msm: display pr_mem logging macro

mdp log macro:
When d/mdp/en_kmsg is 1, pr_mem will output to a ring buffer,
user can retrieve it from /d/mdp/kmsg.
When d/mdp/en_kmsg is 2, pr_mem works as pr_err.
By default, en_kmsg is 0, pr_mem does nothing.

Change-Id: I82fe3f66015d0dc1ac35f14c90f3ec2923f3832e
Signed-off-by: Ken Zhang <kenz@codeaurora.org>
msm: display: frc cadence support

Frame rate conversion support. Support 2:3 and 2:2 pull down cases.
Only enable one video clip whose output size is over half of the
screen.

Change-Id: I6c81ed0074f8c3ec7e20a4bb55a8441aa2610d2c
Signed-off-by: Ken Zhang <kenz@codeaurora.org>
msm-camera: Added the  NULL check in gemini driver.

Adding NULL check for ionhandle and y_off in gemini driver files.

CRs-Fixed: 504159

Change-Id: I6d20298183bec0c3c2c16088a936ac6f7d307da4
Signed-off-by: Katta Santhisindhu <kattas@codeaurora.org>
sock_diag: Fix out-of-bounds access to sock_diag_handlers[]

Userland can send a netlink message requesting SOCK_DIAG_BY_FAMILY
with a family greater or equal then AF_MAX -- the array size of
sock_diag_handlers[]. The current code does not test for this
condition therefore is vulnerable to an out-of-bound access opening
doors for a privilege escalation.

CRs-fixed: 519050
Change-Id: I1466c4f56f3f4df90cf8a1ae17afa80c89b813e8
Git-repo: git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
Git-commit: 6e601a53566d84e1ffd25e7b6fe0b6894ffd79c0
Signed-off-by: Mathias Krause <minipli@googlemail.com>
Acked-by: Eric Dumazet <edumazet@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sarang Joshi <spjoshi@codeaurora.org>
diag: Fix race condition in diagchar driver

diag driver maintains socket logging process in global driver
structure which is manipulated in switch_logging and in close
file_operation.
There is a possibility of race while clearing the socket logging
process in close operation and sending signal in switch_logging
operation. Adding lock to serialize the two operations.

CRs-Fixed: 495063
Change-Id: I0064509c9ace18a8ff40c5a744363546a9021612
Signed-off-by: Ashay Jaiswal <ashayj@codeaurora.org>
Signed-off-by: Sridhar Gujje <sgujje@codeaurora.org>
msm_fb: display: delay commit video tile frame size register

Video tile frame size register is NOT double buffered.
when this register updated, it kicks in immediatly.
During transition from smaller resolution to higher
resolution  it may have possibility that mdp still fetch
from smaller resolution buffer with new higher resolution
frame size. This will cause iommu page fault. This patch
delay commit frame size register until next frame update
if it is necessary.

CRs-fixed: 450126, 461598
Change-Id: I0339100b8b2d76adf2b4b4206d1942effae55e0a
Signed-off-by: Kuogee Hsieh <khsieh@codeaurora.org>
Merge "msm: display pr_mem logging macro"
Merge "msm: display: frc cadence support"
msm: vidc: Validate input data before processing

User controlled data needs to be validated before
processing, otherwise it may corrupt existing data
and other programming variables which may further
lead to crash in kernel space.
This change validates user specified buffer's data,
such as offset and data length, before performing
any operations in kernel.

Change-Id: I841cacd79368046964eec311750b09286e01af98
Signed-off-by: Deepak Verma <dverma@codeaurora.org>
Merge "msm: vidc: Validate input data before processing"
Implements PCIe Power Management feature.
PCIe subsystem can successfully enter and exit suspend.

PCIe votes for 0.5V during sleep to allow vdd minimization.

Change-Id: If41d065c21f480ce282dfbb4dde84d248f0ed926
Signed-off-by: Siva Yarravarapu <sivay@codeaurora.org>
Merge "Implements PCIe Power Management feature. PCIe subsystem can successfully enter and exit suspend."
msm: footswitch: Add vcap core reset

Adding the vcap core reset and release reset functionality
to vcap footswitch enable sequence. And also setting
the smmu_ahb_reset bit for the vcap_ahb_clk  reset.

Change-Id: Ica0fc4514109c1cdeb0d7d96bb4065e4d53b5055
Signed-off-by: Hanumath Prasad <hpprasad@codeaurora.org>
Merge "msm: footswitch: Add vcap core reset"
Merge "msm_fb: display: delay commit video tile frame size register"
 msm:camera: Fix overflow issue in ioctl_hw_cmds function

    'len' is of type signed int 32bit,but the assigned value
    may exceed maximum unsigned int32 range.Add overflow check
    and graceful exit if 'm'exceeds UINT32_MAX value.

Change-Id: I38f0d10a0cb44d08d0054f91044fc891c246ebd1
CRs-Fixed: 493314
Signed-off-by: Monika Alekhya <malekh@codeaurora.org>
msm:camera: Fix signedness issue in hw_exec_cmds

  In hw_exec_cmds()second argument m_cmds should be
  of type unsigned interger

Change-Id: Idad2eb1a59481f3fe9f90221ff2061e8dae57013
CRs-Fixed: 493314
Signed-off-by: Monika Alekhya <malekh@codeaurora.org>
mm-camera: Changes to remove unused code for security issue reported

Changes to remove MSM_CAM_IOCTL_SET_MEM_MAP_INFO Ioctl support.
This will avoid physical memory mapping to userspace.

Change-Id: If014e6d152786b508c8e7ee6c53631913cd4cfcf
Signed-off-by: Guruprasad Gaonkar <ggaonk@codeaurora.org>
Merge "mm-camera: Changes to remove unused code for security issue reported"
msm-camera: fix to prevent untrusted pointer to lead DoS in Actuator

fix to prevent untrusted userspace pointer in actuator kernel
driver to lead DoS in actuator driver

Change-Id: Ic0bfddfcb1f10cd4f21e983217f10f2037a1f909
CRs-Fixed: 547231
Signed-off-by:Vivek Singh<vising@codeaurora.org>