msm: kgsl: Don't access context memory after it's freed

Context memory was potentially accessed after being freed. Fix this
by incrementing the context's refcount at strategic places.

Change-Id: I31049bdd3eb9ac52160ca593619fcc8a32d4ddee
Signed-off-by: Lynus Vaz <lvaz@codeaurora.org>
fix compiling on Mac with non-GZIP kernel compressions

  * Non-GZIP compressions do not include the size in the file. Makefile.lib
    uses the stat command to determine the size of the file and then append
    the file size to the end of the image.
  * On BSD systems like Mac, stat does not recognize -c "%s" instead it
    needs -f "%z". This resulted in a non-booting kernel since the appended
    file size was either corrupt or 0.
  * Run both forms of stat, using whichever does not error out.
  * Allow the 2nd form to print to stderr if something goes wrong to help
    with debug.

Change-Id: I3295d4f59a3f43af476f891aad47f7962ed34a3e
jf: compress kernel with xz compression

Change-Id: I82153602b47f70d5cea4757ab765e7b2b9cdce7e
1
board-8064: pmic: enable RTC write

Change-Id: I8772a6844d3079cf65c769b5429649bae4720aad
jf: add support for panel color shifting based on a sysfs interface

Adapted from work by morfic and ktoonsez

Creates a syfs interface here:
  /sys/devices/virtual/sec/tsp/panel_colors

Will accept 0-4 for parameters:
  0 - Cold (more blues)
  1 - Cool
  2 - Normal (stock colors)
  3 - Warm
  4 - Hot (more reds)

Change-Id: I5cc6853d6a33108ece8d0c22fd1866d9fe104efc
Merge "board-8064: pmic: enable RTC write" into cm-10.1
ARM: mutex: use generic atomic_dec-based implementation for ARMv6+

Commit a76d7bd96d65 ("ARM: 7467/1: mutex: use generic xchg-based
implementation for ARMv6+") removed the barrier-less, ARM-specific
mutex implementation in favour of the generic xchg-based code.

Since then, a bug was uncovered in the xchg code when running on SMP
platforms, due to interactions between the locking paths and the
MUTEX_SPIN_ON_OWNER code. This was fixed in 0bce9c46bf3b ("mutex: place
lock in contended state after fastpath_lock failure"), however, the
atomic_dec-based mutex algorithm is now marginally more efficient for
ARM (~0.5% improvement in hackbench scores on dual A15).

This patch moves ARMv6+ platforms to the atomic_dec-based mutex code.

Change-Id: I5cb600b15f891dc692356322b38cae1d692a084c
Cc: Nicolas Pitre <nico@fluxnic.net>
Signed-off-by: Will Deacon <will.deacon@arm.com>
jf: update to MDL source drop

Conflicts:
	drivers/video/msm/msm_fb.c

Change-Id: Iaef87dd70eda0f6d3260331714518f6e6cc0a0d8
jf: update to MDM source drop

Change-Id: I6d6f527c306b0ed4ca996d91d0bcff8ea80314cc
me4 upddate

* revert video/msm to current state

Conflicts:
	arch/arm/kernel/process.c
	arch/arm/mach-msm/msm_bus/msm_bus_board_8064.c
	arch/arm/mach-msm/msm_bus/msm_bus_core.h
	drivers/video/msm/mdp.c
	drivers/video/msm/mdp.h
	drivers/video/msm/mdp4_overlay.c
	drivers/video/msm/mdp4_overlay_dsi_cmd.c
	drivers/video/msm/mdp4_overlay_dsi_video.c
	drivers/video/msm/mdp4_overlay_dtv.c
	drivers/video/msm/msm_fb.c
	include/linux/msm_ion.h
Change-Id: I0686ef4ee1fe9b34ac9beaaa2bd43555234f5f6d
mdp: update to me4.

