mdss: mdp: Fix check to identify if dsi short read

The short response can be <=2 bytes.

Change-Id: Iad322bc892ea29b2acf220ef579d18dea1a91c32
Signed-off-by: Terence Hampson <thampson@codeaurora.org>
msm: mdss: Clear the previous state of pipe during SOLID_FILL

Clear the previous state of pipe when it is being used in SOLID_FILL
operation to prevent wrong register configuration. For ex: Use case
when DMA pipe was used in BLOCK mode in previous frame, then it is
being used in LINE mode for SOLID_FILL operation in current frame.

CRs-Fixed: 655993
Change-Id: I0ed257276428b96c10a92457a16df4dfdc42c1f8
Signed-off-by: Sushil Chauhan <sushilchauhan@codeaurora.org>
msm: mdss: set pipe to solid fill when releasing it

There are cases where pipe can remain active for additional vsync after
unstaging from mixer, if this ever happens it will keep fetching from
memory. In order to avoid this, we can setup the pipe in solid fill mode
so there is no memory access after pipe is released by software and
avoid potential iommu page fault or underrun since pipe is no longer
considered for bandwidth calculations.

Change-Id: I4b5a5deda8c854c504ef523df434509fa5567186
Signed-off-by: Adrian Salido-Moreno <adrianm@codeaurora.org>
msm: display: reduce display commit prepare waiting time

Unblock overlay_set, prepare and buffer sync ioctls when
commit thread finishes hardware programming.
Use wait_for_kickoff nstead of pan_idle for these ioctls.

Change-Id: Iefb6cbc390d2130926fdcb93688b4d92bfb26937
Signed-off-by: Ken Zhang <kenz@codeaurora.org>
Signed-off-by: Neti Ravi Kumar <ravineti@codeaurora.org>
msm: display: only release kickoff when no cleanup pipe

If there is some pipe to clean up, need wait for it be done to
make sure the pipe can be used for the second cycle and recover
mode can be executed.

Change-Id: Ifb3fdb152bc4bbf367b3d272aa0c88b1a0650c19
Signed-off-by: Ken Zhang <kenz@codeaurora.org>
Signed-off-by: Neti Ravi Kumar <ravineti@codeaurora.org>
Signed-off-by: Jayant Shekhar <jshekhar@codeaurora.org>
power: qpnp-charger: add support for external current sensing OVP

On some MSM8x26 platforms, board configurations exist which utilize
a current sensing OVP to allow adaptive input current limiting
to accurately measure the current flow through the external parallel
USB path.

Add support for this external OVP part by allowing an MPP to be
configured as a sense line and exposing the converted current
reading via a module parameter which is accessible to userspace.

CRs-Fixed: 651261
Change-Id: Idb47430476c1c19f58a4836a15841b95187baf77
Signed-off-by: David Keitel <dkeitel@codeaurora.org>
Merge "mdss: mdp: Fix check to identify if dsi short read"
msm: cpp: Provide cpp clock frequency table to user-space.

CPP clock frequency table varies form platform to platform.
It have to be read and sent to user-space for cpp dynamic
clock calculation. It is done during GET_HW_INFO IOCTL
call. In result user-space sends current cpp clock rate
and bandwidth to be set up.

Change-Id: Iaacfd4c3a93db0e5142d6df01888e9d98e9a4775
Signed-off-by: Krupal Divvela <kdivvela@codeaurora.org>
Signed-off-by: Abhinav Gurram <c_abhina@codeaurora.org>
Merge "power: qpnp-charger: add support for external current sensing OVP"
Merge "msm: cpp: Provide cpp clock frequency table to user-space."
Merge "qseecom: Add checks for user space buffer pointers"
msm_bam_rmnet: Fix potential memory corruption

Usage of legacy string manipulation function sprintf could lead to
memory corruption as the number of bytes to be written to the
destination is not bounded. Replace sprintf with snprintf where the
number of bytes to be written is explicitly specified.

CRs-fixed: 672202
Change-Id: Iab7516ad0e2540eb619fe96e26a3516c7adf86cc
Signed-off-by: Subash Abhinov Kasiviswanathan <subashab@codeaurora.org>
Merge "msm_bam_rmnet: Fix potential memory corruption"
futex-prevent-requeue-pi-on-same-futex.patch futex: Forbid uaddr == uaddr2 in futex_requeue(..., requeue_pi=1).

If uaddr == uaddr2, then we have broken the rule of only requeueing from
a non-pi futex to a pi futex with this call.  If we attempt this, then
dangling pointers may be left for rt_waiter resulting in an exploitable
condition.

This change brings futex_requeue() in line with futex_wait_requeue_pi()
which performs the same check as per commit 6f7b0a2a5c0f ("futex: Forbid
uaddr == uaddr2 in futex_wait_requeue_pi()")

[ tglx: Compare the resulting keys as well, as uaddrs might be
  	different depending on the mapping ]

Fixes CVE-2015-3153.
Reported-by: Pinkie Pie
Signed-off-by: Will Drewry <wad@chromium.org>
Signed-off-by: Kees Cook <keescook@chromium.org>
Cc: stable@vger.kernel.org
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Reviewed-by: Darren Hart <dvhart@linux.intel.com>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Divya Sharma <c_shard@codeaurora.org>
Change-Id: I9ee5c8a87cc43c7b1e1dc2796949e7c20c74ddf4
Signed-off-by: Abhinay Reddy Vanipally <avanip@codeaurora.org>
Merge "futex-prevent-requeue-pi-on-same-futex.patch futex: Forbid uaddr == uaddr2 in futex_requeue(..., requeue_pi=1)."
Merge "msm: mdss: Clear the previous state of pipe during SOLID_FILL"
Merge "msm: mdss: set pipe to solid fill when releasing it"
Merge "msm: display: reduce display commit prepare waiting time"
Merge "msm: display: only release kickoff when no cleanup pipe"