msm: mdss: send DCS commands in LP mode by default

Recent commit 391a24fe60cd1417a6bb105decddf20cec71e2ef sets
default power mode for DCS commands to HS, because of which
on nt35590_720p video mode and command mode panel suspend resume
fails. So, set the default power mode to LP as it was earlier.

Change-Id: Ifa5090ddc92cc953acc61024d0bdc3d6e93cbb10
Signed-off-by: Sandeep Panda <spanda@codeaurora.org>
msm: mdss: fix rotator failures when pixel format changes

Current code fails the SMP allocation in the rotator session
when the pixel format during the session changes from YUV to
RGB. Fix these failures by releasing the SMP allocation
if pixel format changes.

Change-Id: Ic051ad4c48be6d4998d392fa74f7b3fb2c131980
Signed-off-by: Ingrid Gallardo <ingridg@codeaurora.org>
msm: mdss: ensure rotator work is done before reconfiguring session

When queuing new parameters to rotator, need to ensure that current work
is done before reconfiguring pipe parameters, otherwise there may be a
mismatch on parameters with the buffers programmed once work is
scheduled.

Change-Id: I258aedca82bb10498d0ef4cbaa697a29c3c34a99
Signed-off-by: Adrian Salido-Moreno <adrianm@codeaurora.org>
msm: mdss: Handle wfd READY event in display commit

Flicker is seen on wfd while rotation is done.
To prevent this, shared lock should be acquired properly
in case of READY event for wfd in display commit thread.

Change-Id: I0803eeb4d4f1d6283a6addaf40c435fded538718
Signed-off-by: Raghavendra Ambadas <rambad@codeaurora.org>
msm: display: release kickoff before fence waiting

After configuration is done, save the acquired fences,
release the kickoff and ov_lock, then wait for the cached
fences. This way the next prepare will not be blocked by
waiting for acquired fences.

Change-Id: Id6f5b30e0d20cd59bd0aebf71af7cb47ecb1cf5b
Signed-off-by: Ken Zhang <kenz@codeaurora.org>
msm: mdss: unmap rotator src buffer after mapping the next buffer

In secure case, when same buffer is queued in multiple
composition cycles we should map it before unmapping it
so that TZ will not clear the buffer content.

In the former case ref count can be zero which can lead to TZ
clearing the buffer

Change-Id: I5aea01f8d2c4330b93319434ced55f816558619d
Signed-off-by: Kalyan Thota <kalyant@codeaurora.org>
msm: mdss: delay iommu mapping of buffers until commit

Currently iommu map call is done in client's context during overlay
play, this requires iommu attachment to correctly map buffers.
This mapping can be delayed until the actual commit and avoid
unnecessary delays in client's context. Also, only unmap buffers if they
have been mapped, instead of checking if iommu is attached.

Change-Id: I6b26acb3ed843f03b42df1386ee7bdd412365aff
Signed-off-by: Adrian Salido-Moreno <adrianm@codeaurora.org>
cpufreq: interactive: Move definition of cpufreq_gov_interactive downwards

This moves definition of cpufreq_gov_interactive towards the bottom of file, so
that we don't have to add prototype of cpufreq_governor_interactive() in the
beginning of file.

Change-Id: I04bd1004954eb36502c5cd7e35d3d7274cddaf95
Signed-off-by: Viresh Kumar <viresh.kumar@linaro.org>
Git-commit: e50d640cacfe61e69f1b4fa92fa0174c688e919c
Git-Repo: https://android.googlesource.com/kernel/common.git
[junjiew@codeaurora.org: Resolve merge conflicts]
Signed-off-by: Junjie Wu <junjiew@codeaurora.org>
cpufreq: Move get_cpu_idle_time() to cpufreq.c

Governors other than ondemand and conservative can also use
get_cpu_idle_time() and they aren't required to compile
cpufreq_governor.c. So, move these independent routines to
cpufreq.c instead.

Signed-off-by: Viresh Kumar <viresh.kumar@linaro.org>
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
Git-commit: 72a4ce340a7ebf39e1c6fdc8f5feb4f974d6c635
Git-repo: git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
[junjiew@codeaurora.org: update non-upstream files]
Signed-off-by: Junjie Wu <junjiew@codeaurora.org>

Change-Id: I3227454599250011a19a752c962e3cacb1fb0301
cpufreq: interactive: Squashed cleanup patches

Revert "cpufreq: interactive: Remove unnecessary cpu_online() check"

This reverts commit 7b46e2e6d8a3c3c32706ee3c3c3b507d050bedfb.

