msm: camera: Fix lens lock issue in actuator.

The actuator is not able to move beyond one region boundary.
This is because when there is region boundary between current
lens position and destination lens position, the lens is first moved
to region boundary and then moved to the destination target position.
Once region boundary(target lens position in this case) is reached
we should not assume it is the end of total lens movement. So
condition check (curr_lens_pos == target_lens_pos) is wrong. Hence
removing the inaccurate condition check.

Signed-off-by: Rajakumar Govindaram <rajakuma@codeaurora.org>
(cherry picked from commit 526df7fad91516d3e4ff0713c5dc389bdb87df5f)

Change-Id: Ia68ca1441a16662d225172dc0664664899b8c8b5
Signed-off-by: Gopal Goberu <ggober@codeaurora.org>
msm-camera: increase wait for config status

wait for config status for 2 iterations before sending to upperlayers
in case of ERESTARTSYS error.

Change-Id: I938eee5316382a18524fbd7c7c3f1c6715d581dc
Signed-off-by: Katta Santhisindhu <kattas@codeaurora.org>
msm: camera: Fixing multiple stability issues:

    1. Add state for power up.
    2. Adding state check for sensor power up and down.
    3. Fix kernal crash due to NULL mctl_cmd.
    4. Fix for actuator crash.
    5. Add NULL pointer check for regulator.

Change-Id: I33d0ac14ff933872a94e32b25ecb50da56ff7b02
Signed-off-by: Krupal Divvela<kdivvela@codeaurora.org>
msm: camera: Fix NULL pointer dereference while CSIC config

Fix NULL pointer dereference from CSIC config.

CRs-Fixed: 416473

Change-Id: I7d76742de16eb714af357957b53fb8e0ca7d4bb3
Signed-off-by: Lokesh Kumar Aakulu <lkumar@codeaurora.org>
Signed-off-by: Raju P.L.S.S.S.N <rplsssn@codeaurora.org>
msm: camera: Remove duplicate video device list initialization.

When a video device is registered through video_register_device,
the fh_lock and fh_list variables are already initialized. So we
dont need to explicitly initialize them during v4l2 event queue
setup. Doing this overwrites the fh_list in some cases like
mctl pp node, where each instance can have its own eventHandle but
linked to the mctl pp video node. This can cause video device list
corruption in some usecases like HDR. Remove this extra
initialization for v4l2 nodes which register their video devices.
For native nodes using v4l2 event handles, add the initialization
before setting up the v4l2 event queue.
Move the function setup_v4l2_event_queue and
destroy_v4l2_event_queue into msm_cam_server.c for better code
organization.

CRs-fixed: 443659

Change-Id: Iad6a4108f1c970fdf5a64300b9a3194bc48b8a8b
Signed-off-by: Aditya Jonnalagadda <ajonnala@codeaurora.org>
msm:camera: Fix signedness issue in hw_exec_cmds

  In hw_exec_cmds()second argument m_cmds should be
  of type unsigned interger

Change-Id: Idad2eb1a59481f3fe9f90221ff2061e8dae57013
CRs-Fixed: 493314
Signed-off-by: Monika Alekhya <malekh@codeaurora.org>
 msm:camera: Fix overflow issue in ioctl_hw_cmds function

    'len' is of type signed int 32bit,but the assigned value
    may exceed maximum unsigned int32 range.Add overflow check
    and graceful exit if 'm'exceeds UINT32_MAX value.

Change-Id: I38f0d10a0cb44d08d0054f91044fc891c246ebd1
CRs-Fixed: 493314
Signed-off-by: Monika Alekhya <malekh@codeaurora.org>
msm-camera: Fix various small issues in Actuator driver

Bound check and validate userspace parameters direction,
number of steps and direction sign. Also fix possible
memory leak in certain error cases.

Change-Id: I05a3f63583845851df36b122f2079d345657cb99
CRs-Fixed: 511349

Signed-off-by: Katta Santhisindhu <kattas@codeaurora.org>
msm-camera: Changes to remove unused code for security issue reported

changes to remove MSM_CAM_IOCTL_SET_MEM_MAP_INFO Ioctl support.
This will avoid physical memory mapping to userspace.

Change-Id: I2487231054a9c2ced42aad3aed58bb64000b79bf
CRs-Fixed: 463100
Signed-off-by: Katta Santhisindhu <kattas@codeaurora.org>
msm:camera: Initialize a structure before usage

Initialize a structure using memset such that it is
populated properly before returning to userspace.

CRs-fixed: 550567
Change-Id: I2b3c78cd2b309de13acf2811fcc16b8bc04fa052
Signed-off-by: Alok Kediya <kediya@codeaurora.org>
msm:camera: Initialize the structure before to pass userspace.

Initialize the structure by memset so that value will pass to
proper to usersapce.

CRs-fixed: 554845
Change-Id: I4adf4bf1bb6e45e16f5fd2e26a74232e6ee7f8bd
Signed-off-by:Vivek Singh<vising@codeaurora.org>
msm:camera: Bounds and validity check for params

Check the range and validity of parameters before accessing.
CRs-fixed: 550607, 554434, 554436
Change-Id: I2d6aec4f9cb9385789c0df6a2c4abefe9e87539f
Signed-off-by: Alok Kediya <kediya@codeaurora.org>

Signed-off-by: Monika Alekhya <malekh@codeaurora.org>
msm-camera: Fix buffer overflow issue

Tainted length value is used to copy data
which can result in a heap-based buffer overflow

Change-Id: I9f1fa1bd52a78ed48356b9122d8e17b8c74110b3
CRs-Fixed: 547934
Signed-off-by: Katta Santhisindhu <kattas@codeaurora.org>
msm-camera: Fix to prevent kernel heap buffer overflow in actuator

Fix to prevent kernel heap buffer overflow allows user
controlled data to be written to the heap via the
msm_camera actuator IOCTLs

Change-Id: I5d511e8c1aa2f76f4209a6712a58d8757bc53367
CRs-Fixed: 545979
Signed-off-by: Katta Santhisindhu <kattas@codeaurora.org>

Signed-off-by: Monika Alekhya <malekh@codeaurora.org>
msm:camera: Copy data from user to kernel space before access

This would avoid any invalid access of data.

CRs-fixed: 550608
Change-Id: I30993a9bc731227e72f3be34874505f01357f04d
Signed-off-by: Alok Kediya <kediya@codeaurora.org>
Signed-off-by: Monika Alekhya <malekh@codeaurora.org>
msm: camera: prevent invalid access through mmap

Disable access to invalid addresses through mmap.
Add appropriate range checks to ensure valid accesses
through framebuffer mmap. This prevents illegal
access into memory.

Change-Id: Ie053d9d8efe951b88f28b020dd9c2356e54723a7
CRs-Fixed: 475794
Signed-off-by: Manoj Rao <manojraj@codeaurora.org>
msm:camera: Mercury hardware JPEG decoder driver support.

Support for Mecury hardware JPEG decoder engine.

Import from caf/jb_2.5.5

Change-Id: Icbb5e0aa9602c0f01d9034444e3e275994eb6978