jf-kernel: squashed updates

gpu: msm: Add new Adreno driver

* Temporary place for this.

Change-Id: I83b5d75fbd201c352d011ed43f21ebe3576e058c

kref: Implement kref_get_unless_zero v3

This function is intended to simplify locking around refcounting for
objects that can be looked up from a lookup structure, and which are
removed from that lookup structure in the object destructor.
Operations on such objects require at least a read lock around
lookup + kref_get, and a write lock around kref_put + remove from lookup
structure. Furthermore, RCU implementations become extremely tricky.
With a lookup followed by a kref_get_unless_zero *with return value check*
locking in the kref_put path can be deferred to the actual removal from
the lookup structure and RCU lookups become trivial.

v2: Formatting fixes.
v3: Invert the return value.

Signed-off-by: Thomas Hellstrom <thellstrom@vmware.com>
Signed-off-by: Dave Airlie <airlied@redhat.com>
Git-commit: 4b20db3de8dab005b07c74161cb041db8c5ff3a7
Git-repo: git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
[shrenujb@codeaurora.org: resolve trivial merge conflicts]
Signed-off-by: Shrenuj Bansal <shrenujb@codeaurora.org>

Conflicts:
	include/linux/kref.h

Change-Id: Ia41a533f964804264a8e6e31ed0a25f383dd11e7

msm: kgsl: Add separate GPU shader memory mapping

Add separate kernel memory mapping for GPU shader memory.
Previously, both the register and the shader memory were mapped
as one entity, with the mapping length being equal to combined
size of register memory and shader memory. Now, we separate the
shader memory mapping to help in cases of GPU devices where the
shader and register memory may not be adjacent. This helps to
dump the shader memory in the postmortem snapshot. By having a
separate mapping for shader memory, the snapshot dump routine
simply reads in the shader memory range specified and dumps.

Signed-off-by: Harsh Vardhan Dwivedi <hdwivedi@codeaurora.org>

Conflicts:
	drivers/gpu/msm/adreno_a3xx_snapshot.c

Change-Id: Ia51cdbc6a682abe6505bcc53c997ef9c9192f9e6

msm: kgsl: Add intermediate power levels

Make use of the two independent power domains to
add intermediate levels.  Attempt to just increase
the bus frequency before also raising the GPU
frequency.

Signed-off-by: Lucille Sylvester <lsylvest@codeaurora.org>

Conflicts:
	arch/arm/boot/dts/msm8974-gpu.dtsi
	arch/arm/boot/dts/msm8974-v2.dtsi
	drivers/gpu/msm/kgsl_pwrctrl.c
	drivers/gpu/msm/kgsl_pwrctrl.h

Change-Id: Ibe85d1c02941430c5da83a75a09d5bc0ec5f8ec0

iommu/core: pass a user-provided token to fault handlers

Sometimes a single IOMMU user may have to deal with several
different IOMMU devices (e.g. remoteproc).

When an IOMMU fault happens, such users have to regain their
context in order to deal with the fault.

Users can't use the private fields of neither the iommu_domain nor
the IOMMU device, because those are already used by the IOMMU core
and low level driver (respectively).

This patch just simply allows users to pass a private token (most
notably their own context pointer) to iommu_set_fault_handler(),
and then makes sure it is provided back to the users whenever
an IOMMU fault happens.

The patch also adopts remoteproc to the new fault handling
interface, but the real functionality using this (recovery of
remote processors) will only be added later in a subsequent patch
set.

Cc: Fernando Guzman Lugo <fernando.lugo@ti.com>
Signed-off-by: Ohad Ben-Cohen <ohad@wizery.com>
Signed-off-by: Joerg Roedel <joerg.roedel@amd.com>
[ohaugan@codeaurora.org: Resolved compilation and merge issues]
Signed-off-by: Olav Haugan <ohaugan@codeaurora.org>

Conflicts:
	drivers/video/msm/mdss/mdss_mdp.c

Change-Id: I610966aeb936e0d026c6ef35a56453337e1b3c76

msm: Fix mem leak when using per-process pages

When GPU is using per process page tables the code creates
a new page table (domain) for every process. There is also
some associated structures allocated to keep track of each
domain. However, when cleaning up the memory used for a page
table only the domain is freed and not the associated structures.

Add a function to allow a client to properly unregister a domain
which will free all the memory associated with a domain.
Call the unregister function from kgsl driver code.

CRs-fixed: 480801
Signed-off-by: Olav Haugan <ohaugan@codeaurora.org>

Conflicts:
	arch/arm/mach-msm/iommu_domains.c

Change-Id: I78365cac8afb900450b512527f0cb71da5e9ddb2

ARM: Add support for 64 bit register reads/writes

Add macros to read and write to 64 bit registers.

Signed-off-by: Olav Haugan <ohaugan@codeaurora.org>

Conflicts:
	arch/arm/include/asm/io.h

Change-Id: Ied2b38e6a3803377cd271fe7b13f6cf0fc586e70

msm: scm: Add scm_call_atomic3

Some drivers need to pass three arguments atomically. Add support
for it.

