Merge commit 'afabf37012e839802f9f3819f621e16aa4acefd2' into upstreaming

update from cm-13.0

Conflicts:
	Makefile
	crypto/algapi.c
	drivers/char/diag/diagchar.h
	drivers/char/diag/diagchar_core.c
	drivers/misc/Makefile
	kernel/timeconst.pl

15 files changed, 356 insertions, 4 deletions

diff --git a/drivers/battery/battery-factory.c b/drivers/battery/battery-factory.c
index 0f20fed..8df99ed 100644
--- a/drivers/battery/battery-factory.c
+++ b/drivers/battery/battery-factory.c
@@ -54,6 +54,7 @@ static struct device_attribute factory_attrs[] = {
 	FACTORY_ATTR(batt_vfocv),
 	FACTORY_ATTR(batt_lp_charging),
 	FACTORY_ATTR(batt_charging_source),
+	FACTORY_ATTR(charging_enabled),
 	FACTORY_ATTR(test_mode),
 	FACTORY_ATTR(batt_error_test),
 	FACTORY_ATTR(siop_activated),
@@ -90,6 +91,7 @@ enum {
 	BATT_VFOCV,
 	BATT_LP_CHARGING,
 	BATT_CHARGING_SOURCE,
+	CHARGING_ENABLED,
 	TEST_MODE,
 	BATT_ERROR_TEST,
 	SIOP_ACTIVATED,
@@ -218,6 +220,13 @@ static ssize_t factory_show_property(struct device *dev,
 			battery_get_info(info, POWER_SUPPLY_PROP_ONLINE);
 		i += scnprintf(buf + i, PAGE_SIZE - i, "%d\n", val);
 		break;
+	case CHARGING_ENABLED:
+		if (info->charge_real_state == POWER_SUPPLY_STATUS_CHARGING)
+			val = ENABLE;
+		else
+			val = DISABLE;
+		i += scnprintf(buf + i, PAGE_SIZE - i, "%d\n", val);
+		break;
 	case TEST_MODE:
 		val = info->battery_test_mode;
 		i += scnprintf(buf + i, PAGE_SIZE - i, "%d\n", val);
diff --git a/drivers/gpu/drm/radeon/evergreen.c b/drivers/gpu/drm/radeon/evergreen.c
index 87ff586..8cd40e0 100644
--- a/drivers/gpu/drm/radeon/evergreen.c
+++ b/drivers/gpu/drm/radeon/evergreen.c
@@ -1728,7 +1728,7 @@ static void evergreen_gpu_init(struct radeon_device *rdev)
 		rdev->config.evergreen.sx_max_export_size = 256;
 		rdev->config.evergreen.sx_max_export_pos_size = 64;
 		rdev->config.evergreen.sx_max_export_smx_size = 192;
-		rdev->config.evergreen.max_hw_contexts = 8;
+		rdev->config.evergreen.max_hw_contexts = 4;
 		rdev->config.evergreen.sq_num_cf_insts = 2;
 
 		rdev->config.evergreen.sc_prim_fifo_size = 0x40;
diff --git a/drivers/gpu/mali400/r3p2/mali/include/linux/mali/mali_utgard_ioctl.h b/drivers/gpu/mali400/r3p2/mali/include/linux/mali/mali_utgard_ioctl.h
index 6043a7d..8a90421 100644
--- a/drivers/gpu/mali400/r3p2/mali/include/linux/mali/mali_utgard_ioctl.h
+++ b/drivers/gpu/mali400/r3p2/mali/include/linux/mali/mali_utgard_ioctl.h
@@ -46,6 +46,7 @@ extern "C"
 #define MALI_IOC_GET_USER_SETTINGS          _IOWR(MALI_IOC_CORE_BASE, _MALI_UK_GET_USER_SETTINGS, _mali_uk_get_user_settings_s *)
 #define MALI_IOC_STREAM_CREATE              _IOWR(MALI_IOC_CORE_BASE, _MALI_UK_STREAM_CREATE, _mali_uk_stream_create_s *)
 #define MALI_IOC_FENCE_CREATE_EMPTY         _IOWR(MALI_IOC_CORE_BASE, _MALI_UK_FENCE_CREATE_EMPTY, _mali_uk_fence_create_empty_s *)
+#define MALI_IOC_FENCE_CREATE_SIGNALLED     _IOWR(MALI_IOC_CORE_BASE, _MALI_UK_FENCE_CREATE_SIGNALLED, _mali_uk_fence_create_signalled_s *)
 #define MALI_IOC_FENCE_VALIDATE             _IOR(MALI_IOC_CORE_BASE, _MALI_UK_FENCE_VALIDATE, _mali_uk_fence_validate_s *)
 
