Misc fixes plus the merge of 78d8cbad1b06da7c5dffc7434779cfb25f4500a0, b1d819919a625c195efe8519038dda35a47c10e7 fixes.
commit 086c6d943da142d2b60c42688c3720f7048c150d
Author: Todd Poynor <toddpoynor@google.com>
Date:   Tue Jun 4 17:29:38 2013 -0700

    ashmem: avoid deadlock between read and mmap calls

    Avoid holding ashmem_mutex across code that can page fault.  Page faults
    grab the mmap_sem for the process, which are also held by mmap calls
    prior to calling ashmem_mmap, which locks ashmem_mutex.  The reversed
    order of locking between the two can deadlock.

    The calls that can page fault are read() and the ASHMEM_SET_NAME and
    ASHMEM_GET_NAME ioctls.  Move the code that accesses userspace pages
    outside the ashmem_mutex.

    Bug: 9261835
    Change-Id: If1322e981d29c889a56cdc9dfcbc6df2729a45e9
    Signed-off-by: Todd Poynor <toddpoynor@google.com>

diff --git a/mm/ashmem.c b/mm/ashmem.c
index 66e3f23..c1078aa 100644
--- a/mm/ashmem.c
+++ b/mm/ashmem.c
@@ -221,23 +221,30 @@ static ssize_t ashmem_read(struct file *file, char __user *buf,

 	/* If size is not set, or set to 0, always return EOF. */
 	if (asma->size == 0) {
-		goto out;
+		goto out_unlock;
         }

 	if (!asma->file) {
 		ret = -EBADF;
-		goto out;
+		goto out_unlock;
 	}

+	mutex_unlock(&ashmem_mutex);
+
+	/*
+	 * asma and asma->file are used outside the lock here.  We assume
+	 * once asma->file is set it will never be changed, and will not
+	 * be destroyed until all references to the file are dropped and
+	 * ashmem_release is called.
+	 */
 	ret = asma->file->f_op->read(asma->file, buf, len, pos);
-	if (ret < 0) {
-		goto out;
+	if (ret >= 0) {
+		/** Update backing file pos, since f_ops->read() doesn't */
+		asma->file->f_pos = *pos;
 	}
+	return ret;

-	/** Update backing file pos, since f_ops->read() doesn't */
-	asma->file->f_pos = *pos;
-
-out:
+out_unlock:
 	mutex_unlock(&ashmem_mutex);
 	return ret;
 }
@@ -406,50 +413,48 @@ out:

 static int set_name(struct ashmem_area *asma, void __user *name)
 {
+	char lname[ASHMEM_NAME_LEN];
+	int len;
 	int ret = 0;

+	len = strncpy_from_user(lname, name, ASHMEM_NAME_LEN);
+	if (len < 0)
+		return len;
+	if (len == ASHMEM_NAME_LEN)
+		lname[ASHMEM_NAME_LEN - 1] = '\0';
 	mutex_lock(&ashmem_mutex);

 	/* cannot change an existing mapping's name */
-	if (unlikely(asma->file)) {
+	if (unlikely(asma->file))
 		ret = -EINVAL;
-		goto out;
-	}
+	else
+		strcpy(asma->name + ASHMEM_NAME_PREFIX_LEN, lname);

-	if (unlikely(copy_from_user(asma->name + ASHMEM_NAME_PREFIX_LEN,
-				    name, ASHMEM_NAME_LEN)))
-		ret = -EFAULT;
-	asma->name[ASHMEM_FULL_NAME_LEN-1] = '\0';
-
-out:
 	mutex_unlock(&ashmem_mutex);
-
 	return ret;
 }

 static int get_name(struct ashmem_area *asma, void __user *name)
 {
 	int ret = 0;
+	char lname[ASHMEM_NAME_LEN];
+	size_t len;

 	mutex_lock(&ashmem_mutex);
 	if (asma->name[ASHMEM_NAME_PREFIX_LEN] != '\0') {
-		size_t len;
-
 		/*
 		 * Copying only `len', instead of ASHMEM_NAME_LEN, bytes
 		 * prevents us from revealing one user's stack to another.
 		 */
 		len = strlen(asma->name + ASHMEM_NAME_PREFIX_LEN) + 1;
-		if (unlikely(copy_to_user(name,
-				asma->name + ASHMEM_NAME_PREFIX_LEN, len)))
-			ret = -EFAULT;
+		memcpy(lname, asma->name + ASHMEM_NAME_PREFIX_LEN, len);
 	} else {
-		if (unlikely(copy_to_user(name, ASHMEM_NAME_DEF,
-					  sizeof(ASHMEM_NAME_DEF))))
-			ret = -EFAULT;
+		len = strlen(ASHMEM_NAME_DEF) + 1;
+		memcpy(lname, ASHMEM_NAME_DEF, len);
 	}
 	mutex_unlock(&ashmem_mutex);
-
+	if (unlikely(copy_to_user(name, lname, len)))
+		ret = -EFAULT;
 	return ret;
 }
commit b31c22bb42d3ca2910880e50ad1e00dcd7e3d15a
Author: Eric Dumazet <edumazet@google.com>
Date:   Thu Oct 18 09:14:12 2012 +0000

    tcp: fix FIONREAD/SIOCINQ

    [ Upstream commit a3374c42aa5f7237e87ff3b0622018636b0c847e ]

    tcp_ioctl() tries to take into account if tcp socket received a FIN
    to report correct number bytes in receive queue.

    But its flaky because if the application ate the last skb,
    we return 1 instead of 0.

    Correct way to detect that FIN was received is to test SOCK_DONE.

    Reported-by: Elliot Hughes <enh@google.com>
    Signed-off-by: Eric Dumazet <edumazet@google.com>
    Cc: Neal Cardwell <ncardwell@google.com>
    Cc: Tom Herbert <therbert@google.com>
    Signed-off-by: David S. Miller <davem@davemloft.net>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
    Signed-off-by: Ed Tam <etam@google.com>

diff --git a/net/ipv4/tcp.c b/net/ipv4/tcp.c
index 09ced58..dcd64f4 100644
--- a/net/ipv4/tcp.c
+++ b/net/ipv4/tcp.c
@@ -485,14 +485,12 @@ int tcp_ioctl(struct sock *sk, int cmd, unsigned long arg)
 			 !tp->urg_data ||
 			 before(tp->urg_seq, tp->copied_seq) ||
 			 !before(tp->urg_seq, tp->rcv_nxt)) {
-			struct sk_buff *skb;

 			answ = tp->rcv_nxt - tp->copied_seq;

-			/* Subtract 1, if FIN is in queue. */
-			skb = skb_peek_tail(&sk->sk_receive_queue);
-			if (answ && skb)
-				answ -= tcp_hdr(skb)->fin;
+			/* Subtract 1, if FIN was received */
+			if (answ && sock_flag(sk, SOCK_DONE))
+				answ--;
 		} else
 			answ = tp->urg_seq - tp->copied_seq;
 		release_sock(sk);
Further fixes from  android-tegra.
Fixes
Reduce L2 cache latency.
Fix softirq periodicity for when HZ > 100
Fix for wifi deep sleep:
1) This patch (reverts IRQ priority)
2) Set CONFIG_BCMDHD_HW_OOB=y to .config (Device drivers -> Wireless LAN -> Broadcom 4329/30 wireless cards support ->
   Use out of band interrupt
3) Enjoy ;-)