Change-Id: I0077d26eeab0e6a3828f994fd4aabc4d73d48b31
Signed-off-by: Stephen Boyd <sboyd@codeaurora.org>

driver core: Add iommu_group tracking to struct device

IOMMU groups allow IOMMU drivers to represent DMA visibility
and isolation of devices.  Multiple devices may be grouped
together for the purposes of DMA.  Placing a pointer on
struct device enable easy access for things like streaming
DMA programming and drivers like VFIO.

Change-Id: I0a92a94aea0ac699676914a033477243a70dd0b0
Signed-off-by: Alex Williamson <alex.williamson@redhat.com>
Acked-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Acked-by: Benjamin Herrenschmidt <benh@kernel.crashing.org>
Signed-off-by: Joerg Roedel <joerg.roedel@amd.com>
Signed-off-by: Olav Haugan <ohaugan@codeaurora.org>

fix derps

Change-Id: I327cecbd3159621b7655f51033f14f87589c03ed

msm: We are using the msm2 gpu driver, not msm

Fix references that are incorrectly pointing at drivers/gpu/msm
instead of msm2.

The incorrect includes cause linaro gcc 4.8 with -O3 to produce
an unbootable kernel on the DLX.

While it doesn't seem to be affecting our normal builds, not
fixing it will likely bite us in the future in some other
mysterious way.

Change-Id: I3c51062ca6a66ddb9782365d2c51c5e485556c1b

msm: vidc: Use min_dpb from resource tracker in smooth streaming mode

Get min_dpb from resource tracker always if smooth streaming
mode is enabled to handle number of output buffers properly.

Change-Id: Ic46f76061f3895fda44e1d8e94198f898e5edf9b
Signed-off-by: Deepak Verma <dverma@codeaurora.org>

msm: msm_fb: Map RGB layers to the max possible size.

IOMMU Page Faults are observed on RGB layers during stability
because MDP is trying to fetch out of mapped area of the buffer.
This patch avoids the issue by overmapping the RGB layers to the
max possible RGB buffer size.

Change-Id: Idc7ac9acad70e351acac5dba2ae43b8731e84d35
Signed-off-by: Vishnuvardhan Prodduturi <vproddut@codeaurora.org>

msm: msm_fb: Do not use ION_IOMMU_UNMAP_DELAYED flag.

Since iommu buffers will be unmapped after two newer commits
had passed, there is no need to request iommu driver to further
delay unmapping an iommu buffer.

Change-Id: I44099054114403fa7ac6a5e3c71a43d6b932f4a3
Signed-off-by: raghavendra ambadas <rambad@codeaurora.org>

msm: fb: Fix security bugs in msmfb_notify_update & msm_fb_ioctl

msmfb_notify_update: Correct signature of msmfb_notify_update from
the ioctl declaration.

msm_fb_ioctl: Add appropriate null check for mfd data structure
before accessing it's members. This prevents null pointer accesses
in the driver.

CRs-Fixed: 526286
Change-Id: I731018057214fb0fa58c7617934100d2425617f8
Signed-off-by: Neti, Ravi Kumar <ravineti@codeaurora.org>

msm: mdp: Revert changes for delaying commit for tiled video

This reverts commits 3ec662e7079cad581e1b6f13a386059b40fa237a and.
bb3d5cf6e59c86dc619332fad568430c737e7a45.
These commits cause corruption with dynamic resolution changes

Bug: 10192531
Change-Id: I2dcce2fdc358bb0b87885e2ae3f853b4e728b498
Signed-off-by: Naseer Ahmed <naseer@codeaurora.org>

msm: vidc: estimate min_dpb for smooth streaming mode

In case of smoothstreaming:
[1] get dpb requirement for the firmware
[2] get count in resource resource tracker
Use higher of the above

b/10192531

Signed-off-by: Deepak Verma <dverma@codeaurora.org>
Signed-off-by: Praveen Chavan <pchavan@codeaurora.org>

msm: vidc: Set input buffer size dynamically

This change supports overriding of default input
buffer size using a set parameter call from the
client.

Change-Id: I5225ec53ba16b68aeedd4c30897bd291e81b4b09
Signed-off-by: Deepak Verma <dverma@codeaurora.org>

msm_fb: display: Program TILE video frame size in dma ISR

Since, video tile frame size register is single buffered, its
value takes effect as soon as it is programmed. Single buffered
registers like this should be configured very close to the vsync
to prevent issues like flicker or artifacts.
Program this register in dma ISR to prevent flickers and IOMMU
page faults.

Change-Id: Ifa770e4b4f29d6e4070e51388043422cc60e5872
Signed-off-by: Mayank Chopra <makchopra@codeaurora.org>

msm_fb: display: update video tile framesize register

The register should not be delayed in the case of
Witeback and command mode pannel

Change-Id: Ia90ccc1bb376ed829bedee131ba600194d471521
Signed-off-by: Justin Philip <jphili@codeaurora.org>

msm: msm_fb: Fix Regressions because of overmap changes.

Previous MDP overmap change is causing issues with HDMI because of
assumptions about overmap. This patch fixes all such issues.

