening
with RNDIS interface.

The Android composite driver dequeue the control request before
removing the composition.  The current code returns immediately
if the queue is empty.  The control endpoint queues are handled
differently.  The EP0 IN endpoint is only exposed to the composite
driver.  The controller driver takes care of queuing the request
on EP0 IN or EP0 OUT based on control transfer direction.  When
the composite driver dequeue request on control endpoint, check
both direction endpoints queues.

When USB bus is reset, nuke the control endpoints.  Flushing the
endpoint will not call completion handler.

Test endpoint queue list, request list, endpoint descriptor and
soft pull up status under spinlock to prevent any races between
dequeue and queue paths.

CRs-Fixed: 474578
Change-Id: I3d7ca4be4d6cee65707879c6c9b501f442e53018
Signed-off-by: Pavankumar Kondeti <pkondeti@codeaurora.org>
media: dvb: Fix support for maximum TSPP buffer size

The maximum allowed buffer size depends on maximum allowed
number of BAM descriptors. The maximum allowed number of
descriptors was changed to meet HW capabilities. A check
whether user buffer size requires number of descriptors
larger than what is allowed was added.

CRs-Fixed: 490749
Change-Id: Ic60414af156ee8d969263b7636393693277c8f61
Signed-off-by: Hamad Kadmany <hkadmany@codeaurora.org>
mmc: msm_sdcc: Enable clock scaling capability

Enable capability, MMC_CAP2_CLK_SCALE to allow mmc core
to scale the clocks at runtime based on load on card.

Clock scaling in MSM platforms also allow voltage scaling between
NOMINAL and SVS levels, thus allowing additional power savings.

Change-Id: Id1995ffea7a6c06a2e8b29b43da70894f35f6c0b
Signed-off-by: Sujit Reddy Thumma <sthumma@codeaurora.org>
Fix disconnect not sent from host when pairing is cancelled

Fixes the issue that disconnect command is not sent
from the host when pairing is cancelled.

CRs-fixed: 489957

Change-Id: I600a526aa9b95a3f17d77d5ef16d91e206ce7161
Signed-off-by: Subramanian Srinivasan <subrsrin@codeaurora.org>
diag: Upgrade Diag code on this branch

Diag on A-Family mainline is out of data. This change
includes the following changes to bring diag code up to date.

1. Updated the msg SSIDs, log codes and event IDs
2. Fix concurrency issues when processing userspace inputs
3. Add notification that diag supports feature mask
4. Update SSIDs and log codes
5. Fix writing of error message for mode command
6. Bring diag control message support up to date
7. Updated the msg SSIDs, log codes and event IDs
8. Fix array out of bounds access

This includes a crash fix due to out of bounds access.

CRs-Fixed: 488175

Change-Id: I0b315b5f5da0fecdbbd0cf071e05f2cf3ffd9ccb

Signed-off-by: Ravi Aravamudhan <aravamud@codeaurora.org>
video: msm: Maintain histogram LUT state through suspend resume

Make sure LUT state is maintained after suspend resume. Required to ensure
HistLUT and backlight scale are in sync.

CRs-Fixed: 476491
Change-Id: Icc999aa0b04cad93ceed334426f61b71cbdd0a13
Signed-off-by: Carl Vanderlip <carlv@codeaurora.org>
Signed-off-by: Jeevan Shriram <jshriram@codeaurora.org>
video: msm: Initialize HistLUT with last saved LUT

Set HistLUT to last value written to LUT when MDP is turned on. Assumes
that last LUT corresponds to last BL scale value sent.

CRs-Fixed: 475149
Change-Id: I7383666c2d1f3d8800c5f25e2ef648568eb33a74
Signed-off-by: Carl Vanderlip <carlv@codeaurora.org>
Signed-off-by: Jeevan Shriram <jshriram@codeaurora.org>
msm: vidc: Optimize IOMMU map size for H264 decoder

IOMMU map size is not required to be double the actual
buffer size for H264 decoder. So reducing IOMMU map
size for H264 format which will enable support for
two H264 decoder instances in parallel in smooth streamig
mode where the number of output buffers equal to 18 with
each buffer size equal to 1080p buffer size.

CRs-fixed: 491718
Change-Id: Ie6782b2ff58667000213f25482eea151b849762b
Signed-off-by: Maheshwar Ajja <majja@codeaurora.org>
msm: camera: Handle locks properly

Update camera drivers to unlock mutex while returning
the function in caseof errors.

Change-Id: Iaac7ae3a0337445ee072c10c69080c24ed6e512c
Signed-off-by: satyavaraprasad yerramsetti <satyav@codeaurora.org>
Merge "msm: vidc: Optimize IOMMU map size for H264 decoder"
Merge "msm: camera: Change CSI release sequence"
Merge "msm: msm_fb: remove mmio access through mmap"
Merge "mmc: msm_sdcc: Enable clock scaling capability"
msm: vidc: Remove unncessary unmap function calls

Calling unncessary unmap function resulting in
target reset. This change resolves the issue by
removing unncessary unmap functions in video driver.

Change-Id: I0b501f0a7115bba085b067a5e78172df210da8f1
Signed-off-by: Maheshwar Ajja <majja@codeaurora.org>
Merge "diag: Upgrade Diag code on this branch"
Merge "media: dvb: Fix support for maximum TSPP buffer size"