Linux 3.4.88

Change-Id: I13c868f42f31c477231a4a7a5a64bbe75d769d52
LINUX 3.4.89

Change-Id: Ifee30035e1846a671aed40734d7a4f47d44aef5d
LINUX 3.4.90

Change-Id: I4ce61f86d3feb3060b3b37fd0613de21a98faa3d
LINUX 3.4.91

Change-Id: I9272bcfb9aa75786d03274b64c2e3b142a17eed2
LINUX 3.4.92

Change-Id: I13febfd68f8f1d30c98a6cdfd32584c754477454
LINUX 3.4.93

Change-Id: I9fd9776a553e5238d243a81bb7f6619d17855dc3
LINUX 3.4.94

Change-Id: I8d8469237a5c0d2287227697b4839818cf7080be
msm: camera: Exit gracefully while camera daemon crashes

Add camera daemon shutdown handling in all camera
sub devices to exit camera gracefully and it helps
to restart camera.

Change-Id: I39643a16f100b873275efe3a0c6184fe54e52830
Signed-off-by: Suresh Vankadara <svankada@codeaurora.org>
msm:cpp: Fix for spurious interrupts from CPP hardware

When power up the CPP, it generates spurious interrupts
that can confuse microntroller and halt it. This fix
clears the interrupt requests from CPP before enable
Microcontroller at "Open Camera" event.

Change-Id: I3b75f2513efc30fb0f35dd086464f0b6c3a6ff9b
Signed-off-by: Iliya Varadzhakov <ivarad@codeaurora.org>
msm: camera: Cleanup msm generic buf queue on userspace crash

Clean-up the msm camera generic buff queue on userspace
crash to avoid invalid memory access in next session
which might lead to corruption in other modules
and system stability issues and also avoid memory leak.

Change-Id: Icd989cf9ef944c01e1193fead105963f745bcbc4
CRs-Fixed: 522939
Signed-off-by: Hariram Purushothaman <hpurus@codeaurora.org>
msm: camera: Fix for memory leaks and error handlers.

(a) Fix leak during error cases.
(b) Handle error cases like releasing devices in case of
    failures.

Change-Id: I9e01855e1de968cac6708aaf6a2522d277f93f7c
Signed-off-by: Azam Sadiq Pasha Kapatrala Syed <akapatra@codeaurora.org>
msm: camera: Cleanup msm generic buf queue handling

Clean-up the msm camera generic buff queue when all
client closes the handle and also provide init-deinit
ioctl for cpp to open-close the buff mngr handle.

Change-Id: Ie484174e0ffaee02e85c9c9cda8ac26103aaddd0
CRs-Fixed: 582261
Signed-off-by: Hariram Purushothaman <hpurus@codeaurora.org>
msm: camera: Fix for invalid kernel memory access

Adjust the length of the command based on command type
to avoid invalid memory access in ISP driver.

Change-Id: Ie1c23b45426f9598dba3ad1ee91e6598e8232134
Signed-off-by: Aditya Jonnalagadda <ajonnala@codeaurora.org>
msm: camera: Fix possible NULL pointer dereference.

The result of memory allocation in msm_isp_get_buf is not checked for
success before use. This can lead to NULL pointer dereference.

Change-Id: Ia69d61d3db85cfcb1b33a789ccec28fade5ee313
Signed-off-by: Petar Sivenov <psiven@codeaurora.org>
Signed-off-by: Pranav Vashi <neobuddy89@gmail.com>
msm: camera_v2: cci: check for NULL pointer

in function "msm_cci_subdev_g_chip_ident"
check for NULL pointer and return error
instead of assert

Change-Id: I76fa94e420133dfd56240f3baf4c846580123b03
Signed-off-by: Georgi Hristov <ghristov@codeaurora.org>
Signed-off-by: Pranav Vashi <neobuddy89@gmail.com>
msm: camera: Cleanup msm_generic_buff list while close

Cleanup the camera msm generic buffer manager list
when all v4l2 nodes are closed.

Change-Id: Ie309fcdddc3d83587a45dd5742e20a7e3fde19b8
Signed-off-by: Azam Sadiq Pasha Kapatrala Syed <akapatra@codeaurora.org>
Signed-off-by: Pranav Vashi <neobuddy89@gmail.com>
ARM: Improve vmalloc address checking in show_data()

There is an unhandled corner case with the current check
which has recently been hit. The nbytes argument may be
large enough for the range being dumped to cross a
boundary between page-table mappings, and dump addresses
which are vmalloc'd in the neighboring mapping.

Check every address being dumped to see if its vmalloc'd,
not just the address passed to show_data().

CRs-Fixed: 625442
Change-Id: I255b093808177321f5202dcacea337ee333bfc63
Signed-off-by: Matt Wagantall <mattw@codeaurora.org>
dma-contiguous: Retrun 'zero' pfn in case of error

When CMA allocator gets error return from the page
allocator framework, except for the -EBUSY case, it
will bail out. Caller depends on the 'pfn' for
confirming allocation successful or not. Return 0
for those error case.

CRs-Fixed: 647635
Change-Id: Ica4e04a9f9f18b1a29035ba2bae9deecfd68a5e8
Signed-off-by: Chintan Pandya <cpandya@codeaurora.org>
mmc: core: Fix clock frequency transitions during invalid states

eMMC and SD card specifications restrict the usage of a class of
commands while commands in other class are in progress. For example,
during erase operations the SD/eMMC spec. allows only CMD35, CMD36,
CMD38. If clock scaling is enabled and decide to scale up the clocks
it may be possible that CMD19/21 tuning commands are sent in between
erase commands, which is illegal as per specification.

Fix such illegal transactions to the card and also make clock scaling
statistics accountable only for read/write commands instead of time
consuming commands, like CMD38 erase, where transactions are independent
of bus frequency.

Change-Id: Iffba175787837e7f95bde8970f19d0f0f9d7d67d
Signed-off-by: Sujit Reddy Thumma <sthumma@codeaurora.org>
soc: qcom: smd: Validate read and write addresses

The address from which data has to be read and the address to which the
SMD data has to be written is calculated based on the head and tail
indices for that SMD FIFO. If the indices are corrupted, then the
calculated pointer may be outside of the FIFO and may even be outside of
the range of SMEM.

Validate the read and write addresses to be with in the limits of
receive and send FIFO limits respectively.

CRs-Fixed: 550527
Change-Id: Ie5578f6aee73ea2b1435fea7c2a0a6dda14bff82
Signed-off-by: Zaheerulla Meer <zmeer@codeaurora.org>