msm: mpm-of: Fix NULL pointer and buffer overflow errors

When traversing the hlist, the driver incorrectly checks for NULL of
list node instead of the loop cursor to return an mpm pin mapping. Fix
by checking the NULL value of the loop cursor before return the MPM pin
mapping.

Also, when the pin corresponds to a bypassed interrupt, there could
potentially be a out of bounds access on the msm_mpm_irqs_m2a array. Fix
by adding a check for Bypass interrupt value before updating the array
with a linux irq mapping.

CRs-fixed: 522680
Change-Id: Ie6bc201a443d1d038f3680af1cc64f5b32fb47a4
Signed-off-by: Mahesh Sivasubramanian <msivasub@codeaurora.org>
msm: vidc: Add VP8 version set-up via Profile and Level

VP8 specification does not define level or profile concept but
specify a version. The OpenMax IL version 1.1.2 specify a single
profile and multiple levels for VP8 codec, the levels are indeed the
version numbers. The way of setting the codec version using level
field comes from the definitions at OpenMax IL. Since is a single
profile, level value is use to set-up the version but FW expects the
version value to be pass in the profile field, for that reason
incoming level is copy to FW profile.

Change-Id: I1ddc47b7a25efd1d31bed18e54c2b576427d1564
Signed-off-by: Jorge Solano Altamirano <jsolano@codeaurora.org>
msm: vidc: Propagate FBD buffer offset

The offset is used to know the position of the valid data. In the past
this was not use for any codec but is essential for VPX/VP8 encoder.

Change-Id: Id0c5cef74f3ec80a0c41646a3e95d50889932f18
Signed-off-by: Jorge Solano Altamirano <jsolano@codeaurora.org>
msm: vidc: Initialize data_offset to avoid trash values

When data_offset is used by client this may get
trash values causing unexpected results.

Change-Id: Iaa7ca85f6dd81c4246580047f915cbb6327e7361
Signed-off-by: Jorge Solano Altamirano <jsolano@codeaurora.org>
mmc: card: CORRECTLY_PRG_SECTORS_NUM parsing fix

According to eMMC specification (4.5 onwards), CORRECTLY_PRG_SECTORS_NUM
field will reflect the accumulated packed sectors that were transferred
plus header. The header (1 sector size) is not actually written to NAND.

The fix will decrement correctly programmed sectors byte count by 1 sector
size.

CRs-fixed: 518341
Change-Id: I94a79903469c011308fcaf195fce5af5f0525026
Signed-off-by: Konstantin Dorfman <kdorfman@codeaurora.org>
input: synaptics: Add support for new firmware versions

- Add DS5 firmware update support
- Support polling mode in firmware update

Signed-off-by: Alexandra Chin <alexandra.chin@tw.synaptics.com>
Change-Id: Ibf9a6ffcd843866683b3b138af56f09545f3742c
Git-commit: e01cec21f08bc35ba3e97981b967bb4e2c52267a
Git-repo: git://github.com/synaptics-touch/msm-3.4.git
[amaloche@codeaurora.org: Changes due to base driver
differences]
Signed-off-by: Amy Maloche <amaloche@codeaurora.org>
input: synaptics: Add support for F12

2013-07-23
- Add F$12 support
- Correct data size in struct image_header_data
- use DECLARE_COMPLETION

Signed-off-by: Alexandra Chin <alexandra.chin@tw.synaptics.com>
Change-Id: Ie9c1be58f963467e10ff0355f2c7b5b0244ea003
Git-commit: ca4b0c286031245c28b1fa1aca1e1d1614d6c18e
Git-repo: git://github.com/synaptics-touch/msm-3.4.git
[amaloche@codeaurora.org: Changes due to base driver
differences]
Signed-off-by: Amy Maloche <amaloche@codeaurora.org>
input: synaptics: Support lockdown in firmware update

2013.07.29
- Support lockdown in firmware update
- Support write config area from a pure config file
- Skip entering bootloadermode when reading config area
- Use list_for_each_entry_safe if list item will be changed

Signed-off-by: Alexandra Chin <alexandra.chin@tw.synaptics.com>
Change-Id: I2d4fb52456088a1f769a7de4fcac6c3e4589a5a5
Git-commit: a1028858bd164b43e5a78fd2d55f153b84529591
Git-repo: git://github.com/synaptics-touch/msm-3.4.git
[amaloche@codeaurora.org: Changes due to base driver
differences]
Signed-off-by: Amy Maloche <amaloche@codeaurora.org>
msm: mdss: Remove deprecated vsync pending variable

vsync pending variable is deprecated and hence remove its
usage from all places in MDSS. Reenabling vsync ctrl once
panel is on now relies on user space application.

