video: tegra: host: fix memory leak in ctx save

- host1x_save_context() explicitly updated the ref count on context
- with the re-factoring of nvhost_job code, nvhost_job_alloc()
takes a ref count on context
- this caused the explicit ref count in host1x_save_context()
redundant and lead to memory leak. hence remove it

Bug 1015924

Change-Id: Id18c74412e8659b60288700972690d1b895de4c1
Signed-off-by: Mayuresh Kulkarni <mkulkarni@nvidia.com>
Reviewed-on: http://git-master/r/116409
(cherry picked from commit c98d0cfbbdacdda8e540b5d9e0d513e279b3b2f5)
Reviewed-on: http://git-master/r/117326
Reviewed-by: Automatic_Commit_Validation_User
GVS: Gerrit_Virtual_Submit
Reviewed-by: Bharat Nihalani <bnihalani@nvidia.com>
video: tegra: nvmap: Set PAGELIST_VMALLOC_MIN size correct

page list array size greater than PAGE_SIZE should use vmalloc.

Change-Id: Ic03668ba7ff716bfb3cc08aaef5f86214ee0a9df
Signed-off-by: Krishna Reddy <vdumpa@nvidia.com>
Reviewed-on: http://git-master/r/116875
Reviewed-by: Alex Waterman <alexw@nvidia.com>
Reviewed-by: Automatic_Commit_Validation_User
Reviewed-by: Hiroshi Doyu <hdoyu@nvidia.com>
Tested-by: Hiroshi Doyu <hdoyu@nvidia.com>
Reviewed-by: Yu-Huan Hsu <yhsu@nvidia.com>
(cherry picked from commit ddacaacd2a9fff10187e026eaa0d898694eeb95f)
Reviewed-on: http://git-master/r/118194
video: tegra: nvmap: Fix two integer overflows.

nvmap_ioctl_pinop kmalloc's a temporary buffer, whose length is directly
given by ioctl parameter from usermode. The total size of the buffer
is not checked for overflow, which will cause a kernel panic with some
inputs.

Also, a sizeof() is applied to wrong type when calculating the amount
of bytes to copy from userspace.

nvmap_map_into_caller_ptr attempts to validate that the memory range
to be mapped is correct, but integer overflow can cause the check to
fail. This will lead to mapping wrong pages from the allocated
handle later on, when the page fault handler gets called.

Bug 1025502

Change-Id: I71a09c40c209dba9c5b37c3912e92a81e6f87e80
Signed-off-by: Tuomas Tynkkynen <ttynkkynen@nvidia.com>
video: tegra: hdmi: cleanup error handling in init

In case tegra_dc_init fails, this change will prevent unbalanced call
to dc->out_ops->disable().

Also mark tegra_dc_io_end in case tegra_dc_controller_enable
fails, this is required to not stop device from going into suspend mode.

Bug 1003874

Change-Id: I5af6b46fc50e1ae8e54f9f4eb8540d751364fed7
Signed-off-by: Gaurav Batra <gbatra@nvidia.com>
Reviewed-on: http://git-master/r/120108
Reviewed-by: Simone Willett <swillett@nvidia.com>
Tested-by: Simone Willett <swillett@nvidia.com>
WAR: gr3d: limit 3d clock when camera is on

As WAR, limit 3d clock frequency and emc clock frequency
when camera is on and chip is AP37. 3d clock is set to
361MHz and 437MHz is requested for emc clock with this
change. This change allows 3d to request 1.1V in Core
instead of 1.3V in AP37.

Bug 1001262
Bug 1019309

Signed-off-by: Jihoon Bang <jbang@nvidia.com>
Change-Id: I1dbab3469a31ef603f7665fc5a6cb5c1999f89b6
Reviewed-on: http://git-master/r/120480
Reviewed-by: Varun Colbert <vcolbert@nvidia.com>
Tested-by: Varun Colbert <vcolbert@nvidia.com>
video: tegra: nvmap: fix usermode input validation

nvmap_pin_ids accepts a list of handles to pin, which are passed
directly from usermode when called from nvmap_ioctl_pinop.

However, if invalid handles are passed in, the function might
still access them as valid handles, and cause a crash.

Bug 1023954

Change-Id: I6b98a2ef448bb496be7d569ddd4fb516fc399cba
Signed-off-by: Tuomas Tynkkynen <ttynkkynen@nvidia.com>
Reviewed-on: http://git-master/r/119667
Reviewed-by: Automatic_Commit_Validation_User
GVS: Gerrit_Virtual_Submit
Reviewed-by: Juha Tukkinen <jtukkinen@nvidia.com>
video: tegra: host: Fix leak in 3D register read

When 3D register is read, and we need to do a context switch, the old
context reference is incremented, but it never gets decremented. Fix
by using nvhost_job_get_hwctx() to acquire the reference.