Revert "cpufreq: interactive: Allow 1 ms error in above_hispeed_delay comparisons"

This reverts commit ff6af80775231f1dfab8353d0b665718222218bf.

Commit ff6af807 tries to avoid a corner case where frequency is stuck in
hispeed_freq for one additional window. For example, if timer_rate is
20ms, and go_hispeed_delay is 40ms, frequency might be stuck at
hispeed_freq for 60ms due to imprecision in jiffies. Same problem can be
easily solved by making go_hispeed_delay 1ms smaller instead of changing
the code.

Signed-off-by: Junjie Wu <junjiew@codeaurora.org>

cpufreq: interactive: Revert timer start modification

commit f8b276565ce95bd788af0fc8d060f92632590a40
(cpufreq: Sync on thread migration optimizations)
introduced a change to cpufreq_interactive_timer_start() in order
to reschedule the timer differently based on whether min or max
is changed. A better way is to reschedule the timer only when
necessary.

Revert timer start modification in preparation for the final fix.

Signed-off-by: Junjie Wu <junjiew@codeaurora.org>

Revert "cpufreq: interactive: Optimize sync_freq implementation"

This reverts commit 4da7f27d4dbd5bcfb8479467444f2cf198217933.

cpufreq: interactive: Revert sync on thread migration optimizations

Commit f8b276565ce95bd788af0fc8d060f92632590a40
(cpufreq: Sync on thread migration optimizations) is no longer needed
for targets with synchronous CPUs.

Part of that commit has already been reverted in
a913b3afcaa55356f5f793ae895312c8ae7e1f71
(cpufreq: interactive: Revert timer start modification)

This commit reverts the remaining changes.

Signed-off-by: Junjie Wu <junjiew@codeaurora.org>

cpufreq: interactive: Revert sync freq feature

Sync freq feature is not valid for a HMP system with clusters.

This commit reverts commit f3d1980b4db4c20f21acaed59cc511c2df84cec2
(cpufreq: interactive: sync freq feature for interactive governor)

Signed-off-by: Junjie Wu <junjiew@codeaurora.org>

cpufreq: interactive: Remove sampling_down_factor

Remove sampling_down_factor feature.

This commit revert d094d23694edf41fee50ebc544795d6116451643
(cpufreq: interactive: Add a sampling_down_factor for max frequencies)
and subsequent modifications related to sampling down factor.

Signed-off-by: Junjie Wu <junjiew@codeaurora.org>

Conflicts:
	drivers/cpufreq/cpufreq_interactive.c

Change-Id: I9e5fd451e7eaefe8ef7775365cc5a4527d37188f
cpufreq: interactive: Align timer windows for all CPUs

It's more advantageous to evaluate all CPUs at same time so that
interactive governor gets a complete picture of the load on
each CPU at a specific time. It could also reduce number of speed
changes made if there are many CPUs controlled by same policy. In
addition, waking up all CPUs at same time would allow the cluster
to go into a deeper sleep state when it's idle.

Change-Id: I6915050c5339ef1af106eb906ebe4b7c618061e2
Signed-off-by: Junjie Wu <junjiew@codeaurora.org>
cpufreq: interactive: Reset last evaluated jiffy in idle callback

When CPU has been busy for a long time, last evaluated jiffy will be
quite behind because the timer would have been canceled. We don't want
to schedule a timer to fire in the past as load will always be 100%.

Reset last evaluated jiffy so that timer will be scheduled for the
next window.

Change-Id: Ie25e65eab1f16acdeda267987ca605d653f1f32a
Signed-off-by: Junjie Wu <junjiew@codeaurora.org>
cpufreq: interactive: Round up timer_rate to match jiffy

Timers are scheduled in unit of jiffies. Round up timer_rate so that
it matches the actual sampling period.

Change-Id: I47e666f835752528331f50b1e76784e6d67f8bcf
Signed-off-by: Junjie Wu <junjiew@codeaurora.org>
cpufreq: interactive: Use del_timer/add_timer_on to rearm timers

Replace mod_timer_pinned() with del_timer(), add_timer_on().
mod_timer_pinned() always adds timer onto current CPU. Interactive
governor expects each CPU's timers to be running on the same CPU.
If cpufreq_interactive_timer_resched() is called from another CPU,
the timer will be armed on the wrong CPU.

Replacing mod_timer_pinned() with del_timer() and add_timer_on()
guarantees timers are still run on the right CPU even if another
CPU reschedules the timer. This would provide more flexibility
for future changes.

