msm: kgsl: Rate limit interrupt error messages

Limit the interrupt error messages to prevent them from
causing watchdog. Most important interrupt errors will still
be printed but the interrupts that do not cause hang can be
rate limited.

Conflicts:
	drivers/gpu/msm/adreno_a3xx.c

Change-Id: I6f8b7ca590159904d89b98ca25e34448642dd5e1
Signed-off-by: Shubhraprakash Das <sadas@codeaurora.org>
Signed-off-by: Digish Pandya <digishp@codeaurora.org>
msm: kgsl: Read fault register on ringbuffer h/w fault

Read the CP_HW_FAULT register which gives more information
about the fault when ringbuffer h/w fault interrupt is
generated. Also, limit the printing of this interrupt to
prevent watchdog timeout.

Conflicts:
	drivers/gpu/msm/adreno.h
	drivers/gpu/msm/adreno_a3xx.c

CRs-Fixed: 613940
Change-Id: I8eba72ab50553e72f733034c7fa0ea3ca69db343
Signed-off-by: Shubhraprakash Das <sadas@codeaurora.org>
Signed-off-by: Digish Pandya <digishp@codeaurora.org>
msm: kgsl: Add ratelimit check to limit excessive kernel logging

In a3xx_err_callback(), ratelimit check is needed to limit error interrupt
reporting messages. This will prevent kernel logs causing watchdog timeout.

Conflicts:
	drivers/gpu/msm/adreno_a3xx.c

Change-Id: Id01f232fa5dd6b54e1ca9af8d6b7f37f34ed85b8
Signed-off-by: Prabhat Awasthi <pawasthi@codeaurora.org>
Signed-off-by: Digish Pandya <digishp@codeaurora.org>
msm: kgsl: Mark mmapped objects with VM_DONTCOPY

Add VM_DONTCOPY to the default set of mmap flags to keep VM objects
from being copied on fork() and causing issues.  KGSL file descriptors
copied to a child are not expected to be usable.

Change-Id: Ic0dedbad85c07118a931ccb9f7a6fd0507da3e5a
Signed-off-by: Jordan Crouse <jcrouse@codeaurora.org>
msm: kgsl: enable CPU IRQ while suspending context

Make sure that CPU interrupt is enabled before calling adreno
suspend_context when moving from NAP/SLEEP to SLUMBER state.
We send commands to GPU in adreno_drawctxt_switch() which will generate
GPU interrupt. Since CPU interrupt is not enabled, adreno_idle() will
fail because pending interrupt will not be served by CPU this causes
false GPU hang.

CRs-Fixed: 547813

Change-Id: Ia4b730b8f8cda1e820f571ffb7ddb00336ca1a8c
Signed-off-by: Gaurav Gagrani <ggagrani@codeaurora.org>
msm: kgsl: Fix memory entry leak when calling adreno_convertaddr

When adreno_convertaddr is called the memory searched in this function
may have a memory entry associated with it if this allocation belongs
to user space. A reference to this memory entry is taken when
this function is called which should be returned when the caller is
done using the memory. Made changes to return a reference to the
entry when calling this function which is returned when caller is
done using the memory.

Change-Id: I610553fd4b119d3c47cbfcec970d50046dbb2863
Signed-off-by: Shubhraprakash Das <sadas@codeaurora.org>
Signed-off-by: Lynus Vaz <lvaz@codeaurora.org>
msm: kgsl: Keep track of kernel space mappings to memory

Add a counter to count number of times a memory descriptor is
mapped in the kernel and unmap the kernel mapping only when the
count reaches 0. There can be multiple threads using the kernel
mapping at the same time hence a counter is used to make sure
that we do not unmap the mapping before the last thread has
finished using it.

