ion: replace userspace handle cookies with idr

Userspace handles should not leak kernel virtual addresses to
userspace.  They have to be validated by looking them up in an
rbtree anyways, so replace them with an idr and validate them
by using idr_find to convert the id number to the struct
ion_handle pointer.

Change-Id: Iab5667ba6f3a73256fec3949b23a9a6f8e14a283
Signed-off-by: Colin Cross <ccross@android.com>
Git-commit: 1126d98d8e34d771afcc72ce5d1c37ad4d474402
Git-repo: https://android.googlesource.com/kernel/common
[mitchelh@codeaurora.org: conflicts due to msm changes]
Signed-off-by: Mitchel Humpherys <mitchelh@codeaurora.org>
ion: don't use id 0 for handle cookie

ion userspace clients think that the cookie is a pointer, so they
use NULL to check if the handle has been initialized.  Set the first
id number to 1.

Change-Id: Ifb9af6029a8b08f57e41bc6160cc11e11001a2a9
Signed-off-by: Colin Cross <ccross@android.com>
Git-commit: 66df93b4c9e78cf433b76d7fe3da4cc7fd06c36b
Git-repo: https://android.googlesource.com/kernel/common
Signed-off-by: Mitchel Humpherys <mitchelh@codeaurora.org>
ion: add new ion_user_handle_t type for the user-space token

Declare new ion_user_handle_t type to contain the token returned to user-space.
This allows a 2-step migration of the user-space code to a new kernel header
first, then will allow us to change the definition of the ion_user_handle_type_t
to int without breaking the API.

Change-Id: I4200b6600df8e56fe98cf1580a13a65cb25ec646
Signed-off-by: Rom Lemarchand <romlem@google.com>
(cherry picked from commit ebb8269bbb05b06ecedca3e21b3e65f23d48eadd)
Git-commit: 29f271de6ffdf6a96375cd244986617e87afc8d0
Git-repo: https://android.googlesource.com/kernel/common
Signed-off-by: Mitchel Humpherys <mitchelh@codeaurora.org>
ion: hold reference to handle after ion_uhandle_get

commit 1262ab1846cf76f7549c66ef709120dbfbe6d49f (ion: replace
userspace handle cookies with idr) broke the locking in ion.
The ION_IOC_FREE and ION_IOC_MAP ioctls were relying on
ion_handle_validate to detect the case where a call raced
with another ION_IOC_FREE which may have freed the struct
ion_handle.

Rename ion_uhandle_get to ion_handle_get_by_id, and have it
take the client lock and return with an extra reference to
the handle.  Make each caller put its reference once it
is done with the handle.

Also modify users of ion_handle_validate to continue to hold
the client lock after calling ion_handle_validate until
they are done with the handle, and warn if ion_handle_validate
is called without the client lock held.

Change-Id: I56da5624fca3bed4ee24806b6ec39de903543341
Signed-off-by: Colin Cross <ccross@android.com>
Git-commit: 33a57aa073dac709bcdcba23bc4e2e7fcc6330f6
Git-repo: https://android.googlesource.com/kernel/common
[mitchelh@codeaurora.org: minor merge conflicts due to some missing
 casts since we haven't brought in the change that makes
 ion_user_handle_t an int.]
Signed-off-by: Mitchel Humpherys <mitchelh@codeaurora.org>
ion: export a few handle-related APIs

There are a few APIs (ion_handle_put and ion_handle_get_by_id) that are
useful for implementing Ion extensions (e.g. custom ioctl
handlers). Remove the `static' to make these APIs available to other Ion
code.

Change-Id: Ice8767853f628d8178e96a36db3da02fa97f3235
Signed-off-by: Mitchel Humpherys <mitchelh@codeaurora.org>
ion: msm: update custom caching ioctls for new handle format

The userspace API for Ion handles has changed slightly. Update the MSM
caching ioctls to work with the new format.

Change-Id: I6dee3190f5cad117a4d7059f1c7f0f01e05692c0
Signed-off-by: Mitchel Humpherys <mitchelh@codeaurora.org>
ion: msm: fix bug with handle id handling

0 is not a valid handle id value. If we get a 0 we should try to do the
dma_buf import.

Change-Id: I2b9355a5ad65c91247c0369047f921cf02908b1c
Signed-off-by: Mitchel Humpherys <mitchelh@codeaurora.org>
msm: kgsl: avoid zero length scatterlist allocation

During sglist allocation we calculate sglen as
per below

sglen_alloc = PAGE_ALIGN(size) >> PAGE_SHIFT;

sglen_alloc can be zero if size falls within the
last page. For example, when size = 0xFFFF_FF7B,
PAGE_ALIGN(0xFFFF_FF7B) will be 0, considering
0x1000 (4kb) PAGE_SIZE. if kzalloc() with
zero size, it will return ZERO_SIZE_PTR which is
not NULL and we always do NULL check. Dereferencing
ZERO_SIZE_PTR will lead to a distinct access fault.