Conflicts:
	arch/arm/kernel/process.c
	arch/arm/mach-msm/msm_bus/msm_bus_board_8064.c
	arch/arm/mach-msm/msm_bus/msm_bus_core.h
	drivers/video/msm/mdp.c
	drivers/video/msm/mdp.h
	drivers/video/msm/mdp4_overlay.c
	drivers/video/msm/mdp4_overlay_dsi_cmd.c
	drivers/video/msm/mdp4_overlay_dsi_video.c
	drivers/video/msm/mdp4_overlay_dtv.c
	drivers/video/msm/msm_fb.c
	include/linux/msm_ion.h

Change-Id: I53986dd9758c7ac7ea64ab5a336b9e51645dedc0
jf: JC: allow non samsung app to update firmware

insure stability
Change-Id: I5eb80edbcdfe48a86668461d781decd5bedef027
msm_serial_hs: Squashed commit of updates from CAF

msm_serial_hs : handle uart_flush_buffer

Serial core allocates circular buffer for uart tx transfer.
Circular buffer head and tail is updated in serial core and
circular buffer tail is updated in uart driver.While uart
transfer is happening, uart client bluetooth hci_ldisc,calls
uart_flush_buffer in serial core and sets circular buffer
head and tail to zero.As uart driver does not know when
uart_flush_buffer is called in serial core by uart client,it
updates circular buffer tail for the previous ADM Tx completion.
This leads to queueing Tx command to ADM although no data is
there in circular buffer.Because of this,uart client is not
functional.

Hence adding msm_hs_flush_buffer api which notifies to uart driver
that uart_flush_buffer is called in serial core by uart client and
set tty_flush_receive flag to true.In uart interrupt handler ,do
not update circular buffer tail if uart_flush_buffer is already
called in serial core by uart client else update circular buffer
tail on ADM Tx completion.

(cherry picked from commit ce39410ad3db5b9fb446bf5da126585d58fa872a)

Change-Id: I9bce30da218f42739c175d9b3c283ae39b6b5c89
CRs-Fixed: 419054
Signed-off-by: Saket Saurabh <ssaurabh@codeaurora.org>

msm_serial_hs: Add support to handle Rx BREAK condition

Currently Rx Break Error condition is not checked using UART_DM_SR
register. Hence by default null-character is being inserted on
receiving Rx Error or Rx Break condition. Application sets termios
c_iflag if it needs any notification related to any Rx Error or
Break condition. Hence add support to handle Rx Break condition and
insert null-character conditionally based on termios.c_iflag.

CRs-Fixed: 412201
Change-Id: I7f496e42757b949f597d5dbe5c1f1ca88ee53c8c
Signed-off-by: Mayank Rana <mrana@codeaurora.org>

msm_serial_hs: consider flush buffer request only when DMA is in progress

TTY Core uses flush_buffer to clear out any output data before closing
port, whereas UART application can always request to do flush output data
before starting data transfer using tty supported ioctl().
receive_tty_flush is used to make decision on completion of any DMA Tx
data transfer. Using same approach when there is no DMA Tx transfer is
happening, it is breaking next DMA Tx transfer functionality. Hence
update receive_tty_flush only when there is any DMA TX transfer active.

(cherry picked from commit 53069734628ebce341cf1ef778c91dbcbbcf67db)

Change-Id: I26f4ceece422674e1f7647e5dfadb476cec1ef92
CRs-Fixed: 438057
Signed-off-by: Mayank Rana <mrana@codeaurora.org>

msm_serial_hs: Wait for discard flush completion for UART Rx channel

Completion of requested flush command with ADM driver is having more
latency then previously. Hence now it is required to wait for discard
flush complete if there is more events expected with UART driver which
would go out of sync without it. Below are 2 instances where it is must
to wait for discard flush completion requested on UART Rx channel.

