defconfig: update 05
add defconfig (ls980/vs980)
ARM: 7527/1: uaccess: explicitly check __user pointer when !CPU_USE_DOMAINS

The {get,put}_user macros don't perform range checking on the provided
__user address when !CPU_HAS_DOMAINS.

This patch reworks the out-of-line assembly accessors to check the user
address against a specified limit, returning -EFAULT if is is out of
range.

[will: changed get_user register allocation to match put_user]
[rmk: fixed building on older ARM architectures]

CRs-Fixed: 504011
Change-Id: I3818045a136fcdf72deb1371b132e090fd7ed643
Reported-by: Catalin Marinas <catalin.marinas@arm.com>
Signed-off-by: Will Deacon <will.deacon@arm.com>
Cc: stable@vger.kernel.org
Signed-off-by: Russell King <rmk+kernel@arm.linux.org.uk>
Git-commit: 8404663f81d212918ff85f493649a7991209fa04
Git-repo: git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
Signed-off-by: Laura Abbott <lauraa@codeaurora.org>
bcmdhd: Reset the hang flag after the notifications are sent
rfkill: Don't run btlock

It conflicts with userspace's invocations from bluedroid
cpufreq: ondemand: sync with caf
msm: acpuclock-krait: Work-around retention corner-case

The CPU clock source MUXes cannot switch while a CPU is in
retention, but callers of acpuclock APIs may not known that
the CPU is in retention.

Work around this problem be always performing the CPU MUX
switch on the affected CPU using smp_call_function_single()
in cases where cross-calling might otherwise be possible.
The one exception to this is during hotplug code paths,
where cross-calling is expected by design (since the target
CPU is not online and cannot be in retention).

Change-Id: I76b6de436e71da7979f30bdce841f414c26bfe44
Signed-off-by: Matt Wagantall <mattw@codeaurora.org>
ramdisk: do not start thermal-engine
dts: change back to sensor 0, sensor 5 specifically tracks cpu0.

Signed-off-by: Francisco Franco <franciscofranco.1990@gmail.com>
msm: camera: Fix for invalid kernel memory access

Adjust the length of the command based on command type
to avoid invalid memory access in ISP driver.

Change-Id: Ie1c23b45426f9598dba3ad1ee91e6598e8232134
Signed-off-by: Aditya Jonnalagadda <ajonnala@codeaurora.org>
msm:cpp: Set inst_info before send it to userspace

If IOCTL command VIDIOC_MSM_CPP_GET_INST_INFO is
called, inst_info structure must be initilaized before
it is sent to userspace.

Change-Id: I4936ae31ecd19cfd25cf22de32101fe3257889d6
Signed-off-by: Iliya Varadzhakov <ivarad@codeaurora.org>
msm: camera: To prevent the unbounded copy

To prevent the unbounded copy in EEPROM driver
to avoid kernel memory disclosure

Change-Id: Ib7f8719351ff72720c55394fdd0fcd5e876e2c09
CRs-fixed: 553389
Signed-off-by: Cherian Deepak <dcheri@codeaurora.org>
msm: camera: prevent invalid access through mmap

Disable access to invalid addresses through mmap.
Add appropriate range checks to ensure valid accesses
through framebuffer mmap. This prevents illegal
access into memory.

Change-Id: Ie053d9d8efe951b88f28b020dd9c2356e54723a7
CRs-Fixed: 475794
Signed-off-by: Manoj Rao <manojraj@codeaurora.org>
msm: cci: fix for invalid error handle

fix for invalid error handle in msm cci

Change-Id: I2610b08f4eceedfbb8bd07d8027310f43b9ee6bf
Signed-off-by: Vasko Kalanoski <vaskok@codeaurora.org>
msm: actuator: fix to prevent untrusted pointer to lead DoS

fix to prevent untrusted userspace pointer in actuator kernel
driver to lead DoS

Change-Id: I1b64270deb494530d268539e7b420be5ec79b658
Signed-off-by: Vasko Kalanoski <vaskok@codeaurora.org>
msm: camera: changed imx135 sensor clock

sensor clock changed to 24MHZ to get expected frame rate

Change-Id: If52f410d08595dda0b5cca8bebcc39f9d9e51ff5
Signed-off-by: Xu Han <hanxu@quicinc.com>
Signed-off-by: Xu Han <hanxu@codeaurora.org>
msm: cpp: Attach/detach iommu device on open/close node

Change the iommu device attachement to happen on
cpp_open_node and detachment in cpp_close_node.
It decrease the power consumption when Camera is not
working.

Change-Id: I7f8d65e14af2949d9512191459d313ac4d3fff9c
Signed-off-by: Iliya Varadzhakov <ivarad@codeaurora.org>
msm: camera: Handling get buf properly when buffer queue is empty

There can be a possibility that the buffer queue is empty and
we ask for a buffer. In that case the address holding the buffer queue
structure data is not NULL but the entries of the structure are
NULL.

In such a case in addition to checking if bufq address is NULL,
when we request for a buffer, we also make sure that handle is
not NULL.

CRs-Fixed: 533384

Change-Id: I78acdc0455cd187e709722a36d9943af0444eaee
Signed-off-by: Aditya Jonnalagadda <ajonnala@codeaurora.org>
msm: camera: Exit gracefully while camera daemon crashes

Add camera daemon shutdown handling in all camera
sub devices to exit camera gracefully and it helps
to restart camera.

Change-Id: I39643a16f100b873275efe3a0c6184fe54e52830
Signed-off-by: Suresh Vankadara <svankada@codeaurora.org>
msm: camera: increase the length of property array

Increase the length of property array as the pageen property may
be longer than 12.

Change-Id: I1b85e9b9eb01af991dd628a08ca5e334c0fdbc82
Signed-off-by: Wang Wenbin <wenbinw@codeaurora.org>