Change-Id: I9c53deb6af12fb1f6ed30e46b386e1cd60dafdda
Signed-off-by: Shubhraprakash Das <sadas@codeaurora.org>
Signed-off-by: Lynus Vaz <lvaz@codeaurora.org>
ion: Skip zeroing on secure buffers

Secure buffers are never passed to userspace and are controled
by the secure world so there is no real need to zero. Pass the
dma attribute to skip zeroing.

Change-Id: Iad870d0d7732d3dea09443418b9294cb9e05b5e0
Signed-off-by: Laura Abbott <lauraa@codeaurora.org>
Signed-off-by: Jake Weinstein <xboxlover360@gmail.com>
gpu: ion: Add source of allocated page

It might be useful for higher levels in the call chain to know whether a
page came from the page pool or from the buddy allocator. If a page came
from the page pool we know that the page has been zeroed already and we
do not have to do that again.

CRs-fixed: 660049
Change-Id: I849591a56e5af8a5bc4340bff70f23e3702e62fb
Signed-off-by: Olav Haugan <ohaugan@codeaurora.org>
[nabrah@codeaurora.org: changes were manually merged from
 drivers/staging/android/ion]
Signed-off-by: Nirmal Abraham <nabrah@codeaurora.org>

Signed-off-by: Jake Weinstein <xboxlover360@gmail.com>
gpu: ion: Optimize zeroing when allocating from system heap

Currently when allocating from system heap each page is individually
mapped and zero'ed in the page pool code. Under high memory pressure when
we allocate a lot of small pages this becomes a bottleneck. Instead,
do the zeroing in one fell swoop at the end of allocating all the pages
but only for the pages that are not already zero'ed and sync'ed (pages
coming from the page pool).

Test results
------------
Time recorded for allocating 20 x 19MB ION buffers from System heap with
forced 4K page allocations (all pages allocated was order-0) right after
boot to Android homescreen using performance kernel configuration.

Before change (non-cached allocations):
Run 1: 768ms
Run 2: 752ms
Run 3: 759ms

Before change (cached allocations):
Run 1: 726ms
Run 2: 769ms
Run 3: 645ms

After change (cached allocations):
Run 1: 262ms
Run 2: 249ms
Run 3: 310ms

After change (non-cached allocations):
Run 1: 275ms
Run 2: 234ms
Run 3: 259ms

Time recorded for allocating 20 x 19MB ION buffers from System heap (with no
forced page size) right after boot to Android homescreen using
performance kernel configuration. Run 1 is taken right after boot while
run 2 and 3 are subsequent runs without reboot between.

Before change (non-cached allocations):
Run 1: 181ms
Run 2: 1ms
Run 3: 1ms

Before change (cached allocations):
Run 1: 220ms
Run 2: 1ms
Run 3: 2ms

After change (non-cached allocations):
Run 1: 166ms
Run 2: 1ms
Run 3: 1ms

After change (cached allocations):
Run 1: 170ms
Run 2: 1ms
Run 3: 3ms

CRs-fixed: 660049
Change-Id: I8dcfdb4adb8d5f4480768f951523fa5c64db87b1
Signed-off-by: Olav Haugan <ohaugan@codeaurora.org>
[nabrah@codeaurora.org: changes manually merged from
 drivers/staging/android/ion. In ion_system_heap.c, in function
 ion_system_heap_allocate, the call to 'list_first_entry_or_null'
 is replaced with  'list_first_entry' and 'list_empty' as
 'list_first_entry_or_null is not supported in 3.4 kernel branch]
Signed-off-by: Nirmal Abraham <nabrah@codeaurora.org>

Signed-off-by: Jake Weinstein <xboxlover360@gmail.com>
gpu: ion: Reduce allocation time from system heap

If we are under heavy memory pressure the shrinker might be running on
the system heap. This causes contention with the page pool lock when we
try to allocate from system heap. To ensure that allocations aren't
slowed down by having to wait for the page pool mutex we will just try
to get the mutex. If we are unsuccessful we just bypass the pool
altogether.

