usb: gadget: u_ether: Fix memory corruption in TX path

When data aggregation is enabled, multiple skb buffers are copied
into a single USB request buffer.  When ever a USB request queue
is failed, make sure that req->length is reset to 0.  Otherwise
when the same request is used again, the stale length field is used
to access the request buffer.  This would lead to memory corruption.

The xmit function keeps the partial request at the beginning of the
queue.  Always put the idle request at the back of the queue.

CRs-Fixed: 469436
Change-Id: Idcd31e667b0bf261ab9a88f4a34464ccdf503e1b
Signed-off-by: Pavankumar Kondeti <pkondeti@codeaurora.org>
msm: ipc: Add check to avoid integer & buffer overflow

In IPC Router service lookup operation, add check to avoid an integer
overflow and hence a buffer overflow.

CRs-Fixed: 457402
Change-Id: Ibe949fe20aad88b15679bdc96ebc505e4395ac3b
Signed-off-by: Karthikeyan Ramasubramanian <kramasub@codeaurora.org>
usb: ks_bridge: Synchronize disconnect with ongoing IO

Following scenarios possible for interface disconnect racing
with ongoing IO:-

1) Interface disconnect setting interface pointer to NULL and
rx work is executing on other core dereferencing interface
pointer, causing kernel panic. Cancel a work and wait for it
to finish during disconnect.

2) Interface disconnect setting interface pointer to NULL and
tx completion running on other core dereferencing interface
pointer while calling usb_autopm_put_interface_async() API.
Check for USB_DEV_CONNECTED flag(cleared at the time of
disconnect) before dereferencing the interface pointer.

3) Interface unbound and driver is accessing already freed
interface pointer in tx completion or usb device pointer to
re-submit rx urb in rx completion. Add rx and tx urb pending
counters and wait for them to become zero (or timeout) during
disconnect.

CRs-Fixed: 448142
Change-Id: I50341173b94200bcfa60715b4b26b2117fc37c2c
Signed-off-by: Hemant Kumar <hemantk@codeaurora.org>
Signed-off-by: Pavankumar Kondeti <pkondeti@codeaurora.org>
msm: pm-8x60: Switch to using udelay in msm_pm_wait_cpu_shutdown

msm_pm_wait_cpu_shutdown() is invoked by platform_cpu_kill() for hotplug
and reboot framework to ensure that the core is power collapsed. The
function is called in atomic context in the reboot code path. Since
usleep() cannot be called in atomic context switch to using udelay().

Change-Id: Ie7a580a9a6841c679a63457bed71c884654c70fd
Signed-off-by: Mahesh Sivasubramanian <msivasub@codeaurora.org>
Merge "usb: gadget: u_ether: Fix memory corruption in TX path"
Merge "msm: ipc: Add check to avoid integer & buffer overflow"
Merge "msm: pm-8x60: Switch to using udelay in msm_pm_wait_cpu_shutdown"
Merge "usb: ks_bridge: Synchronize disconnect with ongoing IO"
msm_fb: display: delay commit video tile frame size register

Video tile frame size register is NOT double buffered.
when this register updated, it kicks in immediatly.
During transition from smaller resolution to higher
resolution  it may have possibility that mdp still fetch
from smaller resolution buffer with new higher resolution
frame size. This will cause iommu page fault. This patch
delay commit frame size register until next frame update
if it is necessary.

CRs-fixed: 450126, 461598
Change-Id: I0339100b8b2d76adf2b4b4206d1942effae55e0a
Signed-off-by: Kuogee Hsieh <khsieh@codeaurora.org>
(cherry picked from commit cbf9c3e6b7add8c613ed8046616e227b1846ef57)

Signed-off-by: Sudhir Sharma <sudsha@codeaurora.org>
msm_fb: display: reset base layer database

Reset base layer database at suspend so that new base layer can
be populated properly at next resume.