 #define MALI_IOC_MEM_GET_BIG_BLOCK          _IOWR(MALI_IOC_MEMORY_BASE, _MALI_UK_GET_BIG_BLOCK, void *)
diff --git a/drivers/gpu/mali400/r3p2/mali/include/linux/mali/mali_utgard_uk_types.h b/drivers/gpu/mali400/r3p2/mali/include/linux/mali/mali_utgard_uk_types.h
index 4957095..b78e6e2 100644
--- a/drivers/gpu/mali400/r3p2/mali/include/linux/mali/mali_utgard_uk_types.h
+++ b/drivers/gpu/mali400/r3p2/mali/include/linux/mali/mali_utgard_uk_types.h
@@ -70,6 +70,7 @@ typedef enum
 	_MALI_UK_GET_USER_SETTINGS,       /**< _mali_ukk_get_user_settings() *//**< [out] */
 	_MALI_UK_STREAM_CREATE,           /**< _mali_ukk_stream_create() */
 	_MALI_UK_FENCE_CREATE_EMPTY,           /**< _mali_ukk_fence_create_empty() */
+	_MALI_UK_FENCE_CREATE_SIGNALLED,  /**< _mali_ukk_fence_create_signalled() */
 	_MALI_UK_FENCE_VALIDATE,          /**< _mali_ukk_fence_validate() */
 
 	/** Memory functions */
@@ -721,7 +722,7 @@ typedef struct
  * The 16bit integer is stored twice in a 32bit integer
  * For example, for version 1 the value would be 0x00010001
  */
-#define _MALI_API_VERSION 23
+#define _MALI_API_VERSION 29
 #define _MALI_UK_API_VERSION _MAKE_VERSION_ID(_MALI_API_VERSION)
 
 /**
@@ -1144,6 +1145,15 @@ typedef struct
 	s32 fence;                      /**< [out] file descriptor describing fence */
 } _mali_uk_fence_create_empty_s;
 
