msm: fix in-tree compilation for perf_trace_counters

In-tree compilation for arch/arm/mach-msm/perf_trace_counters.c was
hitting this error:

    In file included from arch/arm/mach-msm/perf_trace_counters.h:127:0,
                     from arch/arm/mach-msm/perf_trace_counters.c:14:
    include/trace/define_trace.h:79:43: fatal error: ./perf_trace_counters.h: No such file or directory

Instructions for TRACE_INCLUDE_FILE in include/trace/define_trace.h say
"the path is relative to define_trace.h, not the file including it".
Fix in-tree compilation by making the path relative to define_trace.h.

Signed-off-by: Bryan Huntsman <bryanh@codeaurora.org>
msm: kgsl: Save/restore performance counters across GPU power collapse

Physical performance counters are reset on GPU power collapse.
Save the values of the performance counters when the GPU goes to
power collapse and restore them on restart.

Change-Id: I63bec7b20e7fe516bbac4901cac0af3a1c1f4959
Signed-off-by: Harshdeep Dhatt <hdhatt@codeaurora.org>
msm: kgsl: Protect against a potential overflow in kgsl_sg_alloc

Avoid allocating a scatterlist so large that it overflows the size
passed to the memory allocators.

CRs-fixed: 564448
Change-Id: Ic0dedbad2ab421ddec8f3be38d61c9bdf9ae5bd4
Signed-off-by: Jordan Crouse <jcrouse@codeaurora.org>
msm: kgsl: Add TSE performance counter to software hang detection

Our current hang detection logic covers rendering pass by checking for
shader performance counters but it does not cover the case where there
is long binning or resolve pass. For long binning pass shader is inactive
making our current hang detection logic faulty. Checking for TSE number of
input primitives covers binning and resolve passes and makes our hang
detection logic robust.

CRs-fixed: 521284
Change-Id: Ifdec4b53685903456feb367f64380119b1485408
Signed-off-by: Tarun Karra <tkarra@codeaurora.org>
msm: kgsl: Get reference to process private when attaching mem entry

When a memory entry is attached with to a process private list then
increment the refcount of the process private structure so that the
structure is valid as long as the entry is around. The context
structure is also handled in similar manner. Also, the refcount to
the entry needs to be decremented when the handle that created the
entry goes away and not when the process private structure is
destroyed.

Change-Id: I225698ad4081947a93eb553104e5259bbf31f293
Signed-off-by: Shubhraprakash Das <sadas@codeaurora.org>
Signed-off-by: Shrenuj Bansal <shrenujb@codeaurora.org>
msm: kgsl: Allow GPU start to run in a high priority queue

The GPU start sequence needs to run with low latency when coming
out of slumber for the first draw command. For those cases allow the
start function to be queued into a high priority workqueue to reduce
the chance of it getting scheduled out.

Change-Id: Ic0dedbada7ef4d63b54e826862fbefdfb71a092a
Signed-off-by: Jordan Crouse <jcrouse@codeaurora.org>
msm: kgsl: Add an input handler to power up the GPU on a touch event

On a device where the primary input is a touchscreen nobody is
surprised that touch events are often the catalyst for drawing
frames. If the GPU is in slumber we can get a jump on the action
by watching for touch events and turning the GPU on in anticipation
of a draw call. Register for events from all input drivers
returning EV_ABS events and queue a work task to power up the GPU
if it is currently in slumber.

Change-Id: Ic0dedbadbdc96ef9ddd78252ea65f8e1cdd00110
Signed-off-by: Jordan Crouse <jcrouse@codeaurora.org>

Conflicts:
	drivers/gpu/msm/adreno_ringbuffer.c
block: row: change hrtimer_cancel to hrtimer_try_to_cancel

Calling hrtimer_cancel with interrupts disabled can result in a livelock.
When flushing plug list in the block layer interrupts are disabled and an
hrtimer is used when adding requests from that plug list to the scheduler.
In this code flow, if the hrtimer (which is used for idling) is set, it's
being canceled by calling hrtimer_cancel. hrtimer_cancel will perform
the following in an endless loop:
1. try cancel the timer
2. if fails - rest_cpu
the cancellation can fail if the timer function already started. Since
interrupts are disabled it can never complete.
This patch reduced the number of times the hrtimer lock is taken while
interrupts are disabled by calling hrtimer_try_co_cancel. the later will
try to cancel the timer just once and return with an error code if fails.

CRs-fixed: 499887
Change-Id: I25f79c357426d72ad67c261ce7cb503ae97dc7b9
Signed-off-by: Tatyana Brokhman <tlinder@codeaurora.org>
block: row: add magic values.

