msm: mdss: dsi: Share panel alignment restrictions through sysfs node

Read panel alignment restrictions on left, top, width and height values of
the updating ROI from the dtsi file and share through sysfs node.
Framework needs these details for configuring MDP for certain
features (e.g. Partial frame update).

Change-Id: Ibe6973b721bb20120a6d7a217bad2d0d159cc836
Signed-off-by: Jeykumar Sankaran <jsanka@codeaurora.org>
Signed-off-by: Dan Trifan <jimsth@gmail.com>
msm: mdss: Share minimum width and height limitations on panel ROI

Add panel ROI limitations on minimum width and height values
to the panel info sys_fs node.

Change-Id: I3297beb20e7f207a296e6cec114daf2305324898
Signed-off-by: Jeykumar Sankaran <jsanka@codeaurora.org>
Signed-off-by: Dan Trifan <jimsth@gmail.com>
msm: mdss: Consider FLIP flags while optimizing pixel fetch

While calculating source and destination rect of a pipe for the
programmed ROI, consider FLIP flags set for the pipe.

Change-Id: I631453c26f443b08a23556f83195d9914e05b41d
Signed-off-by: Jeykumar Sankaran <jsanka@codeaurora.org>
Signed-off-by: Dan Trifan <jimsth@gmail.com>
seq_file: introduce seq_setwidth() and seq_pad()

There are several users who want to know bytes written by seq_*() for
alignment purpose.  Currently they are using %n format for knowing it
because seq_*() returns 0 on success.

This patch introduces seq_setwidth() and seq_pad() for allowing them to
align without using %n format.

Signed-off-by: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>
Signed-off-by: Kees Cook <keescook@chromium.org>
Cc: Joe Perches <joe@perches.com>
Cc: David Miller <davem@davemloft.net>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Dan Trifan <jimsth@gmail.com>
seq_file: remove "%n" usage from seq_file users

All seq_printf() users are using "%n" for calculating padding size,
convert them to use seq_setwidth() / seq_pad() pair.

Signed-off-by: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>
Signed-off-by: Kees Cook <keescook@chromium.org>
Cc: Joe Perches <joe@perches.com>
Cc: David Miller <davem@davemloft.net>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Git-commit: 652586df95e5d76b37d07a11839126dcfede1621
Git-repo: git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
[rsiddoji@codeaurora.org: Resolve merge conflicts with ipv4/6 ping
 changes in upstream]
CRs-fixed: 665291
Change-Id: Ia0416c9dbe3d80ff35f24f9c93c3543d1200a327
Signed-off-by: Ravi Kumar <rsiddoji@codeaurora.org>

Signed-off-by: Dan Trifan <jimsth@gmail.com>
vsprintf: ignore %n again

This ignores %n in printf again, as was originally documented.
Implementing %n poses a greater security risk than utility, so it should
stay ignored.  To help anyone attempting to use %n, a warning will be
emitted if it is encountered.

Based on an earlier patch by Joe Perches.

Because %n was designed to write to pointers on the stack, it has been
frequently used as an attack vector when bugs are found that leak
user-controlled strings into functions that ultimately process format
strings.  While this class of bug can still be turned into an
information leak, removing %n eliminates the common method of elevating
such a bug into an arbitrary kernel memory writing primitive,
significantly reducing the danger of this class of bug.

For seq_file users that need to know the length of a written string for
padding, please see seq_setwidth() and seq_pad() instead.

Signed-off-by: Kees Cook <keescook@chromium.org>
Cc: Joe Perches <joe@perches.com>
Cc: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>
Cc: David Miller <davem@davemloft.net>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Git-commit: 9196436ab2f713b823a2ba2024cb69f40b2f54a5
Git-repo: git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
CRs-fixed: 665291
Change-Id: Id191acaf66e3c395df92b0a77331269b525e3cad
Signed-off-by: David Brown <davidb@codeaurora.org>
Signed-off-by: Dan Trifan <jimsth@gmail.com>
msm: krait-l2-accessors: Remove set_get_l2_indirect_reg() API

There are no remaining users of this API, which writes to an indirect
register and reads back the new value. To simplify the future addition
of RTB logging for L2 indirect CP15 accesses, remove the unused API.

set_l2_indirect_reg() and get_l2_indirect_reg() can be individually
called to accomplish the same purpose that set_get_l2_indirect_reg()
served, with a negligible performance difference for common usecases.

Change-Id: If372370eabda7cf5d9eee488222a17e139609a36
Signed-off-by: Matt Wagantall <mattw@codeaurora.org>
Signed-off-by: Dan Trifan <jimsth@gmail.com>
ARM: Don't dump vmalloc addresses with show_data()

Memory-mapped IO address spaces cannot be safely dumped at will.
Some addresses may not be available (clocked, powered) at all times,
and may result in hangs or bus decode errors if accessed. Other
registers that are accessible may have read side-effects, and dumping
them may have adverse affects on stability or the functionality of
the affected peripheral.