+/** @brief Create signalled fence
+ */
+typedef struct
+{
+	void *ctx;                      /**< [in,out] user-kernel context (trashed on output) */
+	s32 stream;                     /**< [in] stream to create fence on */
+	s32 fence;                      /**< [out] file descriptor describing fence */
+} _mali_uk_fence_create_signalled_s;
+
 /** @brief Check fence validity
  */
 typedef struct
diff --git a/drivers/gpu/mali400/r3p2/mali/linux/mali_kernel_linux.c b/drivers/gpu/mali400/r3p2/mali/linux/mali_kernel_linux.c
index f337d09..f0265e3 100644
--- a/drivers/gpu/mali400/r3p2/mali/linux/mali_kernel_linux.c
+++ b/drivers/gpu/mali400/r3p2/mali/linux/mali_kernel_linux.c
@@ -697,6 +697,11 @@ static int mali_ioctl(struct inode *inode, struct file *filp, unsigned int cmd,
 			err = sync_fence_create_empty_wrapper(session_data, (_mali_uk_fence_create_empty_s __user *)arg);
 			break;
 #endif
+		case MALI_IOC_FENCE_CREATE_SIGNALLED:
+#if defined(CONFIG_SYNC)
+			err = sync_fence_create_signalled_wrapper(session_data, (_mali_uk_fence_create_signalled_s __user *)arg);
+			break;
+#endif
 		case MALI_IOC_FENCE_VALIDATE:
 #if defined(CONFIG_SYNC)
 			err = sync_fence_validate_wrapper(session_data, (_mali_uk_fence_validate_s __user *)arg);
diff --git a/drivers/gpu/mali400/r3p2/mali/linux/mali_sync.h b/drivers/gpu/mali400/r3p2/mali/linux/mali_sync.h
index 4415ec6..2da66df 100644
--- a/drivers/gpu/mali400/r3p2/mali/linux/mali_sync.h
+++ b/drivers/gpu/mali400/r3p2/mali/linux/mali_sync.h
@@ -39,6 +39,7 @@ _mali_osk_errcode_t mali_stream_create(const char * name, int * out_fd);
 struct sync_pt *mali_stream_create_point(int tl_fd);
 int mali_stream_create_fence(struct sync_pt *pt);
 int mali_stream_create_empty_fence(int tl_fd);
+int mali_stream_create_signalled_fence(int tl_fd);
 
 /**
  * Commit an empty timed fence
diff --git a/drivers/gpu/mali400/r3p2/mali/linux/mali_sync_user.c b/drivers/gpu/mali400/r3p2/mali/linux/mali_sync_user.c
index 7f0fddfc..ba07f30 100644
--- a/drivers/gpu/mali400/r3p2/mali/linux/mali_sync_user.c
+++ b/drivers/gpu/mali400/r3p2/mali/linux/mali_sync_user.c
@@ -165,6 +165,25 @@ int mali_stream_create_empty_fence(int tl_fd)
 	return fd;
 }
 
+int mali_stream_create_signalled_fence(int tl_fd)
+{
+	int fd;
+	mali_sync_pt *pt;
+
+	pt = mali_stream_create_point_internal(tl_fd, MALI_FALSE);
+
+	if (NULL == pt) return -ENOMEM;
+
+	fd = mali_stream_create_fence(pt);
+
+	if (0 <= fd)
+	{
+		mali_sync_signal_pt(pt, 0);
+	}
+
+	return fd;
+}
+
 _mali_osk_errcode_t mali_fence_validate(int fd)
 {
 	struct sync_fence * fence;
diff --git a/drivers/gpu/mali400/r3p2/mali/linux/mali_ukk_core.c b/drivers/gpu/mali400/r3p2/mali/linux/mali_ukk_core.c
index 1768ff2..6eaea79 100644
--- a/drivers/gpu/mali400/r3p2/mali/linux/mali_ukk_core.c
+++ b/drivers/gpu/mali400/r3p2/mali/linux/mali_ukk_core.c
@@ -152,6 +152,26 @@ int sync_fence_create_empty_wrapper(struct mali_session_data *session_data, _mal
 	return 0;
 }
 
