Revert "tcp: auto corking"

This reverts commit 91266530c799f86773e700b3375595a5627a8309.
Revert "tcp: TCP Small Queues"

This reverts commit f4d4b7636e675c455a967d91d370f279298d8c39.
HID: input: generic hidinput_input_event handler

The hidinput_input_event() callback converts input events written from
userspace into HID reports and sends them to the device. We currently
implement this in every HID transport driver, even though most of them do
the same.

This provides a generic hidinput_input_event() implementation which is
mostly copied from usbhid. It uses a delayed worker to allow multiple LED
events to be collected into a single output event.
We use the custom ->request() transport driver callback to allow drivers
to adjust the outgoing report and handle the request asynchronously. If no
custom ->request() callback is available, we fall back to the generic raw
output report handler (which is synchronous).

Drivers can still provide custom hidinput_input_event() handlers (see
logitech-dj) if the generic implementation doesn't fit their needs.

Signed-off-by: David Herrmann <dh.herrmann@gmail.com>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
Signed-off-by: Michael Wright <michaelwr@google.com>

Conflicts:
	drivers/hid/hid-input.c

Bug: 13350426
Change-Id: I5bdf6c9c5c0523071248b210c41927ab8d3b0059
(cherry picked from commit 5b1b76478c40b5415fa6f49c3cd0de65ee47b094)
mm: Increase number of GFP masks

The __GFP_CMA mask is now placed after all available GFP masks.
With this we need to increase the total number of GFP flags.
Do so accordingly.

Bug: 17494249
CRs-Fixed: 648978
Change-Id: Id154f604cb065bed2bed7f35f7bc995b90b87130
Signed-off-by: Laura Abbott <lauraa@codeaurora.org>
Signed-off-by: Naveen Ramaraj <nramaraj@codeaurora.org>
nf: IDLETIMER: time-stamp and suspend/resume handling.

Message notifications contains an additional timestamp field in nano seconds.
The expiry time for the timers are modified during suspend/resume.
If timer was supposed to expire while the system is suspended then a
notification is sent when it resumes with the timestamp of the scheduled expiry.

Removes the race condition for multiple work scheduled.

Bug: 13247811

Change-Id: I752c5b00225fe7085482819f975cc0eb5af89bff
Signed-off-by: Ruchi Kandoi <kandoiruchi@google.com>
prctl: adds PR_SET_TIMERSLACK_PID for setting timer slack of an arbitrary thread.

Second argument is similar to PR_SET_TIMERSLACK, if non-zero then the
slack is set to that value otherwise sets it to the default for the thread.

Takes PID of the thread as the third argument.

This allows power/performance management software to set timer slack for
other threads according to its policy for the thread (such as when the
thread is designated foreground vs. background activity)

Change-Id: I744d451ff4e60dae69f38f53948ff36c51c14a3f
Signed-off-by: Ruchi Kandoi <kandoiruchi@google.com>
f_qdss: Delete a few unused functions.

Signed-off-by: Mohamad Ayyash <mkayyash@google.com>
Change-Id: I629072b2146fe9ee1837550078a50ba1fe37eae7
android: base-cfg: enable DM_VERITY (used for secureboot)

Change-Id: I68d769f97ffa76bb45e65d34a96dd7f558c02d08
Signed-off-by: JP Abgrall <jpa@google.com>
ASoC: msm: qdsp6: Fix pop noise seen with touch tone during playback

Issue: When a session is opened for playback of the touch tone and
	routed through the COPP, the PBE and IIR params are being
	reconfigured in the COPP every time a session is open.

Rootcause:Configuring the PBE/IIR in the COPP every time a session
           is open.
Fix: Configuring the PBE and IIR param in the COPP one time a session
      is open

CRs-Fixed: 541722
Prev-Change-Id: If0d1a8c6893a94186e1c6c2a75432d2f4a89f842
Signed-off-by: Satish Kamuju <skamuj@codeaurora.org>

Change-Id: If51d472b554e358f2eada257b7cebb97682683b0
ALSA: pcm: check for integer overflow during multiplication

Channel info data structure is parsed from userspace and if
user does not set the no. of channels correctly, it could lead
to security vulnerability if we don't check for overflow when the
no. of channels is multiplied with pcm bit width. Add a condition
to check for overflow during multiplication.

CRs-fixed: 537818
Prev-Change-Id: Ia3c31406dd8b7627ea704c076643c0348582da28
Signed-off-by: Phani Kumar Uppalapati <phaniu@codeaurora.org>

Change-Id: I577e28017baae43f0ca49141916381c7e791a281
ASoC: msm: qdsp6v2: Copy frame data based on frame length

Copying data based on count will result in copying
uninitialized data to userspace which can potentially
disclose sensitive data. Fix by copying data based on
frame instead.

CRs-Fixed: 552528, 552531
Prev-Change-Id: I307b285ef2aefe00b953cf650582e9ff7e03ceb1
Signed-off-by: Shiv Maliyappanahalli <smaliyap@codeaurora.org>

Conflicts:

	sound/soc/msm/qdsp6v2/msm-pcm-voip-v2.c

Change-Id: Ie468d0ccdbd6e253af9bbc7731559856fa302e6e
ALSA: core: Fix crash by avoiding appl_ptr crossing 32-bit boundary

Incase of A2DP usecase using proxy driver, appl_ptr has
boundary value as 0x60000000 frames in sw_params for stereo(2 channels).
When this value crosses 0x40000000, then userspace calculating
appl_ptr at bytes results in crossing 32-bit value 0x100000000,
and points to 0x0 offset which can result in crash or pop.
To avoid above scenario, set the sw_params appl_ptr boundary value
within 0x40000000. Added proper check at sw_params update
to set this value correctly within 32-bit boundary(frames).