CRs-fixed: 687475
Change-Id: I3e92e3081355a8528438e41e74b716a2b49a3891
Signed-off-by: Olav Haugan <ohaugan@codeaurora.org>
[nabrah@codeaurora.org: changes were manually merged from
 drivers/staging/android/ion]
Signed-off-by: Nirmal Abraham <nabrah@codeaurora.org>

Signed-off-by: Jake Weinstein <xboxlover360@gmail.com>
staging: android: ashmem: get_name,set_name not to hold ashmem_mutex

Problem:
There exists a path in ashmem driver that could lead to acquistion
of mm->mmap_sem, ashmem_mutex in reverse order. This could lead
to deadlock in the system.
For Example, assume that mmap is called on a ashmem region
in the context of a thread say T1.
 sys_mmap_pgoff (1. acquires mm->mmap_sem)
  |
   --> mmap_region
 	|
         ----> ashmem_mmap (2. acquires asmem_mutex)
 Now if there is a context switch after 1 and before 2,
 and if another thread T2 (that shares the mm struct) invokes an
 ioctl say ASHMEM_GET_NAME, this can lead to the following path

ashmem_ioctl
  |
  -->get_name (3. acquires ashmem_mutex)
	|
	---> copy_to_user (4. acquires the mm->mmap_sem)
Note that the copy_to_user could lead to a valid fault if no
physical page is allocated yet for the user address passed.
Now T1 has mmap_sem and is waiting for ashmem_mutex.
and T2 has the ashmem_mutex and is waiting for mmap_sem
Thus leading to deadlock.

Solution:
Do not call copy_to_user or copy_from_user while holding the
ahsmem_mutex. Instead copy this to a local buffer that lives
in the stack while holding this lock. This will maintain data
integrity as well never reverse the lock order.

Testing:
Created a unit test case to reproduce the problem.
Used the same to test this fix on kernel version 3.4.0
Ported the same patch to 3.8

Change-Id: Ib66f6265da91691acfd3be9ea8f5c9332c978751
CRs-Fixed: 600362
Signed-off-by: Shankar Brahadeeswaran <shankoo77@gmail.com>
Reviewed-by: Dan Carpenter <dan.carpenter@oracle.com>
Acked-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Git-commit: e5834d620d61d01444c41958f1816d688a96433c
Git-repo: git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
Signed-off-by: Laura Abbott <lauraa@codeaurora.org>
Signed-off-by: Jake Weinstein <xboxlover360@gmail.com>

Conflicts:
	drivers/staging/android/ashmem.c
ashmem: avoid deadlock between read and mmap calls

Avoid holding ashmem_mutex across code that can page fault.  Page faults
grab the mmap_sem for the process, which are also held by mmap calls
prior to calling ashmem_mmap, which locks ashmem_mutex.  The reversed
order of locking between the two can deadlock.

The calls that can page fault are read() and the ASHMEM_SET_NAME and
ASHMEM_GET_NAME ioctls.  Move the code that accesses userspace pages
outside the ashmem_mutex.

Bug: 9261835
Change-Id: If1322e981d29c889a56cdc9dfcbc6df2729a45e9
CRs-Fixed: 600362
Signed-off-by: Todd Poynor <toddpoynor@google.com>
Git-repo: https://android.googlesource.com/kernel/common/
Git-commit: 0a9dea28170c90a7265250b66cc0df1253b0c501
Signed-off-by: Laura Abbott <lauraa@codeaurora.org>
Signed-off-by: Jake Weinstein <xboxlover360@gmail.com>

Conflicts:
	drivers/staging/android/ashmem.c
staging: android: ashmem: Avoid deadlock with mmap/shrink

Both ashmem_mmap and ashmem_shrink take the ashmem_lock. It may
be possible for ashmem_mmap to invoke ashmem_shrink:

