msm: mdss: initialize pipe to NULL

Initialize the pipe pointer to NULL.
So that even if the selection of pipe from pipe-pool
fails, the function returns NULL instead of an
uninitialized value.

Change-Id: Ib04c0a983cba6ffe9532862bcaf516877e49746a
CRs-Fixed: 524466
Signed-off-by: Manoj Rao <manojraj@codeaurora.org>
Signed-off-by: Ajay Dudani <adudani@codeaurora.org>
Signed-off-by: franciscofranco <franciscofranco.1990@gmail.com>
msm: mdss: hdmi: Proper HDMI feature check

Checks for the proper HDMI feature before providing the
corresponding feature data to avoid invalid memory access.

CRs-Fixed: 542785
Change-Id: I943bee9e843e0504effdfddfaf2dea82c22388f6
Signed-off-by: Ajay Singh Parmar <aparmar@codeaurora.org>
Signed-off-by: Ajay Dudani <adudani@codeaurora.org>
Signed-off-by: franciscofranco <franciscofranco.1990@gmail.com>
msm: mdss: hdmi: Security check for EDID 3D data parsing

While parsing EDID (Extended display identification data) received
from TV for 3D data and other, proper buffer overflow check is done
to avoid data overflow or overwrite.
Also, replace snprintf with scnprintf for better memory copy results.

CRs-Fixed: 542823
Change-Id: I2603beea6eb88a92b013a1a45d960a4c3ba6c09b
Signed-off-by: Ajay Singh Parmar <aparmar@codeaurora.org>
Signed-off-by: Ajay Dudani <adudani@codeaurora.org>
Signed-off-by: franciscofranco <franciscofranco.1990@gmail.com>
msm: qmi: Fix access-after-free condition

In case, the sending of a message from handle_resume_tx fails, the
transaction is freed and the failure info is printed in the kernel log
which results in an access-after-free condition.

Free the txn after printing the error message.

CRs-Fixed: 525365
Change-Id: I111634948fa2e8a9737b77a658283ae6d1562531
Signed-off-by: Zaheerulla Meer <zmeer@codeaurora.org>
Signed-off-by: Ajay Dudani <adudani@codeaurora.org>
Signed-off-by: franciscofranco <franciscofranco.1990@gmail.com>
mmc: print an error on FLUSH timeout
msm: audio: qdsp6v2: Change acdb_mmap size variable to unsigned

The acdb_mmap fuction does a size calculation but
stores the result in an int which makes negitive
numbers possible. Changing the variable to unsigned
ensures that the size used is never out of bounds.

Change-Id: Iffd9c1440d2f28b703a77993fdbb3ccd18f30694
CRs-fixed: 548145
Signed-off-by: Ben Romberger <bromberg@codeaurora.org>
Signed-off-by: Ajay Dudani <adudani@codeaurora.org>
Signed-off-by: franciscofranco <franciscofranco.1990@gmail.com>
msm: qdsp6v2: memset stack buffer allocation.

This is needed to avoid garbage data in uninitialized variables.

Change-Id: Ic4b4d7481644c2add187a9122a4e7cfe7255b379
CRs-Fixed: 553304
Signed-off-by: Asish Bhattacharya <asishb@codeaurora.org>
Signed-off-by: Ajay Dudani <adudani@codeaurora.org>
Signed-off-by: franciscofranco <franciscofranco.1990@gmail.com>
msm: qdsp: memset stack buffer allocation.

This is needed to avoid garbage data in uninitialized variables.

Change-Id: I456be431ee2e22fa5cd5fd2951d7079e177e3646
CRs-Fixed: 553262
Signed-off-by: Asish Bhattacharya <asishb@codeaurora.org>
Signed-off-by: Ajay Dudani <adudani@codeaurora.org>
Signed-off-by: franciscofranco <franciscofranco.1990@gmail.com>
msm: mdss: hdmi: Proper permissions for CEC logical address

Do not give universal access to CEC (Consumer Electronics Control)
sysfs nodes for logical and physical addresses to avoid unauthorized
access.

CRs-Fixed: 547968
Change-Id: I2ba57f050cc92a361586064dfd5e5659ab07c2f7
Signed-off-by: Ajay Singh Parmar <aparmar@codeaurora.org>
Signed-off-by: Ajay Dudani <adudani@codeaurora.org>
Signed-off-by: franciscofranco <franciscofranco.1990@gmail.com>
msm: kgsl: Handle failure of find_process_private()

Handle the case of NULL return from find_process_private() upon
its failure by failing from get_process_private().

CRs-fixed: 542831
Change-Id: I8a365368ecf68f0d1aa01199aca76bc7ac49e154
Signed-off-by: Harsh Vardhan Dwivedi <hdwivedi@codeaurora.org>
Signed-off-by: Ajay Dudani <adudani@codeaurora.org>
Signed-off-by: franciscofranco <franciscofranco.1990@gmail.com>
msm: camera_v2: cpp: initialize inst info

memset inst_ifo structure to aviod sending
uninitialized data via ioctl

Change-Id: I2e8ee5ccf4180a9004851c51ed6f837ae492e6cc
Signed-off-by: Georgi Hristov <ghristov@codeaurora.org>
Signed-off-by: Ajay Dudani <adudani@codeaurora.org>
Signed-off-by: franciscofranco <franciscofranco.1990@gmail.com>
ARM: gic: remove redundant debug message

Remvoe log message which was made redundant by 3211f80

Signed-off-by: franciscofranco <franciscofranco.1990@gmail.com>
defconfig: Enable msm_sharedmem UIO driver

Enable msm_sharedmem UIO driver on targets which use RemoteFS
(over QMI) and RFSA.

