msm: kgsl: Add a missing refcount put for kgsl_context

Fix a potential memory leak by putting in the missing
kgsl_context_put() in ft detect for kgsl_context

Change-Id: I2673cdcc5a8ab9caf4d9adbfd9b3aa528348d945
Signed-off-by: Prakash Kamliya <pkamliya@codeaurora.org>
msm: kgsl: Skip hang check for 2d devices
kgsl hung check is used for 3d device but while creating a 2d
device we are creating a hung timer and check for hung in 3d
device, Which is not logically correct. Some time it causes kernal panic
when device type is 2d and we try to access 3d device registers etc

Change-Id: I82d7c4ca542f33529357c336daa36a66153adcd3
Signed-off-by: Gaurav Gagrani <ggagrani@codeaurora.org>
msm: kgsl: Protect against a potential overflow in kgsl_sg_alloc

Avoid allocating a scatterlist so large that it overflows the size
passed to the memory allocators.

CRs-fixed: 564448
Change-Id: Ic0dedbad2ab421ddec8f3be38d61c9bdf9ae5bd4
Signed-off-by: Jordan Crouse <jcrouse@codeaurora.org>
msm: kgsl: avoid zero length scatterlist allocation

During sglist allocation we calculate sglen as
per below

sglen_alloc = PAGE_ALIGN(size) >> PAGE_SHIFT;

sglen_alloc can be zero if size falls within the
last page. For example, when size = 0xFFFF_FF7B,
PAGE_ALIGN(0xFFFF_FF7B) will be 0, considering
0x1000 (4kb) PAGE_SIZE. if kzalloc() with
zero size, it will return ZERO_SIZE_PTR which is
not NULL and we always do NULL check. Dereferencing
ZERO_SIZE_PTR will lead to a distinct access fault.

Signed-off-by: Gaurav Gagrani <ggagrani@codeaurora.org>

Change-Id: Ibcc6198438c13b5111be0faa736328db92511597
CRs-Fixed: 563106
Signed-off-by: Prakash Kamliya <pkamliya@codeaurora.org>
Revert "Execute shader on wakeup from power collapse"

This reverts commit 28eabf6987637c6c438c461aa31ce25e0f7edcc5.

Conflicts:

	drivers/gpu/msm/adreno.c
	drivers/gpu/msm/adreno.h
	drivers/gpu/msm/adreno_a3xx.c
	drivers/gpu/msm/adreno_ringbuffer.c

Change-Id: I0a979f33d9030546d1e72b63cff88d269f63a4c7
Signed-off-by: Hareesh Gundu <hareeshg@codeaurora.org>
msm: kgsl: Fix mem leak when page allocation fails

Page allocation may fail during OOM condition. Update
sglen and size to correct value (allocated) so that
they get freed in kgsl_sharedmem_free().

Change-Id: I1aa0ca77bb767523dfcf0f6cc3a21eac2b6b80e4
Signed-off-by: Hareesh Gundu <hareeshg@codeaurora.org>
msm: kgsl: Change an overflow check to be "smart" compiler proof

In its infinite wisdom, GCC will optimize out this overflow check:

   if ((gpuaddr + size) < gpuaddr)

Which might totally make sense for the compiler but it doesn't do us
a bit of good. Replace the existing overflow check with something
that GCC can't ignore.

CRs-fixed: 544025
Change-Id: Ic0dedbad921545a01d5fe80a20c3f2f4f86ef641
Signed-off-by: Jordan Crouse <jcrouse@codeaurora.org>
msm: kgsl: Fix overflow check in mmap_range_valid

A eager compiler might optimize out the overflow check in
mmap_range_valid.  Add a check against ULONG_MAX to ensure
that the check is performed.

CRs-fixed: 546373
Change-Id: Ic0dedbad478cc3bd65a00a7b31d2039095c005d6
Signed-off-by: Jordan Crouse <jcrouse@codeaurora.org>
msm: kgsl: Verify the user address before reading a perfcounter group

In adreno_perfcounter_read_group some user input verification is
occuring on a user pointer before copy_from_user is called
resulting in a possible segmentation fault if called with improper
input data.

CRs-fixed: 553314
Change-Id: Ic0dedbad4c5e4b2610368d51ff591d1f716712f4
Signed-off-by: Jordan Crouse <jcrouse@codeaurora.org>
msm: kgsl: Remove sscanf() from kgsl_pwrctrl.c

Replace sscanf() in kgsl_pwrctrl.c with a generic function to safely
convert 32 bit unsigned ints.

CRs-fixed: 563585
Change-Id: Ic0dedbad10e2264ec8fccab622d094d123b49b77
Signed-off-by: Jordan Crouse <jcrouse@codeaurora.org>
msm: kgsl: Fix Z180 memory leak

Decerement entry refcount, which incremented
in kgsl_sharedmem_find_region.

CRs-Fixed: 635747
Change-Id: I621ba8f8e119a9ab8ba5455b28a565e3cae2f7cd
Signed-off-by: Hareesh Gundu <hareeshg@codeaurora.org>
kref: Inline all functions

These are tiny functions, there's no point in having them out-of-line.