Change-Id: I3a10be37632afc0ea4e0cc9c86323b9783b216b1
Signed-off-by: Junjie Wu <junjiew@codeaurora.org>
soc: qcom: rq_stats: remove the redundant iowait check

Iowait_time check is redundant and it would lead to heavy load
due to miscaluculation of idle time. Hence remove this check
as iowait will considered based on io_busy flag.

Change-Id: I4dd9f9c79205eca588daea8cc0fe892394a83391
CRs-fixed: 662052
Signed-off-by: Anji Jonnala <anjir@codeaurora.org>
cgroup: Take css_set_lock from cgroup_css_sets_empty()

As indicated in the comment above cgroup_css_sets_empty it needs the
css_set_lock. But neither of the 2 call points have it, so rather then fixing
the callers just take the lock inside cgroup_css_sets_empty().

Signed-off-by: Hans de Goede <hdegoede@redhat.com>
Change-Id: If7aea71824f6d0e3f2cc6c1ce236c3ae6be2037b
cgroup: Fix use after free of cgrp (cgrp->css_sets)

Running a 3.4 kernel + Fedora-18 (systemd) userland on my Allwinner A10
(arm cortex a8), I'm seeing repeated, reproducable list_del list corruption
errors when build with CONFIG_DEBUG_LIST, and the backtrace always shows
free_css_set_work as the function making the problematic list_del call.

I've tracked this doen to a use after free of the cgrp struct, specifically
of the cgrp->css_sets list_head, which gets cleared by free_css_set_work.

Since free_css_set_work runs form a workqueue, it is possible for it to not be
done with clearing the list when the cgrp gets free-ed. To avoid this the code
adding the links increases cgrp->count, and the freeing code running from the
workqueue decreases cgrp->count *after* doing list_del, and then if the count
goes to 0 calls cgroup_wakeup_rmdir_waiter().

However cgroup_rmdir() is missing a check for cgrp->count != 0, causing it
to still continue with the rmdir (which leads to the free-ing of the cgrp),
before free_css_set_work is done. Sometimes the free-ed memory is re-used
before free_css_set_work gets around to unlinking link->cgrp_link_list,
triggering the list_del list corruption messages.

This patch fixes this by properly checking for cgrp->count != 0 and waiting
for the cgroup_rmdir_waitq in that case.

Change-Id: I9dbc02a0a75d5dffa1b65d67456e00139dea57c3
Signed-off-by: Hans de Goede <hdegoede@redhat.com>
ARM: 7449/1: use generic strnlen_user and strncpy_from_user functions

This patch implements the word-at-a-time interface for ARM using the
same algorithm as x86. We use the fls macro from ARMv5 onwards, where
we have a clz instruction available which saves us a mov instruction
when targetting Thumb-2. For older CPUs, we use the magic 0x0ff0001
constant. Big-endian configurations make use of the implementation from
asm-generic.

With this implemented, we can replace our byte-at-a-time strnlen_user
and strncpy_from_user functions with the optimised generic versions.

Reviewed-by: Nicolas Pitre <nico@linaro.org>
Signed-off-by: Will Deacon <will.deacon@arm.com>
Signed-off-by: Russell King <rmk+kernel@arm.linux.org.uk>

lib: Sparc's strncpy_from_user is generic enough, move under lib/

To use this, an architecture simply needs to:

1) Provide a user_addr_max() implementation via asm/uaccess.h

2) Add "select GENERIC_STRNCPY_FROM_USER" to their arch Kcnfig

3) Remove the existing strncpy_from_user() implementation and symbol
   exports their architecture had.

Signed-off-by: David S. Miller <davem@davemloft.net>
Acked-by: David Howells <dhowells@redhat.com>

lib: add generic strnlen_user() function

This adds a new generic optimized strnlen_user() function that uses the
<asm/word-at-a-time.h> infrastructure to portably do efficient string
handling.

In many ways, strnlen is much simpler than strncpy, and in particular we
can always pre-align the words we load from memory.  That means that all
the worries about alignment etc are a non-issue, so this one can easily
be used on any architecture.  You obviously do have to do the
appropriate word-at-a-time.h macros.

Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

kernel: Move REPEAT_BYTE definition into linux/kernel.h

And make sure that everything using it explicitly includes
that header file.

Signed-off-by: David S. Miller <davem@davemloft.net>

word-at-a-time: make the interfaces truly generic

This changes the interfaces in <asm/word-at-a-time.h> to be a bit more
complicated, but a lot more generic.

