msm:camera: Fix signedness issue in hw_exec_cmds

  In hw_exec_cmds()second argument m_cmds should be
  of type unsigned interger

Change-Id: Idad2eb1a59481f3fe9f90221ff2061e8dae57013
CRs-Fixed: 493314
Signed-off-by: Monika Alekhya <malekh@codeaurora.org>
msm: display: system jittering

1. When wait for vsync times out, disable sw frc.
2. Unlock mutex when waiting for gfx fence.
3. Reduce fence log number and add delay when print out.

Change-Id: Ie3acb533dd8e2939efc732a58edb1308161e34a1
Signed-off-by: Ken Zhang <kenz@codeaurora.org>
msm: camera: prevent invalid access through mmap

Disable access to invalid addresses through mmap.
Add appropriate range checks to ensure valid accesses
through framebuffer mmap. This prevents illegal
access into memory.

Change-Id: Ie053d9d8efe951b88f28b020dd9c2356e54723a7
CRs-Fixed: 475794
Signed-off-by: Manoj Rao <manojraj@codeaurora.org>
msm: vidc: Check validity of userspace address

Before writing to a userspace address, verification
of the validity of user space address is required.

Change-Id: I9141e44a6c11aaf3f4d57c08bb0dd26a7b214f34
CRs-fixed: 556356
Signed-off-by: Deepak Verma <dverma@codeaurora.org>
Merge "msm: display: system jittering"
Merge "msm: camera: prevent invalid access through mmap"
ARM: 7809/1: perf: fix event validation for software group leaders

It is possible to construct an event group with a software event as a
group leader and then subsequently add a hardware event to the group.
This results in the event group being validated by adding all members
of the group to a fake PMU and attempting to allocate each event on
their respective PMU.

Unfortunately, for software events wthout a corresponding arm_pmu, this
results in a kernel crash attempting to dereference the ->get_event_idx
function pointer.

This patch fixes the problem by checking explicitly for software events
and ignoring those in event validation (since they can always be
scheduled). We will probably want to revisit this for 3.12, since the
validation checks don't appear to work correctly when dealing with
multiple hardware PMUs anyway.

Change-Id: Ic1722ba7463c9836f1ff595d7e8da1d0fc0e32b0
Cc: <stable@vger.kernel.org>
Reported-by: Vince Weaver <vincent.weaver@maine.edu>
Tested-by: Vince Weaver <vincent.weaver@maine.edu>
Tested-by: Mark Rutland <mark.rutland@arm.com>
Signed-off-by: Will Deacon <will.deacon@arm.com>
Signed-off-by: Russell King <rmk+kernel@arm.linux.org.uk>
Git-commit: c95eb3184ea1a3a2551df57190c81da695e2144b
Git-repo: git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
[joonwoop@codeaurora.org: fixed merge conflict]
CRs-fixed: 529735
Signed-off-by: Joonwoo Park <joonwoop@codeaurora.org>
msm: vidc: Initialize kernel space stack variables

This change initializes kernel space stack variables
that are passed between kernel space and user space
using ioctls.
Non initialization of these variables may lead to
leakage of memory values from the kernel stack to
user space.

Change-Id: Icb195470545ee48b55671ac09798610178e833e1
CRs-fixed: 556771,563420
Signed-off-by: Deepak Verma <dverma@codeaurora.org>
Merge "msm: vidc: Check validity of userspace address"
ARM: 7735/2: Preserve the user r/w register TPIDRURW on context switch and fork

Since commit 6a1c53124aa1 the user writeable TLS register was zeroed to
prevent it from being used as a covert channel between two tasks.

There are more and more applications coming to Windows RT,
Wine could support them, but mostly they expect to have
the thread environment block (TEB) in TPIDRURW.

This patch preserves that register per thread instead of clearing it.
Unlike the TPIDRURO, which is already switched, the TPIDRURW
can be updated from userspace so needs careful treatment in the case that we
modify TPIDRURW and call fork(). To avoid this we must always read
TPIDRURW in copy_thread.

Change-Id: Ib1e25be7b9faa846ba5335aad2574e21a1246066
Signed-off-by: André Hentschel <nerv@dawncrow.de>
Signed-off-by: Will Deacon <will.deacon@arm.com>
Signed-off-by: Jonathan Austin <jonathan.austin@arm.com>
Signed-off-by: Russell King <rmk+kernel@arm.linux.org.uk>
Git-commit: a4780adeefd042482f624f5e0d577bf9cdcbb760
Git-repo: git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
[joonwoop@codeaurora.org: fixed merge conflict]
CRs-fixed: 561044
Signed-off-by: Joonwoo Park <joonwoop@codeaurora.org>
ARM: poison the vectors page

Fill the empty regions of the vectors page with an exception generating
instruction.  This ensures that any inappropriate branch to the vector
page is appropriately trapped, rather than just encountering some code
to execute.  (The vectors page was filled with zero before, which
corresponds with the "andeq r0, r0, r0" instruction - a no-op.)

Change-Id: I74c0105a2bcb3b78d9fc8b105a05c0fc269ba400
Cc: <stable@vger.kernel.org>
Acked-by Nicolas Pitre <nico@linaro.org>
Signed-off-by: Russell King <rmk+kernel@arm.linux.org.uk>
Git-commit: f928d4f2a86f46b030fa0850385b4391fc2b5918
Git-repo: git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
CRs-fixed: 561044
Signed-off-by: Joonwoo Park <joonwoop@codeaurora.org>
ARM: poison memory between kuser helpers

Poison the memory between each kuser helper.  This ensures that any
branch between the kuser helpers will be appropriately trapped.

Change-Id: Ifa4abe51d3dd89a96670a8609cd472fa03988e7e
Cc: <stable@vger.kernel.org>
Acked-by: Nicolas Pitre <nico@linaro.org>
Signed-off-by: Russell King <rmk+kernel@arm.linux.org.uk>
Git-commit: 5b43e7a383d69381ffe53423e46dd0fafae07da3
Git-repo: git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
CRs-fixed: 561044
Signed-off-by: Joonwoo Park <joonwoop@codeaurora.org>
Merge "ARM: 7809/1: perf: fix event validation for software group leaders"
Merge "ARM: 7735/2: Preserve the user r/w register TPIDRURW on context switch and fork"
Merge "ARM: poison the vectors page"
Merge "ARM: poison memory between kuser helpers"
msm: fb: Fix security bugs in msmfb_notify_update & msm_fb_ioctl.

msmfb_notify_update: Correct signature of msmfb_notify_update from
the ioctl declaration.

msm_fb_ioctl: Add appropriate null check for mfd data structure
before accessing it's members. This prevents null pointer accesses
in the driver.

CRs-Fixed: 526286
Change-Id: I731018057214fb0fa58c7617934100d2425617f8
Signed-off-by: Neti, Ravi Kumar <ravineti@codeaurora.org>

Conflicts:

	drivers/video/msm/msm_fb.c

Signed-off-by: Abhinav Gurram <c_abhina@codeaurora.org>
Merge "msm:camera: Fix signedness issue in hw_exec_cmds"
Merge "msm: vidc: Initialize kernel space stack variables"
Merge "msm: fb: Fix security bugs in msmfb_notify_update & msm_fb_ioctl."