msm_fb: display: keep borderfill pipe's iommu info

Keep borderfill pipe's iommu info during base layer pipe
swap with original base layer pipe. Otherwise, borderfill
pipe's may contain original base layer pipe's iommu info
which cause iommu page fault due to same iommu buffer is
unmapped two times.

CRs-fixed: 436711
Change-Id: Ibdb792055287283c4449db07c2de2901aa4fe9b6
Signed-off-by: Kuogee Hsieh <khsieh@codeaurora.org>
msm_fb: display: fix iommu leak during base layer swap

Retain RGB1 iommu information during  base layer swap
so that iommu used by RGB1 can be freed back to pool later.

Change-Id: Ibed85179284743dc8a9d1434f0c81626b0567e16
Signed-off-by: Kuogee Hsieh <khsieh@codeaurora.org>
(cherry picked from commit be46f9f596c5172438a74759d48ca7db600cd737)
msm_fb: display: Configure solidfill color to black

The solidfill color was getting reset to to default state to white.
Correctly reseting to black by default.

Crs-Fixed: 453600
Change-Id: I203ce61867d009509bf6acd01169f1fb0b223652
Signed-off-by: Siddhartha Agrawal <agrawals@codeaurora.org>
msm_fb: dsiplay: fix frame buffer f_count leak

Frame buffer maintains a reference count (f_count) which increased
by fget() and decreased by fput(). overlay play will apply
fget() to frame buffer if it was the soruce buffer and fput()
will be applied to it after pipe commit done. However there has
extra fput() apply to frame buffer at the time pipe is freed.
This patch fix the problem by  clear MDP_MEMORY_ID_TYPE_FB from
pipe's flags to avoid extra fput() applying to frame buffer.

CRs-fixed: 411394
Change-Id: Ib2b72e6277480b5ace23cda554be485d9d477b3d
Signed-off-by: Kuogee Hsieh <khsieh@codeaurora.org>
Signed-off-by: Siddhartha Agrawal <agrawals@codeaurora.org>
msm_fb: display: return fail if pipe still staged

Pipe is not un-staged from mixer when it is unset.
It expects a pan_display() to un-stage it out of mixer.
Return fail at overlay_set() if pipe was still stage
at mixer.

CRs-fixed: 399193, 393979
Change-Id: I562f6e133bb239b30f4f53669dbf1cc5ddf80d02
Signed-off-by: Kuogee Hsieh <khsieh@codeaurora.org>
Signed-off-by: Siddhartha Agrawal <agrawals@codeaurora.org>
sync: Fix race condition between merge and signal

The copied sync_pt was activated immediately. If the sync_pt was
signaled before the entire merge was completed, the new fence's pt_list
could be iterated over while it is still in the process of being
created.

Moving the the sync_pt_activate call for all new sync_pts to after both
the sync_fence_copy_pts and the sync_fence_merge_pts calls ensure that
the pt_list is complete and immutable before it can be reached from the
timeline's active list.

Change-Id: I7aa4d404a822347b6ce148018d2a66e4f6a20c78
Signed-off-by: Erik Gilling <konkers@android.com>
Signed-off-by: Naseer Ahmed <naseer@codeaurora.org>
Signed-off-by: Uma Maheshwari Bhiram <ubhira@codeaurora.org>
sync: don't log wait timeouts when timeout = 0

Signed-off-by: Erik Gilling <konkers@android.com>
sync: fix timeout = 0 wait behavior

Change-Id: I8b9254e92c26d9f44abbc0c77fb44624de947013
Signed-off-by: Jamie Gennis <jgennis@google.com>
msm: kgsl: pwrscale functions should be run while GPU is ACTIVE

Base the decision to call power scaling functions on the current
state, not the requested state.  The GPU may not transition to the
requested state; call through based on current GPU state instead.

Change-Id: I1524bc92c908dc50a60b5815f2221ae3feef59be
CRs-Fixed: 441847
Signed-off-by: Lucille Sylvester <lsylvest@codeaurora.org>
msm: kgsl: Bump up the GPU frequency for long batch processing

Compute workloads run without kernel interaction for long periods
of time.  If one is identified early, increase the frequency to
finish it as fast as possible, rather than waiting for the standard
algorithm to do so.

Change-Id: I213ccabfae5e1000cdc34bc1d92bdc3bad86383d
CRs-Fixed: 441847
Signed-off-by: Lucille Sylvester <lsylvest@codeaurora.org>
(cherry picked from commit 14c9cd845d6a93d7ab91fffa90fa316aebb18942)
CVE-2013-2595: Untrested memory mapping in camera driver

The camera driver provides several interfaces to user space
clients. The user space clients communicate to the kernel via
syscalls such as ioctl or mmap. The camera driver provides an
uncontrolled mmap interface that allows an application with
access to the device file to map physical memory exceeding the
camera driver.s memory into user space. A locally installed,
unprivileged application can use this flaw to escalate privileges.

Code to handle MSM_CAM_IOCTL_SET_MEM_MAP_INFO IOCTL and associated
code was removed, as it is obsolete.

See:

https://www.codeaurora.org/projects/security-advisories/security-advisory-cve-2013-2595
Modification:CVE-2013-2094
net: wireless: enable HTC beacon functions only for BCMDHD_4334
Disable perflock and HTC PNP manager