1. Changing Baud Rate of UART
UART application can send baud rate change request based on its requirement
of communication with connected device on remote uart. Serial core also
does set by default baud rate when application is opening the uart port. As
Rx command is queued always with ADM driver from UART driver, for above
events it is required to flush the same after setting the baud rate. Not
waiting for completion of Rx flush would allow application to send command
on Tx or any other ioctl which would reach to connected device but response
may not be received as Rx flush completion is not received to queue next Rx
command to ADM. Hence with this there are chances that received data with
UART wil be lost when Rx flush completion is not received in-time. Hence
wait for Rx flush completion from set_termios() with timeout as 300 jiffie.
Rx flush completion time is non-deterministic as it depends on number of
commands queued to ADM driver from ADM client drivers.

2. While going for UART clock off
UART clock off has multiple state machines and before going into last
state it makes sure that there are no pending data in UART Tx and Rx FIFO.
Although there would be one Rx command queued which is flushed before
moving to last state and going ahead with UART clock off. If UART clock is
turned off before Rx flush request is being executed and ADM tried to flush
Rx command, ADM encounters data bus error on UART Rx Channel. Hence with
waiting for Rx flush completion, and then doing UART clock off on receving
the same would resolve ADM data bus error issue on UART Rx channel.

CRs-Fixed: 457769
Change-Id: I9344277224a2dc3f28140a1f42aa3feed5411b97
Signed-off-by: Mayank Rana <mrana@codeaurora.org>

msm_serial_hs: Donot register UART device as PM runtime active

Currently UART device is being registered as PM runtime active
in probe() and set as suspended in shutdown(). With this UART
driver PM runtime suspend is being called when system suspend
is invoked and while resuming from the same which invokes UART
driver LPM functionality. It causes UART communication to stop
if both UART Tx and RX FIFO are empty.

This change donot register UART device as PM runtime active
device as UART driver doesn't use PM runtime APIs for its LPM
functionality.

Change-Id: I33d0c95e4227fdb1b7d6d514498e161e6e4df465
Signed-off-by: Mayank Rana <mrana@codeaurora.org>

msm_serial_hs: Fix Tx path issues during uart shutdown

UART queues tx transfer request to ADM and upon getting completion
callback from ADM, schedules tx tasklet in which it enables the
Tx Ready Interrupt and waits for it. On Tx ready interrupt tx
dma_in_flight is set to zero indicating no more tx data is pending.

This would cause corner case where if uart shutdown function checks
dma_in_flight flag between dmov callback and Tx Ready interrupt,
then this may cause uart shutdown function queuing dmov flush for
the completed Tx command and with this dmov flush callback never
be called. To fix this issue, move the dma_in_flight flag reset from
Tx Ready interrupt to dmov callback.

To avoid issues if any uart clients submitting any Tx requests after
uart shutdown, add is_shutdown flag and check before tx command
submission.

CRs-Fixed: 476745
Change-Id: I05314cf2f8361109302dbc0ddcfb834e9034eab5
Signed-off-by: Saket Saurabh <ssaurabh@codeaurora.org>
Signed-off-by: Prasad Sodagudi <psodagud@codeaurora.org>

Conflicts:
	drivers/tty/serial/msm_serial_hs.c

msm_serial_hs: Fix UART Rx dmov command stall issues

Resetting Rx and Tx HW state machine while Rx dmov command queued
with ADM, caused dmov stall issues. Hence moving the Rx and Tx reset
to after dmov_flush. In order to do this, change the Rx path to not
enqueue dmov request as a part of dmov flush when flush is
FLUSH_IGNORE.

Removing the unnecessary UART Rx and Tx HW Reset in
msm_hs_set_bps_locked().

Require to add few clock cycles after Rx and Tx HW reset, hence
adding 10us delay as safe side. In addition to this, combining
both Rx and Tx reset in single register write.

CRs-Fixed: 481244
Change-Id: Ib33feb55ab42b6d30ce19db945fed7496b78debf
Signed-off-by: Saket Saurabh <ssaurabh@codeaurora.org>

msm_serial_hs: Fix synchronization between ADM and UART Cores

With current UART Core programming sequence, it is seen that ADM
and UART Core are going out of sync in few usecases with regression.
It is fixed by using Force RxStale feature of UART Core from
set_termios() and sending discard flush to ADM which would terminate
currently queued UART RX CMD to ADM. Add termios_in_progress check
to make decision about what kind flush to send on receiving RxStale
interrupt. It makes set_termios() more reboust and also keeps ADM
and UART Core in-sync.

