msm: kgsl: Detect and avoid malformed ioctl codes

Because we were using _IO_NR, one could construct a malformed ioctl
code that would avoid allocating memory yet go to a function that
expected that memory. Still use _IO_NR to index the array of ioctls,
but check that the full values match before jumping to the helper
function.

CRs-fixed: 385592
Change-Id: Ic0dedbaded469035bd0a2bb0f20fecb2a3045ca5
Signed-off-by: Jordan Crouse <jcrouse@codeaurora.org>
(cherry picked from commit 1e76f61bb001b93795a227f8f808104b6c10b048)

Signed-off-by: Dhivya Subramanian <dthiru@codeaurora.org>
msm: kgsl: In kgsl release do not idle if device is in HUNG state

When recovery fails we are in HUNG state and clocks are turned off,
If a client closes kgsl device, driver release gets called and
we will try to idle the device which leads to accessing GPU registers
without clock being on. This leads to excessive kernel logging
"kgsl_pre_hwaccess hw access while clocks off from state HUNG"
and this eventually leads to watchdog.

Change-Id: Ib15c83fa06f6d32382b20c68a3ceb5081f1cfd69
CRs-fixed: 397149
Signed-off-by: Tarun Karra <tkarra@codeaurora.org>
Signed-off-by: Gopal Goberu <ggober@codeaurora.org>
msm: kgsl: Invalidate base pointers when tlb is flushed

Invalidate the base pointer even when tlb is flushed. For
gpummu the base pointers are invalidated even after just
a tlb flush, with IOMMU do the same.

Signed-off-by: Shubhraprakash Das <sadas@codeaurora.org>
(cherry picked from commit 967c91794d71107053471f33b903176a3522431d)

Conflicts:

	drivers/gpu/msm/adreno.c

Change-Id: Ic2e6d9b323d8aadabfe73b57d82cbe4500d666fe
Signed-off-by: Sridhar Gujje <sgujje@codeaurora.org>
msm: kgsl: Add idle after writing SMMU ASID register

Add an idle for synchronization after writing the SMMU ASID register.

Signed-off-by: Shubhraprakash Das <sadas@codeaurora.org>
(cherry picked from commit be39728459a2b7a9c0a5b1faf11e7406976ddcc7)

Change-Id: I6dedb2ff1c51a3ee0ffe55ce64567e8bcdf03e7f
Signed-off-by: Sridhar Gujje <sgujje@codeaurora.org>
msm: kgsl: In kgsl release do not idle if device is in HUNG state

When recovery fails we are in HUNG state and clocks are turned off,
If a client closes kgsl device, driver release gets called and
we will try to idle the device which leads to accessing GPU registers
without clock being on. This leads to excessive kernel logging
"kgsl_pre_hwaccess hw access while clocks off from state HUNG"
and this eventually leads to watchdog.

Change-Id: Ib15c83fa06f6d32382b20c68a3ceb5081f1cfd69
CRs-fixed: 397149
Signed-off-by: Tarun Karra <tkarra@codeaurora.org>
Signed-off-by: Gopal Goberu <ggober@codeaurora.org>
Signed-off-by: Subrahmanyam Uppala <csuppal@codeaurora.org>
msm_fb: display: free base layer pipe at adb stop

Base layer pipe need to be freed at adb stop so that same
pipe can be allocated at adb start.

CRs-fixed: 390644
Change-Id: I948bb27687cfe1c96cc3b071b7bb9bb84b2c52c6
Signed-off-by: Kalyan Thota <kalyant@codeaurora.org>
Signed-off-by: Kuogee Hsieh <khsieh@codeaurora.org>
staging: zcache: support multiple clients, prep for KVM and RAMster

This is version 3 of an update to zcache, incorporating feedback from the list.
This patch adds support to the in-kernel transcendent memory ("tmem") code
and the zcache driver for multiple clients, which will be needed for both
RAMster and KVM support.  It also adds additional tmem callbacks to support
RAMster and corresponding no-op stubs in the zcache driver.  In v2, I've
also taken the liberty of adding some additional sysfs variables to
both surface information and allow policy control.  Those experimenting
with zcache should find them useful.  V3 clarifies some code walking
and declaring arrays.

