msm: msm_fb: remove mmio access through mmap

Disable access to mm io and add
appropriate range checks to ensure valid accesses
through framebuffer mmap. This prevents illegal
access into memory.

CRs-Fixed: 474706
Change-Id: If25166f2732433ef967e99c716440030b567aae9
Signed-off-by: Manoj Rao <manojraj@codeaurora.org>
msm: camera: Add null checks for stats module

Add null checks in stats driver before accessing the
data structures to avoid null pointer crash.

Change-Id: I87639848e94e69e3fa020344f936e7cc182e2c66
Signed-off-by: Nishant Pandit <npandit@codeaurora.org>
msm: mdp: Revert MDP Port split changes

Revert MDP changes to avoid bus overflow
seen in camera usecases.

Change-Id: I1c687750bd22c8f64ab28a500562cbfbcb6a6048
Signed-off-by: Kiran Kumar H N <hurlisal@codeaurora.org>
Signed-off-by: Praveen Ac <praveenac@codeaurora.org>
ASoC: msm: Fix wrong wait_event_timeout timeout checks

wait_event_timeout returns zero when there is a timeout.
Change fixes the condition check to handle timeouts.

Change-Id: I01184cce0c98a82bb205023b07dd4dd2d91b42ad
CRs-Fixed: 487821
Signed-off-by: Asish Bhattacharya <asishb@codeaurora.org>
msm: camera: Change CSI release sequence

CSIPhy is released before CSID in CSI release sequence

Change-Id: If6788ed35547417397d0547ac27d38769df70217
CRs-Fixed: 453591
Signed-off-by: Raju P.L.S.S.S.N <rplsssn@codeaurora.org>
msm-camera:Fix integer overflow when processing msm gesture ioctl.

Add check for integer overflow.

CRs-Fixed: 483781
Change-Id: I9534421f9780f5880ddc6e89fc2b451285ee60e0
Signed-off-by: Praveen Ac <praveenac@codeaurora.org>
msm_fb: hdmi: Proper intialization of mhl resolutions

This change adds missing video format intialization

CRs-Fixed: 481049
Change-Id: Ic14eaba7fefcb8b7f9240cae8c179e3dbeef72a5
Signed-off-by: Ajay Singh Parmar <aparmar@codeaurora.org>
USB: ci13xxx_udc: Fix kernel panic during composition switch

The control endpoint requests are not nuked properly during
composition switch.  The stale request is getting completed
during enumeration of the new composition.  Kernel panics if
completion handler access already freed data.  This is happening
with RNDIS interface.

The Android composite driver dequeue the control request before
removing the composition.  The current code returns immediately
if the queue is empty.  The control endpoint queues are handled
differently.  The EP0 IN endpoint is only exposed to the composite
driver.  The controller driver takes care of queuing the request
on EP0 IN or EP0 OUT based on control transfer direction.  When
the composite driver dequeue request on control endpoint, check
both direction endpoints queues.

When USB bus is reset, nuke the control endpoints.  Flushing the
endpoint will not call completion handler.

Test endpoint queue list, request list, endpoint descriptor and
soft pull up status under spinlock to prevent any races between
dequeue and queue paths.

CRs-Fixed: 474578
Change-Id: I3d7ca4be4d6cee65707879c6c9b501f442e53018
Signed-off-by: Pavankumar Kondeti <pkondeti@codeaurora.org>
media: dvb: Fix support for maximum TSPP buffer size

The maximum allowed buffer size depends on maximum allowed
number of BAM descriptors. The maximum allowed number of
descriptors was changed to meet HW capabilities. A check
whether user buffer size requires number of descriptors
larger than what is allowed was added.

CRs-Fixed: 490749
Change-Id: Ic60414af156ee8d969263b7636393693277c8f61
Signed-off-by: Hamad Kadmany <hkadmany@codeaurora.org>
ASoC: WCD9304: Add the compander support to wcd9304

The compander system is intended to increase the dynamic
range of an input signal. But for the wcd9304 codec,
this feature is to use companding in a novel way in the DAC
converter path to increase the signal noise ratio.
The change is to add the compander support to wcd9304
codec. The dynamic compander enable/disable during stream
playback is not supported.

Change-Id: If912302ee9d48dde1318e894a982cba591908d8f
Signed-off-by: Kuirong Wang <kuirongw@codeaurora.org>
msm: mdm: change where ssr_count is decremented

In fusion targets with more than one external modem, where
the modems are restarted together, ssr_count keeps track of
how many modems are still left to be completely restarted so
that any new SSR requests would be rejected until all modems
are restarted. Ssr_count should be decremented when the SSR
module sends the SUBSYS_AFTER_POWERUP notification instead of
during the powerup callback in order to be in sync with the
state of the SSR module.

