msm: kgsl: Enable protected mode for A3XX

Enable protected register mode for A3XX with these commits from
msm-3.10:

msm: kgsl: Enable protected register mode for A3XX
msm: kgsl: Print the register that causes a protected mode error
msm: kgsl: Unprotect the VBIF performance counters

Change-Id: Ic0dedbad950ffbd063fd861d9440bb5dce8d5fb1
Signed-off-by: Jordan Crouse <jcrouse@codeaurora.org>
msm: kgsl: Protect SMMU registers from being written by the GPU

Put the SMMU register range in protected mode to shield them from
IB1/IB2 writes from userspace.

CRs-Fixed: 599971
Change-Id: Ic0dedbad8c03fc1c54ff73221231e2440d3c34dd
Signed-off-by: Jordan Crouse <jcrouse@codeaurora.org>
arm: msm: acpuclock-8226:  Add support for 1.1GHz for 8610

Add a new frequency table for 1.1GHz parts for speed-bin 1.

Change-Id: I4df8ae9f14e0c1444f3a96d065c93f6cfcd0243b
Signed-off-by: Taniya Das <tdas@codeaurora.org>
ARM: msm: dts: Add efuse register base for 1.1GHz

New efuse base register has been added to support new speed bin of
1.1GHz.

Change-Id: I71d278d05a0f936baa70b0f5f41da7df83910bc7
Signed-off-by: Taniya Das <tdas@codeaurora.org>
NFC: don't reparse device tree

probe function parses device tree at the begginning. device tree should not
be reparsed in the middle of the probe.  use the first parse value.

Change-Id: I6695d76c9b05ec9ba2d8f73ee0815ab86078da31
Signed-off-by: Houston Hoffman <hhoffman@codeaurora.org>
Merge "NFC: don't reparse device tree"
futex-prevent-requeue-pi-on-same-futex.patch futex: Forbid uaddr == uaddr2 in futex_requeue(..., requeue_pi=1).

If uaddr == uaddr2, then we have broken the rule of only requeueing from
a non-pi futex to a pi futex with this call.  If we attempt this, then
dangling pointers may be left for rt_waiter resulting in an exploitable
condition.

This change brings futex_requeue() in line with futex_wait_requeue_pi()
which performs the same check as per commit 6f7b0a2a5c0f ("futex: Forbid
uaddr == uaddr2 in futex_wait_requeue_pi()")

[ tglx: Compare the resulting keys as well, as uaddrs might be
  	different depending on the mapping ]

Fixes CVE-2015-3153.
Reported-by: Pinkie Pie
Signed-off-by: Will Drewry <wad@chromium.org>
Signed-off-by: Kees Cook <keescook@chromium.org>
Cc: stable@vger.kernel.org
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Reviewed-by: Darren Hart <dvhart@linux.intel.com>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Divya Sharma <c_shard@codeaurora.org>
Change-Id: I9ee5c8a87cc43c7b1e1dc2796949e7c20c74ddf4
Signed-off-by: Abhinay Reddy Vanipally <avanip@codeaurora.org>
n_tty: Fix n_tty_write crash when echoing in raw mode

The tty atomic_write_lock does not provide an exclusion guarantee for
the tty driver if the termios settings are LECHO & !OPOST. And since
it is unexpected and not allowed to call TTY buffer helpers like
tty_insert_flip_string concurrently, this may lead to crashes when
concurrect writers call pty_write. In that case the following two
writers:
* the ECHOing from a workqueue and
* pty_write from the process
race and can overflow the corresponding TTY buffer like follows.

If we look into tty_insert_flip_string_fixed_flag, there is:
  int space = __tty_buffer_request_room(port, goal, flags);
  struct tty_buffer *tb = port->buf.tail;
  ...
  memcpy(char_buf_ptr(tb, tb->used), chars, space);
  ...
  tb->used += space;

so the race of the two can result in something like this:
          A                             B
   __tty_buffer_request_room
                                  __tty_buffer_request_room
   memcpy(buf(tb->used), ...)
   tb->used += space;
                                 memcpy(buf(tb->used), ...) ->BOOM

B's memcpy is past the tty_buffer due to the previous A's tb->used
increment.

