n_tty: Fix n_tty_write crash when echoing in raw mode

The tty atomic_write_lock does not provide an exclusion guarantee for
the tty driver if the termios settings are LECHO & !OPOST.  And since
it is unexpected and not allowed to call TTY buffer helpers like
tty_insert_flip_string concurrently, this may lead to crashes when
concurrect writers call pty_write. In that case the following two
writers:
* the ECHOing from a workqueue and
* pty_write from the process
race and can overflow the corresponding TTY buffer like follows.

If we look into tty_insert_flip_string_fixed_flag, there is:
  int space = __tty_buffer_request_room(port, goal, flags);
  struct tty_buffer *tb = port->buf.tail;
  ...
  memcpy(char_buf_ptr(tb, tb->used), chars, space);
  ...
  tb->used += space;

so the race of the two can result in something like this:
              A                                B
__tty_buffer_request_room
                                  __tty_buffer_request_room
memcpy(buf(tb->used), ...)
tb->used += space;
                                  memcpy(buf(tb->used), ...) ->BOOM

B's memcpy is past the tty_buffer due to the previous A's tb->used
increment.

Since the N_TTY line discipline input processing can output
concurrently with a tty write, obtain the N_TTY ldisc output_lock to
serialize echo output with normal tty writes.  This ensures the tty
buffer helper tty_insert_flip_string is not called concurrently and
everything is fine.

Note that this is nicely reproducible by an ordinary user using
forkpty and some setup around that (raw termios + ECHO). And it is
present in kernels at least after commit
d945cb9cce20ac7143c2de8d88b187f62db99bdc (pty: Rework the pty layer to
use the normal buffering logic) in 2.6.31-rc3.

js: add more info to the commit log
js: switch to bool
js: lock unconditionally
js: lock only the tty->ops->write call

References: CVE-2014-0196
Reported-and-tested-by: Jiri Slaby <jslaby@suse.cz>
Signed-off-by: Peter Hurley <peter@hurleysoftware.com>
Signed-off-by: Jiri Slaby <jslaby@suse.cz>
Cc: Linus Torvalds <torvalds@linux-foundation.org>
Cc: Alan Cox <alan@lxorguk.ukuu.org.uk>
Cc: <stable@vger.kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
[bwh: Backported to 3.4: output_lock is a member of struct tty_struct]

Change-Id: I11d1685056e18f107c970fbe2cab5176ca3a91c4
msm: kgsl: On release only detach contexts owned by the instance

There can be multiple device instances open for a process. When
a instance is released only destroy the contexts owned by that
instance.

Change-Id: Ic0dedbad818224f01397db8a8f5a83072492dc59
Signed-off-by: Jordan Crouse <jcrouse@codeaurora.org>
Signed-off-by: Carter Cooper <ccooper@codeaurora.org>
msm: kgsl: Add 8974 support for enabling GPU GDHS

We add 8974 support for enabling GDHS of GPU power rail line
by adding it to the 8974 device tree. This feature allows
GPU to go in SLUMBER instead of SLEEP state as 8974 has a low
latency power rail bring-up.

Change-Id: I4c098947c50277817af997e0f8cc7ec232bc42c9
Signed-off-by: Harsh Vardhan Dwivedi <hdwivedi@codeaurora.org>
Signed-off-by: Carter Cooper <ccooper@codeaurora.org>
msm: kgsl: Turn off automatic hardware clock gating for A330

Turn off automatic hardware clock gating for A330 GPUs and
revert to the hardware default values. Turning the clock
gating on seems to push various parts of the hardware to the
edge without some mitigating patches on other subsystems. Going
back to the default values increases stability until all the
ducks are in a row.

Change-Id: Ic0dedbad8acea5d649332f18edf9dd6a88d9c164
Signed-off-by: Jordan Crouse <jcrouse@codeaurora.org>
Signed-off-by: Carter Cooper <ccooper@codeaurora.org>
msm: kgsl: Support larger debug regions for the CP on A330

A330 features expanded debug data for the CP block. CP_STATE_DEBUG
adds a few more indexed records, and the CP debug bus block goes to
0x52 instead of 0x40. Expand the sizes and add support for variable
debug bus block sizes based on block ID and GPU type.

Change-Id: Ic0dedbad4622386e8ecf9f18b7f2d248eaa9ff09
Signed-off-by: Jordan Crouse <jcrouse@codeaurora.org>
Signed-off-by: Carter Cooper <ccooper@codeaurora.org>
msm: kgsl: Add power settings to the postmortem dump

The Nap & StartStop-on-SleepWake config information will help to analyze
hangs due to incorrect power state transitions.

Change-Id: If00009b7800d72fe2e6682457652aa42d4a0aee6
Signed-off-by: Ranjhith Kalisamy <ranjhith@codeaurora.org>
Signed-off-by: Carter Cooper <ccooper@codeaurora.org>
msm: kgsl: Add NOP name to postmortem dump

There are several different NOP commands placed in the ringbuffer
for book keeping.  Rather than just print the random tag associated
with the NOP, print a meaningful string.

Change-Id: Id21743b598047b1b3ff06580ad206cf3e675c83d
Signed-off-by: Carter Cooper <ccooper@codeaurora.org>
msm: kgsl: Update to match DRM driver function pointer structure

DRM for 3.4 kernel has changed the drm_driver function pointer
structure.  Changed kgsl to match.

Change-Id: Icc9b87284ddeaa356c8f5eabe950da1ab8b4c8dc
Signed-off-by: Michael Street <mstreet@codeaurora.org>
Signed-off-by: Carter Cooper <ccooper@codeaurora.org>
msm: kgsl: Using ion allocation instead of pmem for GEM

In GEM object allocations that are requested to be in
physical memory, pmem was used in the past.  Since pmem
has been replaced with ion, we have updated the code to
use ion to manage memory in DRM/GEM that needs to be
shared with MDP.