+int sync_fence_create_signalled_wrapper(struct mali_session_data *session_data, _mali_uk_fence_create_signalled_s __user *uargs)
+{
+	_mali_uk_fence_create_signalled_s kargs;
+
+	MALI_CHECK_NON_NULL(uargs, -EINVAL);
+
+	if (0 != get_user(kargs.stream, &uargs->stream)) return -EFAULT;
+
+	kargs.fence = mali_stream_create_signalled_fence(kargs.stream);
+	if (0 > kargs.fence)
+	{
+		return kargs.fence;
+	}
+
+	kargs.ctx = NULL; /* prevent kernel address to be returned to user space */
+	if (0 != copy_to_user(uargs, &kargs, sizeof(_mali_uk_fence_create_signalled_s))) return -EFAULT;
+
+	return 0;
+}
+
 int sync_fence_validate_wrapper(struct mali_session_data *session, _mali_uk_fence_validate_s __user *uargs)
 {
 	int fd;
diff --git a/drivers/gpu/mali400/r3p2/mali/linux/mali_ukk_wrappers.h b/drivers/gpu/mali400/r3p2/mali/linux/mali_ukk_wrappers.h
index 08bdae4..8bec818 100644
--- a/drivers/gpu/mali400/r3p2/mali/linux/mali_ukk_wrappers.h
+++ b/drivers/gpu/mali400/r3p2/mali/linux/mali_ukk_wrappers.h
@@ -30,6 +30,7 @@ int get_user_settings_wrapper(struct mali_session_data *session_data, _mali_uk_g
 #if defined(CONFIG_SYNC)
 int stream_create_wrapper(struct mali_session_data *session_data, _mali_uk_stream_create_s __user *uargs);
 int sync_fence_create_empty_wrapper(struct mali_session_data *session_data, _mali_uk_fence_create_empty_s __user *uargs);
+int sync_fence_create_signalled_wrapper(struct mali_session_data *session_data, _mali_uk_fence_create_signalled_s __user *uargs);
 int sync_fence_validate_wrapper(struct mali_session_data *session, _mali_uk_fence_validate_s __user *uargs);
 #endif
 int post_notification_wrapper(struct mali_session_data *session_data, _mali_uk_post_notification_s __user *uargs);
diff --git a/drivers/gpu/mali400/r3p2/ump/Kbuild b/drivers/gpu/mali400/r3p2/ump/Kbuild
index 4ca1aae..f6bf61e 100644
--- a/drivers/gpu/mali400/r3p2/ump/Kbuild
+++ b/drivers/gpu/mali400/r3p2/ump/Kbuild
@@ -37,7 +37,7 @@ ccflags-y += -I$(srctree)/$(src) -I$(srctree)/$(src)/common -I$(srctree)/$(src)/
 
 # MALI_SEC
 ccflags-y += -I$(srctree)/$(src)/include
-ccflags-y += -DUSING_MEMORY=1 -DUMP_MEM_SIZE=512
+ccflags-y += -DUSING_MEMORY=1 -DUMP_MEM_SIZE=1024
 
 ccflags-y += -DMALI_STATE_TRACKING=0
 ccflags-$(CONFIG_UMP_DEBUG) += -DDEBUG
diff --git a/drivers/misc/Kconfig b/drivers/misc/Kconfig
index 196c492..c29437f 100644
--- a/drivers/misc/Kconfig
+++ b/drivers/misc/Kconfig
@@ -698,6 +698,12 @@ config MPU_SENSORS_MPU6050
     tristate "MPU6050"
     depends on I2C
 
+config UID_CPUTIME
+	tristate "Per-UID cpu time statistics"
+	depends on PROFILING
+	help
+	  Per UID based cpu time statistics exported to /proc/uid_cputime
+
 source "drivers/misc/c2port/Kconfig"
 source "drivers/misc/eeprom/Kconfig"
 source "drivers/misc/cb710/Kconfig"
diff --git a/drivers/misc/Makefile b/drivers/misc/Makefile
index 91f74c5..c8e34a8 100644
--- a/drivers/misc/Makefile
+++ b/drivers/misc/Makefile
@@ -78,3 +78,4 @@ obj-$(CONFIG_SLP_PROCESS_MON)	+= slp_process_monitor.o
 obj-$(CONFIG_SLP_LOWMEM_NOTIFY)	+= slp_lowmem_notify.o
 
