msm: kgsl: Fix memleak in IOMMU clock disable

IOMMU clock disable on timestamp allocates memory and passes
the pointer to event created, this memory should be freed
when the event fires.

Change-Id: Ia714550ce8a05958fb6668293cd0400a0f69d4af
Signed-off-by: Tarun Karra <tkarra@codeaurora.org>
msm: pm: Fix cpu collapse timeout

Looks like caf mismerged. This may fix the following warning:

<4>[  124.983957] ------------[ cut here ]------------
<4>[  124.984381] WARNING: at arch/arm/mach-msm/msm-pm.c:837 msm_pm_wait_cpu_shu
tdown+0x9c/0xb0()
<4>[  124.984661] CPU2 didn't collapse in 2 ms
<4>[  124.984869] [<c010e10c>] (unwind_backtrace+0x0/0x144) from [<c0a1c68c>] (d
ump_stack+0x20/0x24)
<4>[  124.985170] [<c0a1c68c>] (dump_stack+0x20/0x24) from [<c019ab44>] (warn_sl
owpath_common+0x58/0x70)
<4>[  124.985464] [<c019ab44>] (warn_slowpath_common+0x58/0x70) from [<c019abd8>
] (warn_slowpath_fmt+0x40/0x48)
<4>[  124.985943] [<c019abd8>] (warn_slowpath_fmt+0x40/0x48) from [<c0179d30>] (
msm_pm_wait_cpu_shutdown+0x9c/0xb0)
<4>[  124.986287] [<c0179d30>] (msm_pm_wait_cpu_shutdown+0x9c/0xb0) from [<c0126
750>] (platform_cpu_kill+0x38/0x48)
<4>[  124.986591] [<c0126750>] (platform_cpu_kill+0x38/0x48) from [<c010c6fc>] (
__cpu_die+0x4c/0x98)
<4>[  124.986778] [<c010c6fc>] (__cpu_die+0x4c/0x98) from [<c09ee9cc>] (_cpu_dow
n+0xf8/0x2e0)
<4>[  124.987074] [<c09ee9cc>] (_cpu_down+0xf8/0x2e0) from [<c09eec58>] (cpu_dow
n+0x34/0x50)
<4>[  124.987383] [<c09eec58>] (cpu_down+0x34/0x50) from [<c0194250>] (cpu_down_
work+0xc4/0xd8)
<4>[  124.987564] [<c0194250>] (cpu_down_work+0xc4/0xd8) from [<c01b4e44>] (proc
ess_one_work+0x178/0x4f4)
<4>[  124.987861] [<c01b4e44>] (process_one_work+0x178/0x4f4) from [<c01b5540>]
(worker_thread+0x174/0x448)
<4>[  124.988152] [<c01b5540>] (worker_thread+0x174/0x448) from [<c01bb8ac>] (kt
hread+0xb4/0xc0)
<4>[  124.988450] [<c01bb8ac>] (kthread+0xb4/0xc0) from [<c0108060>] (kernel_thr
ead_exit+0x0/0x8)
<4>[  124.988725] ---[ end trace 77427e632785e345 ]---
PM / devfreq: Rewrite devfreq_update_status() to fix multiple bugs

The current devfreq_update_status() has the following bugs:
- When the new frequency doesn't have a valid level, the time spent in the
  new frequency is counted towards the next valid frequency switch instead
  of being ignored.
- The time spent on the previous frequency is added to the new frequency's
  stats instead of the previous frequency's stats.

This patch fixes all of this.

Change-Id: I7bbdafca78d1565cdbf815356556fe6d6cca9e3f
Signed-off-by: Saravana Kannan <skannan@codeaurora.org>
PM / devfreq: Check for GPU busy time before sending the sample

Sometimes GPU busy time is very low during sampling. Accumulate
the statistics and send them with the next sample.

Change-Id: I77e568b48afc3a4922c7c341d9478705b7ae3a30
Signed-off-by: Suman Tatiraju <sumant@codeaurora.org>
qcom-cpufreq: Move the enabling of the CPU/L2 clocks to CPU_STARTING

It is a requirement of PLLs in MSM SoCs that the PLL power
supplies be enabled while the PLL is running. If the PLL is
locked and outputs enabled, turning off the regulator(s)
supplying the PLL will cause the PLL to enter an unpredictable
state.

Now in the CPU_UP_PREPARE notifier, the CPU clocks are prepared
and enabled, causing the source HFPLLs to also turn on. Note
that the CPU isn't clocked yet. It is possible that execution is
pre-empted and the CPU running the notifier enters power
collapse. If all other CPUs also enter power collapse, then it
is possible for an RPM notification to go out, allowing the RPM
to transition the Apps processor to its sleep set. This can
result in the HFPLL supplies being turned off while the HFPLL is
running, violating the requirement mentioned above. Once the CPU
is unclamped, the CPU is effectively unclocked, due to the HFPLL
being in an unknown state.

