ARM: 7527/1: uaccess: explicitly check __user pointer when !CPU_USE_DOMAINS

The {get,put}_user macros don't perform range checking on the provided
__user address when !CPU_HAS_DOMAINS.

This patch reworks the out-of-line assembly accessors to check the user
address against a specified limit, returning -EFAULT if is is out of
range.

[will: changed get_user register allocation to match put_user]
[rmk: fixed building on older ARM architectures]

CRs-Fixed: 504011
Change-Id: I3818045a136fcdf72deb1371b132e090fd7ed643
Reported-by: Catalin Marinas <catalin.marinas@arm.com>
Signed-off-by: Will Deacon <will.deacon@arm.com>
Cc: stable@vger.kernel.org
Signed-off-by: Russell King <rmk+kernel@arm.linux.org.uk>
Git-commit: 8404663f81d212918ff85f493649a7991209fa04
Git-repo: git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
Signed-off-by: Laura Abbott <lauraa@codeaurora.org>

Conflicts:
	arch/arm/include/asm/uaccess.h
USB: msm72k_udc: Synchronize ep dequeue to handle race

The rndis composition switch and handling a rndis command
or a standard request like setup can lead to a race
condition. While the command is getting completed,
ep dequeue may happen as a part of android_disable which
can lead to crash.

Have a busy state marked to the endpoint while
the completion on that request is running and let
ep dequeue wait untill command is completed.

CRs-Fixed: 523964
Change-Id: Ia3a1bbadccdf8abe24cc14ee64aad3d9eae1d3e5
Signed-off-by: Sujeet Kumar <ksujeet@codeaurora.org>
arm: Add ARCH_RANDOM Kconfig

Some boards may support architecture generated random numbers. Add
the appropriate Kconfig.

Change-Id: I0077a982c9bb6d3a35435cc27fe40b7e0596ca84
Signed-off-by: Laura Abbott <lauraa@codeaurora.org>
Signed-off-by: Gopal G Goberu <ggober@codeaurora.org>
init: Move stack canary initialization after setup_arch

Stack canary intialization involves getting a random number.
Getting this random number may involve accessing caches or other
architectural specific features which are not available until
after the architecture is setup. Move the stack canary initialization
later to accomodate this.

Change-Id: I00b564a2c3172229a44339c061fa380c17fe7d8e
Signed-off-by: Laura Abbott <lauraa@codeaurora.org>
Signed-off-by: Gopal G Goberu <ggober@codeaurora.org>
msm: audio: qdsp6v2:  Check return code from audio_aio_open()

When audio_aio_open() is triggered in blocking fashion, it  frees audio
resouces and returns error code. In the current implementation,  callers
did not check the error code which can lead to dereference to freed
resources and cause system crash.  Update the callers to check return
code and then return error back to application to avoid the issue. In
the meanwhile, update the audio_aio_open not to free memory for caller
and leave the caller to free the memory in error condition.

Change-Id: If3bc82f1704ff7cfa0814072eba871d8deb0fd54
CRs-fixed: 436653
Signed-off-by: Kuirong Wang <kuirongw@codeaurora.org>
perf: Treat attr.config as u64 in perf_swevent_init()

Trinity discovered that we fail to check all 64 bits of
attr.config passed by user space, resulting to out-of-bounds
access of the perf_swevent_enabled array in
sw_perf_event_destroy().

Introduced in commit b0a873ebb ("perf: Register PMU
implementations").

Signed-off-by: Tommi Rantala <tt.rantala@gmail.com>
Cc: Peter Zijlstra <a.p.zijlstra@chello.nl>
Cc: davej@redhat.com
Cc: Paul Mackerras <paulus@samba.org>
Cc: Arnaldo Carvalho de Melo <acme@ghostprotocols.net>
Signed-off-by: Ingo Molnar <mingo@kernel.org>
Patch-mainline: linux-kernel @ 04/13/13, 19:49
Signed-off-by: Deepak Katragadda <dkatraga@codeaurora.com>

Conflicts:
	kernel/events/core.c

Change-Id: I04e665bfcf2b4889be19264eee3fa8ea02c53e76
arm: Move the secondary_startup to __CPUINIT section.

Because of addition 1MB alignment after head.txt section,
the secondary_startup needs to move to 1MB aligned section.

CRs-Fixed: 513919
Change-Id: I332d1e4ec95c877406c6ad3318e5f9a3c85cc10f
Signed-off-by: Venkatesh Yadav Abbarapu <quicvenkat@codeaurora.org>
msm: fb: Copy unsigned int for notify update

Change to correct signature of msmfb_notify_update
from the ioctl declaration.

Change-Id: Ia7bdfd3dbe8494a641ffd46d484794b4bec7d27c
Signed-off-by: Krishna Chaitanya Parimi <cparimi@codeaurora.org>
msm: fb: Null check mfd data

Add appropriate null check for mfd data structure before
accessing it's members. This prevents null pointer accesses
in the driver.

Change-Id: I5aae937f839e4f6ed8d5c5a4b54ab45f0ff07332
Signed-off-by: Krishna Chaitanya Parimi <cparimi@codeaurora.org>
Signed-off-by: Neti, Ravi Kumar <ravineti@codeaurora.org>
kernel: gtod: vsyscall

Introduce kernel user helper vsyscall to allow a higher performance
gettimeofday implementation in user-space.

Change-Id: I9b9971d217382129170ecd6a35461539dac9eebb
Signed-off-by: Brent DeGraaf <bdegraaf@codeaurora.org>
Signed-off-by: Joonwoo Park <joonwoop@codeaurora.org>
kernel: Add hooks for user-accessible timers in the kernel.

Hooks for user-accessible timers allow implementation of a
more efficient gettimeofday in user-space.

