msm_fb: display: vsync driven screen update

This patch will queue multiple surfaces and commit those
surfaces into mdp at same instance so that surfaces will
be blended and displayed at same time. Hardware vsync event
is delivered to the user space frame work via uevent. Both
queue and commit are controlled by frame work and synchonized
with vsync event. Therefore frame rate will match with vsync rate.

Change-Id: If630a6d94fd38483ee313f575b1a71ed8bd65a52
Signed-off-by: Kuogee Hsieh <khsieh@codeaurora.org>

Conflicts:

	drivers/video/msm/mdp.c
	drivers/video/msm/mdp4.h
	drivers/video/msm/mdp4_overlay.c
	drivers/video/msm/mdp4_overlay_dsi_cmd.c
	drivers/video/msm/mdp4_overlay_dsi_video.c
	drivers/video/msm/mdp4_overlay_dtv.c
	drivers/video/msm/mdp4_overlay_lcdc.c
	drivers/video/msm/mdp4_util.c
	drivers/video/msm/mdp_debugfs.c
	drivers/video/msm/mipi_NT35510.c
	drivers/video/msm/mipi_dsi.c
	drivers/video/msm/mipi_dsi_host.c
	drivers/video/msm/mipi_orise.c
	drivers/video/msm/mipi_simulator.c
	drivers/video/msm/mipi_tc358764_dsi2lvds.c
	drivers/video/msm/mipi_truly.c
	drivers/video/msm/mipi_truly_tft540960_1_e.c
	drivers/video/msm/msm_fb.c
	include/linux/msm_mdp.h
msm_fb: display: Create sysfs entries in mdp_probe for MDP3 targets

This is a combination of 2 commits.

msm_fb: display: Create sysfs entries in mdp_probe for MDP3 targets

vsync sysfs entries should be created in mdp_probe instead of
creating in panel on. This avoids waiting for the first event
control in framework

Change-Id: I18b05b8d2a65d489afc6e3274ec8dc7a5b9a5f9a
Signed-off-by: Mayank Chopra <makchopra@codeaurora.org>

Conflicts:

	drivers/video/msm/mdp.c
	drivers/video/msm/mdp_dma_dsi_video.c

msm_fb: display: Create sysfs entries in mdp_probe for MDP4 targets

vsync sysfs entries should be created in mdp_probe instead of
creating in panel on. This avoids waiting for the first event
control in framework

Change-Id: I983731481ea89bb7666be5f2a9f75a1e04fd963f
Signed-off-by: Mayank Chopra <makchopra@codeaurora.org>

Conflicts:

	drivers/video/msm/mdp.c
	drivers/video/msm/mdp4.h
	drivers/video/msm/mdp4_overlay_dsi_cmd.c
	drivers/video/msm/mdp4_overlay_dsi_video.c
	drivers/video/msm/mdp4_overlay_dtv.c
	drivers/video/msm/mdp4_overlay_lcdc.c
	drivers/video/msm/msm_fb.h
msm-fb: Fix sysfs node creation in mdp_probe for MDP3 targets

-vsync_init null check not required for mdp3 target before
 creating sysfs node.
-Set vsync suspend and resume flags appropriately in mdp_on
 for mdp3.

CRs-Fixed: 393243
Change-Id: I3366df7385ca8e2ae15053c3e58332f8e32ce0cd
Signed-off-by: Pawan Kumar <pavaku@codeaurora.org>
n_tty: Fix n_tty_write crash when echoing in raw mode

The tty atomic_write_lock does not provide an exclusion guarantee for
the tty driver if the termios settings are LECHO & !OPOST.  And since
it is unexpected and not allowed to call TTY buffer helpers like
tty_insert_flip_string concurrently, this may lead to crashes when
concurrect writers call pty_write. In that case the following two
writers:
* the ECHOing from a workqueue and
* pty_write from the process
race and can overflow the corresponding TTY buffer like follows.

If we look into tty_insert_flip_string_fixed_flag, there is:
  int space = __tty_buffer_request_room(port, goal, flags);
  struct tty_buffer *tb = port->buf.tail;
  ...
  memcpy(char_buf_ptr(tb, tb->used), chars, space);
  ...
  tb->used += space;

so the race of the two can result in something like this:
              A                                B
__tty_buffer_request_room
                                  __tty_buffer_request_room
memcpy(buf(tb->used), ...)
tb->used += space;
                                  memcpy(buf(tb->used), ...) ->BOOM

B's memcpy is past the tty_buffer due to the previous A's tb->used
increment.

Since the N_TTY line discipline input processing can output
concurrently with a tty write, obtain the N_TTY ldisc output_lock to
serialize echo output with normal tty writes.  This ensures the tty
buffer helper tty_insert_flip_string is not called concurrently and
everything is fine.

Note that this is nicely reproducible by an ordinary user using
forkpty and some setup around that (raw termios + ECHO). And it is
present in kernels at least after commit
d945cb9cce20ac7143c2de8d88b187f62db99bdc (pty: Rework the pty layer to
use the normal buffering logic) in 2.6.31-rc3.

js: add more info to the commit log
js: switch to bool
js: lock unconditionally
js: lock only the tty->ops->write call

Change-Id: I38bad9744ad4309cdd0f563d1fcd6ad61d9e0bbb
References: CVE-2014-0196
Reported-and-tested-by: Jiri Slaby <jslaby@suse.cz>
Signed-off-by: Peter Hurley <peter@hurleysoftware.com>
Signed-off-by: Jiri Slaby <jslaby@suse.cz>
Cc: Linus Torvalds <torvalds@linux-foundation.org>
Cc: Alan Cox <alan@lxorguk.ukuu.org.uk>
Cc: <stable@vger.kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>