Change-Id: Ifd2f8a0596d9df08538464bdcdd5946cf84db4d9
Signed-off-by: Vishnuvardhan Prodduturi <vproddut@codeaurora.org>

Revert "[ARM] msm: iommu_domains: replace vmalloc with kmalloc"

When overmapping is used, system can request higher order page allocaitons.
this can lead to page allocation failure if kmalloc is used

CRs-Fixed: 571753

This reverts commit 191a48ee7bda08bf88a61b48fd0433627c5918dc.

Change-Id: I4d44bf88d84d96d315f89a1304a2d25b75be79d8
Signed-off-by: Srinivasarao P <spathi@codeaurora.org>

smp: Relax irqs_disable() warning in smp_call_function_single()

The change that long-ago added the interrupts-disabled warning in
smp_call_function_single() cited the following deadlock as the reason:
	CPU A				CPU B
	Disable interrupts
					smp_call_function()
					Take call_lock
					Send IPIs
					Wait for all cpus to acknowledge IPI
					CPU A has not responded, spin waiting
					for cpu A to respond, holding call_lock
	smp_call_function()
	Spin waiting for call_lock
	Deadlock			Deadlock

Such a deadlock is not possible however, in the event that
smp_call_function_single() is called for the currently-executing CPU.
While not a common usecase, relaxing the warning may simplify some
driver implementations.

The 'acpuclock-krait' driver in the MSM ARM sub-architecture provides
one example, where smp_call_function_single() is sometimes called from
a cpuidle path with interrupts disabled, but only ever from the target
CPU. Other callers of that same function may cross-call, but only do so
when interrupts are enabled.

Change-Id: I647b3b46fe6aa4dfb06f7750396986b80b92d700
Signed-off-by: Matt Wagantall <mattw@codeaurora.org>

mm: add a field to store names for private anonymous memory

Userspace processes often have multiple allocators that each do
anonymous mmaps to get memory.  When examining memory usage of
individual processes or systems as a whole, it is useful to be
able to break down the various heaps that were allocated by
each layer and examine their size, RSS, and physical memory
usage.

This patch adds a user pointer to the shared union in
vm_area_struct that points to a null terminated string inside
the user process containing a name for the vma.  vmas that
point to the same address will be merged, but vmas that
point to equivalent strings at different addresses will
not be merged.

Userspace can set the name for a region of memory by calling
prctl(PR_SET_VMA, PR_SET_VMA_ANON_NAME, start, len, (unsigned long)name);
Setting the name to NULL clears it.

The names of named anonymous vmas are shown in /proc/pid/maps
as [anon:<name>] and in /proc/pid/smaps in a new "Name" field
that is only present for named vmas.  If the userspace pointer
is no longer valid all or part of the name will be replaced
with "<fault>".

The idea to store a userspace pointer to reduce the complexity
within mm (at the expense of the complexity of reading
/proc/pid/mem) came from Dave Hansen.  This results in no
runtime overhead in the mm subsystem other than comparing
the anon_name pointers when considering vma merging.  The pointer
is stored in a union with fieds that are only used on file-backed
mappings, so it does not increase memory usage.

Change-Id: Ie2ffc0967d4ffe7ee4c70781313c7b00cf7e3092
Signed-off-by: Colin Cross <ccross@android.com>

tracing: Fix potential out-of-bounds in trace_get_user()

commit 057db8488b53d5e4faa0cedb2f39d4ae75dfbdbb upstream.

Andrey reported the following report:

ERROR: AddressSanitizer: heap-buffer-overflow on address ffff8800359c99f3
ffff8800359c99f3 is located 0 bytes to the right of 243-byte region [ffff8800359c9900, ffff8800359c99f3)
Accessed by thread T13003:
  #0 ffffffff810dd2da (asan_report_error+0x32a/0x440)
  #1 ffffffff810dc6b0 (asan_check_region+0x30/0x40)
  #2 ffffffff810dd4d3 (__tsan_write1+0x13/0x20)
  #3 ffffffff811cd19e (ftrace_regex_release+0x1be/0x260)
  #4 ffffffff812a1065 (__fput+0x155/0x360)
  #5 ffffffff812a12de (____fput+0x1e/0x30)
  #6 ffffffff8111708d (task_work_run+0x10d/0x140)
  #7 ffffffff810ea043 (do_exit+0x433/0x11f0)
  #8 ffffffff810eaee4 (do_group_exit+0x84/0x130)
  #9 ffffffff810eafb1 (SyS_exit_group+0x21/0x30)
  #10 ffffffff81928782 (system_call_fastpath+0x16/0x1b)