Add dma_in_flight to keep check of UART Rx CMD status and BUG_ON if
UART driver is trying to queue one more UART RX CMD to ADM as UART
driver re-uses same UART RX CMD.

This change also adds check of currently set uartclk rate and next
required uartclk rate for new baud rate. If both are same it would
not call clk_set_rate() to set same uartclk rate again.

UART baud rate change request (i.e. executing set_termios()) can come
asynchronously and time to program ADM hardware with queued CMD by ADM
driver is non-deterministic. It is required by UART driver to confirm
that queued RX CMD is programmed with ADM hardware before going with
requested baud rate change operation. Hence this change wait in
set_termios() for ADM driver to program queued RX CMD before going ahead
with baud rate. Otherwise ADM may encounter data bus error with UART RX
channel which is unrecoverable.

Change-Id: I678e91420b33a49ce8b6a5a29c6309f9ff6f5c4a
Signed-off-by: Mayank Rana <mrana@codeaurora.org>

msm_serial_hs: Disable UART RxStale before Force RxStale in set_termios

There is possible race for handling normal RxStale event and Force
Rxstale event with UART Core, when Force RxStale is issued from
set_termios(). Hence on baud rate change request disable RxStale event
mechanism, and invoke Force RxStale. With RxStale event mechanism
disabled, Force RxStale still generates interrupt.

Fix possible race condition if before completion of previous UART RX CMD
flush, set_termios() request is received. With this case it is quite
possible that rx_tlet() queues one UART RX CMD with ADM driver and also
set_termios() queues one more UART RX CMD which would results with
queueing same UART RX CMD twice with ADM driver. With this device would
crash as the ADM driver will not be able to de-reference the second UART
RX CMD work. Hence add check in set_termios with rx.flush value as
FLUSH_DATA_READY which confirms that flush is initiated but it is not
completed and wait for rx.flush to become FLUSH_NONE which would happen
only once flush is completed and new UART RX CMD is being queued with ADM
driver.

Reduce waiting time for discard flush completion as it is already waited
for queued UART Rx CMD to be programmed with ADM hardware. Hence change
wait time out from 300 jiffies to 50 mseconds.

Add an API to get important UART core registers values which can be called
from error condition. Use the same when discard flush timeout happens with
set_termios(), when rx.dma_in_flight is not set with set_termios() and when
multiple UART RX CMD queueing condition is seen in msm_hs_start_rx_locked()
API.

CRs-Fixed: 486260
Change-Id: I9fd17e453fad619609e76e8b3a72a4f47210cff9
Signed-off-by: Mayank Rana <mrana@codeaurora.org>
perf: Treat attr.config as u64 in perf_swevent_init()

Trinity discovered that we fail to check all 64 bits of
attr.config passed by user space, resulting to out-of-bounds
access of the perf_swevent_enabled array in
sw_perf_event_destroy().

Introduced in commit b0a873ebb ("perf: Register PMU
implementations").

Signed-off-by: Tommi Rantala <tt.rantala@gmail.com>
Cc: Peter Zijlstra <a.p.zijlstra@chello.nl>
Cc: davej@redhat.com
Cc: Paul Mackerras <paulus@samba.org>
Cc: Arnaldo Carvalho de Melo <acme@ghostprotocols.net>
Link: http://lkml.kernel.org/r/1365882554-30259-1-git-send-email-tt.rantala@gmail.com
Signed-off-by: Ingo Molnar <mingo@kernel.org>

Change-Id: I117496399c6bbd94faaef5912d18bdb7f44bcc67
Add and enable kexec hardboot support.