Signed-off-by: Dan Magenheimer <dan.magenheimer@oracle.com>

[v3: error27@gmail.com: fix array bounds/walking]
[v2: konrad.wilk@oracle.com: fix bools, add check for NULL, fix a comment]
[v2: sjenning@linux.vnet.ibm.com: add info/tunables for poor compression]
[v2: marcusklemm@googlemail.com: add tunable for max persistent pages]
Acked-by: Dan Carpenter <error27@gmail.com>
Cc: Nitin Gupta <ngupta@vflare.org>
Cc: linux-mm@kvack.org
Cc: kvm@vger.kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

staging: fix zcache building

zcache is only building tmem.c and not building zcache.c. To keep the
module name, zcache.c must be renamed if symbols from tmem.c are to
remain unexported.

Signed-off-by: Thadeu Lima de Souza Cascardo <cascardo@holoscopio.com>
Acked-by: Dan Magenheimer <dan.magenheimer@oracle.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

staging: zcache: module is GPL

This avoids tainting the kernel as if a proprietary module was loaded.
The kernel will still be tainted because this is a staging driver.

Signed-off-by: Thadeu Lima de Souza Cascardo <cascardo@holoscopio.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

staging: zcache: include module.h for MODULE_LICENSE

The oncoming cleanup of module.h usage requires the explicit inclusion
of module.h when it was otherwise being included indirectly. Otherwise,
building zcache will fail.

Reported-by: Stephen Rothwell <sfr@canb.auug.org.au>
Signed-off-by: Thadeu Lima de Souza Cascardo <cascardo@holoscopio.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

zcache: Use div_u64 for 64-bit division

xv_get_total_size_bytes returns a u64 value and it's used in a division.
This causes build failures in 32-bit architectures, as reported by Randy
Dunlap.

Reported-by: Randy Dunlap <rdunlap@xenotime.net>
Signed-off-by: Thadeu Lima de Souza Cascardo <cascardo@holoscopio.com>
Cc: Stephen Rothwell <sfr@canb.auug.org.au>
Cc: Dan Magenheimer <dan.magenheimer@oracle.com>
Cc: Nitin Gupta <ngupta@vflare.org>
Acked-by: Randy Dunlap <rdunlap@xenotime.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

zcache: Fix build error when sysfs is not defined

Signed-off-by: Nitin Gupta <ngupta@vflare.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

staging: zcache: fix possible sleep under lock

zcache_new_pool() calls kmalloc() with GFP_KERNEL which has
__GFP_WAIT set.  However, zcache_new_pool() gets called on
a stack that holds the swap_lock spinlock, leading to a
possible sleep-with-lock situation. The lock is obtained
in enable_swap_info().

The patch replaces GFP_KERNEL with GFP_ATOMIC.

v2: replace with GFP_ATOMIC, not GFP_IOFS

Signed-off-by: Seth Jennings <sjenning@linux.vnet.ibm.com>
Acked-by: Dan Magenheimer <dan.magenheimer@oracle.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

staging: zcache: fix typos

The patch fixes two typos in zcache-main.c

Signed-off-by: Seth Jennings <sjenning@linux.vnet.ibm.com>
Acked-by: Dan Magenheimer <dan.magenheimer@oracle.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

staging: zcache: fix crash on high memory swap

zcache_put_page() was modified to pass page_address(page) instead of the
actual page structure. In combination with the function signature changes
to tmem_put() and zcache_pampd_create(), zcache_pampd_create() tries to
(re)derive the page structure from the virtual address.  However, if the
original page is a high memory page (or any unmapped page), this
virt_to_page() fails because the page_address() in zcache_put_page()
returned NULL.

This patch changes zcache_put_page() and zcache_get_page() to pass
the page structure instead of the page's virtual address, which
may or may not exist.

Signed-off-by: Seth Jennings <sjenning@linux.vnet.ibm.com>
Acked-by: Dan Magenheimer <dan.magenheimer@oracle.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

Staging: zcache: signedness bug in tmem_get()

"ret" needs to be signed for the error handling to work properly.

