netlink: fix possible spoofing from non-root processes

Non-root user-space processes can send Netlink messages to other
processes that are well-known for being subscribed to Netlink
asynchronous notifications. This allows ilegitimate non-root
process to send forged messages to Netlink subscribers.

The userspace process usually verifies the legitimate origin in
two ways:

a) Socket credentials. If UID != 0, then the message comes from
   some ilegitimate process and the message needs to be dropped.

b) Netlink portID. In general, portID == 0 means that the origin
   of the messages comes from the kernel. Thus, discarding any
   message not coming from the kernel.

However, ctnetlink sets the portID in event messages that has
been triggered by some user-space process, eg. conntrack utility.
So other processes subscribed to ctnetlink events, eg. conntrackd,
know that the event was triggered by some user-space action.

Neither of the two ways to discard ilegitimate messages coming
from non-root processes can help for ctnetlink.

This patch adds capability validation in case that dst_pid is set
in netlink_sendmsg(). This approach is aggressive since existing
applications using any Netlink bus to deliver messages between
two user-space processes will break. Note that the exception is
NETLINK_USERSOCK, since it is reserved for netlink-to-netlink
userspace communication.

Still, if anyone wants that his Netlink bus allows netlink-to-netlink
userspace, then they can set NL_NONROOT_SEND. However, by default,
I don't think it makes sense to allow to use NETLINK_ROUTE to
communicate two processes that are sending no matter what information
that is not related to link/neighbouring/routing. They should be using
NETLINK_USERSOCK instead for that.

Change-Id: I6382c2ecf3dc9ada1f6b7298ebb8bd08453d3a28
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
qseecom: Add support to handle multiple app load & unload

Media server is associated with multiple apps on TZ-side.
Unloading a single app for clean up is not enought. QSEECOM
needs to handle the app load & unload of multiple apps
associated with the client. During app_load & app_unload
along with app_id, app_name should also be checked. Besides,
keymaster will not be unloaded and app search execution
during app unload is optimized.

Change-Id: Ie92e97b9154851b713a8c3394b8ed10fdbdebd2f
Signed-off-by: Zhen Kong <zkong@codeaurora.org>
Signed-off-by: William Clark <wclark@codeaurora.org>
qseecom: change the number of bytes to compare app names

keymaster app has two names with different length: "keymaster" and
"keymaste". To compare the app names correctly, the shorter name
length is choosen for memcmp in __qseecom_send_cmd.

Change-Id: I5f0dff7f9756362be40cc64985b65bc2268d734f
Signed-off-by: Zhen Kong <zkong@codeaurora.org>
Signed-off-by: William Clark <wclark@codeaurora.org>
rtc: alarm: set power_on_alarm again when calling alarm_resume

The power_on alarm might be replaced or cleared during alarm
suspend and resume process.So restore the power_on alarm into RTC
during alarm resume.

Change-Id: I1eefb082f9dfbd78517f3da1cc60a989853555fd
Signed-off-by: Mao Jinlong <c_jmao@codeaurora.org>
ARM: Fix undefined instruction exception handling

While trying to get a v3.5 kernel booted on the cubox, I noticed that
VFP does not work correctly with VFP bounce handling.  This is because
of the confusion over 16-bit vs 32-bit instructions, and where PC is
supposed to point to.

The rule is that FP handlers are entered with regs->ARM_pc pointing at
the _next_ instruction to be executed.  However, if the exception is
not handled, regs->ARM_pc points at the faulting instruction.

This is easy for ARM mode, because we know that the next instruction and
previous instructions are separated by four bytes.  This is not true of
Thumb2 though.

Since all FP instructions are 32-bit in Thumb2, it makes things easy.
We just need to select the appropriate adjustment.  Do this by moving
the adjustment out of do_undefinstr() into the assembly code, as only
the assembly code knows whether it's dealing with a 32-bit or 16-bit
instruction.

Cc: <stable@vger.kernel.org>
Acked-by: Will Deacon <will.deacon@arm.com>
Signed-off-by: Russell King <rmk+kernel@arm.linux.org.uk>

ARM: 8036/1: Enable IRQs before attempting to read user space in __und_usr

The Undef abort handler in the kernel reads the undefined instruction
from user space. If the page table was modified from another CPU, the
user access could fail and do_page_fault() will be executed with
interrupts disabled. This can potentially deadlock on ARM11MPCore or on
Cortex-A15 with erratum 798181 workaround enabled (both implying IPI for
TLB maintenance with page table lock held).

