Promotion of lk.lnx.1.0-00035.

CRs      Change ID                                   Subject
--------------------------------------------------------------------------------------------------------------
974677   I7e1b1d65bc8ec0278e81091b170c40eb12cf6ce7   dev: gcdb: display: add support for Sharp 4k dsc video p
971322   If03cc9f9442482d0778cebd5e575e44e963a09ca   platform: msm_shared: set long press time to 500ms
975706   Ifc854153755c86250d88ac614f6f6be711e8c590   platform: msm-shared: Erase the correct block when inval
974677   Ic47acb1cd22da7e149827fe7f2a9812ce00b2ee1   dev: gcdb: display: add support for Sharp 4k dsc cmd pan
948243   I450db51ce8279d2bb17c7f75930ff135f647b5ea   platform: msm_shared: add integer overflow checks
973910   Ib787fc3f69474284b9480557feab2e64b0423db4   dev: gcdb: display: update the supported fps values for

Change-Id: If3e2f8b67f35763e3c7e2bd50b88e5aebbe3ad56
CRs-Fixed: 948243, 975706, 971322, 974677, 973910
diff --git a/dev/gcdb/display/fastboot_oem_display.h b/dev/gcdb/display/fastboot_oem_display.h
index 26873ed..aaccf0e 100644
--- a/dev/gcdb/display/fastboot_oem_display.h
+++ b/dev/gcdb/display/fastboot_oem_display.h
@@ -1,4 +1,4 @@
-/* Copyright (c) 2013-2015, The Linux Foundation. All rights reserved.
+/* Copyright (c) 2013-2016, The Linux Foundation. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -94,6 +94,8 @@
 	{"r63417_1080p_video", "qcom,mdss_dsi_r63417_1080p_video", false},
 	{"samsung_wxga_video", "qcom,mdss_dsi_samsung_wxga_video", false},
 	{"sharp_1080p_cmd", "qcom,mdss_dsi_sharp_1080p_cmd", false},
+	{"sharp_4k_dsc_video", "qcom,mdss_dsi_sharp_4k_dsc_video", true},
+	{"sharp_4k_dsc_cmd", "qcom,mdss_dsi_sharp_4k_dsc_cmd", true},
 	{"sharp_qhd_video", "qcom,mdss_dsi_sharp_qhd_video", false},
 	{"sharp_wqxga_dualdsi_video", "qcom,mdss_dsi_sharp_wqxga_video", true},
 	{"ssd2080m_720p_video", "qcom,mdss_dsi_ssd2080m_720p_video", false},
diff --git a/dev/gcdb/display/include/panel_truly_1080p_video.h b/dev/gcdb/display/include/panel_truly_1080p_video.h
index 9b8a52b..46417c6 100755
--- a/dev/gcdb/display/include/panel_truly_1080p_video.h
+++ b/dev/gcdb/display/include/panel_truly_1080p_video.h
@@ -302,7 +302,7 @@
 /* Dynamic fps supported frequencies by panel                                */
 /*---------------------------------------------------------------------------*/
 static const struct dfps_panel_info truly_1080p_video_dfps = {
-	1, 3, {48, 54, 60}
+	1, 10, {48, 49, 50, 51, 52, 54, 56, 57, 58, 60}
 };
 
