Upgrade ashmem to kk_3.5_rb1.21 from drivers/staging/android (4 commits)

drivers: staging: android: Fix ashmem vm range comparison to stop roll-over

Every time ASHMEM_CACHE_INV_RANGE was sent to an IOCTL a roll-over was
occurring, causing the check to fail. This was comparing a start + size
range with a start + end range, and if the start + end was less than the
start + size the ioctl would fail. The end value was always equal to
start + size from all tests I ran, and since the roll-over occurred with
start + end, it was always less than start. Setting the check to compare
start + size > end fixes this.

Change-Id: I3e4356ab40d8c745fd91eb0cc6b1aaed73494140
Signed-off-by: Matthew Trusten <mtrusten@codeaurora.org>

staging: android: ashmem: get_name,set_name not to hold ashmem_mutex

Problem:
There exists a path in ashmem driver that could lead to acquistion
of mm->mmap_sem, ashmem_mutex in reverse order. This could lead
to deadlock in the system.
For Example, assume that mmap is called on a ashmem region
in the context of a thread say T1.
 sys_mmap_pgoff (1. acquires mm->mmap_sem)
  |
   --> mmap_region
 	|
         ----> ashmem_mmap (2. acquires asmem_mutex)
 Now if there is a context switch after 1 and before 2,
 and if another thread T2 (that shares the mm struct) invokes an
 ioctl say ASHMEM_GET_NAME, this can lead to the following path

ashmem_ioctl
  |
  -->get_name (3. acquires ashmem_mutex)
	|
	---> copy_to_user (4. acquires the mm->mmap_sem)
Note that the copy_to_user could lead to a valid fault if no
physical page is allocated yet for the user address passed.
Now T1 has mmap_sem and is waiting for ashmem_mutex.
and T2 has the ashmem_mutex and is waiting for mmap_sem
Thus leading to deadlock.

Solution:
Do not call copy_to_user or copy_from_user while holding the
ahsmem_mutex. Instead copy this to a local buffer that lives
in the stack while holding this lock. This will maintain data
integrity as well never reverse the lock order.

Testing:
Created a unit test case to reproduce the problem.
Used the same to test this fix on kernel version 3.4.0
Ported the same patch to 3.8

Change-Id: Ib66f6265da91691acfd3be9ea8f5c9332c978751
CRs-Fixed: 600362
Signed-off-by: Shankar Brahadeeswaran <shankoo77@gmail.com>
Reviewed-by: Dan Carpenter <dan.carpenter@oracle.com>
Acked-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Git-commit: e5834d620d61d01444c41958f1816d688a96433c
Git-repo: git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
Signed-off-by: Laura Abbott <lauraa@codeaurora.org>

ashmem: avoid deadlock between read and mmap calls

Avoid holding ashmem_mutex across code that can page fault.  Page faults
grab the mmap_sem for the process, which are also held by mmap calls
prior to calling ashmem_mmap, which locks ashmem_mutex.  The reversed
order of locking between the two can deadlock.

The calls that can page fault are read() and the ASHMEM_SET_NAME and
ASHMEM_GET_NAME ioctls.  Move the code that accesses userspace pages
outside the ashmem_mutex.

Bug: 9261835
Change-Id: If1322e981d29c889a56cdc9dfcbc6df2729a45e9
CRs-Fixed: 600362
Signed-off-by: Todd Poynor <toddpoynor@google.com>
Git-repo: https://android.googlesource.com/kernel/common/
Git-commit: 0a9dea28170c90a7265250b66cc0df1253b0c501
Signed-off-by: Laura Abbott <lauraa@codeaurora.org>

staging: ashmem: Fix the build failure when OUTER_CACHE is enabled

ashmem driver is failing to build when OUTER_CACHE is enabled
through the CACHE_L2X0 option. Fix it with appropriate new
offset routines.

Change-Id: I298f9bb32899f20e17407b5210d0859d6308c035
Signed-off-by: Trilok Soni <tsoni@codeaurora.org>
p505-p506-p509: Initial commit for KitKat - FUSE_FS is required for sdcard

Change-Id: I0515c709950a30f0245297355a394ee2adb84828
gpu/kgsl: update to ics_chocolate

AU_LINUX_ANDROID_ICS_CHOCOLATE.04.00.04.005.325

Change-Id: I4adf8f2d732526735d656bcf0f886fc69e1ba681
msm/display: ics_chocolate_rb4.2 -> ics_chocolate

Change-Id: If0611e38fd8df931b2a67a6c8f23ed19b299e03f
netfilter: qtaguid: initialize a local var to keep compiler happy.

