genalloc: Correct nbytes calculation on long boundary

In existing code we calculate nbytes based on the byte
boundary, but genalloc uses bitmap for maintaining the
memory allocation aligned to long. So while calculating
nbytes we end up getting wrong nbytes.
example: lets say nbytes comes to 9 bytes for 70 bits when
bytes aligned,but if long aligned we will have 3 long words
i.e 12 bytes. This difference may lead to choosing the
wrong api for freeing the memory i.e Between kfree() and
vfree().
Fix was inspired by an upstream commit
eedce141cd2dad8d0cefc5468ef41898949a7031, bringing same fix
into the gen_pool_detroy path.

Change-Id: I942caf59e25515c780896b328b912604df9e10bf
Signed-off-by: Hareesh Gundu <hareeshg@codeaurora.org>
Signed-off-by: Sunil Khatri <sunilkh@codeaurora.org>
msm: kgsl: Increase IDLE_TIMEOUT for 2D core to 20secs

Increasing the hang detection time for 2D core from
10 secs to 20 secs to avoid False GPU Hangs.
Some c2d test cases are taking more than 10 secs
to process which results in a False GPU Hang.

CRs-Fixed: 454439, 644283
Change-Id: Ice5e4b719adb44cd13fb8164bafedce1049416f7
Signed-off-by: Hareesh Gundu <hareeshg@codeaurora.org>
genalloc: stop crashing the system when destroying a pool

The genalloc code uses the bitmap API from include/linux/bitmap.h and
lib/bitmap.c, which is based on long values.  Both bitmap_set from
lib/bitmap.c and bitmap_set_ll, which is the lockless version from
genalloc.c, use BITMAP_LAST_WORD_MASK to set the first bits in a long in
the bitmap.

That one uses (1 << bits) - 1, 0b111, if you are setting the first three
bits.  This means that the API counts from the least significant bits
(LSB from now on) to the MSB.  The LSB in the first long is bit 0, then.
The same works for the lookup functions.

The genalloc code uses longs for the bitmap, as it should.  In
include/linux/genalloc.h, struct gen_pool_chunk has unsigned long
bits[0] as its last member.  When allocating the struct, genalloc should
reserve enough space for the bitmap.  This should be a proper number of
longs that can fit the amount of bits in the bitmap.

However, genalloc allocates an integer number of bytes that fit the
amount of bits, but may not be an integer amount of longs.  9 bytes, for
example, could be allocated for 70 bits.

This is a problem in itself if the Least Significat Bit in a long is in
the byte with the largest address, which happens in Big Endian machines.
This means genalloc is not allocating the byte in which it will try to
set or check for a bit.

This may end up in memory corruption, where genalloc will try to set the
bits it has not allocated.  In fact, genalloc may not set these bits
because it may find them already set, because they were not zeroed since
they were not allocated.  And that's what causes a BUG when
gen_pool_destroy is called and check for any set bits.

What really happens is that genalloc uses kmalloc_node with __GFP_ZERO
on gen_pool_add_virt.  With SLAB and SLUB, this means the whole slab
will be cleared, not only the requested bytes.  Since struct
gen_pool_chunk has a size that is a multiple of 8, and slab sizes are
multiples of 8, we get lucky and allocate and clear the right amount of
bytes.

Hower, this is not the case with SLOB or with older code that did memset
after allocating instead of using __GFP_ZERO.

So, a simple module as this (running 3.6.0), will cause a crash when
rmmod'ed.

  [root@phantom-lp2 foo]# cat foo.c
  #include <linux/kernel.h>
  #include <linux/module.h>
  #include <linux/init.h>
  #include <linux/genalloc.h>