Bug 1031746

Change-Id: Ic72637cb2399f960e2297733bfe45e585a8ec180
Signed-off-by: Terje Bergstrom <tbergstrom@nvidia.com>
Reviewed-on: http://git-master/r/123678
Reviewed-by: Automatic_Commit_Validation_User
Reviewed-by: Arto Merilainen <amerilainen@nvidia.com>
Reviewed-by: Juha Tukkinen <jtukkinen@nvidia.com>
GVS: Gerrit_Virtual_Submit
video: tegra: nvmap: Fix overflow in nvmap_heap

do_heap_alloc locates a suitable free block from a nvmap heap given a
size and alignment. Unfortunately, if a heap block happens to be
smaller than the alignment passed to the function, an integer overflow
will occur, and a block that's too small gets accidentally returned.

Bug 1032642

Change-Id: Ic650c520409134d753e968f62f144ddeb065ccc7
Signed-off-by: Tuomas Tynkkynen <ttynkkynen@nvidia.com>
Reviewed-on: http://git-master/r/123076
Reviewed-by: Automatic_Commit_Validation_User
GVS: Gerrit_Virtual_Submit
Reviewed-by: Krishna Reddy <vdumpa@nvidia.com>
video: tegra: host: Fix crash if allocation fails

nvhost_module_remove_client assumes that a client structure
to be freed exists in the linked list. However, if an allocation fails
in nvhost_module_add_client, no client structure is allocated, and
during cleanup, nvhost_module_remove_client would then attempt
to free an invalid pointer.

Bug 1034729

Change-Id: Ie1a641071b86f8246951e9be824a6003f14b04b6
Signed-off-by: Tuomas Tynkkynen <ttynkkynen@nvidia.com>
Reviewed-on: http://git-master/r/124096
Reviewed-by: Automatic_Commit_Validation_User
GVS: Gerrit_Virtual_Submit
Reviewed-by: Terje Bergstrom <tbergstrom@nvidia.com>
Reviewed-by: Juha Tukkinen <jtukkinen@nvidia.com>
video: tegra: dc: Make framebuffer console init OK

Update framebuffer's modelist after we changed it's fb_var_screeninfo.
This makes sure the framebuffer console can be inited successfully.
During framebuffer console init, it'll check whether the var info of
the framebuffer is consistent with the modelist.
Unsuccessful init of framebuffer console driver makes VT driver
doesn't work in right way.

Bug 996992

Signed-off-by: Mark Zhang <markz@nvidia.com>
Change-Id: I96a1db1f389be75dcba48b20447cf1510ad3768b
Reviewed-on: http://git-master/r/107866
Reviewed-by: Automatic_Commit_Validation_User
Reviewed-by: Shashank Sharma <shashanks@nvidia.com>
GVS: Gerrit_Virtual_Submit
Reviewed-by: Jon Mayo <jmayo@nvidia.com>
video: tegra: nvmap: fix handle usecount tracking

A handle's usecount used to be incremented once during the mmap ioctl,
and decremented when the mapping is closed by the kernel. However, that
fails if a mapping cloned, for example if the mapping was split due to
a munmap, or (presumably) during fork, as the decrement will then happen
for each cloned mapping.

Therefore increment the usecount when a mapping is opened.
Also fix a BUG_ON() that would have caught this bug, if it wouldn't
have done the check by checking if the unsigned usecount field is
less than zero.

Bug 1033981

Change-Id: I72ac9361a19e44f91ffd6b1126f4632e0f7b6726
Signed-off-by: Tuomas Tynkkynen <ttynkkynen@nvidia.com>
Reviewed-on: http://git-master/r/123710
Reviewed-by: Automatic_Commit_Validation_User
GVS: Gerrit_Virtual_Submit
Reviewed-by: Krishna Reddy <vdumpa@nvidia.com>
video: tegra: host: Use unsigned integer in sysfs

Sync point values are unsigned, but sysfs creates the text
representation as signed. Correct to use unsigned representation.

Bug 1039058

Change-Id: I96de13952eeeba9510bae179a036459ddee18dcd
Signed-off-by: Terje Bergstrom <tbergstrom@nvidia.com>
Reviewed-on: http://git-master/r/128075
Reviewed-by: Automatic_Commit_Validation_User
GVS: Gerrit_Virtual_Submit
Reviewed-by: Juha Tukkinen <jtukkinen@nvidia.com>
Reviewed-by: Michal Pecio <mpecio@nvidia.com>