 obj-$(CONFIG_MACH_M0_CTC)   += cw_tty.o
+obj-$(CONFIG_UID_CPUTIME) += uid_cputime.o
diff --git a/drivers/misc/uid_cputime.c b/drivers/misc/uid_cputime.c
new file mode 100644
index 0000000..6ca3c2b
--- /dev/null
+++ b/drivers/misc/uid_cputime.c
@@ -0,0 +1,259 @@
+/* drivers/misc/uid_cputime.c
+ *
+ * Copyright (C) 2014 - 2015 Google, Inc.
+ *
+ * This software is licensed under the terms of the GNU General Public
+ * License version 2, as published by the Free Software Foundation, and
+ * may be copied, distributed, and modified under those terms.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ */
+
+#include <linux/atomic.h>
+#include <linux/err.h>
+#include <linux/hashtable.h>
+#include <linux/init.h>
+#include <linux/kernel.h>
+#include <linux/list.h>
+#include <linux/proc_fs.h>
+#include <linux/profile.h>
+#include <linux/sched.h>
+#include <linux/seq_file.h>
+#include <linux/slab.h>
+#include <linux/uaccess.h>
+
+#define UID_HASH_BITS	10
+DECLARE_HASHTABLE(hash_table, UID_HASH_BITS);
+
+static DEFINE_MUTEX(uid_lock);
+static struct proc_dir_entry *parent;
+
+struct uid_entry {
+	uid_t uid;
+	cputime_t utime;
+	cputime_t stime;
+	cputime_t active_utime;
+	cputime_t active_stime;
+	unsigned long long active_power;
+	unsigned long long power;
+	struct hlist_node hash;
+};
+
+static struct uid_entry *find_uid_entry(uid_t uid)
+{
+	struct uid_entry *uid_entry;
+	struct hlist_node *node;
+
+	hash_for_each_possible(hash_table, uid_entry, node, hash, uid) {
+		if (uid_entry->uid == uid)
+			return uid_entry;
+	}
+	return NULL;
+}
+
+static struct uid_entry *find_or_register_uid(uid_t uid)
+{
+	struct uid_entry *uid_entry;
+
+	uid_entry = find_uid_entry(uid);
+	if (uid_entry)
+		return uid_entry;
+
+	uid_entry = kzalloc(sizeof(struct uid_entry), GFP_ATOMIC);
+	if (!uid_entry)
+		return NULL;
+
+	uid_entry->uid = uid;
+
+	hash_add(hash_table, &uid_entry->hash, uid);
+
+	return uid_entry;
+}
+
+static int uid_stat_show(struct seq_file *m, void *v)
+{
+	struct uid_entry *uid_entry;
+	struct task_struct *task, *temp;
+	struct hlist_node *node;
+	cputime_t utime;
+	cputime_t stime;
+	unsigned long bkt;
+
+	mutex_lock(&uid_lock);
+
+	hash_for_each(hash_table, bkt, node, uid_entry, hash) {
+		uid_entry->active_stime = 0;
+		uid_entry->active_utime = 0;
+		uid_entry->active_power = 0;
+	}
+
+	read_lock(&tasklist_lock);
+	do_each_thread(temp, task) {
+		uid_entry = find_or_register_uid(task_uid(task));
+		if (!uid_entry) {
+			read_unlock(&tasklist_lock);
+			mutex_unlock(&uid_lock);
+			pr_err("%s: failed to find the uid_entry for uid %d\n",
+						__func__, task_uid(task));
+			return -ENOMEM;
+		}
+		/* if this task is exiting, we have already accounted for the
+		 * time and power. */
+#if 0 /* 3.0 fix */
+		if (task->cpu_power == ULLONG_MAX)
+			continue;
+#endif
+		task_times(task, &utime, &stime);
+		uid_entry->active_utime += utime;
+		uid_entry->active_stime += stime;
+#if 0 /* 3.0 fix */
+		uid_entry->active_power += task->cpu_power;
+#endif
+	} while_each_thread(temp, task);
+	read_unlock(&tasklist_lock);
+
+	hash_for_each(hash_table, bkt, node, uid_entry, hash) {
+		cputime_t total_utime = uid_entry->utime +
+							uid_entry->active_utime;
+		cputime_t total_stime = uid_entry->stime +
+							uid_entry->active_stime;
+		unsigned long long total_power = uid_entry->power +
+							uid_entry->active_power;