CRs-Fixed: 513502
Change-Id: I4b3062012983c1de98a5e59b4368e028eb6b46a5
Signed-off-by: Jayant Shekhar <jshekhar@codeaurora.org>
msm: mdss: Return standard errno for error conditions

Replace ENOTSUPP with standard lib error EOPNOTSUPP in order
to update errno. Return EPERM error when VSYNC_ENABLED called
in suspend state in order to reflect the actual state of the
device. if no error returned applications would assume vsync
events are being generated when this is not true.

Change-Id: I72a7347ebecc71376884cf21b7e757f75ba9b40e
Signed-off-by: Ramkumar Radhakrishnan <ramkumar@codeaurora.org>
arm/dt: msm8226: Add helper regulator for vdd_buck of audio codec

vdd_buck power rail to the codec is supplied by SMPA 4. During
high loading conditions, SMPA4 needs to be backed up by LDO25
as a helper regulator. Add LDO25 as a helper regulator to the
audio codec regulator list. Both SMPA4 and LDO25 are optional
and on-demand regulators for the audio codec.

Change-Id: I2b28d645d21f12c7c9e0badb9101ed7dab075dee
Signed-off-by: Bhalchandra Gajare <gajare@codeaurora.org>
mfd: wcd9xxx: Add support to parse new set of regulators

Chargepump supply to the codec can be supplied from multiple
regulators. Add support to maintain list of regulators for
chargepump that can be used by individual codec drivers to
dynamically enable/disable the regulators.

Change-Id: I22e2abac349f099ed60a786e50bc15cffd0a3aa2
Signed-off-by: Bhalchandra Gajare <gajare@codeaurora.org>
ASoC: wcd9306: Add support for chargepump regulators

Chargepump supply to the codec is only needed when there is
active audio playback on the EAR / LO / Headphone paths of
the codec. Add support to dynamically enable/disable all
necessary regulators for chargepump based on path which
needs chargepump supply

CRs-fixed: 484348
CRs-fixed: 519594
Change-Id: I27323edd5ba42f2045c132c56f8e282a7fbe92d6
Signed-off-by: Bhalchandra Gajare <gajare@codeaurora.org>
msm: mdss: Configure panel's physical dimensions

Parse the panel's physical dimensions from the dts file and
set width and height in frame buffer information accordingly.

Change-Id: Ic76949b14313777b9f3ea1a2c9e60565fe203d67
Signed-off-by: Mayank Chopra <makchopra@codeaurora.org>
leds: leds-qpnp: Enable flash torch mode on single LED PMIC

Flash LED torch mode is not supported from hardware perspective
on PMIC with single flash LED module. Enabling torch mode on such
PMIC chips requires detection of PMIC peripheral subtype and
use flash mode with a lower current to implement torch.

Change-Id: I77228068c2c0ec4a0ed5614f4a991a3bce5db013
Signed-off-by: Chun Zhang <chunz@codeaurora.org>
rtc: alarm: Set power-on alarm 120 sec before actual alarm time

This will add extra buffer time for booting-up the device before
actual alarm expiration time.

Change-Id: I02cad84c394a6aab943fff37a1a0de56bb511f56
Signed-off-by: Mohit Aggarwal <maggarwa@codeaurora.org>
Signed-off-by: Ashay Jaiswal <ashayj@codeaurora.org>
ARM: dts: msm: Utilize flash module for torch mode on PM8026

Flash LED torch mode is not supported on PM8026 chips. To
enable flash LED torch mode, flash module needs to be used with
a lower current.

CRs-fixed: 507563
Change-Id: Ifec6a9df3cf7fc56c9dda13a7ff33380d0cd13f9
Signed-off-by: Chun Zhang <chunz@codeaurora.org>
slim_ngd: Make sure transaction is not dereferenced after it's freed

Every read transaction over slimbus is a set of one transmit and one
receive. Receive part frees meta-data for the read transaction since
it is no longer needed, and the transaction-ID can be reused.
Make sure that the transmit function doesn't try to dereference the
transaction meta-data after possibly receiving a response.

CRs-fixed: 515802
Change-Id: Id736ad368d4944a6aabc89f4ff295d664bc5efa0
Signed-off-by: Sagar Dharia <sdharia@codeaurora.org>
tty: serial: Use "no_log" readl/writel variants in hsl_read/write

hsl_read and hsl_write both directly call ioread32/iowrite32, which
leads to either a __raw_readl or __raw_writel call. These
readl/writel call are logged to the register trace buffer (RTB) by
default and generate a very large amount of output. This patch
directly calls __raw_readl_no_log and __raw_writel_no_log in
hsl_read and hsl_write to avoid logging these events to the RTB.

Change-Id: I9b3253996188f0642a4f6dedf449ec23fa1de05a
Signed-off-by: David Garibaldi <dgaribal@codeaurora.org>
msm: camera: Fix potential memory overflow errors

Fix potential memory overflow errors in msm_isp_util.c which happen
under certain rare conditions.

CRs-fixed: 514717
Change-Id: I8c70e089df9bf1e7a364c5c8264b782c9c23bf0b
Signed-off-by: Seemanta Dutta <seemanta@codeaurora.org>