 /*---------------------------------------------------------------------------*/
diff --git a/platform/msm_shared/boot_verifier.c b/platform/msm_shared/boot_verifier.c
index 941bdaf..9c80839 100644
--- a/platform/msm_shared/boot_verifier.c
+++ b/platform/msm_shared/boot_verifier.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2014-2015, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2014-2016, The Linux Foundation. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions are
@@ -418,6 +418,18 @@
 			// Send hash of key from OEM KEYSTORE + Boot device state
 			n = BN_num_bytes(oem_keystore->mykeybag->mykey->key_material->n);
 			e = BN_num_bytes(oem_keystore->mykeybag->mykey->key_material->e);
+			/*this assumes a valid acceptable range for RSA, including 4096 bits of modulo n. */
+			if (n<0 || n>1024)
+			{
+				dprintf(CRITICAL, "Invalid n value from key_material\n");
+				ASSERT(0);
+			}
+			/* e can assumes 3,5,17,257,65537 as valid values, which should be 1 byte long only, we accept 2 bytes or 16 bits long */
+			if( e < 0 || e >16)
+			{
+				dprintf(CRITICAL, "Invalid e value from key_material\n");
+				ASSERT(0);
+			}
 			len_oem_rsa = n + e;
 			if(!(input = malloc(len_oem_rsa)))
 			{
@@ -440,6 +452,18 @@
 			// Send hash of key from certificate in boot image + boot device state
 			n = BN_num_bytes(rsa_from_cert->n);
 			e = BN_num_bytes(rsa_from_cert->e);
+			/*this assumes a valid acceptable range for RSA, including 4096 bits of modulo n. */
+			if (n<0 || n>1024)
+			{
+				dprintf(CRITICAL, "Invalid n value from rsa_from_cert\n");
+				ASSERT(0);
+			}
+			/* e can assumes 3,5,17,257,65537 as valid values, which should be 1 byte long only, we accept 2 bytes or 16 bits long */
+			if( e < 0 || e >16)
+			{
+				dprintf(CRITICAL, "Invalid e value from rsa_from_cert\n");
+				ASSERT(0);
+			}
 			len_from_cert = n + e;
 			if(!(input = malloc(len_from_cert)))
 			{
diff --git a/platform/msm_shared/flash-ubi.c b/platform/msm_shared/flash-ubi.c
index d9c5cc0..010f61e 100644
--- a/platform/msm_shared/flash-ubi.c
+++ b/platform/msm_shared/flash-ubi.c
@@ -816,7 +816,8 @@
 	int num_pages;
 	int ret;
 	int bad_blocks_cnt = 0;
-	int fmsb_peb = 0;
+	uint32_t fmsb_peb = UINT_MAX;
+	int is_fmsb_peb_valid = 0;
 
 	si = scan_partition(ptn);
 	if (!si) {
@@ -867,8 +868,10 @@
 		else
 			size -= block_size;
 
-		if (fastmap_present(img_peb))
+		if (fastmap_present(img_peb)) {
 			fmsb_peb = curr_peb;
+			is_fmsb_peb_valid = 1;
+		}
 		img_peb += flash_block_size();
 		curr_peb++;
 	}
@@ -891,9 +894,10 @@
 	 * we need to invalidate the flashed fastmap since it isn't accurate
 	 * anymore.
 	 */
-	if (bad_blocks_cnt && fmsb_peb) {
-		dprintf(CRITICAL, "flash_ubi_img: invalidate fmsb\n");
-		ret = ubi_erase_peb(ptn->start + 2, si, ptn->start);
+	if (bad_blocks_cnt && (is_fmsb_peb_valid == 1)) {
+		dprintf(CRITICAL, "flash_ubi_img: invalidate fmsb (fmsb_peb = %u)\n",
+			fmsb_peb);
+		ret = ubi_erase_peb(fmsb_peb, si, ptn->start);
 	}
 
 out:
diff --git a/platform/msm_shared/shutdown_detect.c b/platform/msm_shared/shutdown_detect.c
index 9bde63d..d574b8d 100644
--- a/platform/msm_shared/shutdown_detect.c
+++ b/platform/msm_shared/shutdown_detect.c
@@ -1,4 +1,4 @@
-/* Copyright (c) 2014-2015, The Linux Foundation. All rights reserved.
+/* Copyright (c) 2014-2016, The Linux Foundation. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions are
@@ -38,9 +38,12 @@
 #include <platform.h>
 #include <target.h>
 
-/* sleep clock is 32.768 khz, 0x8000 count per second */
+/*
+ * Sleep clock is 32.768 khz, 0x8000 count per second.
+ * Set long press wait time to 500ms to benefit boot time.
+ */
 #define MPM_SLEEP_TIMETICK_COUNT    0x8000
-#define PWRKEY_LONG_PRESS_COUNT     0xC000
+#define PWRKEY_LONG_PRESS_COUNT     0x4000
 #define QPNP_DEFAULT_TIMEOUT        250
 #define PWRKEY_DETECT_FREQUENCY     50