backport uhid driver from linux 3.8

the userspace HID driver is needed by the JB bluetooth stack to process input
from bluetooth keyboards.
backport lowmemorykiller from CAF msm-3.4

this improves low memory behaviour greatly due to accounting for
lowmem_reserve as well as shmem pages.

Conflicts:
	drivers/staging/android/lowmemorykiller.c
msm: kgsl: Optimize page_alloc allocations

User memory needs to be zeroed out before it is sent to the user.
To do this, the kernel maps the page, memsets it to zero and then
unmaps it.  By virtue of mapping it, this forces us to flush the
dcache to ensure cache coherency between kernel and user mappings.
Originally, the page_alloc loop was using GFP_ZERO (which does a
map, memset, and unmap for each individual page) and then we were
additionally calling flush_dcache_page() for each page killing us
on performance.  It is far more efficient, especially for large
allocations (> 1MB), to allocate the pages without GFP_ZERO and
then to vmap the entire allocation, memset it to zero, flush the
cache and then unmap. This process is slightly slower for very
small allocations, but only by a few microseconds, and is well
within the margin of acceptability. In all, the new scheme is
faster than the default for all sizes greater than 16k, and is
almost 4X faster for 2MB and 4MB allocations which are common for
textures and very large buffer objects.

The downside is that if there isn't enough vmalloc room for the
allocation that we are forced to fallback to a slow page by
page memset/flush, but this should happen rarely (if at all) and
is only included for completeness.

CRs-Fixed: 372638
Change-Id: Ic0dedbadf3e27dcddf0f068594a40c00d64b495e
Signed-off-by: Jordan Crouse <jcrouse@codeaurora.org>
perf: Treat attr.config as u64 in perf_swevent_init()

Trinity discovered that we fail to check all 64 bits of
attr.config passed by user space, resulting to out-of-bounds
access of the perf_swevent_enabled array in
sw_perf_event_destroy().

Introduced in commit b0a873ebb ("perf: Register PMU
implementations").

Signed-off-by: Tommi Rantala <tt.rantala@gmail.com>
Cc: Peter Zijlstra <a.p.zijlstra@chello.nl>
Cc: davej@redhat.com
Cc: Paul Mackerras <paulus@samba.org>
Cc: Arnaldo Carvalho de Melo <acme@ghostprotocols.net>
Link: http://lkml.kernel.org/r/1365882554-30259-1-git-send-email-tt.rantala@gmail.com
Signed-off-by: Ingo Molnar <mingo@kernel.org>

Change-Id: I117496399c6bbd94faaef5912d18bdb7f44bcc67
msm: msm_fb: remove mmio access through mmap

Disable access to mm io and add
appropriate range checks to ensure valid accesses
through framebuffer mmap. This prevents illegal
access into memory.

CRs-Fixed: 474706
Change-Id: If25166f2732433ef967e99c716440030b567aae9
Signed-off-by: Manoj Rao <manojraj@codeaurora.org>

Integer overflow in range check when mapping framebuffer memory (CVE-2013-2596).
https://www.codeaurora.org/projects/security-advisories/integer-overflow-range-check-when-mapping-framebuffer-memory-cve-2013-2596
msm: kgsl: Detect and avoid malformed ioctl codes

Because we were using _IO_NR, one could construct a malformed ioctl
code that would avoid allocating memory yet go to a function that
expected that memory. Still use _IO_NR to index the array of ioctls,
but check that the full values match before jumping to the helper
function.

CRs-fixed: 385592
Change-Id: Ic0dedbaded469035bd0a2bb0f20fecb2a3045ca5
Signed-off-by: Jordan Crouse <jcrouse@codeaurora.org>

CVE-2012-4222:
Several integer overflows in the processing of DIAG ioctl system call
parameters allow a locally installed application to conduct denial of
service (DoS) attacks or possibly execute arbitrary code in kernel
context.
https://www.codeaurora.org/projects/security-advisories/multiple-issues-diagkgsl-system-call-handling-cve-2012-4220-cve-2012
diag: Release mutex in corner case

DIAG driver maintains a table for all registrations by remote
peripherals and user space applications. In certain cases, the
number of registrations can exceed table capacity. Thus, diag
re-allocates the table memory, to fit in all registrations.
This re-allocation stops at a threshold, even if requirement
is greater than threshold.