Signed-off-by: franciscofranco <franciscofranco.1990@gmail.com>
msm: netfilter: NATTYPE Refresh Timer Changes

NATTYPE entry timeout will not be updated when packets
start flowing through IPA and eventually can timeout.
Make changes to refresh the NATTYPE entry timeout from
the connection tracking netlink module which is used by
IPANAT to update conntrack timeout. Also make the timeout
dynamic by taking the expiry timeout value from connection
tracking entry. Otherwise NATTYPE entry will not timeout
even when all the corresponding conntrack entries expire.

CRs-FIXED: 490813
Change-Id: Ibb225d7b91070ca9948c7a11f0b5925a8435915c
Signed-off-by: Tyler Wear <twear@codeaurora.org>
Bluetooth: Remove sysfs entry if hid connection is disconnected

This patch fixes the issue that sysfs entry for hid was not removed when
disconnection was initiated from remote end or if BT was reset. Sysfs
entry prevented reconnection from HID device.

CRs-Fixed: 468516, 473179

Change-Id: I40bcd27450cd8f87180d33b66969dde4f08a34f3
Signed-off-by: Hemant Gupta <hemantg@codeaurora.org>
netlink: validate addr_len on bind

Otherwise an out of bounds read could happen.

Signed-off-by: Hannes Frederic Sowa <hannes@stressinduktion.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
net: flow: Prevent bringing up new CPUs during per-CPU initialization

In a rare race-condition, it's possible that a CPU will be brought
online between when the for_each_online_cpu() loop executes to
call flow_cache_cpu_prepare(), and when the hotplug notifier for
calling this same function is registered. If this happens,
flow_cache_cpu_prepare() will never be called for the new CPU,
resulting in crashes due to uninitialized per-cpu data.

Fix this by preventing CPUs from being added or removed during
this small but sensitive window.

Change-Id: Iafbbaa8a50e5c527392d130561874313720849d0
Signed-off-by: Matt Wagantall <mattw@codeaurora.org>
netfilter: xt_qtaguid: fix error exit that would keep a spinlock.

qtudev_open() could return with a uid_tag_data_tree_lock held
when an kzalloc(..., GFP_ATOMIC) would fail.
Very unlikely to get triggered AND survive the mayhem of running out of mem.

Signed-off-by: JP Abgrall <jpa@google.com>
netfilter: qtaguid: Don't BUG_ON if create_if_tag_stat fails

If create_if_tag_stat fails to allocate memory (GFP_ATOMIC) the
following will happen:

qtaguid: iface_stat: tag stat alloc failed
...
kernel BUG at xt_qtaguid.c:1482!

Signed-off-by: Pontus Fuchs <pontus.fuchs@gmail.com>
netfilter: xt_qtaguid: report only uid tags to non-privileged processes

In the past, a process could only see its own stats (uid-based summary,
and details).
Now we allow any process to see other UIDs uid-based stats, but still
hide the detailed stats.

Change-Id: I7666961ed244ac1d9359c339b048799e5db9facc
Signed-off-by: JP Abgrall <jpa@google.com>
net: feed /dev/random with the MAC address when registering a device

commit 7bf2357524408b97fec58344caf7397f8140c3fd upstream.

Signed-off-by: "Theodore Ts'o" <tytso@mit.edu>
Cc: David Miller <davem@davemloft.net>
Cc: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Patrick Tjin <pattjin@google.com>
ipv6: use a stronger hash for tcp

It looks like its possible to open thousands of TCP IPv6
sessions on a server, all landing in a single slot of TCP hash
table. Incoming packets have to lookup sockets in a very
long list.

We should hash all bits from foreign IPv6 addresses, using
a salt and hash mix, not a simple XOR.

inet6_ehashfn() can also separately use the ports, instead
of xoring them.

Reported-by: Neal Cardwell <ncardwell@google.com>
Signed-off-by: Eric Dumazet <edumazet@google.com>
Cc: Yuchung Cheng <ycheng@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Iliyan Malchev <malchev@google.com>

Conflicts:
	include/net/ipv6.h
net: defer net_secret[] initialization

Instead of feeding net_secret[] at boot time, defer the init
at the point first socket is created.

This permits some platforms to use better entropy sources than
the ones available at boot time.

Signed-off-by: Eric Dumazet <edumazet@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
net-fixes: flow_dissector: prevent an infinite loop (CVE-2013-4348)

Jason Wang found that a malicious packet could make skb_flow_dissect()
loop forever. We must check that IP header has a valid ihl to avoid
this loop. It involves IPIP encapsulation and ihl = 0 to trigger.

Given this bug is critical, I cooked a patch before having
a fix in upstream kernel.

Tested:

 Compiled/booted
 Ran some tests on bnx2x and explicitely disabled hardware provided rxhash
 ethtool -K eth1 rxhash off
 ethtool -K eth2 rxhash off

Google-Bug-Id: 11465355
Effort: net-fixes
Change-Id: I813e4dc48cecb05f8edfa218304e1f13fd764323
Signed-off-by: Francisco Franco <franciscofranco.1990@gmail.com>