Allocated by thread T5167:
  #0 ffffffff810dc778 (asan_slab_alloc+0x48/0xc0)
  #1 ffffffff8128337c (__kmalloc+0xbc/0x500)
  #2 ffffffff811d9d54 (trace_parser_get_init+0x34/0x90)
  #3 ffffffff811cd7b3 (ftrace_regex_open+0x83/0x2e0)
  #4 ffffffff811cda7d (ftrace_filter_open+0x2d/0x40)
  #5 ffffffff8129b4ff (do_dentry_open+0x32f/0x430)
  #6 ffffffff8129b668 (finish_open+0x68/0xa0)
  #7 ffffffff812b66ac (do_last+0xb8c/0x1710)
  #8 ffffffff812b7350 (path_openat+0x120/0xb50)
  #9 ffffffff812b8884 (do_filp_open+0x54/0xb0)
  #10 ffffffff8129d36c (do_sys_open+0x1ac/0x2c0)
  #11 ffffffff8129d4b7 (SyS_open+0x37/0x50)
  #12 ffffffff81928782 (system_call_fastpath+0x16/0x1b)

Shadow bytes around the buggy address:
  ffff8800359c9700: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
  ffff8800359c9780: fd fd fd fd fd fd fd fd fa fa fa fa fa fa fa fa
  ffff8800359c9800: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  ffff8800359c9880: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  ffff8800359c9900: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
=>ffff8800359c9980: 00 00 00 00 00 00 00 00 00 00 00 00 00 00[03]fb
  ffff8800359c9a00: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  ffff8800359c9a80: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  ffff8800359c9b00: fa fa fa fa fa fa fa fa 00 00 00 00 00 00 00 00
  ffff8800359c9b80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  ffff8800359c9c00: 00 00 00 00 00 00 00 00 fa fa fa fa fa fa fa fa
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07
  Heap redzone:          fa
  Heap kmalloc redzone:  fb
  Freed heap region:     fd
  Shadow gap:            fe

The out-of-bounds access happens on 'parser->buffer[parser->idx] = 0;'

Although the crash happened in ftrace_regex_open() the real bug
occurred in trace_get_user() where there's an incrementation to
parser->idx without a check against the size. The way it is triggered
is if userspace sends in 128 characters (EVENT_BUF_SIZE + 1), the loop
that reads the last character stores it and then breaks out because
there is no more characters. Then the last character is read to determine
what to do next, and the index is incremented without checking size.

Then the caller of trace_get_user() usually nulls out the last character
with a zero, but since the index is equal to the size, it writes a nul
character after the allocated space, which can corrupt memory.

Luckily, only root user has write access to this file.

Link: http://lkml.kernel.org/r/20131009222323.04fd1a0d@gandalf.local.home

Reported-by: Andrey Konovalov <andreyknvl@google.com>
Signed-off-by: Steven Rostedt <rostedt@goodmis.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

tracing/sched: add load balancer tracepoint

When doing performance analysis it can be useful to see exactly
what is going on with the load balancer - when it runs and why
exactly it may not be redistributing load.

This additional tracepoint will show the idle context of the
load balance operation (idle, not idle, newly idle), various
values from the load balancing operation, the final result,
and the new balance interval.

Change-Id: I9e5c97ae3878bea44e60d189ff3cec2275f2c75e
Signed-off-by: Steve Muckle <smuckle@codeaurora.org>

sched: Fix clear NOHZ_BALANCE_KICK

I have faced a sequence where the Idle Load Balance was sometime not
triggered for a while on my platform, in the following scenario:

 CPU 0 and CPU 1 are running tasks and CPU 2 is idle

 CPU 1 kicks the Idle Load Balance
 CPU 1 selects CPU 2 as the new Idle Load Balancer
 CPU 2 sets NOHZ_BALANCE_KICK for CPU 2
 CPU 2 sends a reschedule IPI to CPU 2

 While CPU 3 wakes up, CPU 0 or CPU 1 migrates a waking up task A on CPU 2

 CPU 2 finally wakes up, runs task A and discards the Idle Load Balance
       task A quickly goes back to sleep (before a tick occurs on CPU 2)
 CPU 2 goes back to idle with NOHZ_BALANCE_KICK set

Whenever CPU 2 will be selected as the ILB, no reschedule IPI will be sent
because NOHZ_BALANCE_KICK is already set and no Idle Load Balance will be
performed.

We must wait for the sched softirq to be raised on CPU 2 thanks to another
part the kernel to come back to clear NOHZ_BALANCE_KICK.

The proposed solution clears NOHZ_BALANCE_KICK in schedule_ipi if
we can't raise the sched_softirq for the Idle Load Balance.

Change since V1:

- move the clear of NOHZ_BALANCE_KICK in got_nohz_idle_kick if the ILB
  can't run on this CPU (as suggested by Peter)

Signed-off-by: Vincent Guittot <vincent.guittot@linaro.org>
Signed-off-by: Peter Zijlstra <peterz@infradead.org>
Link: http://lkml.kernel.org/r/1370419991-13870-1-git-send-email-vincent.guittot@linaro.org
Signed-off-by: Ingo Molnar <mingo@kernel.org>
Git-commit: 873b4c65b519fd769940eb281f77848227d4e5c1
Git-repo: git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
[smuckle@codeaurora.org: minor merge resolution for 3.4 in scheduler_ipi()]
Signed-off-by: Steve Muckle <smuckle@codeaurora.org>
Change-Id: I3548612057cccc2ecc29429c129c44183083831f

slub: tid must be retrieved from the percpu area of the current processor

As Steven Rostedt has pointer out: rescheduling could occur on a
different processor after the determination of the per cpu pointer and
before the tid is retrieved. This could result in allocation from the
wrong node in slab_alloc().