In such a corner case, if the requirement is greater than threshold,
then the mutex might remain locked after filling the table upto full
capacity. Adding unlocking condition to release mutex in such cases.

Change-Id: Ief412965eaaf1e1bdb1a132c03c37f43c58bc423
Signed-off-by: Shalabh Jain <shalabhj@codeaurora.org>
diag: Increase itemsize of diag memory pool.

Diag allocates memory objects from mempool for copying packet from user
space to kernel space. Fix increases oject size of mempool to 4KB and any
packet of size greater than 4KB is dropped.

CRs-Fixed: 326579
Signed-off-by: Ashay Jaiswal <ashayj@codeaurora.org>
(cherry picked from commit 1fe33273a471084bd506505c3a59c7ce95e46f93)

Change-Id: I007768b00f283debba405148d680f78e68628570
Signed-off-by: Yen-Pin Hsiao <yphsiao@codeaurora.org>
diag: Fix various issues with IOCTLs

DIAG kernel driver interacts with user space processes using
IOCTLS. Some issues, such as potential integer over/underflow,
incorrect buffer copy etc were identified in these functions.
This change fixes them.

Change-Id: Ic1e815051ae9544c911c9a5bd0c9218c1225f6d5
CRs-Fixed: 385352, 385349
Signed-off-by: Shalabh Jain <shalabhj@codeaurora.org>

Multiple issues in DIAG system call handling (CVE-2012-4220, CVE-2012-4221)
https://www.codeaurora.org/projects/security-advisories/multiple-issues-diagkgsl-system-call-handling-cve-2012-4220-cve-2012
netfilter: xt_qtaguid: update to msm-3.4

AU_LINUX_ANDROID_JB_MR2.04.03.00.110.011

Change-Id: I8912242c95270f21b0d21dc859c56f0d0342d8c0
mm: ashmem: Make sure vma is valid while flushing

Ensure that the vma that the ashmem region is tied to
is valid before flushing and hold the mm semaphore so
that the vma does not get destroyed from under while
it's being flushed.

CRs-Fixed: 326685
Change-Id: I86320ffe9e6570e6ffa7dda68ab26be7aed86afd
Signed-off-by: Shubhraprakash Das <sadas@codeaurora.org>
USB: msm72k_udc: Don't handle asynchronous interrupt

USB enter low power mode after detecting the wall charger. When
wall-charger is disconnected, USB hardware generate asynchronous interrupt
for notifying B-Session Valid low condition. OTG and UDC share the same
interrupt line. The OTG interrupt handler is called first and it disable
the IRQ and schedule the resume work. As the interrupt is received,
the kernel will invoke all shared interrupt handlers though the IRQ is
disabled by the first handler.

The UDC interrupt handler is accessing USB registers before clocks are
turned on. Avoid unclocked access by ignoring the asynchronous interrupt.

CRs-Fixed: 442012
Change-Id: I58c6a6e192ce274ab265b5d7c8d95ad84dc55efd
Signed-off-by: Rajkumar Raghupathy <raghup@codeaurora.org>
video: msm_fb: Increase display timeout to 2 seconds

One second time out for no frame update, as in current implementation,
does not allow CABL to reach minimum backlight level possible because
histograms dont get generated after one second. So increase time out
period to two seconds which seem to be sufficient for complete black to
complete white and vice versa transitions.

CRs-fixed: 370804
Signed-off-by: Pravin Tamkhane <pravint@codeaurora.org>
Signed-off-by: Carl Vanderlip <carlv@codeaurora.org>
(cherry picked from commit 1bb4edf9242b0397975636a4442318713a53b5e6)

Change-Id: I298dbc94c32035bc7872341a028af979d74fe38f
Signed-off-by: Ramakrishna Prasad N <crpn@codeaurora.org>
msm_serial: Don't configure UART IRQ as wakeup interrupt

Currently UART IRQ is being configured as wakeup interrupt once
UART port is being opened and not unconfigured on closing the port.
It is not required to configure UART IRQ as wakeup interrupt as
wakeup functionality is only supported through UART RX GPIO IRQ line
if it is required and enabled for the use case. Enabling UART IRQ as
wakeup interrupt consumes more power on TCXO state.