Consists of squashed commits from:
https://github.com/mkasick/android_kernel_samsung_jfltespr.git

commit 750bb80f2854d6af5273e55ea179a4c60b2d9efc
Author: Mike Kasick <mike@kasick.org>
Date:   Sun Jun 2 23:11:24 2013 -0400

    Clear download mode flag on kexec hardboot.

commit 138ba851ee949af291eae914f410aea2d85ed9f5
Author: Mike Kasick <mike@kasick.org>
Date:   Sun May 12 22:39:26 2013 -0400

    Support hard booting to a kexec kernel.

    See KEXEC_HARDBOOT config option help for details.

commit 3ab41019a7af08395c233bebb605c2f1ea49c8e0
Author: Mike Kasick <mike@kasick.org>
Date:   Sat Jul 7 23:10:24 2012 -0400

    Support copying of kernel tagged list (atags) in the decompressor.

    This is needed to hardboot kexec a kernel with a new tags list (including a
    new kernel command line), since the new atags would otherwise be lost with
    the limited kernel memory mapping.  Without this patch, a hardboot-kexec'd
    kernel uses the atags provided by the bootloader.

commit 446c3d7a6631877f7dc9142359cf0eae300e9a08
Author: Mike Kasick <mike@kasick.org>
Date:   Sat Jul 7 23:09:39 2012 -0400

    Enable caching and buffering for all of physical RAM in the decompressor.

    Old method is to enable caching and buffering only for the 256 MB at the
    start of the decompressor image.  This makes a hardboot-kexec'd kernel very
    slow to decompress since the decompressor is located far above the kernel
    destination.  This patch reduces boot time from 35 to 8 seconds on epicmtd.

commit d3646be88f5b1f9a8ae714c922ec50c681b7157f
Author: Mike Kasick <mike@kasick.org>
Date:   Sat Jul 7 19:00:47 2012 -0400

    Enable and fix kexec syscall support.

    Use mem_text_write_kernel_word when assigning reboot_code_buffer parameters
    to avoid protection faults (writes to read-only kernel memory) when
    CONFIG_STRICT_MEMORY_RWX is enabled.

Change-Id: I0400ad00fcf02b8ad017f8aa371724a659b930b4
Merge "msm_serial_hs: Squashed commit of updates from CAF" into cm-10.1
msm: vidc: Separate meta buffers support in secure mode

Extradata is appended at the end of each output buffer
in non secure video use case but in secure video playback,
the client/CPU don't have access to the output buffer
to parse the extradata. This change allows the client/CPU
to parse the extradata by allocating separate buffers for
video hardware to store extradata.

Change-Id: I12927ea3d142b9cecd6fb1ae1086c5624d0e08d6
Signed-off-by: Deepak Verma <dverma@codeaurora.org>
msm: vidc: Free meta buffers during address table cleanup

This change frees the allocated meta buffers, if any
present, during video core address table cleanup.

Change-Id: Id8c42491040bc5be09f3bb59780d376e6921c76e
CRs-fixed: 459980
Signed-off-by: Deepak Verma <dverma@codeaurora.org>
msm: vidc: Remove delayed unmap flag in ion_map_iommu()

This change fixes the iommu map failure in movie studio
application by removing the delayed unmap flag in
ion_map_iommu(). The delayed unmap will cause the
iommu buffer to be unmapped only when all the clients
unmap the buffer.

Change-Id: I9e226fd56fecfa292e4d77aa94b2883bcfbf6ec2
CRs-fixed: 464374
Signed-off-by: Maheshwar Ajja <majja@codeaurora.org>
msm: vidc: Remove kernel mapping on input/output buffers

This change will remove the kernel mapping of input and
output buffers for both video encoder and decoder to
avoid the errors resulting from ion_map_kernel() for
high resolution video concurrency use cases due to the
limited vmalloc space. It also removed the metadata
processing in kerner video driver as kernel virtual
address is removed. The metadata processing can be
done in user space video component.

Change-Id: I3f2c9b7c13b3e09097ce07ca7b59154b97401052
CRs-fixed: 471135
Signed-off-by: Maheshwar Ajja <majja@codeaurora.org>