msm: ipa: provide ECM connect and disconnect using IPA messaging

This supplements the exiting mechanism based on netlink events.
This is added because in some cases, the netlink events are
not seen at user-space leading to device crash.

Change-Id: I8e34e1ef6556f3d79af84b39174a849c3bd5d29f
Signed-off-by: Ravi Gummadidala <rgummadi@codeaurora.org>
Merge "msm: ipa: provide ECM connect and disconnect using IPA messaging"
mtd: msm_qpic_nand: Fix buffer overflow issue

Correct the size argument passed to memset() in function
msm_nand_block_isbad() to fix buffer overflow issue.

CRs-fixed: 561236
Change-Id: I1c664ef529a42901d1f3d5d1d7b747cf58f886b6
Signed-off-by: Sahitya Tummala <stummala@codeaurora.org>
Merge "mtd: msm_qpic_nand: Fix buffer overflow issue"
usb: adb: Don't dequeue request during system suspend

Userspace adb daemon queues usb_request from adb_read and
waits for its completion to fetch data from host.
If host suspends USB bus then allowing system suspend
subsequently results in a signal being issued to adbd as part
of freezing the userspace processes. Currently this causes
adb_read to dequeues RX request.
If USB clocks are turned off as part of bus suspend then
usb_ep_dequeue may result in unclocked access.
Fix this by avoiding request dequeue from adb_read during
system suspend and re-using same request after resume.

CRs-fixed: 607157
Change-Id: Ifd0f300377d5ac462fb0d65a593a17f4eab43344
Signed-off-by: Manu Gautam <mgautam@codeaurora.org>
USB: msm_otg: Fail suspend if !BSV is under processing

USB BAM driver is also responsible for putting USB OTG
in runtime suspend state during bus suspend or cable
disconnect. There is a handshake between usb_bam and
IPA for the same. msm_otg checks with usb_bam for the
same using msm_bam_lpm_ok() before entering suspend
to make sure that handshake between usb_bam and its
peer bam peripheral is finished.
In case that handshake takes more time and msm_bam_lpm_ok
returns FALSE then it is the responsibility of usb_bam
driver to put usb_otg in runtime_suspend later when
it is finished. But, there is chance that user disconnects
USB cable just when usb_bam is trying to put USB in
LPM and its processing is not finished by sm_work_fn.
This may result in stop_peripheral and msm_otg_suspend
racing with each other. Fix this by not allowing LPM if
cable is disconnected but OTG state is not B_IDLE. OTG
state is marked B_IDLE only after gadget driver is
disconnected or stopped.

Change-Id: I14b12ba52afd568bcb7fbc5a690ed135c3e90c55
CRs-fixed: 606558
Signed-off-by: Manu Gautam <mgautam@codeaurora.org>
USB: gadget: ether: Fix memory corruption issues with multi_pkt_xfers

If gadget xmits packets before host sends RNDIS_MSG_INIT to update
maximum packets supported per transfer, then there is a possibility
of using freed skb memory later from xmit function. Fix such
races which may arise between tx_complete and start_xmit routines
depending on when multi_pkt_transfers are enabled.
Other option is to defer starting TX transfers until RNDIS_MSG_INIT
is received, but then it makes it difficult to handle scenarios
where host doesn't support this message or just doesn't send it.

CRs-fixed: 595367
Change-Id: I181da831120b38840ae4b8b74c1dacce129d1ba6
Signed-off-by: Manu Gautam <mgautam@codeaurora.org>
msm: kgsl: Verify the user address before reading a perfcounter group

In adreno_perfcounter_read_group some user input verification is
occuring on a user pointer before copy_from_user is called
resulting in a possible segmentation fault if called with improper
input data.

CRs-fixed: 553314
Change-Id: Ic0dedbad4c5e4b2610368d51ff591d1f716712f4
Signed-off-by: Jordan Crouse <jcrouse@codeaurora.org>
msm: net: ecm: cleanup for HW headers

This commit add support to remove the HW headers
for ECM tethering in case of composition switch.

Change-Id: I4dcb9da20956096012ce30d6da3894836ee4f962
Signed-off-by: Talel Atias <tatias@codeaurora.org>
msm: display: 9x25: qpic bus request

Add bus vote for display transfer.
CRs-fixed: 591811

Change-Id: Ifde6449693416ed06ae57ccaaf5ba305eef6e4c5
Signed-off-by: Ken Zhang <kenz@codeaurora.org>
Merge "msm: display: 9x25: qpic bus request"
Merge "usb: adb: Don't dequeue request during system suspend"
Merge "USB: msm_otg: Fail suspend if !BSV is under processing"
Merge "USB: gadget: ether: Fix memory corruption issues with multi_pkt_xfers"
Merge "msm: net: ecm: cleanup for HW headers"
msm: mdss: Sanitize read of panel properties

Check panel property's values properly before operating on
them.

CRs-Fixed: 562887
Change-Id: I26ce51e8b3a8e9328e7b6370b9c56d67fcdd1901
Signed-off-by: Mayank Chopra <makchopra@codeaurora.org>
Merge "msm: kgsl: Verify the user address before reading a perfcounter group"
msm: buspm: Correct size type in buspm_xfer_req

Variable size inside buspm_xfer_req
can be negative and thus would be a
large positive number resulting in arbitary
Kernel read.This patch corrects this value.

CRs-Fixed: 563529
Change-Id: I877db6960530d6c7d1486da9cfdc15a43e57e152
Signed-off-by: Sana Venkat Raju <c_vsana@codeaurora.org>
Merge "msm: buspm: Correct size type in buspm_xfer_req"
Merge "msm: mdss: Sanitize read of panel properties"