This patch enables the IRQs in __und_usr before attempting to read the
instruction from user space.

CRs-Fixed: 685372
Signed-off-by: Catalin Marinas <catalin.marinas@arm.com>
Tested-by: Arun KS <getarunks@gmail.com>
Cc: Hartley Sweeten <hsweeten@visionengravers.com>
Cc: Ryan Mallon <rmallon@gmail.com>
Signed-off-by: Russell King <rmk+kernel@arm.linux.org.uk>
Git-commit: 1417a6b8dc4db73055be9a3aa288b050e9dc06ab
Git-repo: git://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git
Signed-off-by: Kishan Kumar <kishank@codeaurora.org>

ARM: 7526/1: traps: send SIGILL if get_user fails on undef handling path

get_user may fail to load from the provided __user address due to an
unhandled fault generated by the access.

In the case of the undefined instruction trap, this results in failure
to load the faulting instruction, in which case we should send SIGILL to
the task rather than continue with potentially uninitialised data.

Signed-off-by: Will Deacon <will.deacon@arm.com>
Cc: stable@vger.kernel.org
Signed-off-by: Russell King <rmk+kernel@arm.linux.org.uk>

Conflicts:
	arch/arm/kernel/traps.c

ARM: fix "bad mode in ... handler" message for undefined instructions

commit 29c350bf28da333e41e30497b649fe335712a2ab upstream.

The array was missing the final entry for the undefined instruction
exception handler; this commit adds it.

Signed-off-by: Russell King <rmk+kernel@arm.linux.org.uk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

Conflicts:
	arch/arm/kernel/traps.c

ARM: 7553/1: proc-v7: Ensure correct instruction set after cpu_reset

Because mov pc,<Rn> never switches instruction set when executed in
Thumb code, Thumb-2 kernels will silently execute the target code
after cpu_reset as Thumb code, even if the passed code pointer
denotes ARM (bit 0 clear).

This patch uses bx instead, ensuring the correct instruction set
for the target code.

Thumb code in the kernel is not supported prior to ARMv7, so other
CPUs are not affected.

Change-Id: I7beb234e130f41aece0e11b8f6cca66b8168a64b
Signed-off-by: Dave Martin <dave.martin@linaro.org>
Acked-by: Will Deacon <will.deacon@arm.com>
Acked-by: Nicolas Pitre <nico@linaro.org>
Signed-off-by: Russell King <rmk+kernel@arm.linux.org.uk>
sched: Fix migration thread runtime bogosity

commit 8f6189684eb4e85e6c593cd710693f09c944450a upstream.

Make stop scheduler class do the same accounting as other classes,

Migration threads can be caught in the act while doing exec balancing,
leading to the below due to use of unmaintained ->se.exec_start.  The
load that triggered this particular instance was an apparently out of
control heavily threaded application that does system monitoring in
what equated to an exec bomb, with one of the VERY frequently migrated
tasks being ps.

%CPU   PID USER     CMD
99.3    45 root     [migration/10]
97.7    53 root     [migration/12]
97.0    57 root     [migration/13]
90.1    49 root     [migration/11]
89.6    65 root     [migration/15]
88.7    17 root     [migration/3]
80.4    37 root     [migration/8]
78.1    41 root     [migration/9]
44.2    13 root     [migration/2]

Change-Id: I76222355ff43fcef272642722d04b8882f5e506b
Signed-off-by: Mike Galbraith <mgalbraith@suse.de>
Signed-off-by: Peter Zijlstra <a.p.zijlstra@chello.nl>
Link: http://lkml.kernel.org/r/1344051854.6739.19.camel@marge.simpson.net
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Cc: Steven Rostedt <rostedt@goodmis.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
msm: mdss: Prevent modification to image roi when scaling

If pixel extension is enabled by scaler, and layer content is
deinterlaced, the modifications to the layers region of interest
to be used by mdp hw has already been modified. We should not
further changing these values.