+		seq_printf(m, "%d: %llu %llu %llu\n", uid_entry->uid,
+				(unsigned long long)jiffies_to_msecs(
+					cputime_to_jiffies(total_utime)) * USEC_PER_MSEC,
+				(unsigned long long)jiffies_to_msecs(
+					cputime_to_jiffies(total_stime)) * USEC_PER_MSEC,
+				total_power);
+	}
+
+	mutex_unlock(&uid_lock);
+	return 0;
+}
+
+static int uid_stat_open(struct inode *inode, struct file *file)
+{
+	return single_open(file, uid_stat_show, PDE(inode)->data);
+}
+
+static const struct file_operations uid_stat_fops = {
+	.open		= uid_stat_open,
+	.read		= seq_read,
+	.llseek		= seq_lseek,
+	.release	= single_release,
+};
+
+static int uid_remove_open(struct inode *inode, struct file *file)
+{
+	return single_open(file, NULL, NULL);
+}
+
+static ssize_t uid_remove_write(struct file *file,
+			const char __user *buffer, size_t count, loff_t *ppos)
+{
+	struct uid_entry *uid_entry;
+	struct hlist_node *node, *tmp;
+	char uids[128];
+	char *start_uid, *end_uid = NULL;
+	long int uid_start = 0, uid_end = 0;
+
+	if (count >= sizeof(uids))
+		count = sizeof(uids) - 1;
+
+	if (copy_from_user(uids, buffer, count))
+		return -EFAULT;
+
+	uids[count] = '\0';
+	end_uid = uids;
+	start_uid = strsep(&end_uid, "-");
+
+	if (!start_uid || !end_uid)
+		return -EINVAL;
+
+	if (kstrtol(start_uid, 10, &uid_start) != 0 ||
+		kstrtol(end_uid, 10, &uid_end) != 0) {
+		return -EINVAL;
+	}
+
+	mutex_lock(&uid_lock);
+
+	for (; uid_start <= uid_end; uid_start++) {
+		hash_for_each_possible_safe(hash_table, uid_entry, node, tmp,
+							hash, uid_start) {
+			hash_del(&uid_entry->hash);
+			kfree(uid_entry);
+		}
+	}
+
+	mutex_unlock(&uid_lock);
+	return count;
+}
+
+static const struct file_operations uid_remove_fops = {
+	.open		= uid_remove_open,
+	.release	= single_release,
+	.write		= uid_remove_write,
+};
+
+static int process_notifier(struct notifier_block *self,
+			unsigned long cmd, void *v)
+{
+	struct task_struct *task = v;
+	struct uid_entry *uid_entry;
+	cputime_t utime, stime;
+	uid_t uid;
+
+	if (!task)
+		return NOTIFY_OK;
+
+	mutex_lock(&uid_lock);
+	uid = task_uid(task);
+	uid_entry = find_or_register_uid(uid);
+	if (!uid_entry) {
+		pr_err("%s: failed to find uid %d\n", __func__, uid);
+		goto exit;
+	}
+
+	task_times(task, &utime, &stime);
+	uid_entry->utime += utime;
+	uid_entry->stime += stime;
+#if 0 /* 3.0 fix */
+	uid_entry->power += task->cpu_power;
+	task->cpu_power = ULLONG_MAX;
+#endif
+
+exit:
+	mutex_unlock(&uid_lock);
+	return NOTIFY_OK;
+}
+
+static struct notifier_block process_notifier_block = {
+	.notifier_call	= process_notifier,
+};
+
+static int __init proc_uid_cputime_init(void)
+{
+	hash_init(hash_table);
+
+	parent = proc_mkdir("uid_cputime", NULL);
+	if (!parent) {
+		pr_err("%s: failed to create proc entry\n", __func__);
+		return -ENOMEM;
+	}
+
+	proc_create_data("remove_uid_range", S_IWUGO, parent, &uid_remove_fops,
+					NULL);
+
+	proc_create_data("show_uid_stat", S_IRUGO, parent, &uid_stat_fops,
+					NULL);
+
+	profile_event_register(PROFILE_TASK_EXIT, &process_notifier_block);
+
+	return 0;
+}
+
+early_initcall(proc_uid_cputime_init);
diff --git a/drivers/staging/android/binder.c b/drivers/staging/android/binder.c
index 8a37cbd..aad750b 100644
--- a/drivers/staging/android/binder.c
+++ b/drivers/staging/android/binder.c
@@ -33,6 +33,7 @@
 #include <linux/slab.h>
 #include <linux/uaccess.h>
 #include <linux/vmalloc.h>
+#include <linux/security.h>
 
