msm: camera: Rollback to jb_rel_rb4.2 into HEAD.

Include caf/jb_2.5.3 ION/IOMMU port.

Change-Id: I4b04a1cb46cb00c54e3e354321accc6a9aa21dc6
msm-camera: increase wait for config status.

wait for config status for 2 iterations before sending to upperlayers
in case of ERESTARTSYS error.

Signed-off-by: Katta Santhisindhu <kattas@codeaurora.org>
(cherry picked from commit d82e1c8e56dd3840a60f61409eaa5a34fdf28ea4)

Change-Id: Ia4a8ba39e7f5af205dc6271f9bfe2ae26009af06
Signed-off-by: Vivek Panwar <c_vpanwa@qti.qualcomm.com>
Signed-off-by: Vivek Panwar <vpanwa@codeaurora.org>
msm: camera: Add support for bus overflow recovery.

In case of bus overflow, try to recover by stopping CAMIF
and overall VFE reset and restore the IRQ mask.

CRs-Fixed: 510209
Change-Id: I18d5d0c22ffed94f559717500901ff23ce19c0ca
Signed-off-by: Kiran Kumar H N <hurlisal@codeaurora.org>
(cherry picked from commit c3a15ed07f92e1cad6ef3d55e41fa590c15f31c9)

Signed-off-by: Satish Kamuju <skamuj@codeaurora.org>
msm: camera: Notify application in case of CAMIF error.

In case of CAMIF errors, send the error notification so that
the application can shutdown the camera pipeline.

Change-Id: I08e9e150e5e08905e34fb342c611f789eccc4e74
CRs-Fixed: 510209
Signed-off-by: Kiran Kumar H N <hurlisal@codeaurora.org>
(cherry picked from commit 8641b2821d2d1f0000c49e9c7017cca6e9979663)

Signed-off-by: Satish Kamuju <skamuj@codeaurora.org>
msm: camera: Notify application in case of bad state.

In case, the bus overflow keeps happening beyond a
predefined threshold, stop recovery and notify the
user about the error so that camera can be gracefully
shutdown.

CRs-Fixed: 510209
Change-Id: I4a3ff26cd73a20511174fe7fc9d0b46af2986249
Signed-off-by: Kiran Kumar H N <hurlisal@codeaurora.org>
(cherry picked from commit 6a5606b85cd601af351b3b7256b176aa403638fc)

Signed-off-by: Satish Kamuju <skamuj@codeaurora.org>
msm-camera: Fix various small issues in Actuator driver

Bound check and validate userspace parameters direction,
number of steps and direction sign. Also fix possible
memory leak in certain error cases.

Change-Id: I05a3f63583845851df36b122f2079d345657cb99
CRs-Fixed: 511349

Signed-off-by: Katta Santhisindhu <kattas@codeaurora.org>
msm-camera: Changes to remove unused code for security issue reported

changes to remove MSM_CAM_IOCTL_SET_MEM_MAP_INFO Ioctl support.
This will avoid physical memory mapping to userspace.

Change-Id: I2487231054a9c2ced42aad3aed58bb64000b79bf
CRs-Fixed: 463100
Signed-off-by: Katta Santhisindhu <kattas@codeaurora.org>
msm:camera: Initialize a structure before usage

Initialize a structure using memset such that it is
populated properly before returning to userspace.

CRs-fixed: 550567
Change-Id: I2b3c78cd2b309de13acf2811fcc16b8bc04fa052
Signed-off-by: Alok Kediya <kediya@codeaurora.org>
msm:camera: Initialize the structure before to pass userspace.

Initialize the structure by memset so that value will pass to
proper to usersapce.

CRs-fixed: 554845
Change-Id: I4adf4bf1bb6e45e16f5fd2e26a74232e6ee7f8bd
Signed-off-by:Vivek Singh<vising@codeaurora.org>
msm:camera: Bounds and validity check for params

Check the range and validity of parameters before accessing.
CRs-fixed: 550607, 554434, 554436
Change-Id: I2d6aec4f9cb9385789c0df6a2c4abefe9e87539f
Signed-off-by: Alok Kediya <kediya@codeaurora.org>

Signed-off-by: Monika Alekhya <malekh@codeaurora.org>
msm-camera: Fix buffer overflow issue

Tainted length value is used to copy data
which can result in a heap-based buffer overflow

Change-Id: I9f1fa1bd52a78ed48356b9122d8e17b8c74110b3
CRs-Fixed: 547934
Signed-off-by: Katta Santhisindhu <kattas@codeaurora.org>
msm-camera: Fix to prevent kernel heap buffer overflow in actuator

Fix to prevent kernel heap buffer overflow allows user
controlled data to be written to the heap via the
msm_camera actuator IOCTLs

Change-Id: I5d511e8c1aa2f76f4209a6712a58d8757bc53367
CRs-Fixed: 545979
Signed-off-by: Katta Santhisindhu <kattas@codeaurora.org>

Signed-off-by: Monika Alekhya <malekh@codeaurora.org>
msm:camera: Copy data from user to kernel space before access

This would avoid any invalid access of data.

CRs-fixed: 550608
Change-Id: I30993a9bc731227e72f3be34874505f01357f04d
Signed-off-by: Alok Kediya <kediya@codeaurora.org>
Signed-off-by: Monika Alekhya <malekh@codeaurora.org>
msm: camera: prevent invalid access through mmap

Disable access to invalid addresses through mmap.
Add appropriate range checks to ensure valid accesses
through framebuffer mmap. This prevents illegal
access into memory.

Change-Id: Ie053d9d8efe951b88f28b020dd9c2356e54723a7
CRs-Fixed: 475794
Signed-off-by: Manoj Rao <manojraj@codeaurora.org>
gpu: ion: Request highmem pages for IOMMU heap

When allocating pages for IOMMU heap it is advantageous
to try to allocate pages from highmem in addition to
lowmem since clients using the IOMMU heap can use
either highmem or lowmem.

CRs-fixed: 430457
Change-Id: Ifc794fc344c67dd53d8f7cebf86536ab9d44ed6c
Signed-off-by: Olav Haugan <ohaugan@codeaurora.org>
Signed-off-by: Laura Abbott <lauraa@codeaurora.org>