Be safe, and skip dumping such addresses altogether.

CRs-Fixed: 625442
Change-Id: I4cfa75f027ededf841a0240715af0db385857cbe
Signed-off-by: Matt Wagantall <mattw@codeaurora.org>
(cherry picked from commit 23bbd49b56e4854067337c16ad2c2c95abbf7100)
Signed-off-by: Dan Trifan <jimsth@gmail.com>
ARM: Improve vmalloc address checking in show_data()

There is an unhandled corner case with the current check
which has recently been hit. The nbytes argument may be
large enough for the range being dumped to cross a
boundary between page-table mappings, and dump addresses
which are vmalloc'd in the neighboring mapping.

Check every address being dumped to see if its vmalloc'd,
not just the address passed to show_data().

CRs-Fixed: 625442
Change-Id: I255b093808177321f5202dcacea337ee333bfc63
Signed-off-by: Matt Wagantall <mattw@codeaurora.org>
(cherry picked from commit 2811c0946b2164cc3ede5350ce04dae32ce863e2)
Signed-off-by: Dan Trifan <jimsth@gmail.com>
msm: msm-krait-l2-accessors: Add RTB logging

Accesses to indirect CP15 registers are important system events that
are worth recording in the RTB logs. The logs may aid in debugging
issues seen following operations that use these APIs, like CPU clock
source selection changes.

Change-Id: Ibc98ba2d58ab809a9e22bab4b6fcadd1e00e5f70
Signed-off-by: Matt Wagantall <mattw@codeaurora.org>
Signed-off-by: Dan Trifan <jimsth@gmail.com>
msm: kgsl: Take the pagetable reference count only when needed

There could be a race condition where one thread is iterating
over ptlist inside kgsl_get_pagetable() with spinlock acquired
and going to call kref_put(). At the same time another thread is
inside kgsl_put_pagetable() without any spinlock calls kref_put()
and returns without calling kgsl_destroy_pagetable(). The decrement
of refcount by second thread leads to a situation where first thread
enters kgsl_destroy_pagetable_locked() and hence destroying the pt
node from list. This causes the destroyed pt node's next and prev
pointers set to POISON value resulting in kernel panic while executing
next iteration of ptlist.

Taking pt refcount while iterating over ptlist should be avoided if the
spinlock is already held and the pt is not returned to the caller. In
kgsl_get_pagetable(), since the loop is already holding the mutex, it
is safe to look at pt before taking a reference.

CRs-Fixed: 661374
Change-Id: Ide1f57cc1eb3cbf66fa399b6b72491755b999c7a
Signed-off-by: Prabhat Awasthi <pawasthi@codeaurora.org>
Signed-off-by: Dan Trifan <jimsth@gmail.com>
msm: kgsl: Remove the "global" locking from the ioctl path

Remove the lock code from the generic ioctl handler and move the
mutex lock/unlock code to the places that really need it.  In
particular try not to hold a lock while doing user memory functions
(copy_to_user/copy_from_user) to avoid the potential of a deadlock
with the memory semaphore.

CRs-Fixed: 671080
Change-Id: Ic0dedbad6f7325b53d71a5dbbed50f92483871c8
Signed-off-by: Jordan Crouse <jcrouse@codeaurora.org>
Signed-off-by: Hareesh Gundu <hareeshg@codeaurora.org>
Signed-off-by: Dan Trifan <jimsth@gmail.com>
msm: kgsl: Fix power api's used in fault interrupt sysfs control

Sysfs control of fault interrupt is using incorrect GPU power
control api's. *_clk api should not be used by rest of the
GPU driver, use the correct api for consistency.

Change-Id: I32f161c1fbf60ffe9458a5f64a8f8efb0dc79311
Signed-off-by: Tarun Karra <tkarra@codeaurora.org>
Signed-off-by: Dan Trifan <jimsth@gmail.com>
msm: kgsl: Protect CP_STATE_DEBUG_INDEX

Put CP_STATE_DEBUG_INDEX and CP_STATE_DEBUG_DATA under protection
to keep it from being written from an IB1. Doing so however opens
up a subtle "feature" in the microcode: memory read opcodes turn off
protected mode in the microcode to do the read and then turns it
back on regardless of the initial state. This is a problem if the
memory read happens while protected mode is turned off and then we
try to access a protected register which then complains and goes boom.

To account for this irregularity explicitly turn back off protected
mode in all the places where we know this will be a problem.

Change-Id: Ic0dedbad1397ca9b80132241ac006560a615e042
Signed-off-by: Jordan Crouse <jcrouse@codeaurora.org>
Signed-off-by: Dan Trifan <jimsth@gmail.com>