ARM: Fix undefined instruction exception handling

While trying to get a v3.5 kernel booted on the cubox, I noticed that
VFP does not work correctly with VFP bounce handling.  This is because
of the confusion over 16-bit vs 32-bit instructions, and where PC is
supposed to point to.

The rule is that FP handlers are entered with regs->ARM_pc pointing at
the _next_ instruction to be executed.  However, if the exception is
not handled, regs->ARM_pc points at the faulting instruction.

This is easy for ARM mode, because we know that the next instruction and
previous instructions are separated by four bytes.  This is not true of
Thumb2 though.

Since all FP instructions are 32-bit in Thumb2, it makes things easy.
We just need to select the appropriate adjustment.  Do this by moving
the adjustment out of do_undefinstr() into the assembly code, as only
the assembly code knows whether it's dealing with a 32-bit or 16-bit
instruction.

Cc: <stable@vger.kernel.org>
Acked-by: Will Deacon <will.deacon@arm.com>
Signed-off-by: Russell King <rmk+kernel@arm.linux.org.uk>

ARM: 8036/1: Enable IRQs before attempting to read user space in __und_usr

The Undef abort handler in the kernel reads the undefined instruction
from user space. If the page table was modified from another CPU, the
user access could fail and do_page_fault() will be executed with
interrupts disabled. This can potentially deadlock on ARM11MPCore or on
Cortex-A15 with erratum 798181 workaround enabled (both implying IPI for
TLB maintenance with page table lock held).

This patch enables the IRQs in __und_usr before attempting to read the
instruction from user space.

CRs-Fixed: 685372
Signed-off-by: Catalin Marinas <catalin.marinas@arm.com>
Tested-by: Arun KS <getarunks@gmail.com>
Cc: Hartley Sweeten <hsweeten@visionengravers.com>
Cc: Ryan Mallon <rmallon@gmail.com>
Signed-off-by: Russell King <rmk+kernel@arm.linux.org.uk>
Git-commit: 1417a6b8dc4db73055be9a3aa288b050e9dc06ab
Git-repo: git://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git
Signed-off-by: Kishan Kumar <kishank@codeaurora.org>

ARM: 7526/1: traps: send SIGILL if get_user fails on undef handling path

get_user may fail to load from the provided __user address due to an
unhandled fault generated by the access.

In the case of the undefined instruction trap, this results in failure
to load the faulting instruction, in which case we should send SIGILL to
the task rather than continue with potentially uninitialised data.

Signed-off-by: Will Deacon <will.deacon@arm.com>
Cc: stable@vger.kernel.org
Signed-off-by: Russell King <rmk+kernel@arm.linux.org.uk>

Conflicts:
	arch/arm/kernel/traps.c

ARM: fix "bad mode in ... handler" message for undefined instructions

commit 29c350bf28da333e41e30497b649fe335712a2ab upstream.

The array was missing the final entry for the undefined instruction
exception handler; this commit adds it.

Signed-off-by: Russell King <rmk+kernel@arm.linux.org.uk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

Conflicts:
	arch/arm/kernel/traps.c

ARM: 7553/1: proc-v7: Ensure correct instruction set after cpu_reset

Because mov pc,<Rn> never switches instruction set when executed in
Thumb code, Thumb-2 kernels will silently execute the target code
after cpu_reset as Thumb code, even if the passed code pointer
denotes ARM (bit 0 clear).

This patch uses bx instead, ensuring the correct instruction set
for the target code.

Thumb code in the kernel is not supported prior to ARMv7, so other
CPUs are not affected.

Change-Id: I7beb234e130f41aece0e11b8f6cca66b8168a64b
Signed-off-by: Dave Martin <dave.martin@linaro.org>
Acked-by: Will Deacon <will.deacon@arm.com>
Acked-by: Nicolas Pitre <nico@linaro.org>
Signed-off-by: Russell King <rmk+kernel@arm.linux.org.uk>
msm: camera: Fix camera crash in msm_open_config

Add proper check before accessing mctl handle to
avoid camera crash.

Change-Id: I1413f086ab7d94fe223a814bb16867d1dcc0a4bf
CRs-Fixed: 481757
Signed-off-by: Suresh Vankadara <svankada@codeaurora.org>
Signed-off-by: Stratos Karafotis <stratosk@semaphore.gr>
msm: camera: Fix camera crash when ctrl_q is empty

Add proper error condition if the list is empty and
return error value to upper layers instead of BUG_ON.

Change-Id: I89237e7a27d5fb1e1fd5f1a8a2dfd7ea9a1afff5
CRs-Fixed: 481759
Signed-off-by: Suresh Vankadara <svankada@codeaurora.org>
Signed-off-by: Stratos Karafotis <stratosk@semaphore.gr>
msm: camera: Fix mctl release crash issue.

After mctl release initialize pointer to NULL to
avoid crash.

Change-Id: Ia3e0b1b809f85760a92b5248f402df589c6ace04
Signed-off-by: Suresh Vankadara <svankada@codeaurora.org>
Signed-off-by: Stratos Karafotis <stratosk@semaphore.gr>
Revert "Really no need for these updates, they cause a FPS regression in games.  Will update these again when the adreno proprietaries are updated."

This reverts commit 040e3c9560b6137729ff39de9634c3899832d074.
fixup kgsl/adreno
update version to 91u-A4
msm: kgsl: Return HI offset from kgsl_perfcounter_get

Previously, kgsl_perfcounter_get only returned the offset
of the LO perf counter register. This assumed that the HI
register would always be adjacent to the LO register. With
VBIF 2.0, this assumption has now been broken, so both the
HI and LO register offsets must be returned.