-000|mutex_lock(lock = 0x0)
-001|ashmem_shrink(?, sc = 0x0) <--- try to take ashmem_mutex again
-002|shrink_slab(shrink = 0xDA5F1CC0, nr_pages_scanned = 0, lru_pages
-002|=
-002|124)
-003|try_to_free_pages(zonelist = 0x0, ?, ?, ?)
-004|__alloc_pages_nodemask(gfp_mask = 21200, order = 1, zonelist =
-004|0xC11D0940,
-005|new_slab(s = 0xE4841E80, ?, node = -1)
-006|__slab_alloc.isra.43.constprop.50(s = 0xE4841E80, gfpflags =
-006|2148925462, ad
-007|kmem_cache_alloc(s = 0xE4841E80, gfpflags = 208)
-008|shmem_alloc_inode(?)
-009|alloc_inode(sb = 0xE480E800)
-010|new_inode_pseudo(?)
-011|new_inode(?)
-012|shmem_get_inode(sb = 0xE480E800, dir = 0x0, ?, dev = 0, flags =
-012|187)
-013|shmem_file_setup(?, ?, flags = 187)
-014|ashmem_mmap(?, vma = 0xC5D64210) <---- Acquire ashmem_mutex
-015|mmap_region(file = 0xDF8E2C00, addr = 1772974080, len = 233472,
-015|flags = 57,
-016|sys_mmap_pgoff(addr = 0, len = 230400, prot = 3, flags = 1, fd =
-016|157, pgoff
-017|ret_fast_syscall(asm)
-->|exception
-018|NUR:0x40097508(asm)
---|end of frame

Avoid this deadlock by using mutex_trylock in ashmem_shrink; if the mutex
is already held, do not attempt to shrink.

Change-Id: I222bbf55856d5849da813b730de0636c80966c8e
CRs-Fixed: 608832
Signed-off-by: Laura Abbott <lauraa@codeaurora.org>
Signed-off-by: Jake Weinstein <xboxlover360@gmail.com>

Conflicts:
	drivers/staging/android/ashmem.c
staging: binder: add vm_fault handler

An issue was observed when a userspace task exits.
The page which hits error here is the zero page.
In binder mmap, the whole of vma is not mapped.
On a task crash, when debuggerd reads the binder regions,
the unmapped areas fall to do_anonymous_page in handle_pte_fault,
due to the absence of a vm_fault handler. This results in
zero page being mapped. Later in zap_pte_range, vm_normal_page
returns zero page in the case of VM_MIXEDMAP and it results in the
error.

BUG: Bad page map in process mediaserver  pte:9dff379f pmd:9bfbd831
page:c0ed8e60 count:1 mapcount:-1 mapping:  (null) index:0x0
page flags: 0x404(referenced|reserved)
addr:40c3f000 vm_flags:10220051 anon_vma:  (null) mapping:d9fe0764 index:fd
vma->vm_ops->fault:   (null)
vma->vm_file->f_op->mmap: binder_mmap+0x0/0x274
CPU: 0 PID: 1463 Comm: mediaserver Tainted: G        W    3.10.17+ #1
[<c001549c>] (unwind_backtrace+0x0/0x11c) from [<c001200c>] (show_stack+0x10/0x14)
[<c001200c>] (show_stack+0x10/0x14) from [<c0103d78>] (print_bad_pte+0x158/0x190)
[<c0103d78>] (print_bad_pte+0x158/0x190) from [<c01055f0>] (unmap_single_vma+0x2e4/0x598)
[<c01055f0>] (unmap_single_vma+0x2e4/0x598) from [<c010618c>] (unmap_vmas+0x34/0x50)
[<c010618c>] (unmap_vmas+0x34/0x50) from [<c010a9e4>] (exit_mmap+0xc8/0x1e8)
[<c010a9e4>] (exit_mmap+0xc8/0x1e8) from [<c00520f0>] (mmput+0x54/0xd0)
[<c00520f0>] (mmput+0x54/0xd0) from [<c005972c>] (do_exit+0x360/0x990)
[<c005972c>] (do_exit+0x360/0x990) from [<c0059ef0>] (do_group_exit+0x84/0xc0)
[<c0059ef0>] (do_group_exit+0x84/0xc0) from [<c0066de0>] (get_signal_to_deliver+0x4d4/0x548)
[<c0066de0>] (get_signal_to_deliver+0x4d4/0x548) from [<c0011500>] (do_signal+0xa8/0x3b8)

Add a vm_fault handler which returns VM_FAULT_SIGBUS, and prevents the
wrong fallback to do_anonymous_page.