There is a check that is enabled in the PM code's CPU_UP_PREPARE
notifier callback. This check ensures that the problematic RPM
notification cannot occur until the core that is being brought
online also enters power collapse. However, there is no ordering
guarantee between that PM's hotplug notifier callback's execution
and the cpufreq hotplug notifier callback's execution. This
ordering depends on program link order, which is unreliable.

It is necessary to ensure that once the HFPLL is enabled, the
RPM cannot transition apps to its sleep set. Move the enabling
of the CPU clocks to the CPU_STARTING notifier, which runs on
the CPU bring brought online. The CPU_STARTING notifier is
guaranteed to run after the CPU_UP_PREPARE notifier, which
implies that the aforementioned do-not-notify-rpm check is
executed *before* the HFPLL is enabled. Therefore even if all
cores enter power collapse after the HFPLL is enabled, the
HFPLL supplies are guaranteed to stay on, or the CPU clock
is switched to the safe source and the HFPLL is turned off.

CRs-Fixed: 622738
Change-Id: I136841405806c07e755919859e649ded0c719abb
Signed-off-by: Vikram Mulukutla <markivx@codeaurora.org>
arm: arch_timer: set memory mapped timer interrupt as IRQF_TIMER

The memory mapped timer is used as a broadcast timer to wake the core for
timer interrupts when the arch timer might not be functional. When interrupt
is not marked as IRQF_NO_SUSPEND, the interrupt gets disabled during the
suspend_device_irqs() callback in the suspend path. If a core were to enter a
idle low power mode which relies on broadcast timer to process the interrupt,
the core is never woken up for timer interrupts.

Mark the interrupt with IRQF_TIMER which marks this interrupt as a timer
interrupt and also marks it as IRQF_NO_SUSPEND

CRs-fixed: 636712
Change-Id: I0484e92a9d05f66a0c5b3c00c584a3dd3fe6ae85
Signed-off-by: Mahesh Sivasubramanian <msivasub@codeaurora.org>
qcom-cpufreq: Block hotplug until cpufreq is ready

Hotplug before qcom-cpufreq is ready could lead to inconsistent CPU
clock state. Block hotplug by returning NOTIFY_BAD in hotplug callback
until qcom-cpufreq is probed.

Change-Id: I72a2f98c083c9b21b95ecafdb5a5be7a7682e842
Signed-off-by: Junjie Wu <junjiew@codeaurora.org>
qcom-cpufreq: Fix hotplug blocking logic

Change 2b63b10 qcom-cpufreq: Block hotplug until cpufreq is ready
intended to block hotplug until qcom-cpufreq driver has got all
clocks. However, its implementation still leaves a small window when
CPU 0 has got its clock but others haven't. If a hotplug happens on
another CPU that doesn't have its clock pointer, refcount of that CPU
clock will again be wrong.

Fix the issue by introducing a ready flag.

Change-Id: I1e05b063b0584088f717b82709a3f1d55bc6561b
Signed-off-by: Junjie Wu <junjiew@codeaurora.org>
msm: kgsl: Add new API's to track device mutex owner

Add new API's kgsl_mutex_lock/unlock to track device mutex owner.
Mutex owner is an atomic variable and all operations set/clear on
it are also atomic to avoid any race conditions.

If a thread tries to acquire the mutex using new API, try to acquire
the mutex only if mutex owner is not same as current thread. This is
to prevent deadlocks which can happen if a thread tries to acquire
mutex with mutex held.

Change-Id: I3da4d0427ede5458f6a663043c57a4799b72d8fd
Signed-off-by: Tarun Karra <tkarra@codeaurora.org>

Conflicts:
	drivers/gpu/msm/kgsl_device.h
msm: kgsl: Flush TLB when mapping to IOMMU pagetable

Flush TLB when mapping to IOMMU pagetable, this is a requirement
for current IOMMU hardware.

Change-Id: I82e766f4869c737c1f5b73934eacaada40d46e10
Signed-off-by: Tarun Karra <tkarra@codeaurora.org>
iommu: msm: Add base physical address to drvdata structure

Add the physical address value to the iommu drvdata structure. This
address is needed for debugging purposes when we get iommu page
faults and during iommu halt and tlb sync issues.

Change-Id: I2d4f36cdfe8a3da772839cb07cd186820f2e1f52
Signed-off-by: Olav Haugan <ohaugan@codeaurora.org>
iommu: msm: Do not sleep for 10 ms when TLB sync does not complete

TLB sync might take longer than expected to complete and we wait for 10 ms
to recheck. This is causing jitter in some applications. Instead of waiting
too long to check whether TLB sync has completed we use function
readl_tight_poll_timeout to quickly poll the status without incurring sleep
delay.

We also ensure that if we do eventually time out on the TLB sync or iommu
halt we cause a crash to indicate that something has gone wrong.

CRs-fixed: 608971
Change-Id: I6b3e5155ab7aafa80432f95554d25cf0e2b753f9
Signed-off-by: Olav Haugan <ohaugan@codeaurora.org>
iommu: msm: Check VBIF state during IOMMU access timeout

Check whether halting the VBIF XIN when the TLB sync or IOMMU halt
times out clears the issue indicating an issue with the master not clearing
the VBIF FIFO.