  MODULE_LICENSE("GPL");
  MODULE_VERSION("0.1");

  static struct gen_pool *foo_pool;

  static __init int foo_init(void)
  {
          int ret;
          foo_pool = gen_pool_create(10, -1);
          if (!foo_pool)
                  return -ENOMEM;
          ret = gen_pool_add(foo_pool, 0xa0000000, 32 << 10, -1);
          if (ret) {
                  gen_pool_destroy(foo_pool);
                  return ret;
          }
          return 0;
  }

  static __exit void foo_exit(void)
  {
          gen_pool_destroy(foo_pool);
  }

  module_init(foo_init);
  module_exit(foo_exit);
  [root@phantom-lp2 foo]# zcat /proc/config.gz | grep SLOB
  CONFIG_SLOB=y
  [root@phantom-lp2 foo]# insmod ./foo.ko
  [root@phantom-lp2 foo]# rmmod foo
  ------------[ cut here ]------------
  kernel BUG at lib/genalloc.c:243!
  cpu 0x4: Vector: 700 (Program Check) at [c0000000bb0e7960]
      pc: c0000000003cb50c: .gen_pool_destroy+0xac/0x110
      lr: c0000000003cb4fc: .gen_pool_destroy+0x9c/0x110
      sp: c0000000bb0e7be0
     msr: 8000000000029032
    current = 0xc0000000bb0e0000
    paca    = 0xc000000006d30e00   softe: 0        irq_happened: 0x01
      pid   = 13044, comm = rmmod
  kernel BUG at lib/genalloc.c:243!
  [c0000000bb0e7ca0] d000000004b00020 .foo_exit+0x20/0x38 [foo]
  [c0000000bb0e7d20] c0000000000dff98 .SyS_delete_module+0x1a8/0x290
  [c0000000bb0e7e30] c0000000000097d4 syscall_exit+0x0/0x94
  --- Exception: c00 (System Call) at 000000800753d1a0
  SP (fffd0b0e640) is in userspace

Signed-off-by: Thadeu Lima de Souza Cascardo <cascardo@linux.vnet.ibm.com>
Cc: Paul Gortmaker <paul.gortmaker@windriver.com>
Cc: Benjamin Gaignard <benjamin.gaignard@stericsson.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Git-commit: eedce141cd2dad8d0cefc5468ef41898949a7031
Git-repo: https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git
Change-Id: Ic8a8a2d05ee16d59af61d0cc79c88e6e7ab442ae
Signed-off-by: Sunil Khatri <sunilkh@codeaurora.org>
msm: kgsl: Fix GPU hang recovery logic

During new commands submission, if the write pointer
is ahead of read pointer fill ringbuffer data with
KGSL_NOP_DATA_FILLER after NOP command. This will
avoids getting incorrect context ID from the ringbuffer
extraction logic during GPU recovery.

CRs-Fixed: 620533
Change-Id: If4d25770b7288bc6fb618611c150e3876cc87c6f
Signed-off-by: Hareesh Gundu <hareeshg@codeaurora.org>
msm: kgsl: Reset VSC control registers

Configure the A2xx VSC register in context switch,
which helps GPU to recover from the bad state.

CRs-Fixed: 637288
Change-Id: I2000a579614c491a015c618a52808500541329c5
Signed-off-by: Hareesh Gundu <hareeshg@codeaurora.org>
msm: kgsl: Fix for panic in z180 postmortem dumps

We were accessing z180 registers without holding
device mutex. This change ensures that we hold the
mutex before accessing z180's registers

CRs-Fixed: 644283
Change-Id: Ib6496c427fc6c9a3f97a6720adb80a390fe21b0d
Signed-off-by: Gaurav Gagrani <ggagrani@codeaurora.org>
Signed-off-by: Hareesh Gundu <hareeshg@codeaurora.org>
Merge "Merge "ARM: mm: remove IPI broadcasting on ASID rollover""
Merge "Merge "Merge "ARM: mm: remove IPI broadcasting on ASID rollover"""
Merge "msm: kgsl: Fix for panic in z180 postmortem dumps"
Merge "msm: kgsl: Increase IDLE_TIMEOUT for 2D core to 20secs"
Merge "msm: kgsl: Reset VSC control registers"
Merge "genalloc: Correct nbytes calculation on long boundary"
Merge "genalloc: stop crashing the system when destroying a pool"
Merge "msm: kgsl: Fix GPU hang recovery logic"
Merge "Merge "genalloc: stop crashing the system when destroying a pool""
Merge "Merge "Merge "genalloc: stop crashing the system when destroying a pool"""
Merge "Merge "msm: kgsl: Fix GPU hang recovery logic""
Merge "Merge "Merge "msm: kgsl: Fix GPU hang recovery logic"""
Merge "Merge "msm: kgsl: Fix GPU hang recovery logic""
Merge "Merge "Merge "msm: kgsl: Fix GPU hang recovery logic"""