Change-Id: I2c528b54ce07e90b66b56ef008b73b78e4227c9d
Signed-off-by: Terence Hampson <thampson@codeaurora.org>
msm: kgsl: Fixup the idle_timer save/store functions

Use standard kernel functions to convert between jiffies and
milliseconds.

Change-Id: Ic0dedbad8244518ec77024aaae170736dec9b93a
Signed-off-by: Jordan Crouse <jcrouse@codeaurora.org>

msm: kgsl: Streamline power level changes

Gather all power level restrictions in one place.  Make as
few paths through power level changes as possible.

Change-Id: I672fea958e965d6b65b697f16829553f4e8a99fd
Signed-off-by: Lucille Sylvester <lsylvest@codeaurora.org>

msm: kgsl: Enable frequency cycling for thermal mitigation

Allow thermal mitigation to select effective GPU frequencies
between the supported frequencies.  This gives more flexiblity
in the thermal performance limitations.

Change-Id: I618da263b02f09f293d737a13de567a3c31b37f0
Signed-off-by: Lucille Sylvester <lsylvest@codeaurora.org>

msm: kgsl: Skip dispatcher mutex owner check

Skip dispatcher mutex owner checking in adreno_idle
when we know that current thread doesn't own it.

Change-Id: I4e9afa104884a1a0505582058829b7bb780d33cf
Signed-off-by: Rajesh Kemisetti <rajeshk@codeaurora.org>

msm: kgsl: Support offset and size for cache operations

Currently, IOCTL_KGSL_GPUMEM_SYNC_CACHE performs cache
operations on the entire memdesc. This change adds
support for performing the cache operation on a range
of memory defined by an offset and size

Change-Id: Icd8bf6f5a5c1a0335c6d278b950e19bdda0c95f6
Signed-off-by: Sushmita Susheelendra <ssusheel@codeaurora.org>

msm: kgsl: Restrict GPU memory object alignment to 32MB

The code was being very generous in giving the user the ability to
align GPU objects on 4GB boundaries. Cut the restriction down to
32MB which is still pretty generous but within the realm of
possiblity (especially for a 32 bit GPU).  While we are at it fix
a bug in the page_alloc code that was accidently resetting the
alignment to the alloc page size.  The alignment cannot be _less_
than the max page_alloc size but there certainly isn't any reason
why you couldn't specify a larger alignment if you so wished.

Change-Id: Ic0dedbadebd4c6fd98e3bf2f3d6d5bb924223157
Signed-off-by: Jordan Crouse <jcrouse@codeaurora.org>

msm: kgsl: Split out adreno_idle into a lighter weight function

In most cases idling the GPU is a heavy weight operation: stop the
dispatcher, wait for the hardware, deal with faults, etc. The idle
following ME_INIT is not one of those cases. The init sequence
is a controlled operation with a stopped dispatcher so we can forgo
the heavier bits of adreno_idle(). Break out the idle loop
and turn it into adreno_spin_idle() for use by both adreno_idle()
and ringbuffer init.

Change-Id: Ic0dedbad870ea65cc78d2a45d90ed895b87a7f5e
Signed-off-by: Jordan Crouse <jcrouse@codeaurora.org>

msm: kgsl: Mark mmapped objects with VM_DONTCOPY

Add VM_DONTCOPY to the default set of mmap flags to keep VM objects
from being copied on fork() and causing issues.  KGSL file descriptors
copied to a child are not expected to be usable.

Change-Id: Ic0dedbad85c07118a931ccb9f7a6fd0507da3e5a
Signed-off-by: Jordan Crouse <jcrouse@codeaurora.org>

msm: kgsl: enable CPU IRQ while suspending context

Make sure that CPU interrupt is enabled before calling adreno
suspend_context when moving from NAP/SLEEP to SLUMBER state.
We send commands to GPU in adreno_drawctxt_switch() which will generate
GPU interrupt. Since CPU interrupt is not enabled, adreno_idle() will
fail because pending interrupt will not be served by CPU this causes
false GPU hang.

CRs-Fixed: 547813

Change-Id: Ia4b730b8f8cda1e820f571ffb7ddb00336ca1a8c
Signed-off-by: Gaurav Gagrani <ggagrani@codeaurora.org>

Conflicts:
	drivers/gpu/msm/kgsl_pwrctrl.c