In particular, it allows us to really do the operations efficiently on
both little-endian and big-endian machines, pretty much regardless of
machine details.  For example, if you can rely on a fast population
count instruction on your architecture, this will allow you to make your
optimized <asm/word-at-a-time.h> file with that.

NOTE! The "generic" version in include/asm-generic/word-at-a-time.h is
not truly generic, it actually only works on big-endian.  Why? Because
on little-endian the generic algorithms are wasteful, since you can
inevitably do better. The x86 implementation is an example of that.

(The only truly non-generic part of the asm-generic implementation is
the "find_zero()" function, and you could make a little-endian version
of it.  And if the Kbuild infrastructure allowed us to pick a particular
header file, that would be lovely)

The <asm/word-at-a-time.h> functions are as follows:

 - WORD_AT_A_TIME_CONSTANTS: specific constants that the algorithm
   uses.

 - has_zero(): take a word, and determine if it has a zero byte in it.
   It gets the word, the pointer to the constant pool, and a pointer to
   an intermediate "data" field it can set.

   This is the "quick-and-dirty" zero tester: it's what is run inside
   the hot loops.

 - "prep_zero_mask()": take the word, the data that has_zero() produced,
   and the constant pool, and generate an *exact* mask of which byte had
   the first zero.  This is run directly *outside* the loop, and allows
   the "has_zero()" function to answer the "is there a zero byte"
   question without necessarily getting exactly *which* byte is the
   first one to contain a zero.

   If you do multiple byte lookups concurrently (eg "hash_name()", which
   looks for both NUL and '/' bytes), after you've done the prep_zero_mask()
   phase, the result of those can be or'ed together to get the "either
   or" case.

 - The result from "prep_zero_mask()" can then be fed into "find_zero()"
   (to find the byte offset of the first byte that was zero) or into
   "zero_bytemask()" (to find the bytemask of the bytes preceding the
   zero byte).

   The existence of zero_bytemask() is optional, and is not necessary
   for the normal string routines.  But dentry name hashing needs it, so
   if you enable DENTRY_WORD_AT_A_TIME you need to expose it.

This changes the generic strncpy_from_user() function and the dentry
hashing functions to use these modified word-at-a-time interfaces.  This
gets us back to the optimized state of the x86 strncpy that we lost in
the previous commit when moving over to the generic version.

Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

ARM: 7450/1: dcache: select DCACHE_WORD_ACCESS for little-endian ARMv6+ CPUs

DCACHE_WORD_ACCESS uses the word-at-a-time API for optimised string
comparisons in the vfs layer.

This patch implements support for load_unaligned_zeropad for ARM CPUs
with native support for unaligned memory accesses (v6+) when running
little-endian.

Change-Id: Ifdf8207f2581f93870eb0e627f5d12f97c4be7cc
Reviewed-by: Nicolas Pitre <nico@linaro.org>
Signed-off-by: Will Deacon <will.deacon@arm.com>
Signed-off-by: Russell King <rmk+kernel@arm.linux.org.uk>
Revert "epoll: use freezable blocking call"

This reverts commit 1c441e921201 (epoll: use freezable blocking call)
which is reported to cause user space memory corruption to happen
after suspend to RAM.

Since it appears to be extremely difficult to root cause this
problem, it is best to revert the offending commit and try to address
the original issue in a better way later.

Change-Id: Ib57a2bda6c190454ae3bd3ae7eeb1456ea2156a6
References: https://bugzilla.kernel.org/show_bug.cgi?id=61781
Reported-by: Natrio <natrio@list.ru>
Reported-by: Jeff Pohlmeyer <yetanothergeek@gmail.com>
Bisected-by: Leo Wolf <jclw@ymail.com>
Fixes: 1c441e921201 (epoll: use freezable blocking call)
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
Cc: 3.11+ <stable@vger.kernel.org> # 3.11+
Git-commit: c511851de162e8ec03d62e7d7feecbdf590d881d
Git-repo: git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux-stable.git
Signed-off-by: Osvaldo Banuelos <osvaldob@codeaurora.org>
cma: assign to correct variable in __iommu_alloc_buffer

When we moved to pfns in [9740ba422e "cma: use pfn instead of pages for
argument passing"], there was one place where we should have been using
a page variable instead of a pfn. Fix this.

Change-Id: I8fd920dff19a21ad441a35c0f772f947bfb756d9
Signed-off-by: Mitchel Humpherys <mitchelh@codeaurora.org>