cdc:  patches from mbm in userspace
pehci:  Bring back usleep
update to 2.6 settings
Revert "cdc:  patches from mbm in userspace"

causes slow connections

This reverts commit 5d384ed7e5fd4ab773edb17b4b22c872bbcc4aa4.
cdc:  update with patches from mbm userspace
Compilation issue fix

 Defined INSTALLED_KERNEL_TARGET
 Added files to ggc_wrapper.py
 Disabled SELINUX

Change-Id: I7a1702dfcaac32caff94a7cd1929483c005fc15e
Signed-off-by: Samjith Sadasivan <samjit@codeaurora.org>
msm_bam_rmnet: Fix potential memory corruption

Usage of legacy string manipulation function sprintf could lead to
memory corruption as the number of bytes to be written to the
destination is not bounded. Replace sprintf with snprintf where the
number of bytes to be written is explicitly specified.

CRs-fixed: 672202
Change-Id: Iab7516ad0e2540eb619fe96e26a3516c7adf86cc
Signed-off-by: Subash Abhinov Kasiviswanathan <subashab@codeaurora.org>
n_tty: Fix n_tty_write crash when echoing in raw mode

The tty atomic_write_lock does not provide an exclusion guarantee for
the tty driver if the termios settings are LECHO & !OPOST. And since
it is unexpected and not allowed to call TTY buffer helpers like
tty_insert_flip_string concurrently, this may lead to crashes when
concurrect writers call pty_write. In that case the following two
writers:
* the ECHOing from a workqueue and
* pty_write from the process
race and can overflow the corresponding TTY buffer like follows.

If we look into tty_insert_flip_string_fixed_flag, there is:
  int space = __tty_buffer_request_room(port, goal, flags);
  struct tty_buffer *tb = port->buf.tail;
  ...
  memcpy(char_buf_ptr(tb, tb->used), chars, space);
  ...
  tb->used += space;

so the race of the two can result in something like this:
          A                             B
   __tty_buffer_request_room
                                  __tty_buffer_request_room
   memcpy(buf(tb->used), ...)
   tb->used += space;
                                 memcpy(buf(tb->used), ...) ->BOOM

B's memcpy is past the tty_buffer due to the previous A's tb->used
increment.

Since the N_TTY line discipline input processing can output
concurrently with a tty write, obtain the N_TTY ldisc output_lock to
serialize echo output with normal tty writes. This ensures the tty
buffer helper tty_insert_flip_string is not called concurrently and
everything is fine.

Note that this is nicely reproducible by an ordinary user using
forkpty and some setup around that (raw termios + ECHO). And it is
present in kernels at least after commit
d945cb9cce20ac7143c2de8d88b187f62db99bdc (pty: Rework the pty layer to
use the normal buffering logic) in 2.6.31-rc3.

js: add more info to the commit log
js: switch to bool
js: lock unconditionally
js: lock only the tty->ops->write call

Signed-off-by: Peter Hurley <peter@hurleysoftware.com>
Signed-off-by: Jiri Slaby <jslaby@suse.cz>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Change-Id: I9e235db6ec2bb950f26bd8a23f6145dab5dc0a15
Git-commit: 4291086b1f081b869c6d79e5b7441633dc3ace00
Git-repo: git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
Signed-off-by: Avijit Kanti Das <avijitnsec@codeaurora.org>
[rsiddoji@codeaurora.org: resolve trivial merge conflicts]
Signed-off-by: Ravi Kumar S <rsiddoji@codeaurora.org>
ASoC: msm: Flexible period size for pcm playback

PCM driver was configured for fixed buffer
size on the playback path. With this, varying
the buffer sizes on the playback path was not
possible. To fix this, support for flexible
period sizes is added by setting different
values for min and max buffer sizes

Change-Id: I7f69db4940f67e5e3a795101af1b1682afbdb530
Signed-off-by: Alexy Joseph <alexyj@codeaurora.org>
Signed-off-by: Mekala Natarajan <mekalan@codeaurora.org>
ASoC: msm: Reduce maximum number of VOIP periods

Change-Id: I7c12a1fbae39ebee86f526549afe82451f87fd1b
ASoC: msm: Add routing info for VOIP_EXT_EC_REF

Change-Id: Ic9db1ec35255643c3cca7a351be0f1481c60f086
net: Zeroing the structure ethtool_wolinfo in ethtool_get_wol()

memset() the structure ethtool_wolinfo that has padded bytes
but the padded bytes have not been zeroed out.

Change-Id: If3fd2d872a1b1ab9521d937b86a29fc468a8bbfe
Signed-off-by: Avijit Kanti Das <avijitnsec@codeaurora.org>
Fix build for GCC 4.7

Change-Id: I4e9265369174d82b55fd435bc47887972f99c9d4
msm: vidc: cache-flush encoder output buffers after alloc

Flush output buffers explcitly during registering. This ensures
any pending CPU writes (i.e meset to 0 after allocation) are
committed right away, or else this may get flushed _after_
hardware has written the bitstream.

Change-Id: I958466011e7d96c7b5e2691403c8386309997429
Signed-off-by: Praveen Chavan <pchavan@codeaurora.org>
Signed-off-by: c_sridur <sridur@codeaurora.org>
tracing/syscalls: Fix perf syscall tracing when syscall_nr == -1

syscall_get_nr can return -1 in the case that the task is not executing
a system call.

