msm: mdss: Clear the previous state of pipe during SOLID_FILL

Clear the previous state of pipe when it is being used in SOLID_FILL
operation to prevent wrong register configuration. For ex: Use case
when DMA pipe was used in BLOCK mode in previous frame, then it is
being used in LINE mode for SOLID_FILL operation in current frame.

CRs-Fixed: 655993
Change-Id: I0ed257276428b96c10a92457a16df4dfdc42c1f8
Signed-off-by: Sushil Chauhan <sushilchauhan@codeaurora.org>
msm: mdss: set pipe to solid fill when releasing it

There are cases where pipe can remain active for additional vsync after
unstaging from mixer, if this ever happens it will keep fetching from
memory. In order to avoid this, we can setup the pipe in solid fill mode
so there is no memory access after pipe is released by software and
avoid potential iommu page fault or underrun since pipe is no longer
considered for bandwidth calculations.

Change-Id: I4b5a5deda8c854c504ef523df434509fa5567186
Signed-off-by: Adrian Salido-Moreno <adrianm@codeaurora.org>
msm: display: reduce display commit prepare waiting time

Unblock overlay_set, prepare and buffer sync ioctls when
commit thread finishes hardware programming.
Use wait_for_kickoff nstead of pan_idle for these ioctls.

Change-Id: Iefb6cbc390d2130926fdcb93688b4d92bfb26937
Signed-off-by: Ken Zhang <kenz@codeaurora.org>
Signed-off-by: Neti Ravi Kumar <ravineti@codeaurora.org>
msm: display: only release kickoff when no cleanup pipe

If there is some pipe to clean up, need wait for it be done to
make sure the pipe can be used for the second cycle and recover
mode can be executed.

Change-Id: Ifb3fdb152bc4bbf367b3d272aa0c88b1a0650c19
Signed-off-by: Ken Zhang <kenz@codeaurora.org>
Signed-off-by: Neti Ravi Kumar <ravineti@codeaurora.org>
Signed-off-by: Jayant Shekhar <jshekhar@codeaurora.org>
Merge "qseecom: Add checks for user space buffer pointers"
msm_bam_rmnet: Fix potential memory corruption

Usage of legacy string manipulation function sprintf could lead to
memory corruption as the number of bytes to be written to the
destination is not bounded. Replace sprintf with snprintf where the
number of bytes to be written is explicitly specified.

CRs-fixed: 672202
Change-Id: Iab7516ad0e2540eb619fe96e26a3516c7adf86cc
Signed-off-by: Subash Abhinov Kasiviswanathan <subashab@codeaurora.org>
Merge "msm_bam_rmnet: Fix potential memory corruption"
futex-prevent-requeue-pi-on-same-futex.patch futex: Forbid uaddr == uaddr2 in futex_requeue(..., requeue_pi=1).

If uaddr == uaddr2, then we have broken the rule of only requeueing from
a non-pi futex to a pi futex with this call.  If we attempt this, then
dangling pointers may be left for rt_waiter resulting in an exploitable
condition.

This change brings futex_requeue() in line with futex_wait_requeue_pi()
which performs the same check as per commit 6f7b0a2a5c0f ("futex: Forbid
uaddr == uaddr2 in futex_wait_requeue_pi()")

[ tglx: Compare the resulting keys as well, as uaddrs might be
  	different depending on the mapping ]

Fixes CVE-2015-3153.
Reported-by: Pinkie Pie
Signed-off-by: Will Drewry <wad@chromium.org>
Signed-off-by: Kees Cook <keescook@chromium.org>
Cc: stable@vger.kernel.org
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Reviewed-by: Darren Hart <dvhart@linux.intel.com>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Divya Sharma <c_shard@codeaurora.org>
Change-Id: I9ee5c8a87cc43c7b1e1dc2796949e7c20c74ddf4
Signed-off-by: Abhinay Reddy Vanipally <avanip@codeaurora.org>
Merge "futex-prevent-requeue-pi-on-same-futex.patch futex: Forbid uaddr == uaddr2 in futex_requeue(..., requeue_pi=1)."
Merge "msm: mdss: Clear the previous state of pipe during SOLID_FILL"
Merge "msm: mdss: set pipe to solid fill when releasing it"
Merge "msm: display: reduce display commit prepare waiting time"
Merge "msm: display: only release kickoff when no cleanup pipe"