msm_fb:hdmi:Security checks for EDID block read.

Ensure data is read from within limits of buffer
for data block collection/video data block in EDID.
This prevents EDID data from being read past the end
of data block collection offset.
Ensure the 3D formats are only read from the proper
buffer region for vendor specific data block. This
prevents illegal data being read from the EDID data.

Change-Id: Id411f7e93aaf9293341a87cb4ca5431005e2bb18
Signed-off-by: Sandeep Panda <spanda@codeaurora.org>
netfilter: Enable TOS matching in the kernel

This patch enabled kernel config CONFIG_NETFILTER_XT_MATCH_DSCP.
This adds a netfilter kernel configuration for matching TOS
packets for IPV4 packets. This will be required in certain QOS
filtering scenarios when the filter match is based on TOS.

CRs-Fixed: 542806
Change-Id: I59f311709daba8859db317cc152f96bc09f345b1
Acked-by: Sudharsan Coimbatore Premkumar <supremku@qti.qualcomm.com>
Signed-off-by: Harout Hedeshian <harouth@codeaurora.org>
msm: kgsl: always check ft and hw gates in kgsl_active_count_get

The device state can fluctuate during recovery and resume, so
it is safer to check the gates unconditionally rather than
trust the state. The gates are left open until recovery
or suspend starts.

Change-Id: Idad91976ceba0904425e54c71faf88b4fccb8fdd
Signed-off-by: Jeremy Gebben <jgebben@codeaurora.org>
msm: kgsl: Do not wait for FT gate in fault tolerance state

When device start fails, device is in INIT state and FT is triggered.
In FT we trigger snapshot which waits on ft_gate when active count is
0 and device is not in active state. This causes a deadlock. This
change does not wait for FT gate in FT state and thereby prevents
the deadlock.

CRs-Fixed: 526206
Change-Id: Id9e0a7c3f3f9367d0b3cc17e45fbba4b42bebf64
Signed-off-by: Tarun Karra <tkarra@codeaurora.org>
arm: Move the secondary_startup to __CPUINIT section.

Because of addition 1MB alignment after head.txt section,
the secondary_startup needs to move to 1MB aligned section.

CRs-Fixed: 513919
Change-Id: I332d1e4ec95c877406c6ad3318e5f9a3c85cc10f
Signed-off-by: Venkatesh Yadav Abbarapu <quicvenkat@codeaurora.org>
sync: signal pt before sync_timeline object gets destroyed

There is a race condition

Assume we have *one* sync_fence object, with *one* sync_pt
which belongs to *one* sync_timeline, given this condition,
sync_timeline->kref will have two counts, one for sync_timeline
(implicit) and another for sync_pt.

Assume following is the situation on CPU

Theead-1 : (Thread which calls sync_timeline_destroy())
  -> (some function calls)
   -> sync_timeline_destory()
    -> sync_timeline_signal() (CPU is inside this
function after putting reference to sync_timeline)

At this time Thread-2 comes and does following

Thread-2 : (fclose on fence fd)
> sync_fence_release() -> because of fclose() on fence object
 -> sync_fence_free()
  -> sync_pt_free()
   -> kref_put(&pt->parent->kref, sync_timeline_free);
    -> sync_timeline_free() (CPU is inside this because
this time kref will be zero after _put)

Thread-2 will free sync_timeline object before Thread-1
has finished its work inside sync_timeline_signal.

With this change we signals all sync_pt before putting
reference to sync_timeline object.

Change-Id: I66d7359cc5dca0352fda49f81953028e98b95993
Signed-off-by: Prakash Kamliya <pkamliya@codeaurora.org>
Signed-off-by: Hareesh Gundu <hareeshg@codeaurora.org>
msm_fb:hdmi:Fix for sysfs Entry Information Leaks

These sysfs entries leak logical and physical addresses
within the kernel and may be read by any user.
The read permissions for the sysfs entries changed
to S_IRUSR from S_IRUGO.

Change-Id: Idfc58c3b639ea4dfa105ff146467a1c4f01edb6e
Signed-off-by: Sandeep Panda <spanda@codeaurora.org>
msm: msm_fb: validating backlight level and scale value

Validating the value of backlight to be not more than the
max value and also ensuring that the backlight scale value
is not more than 1024, thereby ensuring that backlight
scaling factor is not more than 1

Change-Id: I6a6f4f0f0a8c272edcac5078276fb406ddee3e90
Signed-off-by: Krishna Chaitanya Parimi <cparimi@codeaurora.org>
msm: fb: Null check mfd data

Add appropriate null check for mfd data
structure before accessing it's members.
This prevents null pointer accesses in
the driver.

Change-Id: I5aae937f839e4f6ed8d5c5a4b54ab45f0ff07332
Signed-off-by: Krishna Chaitanya Parimi <cparimi@codeaurora.org>
msm: fb: Copy unsigned int for notify update

Change to correct signature of msmfb_notify_update
from the ioctl declaration.

Change-Id: Ia7bdfd3dbe8494a641ffd46d484794b4bec7d27c
Signed-off-by: Krishna Chaitanya Parimi <cparimi@codeaurora.org>
msm_fb:hdmi:Security check for EDID 3D data parse

While parsing EDID received from TV for 3D data and other,
proper buffer overflow check is done to avoid
data overflow or overwrite.
Also, replace snprintf with scnprintf for better memory copy results.

Change-Id: I4100226a6e5ae0740478f5d85e5b70c9fa20188e
Signed-off-by: Sandeep Panda <spanda@codeaurora.org>
Merge "netfilter: Enable TOS matching in the kernel"
Merge "arm: Move the secondary_startup to __CPUINIT section."
msm: msm_fb: Remove Warnings when required BW exceeds Max Bandwidth.

When required BW exceeds max bandwidth, warnings are printed on the
console which are causing performance degradation. This Patch fixes
the issue.

Change-Id: I769f55dd76a3f28639b848bd5461e2ff3abae3f5
Signed-off-by: Vishnuvardhan Prodduturi <vproddut@codeaurora.org>
Merge "msm: msm_fb: Remove Warnings when required BW exceeds Max Bandwidth."
Merge "msm_fb:hdmi:Security checks for EDID block read."
Merge "msm_fb:hdmi:Fix for sysfs Entry Information Leaks"
Merge "msm: fb: Null check mfd data"
Merge "msm: fb: Copy unsigned int for notify update"
Merge "msm: msm_fb: validating backlight level and scale value"