msm: camera: make sure num_buf is not out of bound

V4L2 only allow 32 buffers. Check the num_buf to make sure that
user space passed value is not out of bound.

CRs-Fixed: 514698
Change-Id: I662ec1eb998ed8bfb2a7f188e645410aa78c83b0
Signed-off-by: Hariram Purushothaman <hpurus@codeaurora.org>
Signed-off-by: Ankit Premrajka <ankitp@codeaurora.org>
Signed-off-by: Raghu DP <dp.raghu@codeaurora.org>
Signed-off-by: Yiduo Wang <yiduow@codeaurora.org>
Revert "[media] media: Init the reserved fields of struct media_link_desc"

Reverting this commit to pull in the upstream version of this fix.
It'll make future kernel migrations easier.

This reverts commit e28d05092ee29d31c27e273bc9ccbc2bc3c49e1c.

Change-Id: Iab08f6c239cde9d59ed025cb68cbf233b777a614
Signed-off-by: Deva Ramasubramanian <dramasub@codeaurora.org>
[media] media: info leak in __media_device_enum_links()

These structs have holes and reserved struct members which aren't
cleared.  I've added a memset() so we don't leak stack information.

Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>

Change-Id: Ia22c66d36c0a7bcaee60e65a7db406a40f973006
Git-commit: c88e739b1fad662240e99ecbd0bdaac871717987
Git-repo: git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
Signed-off-by: Deva Ramasubramanian <dramasub@codeaurora.org>
Merge "Revert "[media] media: Init the reserved fields of struct media_link_desc""
wcnss: Reset IRIS card before Starting IRIS XO configuration

Set iris_reset bit of PMU CFG register to reset the IRIS
card before Starting IRIS XO configuration.

Change-Id: Id1cfd7e3e3df29919089725b2233c6f95afbbfb5
CRs-Fixed: 664642
Signed-off-by: Hardik Kantilal Patel <hkpatel@codeaurora.org>
Merge "msm: camera: make sure num_buf is not out of bound"
msm_serial_hs: Fix the logic for numbering the serial device

This patch fixes the way the UART nodes are enumerated when
aliases are used to identify the nodes. The atomic variable that
used to hold the next available node number was incorrectly being
incremented and if that number were to hold a number that was also
used in an alias, the probe would fail. This patch corrects it.
It also removes the atomic variable and introduces two apis to set
and get the next device number and this logic is protected by a mutex.

Change-Id: Iaee655603b527f3283e1f12d90b1220e9315b529
Signed-off-by: Naveen Kaje <nkaje@codeaurora.org>
USB: ehci-msm2: Correct USB PHY RESET sequence

Existing code assumes that USB PHY is reset as part of block
reset using GCC, but that is not the case. This results in
PHY access failures later when ulpi accesses are performed,
or device enumeration fails as CORE can't access PHY.
Correct PHY reset sequence by using USB_PHY_PON bit with
USB_OTG_HS_PHY_CTRL register as per hardware programming
guidelines. Since, driver supports selection of primary or
secondary PHY with CI controller, choose PHY_CTRL_REG
accordingly. Also, debug out important USB register when
ulpi read/write timeout is seen with USB PHY.

CRs-fixed: 676343
Change-Id: Ie69e44a1134c1f4458619ae93520e722aad9e0c8
Signed-off-by: Manu Gautam <mgautam@codeaurora.org>
usb: gadget: Ignore the second set_config from the host

Some USB hosts may send SET_CONFIGURATION with same value twice.
The current code implementation of android_work() issues disconnect
event to userspace if SetConfiguration with non-zero value is sent
twice. The Userspace application may disconnect USB and it causes
fail to connect to the USB host.

Fix this by ignoring the second time SET_CONFIGURATION request
from the host only for the same configuration value twice.

CRs-Fixed: 661220
Change-Id: Iec8dd7824fa9f371ea147784cf9137aa88a7128e
Signed-off-by: ChandanaKishori Chiluveru <cchilu@codeaurora.org>
USB: android: release spinlock before queuing work in android_setup

In android_setup we release spinlock after scheduling the work but there
is no need for holding the spinlock during the schedule_work call
is executed this can lead to spinlock timeouts in case where schedule
work takes more time.