Cc: Alexey Dobriyan <adobriyan@gmail.com>
Cc: Eric Dumazet <eric.dumazet@gmail.com>
Cc: Ingo Molnar <mingo@elte.hu>
Signed-off-by: Peter Zijlstra <a.p.zijlstra@chello.nl>
Link: http://lkml.kernel.org/n/tip-8eccvi2ur2fzgi00xdjlbf5z@git.kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
kref: Implement kref_put in terms of kref_sub

Less lines of code is better.

Cc: Alexey Dobriyan <adobriyan@gmail.com>
Cc: Eric Dumazet <eric.dumazet@gmail.com>
Cc: Ingo Molnar <mingo@elte.hu>
Signed-off-by: Peter Zijlstra <a.p.zijlstra@chello.nl>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
kref: Remove the memory barriers

Commit 1b0b3b9980e ("kref: fix CPU ordering with respect to krefs")
wrongly adds memory barriers to kref.

It states:

  some atomic operations are only atomic, not ordered. Thus a CPU is allowed
  to reorder memory references to an object to before the reference is
  obtained. This fixes it.

While true, it fails to show why this is a problem. I say it is not a
problem because if there is a race with kref_put() such that we could
end up referencing a free'd object without this memory barrier, we
would still have that race with the memory barrier.

The kref_put() in question could complete (and free the object) before
the atomic_inc() and we'd still be up shit creek.

The kref_init() case is even worse, if your object is published at this
time you're so wrong the memory barrier won't make a difference what
so ever. If its not published, the act of publishing should include
the needed barriers/locks to make sure all writes prior to the act of
publishing are complete such that others will only observe a complete
object.

Cc: Alexey Dobriyan <adobriyan@gmail.com>
Cc: Eric Dumazet <eric.dumazet@gmail.com>
Cc: Ingo Molnar <mingo@elte.hu>
Cc: Oliver Neukum <oneukum@suse.de>
Signed-off-by: Peter Zijlstra <a.p.zijlstra@chello.nl>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
kref: fix up the kfree build problems

It turns out that some memory allocators use kobjects, which use krefs,
and kref.h was wanting to figure out the address of kfree(), which ended
up in a loop.

kfree was only being needed for a warning to tell the caller that they
were doing something stupid.  Now we just move that warning into the
comments for the functions, which results in a bit more fun as everyone
enjoys digging for people to mock at times of boredom.

So, remove the dependancy of slab.h on kref.h, and fix up the other
include file as well (we really only need bug.h and atomic.h, not
types.h).

Reported-by: Stephen Rothwell <sfr@canb.auug.org.au>
Cc: Peter Zijlstra <a.p.zijlstra@chello.nl>
Cc: Alexey Dobriyan <adobriyan@gmail.com>
Cc: Eric Dumazet <eric.dumazet@gmail.com>
Cc: Ingo Molnar <mingo@elte.hu>
Cc: Oliver Neukum <oneukum@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
Fix compile breakage with kref.h

This set of build failures just started appearing on parisc:

  In file included from drivers/input/serio/serio_raw.c:12:
  include/linux/kref.h: In function 'kref_get':
  include/linux/kref.h:40: error: 'TAINT_WARN' undeclared (first use in this function)
  include/linux/kref.h:40: error: (Each undeclared identifier is reported only once
  include/linux/kref.h:40: error: for each function it appears in.)
  include/linux/kref.h: In function 'kref_sub':
  include/linux/kref.h:65: error: 'TAINT_WARN' undeclared (first use in this function)

It happens because TAINT_WARN is defined in kernel.h and this particular
compile doesn't seem to include it (no idea why it's just manifesting ..
probably some #include file untangling exposed it).

Fix by adding

  #include <linux/kernel.h>

to linux/kref.h

Signed-off-by: James Bottomley <JBottomley@Parallels.com>
Acked-by: Greg Kroah-Hartman <gregkh@suse.de>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
kref: Implement kref_get_unless_zero v3

This function is intended to simplify locking around refcounting for
objects that can be looked up from a lookup structure, and which are
removed from that lookup structure in the object destructor.
Operations on such objects require at least a read lock around
lookup + kref_get, and a write lock around kref_put + remove from lookup
structure. Furthermore, RCU implementations become extremely tricky.
With a lookup followed by a kref_get_unless_zero *with return value check*
locking in the kref_put path can be deferred to the actual removal from
the lookup structure and RCU lookups become trivial.

v2: Formatting fixes.
v3: Invert the return value.

Change-Id: I391623ee7458428eab6d7f361630f8646d6790b0
Signed-off-by: Thomas Hellstrom <thellstrom@vmware.com>
Signed-off-by: Dave Airlie <airlied@redhat.com>
Git-commit: 4b20db3de8dab005b07c74161cb041db8c5ff3a7
Git-repo: git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
[shrenujb@codeaurora.org: resolve trivial merge conflicts]
Signed-off-by: Shrenuj Bansal <shrenujb@codeaurora.org>
msm: kgsl: fix a race condition when calling kref_put

Fix a race condition which can occur if a thread tries to acquire
a reference to a mem_entry or context while another thread has
already decremented the refcount to 0 and is in the process of
destroying said mem_entry or context.

CRs-Fixed: 635747
Change-Id: I6be64ca75f9cb12b03e870b9ca83588197c64e5e
Signed-off-by: Hareesh Gundu <hareeshg@codeaurora.org>