The effect is much more severe in slab_free() where we could free to the
freelist of the wrong page.

The window for something like that occurring is pretty small but it is
possible.

Change-Id: I9e658e97ed2096f658d6e67739764a86151f13e3
Signed-off-by: Christoph Lameter <cl@linux.com>
Signed-off-by: Pekka Enberg <penberg@kernel.org>
Git-commit: 7cccd80b4397699902aced1ad3d692d384aaab77
Git-repo: git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
Signed-off-by: Matt Wagantall <mattw@codeaurora.org>

mm: panic on the first bad page table entry access

Sometimes having a number of bad page table entries precipitates in
a crash much later. Because of this, we do not have any context for
the point at which the first bad pte entry was encountered. Hence,
panic on first such instance to help gather context for debug.

Change-Id: Idddf2b977214eb1463d08e16630e98264b9af487
Signed-off-by: Pushkar Joshi <pushkarj@codeaurora.org>

debug-pagealloc: Panic on pagealloc corruption

Currently, we just print the pagealloc corruption warnings and
proceed. Sometimes, we are getting multiple errors printed down
the line. It will be good to get the device state as early as
possible when we get the first pagealloc error.

Change-Id: I79155ac8a039b30a3a98d5dd1384d3923082712f
Signed-off-by: Subbaraman Narayanamurthy <subbaram@codeaurora.org>

mm: methods for teaching filesystems about PG_swapcache pages

In order to teach filesystems to handle swap cache pages, three new page
functions are introduced:

  pgoff_t page_file_index(struct page *);
  loff_t page_file_offset(struct page *);
  struct address_space *page_file_mapping(struct page *);

page_file_index() - gives the offset of this page in the file in
PAGE_CACHE_SIZE blocks.  Like page->index is for mapped pages, this
function also gives the correct index for PG_swapcache pages.

page_file_offset() - uses page_file_index(), so that it will give the
expected result, even for PG_swapcache pages.

page_file_mapping() - gives the mapping backing the actual page; that is
for swap cache pages it will give swap_file->f_mapping.

Change-Id: I13d18bb25be606760eac26cc842eb7c9fc9e4766
Signed-off-by: Peter Zijlstra <a.p.zijlstra@chello.nl>
Signed-off-by: Mel Gorman <mgorman@suse.de>
Reviewed-by: Rik van Riel <riel@redhat.com>
Cc: Christoph Hellwig <hch@infradead.org>
Cc: David S. Miller <davem@davemloft.net>
Cc: Eric B Munson <emunson@mgebm.net>
Cc: Eric Paris <eparis@redhat.com>
Cc: James Morris <jmorris@namei.org>
Cc: Mel Gorman <mgorman@suse.de>
Cc: Mike Christie <michaelc@cs.wisc.edu>
Cc: Neil Brown <neilb@suse.de>
Cc: Sebastian Andrzej Siewior <sebastian@breakpoint.cc>
Cc: Trond Myklebust <Trond.Myklebust@netapp.com>
Cc: Xiaotian Feng <dfeng@redhat.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Git-commit: f981c5950fa85916ba49bea5d9a7a5078f47e569
Git-repo: git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
[ohaugan@codeaurora.org: Resolved merge issues]
Signed-off-by: Olav Haugan <ohaugan@codeaurora.org>

msm: camera: Send VFE_REG_UPDATE_CMD while enabling liveshot.

Sometimes, especially with YUV sensors, snapshot frame is
not received in time when liveshot is triggered.

CRs-Fixed: 501466
Change-Id: Ib92929ebe82eadb92492d899b2077832fab02842

Signed-off-by: Sai Kumar Sanagavarapu <ssanagav@codeaurora.org>
Signed-off-by: Sridhar Gujje <sgujje@codeaurora.org>

msm: camera: Handle locks properly

Update camera drivers to unlock mutex while returning
the function in caseof errors.

Change-Id: Iaac7ae3a0337445ee072c10c69080c24ed6e512c
Signed-off-by: satyavaraprasad yerramsetti <satyav@codeaurora.org>

msm: camera: fix the out of order of frames issue

observed that if the frame processing in the userspace
is delayed, the incoming frames from the hardware are being sent
to user before the diverted frame returns.so dropping the
the delayed postprocessing frame to prevent out of order

Change-Id: I43b0f9ea7a7683a419ce142b7d4fdf9e13d11d95
Signed-off-by: Lakshmi Narayana Kalavala <lkalaval@codeaurora.org>

msm: camera: Enable use of AVTimer, Rotation and Crop for VT

The changes expose parameters for the application to set
the use of AVTimer for TimeStamp information and rotation
angle for video stream along with crop for VT use case.

CRs-fixed: 498762
Change-Id: Icf883f53513ab084f0970e84bbccd8bb9ec64737
Signed-off-by: Alok Kediya <kediya@codeaurora.org>

msm: camera: Recovery through camif stop and overall reset.