Signed-off-by: Dan Carpenter <error27@gmail.com>
Acked-by: Dan Magenheimer <dan.magenheimer@oracle.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

staging: zcache: fix cleancache crash

After commit c5f5c4db3938 ("staging: zcache: fix crash on high memory
swap") cleancache crashes on the first successful get.  This was caused
by a remaining virt_to_page() call in zcache_pampd_get_data_and_free()
that only gets run in the cleancache path.

The patch converts the virt_to_page() to struct page casting like was
done for other instances in c5f5c4db3938.

Signed-off-by: Seth Jennings <sjenning@linux.vnet.ibm.com>
Tested-By: Valdis Kletnieks <valdis.kletnieks@vt.edu>
Acked-by: Dan Magenheimer <dan.magenheimer@oracle.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

staging: zcache: fix crash on cpu remove

In the case that a cpu is taken offline before zcache_do_preload() is
ever called on the cpu, the per-cpu zcache_preloads structure will
be uninitialized.  In the CPU_DEAD case for zcache_cpu_notifier(),
kp->obj is not checked before calling kmem_cache_free() on it.
If it is NULL, a crash results.

This patch ensures that both kp->obj and kp->page are not NULL before
calling the respective free functions. In practice, just checking
one or the other should be sufficient since they are assigned together
in zcache_do_preload(), but I check both for safety.

Signed-off-by: Seth Jennings <sjenning@linux.vnet.ibm.com>
Acked-by: Dave Hansen <dave@linux.vnet.ibm.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

staging: zcache: reduce tmem bucket lock contention

tmem uses hash buckets each with their own rbtree and lock to
quickly lookup tmem objects.  tmem has TMEM_HASH_BUCKETS (256)
buckets per pool.  However, because of the way the tmem_oid is
generated for frontswap pages, only 16 unique tmem_oids are being
generated, resulting in only 16 of the 256 buckets being used.
This cause high lock contention for the per bucket locks.

This patch changes SWIZ_BITS to include more bits of the offset.
The result is that all 256 hash buckets are potentially used resulting in a
95% drop in hash bucket lock contention.

Signed-off-by: Seth Jennings <sjenning@linux.vnet.ibm.com>
Acked-by: Dan Magenheimer <dan.magenheimer@oracle.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

staging: zcache: remove zcache_direct_reclaim_lock

zcache_do_preload() currently does a spin_trylock() on the
zcache_direct_reclaim_lock. Holding this lock intends to prevent
shrink_zcache_memory() from evicting zbud pages as a result
of a preload.

However, it also prevents two threads from
executing zcache_do_preload() at the same time.  The first
thread will obtain the lock and the second thread's spin_trylock()
will fail (an aborted preload) causing the page to be either lost
(cleancache) or pushed out to the swap device (frontswap). It
also doesn't ensure that the call to shrink_zcache_memory() is
on the same thread as the call to zcache_do_preload().

Additional, there is no need for this mechanism because all
zcache_do_preload() calls that come down from cleancache already
have PF_MEMALLOC set in the process flags which prevents
direct reclaim in the memory manager. If the zcache_do_preload()
call is done from the frontswap path, we _want_ reclaim to be
done (which it isn't right now).

This patch removes the zcache_direct_reclaim_lock and related
statistics in zcache.

Based on v3.1-rc8

Signed-off-by: Seth Jennings <sjenning@linux.vnet.ibm.com>
Reviewed-by: Dave Hansen <dave@linux.vnet.ibm.com>
Acked-by: Dan Magenheimer <dan.magenheimer@oracle.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

Staging: zcache: Fix calls to obsolete function

Function "strict_strtol" replaced by "kstrtol" as suggested by the checkpatch script

Signed-off-by: Bernhard Heinloth <bernhard@heinloth.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

zcache: fix deadlock condition

I discovered this deadlock condition awhile ago working on RAMster
but it affects zcache as well.  The list spinlock must be
locked prior to the page spinlock and released after.  As
a result, the page copy must also be done while the locks are held.