Change-Id: I245b863ada6778d2206baf59a98124d39ee89d4a
Signed-off-by: Michael Street <mstreet@codeaurora.org>
Signed-off-by: Carter Cooper <ccooper@codeaurora.org>
msm: kgsl: Added DRM_IOCTL_KGSL_GEM_GET_ION_FD ioctl to DRM device.

To allow for user space ion based zero copy operations
(such as camera preview) on X11 allocated buffers (e.g. Pixmaps).
This ioctl returns a sharable ION file descriptor given a GEM object.

Change-Id: I055712b8fa469c99a224933a1f2fd62d2d811536
Signed-off-by: Michael Street <mstreet@codeaurora.org>
Signed-off-by: Carter Cooper <ccooper@codeaurora.org>
msm: kgsl: Add cache flush for A20x

Adding extra cache flush command to make sure that CP block
gets event from RB all the time to avoid race conditions because of
clock switches. this is to improve stability on 8x25 target.

Change-Id: Ie411be46fa166864073d35c50085a8f2506d0eb8
Signed-off-by: Rajesh Kemisetti <rajeshk@codeaurora.org>
Signed-off-by: Carter Cooper <ccooper@codeaurora.org>
msm: kgsl: Add separate GPU shader memory mapping

Add separate kernel memory mapping for GPU shader memory.
Previously, both the register and the shader memory were mapped
as one entity, with the mapping length being equal to combined
size of register memory and shader memory. Now, we separate the
shader memory mapping to help in cases of GPU devices where the
shader and register memory may not be adjacent. This helps to
dump the shader memory in the postmortem snapshot. By having a
separate mapping for shader memory, the snapshot dump routine
simply reads in the shader memory range specified and dumps.

Change-Id: I30e59dffe849fefcfbbaf0e5245cc1024ccedcb1
Signed-off-by: Harsh Vardhan Dwivedi <hdwivedi@codeaurora.org>
Signed-off-by: Carter Cooper <ccooper@codeaurora.org>
msm: kgsl: Add a ftrace event for GPU busy

Log a ftrace event when the GPU statistics are collected so that
we can keep track of GPU busy along with the other statistics
in the ftrace stream.

Change-Id: Ic0dedbadb58b9bef6e8669a7634bf9ca87073bcb
Signed-off-by: Jordan Crouse <jcrouse@codeaurora.org>
Signed-off-by: Carter Cooper <ccooper@codeaurora.org>
gproj: kgsl: Update separate GPU shader memory mapping

Add separate kernel memory mapping for GPU shader memory.
Previously, both the register and the shader memory were mapped
as one entity, with the mapping length being equal to combined
size of register memory and shader memory. Now, we separate the
shader memory mapping to help in cases of GPU devices where the
shader and register memory may not be adjacent. This helps to
dump the shader memory in the postmortem snapshot. By having a
separate mapping for shader memory, the snapshot dump routine
simply reads in the shader memory range specified and dumps.

Change-Id: Ib7bc7410a65018515949e3ba165d94906071c998
Signed-off-by: Carter Cooper <ccooper@codeaurora.org>
msm: kgsl: Set a useful pm_qos default value

Also allow the value to be updated via sysfs.

CRs-Fixed: 434556
Signed-off-by: Lucille Sylvester <lsylvest@codeaurora.org>
Signed-off-by: Carter Cooper <ccooper@codeaurora.org>
msm: kgsl: Revert low latency power collapse

Standalone PC causes a watchdog bark on some hardware
during boot.  Disable it until the issue is resolved.

Change-Id: I9eb7be66cdb001db10849424a59064ad41f9db22
Signed-off-by: Lucille Sylvester <lsylvest@codeaurora.org>
Signed-off-by: Carter Cooper <ccooper@codeaurora.org>
msm: kgsl: Set the context ID of iommu bank based on address

Use the context bank's and iommu units register base address to
calculate the iommu context'd ID instead of using sid. It is done
in a similar manner in iommu driver.

Change-Id: I6f8f02257a8bbd11de555901f9bbe87c66112219
Signed-off-by: Shubhraprakash Das <sadas@codeaurora.org>
Signed-off-by: Carter Cooper <ccooper@codeaurora.org>
msm: kgsl: Correct the initial idle_timer value

The gpu idle_timer initial value is incorrect in the DT for 8974

Change-Id: I07cd42c93070162bf520cfc9cfa7e15a46b2c2e8
Signed-off-by: Vladimir Razgulin <vrazguli@codeaurora.org>
Signed-off-by: Carter Cooper <ccooper@codeaurora.org>
msm: kgsl: Turn on clock gating for A330 devices

Turn on HW clock gating for A330 by writing the most aggressive
gating values to A330_CLK_CTL and A330_GPR0_CTL registers.

Change-Id: Ife5d1d900b1f952b8497e9e8fff622c1aa66cd5a
Signed-off-by: Harsh Vardhan Dwivedi <hdwivedi@codeaurora.org>
Signed-off-by: Carter Cooper <ccooper@codeaurora.org>
msm: kgsl: Idle timeout should be reported in msec

Remove the restrictions on the low end of the idle timeout.
Accept the idle timeout in msec and also display it in msec.

Change-Id: I8ca4cd7ade503ed24424e4e429243e921eb6fb0f
Signed-off-by: Lucille Sylvester <lsylvest@codeaurora.org>
Signed-off-by: Carter Cooper <ccooper@codeaurora.org>