CRs-Fixed: 673147
Change-Id: I43730a51b6c819538b46c5e4dc5c96c8a384098d
Signed-off-by: Vinayak Menon <vinayakm.list@gmail.com>
Patch-mainline: linux-arm-kernel @ 06/02/14, 18:17
Signed-off-by: Vignesh Radhakrishnan <vigneshr@codeaurora.org>
Signed-off-by: Subbaraman Narayanamurthy <subbaram@codeaurora.org>
Signed-off-by: Jake Weinstein <xboxlover360@gmail.com>
[PATCH] Staging: android: binder: More offset validation.

Make sure offsets don't point to overlapping flat_binder_object
structs.

Change-Id: I425ab0c46fbe2b00ed679c5becf9e8140395eb40
Signed-off-by: Arve HjÃ¸nnevÃ¥g <arve@android.com>
Signed-off-by: Jake Weinstein <xboxlover360@gmail.com>
slimbus: Provide framer-booted notification to slimbus device drivers

When slimbus resets (due to bus reset sequence, or after it shuts down
and comes up), framer boots up and starts clocking the bus.
Devices on the bus may be in undefined state at that time. Callback
is provided to slimbus device drivers so that controller can report
framer-booted notification so that drivers can take necessary action
to put devices in reset state so that they can acquire sync, report
present, and be operational.

Change-Id: I6068063ef32c91a67c246f9ee727b4724c11f5f2
Signed-off-by: Sagar Dharia <sdharia@codeaurora.org>
Signed-off-by: Jake Weinstein <xboxlover360@gmail.com>

Conflicts:
	drivers/slimbus/slimbus.c
	include/linux/slimbus/slimbus.h
slim_msm: ngd: Return success for channel removal during ADSP SSR

Slimbus master component resides on ADSP when this driver is used.
Wehn ADSP restarts, slimbus component goes down and bus is not
operational until it comes back up. During restart, slimbus clients
are notified since their device goes down, and the clients remove
channels and/or disconnect ports. Since bus is not operational,
return success for channel removal/port disconnection calls so that
the channel, port state is consistent with HW (not active, removed)

Change-Id: Ia2707ed9f3fc3573b5746c8e42fa7f229e0dea4f
Signed-off-by: Sagar Dharia <sdharia@codeaurora.org>
Signed-off-by: Jake Weinstein <xboxlover360@gmail.com>

Conflicts:
	drivers/slimbus/slim-msm-ngd.c
slim_ngd: Return success for resource removal requests if HW restarts

Channel and ports are removed when HW restarts. Return success to
client channel removal, port disconnection requests when slimbus HW
is restarting.

Change-Id: Ifc9a3bb80023c823a7776a16fe32e5b59b181350
Signed-off-by: Sagar Dharia <sdharia@codeaurora.org>
Signed-off-by: Jake Weinstein <xboxlover360@gmail.com>
slim_ngd: Fix logical address notification mechanism

It's possible that multiple slaves report present and expect
corresponding notifications concurrently. Make sure notifications
are sent out in that case. Since notifications cannot be sent when
device doesn't have associated driver, make sure logical address
is not queried in that case.

Change-Id: I371c48d25a0953f5f1909c904e8fd80b599d16b3
Signed-off-by: Sagar Dharia <sdharia@codeaurora.org>
Signed-off-by: Jake Weinstein <xboxlover360@gmail.com>