There was a case that might have seemed like new_tag_stat was not
initialized and actually used.
Added comment explaining why it was impossible, and a BUG()
in case the logic gets changed.

Change-Id: I1eddd1b6f754c08a3bf89f7e9427e5dce1dfb081
Signed-off-by: JP Abgrall <jpa@google.com>
p50x_defconfig: Update netfilter options

Change-Id: I0ecd4d1348eca7e712e5998be99aa565a55bceda
various: compilation fixes for gcc 4.6

These changes are required to compile successfully with
gcc version 4.6.

The -Wno-address option is applied to some files to
bypass a warning triggered by an rcu macro. The
warning is fixed cleanly upstream, but that fix is too
risky to backport, so it is better to just silence it
this way.

Change-Id: I787ad2db6e649d29874b7b624c2b28f686236466
Signed-off-by: Steve Muckle <smuckle@codeaurora.org>
cifs: silence compiler warnings showing up with gcc-4.7.0

gcc-4.7.0 has started throwing these warnings when building cifs.ko.

  CC [M]  fs/cifs/cifssmb.o
fs/cifs/cifssmb.c: In function ‘CIFSSMBSetCIFSACL’:
fs/cifs/cifssmb.c:3905:9: warning: array subscript is above array bounds [-Warray-bounds]
fs/cifs/cifssmb.c: In function ‘CIFSSMBSetFileInfo’:
fs/cifs/cifssmb.c:5711:8: warning: array subscript is above array bounds [-Warray-bounds]
fs/cifs/cifssmb.c: In function ‘CIFSSMBUnixSetFileInfo’:
fs/cifs/cifssmb.c:6001:25: warning: array subscript is above array bounds [-Warray-bounds]

This patch cleans up the code a bit by using the offsetof macro instead
of the funky "&pSMB->hdr.Protocol" construct.

Change-Id: I07e9f23107483d63811e7e7fd79225bb3898d7e7
Signed-off-by: Jeff Layton <jlayton@redhat.com>
Signed-off-by: Steve French <sfrench@us.ibm.com>
netfilter: xt_qtaguid: update to msm-3.4

AU_LINUX_ANDROID_JB_MR2.04.03.00.110.011

Change-Id: I8912242c95270f21b0d21dc859c56f0d0342d8c0
backport lowmemorykiller from CAF msm-3.4

this improves low memory behaviour greatly due to accounting for
lowmem_reserve as well as shmem pages.

Change-Id: I1997d142f90afdc998f4bdf88808696bd2866394
add extra free kbytes tunable

Add a userspace visible knob to tell the VM to keep an extra amount
of memory free, by increasing the gap between each zone's min and
low watermarks.

This is useful for realtime applications that call system
calls and have a bound on the number of allocations that happen
in any short time period.  In this application, extra_free_kbytes
would be left at an amount equal to or larger than than the
maximum number of allocations that happen in any burst.

It may also be useful to reduce the memory use of virtual
machines (temporarily?), in a way that does not cause memory
fragmentation like ballooning does.

[ccross]
Revived for use on old kernels where no other solution exists.
The tunable will be removed on kernels that do better at avoiding
direct reclaim.

Change-Id: I765a42be8e964bfd3e2886d1ca85a29d60c3bb3e
Signed-off-by: Rik van Riel<riel@redhat.com>
Signed-off-by: Colin Cross <ccross@android.com>
This is a combination of 2 commits.

staging: android: lowmemorykiller: Add config option to support oom_adj values

The conversion to use oom_score_adj instead of the deprecated oom_adj
values breaks existing user-space code. Add a config option to convert
oom_adj values written to oom_score_adj values if they appear to be
valid oom_adj values.

Change-Id: I68308125059b802ee2991feefb07e9703bc48549
Signed-off-by: Arve Hjønnevåg <arve@android.com>

android/lowmemorykiller: Ignore tasks with freed mm

A killed task can stay in the task list long after its
memory has been returned to the system, therefore
ignore any tasks whose mm struct has been freed.

Change-Id: I76394b203b4ab2312437c839976f0ecb7b6dde4e
CRs-fixed: 450383
Signed-off-by: Liam Mark <lmark@codeaurora.org>

Change-Id: I68308125059b802ee2991feefb07e9703bc48549
p500: Enable some memory configs to use zRAM swap effectively

Change-Id: I45b8e53d22c8d3b51181437f4cb5f541e5ff76f8
lzo: This is a combination of 5 commits.

lib/lzo: Rename lzo1x_decompress.c to lzo1x_decompress_safe.c

Rename the source file to match the function name and thereby
also make room for a possible future even slightly faster
"non-safe" decompressor version.