 #include "binder.h"
 
@@ -1473,6 +1474,10 @@ static void binder_transaction(struct binder_proc *proc,
 			return_error = BR_DEAD_REPLY;
 			goto err_dead_binder;
 		}
+		if (security_binder_transaction(proc->tsk, target_proc->tsk) < 0) {
+			return_error = BR_FAILED_REPLY;
+			goto err_invalid_target_handle;
+		}
 		if (!(tr->flags & TF_ONE_WAY) && thread->transaction_stack) {
 			struct binder_transaction *tmp;
 			tmp = thread->transaction_stack;
@@ -1628,6 +1633,10 @@ static void binder_transaction(struct binder_proc *proc,
 					fp->cookie, node->cookie);
 				goto err_binder_get_ref_for_node_failed;
 			}
+			if (security_binder_transfer_binder(proc->tsk, target_proc->tsk)) {
+				return_error = BR_FAILED_REPLY;
+				goto err_binder_get_ref_for_node_failed;
+			}
 			ref = binder_get_ref_for_node(target_proc, node);
 			if (ref == NULL) {
 				return_error = BR_FAILED_REPLY;
@@ -1657,6 +1666,10 @@ static void binder_transaction(struct binder_proc *proc,
 				return_error = BR_FAILED_REPLY;
 				goto err_binder_get_ref_failed;
 			}
+			if (security_binder_transfer_binder(proc->tsk, target_proc->tsk)) {
+				return_error = BR_FAILED_REPLY;
+				goto err_binder_get_ref_failed;
+			}
 			if (ref->node->proc == target_proc) {
 				if (fp->type == BINDER_TYPE_HANDLE)
 					fp->type = BINDER_TYPE_BINDER;
@@ -1710,6 +1723,11 @@ static void binder_transaction(struct binder_proc *proc,
 				return_error = BR_FAILED_REPLY;
 				goto err_fget_failed;
 			}
+			if (security_binder_transfer_file(proc->tsk, target_proc->tsk, file) < 0) {
+				fput(file);
+				return_error = BR_FAILED_REPLY;
+				goto err_get_unused_fd_failed;
+			}
 			target_fd = task_get_unused_fd_flags(target_proc, O_CLOEXEC);
 			if (target_fd < 0) {
 				fput(file);
@@ -2715,6 +2733,9 @@ static long binder_ioctl(struct file *filp, unsigned int cmd, unsigned long arg)
 			ret = -EBUSY;
 			goto err;
 		}
+		ret = security_binder_set_context_mgr(proc->tsk);
+		if (ret < 0)
+			goto err;
 		if (binder_context_mgr_uid != -1) {
 			if (binder_context_mgr_uid != current->cred->euid) {
 				printk(KERN_ERR "binder: BINDER_SET_"
diff --git a/drivers/video/fbmem.c b/drivers/video/fbmem.c
index f93347d..fcc52d4 100644
--- a/drivers/video/fbmem.c
+++ b/drivers/video/fbmem.c
@@ -34,7 +34,6 @@
 #include <linux/fb.h>
 
 #include <asm/fb.h>
-#include <linux/cma.h>
 
 
     /*