Add recovery mechanism in case of bus overflow. As part of the
recovery, stop the CAMIF, reset the VFE and reload the AXI
write masters and then restore the IRQ settings to VFE.

Change-Id: Iba6576777f05135cc13c1ee0c9db764d35c7282a
Signed-off-by: Kevin Chan <ktchan@codeaurora.org>
Signed-off-by: Praveen Ac <praveenac@codeaurora.org>
Signed-off-by: Kiran Kumar H N <hurlisal@codeaurora.org>

msm: camera: Add recovery routine for live snapshot.

During live snapshot, if bus overflow happen, recovery routine will
kick in and reset the hardware. At this point, the live snapshot
might not be completed and application will continue to wait for
the snapshot to complete. This change adds the logic to restart
the snapshot process after recovery is completed.

Change-Id: I9ba0a27ce53eb008a4af8d65a3f37a7cded03559
Signed-off-by: Kevin Chan <ktchan@codeaurora.org>
Signed-off-by: Praveen Ac <praveenac@codeaurora.org>
Signed-off-by: Kiran Kumar H N <hurlisal@codeaurora.org>

msm: camera: Move halt logic in case of overflow to ISR.

Move the halt logic which includes AXI HALT and CAMIF Disable
to ISR to start the recovery mechanism sooner.
Add some protection in case of liveshot.

Change-Id: I28ec462474524c0064cd7ecd4f77801cd494e514
Signed-off-by: Kevin Chan <ktchan@codeaurora.org>
Signed-off-by: Praveen Ac <praveenac@codeaurora.org>
Signed-off-by: Kiran Kumar H N <hurlisal@codeaurora.org>

msm: camera: Add mechanism to stop overflow recovery and handle IOMMU pagefault

CRs-Fixed: 491200

Change-Id: I1e498d87853c4dee8b1821595aad1958cb5341d3
Signed-off-by: Roja Rani Yarubandi <rojay@codeaurora.org>
Signed-off-by: Sridhar Gujje <sgujje@codeaurora.org>

msm: camera: Handle ioctls issued on vfe subdevice properly

In case vfebase is not set by the time ioctl is issued on the
vfe subdevice, it might lead to kernel panic if the arguments
of the ioctl are not set properly. Now handling these ioctls
before checking for vfebase will remove the possibility of a
kernel panic.

CRs-Fixed: 502383
Change-Id: Ib36db26c58acbaef14f1052aed71b7c3701e93a3
Signed-off-by: Aditya Jonnalagadda <ajonnala@codeaurora.org>

msm: camera: Null check added at iommu_attach_device

In case domain has not been initialized before, added a null
check for it inorder to avoid a potential kernel panic.

CRs-Fixed: 502383
Change-Id: I43a173e96415bdaea0968ce6ca37e6c1ee75d666
Signed-off-by: Aditya Jonnalagadda <ajonnala@codeaurora.org>

msm: camera: Enable frame based AXI WM for RDI0

Frame based AXI WM configuration for RDI0 path
Also populate sensor type in the device info structure.

Change-Id: Ib6d65cd8cb1e4655c4f67903a8f329962512115e
Signed-off-by: Sai Kumar Sanagavarapu <ssanagav@codeaurora.org>

Conflicts:
	drivers/media/video/msm/vfe/msm_vfe32.c

msm: camera: Enable CAMIF SOF in case of non dual camera usecase.

When Dual camera usecase is enabled, the ISPIF PIX SOF is enabled
by default to synchronize with the RDI interfaces.
But in non dual camera usecases, use CAMIF SOF IRQ to increment
the frame IDs being embedded inside the output frames.
Sometimes the SOF IRQs of frame 'n' is clubbed along with the
Output IRQs of the frame 'n-1'. Thus although the output IRQs
are supposed for frame 'n-1' it results in a frame ID of 'n' which
will cause incorrect behaviour downstream. Correct this behaviour
by checking the SOF and Output status bits in the IRQ Mask and
adjust the frame ID accordingly.

CRs-Fixed: 481721
Change-Id: If7a9db2337febf10e89d44c58b9d980d874c69b6
Signed-off-by: Sai Kumar Sanagavarapu <ssanagav@codeaurora.org>
Signed-off-by: Kiran Kumar H N <hurlisal@codeaurora.org>

msm: camera: ABCC feature porting in kernel space

Reference - https://review-android.quicinc.com/#/c/141518/
CRs-fixed: 502029

Change-Id: I40ee7349f26cc9d040a9b36cf8cf30020991c381
Signed-off-by: Alok Kediya <kediya@codeaurora.org>

msm: camera: Return from DQBUF ioctl in case of error.

Incase the vb2_dqbuf call returns error, we are continuing
ahead and trying to access the fields of the vb2 buffer which
may not be initialized yet. Avoid this by checking the
return value of vb2_dqbuf and return immediately in case of
errors.

