seq_file: introduce seq_setwidth() and seq_pad()

There are several users who want to know bytes written by seq_*() for
alignment purpose.  Currently they are using %n format for knowing it
because seq_*() returns 0 on success.

This patch introduces seq_setwidth() and seq_pad() for allowing them to
align without using %n format.

Signed-off-by: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>
Signed-off-by: Kees Cook <keescook@chromium.org>
Cc: Joe Perches <joe@perches.com>
Cc: David Miller <davem@davemloft.net>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Dan Trifan <jimsth@gmail.com>
seq_file: remove "%n" usage from seq_file users

All seq_printf() users are using "%n" for calculating padding size,
convert them to use seq_setwidth() / seq_pad() pair.

Signed-off-by: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>
Signed-off-by: Kees Cook <keescook@chromium.org>
Cc: Joe Perches <joe@perches.com>
Cc: David Miller <davem@davemloft.net>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Git-commit: 652586df95e5d76b37d07a11839126dcfede1621
Git-repo: git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
[rsiddoji@codeaurora.org: Resolve merge conflicts with ipv4/6 ping
 changes in upstream]
CRs-fixed: 665291
Change-Id: Ia0416c9dbe3d80ff35f24f9c93c3543d1200a327
Signed-off-by: Ravi Kumar <rsiddoji@codeaurora.org>

Signed-off-by: Dan Trifan <jimsth@gmail.com>
vsprintf: ignore %n again

This ignores %n in printf again, as was originally documented.
Implementing %n poses a greater security risk than utility, so it should
stay ignored.  To help anyone attempting to use %n, a warning will be
emitted if it is encountered.

Based on an earlier patch by Joe Perches.

Because %n was designed to write to pointers on the stack, it has been
frequently used as an attack vector when bugs are found that leak
user-controlled strings into functions that ultimately process format
strings.  While this class of bug can still be turned into an
information leak, removing %n eliminates the common method of elevating
such a bug into an arbitrary kernel memory writing primitive,
significantly reducing the danger of this class of bug.

For seq_file users that need to know the length of a written string for
padding, please see seq_setwidth() and seq_pad() instead.

Signed-off-by: Kees Cook <keescook@chromium.org>
Cc: Joe Perches <joe@perches.com>
Cc: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>
Cc: David Miller <davem@davemloft.net>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Git-commit: 9196436ab2f713b823a2ba2024cb69f40b2f54a5
Git-repo: git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
CRs-fixed: 665291
Change-Id: Id191acaf66e3c395df92b0a77331269b525e3cad
Signed-off-by: David Brown <davidb@codeaurora.org>
Signed-off-by: Dan Trifan <jimsth@gmail.com>
msm: krait-l2-accessors: Remove set_get_l2_indirect_reg() API

There are no remaining users of this API, which writes to an indirect
register and reads back the new value. To simplify the future addition
of RTB logging for L2 indirect CP15 accesses, remove the unused API.

set_l2_indirect_reg() and get_l2_indirect_reg() can be individually
called to accomplish the same purpose that set_get_l2_indirect_reg()
served, with a negligible performance difference for common usecases.

Change-Id: If372370eabda7cf5d9eee488222a17e139609a36
Signed-off-by: Matt Wagantall <mattw@codeaurora.org>
Signed-off-by: Dan Trifan <jimsth@gmail.com>
ARM: Don't dump vmalloc addresses with show_data()

Memory-mapped IO address spaces cannot be safely dumped at will.
Some addresses may not be available (clocked, powered) at all times,
and may result in hangs or bus decode errors if accessed. Other
registers that are accessible may have read side-effects, and dumping
them may have adverse affects on stability or the functionality of
the affected peripheral.

Be safe, and skip dumping such addresses altogether.

CRs-Fixed: 625442
Change-Id: I4cfa75f027ededf841a0240715af0db385857cbe
Signed-off-by: Matt Wagantall <mattw@codeaurora.org>
(cherry picked from commit 23bbd49b56e4854067337c16ad2c2c95abbf7100)
Signed-off-by: Dan Trifan <jimsth@gmail.com>
ARM: Improve vmalloc address checking in show_data()

There is an unhandled corner case with the current check
which has recently been hit. The nbytes argument may be
large enough for the range being dumped to cross a
boundary between page-table mappings, and dump addresses
which are vmalloc'd in the neighboring mapping.

Check every address being dumped to see if its vmalloc'd,
not just the address passed to show_data().

CRs-Fixed: 625442
Change-Id: I255b093808177321f5202dcacea337ee333bfc63
Signed-off-by: Matt Wagantall <mattw@codeaurora.org>
(cherry picked from commit 2811c0946b2164cc3ede5350ce04dae32ce863e2)
Signed-off-by: Dan Trifan <jimsth@gmail.com>
msm: msm-krait-l2-accessors: Add RTB logging

Accesses to indirect CP15 registers are important system events that
are worth recording in the RTB logs. The logs may aid in debugging
issues seen following operations that use these APIs, like CPU clock
source selection changes.

Change-Id: Ibc98ba2d58ab809a9e22bab4b6fcadd1e00e5f70
Signed-off-by: Matt Wagantall <mattw@codeaurora.org>
Signed-off-by: Dan Trifan <jimsth@gmail.com>
msm: kgsl: Take the pagetable reference count only when needed

There could be a race condition where one thread is iterating
over ptlist inside kgsl_get_pagetable() with spinlock acquired
and going to call kref_put(). At the same time another thread is
inside kgsl_put_pagetable() without any spinlock calls kref_put()
and returns without calling kgsl_destroy_pagetable(). The decrement
of refcount by second thread leads to a situation where first thread
enters kgsl_destroy_pagetable_locked() and hence destroying the pt
node from list. This causes the destroyed pt node's next and prev
pointers set to POISON value resulting in kernel panic while executing
next iteration of ptlist.