Applies to 3.2.  Konrad, please push (via GregKH?)...
this is definitely a bug fix so need not be pushed during
a -rc0 window.

Signed-off-by: Dan Magenheimer <dan.magenheimer@oracle.com>
Acked-by: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>
Cc: stable <stable@vger.kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

zcache: Set SWIZ_BITS to 8 to reduce tmem bucket lock contention.

SWIZ_BITS > 8 results in a much larger number of "tmem_obj"
allocations, likely one per page-placed-in-frontswap.  The
tmem_obj is not huge (roughly 100 bytes), but it is large
enough to add a not-insignificant memory overhead to zcache.

The SWIZ_BITS=8  will get roughly the same lock contention
without the space wastage.

The effect of SWIZ_BITS can be thought of as "2^SWIZ_BITS is
the number of unique oids that be generated" (This concept is
limited to frontswap's use of tmem).

Acked-by: Seth Jennings <sjenning@linux.vnet.ibm.com>
Signed-off-by: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>
Cc: stable <stable@vger.kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

staging: zcache: fix serialization bug in zv stats

In a multithreaded workload, the zv_curr_dist_counts
and zv_cumul_dist_counts statistics are being corrupted
because the increments and decrements in zv_create
and zv_free are not atomic.

This patch converts these statistics and their corresponding
increments/decrements/reads to atomic operations.

Signed-off-by: Seth Jennings <sjenning@linux.vnet.ibm.com>
Acked-by: Dan Magenheimer <dan.magenheimer@oracle.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

staging: zcache: crypto API support

This patch allow zcache to use the crypto API for page compression.
It replaces the direct LZO compress/decompress calls with calls
into the crypto compression API. The compressor to be used is
specified in the kernel boot line with the zcache parameter like:
zcache=lzo or zcache=deflate.  If the specified compressor can't
be loaded, zcache uses lzo as the default compressor.

Signed-off-by: Seth Jennings <sjenning@linux.vnet.ibm.com>
Acked-by: Dan Magenheimer <dan.magenheimer@oracle.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

staging: zcache: avoid AB-BA deadlock condition

Commit 9256a47 fixed a deadlock condition, being sure that the buddy
list spinlock is always taken before the page spinlock.

However in zbud_free_and_delist() locking order is the opposite
(page lock -> list lock).

Possible unsafe locking scenario (reported by lockdep):

        CPU0                    CPU1
        ----                    ----
   lock(&(&zbpg->lock)->rlock);
                                lock(zbud_budlists_spinlock);
                                lock(&(&zbpg->lock)->rlock);
   lock(zbud_budlists_spinlock);

Fix by grabbing the locks in opposite order in zbud_free_and_delist().

Signed-off-by: Andrea Righi <andrea@betterlinux.com>
Cc: stable <stable@vger.kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
msm_fb: display: turn vsync irq off at suspend

Turn off vsycn irq at suspend to prevent vsync irq firing
before vsycn enabled ioctl called at resume.

Change-Id: I2428cdeb5cf7008e50f6d8dabfad52416db2fff7
Signed-off-by: Kuogee Hsieh <khsieh@codeaurora.org>

Conflicts:

	drivers/video/msm/mdp4_overlay_dsi_video.c
	drivers/video/msm/mdp4_overlay_lcdc.c
msm_fb : display : Block RGB downscale in MDP 4.0 and 4.1

Downscale is not allowed on RGB pipes in MDP 4.0 and 4.1. Hence,
fail the OVERLAY_SET ioctl for such configurations.

Signed-off-by: Pradeep Jilagam <pjilagam@codeaurora.org>
(cherry picked from commit 3545573720822ce97ec37586f10fdf74a6d4f090)

Change-Id: I8445c18ac21cb7322eb9eb4c802623df5da07eb7
Signed-off-by: Gopal Goberu <ggober@codeaurora.org>
msm: rotator: Add pseudo-planar 422 H1V2 dst format for MDP4

For interleaved 422 inputs, rotator outputs MDP_Y_CRCB_H1V2
format on 90 degree rotation. Add support as destination format
for MDP4.