Change-Id: I33036fe9b3bd7ce2b28e9cd6e4cd5f293425be95
CRs-Fixed: 495635
Signed-off-by: Kiran Kumar H N <hurlisal@codeaurora.org>

msm:camera: Fix signedness issue in hw_exec_cmds

  In hw_exec_cmds()second argument m_cmds should be
  of type unsigned interger

Change-Id: Idad2eb1a59481f3fe9f90221ff2061e8dae57013
CRs-Fixed: 493314
Signed-off-by: Monika Alekhya <malekh@codeaurora.org>

msm: camera: Handle incorrect parameter properly

By this change, when incorrect size is passed, we
return back rather than proceeding forward.

CRs-Fixed: 477936

Change-Id: I8f3ea3c7680a468e36ed0cdb026e95cc29e3f4be
Signed-off-by: Aditya Jonnalagadda <ajonnala@codeaurora.org>

msm: gemini: Reset the core incase of overflow error

Reset the gemini core for the overflow usecases.

Change-Id: I64b4283806d67615b2963e0d6a42f04a40d6a892
Signed-off-by: Sunid Wilson <sunidw@codeaurora.org>

msm: gemini: Fix the size argument of hw_region_dump function.

The size argument for the msm_gemini_hw_region_dump function is
signed which is not correct, since the function operates on
it as if it is unsigned. Change this to unsigned parameter.

Change-Id: Icea70ad20b010651047b911e7b6ae57889e610e7
Signed-off-by: Kiran Kumar H N <hurlisal@codeaurora.org>

msm:camera: Increase the v4l2 event queue length

Observed missing of v4l2 events to userspace media controller,
this can happen if media controller is blocked in post processing
the frames. Hence increasing the queue length gives enough time
to accomodate all the events without being overwritten with
newer events.

Change-Id: Ic3b5fd29df8c6384e83312b9c9ffd788bdf60951
Signed-off-by: Lakshmi Narayana Kalavala <lkalaval@codeaurora.org>

 msm:camera: Fix overflow issue in ioctl_hw_cmds function

    'len' is of type signed int 32bit,but the assigned value
    may exceed maximum unsigned int32 range.Add overflow check
    and graceful exit if 'm'exceeds UINT32_MAX value.

Change-Id: I38f0d10a0cb44d08d0054f91044fc891c246ebd1
CRs-Fixed: 493314
Signed-off-by: Monika Alekhya <malekh@codeaurora.org>
Signed-off-by: Sridhar Gujje <sgujje@codeaurora.org>

msm: camera: Check for open camera instances before release

Release the subdevs and QOS variables only if there are active
camera instances

Change-Id: If8f6eb80cf7bd21e36de988ad6c4df7441d655ae
CRs-fixed: 490249
Signed-off-by: Alok Kediya <kediya@codeaurora.org>

msm: camera: Fix for kernel panic

check if buffer instance handle is zero while
getting pcam instance based on instance handle
in msm_mctl_reserve_free_buf function

Change-Id: Id3861c4f29fb4f7fd62ad6de6597e65c7c4f656b
Signed-off-by: manish gotefode <mgote@codeaurora.org>

msm: camera: Guard the release of resources using mutex

The critical section of the code related to release needs to be
protected against race conditions.

Change-Id: I2165d37168882c345e2f845df08b74eb49b3cb23
CRs-fixed: 518302
Signed-off-by: Alok Kediya <kediya@codeaurora.org>

msm-camera: Added the  NULL check in gemini driver.

Adding NULL check for ionhandle and y_off in gemini driver files.

CRs-Fixed: 504159

Change-Id: I6d20298183bec0c3c2c16088a936ac6f7d307da4
Signed-off-by: Katta Santhisindhu <kattas@codeaurora.org>

msm: camera: prevent invalid access through mmap

Disable access to invalid addresses through mmap.
Add appropriate range checks to ensure valid accesses
through framebuffer mmap. This prevents illegal
access into memory.

Change-Id: Ie053d9d8efe951b88f28b020dd9c2356e54723a7
CRs-Fixed: 475794
Signed-off-by: Manoj Rao <manojraj@codeaurora.org>

msm: camera: Enable AVTimer related APIs

Uncomment the code related to using AVTimer APIs to retrieve
TimeStamp information from QDSP.

CRs-fixed: 498762
Change-Id: I727f0d4219da2e9ccd5e88d18d1041a82abbb4cc
Signed-off-by: Alok Kediya <kediya@codeaurora.org>

msm-camera: Bound check num_cid from userspace in csid driver

Upper and lower bound checks are enforced for num_cid
which is passed from userspace with lower as 1 and
max of 16.

Change-Id: I69a405995d2f53c3a0b0a72b50460bebfdf38442
CRs-Fixed: 511358
Signed-off-by: Katta Santhisindhu <kattas@codeaurora.org>

msm: camera: ifdef AVTimer APIs

msm_fb: Fix color format mapping between V4L2 and MDP

Add V4L2_PIX_FMT_UYVY, V4L2_PIX_FMT_YUYV, V4L2_PIX_FMT_YVU420
format mapping in video driver. Add support  for
MDP_CBYCRY_H2V1 format for mdp4.

Change-Id: I4d5f1ae4ea71aa57c168f7143ff15f79e27cc1d0
Signed-off-by: Pawan Kumar <pavaku@codeaurora.org>

msm: camera: Added bounds check for index parameter

Bound check the index param from user space to avoid
any invalid memory access.