Change-Id: I196f4937d929c54f475d251632f111404a2b3bf1
Signed-off-by: Joel King <joelking@codeaurora.org>
mmc: msm_sdcc: Enable clock scaling capability

Enable capability, MMC_CAP2_CLK_SCALE to allow mmc core
to scale the clocks at runtime based on load on card.

Clock scaling in MSM platforms also allow voltage scaling between
NOMINAL and SVS levels, thus allowing additional power savings.

Change-Id: Id1995ffea7a6c06a2e8b29b43da70894f35f6c0b
Signed-off-by: Sujit Reddy Thumma <sthumma@codeaurora.org>
msm: kgsl: Protect the mem_entry list during deletion

Use the spinlock to prevent corruption of the mem_entry list during
deletion. Otherwise the mem_entry list may be modified by another
thread at the same time resulting in memory corruption.

Change-Id: I5728a8b925753d5fda82413615e5ebaf0366dfd8
CRs-fixed: 489224
Signed-off-by: Lynus Vaz <lvaz@codeaurora.org>
msm: kgsl: Submit a draw command on resume

For A305, submit an extra draw command while resuming the GPU from
SLUMBER state. This fixes corruption seen when the screen is
turned on.

Change-Id: Iafed90b617b0a700ac3f2afcb6d9ecadca590914
Signed-off-by: Lynus Vaz <lvaz@codeaurora.org>
Fix disconnect not sent from host when pairing is cancelled

Fixes the issue that disconnect command is not sent
from the host when pairing is cancelled.

CRs-fixed: 489957

Change-Id: I600a526aa9b95a3f17d77d5ef16d91e206ce7161
Signed-off-by: Subramanian Srinivasan <subrsrin@codeaurora.org>
diag: Upgrade Diag code on this branch

Diag on A-Family mainline is out of data. This change
includes the following changes to bring diag code up to date.

1. Updated the msg SSIDs, log codes and event IDs
2. Fix concurrency issues when processing userspace inputs
3. Add notification that diag supports feature mask
4. Update SSIDs and log codes
5. Fix writing of error message for mode command
6. Bring diag control message support up to date
7. Updated the msg SSIDs, log codes and event IDs
8. Fix array out of bounds access

This includes a crash fix due to out of bounds access.

CRs-Fixed: 488175

Change-Id: I0b315b5f5da0fecdbbd0cf071e05f2cf3ffd9ccb

Signed-off-by: Ravi Aravamudhan <aravamud@codeaurora.org>
video: msm: Maintain histogram LUT state through suspend resume

Make sure LUT state is maintained after suspend resume. Required to ensure
HistLUT and backlight scale are in sync.

CRs-Fixed: 476491
Change-Id: Icc999aa0b04cad93ceed334426f61b71cbdd0a13
Signed-off-by: Carl Vanderlip <carlv@codeaurora.org>
Signed-off-by: Jeevan Shriram <jshriram@codeaurora.org>
video: msm: Initialize HistLUT with last saved LUT

Set HistLUT to last value written to LUT when MDP is turned on. Assumes
that last LUT corresponds to last BL scale value sent.

CRs-Fixed: 475149
Change-Id: I7383666c2d1f3d8800c5f25e2ef648568eb33a74
Signed-off-by: Carl Vanderlip <carlv@codeaurora.org>
Signed-off-by: Jeevan Shriram <jshriram@codeaurora.org>
msm: vidc: Optimize IOMMU map size for H264 decoder

IOMMU map size is not required to be double the actual
buffer size for H264 decoder. So reducing IOMMU map
size for H264 format which will enable support for
two H264 decoder instances in parallel in smooth streamig
mode where the number of output buffers equal to 18 with
each buffer size equal to 1080p buffer size.

CRs-fixed: 491718
Change-Id: Ie6782b2ff58667000213f25482eea151b849762b
Signed-off-by: Maheshwar Ajja <majja@codeaurora.org>
msm: camera: Handle locks properly

Update camera drivers to unlock mutex while returning
the function in caseof errors.

Change-Id: Iaac7ae3a0337445ee072c10c69080c24ed6e512c
Signed-off-by: satyavaraprasad yerramsetti <satyav@codeaurora.org>