Conflicts:
	drivers/gpu/msm/kgsl_sharedmem.h

Change-Id: Ibcc6198438c13b5111be0faa736328db92511597
CRs-Fixed: 563106
Signed-off-by: Prakash Kamliya <pkamliya@codeaurora.org>
msm: kgsl: devfreq_target requests can happen during SLUMBER

Bus updates should be ignored if the bus is already off.  The bus
will wake at the default frequency for the active power level.

Change-Id: I63b8d1aacfe45971929f21f7c63bdd8ba16536e1
CRs-fixed: 589899
Signed-off-by: Lucille Sylvester <lsylvest@codeaurora.org>
msm: kgsl: when unmapping from the mmu flush the entire tlb

Flushes the entire tlb when calling mmu_unmap to make sure there
is no race condition between unmapping and freeing the pages.

Change-Id: I911f8479a3aef2006f9df40a3419284423937542
Signed-off-by: Shrenuj Bansal <shrenujb@codeaurora.org>
ion: invalidate cache after zero'ing buffers even if uncached

Currently, we don't invalidate the cache if we're working with uncached
buffers. However, the memory for those mappings might actually be stale
in the cache since someone else might have touched it. Just invalidate
the cache for everyone, cached or uncached.

Without this change, corruption was observed on the display due to stale
data in graphics buffers from Ion.

CRs-Fixed: 585524
Change-Id: I0037beaadfde983af15d8f45918f7798264dd3ca
Signed-off-by: Mitchel Humpherys <mitchelh@codeaurora.org>
msm: kgsl: Don't open kgsl device in erroneous case

If kgsl_get_process_private() returns NULL, it goes to
err_stop with result = -ENOMEM. If open_count is 0,
adreno_stop() overwrites the result variable with 0.
This leads to kgsl_open() to be successful while it
shouldn't.

Change-Id: Ic12d92a099280e4d958fa192fa5128211120d361
Signed-off-by: Prabhat Awasthi <pawasthi@codeaurora.org>
msm: kgsl: Add check for NULL value from dev_get_drvdata

Check to see if dev_get_drvdata returns NULL and handle it.

CRs-Fixed: 552580
Change-Id: Ic0dedbad426dbbe15896608213067ee7337f3b34
Signed-off-by: Jordan Crouse <jcrouse@codeaurora.org>
msm: kgsl: Fix range checking for profile wrapping

There is a chance that the profile code will not wrap correctly.
This can cause the in stream profiling to cause buffer pre-run
or undershoot (accessing data before the buffer). Fix logic to
cause the correct wrapping.

Change-Id: I9aa68228ff5be1bd26ee1cf1a486859346a8027f
CRs-Fixed: 585754
Signed-off-by: Carter Cooper <ccooper@codeaurora.org>
msm: kgsl: Force the ME off before reading the microcode

On A3XX reading the microcode while the CP is running is dangerous
beyond words.  By setting the offset address for the read, we are
essentially changing the instruction pointer for the ME while it
is running causing opcode errors, gpu faults and/or system errors.

We do not want to stop the CP at the beginning of the snapshot
process beacuse doing so changes the RBBM status and the state of
the CP registers which may damage the debug effort.  But by the
time we get to the microcode read we no longer care about the state
of the registers so we can freely halt the ME just before starting
the read.

CRs-fixed: 585449
Change-Id: Ic0dedbad85d7ec26915f054dd597e226e8101a29
Signed-off-by: Jordan Crouse <jcrouse@codeaurora.org>
msm: kgsl: Ensure signals do not cause waits to end early

Move to using uninterruptible (which will bail if any signal is received)
when waiting on events.  A signal was causing the wait to finish
prematurely, freeing memory while the GPU was still using it.  This caused
quite a few page faults and the device to become unstable.

Change-Id: Ic0dedbade9143c9377830a209c3ffd252aa9668b
Signed-off-by: Carter Cooper <ccooper@codeaurora.org>
Signed-off-by: Jordan Crouse <jcrouse@codeaurora.org>

Conflicts:
	drivers/gpu/msm/adreno_dispatch.c
msm: kgsl: Panic if global timestamp wait fails in context detach

If we timeout while waiting for the last issued global timestamp for
a detaching context to expire (10 seconds!) then we are on a fast
train to crashville.  BUG_ON() so we can stand a chance of debugging
this very rare issue.

Change-Id: Ic0dedbaddb9cbc5681f9c872785ce26b7cf9b87b
Signed-off-by: Jordan Crouse <jcrouse@codeaurora.org>
PM: devfreq: Add conservative governor

A GPU governor is not rocket science. This one gets the job done pretty
smoothly while complying with devfreq framework rules.

Conflicts:
	drivers/devfreq/Kconfig
	drivers/devfreq/Makefile
PM: devfreq: Fixup device transition and usage statistics

Ignore bogus data during slumber in transition and usage stats that
rendered the output basically useless. Also fix the reported GPU
frequency.

Signed-off-by: Pranav Vashi <neobuddy89@gmail.com>
msm: kgsl: Export device state to devfreq

Signed-off-by: Pranav Vashi <neobuddy89@gmail.com>