Prev-Change-Id: I537a04156699d90549a0a468ae19539ecd552d3b
CRs-Fixed: 483203
Signed-off-by: Laxminath Kasam <lkasam@codeaurora.org>

Change-Id: Ife1e9debfce7cc62c88ca9587006f0e4e44a7a64
ASoC: msm: qdsp6v2: Fix buffer overflow in voice driver

Userspace registers calibration data with acdb driver
through ioctls. Voice driver registers the calibration
data with CVD by querying acdb data from acdb driver and
copies the calibration data in apr message.

The size of the calibration data can be controlled by userspace
and can result in buffer overflow if the calibration size is
greater than the destination buffer size.
Reject acdb data if the size is greater than the size of
destination buffer.

Prev-Change-Id: I1b495390d67907afc608ed8233bf916777d38e11
CRs-fixed: 548872
Signed-off-by: Shiv Maliyappanahalli <smaliyap@codeaurora.org>

Conflicts:

	sound/soc/msm/qdsp6v2/q6voice.c

Change-Id: Ic50d948134a72ab416be1a46ba59e33beb04827d
SELinux: Reduce overhead of mls_level_isvalid() function call

Date	Mon, 10 Jun 2013 13:55:08 -0400

v4->v5:
  - Fix scripts/checkpatch.pl warning.

v3->v4:
  - Merge the 2 separate while loops in ebitmap_contains() into
    a single one.

v2->v3:
  - Remove unused local variables i, node from mls_level_isvalid().

v1->v2:
 - Move the new ebitmap comparison logic from mls_level_isvalid()
   into the ebitmap_contains() helper function.
 - Rerun perf and performance tests on the latest v3.10-rc4 kernel.

While running the high_systime workload of the AIM7 benchmark on
a 2-socket 12-core Westmere x86-64 machine running 3.10-rc4 kernel
(with HT on), it was found that a pretty sizable amount of time was
spent in the SELinux code. Below was the perf trace of the "perf
record -a -s" of a test run at 1500 users:

  5.04%            ls  [kernel.kallsyms]     [k] ebitmap_get_bit
  1.96%            ls  [kernel.kallsyms]     [k] mls_level_isvalid
  1.95%            ls  [kernel.kallsyms]     [k] find_next_bit

The ebitmap_get_bit() was the hottest function in the perf-report
output.  Both the ebitmap_get_bit() and find_next_bit() functions
were, in fact, called by mls_level_isvalid(). As a result, the
mls_level_isvalid() call consumed 8.95% of the total CPU time of
all the 24 virtual CPUs which is quite a lot. The majority of the
mls_level_isvalid() function invocations come from the socket creation
system call.

Looking at the mls_level_isvalid() function, it is checking to see
if all the bits set in one of the ebitmap structure are also set in
another one as well as the highest set bit is no bigger than the one
specified by the given policydb data structure. It is doing it in
a bit-by-bit manner. So if the ebitmap structure has many bits set,
the iteration loop will be done many times.

The current code can be rewritten to use a similar algorithm as the
ebitmap_contains() function with an additional check for the
highest set bit. The ebitmap_contains() function was extended to
cover an optional additional check for the highest set bit, and the
mls_level_isvalid() function was modified to call ebitmap_contains().

With that change, the perf trace showed that the used CPU time drop
down to just 0.08% (ebitmap_contains + mls_level_isvalid) of the
total which is about 100X less than before.

  0.07%            ls  [kernel.kallsyms]     [k] ebitmap_contains
  0.05%            ls  [kernel.kallsyms]     [k] ebitmap_get_bit
  0.01%            ls  [kernel.kallsyms]     [k] mls_level_isvalid
  0.01%            ls  [kernel.kallsyms]     [k] find_next_bit

The remaining ebitmap_get_bit() and find_next_bit() functions calls
are made by other kernel routines as the new mls_level_isvalid()
function will not call them anymore.

This patch also improves the high_systime AIM7 benchmark result,
though the improvement is not as impressive as is suggested by the
reduction in CPU time spent in the ebitmap functions. The table below
shows the performance change on the 2-socket x86-64 system (with HT
on) mentioned above.

+--------------+---------------+----------------+-----------------+
|   Workload   | mean % change | mean % change  | mean % change   |
|              | 10-100 users  | 200-1000 users | 1100-2000 users |
+--------------+---------------+----------------+-----------------+
| high_systime |     +0.1%     |     +0.9%      |     +2.6%       |
+--------------+---------------+----------------+-----------------+
Signed-off-by: Waiman Long <Waiman.Long@hp.com>
Signed-off-by: Paul Reioux <reioux@gmail.com>
video: msm: mipi_novatek: Fix snprintf length usage
REVERT THIS BEFORE UPDATE ion: Rename heap_mask when used in userspace

The L userspace expects this field to have a different name :/