CRs-Fixed: 477427
Bug: 12784954
Change-Id: I63d95aa0fcbbdc17d64fb7749ed50c3890551dce
Signed-off-by: Pratibhasagar V <pratibha@codeaurora.org>
Signed-off-by: Venkat Gopalakrishnan <venkatg@codeaurora.org>
Signed-off-by: Mekala Natarajan <mekalan@codeaurora.org>
Signed-off-by: franciscofranco <franciscofranco.1990@gmail.com>
ARM: dts: msm: Add new 'sharedmem' devices

Add new devices which need to maintain the shared memory
address for RemoteFS and RFSA

CRs-Fixed: 477427
Bug: 12784954
Change-Id: Id5f3ea2a827d5a30b06d872d7a72468f1fd7718f
Signed-off-by: Pratibhasagar V <pratibha@codeaurora.org>
Signed-off-by: Venkat Gopalakrishnan <venkatg@codeaurora.org>
Signed-off-by: Mekala Natarajan <mekalan@codeaurora.org>
Signed-off-by: franciscofranco <franciscofranco.1990@gmail.com>
uio: msm_sharedmem: Add new device driver for sharedmemory access

Add new device driver to provide a standard interface for its
clients (like RemoteFS and RFSA) to be able to memory map their
respective allotted shared memory address in the client's address space.
The shared memory (a transport buffer) address is unique for each
individual client and is made available to the driver via device tree.

This driver uses the existing UIO framework to facilitate the clients
mmap requirements. Each individual client will be able to use a unique
UIO device for this purpose.

CRs-Fixed: 477427
Bug: 12784954
Change-Id: If07b88086b5f1b87845962818094644575629fcf
Signed-off-by: Pratibhasagar V <pratibha@codeaurora.org>
Signed-off-by: Venkat Gopalakrishnan <venkatg@codeaurora.org>
Signed-off-by: Mekala Natarajan <mekalan@codeaurora.org>
Signed-off-by: franciscofranco <franciscofranco.1990@gmail.com>
hammerhead_defconfig: Enable msm_sharedmem UIO driver

Enable msm_sharedmem UIO driver on targets which use
RemoteFS(over QMI).

CRs-Fixed: 477427
Bug: 12784954
Signed-off-by: Mekala Natarajan <mekalan@codeaurora.org>
Signed-off-by: franciscofranco <franciscofranco.1990@gmail.com>
uio: provide vm access to UIO_MEM_PHYS maps

This makes it possible to let gdb access mappings of the process that is
being debugged.

uio_mmap_logical was moved and uio_vm_ops renamed to group related code
and differentiate to new stuff.

CRs-Fixed: 570735
Change-Id: I8a5ff343727cc58fedfeb73f3466cc9a7f153e84
Signed-off-by: Uwe Kleine-König <u.kleine-koenig@pengutronix.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Git-commit: 7294151d0592e0ff48c61fca9fd7c93d613134da
Git-repo: http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git
Signed-off-by: Pratibhasagar V <pratibha@codeaurora.org>
Signed-off-by: franciscofranco <franciscofranco.1990@gmail.com>
msm: kgsl: Ensure signals do not cause waits to end early

Move to using uninterruptible (which will bail if any signal is received)
when waiting on events.  A signal was causing the wait to finish
prematurely, freeing memory while the GPU was still using it.  This caused
quite a few page faults and the device to become unstable.

Change-Id: Ic0dedbade9143c9377830a209c3ffd252aa9668b
Signed-off-by: Carter Cooper <ccooper@codeaurora.org>
Signed-off-by: Jordan Crouse <jcrouse@codeaurora.org>
Signed-off-by: franciscofranco <franciscofranco.1990@gmail.com>
msm: kgsl: Panic if global timestamp wait fails in context detach

If we timeout while waiting for the last issued global timestamp for
a detaching context to expire (10 seconds!) then we are on a fast
train to crashville.  BUG_ON() so we can stand a chance of debugging
this very rare issue.

Change-Id: Ic0dedbaddb9cbc5681f9c872785ce26b7cf9b87b
Signed-off-by: Jordan Crouse <jcrouse@codeaurora.org>
Signed-off-by: franciscofranco <franciscofranco.1990@gmail.com>
msm: kgsl: Force the ME off before reading the microcode

On A3XX reading the microcode while the CP is running is dangerous
beyond words.  By setting the offset address for the read, we are
essentially changing the instruction pointer for the ME while it
is running causing opcode errors, gpu faults and/or system errors.

We do not want to stop the CP at the beginning of the snapshot
process beacuse doing so changes the RBBM status and the state of
the CP registers which may damage the debug effort.  But by the
time we get to the microcode read we no longer care about the state
of the registers so we can freely halt the ME just before starting
the read.

CRs-fixed: 585449
Change-Id: Ic0dedbad85d7ec26915f054dd597e226e8101a29
Signed-off-by: Jordan Crouse <jcrouse@codeaurora.org>
Signed-off-by: franciscofranco <franciscofranco.1990@gmail.com>