Change-Id: I552f72db17e31a174ab2725bbecbf4ad98a9d378
Signed-off-by: Olav Haugan <ohaugan@codeaurora.org>
mmc: core: Exit clock scaling prior to removing the card

After removing the SD/MMC 'card' from the driver model we
are cancelling the pending clock scaling work which accesses
card->dev. This could cause NULL pointer issue as the card
is already removed.

CRs-Fixed: 640344
Change-Id: I8c5ee817e3f116dedf0bf4fb51eb6b70d52467b7
Signed-off-by: Pratibhasagar V <pratibha@codeaurora.org>
msm: kgsl: Do not detect faults when GPU core is idle

Do not detect GPU faults when GPU hardware status is idle,
this leads to incorrect fault detection.

Conflicts:
	drivers/gpu/msm/adreno.h

Change-Id: I7a9f8c49eb819241698f99fd50aaed400aadd4f4
Signed-off-by: Tarun Karra <tkarra@codeaurora.org>
Signed-off-by: Hareesh Gundu <hareeshg@codeaurora.org>
(cherry picked from commit 8002a0061d3ccfeccb93af50bce4ef44977845af)
ARM: Don't dump vmalloc addresses with show_data()

Memory-mapped IO address spaces cannot be safely dumped at will.
Some addresses may not be available (clocked, powered) at all times,
and may result in hangs or bus decode errors if accessed. Other
registers that are accessible may have read side-effects, and dumping
them may have adverse affects on stability or the functionality of
the affected peripheral.

Be safe, and skip dumping such addresses altogether.

CRs-Fixed: 625442
Change-Id: I4cfa75f027ededf841a0240715af0db385857cbe
Signed-off-by: Matt Wagantall <mattw@codeaurora.org>
Signed-off-by: Vignesh Radhakrishnan <vigneshr@codeaurora.org>
ARM: fix executability of CMA mappings

The CMA region was being marked executable:

0xdc04e000-0xdc050000           8K     RW x      MEM/CACHED/WBRA
0xdc060000-0xdc100000         640K     RW x      MEM/CACHED/WBRA
0xdc4f5000-0xdc500000          44K     RW x      MEM/CACHED/WBRA
0xdcce9000-0xe0000000       52316K     RW x      MEM/CACHED/WBRA

This is mainly due to the badly worded MT_MEMORY_DMA_READY symbol, but
there are also a few other places in dma-mapping which should be
corrected to use the right constant.  Fix all these places:

0xdc04e000-0xdc050000           8K     RW NX     MEM/CACHED/WBRA
0xdc060000-0xdc100000         640K     RW NX     MEM/CACHED/WBRA
0xdc280000-0xdc300000         512K     RW NX     MEM/CACHED/WBRA
0xdc6fc000-0xe0000000       58384K     RW NX     MEM/CACHED/WBRA

Change-Id: I044360a8f08b1a4ae3e3e9e623fb77af2b427c51
Signed-off-by: Russell King <rmk+kernel@arm.linux.org.uk>
Git-commit: 71b55663c5d0a6f8473045db1c8b376803780191
Git-repo: git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
[lauraa@codeaurora.org: Context fixups due to __dma_remap signature change]
Signed-off-by: Laura Abbott <lauraa@codeaurora.org>
ARM: dma-mapping: don't allow DMA mappings to be marked executable

DMA mapping permissions were being derived from pgprot_kernel directly
without using PAGE_KERNEL.  This causes them to be marked with executable
permission, which is not what we want.  Fix this.

Change-Id: Ib40f59f3c569f82409943cf8f9a86a9869d922cc
Signed-off-by: Russell King <rmk+kernel@arm.linux.org.uk>
Git-commit: 0ea1ec713f04bdfac343c9702b21cd3a7c711826
Git-repo: git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
[lauraa@codeaurora.org: dropped functions not in older builds]
Signed-off-by: Laura Abbott <lauraa@codeaurora.org>
ARM: Improve vmalloc address checking in show_data()

There is an unhandled corner case with the current check
which has recently been hit. The nbytes argument may be
large enough for the range being dumped to cross a
boundary between page-table mappings, and dump addresses
which are vmalloc'd in the neighboring mapping.

Check every address being dumped to see if its vmalloc'd,
not just the address passed to show_data().

CRs-Fixed: 625442
Change-Id: I255b093808177321f5202dcacea337ee333bfc63
Signed-off-by: Matt Wagantall <mattw@codeaurora.org>
soc: qcom: smd: Validate read and write addresses

The address from which data has to be read and the address to which the
SMD data has to be written is calculated based on the head and tail
indices for that SMD FIFO. If the indices are corrupted, then the
calculated pointer may be outside of the FIFO and may even be outside of
the range of SMEM.

Validate the read and write addresses to be with in the limits of
receive and send FIFO limits respectively.

CRs-Fixed: 550527
Change-Id: Ie5578f6aee73ea2b1435fea7c2a0a6dda14bff82
Signed-off-by: Zaheerulla Meer <zmeer@codeaurora.org>