Change-Id: I482ee415d43c5aaa77d34946ae1fa0af5465b007
Signed-off-by: Markus F.X.J. Oberhumer <markus@oberhumer.com>

lib/lzo: Update LZO compression to current upstream version

This commit updates the kernel LZO code to the current upsteam version
which features a significant speed improvement - benchmarking the Calgary
and Silesia test corpora typically shows a doubled performance in
both compression and decompression on modern i386/x86_64/powerpc machines.

Change-Id: Ifcde45460c856644097bdeb612f0d68c6429f03c
Signed-off-by: Markus F.X.J. Oberhumer <markus@oberhumer.com>

lib/lzo: huge LZO decompression speedup on ARM by using unaligned access

Change-Id: I4dc172b2822504c3f2db1913ed9404e031861d55
Signed-off-by: Markus F.X.J. Oberhumer <markus@oberhumer.com>

ARM: kconfig: select HAVE_EFFICIENT_UNALIGNED_ACCESS for CPUv6+ && MMU

Modern ARM CPUs can perform efficient unaligned memory accesses in
hardware and this feature is relied up on by code such as the dcache
word-at-a-time name hashing.

[pawitp: adapt to kernel 3.0]

Change-Id: I41559fc9255229e2601f4bef28aa8d48246156b7
Signed-off-by: Will Deacon <will.deacon@arm.com>

mm: remove compressed copy from zram in-memory

Swap subsystem does lazy swap slot free with expecting the page would be
swapped out again so we can avoid unnecessary write.

But the problem in in-memory swap(ex, zram) is that it consumes memory
space until vm_swap_full(ie, used half of all of swap device) condition
meet.  It could be bad if we use multiple swap device, small in-memory
swap and big storage swap or in-memory swap alone.

This patch makes swap subsystem free swap slot as soon as swap-read is
completed and make the swapcache page dirty so the page should be
written out the swap device to reclaim it.  It means we never lose it.

I tested this patch with kernel compile workload.

1. before

   compile time : 9882.42
   zram max wasted space by fragmentation: 13471881 byte
   memory space consumed by zram: 174227456 byte
   the number of slot free notify: 206684

2. after

   compile time : 9653.90
   zram max wasted space by fragmentation: 11805932 byte
   memory space consumed by zram: 154001408 byte
   the number of slot free notify: 426972

[akpm@linux-foundation.org: tweak comment text]
[artem.savkov@gmail.com: fix BUG due to non-swapcache pages in end_swap_bio_read()]
[akpm@linux-foundation.org: invert unlikely() test, augment comment, 80-col cleanup]
Signed-off-by: Dan Magenheimer <dan.magenheimer@oracle.com>
Signed-off-by: Minchan Kim <minchan@kernel.org>
Signed-off-by: Artem Savkov <artem.savkov@gmail.com>
Cc: Hugh Dickins <hughd@google.com>
Cc: Seth Jennings <sjenning@linux.vnet.ibm.com>
Cc: Nitin Gupta <ngupta@vflare.org>
Cc: Konrad Rzeszutek Wilk <konrad@darnok.org>
Cc: Shaohua Li <shli@kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

Conflicts:
	mm/page_io.c

Change-Id: I8f11fb7f0391954435002e7f290352f311c907d4
Revert "drivers: staging: snappy compression added"

This reverts commit 8a7a2a2b99825f66a64b3a17fd42d2d7d27261fa.

Change-Id: I0f65ae3af6816788b021b06e570cdb1289924f97
bluetooth: jb_mr1_chocolate -> jb_2.6

Change-Id: Iff040d84e04bd57bf5979cc76a6580eeaffe47af
Recovery config for p500

Remove some debug, ipv6 and netfilter options
Reduced 200KB

Change-Id: If2216123eb738a5ececbe1237f3051358c11a794
gpu: ion: Add dummy msm_ion header file

The msm specific parts of ion.h are being moved into a new header
file. For now, add a dummy header file to get clients transitioned
over.

Change-Id: Iac039678e1c3f15d87e67aa667f7e9883ca16669
Signed-off-by: Laura Abbott <lauraa@codeaurora.org>
Merge branch 'cm-11.0' of https://github.com/androidarmv6/android_kernel_lge_msm7x27-3.0.x into cm-11.0
zram & qcache & zsmalloc: update to LNX.LA.3.5.1-00710-8x26.0

Change-Id: Icb5167e3d8d4149ad71282d17a9318c15c3879e3