CRs-Fixed: 371303
Change-Id: Ie0f98d40f58bf2cb9bc3298a94cae9c4e89b2f7a
Signed-off-by: Mayank Chopra <makchopra@codeaurora.org>
msm_fb: display: Add pseudo-planar 422 H1V2 support in the MDP4

Rotator outputs pseudo-planar 422 H1V2 for interleaved inputs
on 90 degree rotation. Add changes to support MDP_Y_CRCB_H1V2
in MDP4.

CRs-Fixed: 371303
Change-Id: I8083bf44f9e2addf9e8732268147c1c3f6c0e2af
Signed-off-by: Mayank Chopra <makchopra@codeaurora.org>
msm_fb: display: remove extra dmap irq disable

Both irq enable and disable need to be called symmetrically.
Remove an extra dmap irq disable call.

Change-Id: Ic51003c50431ebe46a9fc540163cda77a1c91797
Signed-off-by: Kuogee Hsieh <khsieh@codeaurora.org>
msm_fb: display: empty pending queue during suspend

Overlay_play() adds a pipe into pending queue and pan_display()
will commit those pipes to hardware and empty queue. This patch
will make sure queue is empty at suspend so that no unexpected
pipes will be commited to hardware by pan_display() at resume.
Otherwise, iommu page fault may happen.

Change-Id: Iafdf469c6cdbf5d469c9dee114555a8d1adb9c66
Signed-off-by: Kuogee Hsieh <khsieh@codeaurora.org>
msm_fb: display: remove background invert alpha option for alpha drop pipe

When the blended background pipe has dropped alpha and it is going to
be blended with foreground pipe on the next stage,
MDP4_BLEND_BG_ALPHA_FG_CONST is taken. Foreground alpha constant is
0xFF, so we need to use this alpha value to show background, instead
of its inverted value.

Change-Id: I1fe0572f9bb54db6280bcc44117a21b8c0d8b07a
Signed-off-by: Huaibin Yang <huaibiny@codeaurora.org>
msm_fb: display: add fput_light to frame buffer

Frame buffer's (fb0) ref_count need to be balanced. overlay_play()
increase fb0's ref_count (fget_light). This patch will decrease fb0's
ref_count by calling fput_light after commit.

Change-Id: I34ea738bf21d0858b7361ec8e289464a217a1231
Signed-off-by: Kuogee Hsieh <khsieh@codeaurora.org>
msm_fb: display: check base layer pipe at irq handler

There is a corner case when overlay and dmap interrupts
are fired before base layer pipe is allocated. Therefore
Check for base layer pipe before performing any operations.

Change-Id: Ib188d575044f5479672503508042c8c1e9c759c4
Signed-off-by: Kuogee Hsieh <khsieh@codeaurora.org>
msm_fb: Use background alpha for all destination alpha enable cases

Use background alpha for modulation in all the cases where source alpha
is not available.

CRs-fixed: 366834
Change-Id: I300c04181ee3fa4f305a26a3e17e7eac2572564c
Signed-off-by: Kalyan Thota <kalyant@codeaurora.org>
msm_fb: display: add checking y direction for alpha drop

Alpha is dropped when scaling with non repeat pixel method.
Both x and y direction of scaling need to be cehcked for
alpha dropped.

Change-Id: Iba0df5a85011f179199c13ffdebac911e5c14c3c
Signed-off-by: Kuogee Hsieh <khsieh@codeaurora.org>
msm: rotator: add YUV444 interleave format support

Add support for H1V1 interleave (YUV444) to rotator
in msm_rotator_get_plane_sizes().

Change-Id: I57ff5236b7e9329b72f9983da9874de938a821a2
Signed-off-by: Kyong Hwa Bae <kbae@codeaurora.org>
msm: rotator: add YUV444 interleave format support

Add support for H1V1 interleave (YUV444) to rotator

Change-Id: I772ff1823e3c9acf046d339c3a1eeb1ab324b279
Signed-off-by: Kyong Hwa Bae <kbae@codeaurora.org>
Signed-off-by: Adrian Salido-Moreno <adrianm@codeaurora.org>