CRs-Fixed: 452191
Change-Id: I25f86316fdbd356547e0b6921bde23aff3a56355
Signed-off-by: Saket Saurabh <ssaurabh@codeaurora.org>
msm: kgsl: Calculate busy interval considering GPU freq as float

GPU freq could be non-integral value and treating it as an integer
to calculate GPU busy insterval leads to higher busy interval
and more often we see negative idle stats. This change caculates
busy interval by treating gpu freq to the correct precision.

Change-Id: Ic54130803d7a0436b4ba31b09915eb7165d16590
CRs-fixed: 454972
Signed-off-by: Vinay Roy <vroy@codeaurora.org>
msm: kgsl: Hold the pm_qos vote at all times when ACTIVE

The GPU needs access to the L2 cache while running.  If the
CPU is not also active using the cache can lead to stability
issues.  Keep the CPU out of idle power collapse at all times
while the GPU is running.

CRs-Fixed: 397489

Change-Id: Iab2d8c601e903aadc4060f7c6d67bc128840edbf
Signed-off-by: Lucille Sylvester <lsylvest@codeaurora.org>
mmc: msm_sdcc: fix a type mismatch in msmsdccc_config_dma()

msmsdcc_prep_xfer() function returns a signed integer value but
caller function msmsdcc_config_dma() is storing this value in an unsigned
integer variable which is obviously not the correct thing to do.

CRs-Fixed: 476578
Change-Id: I39159e2f4f73c7f54de359cbe4faba5e902915ff
Signed-off-by: Subhash Jadavani <subhashj@codeaurora.org>
ashmem: avoid deadlock between read and mmap calls

Avoid holding ashmem_mutex across code that can page fault.  Page faults
grab the mmap_sem for the process, which are also held by mmap calls
prior to calling ashmem_mmap, which locks ashmem_mutex.  The reversed
order of locking between the two can deadlock.

The calls that can page fault are read() and the ASHMEM_SET_NAME and
ASHMEM_GET_NAME ioctls.  Move the code that accesses userspace pages
outside the ashmem_mutex.

Bug: 9261835
Change-Id: If1322e981d29c889a56cdc9dfcbc6df2729a45e9
Signed-off-by: Todd Poynor <toddpoynor@google.com>
usb: gadget: composite: Fix a bug in delayed status handling

The SET_CONFIGURATION control request's status phase is delayed
till the new config change is handled by the file-storage thread.
If the cable is disconnected or the bus is reset before the
previous config is handled, then composite driver is not notified
about the delayed status.  As a result of which, the delayed_status
field of composite device structure remains non-zero.  The status
phase of next SET_CONFIGURATION control request is not sent.
This makes the gadget unusable.

Calling usb_composite_setup_continue() after the disconnect or reset
does not make any sense.  If the host sends another control request
before the status phase of the previous control request is sent, the
delayed_status must be reset to zero.  This is not straight forward
as the UDC handles some control requests without delegating them to
the composite driver.  A simple fix would be resetting the delayed
status value after the disconnect/reset.

CRs-Fixed: 501527
Change-Id: I67c832afc88c9e7d025247e539b7223fd83644d7
Signed-off-by: Pavankumar Kondeti <pkondeti@codeaurora.org>
msm: rpc: hold spinlock while doing wait_event

To prevent a race condition between wake_up called by
msm_rpcrouter_xprt_notify and wait_event in rr_read
hold a spinlock irqsave to prevent the system from going into
sleep when there is pending SMD data to process.

CRs-Fixed: 393416
Signed-off-by: Angshuman Sarkar <angshuman@codeaurora.org>
(cherry picked from commit 902de08f6670ddba147609e8b9f895dadf2275d9)

Change-Id: Ib7d8a868e1e968fcc8eeca53e2c1c2eeec8dd965
Signed-off-by: Sridhar Gujje <sgujje@codeaurora.org>

Conflicts:
	arch/arm/mach-msm/smd_rpcrouter.c