CRs-fixed: 578771
Change-Id: Ie74da5d797e58a143b89a61aba7ebaf1ed42ed5e
Signed-off-by: Kevin Matlage <kmatlage@codeaurora.org>
msm: kgsl: Refcount mmu clock calls and allow multiple disable events

Allow each mmu clock enable call to enable the clock and let the
clock driver refcounting mechanism deal with switching the clock
off at the right time. This also means that each enable call should
have a disable call or a disable event registered, so allow for
multiple disable events to be registered. This simplifies the mmu
clock handling mechanism which is better for multiple ringbuffer
implementation. With multiple ringbuffers each global timestamp is
tied to a specific ringbuffer and with a single clock disable event
it is hard to figure out when the clock should be turned off.

Change-Id: I924c545140bd19d95890a5fdfd0382c511abe973
Signed-off-by: Shubhraprakash Das <sadas@codeaurora.org>
msm: kgsl: Restructure IOMMU clock management

Restructure IOMMU clock management code to enable/disable clocks
based on iommu unit instead of context. In hardware IOMMU clocks
are associated with each IOMMU unit. There is no granularity of
clock control for each iommu context. Turning on the clocks for
one context in a IOMMU unit automatically turns on the clocks for
all the contexts in IOMMU unit. Reduce the number of clock
enable/disable calls and structure the software design as per
hardware design by doing clock management per IOMMU unit.

Change-Id: Ib54dbb7a31d6b30b65c07ef130bee149e3e587d8
Signed-off-by: Tarun Karra <tkarra@codeaurora.org>
msm: kgsl: hold a process_private refcount in process_mem_print

There is a possible race condition where the process can be going
away while its debugfs 'mem' file is being read, which could cause
memory corruption.

CRs-Fixed: 627780
Change-Id: I697486faeb3f186fd1220d0acc1e449a4f7b77b0
Signed-off-by: Jeremy Gebben <jgebben@codeaurora.org>
msm: kgsl: Add a power constraints interface

Add an interface to hint the user specified power
constraint. User can specify a particular GPU power level
or a bandwidth vote. The power constraints are per context
or command batch. Power constraints are only for hinting
and should be used judiciously.

Change-Id: Ic10a5fff4abc88c51cd45a7d7ac58c0d4e5dcb25
Signed-off-by: Suman Tatiraju <sumant@codeaurora.org>
Signed-off-by: Lucille Sylvester <lsylvest@codeaurora.org>
msm: kgsl: Ensure that power constraints run for a full interval

Make sure that a power constraint is given a full DCVS interval to
influence the GPU before having it adjusted back down.

Change-Id: Ic0dedbad22e74ce6e62e26c386b900442d7bab40
Signed-off-by: Jordan Crouse <jcrouse@codeaurora.org>
msm: kgsl: allow creation of events from the future

For contexts created with the KGSL_CONTEXT_USER_GENERATED_TS,
allow events to be created for timestamps that have not
been issued yet. Presumably these contexts know what they
are doing.

Change-Id: Iccf2e549b38e1a11850d26ee64b7279ab0b8a1ae
Signed-off-by: Jeremy Gebben <jgebben@codeaurora.org>
msm: kgsl: update KGSL to match most recent version

Over time chery-picks for KGSL have been skipped or
have been resolved differently between branches. As
a result, this branch of KGSL has become increasingly
difficult to maintain due to merge conflicts. With a
few exceptions KGSL should match the msm-3.4 mainline
exactly. To rectify the situation, this change brings
KGSL up-to-date with the msm-3.4 mainline as a bulk
change because cherry-picks are not practical.

Change-Id: I53f9f7fbf4942e147dea486ff5dbf179af75ea8c
Signed-off-by: Jeff Boody <jboody@codeaurora.org>
msm: kgsl: Mark the IOMMU setstate memory as read only

Mark the IOMMU setstate memory as read only in the pagetable.

Change-Id: Ic0dedbadb19e499c749cd744c3e89be3bcb4c2a2
Signed-off-by: Jordan Crouse <jcrouse@codeaurora.org>
msm: kgsl: Enable protected register mode for A3XX

Turn on protected register mode for the A3XX GPU family and add 0x63
(RBBM_INT_0_MASK) to the list of protected registers.

Change-Id: Ic0dedbad10ebfa6eb6d3d815b5aa9b6b6f0e8e35
Signed-off-by: Jordan Crouse <jcrouse@codeaurora.org>
msm: kgsl: Protect SMMU registers from being written by the GPU

Put the SMMU register range in protected mode to shield them from
IB1/IB2 writes from userspace.

CRs-Fixed: 599971
Change-Id: Ic0dedbad8c03fc1c54ff73221231e2440d3c34dd
Signed-off-by: Jordan Crouse <jcrouse@codeaurora.org>
msm: kgsl: Print the register that causes a protected mode error

When we get a protected mode error print out the register information
that caused the exception.

Change-Id: Ic0dedbad4f586c5715669226619b51665ef9681f
Signed-off-by: Jordan Crouse <jcrouse@codeaurora.org>
msm: kgsl: Protect CP_STATE_DEBUG_INDEX

Put CP_STATE_DEBUG_INDEX and CP_STATE_DEBUG_DATA under protection
to keep it from being written from an IB1. Doing so however opens
up a subtle "feature" in the microcode: memory read opcodes turn off
protected mode in the microcode to do the read and then turns it
back on regardless of the initial state. This is a problem if the
memory read happens while protected mode is turned off and then we
try to access a protected register which then complains and goes boom.

To account for this irregularity explicitly turn back off protected
mode in all the places where we know this will be a problem.

Change-Id: Ic0dedbad1397ca9b80132241ac006560a615e042
Signed-off-by: Jordan Crouse <jcrouse@codeaurora.org>