So before scheduling work in android_setup we release spinlock to avoid
potential spinlock lockup or timeout.

CRs-Fixed: 661220
Change-Id: Ibf8ff7f07caf20edf9e646fdcef540fbc6441aec
Signed-off-by: Tarun Gupta <tarung@codeaurora.org>
Signed-off-by: Vijayavardhan Vennapusa <vvreddy@codeaurora.org>
Signed-off-by: ChandanaKishori Chiluveru <cchilu@codeaurora.org>
msm: camera: sensor: remove unnecessary logs

Use CDBG instead of pr_err for non-error logs.

Change-Id: If09d576040011e4036dda830b50d84473ec806b7
Signed-off-by: Xu Han <hanxu@codeaurora.org>
Merge "usb: gadget: Ignore the second set_config from the host"
Merge "USB: android: release spinlock before queuing work in android_setup"
net: fib: fix incorrect call_rcu_bh()

After IP route cache removal, I believe rcu_bh() has very little use and
we should remove this RCU variant, since it adds some cycles in fast
path.

Anyway, the call_rcu_bh() use in fib_true is obviously wrong, since
some users only assert rcu_read_lock().

Change-Id: Ie22d933518d579f4d018a4efec9d3a39c7b64681
Signed-off-by: Eric Dumazet <edumazet@google.com>
Cc: "Paul E. McKenney" <paulmck@linux.vnet.ibm.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Git-commit: 0c03eca3d995e73d691edea8c787e25929ec156d
Git-repo: git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
Signed-off-by: Osvaldo Banuelos <osvaldob@codeaurora.org>
usb: android: Skip the work when set_config arrives with same value twice

Some USB hosts may send SET_CONFIGURATION with same value twice.
The current code implementation processing the 2nd set_config and
schedules the work. The android_work() issues disconnect event to
userspace if SetConfiguration with non-zero value is sent twice.
The userspace applications may disconnect the USB and the device
doesn't connect to the host.

Fix this by avoiding the android_work for the second time SET_CONFIGURATION
request when it receives SetConfiguration request with same configuration
value twice from the host.

CRs-Fixed: 661220
Change-Id: Ic450315a9067b9b679b4936480d125e4e4b7cdf7
Signed-off-by: ChandanaKishori Chiluveru <cchilu@codeaurora.org>
Merge "usb: android: Skip the work when set_config arrives with same value twice"
Merge "wcnss: Reset IRIS card before Starting IRIS XO configuration"
msm: display: Add pipe type selection in overlay request

Allow user to specify the type when requesting an overlay pipe.
If field is set the pipe type indication in the flags will be
ignored.
Change-Id: Iee51d24b96c7a2a987dc70a439342e6548dfc8fa
Signed-off-by: Vineet Bajaj <vbajaj@codeaurora.org>
msm: mdss: Increase commit count for first kickoff

During panel unblank a kickoff is done to turn on the panel so that the
first update is not delayed. It is also used to give buffer to command
mode panel prior to enabling backlight prevent junk data from appearing.
In order to prevent release fence timeline from being signaled too
early we will increase the commit count. This allow next sync point
to be added to the appropriate point on timeline, instead of relying
on frame done being called before sync/commit calls.

Change-Id: I566f90b3013b59dedbe42bbb9fdf6fa37d65e779
Signed-off-by: Terence Hampson <thampson@codeaurora.org>
ARM: dts: msm: Update bus bandwidth votes for sdhci on 8974

Some versions of 8974 supports eMMC HS400 mode providing maximum
throughput of 400MB/s. Update the list of bus bandwidth votes to
make sure appropriate vote is placed in this mode.

CRs-fixed: 656702
Change-Id: I5e3bed70d8c8c1c6423483f7469849823e3ebb2c
Signed-off-by: Sujit Reddy Thumma <sthumma@codeaurora.org>
Signed-off-by: Asutosh Das <asutoshd@codeaurora.org>