This patch fixes perf_syscall_{enter,exit} to check that the syscall
number is valid before using it as an index into a bitmap.

Link: http://lkml.kernel.org/r/1345137254-7377-1-git-send-email-will.deacon@arm.com

Change-Id: I12f99dea41390b9631f98f925dc1d572aa4fc22d
Cc: Jason Baron <jbaron@redhat.com>
Cc: Wade Farnsworth <wade_farnsworth@mentor.com>
Cc: Frederic Weisbecker <fweisbec@gmail.com>
Signed-off-by: Will Deacon <will.deacon@arm.com>
Signed-off-by: Steven Rostedt <rostedt@goodmis.org>
tracing/syscalls: Ignore numbers outside NR_syscalls' range

ARM has some private syscalls (for example, set_tls(2)) which lie
outside the range of NR_syscalls.  If any of these are called while
syscall tracing is being performed, out-of-bounds array access will
occur in the ftrace and perf sys_{enter,exit} handlers.

 # trace-cmd record -e raw_syscalls:* true && trace-cmd report
 ...
 true-653   [000]   384.675777: sys_enter:            NR 192 (0, 1000, 3, 4000022, ffffffff, 0)
 true-653   [000]   384.675812: sys_exit:             NR 192 = 1995915264
 true-653   [000]   384.675971: sys_enter:            NR 983045 (76f74480, 76f74000, 76f74b28, 76f74480, 76f76f74, 1)
 true-653   [000]   384.675988: sys_exit:             NR 983045 = 0
 ...

 # trace-cmd record -e syscalls:* true
 [   17.289329] Unable to handle kernel paging request at virtual address aaaaaace
 [   17.289590] pgd = 9e71c000
 [   17.289696] [aaaaaace] *pgd=00000000
 [   17.289985] Internal error: Oops: 5 [#1] PREEMPT SMP ARM
 [   17.290169] Modules linked in:
 [   17.290391] CPU: 0 PID: 704 Comm: true Not tainted 3.18.0-rc2+ #21
 [   17.290585] task: 9f4dab00 ti: 9e710000 task.ti: 9e710000
 [   17.290747] PC is at ftrace_syscall_enter+0x48/0x1f8
 [   17.290866] LR is at syscall_trace_enter+0x124/0x184

Fix this by ignoring out-of-NR_syscalls-bounds syscall numbers.

Commit cd0980fc8add "tracing: Check invalid syscall nr while tracing syscalls"
added the check for less than zero, but it should have also checked
for greater than NR_syscalls.

Link: http://lkml.kernel.org/p/1414620418-29472-1-git-send-email-rabin@rab.in

Change-Id: Ic7ab546938e4655d73791d4cf371ffd9244c3e4d
Fixes: cd0980fc8add "tracing: Check invalid syscall nr while tracing syscalls"
Cc: stable@vger.kernel.org # 2.6.33+
Signed-off-by: Rabin Vincent <rabin@rab.in>
Signed-off-by: Steven Rostedt <rostedt@goodmis.org>
msm: wlan: Fix dangling pAdapter pointer in HDD.

On getting response from FW , SME calls hdd in
hdd_tx_per_hit_cb with pAdapter as argument.But
by that pAdapter in hdd might be removed.
As a part of fix, instead of passing pAdapter,
sessionId is passed. So when SME gets response from
FW , it will call hdd with sessionId and in hdd based
on sessionId a valid pAdapter would be used.

Change-Id: I50b484f2b2fbff17766ea14315132a9d6531e86b
CRs-Fixed: 699843
Signed-off-by: Kaushik, Sushant <skaushik@codeaurora.org>
ASoC: msm: qdsp6v2: check proxy port is open when closing

The current logic opens the afe proxy port only if the
proxy instance virtual port is opened. If only
pcm instance virtual port is opened and a close of the
afe proxy port is attempted, this causes the device to
crash due to a wait event timeout as the driver tries
to close an unopened afe port.
The change ensures that only if both the virtual ports
are opened, which in effect starts the proxy port,
the afe close commands for the proxy port is sent to DSP,
else return immediately.

Change-Id: I9450001c608208f3d8da22b2881a88db1c21d950
Signed-off-by: Aravind Kumar <akumark@codeaurora.org>
qseecom: fix secure app loading failure by kernel mode qseecom client

Make a change to fix secure app loading failure due to premature
kzfree() from __qseecom_load_fw(), when kernel mode qseecom client
tries to load app.

CRs-fixed: 694541

Change-Id: I1ac39ee885c12e08e863d976321dda2380ace852
Signed-off-by: William Clark <wclark@codeaurora.org>
crypto: msm: check potential integer overflow

According to the specification of AEAD, AEAD request crypt length is
not a fixed maximum and associated length is also same. This could
lead to potential integer overflow, thus allocating less memory. So
we need to check potential integer overflow on AEAD request length.

CRs-Fixed: 726872
Change-Id: Ie7708000bfd8c57e2fba8e02230a7ce9cdc9634c
Signed-off-by: William Clark <wclark@codeaurora.org>