CRs-Fixed: 583366

Change-Id: I0f887bb8f1fa5a69a55e23dbb522b3bb694ad27f
Signed-off-by: Alok Kediya <kediya@codeaurora.org>

avtimer: kernel driver to expose avtimer to userspace

This driver expose the API to get LPASS subsystem
out of power collapsed state and exposes ioctl control to
read avtimer tick.

Change-Id: I4b50fbfca5741449a8e5f0d0514f5ca7bccec04d
Signed-off-by: Srikanth Uyyala <suyyala@codeaurora.org>

cpufreq: ondemand:kernel NULL pointer dereference at dbs_check_cpu

Function dbs_check_cpu  calls __cpufreq_driver_getavg
With  policy as IN/OUT parameter.
There is possiblity of policy becoming NULL in
 __cpufreq_driver_getavg. Same policy is getting
accessed in the for loop which leads to NULL pointer dereference.
So NULL check is required for the policy

CRs-fixed: 582925
Change-Id: Ib8d8de8d66500430a5aa4c275937640e4f934aa8
Signed-off-by: Swetha Chikkaboraiah <schikk@codeaurora.org>

cpufreq: Disable cpu-boost by default

Disable cpu-boost by default, so that it can be turned ON only by
setting the module parameter boost_ms through command prompt when
required.

Change-Id: Ia9bc280892f65ed1d2e8051d1951e51922ad13db
Signed-off-by: Rohit Gupta <rohgup@codeaurora.org>

cpufreq: interactive: Allow 1 ms error in above_hispeed_delay comparisons

Allow for an error of 1 ms while taking into account
above_hispeed_delay for a frequency

Change-Id: I744e44387152e4efb5978df4f2b9533bf79d4582
Signed-off-by: Rohit Gupta <rohgup@codeaurora.org>

cpufreq: interactive: Reset floor_validate_time if busy at max for 100ms

When the interactive governor selects to run at max frequency it doesn't
re-schedule the timer until it hits an idle. This change checks if the CPU
has been continuously busy for last 100ms on hitting an idle start. If yes,
then floor_validate_time is reset so that the CPU stays at max frequency
for at least another 100 ms before stepping down.
This is an important feature for detecting CPU intensive workloads which
require high frequencies for achieving better performance.

Change-Id: I7d48ffbc3d50a80af9be3bf94667ee3d0120b763
Signed-off-by: Rohit Gupta <rohgup@codeaurora.org>

cpufreq: interactive: Add a sampling_down_factor for max frequencies

Change min_sample_time to 100ms when running at max

Change-Id: Ia7e35b0625bedf20e7ef3a1f52e5828ffbfed93e
Signed-off-by: Rohit Gupta <rohgup@codeaurora.org>

cpufreq: interactive: sync freq feature for interactive governor

1) Add load info to cpufreq_interactive_cpuinfo
2) If load on any other online cpu exceeds sync_freq_load_threshold,
   do not allow the frequency to drop below sync_freq

Change-Id: I3617e10f87b85178914a18bcf04ac2a31a4f1ec1
Signed-off-by: Rohit Gupta <rohgup@codeaurora.org>
(cherry picked from commit c26e25944543c61b34b1830938bb6f353a2580ac)

cpufreq: interactive: Remove trace event from idle_start handler

Removed the trace_cpufreq_interactive_idle_start.
Also fix a crash resulting from accessing NULL policy before taking
the pcpu->enable_sem lock. The policy can be NULL if the core is
hotplugged out before the enable_sem lock is taken.

Change-Id: I7e2809cc016b3b383a44cdf3c697013e2d2b5417
Signed-off-by: Rohit Gupta <rohgup@codeaurora.org>
(cherry picked from commit 3b7992b90216c74a9ae9ce0df90bc446687a2313)

msm: gemini: Fix the error irq handling sequence

Update the gemini IRQ handling sequence in ISR.

Change-Id: Ia47e1600174462341027540247a79cba7ffd9c56
Signed-off-by: Sunid Wilson <sunidw@codeaurora.org>
Signed-off-by: Kiran Kumar H N <hurlisal@codeaurora.org>

msm: Fix race condition in domain lookup

During lookup of domains we take a pointer to the root node
of the rb tree before taking the mutex to protect the rb tree.
However, the rb root node might change if another process updates
the rb tree after we take the pointer to the root node. This can
cause us to not find the entry that we are looking for.
Fix this by ensuring we have taken the mutex before getting the
root node pointer.

CRs-fixed: 493503
Change-Id: I4702740e486fda0cd92df0401d8e4706598a899b
Signed-off-by: Olav Haugan <ohaugan@codeaurora.org>
Signed-off-by: Sridhar Gujje <sgujje@codeaurora.org>

gpu: msm2: Sync with upstream

Change-Id: I6a9e8e44d993d9c9ee26f7462169ef1d20a6d113

video: msm: Sync camera to Samsung release ML4

Change-Id: Ibd6e177c15120de2a9d6c2dbb44d45c9baa4aa13