USB: msm72k_udc: Synchronize ep dequeue to handle race

The rndis composition switch and handling a rndis command
or a standard request like setup can lead to a race
condition. While the command is getting completed,
ep dequeue may happen as a part of android_disable which
can lead to crash.

Have a busy state marked to the endpoint while
the completion on that request is running and let
ep dequeue wait untill command is completed.

CRs-Fixed: 523964
Change-Id: Ia3a1bbadccdf8abe24cc14ee64aad3d9eae1d3e5
Signed-off-by: Sujeet Kumar <ksujeet@codeaurora.org>
msm: scm: Add scm_call_noalloc and helper macros

Currently, scm_call internally calls kmalloc() to allocate a command
buffer structure. This prevents scm_call from working before kmalloc
structures are initialized or during atomic contexts. Allow clients
to pass in a pre-allocated buffer for scm_call to be used for internal
structures.

Change-Id: Id09500c8c696298228aefdcc2a61953e654677c9
Signed-off-by: Laura Abbott <lauraa@codeaurora.org>
Signed-off-by: Gopal G Goberu <ggober@codeaurora.org>
arm: Add ARCH_RANDOM Kconfig

Some boards may support architecture generated random numbers. Add
the appropriate Kconfig.

Change-Id: I0077a982c9bb6d3a35435cc27fe40b7e0596ca84
Signed-off-by: Laura Abbott <lauraa@codeaurora.org>
Signed-off-by: Gopal G Goberu <ggober@codeaurora.org>
msm: implement ARCH_RANDOM

Currently, the software random number generator is not intialized
until relatively late in the boot process. Software that relies on
random numbers early will not be reliable. Entropy sources are
available early but not early enough for some use cases which means
that moving the software random number generation earlier is not an
option. As an alternate solution, implement the functions associated
with CONFIG_ARCH_RANDOM. These functions currently make a call into
trustzone to get reliable random numbers. The functions are disabled
once the regular random number generator is sufficiently reliable.

Change-Id: If40cfcb96b091fa26a28047c10a902287b26f6c1
Signed-off-by: Laura Abbott <lauraa@codeaurora.org>

Conflicts:

	arch/arm/mach-msm/Makefile

Signed-off-by: Gopal G Goberu <ggober@codeaurora.org>
init: Move stack canary initialization after setup_arch

Stack canary intialization involves getting a random number.
Getting this random number may involve accessing caches or other
architectural specific features which are not available until
after the architecture is setup. Move the stack canary initialization
later to accomodate this.

Change-Id: I00b564a2c3172229a44339c061fa380c17fe7d8e
Signed-off-by: Laura Abbott <lauraa@codeaurora.org>
Signed-off-by: Gopal G Goberu <ggober@codeaurora.org>
Merge "msm: scm: Add scm_call_noalloc and helper macros"
Merge "arm: Add ARCH_RANDOM Kconfig"
Merge "msm: implement ARCH_RANDOM"
Merge "init: Move stack canary initialization after setup_arch"
msm: hdmi-cec: bounds check cec frame size

Ensure that the frame size for the HDMI-CEC message
frame size doesn't exceed the maximum size when
reading message from userspace through sysfs interface.
This avoids potential overflow in cec send msg routine.

Change-Id: I09eb8f7a6dee64be2b504c6448b49e1da902aa47
CRs-Fixed: 520140
Signed-off-by: Manoj Rao <manojraj@codeaurora.org>
Merge "USB: msm72k_udc: Synchronize ep dequeue to handle race"
msm: audio: qdsp6v2:  Check return code from audio_aio_open()

When audio_aio_open() is triggered in blocking fashion, it  frees audio
resouces and returns error code. In the current implementation,  callers
did not check the error code which can lead to dereference to freed
resources and cause system crash.  Update the callers to check return
code and then return error back to application to avoid the issue. In
the meanwhile, update the audio_aio_open not to free memory for caller
and leave the caller to free the memory in error condition.

Change-Id: If3bc82f1704ff7cfa0814072eba871d8deb0fd54
CRs-fixed: 436653
Signed-off-by: Kuirong Wang <kuirongw@codeaurora.org>
perf: Treat attr.config as u64 in perf_swevent_init()

Trinity discovered that we fail to check all 64 bits of
attr.config passed by user space, resulting to out-of-bounds
access of the perf_swevent_enabled array in
sw_perf_event_destroy().

Introduced in commit b0a873ebb ("perf: Register PMU
implementations").

Signed-off-by: Tommi Rantala <tt.rantala@gmail.com>
Cc: Peter Zijlstra <a.p.zijlstra@chello.nl>
Cc: davej@redhat.com
Cc: Paul Mackerras <paulus@samba.org>
Cc: Arnaldo Carvalho de Melo <acme@ghostprotocols.net>
Signed-off-by: Ingo Molnar <mingo@kernel.org>
Patch-mainline: linux-kernel @ 04/13/13, 19:49
Signed-off-by: Deepak Katragadda <dkatraga@codeaurora.com>
Merge "msm: audio: qdsp6v2:  Check return code from audio_aio_open()"
Merge "perf: Treat attr.config as u64 in perf_swevent_init()"
msm_serial_hs:Increase rx buffer size to 1024bytes

Increase the UARTDM rx buffer size from 512 bytes
to 1024 bytes. This patch helps to increase the
rx data rates of the clients that uses serial_hs driver.
CRs-Fixed: 514385

Change-Id: I957b1e47887931047e66da555e73683e7dca49a8
Signed-off-by: Dilip Kota <c_dkota@codeaurora.org>
Merge "msm_serial_hs:Increase rx buffer size to 1024bytes"
msm: Make CONFIG_STRICT_MEMORY_RWX even stricter

If CONFIG_STRICT_MEMORY_RWX was set, the first section (containing
the kernel page table and the initial code) and the section
containing the init code were both given RWX permission, which is
a potential security hole.

Pad the first section after the initial code (which will never
be executed when the MMU is on) to make the rest of the kernel
text start in the second section and make the first section RW.

Move some data which had ended up in the "init text"
section into the "init data" one, as this is RW, not RX.
Make the "init text" RX.

We will not free the section containing the "init text",
because if we do, the kernel will allocate memory for RW data there.

Change-Id: I6ca5f4e07342c374246f04a3fee18042fd47c33b
CRs-fixed: 513919
Signed-off-by: Larry Bassel <lbassel@codeaurora.org>
Merge "msm: Make CONFIG_STRICT_MEMORY_RWX even stricter"
Merge "msm: hdmi-cec: bounds check cec frame size"