Change-Id: If2f63d010c1cf142eb84f3745617e756913e46f7
Signed-off-by: Brent DeGraaf <bdegraaf@codeaurora.org>
Signed-off-by: Joonwoo Park <joonwoop@codeaurora.org>
kernel: ARM-specific implementation of user-accessible timers

Expose a read-only timer page to user-space to allow for a more
efficient implementation of gettimeofday in user-space.

Change-Id: Ibd6ce41f5f4ff9435e4bf4582ef5de721283d56b
Signed-off-by: Brent DeGraaf <bdegraaf@codeaurora.org>
Signed-off-by: Joonwoo Park <joonwoop@codeaurora.org>
arm: Make the WFE macro unconditional

Remove the condition argument from the WFE macro in the
spinlock code so it can support a WFE fixup needed on
certain Krait CPUs.

Change-Id: I8b4f85f0e7c130dff1e14fe275fda14a43e6f3f4
Signed-off-by: Stepan Moskovchenko <stepanm@codeaurora.org>
Signed-off-by: Joonwoo Park <joonwoop@codeaurora.org>
arm: Convert spinlocks to new inline assembly style

Refactor the inline assembly code in spinlock.h in
preparation for supporting the Krait safe WFE sequence.

Change-Id: I2db4f823c39b164e04673f44cea916e334a20c9a
Signed-off-by: Stepan Moskovchenko <stepanm@codeaurora.org>
Signed-off-by: Joonwoo Park <joonwoop@codeaurora.org>
arm: Support the safe WFE sequence for Krait CPUs

Certain version of the Krait processor require a specific
code sequence to be executed prior to executing a WFE
instruction to permit that instruction to place the
processor into a low-power state.

Change-Id: I308adc691f110a323cbd84e9779675ac045826fa
Signed-off-by: Stepan Moskovchenko <stepanm@codeaurora.org>
Signed-off-by: Joonwoo Park <joonwoop@codeaurora.org>
kernel: gtod: Add MSM-specific user-accessible timers

Enable MSM-specific timers to be readable from user-space.
This allows implementation of a higher-performance
gettimeofday in user-space.

Change-Id: I1f322b5396ee335b10aeb81c681593621d151176
Signed-off-by: Brent DeGraaf <bdegraaf@codeaurora.org>
Signed-off-by: Joonwoo Park <joonwoop@codeaurora.org>
arm: Don't disable interrupts during WFE fixup

Disabling interrupts during the Krait WFE fixup can result
in deadlock if a thread tries to acquire a spinlock that is
released from an interrupt context. Instead of disabling
interrupts, modify the interrupt handler to reset the fixup
condition to put the processor into a safe state in the
event that the interrupt came in during the fixup window.

CRs-Fixed: 383670
Change-Id: Id504f46d6f840dc32ca11ed2f813003143e60f2d
Signed-off-by: Stepan Moskovchenko <stepanm@codeaurora.org>
Signed-off-by: Joonwoo Park <joonwoop@codeaurora.org>
ARM: 7735/2: Preserve the user r/w register TPIDRURW on context switch and fork

Since commit 6a1c53124aa1 the user writeable TLS register was zeroed to
prevent it from being used as a covert channel between two tasks.

There are more and more applications coming to Windows RT,
Wine could support them, but mostly they expect to have
the thread environment block (TEB) in TPIDRURW.

This patch preserves that register per thread instead of clearing it.
Unlike the TPIDRURO, which is already switched, the TPIDRURW
can be updated from userspace so needs careful treatment in the case that we
modify TPIDRURW and call fork(). To avoid this we must always read
TPIDRURW in copy_thread.

Change-Id: Ib1e25be7b9faa846ba5335aad2574e21a1246066
Signed-off-by: André Hentschel <nerv@dawncrow.de>
Signed-off-by: Will Deacon <will.deacon@arm.com>
Signed-off-by: Jonathan Austin <jonathan.austin@arm.com>
Signed-off-by: Russell King <rmk+kernel@arm.linux.org.uk>
Git-commit: a4780adeefd042482f624f5e0d577bf9cdcbb760
Git-repo: git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
[joonwoop@codeaurora.org: fixed merge conflict]
CRs-fixed: 561044
Signed-off-by: Joonwoo Park <joonwoop@codeaurora.org>
ARM: poison the vectors page

Fill the empty regions of the vectors page with an exception generating
instruction.  This ensures that any inappropriate branch to the vector
page is appropriately trapped, rather than just encountering some code
to execute.  (The vectors page was filled with zero before, which
corresponds with the "andeq r0, r0, r0" instruction - a no-op.)

Change-Id: I74c0105a2bcb3b78d9fc8b105a05c0fc269ba400
Cc: <stable@vger.kernel.org>
Acked-by Nicolas Pitre <nico@linaro.org>
Signed-off-by: Russell King <rmk+kernel@arm.linux.org.uk>
Git-commit: f928d4f2a86f46b030fa0850385b4391fc2b5918
Git-repo: git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
CRs-fixed: 561044
Signed-off-by: Joonwoo Park <joonwoop@codeaurora.org>
ARM: poison memory between kuser helpers

Poison the memory between each kuser helper.  This ensures that any
branch between the kuser helpers will be appropriately trapped.

Change-Id: Ifa4abe51d3dd89a96670a8609cd472fa03988e7e
Cc: <stable@vger.kernel.org>
Acked-by: Nicolas Pitre <nico@linaro.org>
Signed-off-by: Russell King <rmk+kernel@arm.linux.org.uk>
Git-commit: 5b43e7a383d69381ffe53423e46dd0fafae07da3
Git-repo: git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
CRs-fixed: 561044
Signed-off-by: Joonwoo Park <joonwoop@codeaurora.org>