CRs-fixed: 462289
Change-Id: Iddffa15ab8d6ca024b37674fbbb412d23d27b59d
Signed-off-by: Kuogee Hsieh <khsieh@codeaurora.org>
(cherry picked from commit c5cd2ce13ec9a75dd2f803907311cf7d4514044b)
msm_fb: display: fix iommu page fault when iommu buffer freed

There has possibility that pipe commit come very close to next vsync.
This may cause two consecutive pipe_commits happen within same vsync
period which cause iommu page fault when previous iommu buffer is
freed since mdp stil fetching it. Set ION_IOMMU_UNMAP_DELAYED flag
at ion_map_iommu() to add delay un mapping iommu buffer to fix this problem.
Otherwise four buffer mechanism is needed to avoid this problem..
Also ion_unmap_iommu() may take long time to free an ion buffer. Move
mdp4_overlay_iommu_unmap_freelist(mixer) called after stage_commit()
to increase chance to have pipe_commit (up to stage_commit) is completed
within same vsync period
This patch also fix an potential race condition at wait_for_completion
between show_event thread and wait4vsync thread.

Change-Id: I673b0e368bbcd3120bc26569fe7a7bb82931daaa
Signed-off-by: Kuogee Hsieh <khsieh@codeaurora.org>
(cherry picked from commit ada63be0fd32e729e4b91aeeea2a5cfe0830148c)
(cherry picked from commit 799796f15e0b78ffe47975db1cf7f3791cb98129)
msm_fb: display: add one more pipe_commit delay before free ion buffer

It is possible that two consective pipe_commits happen within
same vsync period.  This will cause iommu page fault due to an ion buffer
that is being fetched by mdp's pipe is freed. It needs one pipe_commit
delay to free ion buffer to prevent iommu page from happening. Therefore
an extra free stage is needed to empty ion buffer free list.
Also, ION_IOMMU_UNMAP_DELAYED flag is not necessary at mapping of an
ion buffer since one pipe_commit delay had been added.

Change-Id: I340e002e8dc30b6faa0c095ba042eab50e8b7c88
Signed-off-by: Kuogee Hsieh <khsieh@codeaurora.org>
(cherry picked from commit 42358250bb04f8cb974494626c629242a2f98904)
mms_fb: display: init pipe default configure as solidfill

Initialize mdp pipes default config as solid fill so that
there will have no memory fetch if pipe are staged into
mixer while flush bits are left behind and set at next vsync.
This is will prevent mdp iommu page fault from happening
at address 0x00000000 during resume.

Change-Id: Ide944ec1d069629f1ae2ecd0daf49c69ce2af2eb
Signed-off-by: Kuogee Hsieh <khsieh@codeaurora.org>
(cherry picked from commit 7a6cd5104ed0117deeecad58519d44f793fc86f5)
msm_fb: display: free previous iommu buffer only at overlay_unset

Since wait4dmap is used at pipe_commit, there is possibility that
iommu buffer had been freed before vsync. Iommu page fault will
happen under this situation. Therefore only previous played iommu
buffer can be freed at overlay_unset. However all iommu buffers
are freed at suspend.

CRs-fixed: 440254
Change-Id: I9c3b77de255b74fd608aa28bb0f2277a58e2ba97
Signed-off-by: Kuogee Hsieh <khsieh@codeaurora.org>
(cherry picked from commit 4089e35a4b19eff1ac81cee4bc9157f7142bacf0)

Signed-off-by: Sudhir Sharma <sudsha@codeaurora.org>
(cherry picked from commit 6058f1b54a26498b9b36ac5a095cea09fbb23d00)
Merge "msm_fb: display: delay commit video tile frame size register"
Merge "msm_fb: display: reset base layer database"
Merge "msm_fb: display: fix iommu page fault when iommu buffer freed"
Merge "msm_fb: display: add one more pipe_commit delay before free ion buffer"
Merge "mms_fb: display: init pipe default configure as solidfill"
Merge "msm_fb: display: free previous iommu buffer only at overlay_unset"