Trim MSM_PMEM_MDP_SIZE

Gives about 5mb more free RAM
gpu: ion: Add dummy msm_ion header file

The msm specific parts of ion.h are being moved into a new header
file. For now, add a dummy header file to get clients transitioned
over.

Change-Id: Iac039678e1c3f15d87e67aa667f7e9883ca16669
Signed-off-by: Laura Abbott <lauraa@codeaurora.org>
cpufreq: update Ondemand governor from experimental-3.10 kernel

Change-Id: Idbac8ae56c5b304d43c2baf4d73e49b8b58f455c

Conflicts:
	drivers/cpufreq/cpufreq_ondemand.c
base: genlock: Properly destroy handle resources

The resources allocated for a handle were not being freed on device
release.  This included releasing the lock.  Unfortunately, the
lock release had a fput() too many which was screwing up the
reference counting on the file descriptors.  When attaching a lock,
we only need the file pointer for a short time so fput() it back
immediately.  That way, only there will only be one reference to
the lock per process, and the process will be responsible for
closing the fd directly and the fput() in genlock_release_lock
is no longer needed.

CRs-fixed: 322645
Change-Id: Ic0dedbad55300a2f8463c800cf8361719583b0b8
Signed-off-by: Jordan Crouse <jcrouse@codeaurora.org>
base: genlock: Avoid a race condition when releasing locks

Avoid a race condition if a lock gets released by all owners
but a process fails to close a lock file descriptor and tries
to reuse it.  Clearing the pointers to the data will ensure
that attaching a dead lock will return an error.

Change-Id: Ic0dedbadd693c7a22b027052cdd247370b28a7c5
Signed-off-by: Jordan Crouse <jcrouse@codeaurora.org>
base: genlock: Add error messages for failure cases

Signed-off-by: Naomi Luis <nluis@codeaurora.org>
Change-Id: I833e480abfc11ce4aa00a5ae46144895429a0339
base: genlock: Check for instances where handle is NULL

Check for the possibility of NULL handles passed into the
in-kernel API functions and return error where appropriate.
There is a non-zero chance that the private_data will be
cleared while the FD is still active, so check in the ioctl()
function as well.

(cherry picked from commit a73ed097420c53451e843ae61d9aadc8fefabc94)

Change-Id: If481b98a6a2ab01ab788c23bffe9df7ab8bc6aee
CRs-fixed: 332835
Signed-off-by: Jordan Crouse <jcrouse@codeaurora.org>
base: genlock: Remove genlock_release_lock and associated ioctl

Allowing a lock to be asynchronously released while a handle
was still active turned out to be too dangerous to use in a
multi-threaded environment and it served no pratical
purpose anyway.  Handles now hold an attached lock until they
are destroyed.

(cherry picked from commit 4df70a254d9ddea0ee4bede39d4d12e6360e5b99)

Change-Id: I969ac3cf84c5982cc7c03c5651c7fe328567c02b
CRs-fixed: 333141
Signed-off-by: Jordan Crouse <jcrouse@codeaurora.org>
base: genlock: Use a signed long for the result from wait_timeout

interruptible_wait_timeout returns a signed long, so make sure that
we use a signed long to hold the result. Using an unsigned value would
horribly misinterpet an error such as -ERESTARTSYS.

CRs-Fixed: 341347
Signed-off-by: Jordan Crouse <jcrouse@codeaurora.org>
(cherry picked from commit be669bc92358653a46c63f2352e6d981f9ed3bdf)

Change-Id: Ifcf555f8719f9c74fdb6d8b5cf2a32582988335b
Signed-off-by: Ram Kumar Chakravarthy Chebathini <rcheba@codeaurora.org>
Staging: android: binder: Don't call dump_stack in binder_vma_open

If user-space partially unmaps the driver, binder_vma_open
would dump the kernel stack. This is not a kernel bug however
and will be treated as if the whole area was unmapped once
binder_vma_close gets called.

Signed-off-by: Arve Hjønnevåg <arve@android.com>
Cc: stable <stable@vger.kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
Signed-off-by: stratosk <stratosk@semaphore.gr>
Staging: android: binder: Fix crashes when sharing binder file between processes

Opening the binder driver and sharing the file returned with
other processes (e.g. by calling fork) can crash the kernel.
Prevent these crashes with the following changes:
- Add a mutex to protect against two processes mmapping the
  same binder_proc.
- After locking mmap_sem, check that the vma we want to access
  (still) points to the same mm_struct.
- Use proc->tsk instead of current to get the files struct since
  this is where we get the rlimit from.

Signed-off-by: Arve Hjønnevåg <arve@android.com>
Cc: stable <stable@vger.kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: stratosk <stratosk@semaphore.gr>
drivers:staging:android Typos: fix some comments that have typos in them.

Below is a patch that fixes some typos in some comments.

Signed-off-by: Justin P. Mattock <justinmattock@gmail.com>
Cc: Randy Dunlap <rdunlap@xenotime.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: stratosk <stratosk@semaphore.gr>
Staging:android: Change type for binder_debug_no_lock switch to bool

GCC warns that module_param_named() indirectly returns a bool type value
which is different from 'int' type binder_debug_no_lock declared. Change
it to bool because it is a internal switch for debugging.

Signed-off-by: Zhengwang Ruan <ruan.zhengwang@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: stratosk <stratosk@semaphore.gr>
Staging: android: binder: Fix use-after-free bug

binder_update_page_range could read freed memory if the vma of the
selected process was freed right before the check that the vma
belongs to the mm struct it just locked.

If the vm_mm pointer in that freed vma struct had also been rewritten
with a value that matched the locked mm struct, then the code would
proceed and possibly modify the freed vma.

Signed-off-by: Arve Hjønnevåg <arve@android.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: stratosk <stratosk@semaphore.gr>
Staging: android: binder: Remove an inconsequential conditional macro

Removes an inconsequential conditional macro.

Cc: Arve Hjønnevåg <arve@android.com>
Signed-off-by: Sachin Kamat <sachin.kamat@linaro.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: stratosk <stratosk@semaphore.gr>
binder: don't allow mmap() by process other than proc->tsk

we really shouldn't do get_files_struct() on a different process
and use it to modify the sucker later on.

Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
Signed-off-by: stratosk <stratosk@semaphore.gr>
Staging: android: binder: Add some missing binder_stat_br calls

Cached thread return errors, death notifications and new looper
requests were not included in the stats.

Signed-off-by: Arve Hjønnevåg <arve@android.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: stratosk <stratosk@semaphore.gr>
Staging: android: binder: Allow using highmem for binder buffers

The default kernel mapping for the pages allocated for the binder
buffers is never used. Set the __GFP_HIGHMEM flag when allocating
these pages so we don't needlessly use low memory pages that may
be required elsewhere.

Signed-off-by: Arve Hjønnevåg <arve@android.com>
Cc: stable <stable@vger.kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: stratosk <stratosk@semaphore.gr>
staging: android: Fix two checkpatch issues in binder.c

This fixes two instances of
"static const char * array should probably be static const char * const"

I have seen other commits doing this in other files, so I am
assuming it should be done here as well.

Please tell me if this is wrong :)

Signed-off-by: Cruz Julian Bishop <cruzjbishop@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: stratosk <stratosk@semaphore.gr>
[Staging: android: binder: Fix memory leak on thread/process exit

If a thread or process exited while a reply, one-way transaction or
death notification was pending, the struct holding the pending work
was leaked.

Signed-off-by: Arve Hjønnevåg <arve@android.com>
Cc: stable <stable@vger.kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: stratosk <stratosk@semaphore.gr>