Since the N_TTY line discipline input processing can output
concurrently with a tty write, obtain the N_TTY ldisc output_lock to
serialize echo output with normal tty writes. This ensures the tty
buffer helper tty_insert_flip_string is not called concurrently and
everything is fine.

Note that this is nicely reproducible by an ordinary user using
forkpty and some setup around that (raw termios + ECHO). And it is
present in kernels at least after commit
d945cb9cce20ac7143c2de8d88b187f62db99bdc (pty: Rework the pty layer to
use the normal buffering logic) in 2.6.31-rc3.

js: add more info to the commit log
js: switch to bool
js: lock unconditionally
js: lock only the tty->ops->write call

Signed-off-by: Peter Hurley <peter@hurleysoftware.com>
Signed-off-by: Jiri Slaby <jslaby@suse.cz>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Change-Id: I9e235db6ec2bb950f26bd8a23f6145dab5dc0a15
Git-commit: 4291086b1f081b869c6d79e5b7441633dc3ace00
Git-repo: git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
Signed-off-by: Avijit Kanti Das <avijitnsec@codeaurora.org>
[rsiddoji@codeaurora.org: resolve trivial merge conflicts]
Signed-off-by: Ravi Kumar S <rsiddoji@codeaurora.org>
Merge "n_tty: Fix n_tty_write crash when echoing in raw mode"
Merge "futex-prevent-requeue-pi-on-same-futex.patch futex: Forbid uaddr == uaddr2 in futex_requeue(..., requeue_pi=1)."
Revert "NFC: don't reparse device tree"

This reverts commit b74cf3c8fb11593a0aafbddb27f14110f3bdacdf

Change-Id: I61f82c39e9ba30a398b82832141623a486487416
Revert "NFC: don't reparse device tree"

This reverts commit b74cf3c8fb11593a0aafbddb27f14110f3bdacdf

Change-Id: I4a81adebf54bf3b1182ae5a940414b1e4a758603
msm: thermal: Add support for cpu temp limit recommendation for SoC

Add support in KTM to get SoC parts info by reading appropriate
efuse bits and recommend default cpu temperature limit based on
efuse value temperature map to userspace through sysfs interface
'/sys/module/msm_thermal/default_cpu_temp_limit'. Efuse data
to be read such as address, row number, starting bit number
of the row, number of bits for identifying parts etc, default core
temperature and efuse temperature value map are read from dt.
The default cpu temperature information is exported in the format
<temperature in degree celsius>.

Change-Id: Icbf43c3fd56e95d49a886d309e613d2fe146a506
Signed-off-by: Manaf Meethalavalappu Pallikunhi <manafm@codeaurora.org>
ARM: dts: msm: Add default cpu temp limit info entry for MSM8610

Add efuse data for identifying SoC parts and cpu temperature limit
information for different parts to thermal for MSM8610.

Change-Id: I1b50280c7c8092544165b26b95e235e5571a63d3
Signed-off-by: Manaf Meethalavalappu Pallikunhi <manafm@codeaurora.org>
Merge "Revert "NFC: don't reparse device tree""
Merge "Revert "NFC: don't reparse device tree""
msm_bam_rmnet: Fix potential memory corruption.

Usage of legacy string manipulation function sprintf could lead to
memory corruption as the number of bytes to be written to the
destination is not bounded. Replace sprintf with snprintf where the
number of bytes to be written is explicitly specified.

CRs-fixed: 672202
Change-Id: Iab7516ad0e2540eb619fe96e26a3516c7adf86cc
Signed-off-by: Subash Abhinov Kasiviswanathan <subashab@codeaurora.org>
Signed-off-by: Abhinay Reddy Vanipally <avanip@codeaurora.org>
Merge "msm: kgsl: Enable protected mode for A3XX"
Merge "msm: kgsl: Protect SMMU registers from being written by the GPU"
ARM: dts: msm: set cpu_dma_latency to 701 usec

Vote for 701 usec so as to allow the core to go to
stand-alone power collapse.

CRs-fixed: 636365
Change-Id: I456aa4936b2a8104f2146786fa819839500d73b7
Signed-off-by: Asutosh Das <asutoshd@codeaurora.org>