Taking pt refcount while iterating over ptlist should be avoided if the
spinlock is already held and the pt is not returned to the caller. In
kgsl_get_pagetable(), since the loop is already holding the mutex, it
is safe to look at pt before taking a reference.

CRs-Fixed: 661374
Change-Id: Ide1f57cc1eb3cbf66fa399b6b72491755b999c7a
Signed-off-by: Prabhat Awasthi <pawasthi@codeaurora.org>
Signed-off-by: Dan Trifan <jimsth@gmail.com>
msm: kgsl: Remove the "global" locking from the ioctl path

Remove the lock code from the generic ioctl handler and move the
mutex lock/unlock code to the places that really need it.  In
particular try not to hold a lock while doing user memory functions
(copy_to_user/copy_from_user) to avoid the potential of a deadlock
with the memory semaphore.

CRs-Fixed: 671080
Change-Id: Ic0dedbad6f7325b53d71a5dbbed50f92483871c8
Signed-off-by: Jordan Crouse <jcrouse@codeaurora.org>
Signed-off-by: Hareesh Gundu <hareeshg@codeaurora.org>
Signed-off-by: Dan Trifan <jimsth@gmail.com>
msm: kgsl: Fix power api's used in fault interrupt sysfs control

Sysfs control of fault interrupt is using incorrect GPU power
control api's. *_clk api should not be used by rest of the
GPU driver, use the correct api for consistency.

Change-Id: I32f161c1fbf60ffe9458a5f64a8f8efb0dc79311
Signed-off-by: Tarun Karra <tkarra@codeaurora.org>
Signed-off-by: Dan Trifan <jimsth@gmail.com>
msm: kgsl: Skip the entire command during fault recovery

During fault recovery the algorithm may choose to skip the faulting
command. To skip just one indirect buffer we have to rely on
CP_IB1_BASE but depending on where the fault happened the base could
already be pointing to the next buffer. This causes the code to skip
over the wrong buffer. There is no advantage to skipping just one
buffer vs the entire submission.

Change-Id: I28dc999b2156d05f7b5084df6bdd95c5b9308579
Signed-off-by: Tarun Karra <tkarra@codeaurora.org>
Signed-off-by: Dan Trifan <jimsth@gmail.com>
msm: kgsl: Policy change to skip entire command during fault recovery

During fault recovery change default policy to skip entire command instead
of skipping faulting indirect buffer.

Change-Id: I3c2d159dbb3f2523a05f4bcbf65195673e26c020
Signed-off-by: Tarun Karra <tkarra@codeaurora.org>
Signed-off-by: Dan Trifan <jimsth@gmail.com>
msm: kgsl: Protect CP_STATE_DEBUG_INDEX

Put CP_STATE_DEBUG_INDEX and CP_STATE_DEBUG_DATA under protection
to keep it from being written from an IB1. Doing so however opens
up a subtle "feature" in the microcode: memory read opcodes turn off
protected mode in the microcode to do the read and then turns it
back on regardless of the initial state. This is a problem if the
memory read happens while protected mode is turned off and then we
try to access a protected register which then complains and goes boom.

To account for this irregularity explicitly turn back off protected
mode in all the places where we know this will be a problem.

Change-Id: Ic0dedbad1397ca9b80132241ac006560a615e042
Signed-off-by: Jordan Crouse <jcrouse@codeaurora.org>
Signed-off-by: Dan Trifan <jimsth@gmail.com>
arm/dts: hammerhead: Set panel name

Signed-off-by: Dan Trifan <jimsth@gmail.com>
msm: mdss: update DSI ULPS exit sequence

Analog upstream commit: e8c272ba5c3f23e6cece61bde7834cab7922a1d4

When MDSS idle power collapse feature is enabled in conjunction
with the DSI Ultra Low Power State (ULPS) feature, it is possible
that the MDSS GDSC can be turned off once the DSI lanes are in ULPS
mode. When ULPS mode is subsequently exited, the DSI controller
should be reset prior to executing the DSI ULPS sequence so that
the exit sequence conforms with MIPI D-PHY specifications. However,
this could sometimes lead to DSI lanes not being in the stop state
after exiting ULPS leading to DSI command transmission failures.
To address that issue, force the DSI lanes to be in stop state upon
exiting ULPS.

Signed-off-by: Dan Trifan <jimsth@gmail.com>
msm: kgsl: Rate limit interrupt error messages

Limit the interrupt error messages to prevent them from
causing watchdog. Most important interrupt errors will still
be printed but the interrupts that do not cause hang can be
rate limited.

Signed-off-by: Dan Trifan <jimsth@gmail.com>

Conflicts:
	drivers/gpu/msm/adreno_a3xx.c

Change-Id: I6f8b7ca590159904d89b98ca25e34448642dd5e1
Signed-off-by: Shubhraprakash Das <sadas@codeaurora.org>
Signed-off-by: Digish Pandya <digishp@codeaurora.org>
Signed-off-by: Dan Trifan <jimsth@gmail.com>
msm: kgsl: Read fault register on ringbuffer h/w fault

Read the CP_HW_FAULT register which gives more information
about the fault when ringbuffer h/w fault interrupt is
generated. Also, limit the printing of this interrupt to
prevent watchdog timeout.

Signed-off-by: Dan Trifan <jimsth@gmail.com>

Conflicts:
	drivers/gpu/msm/adreno.h
	drivers/gpu/msm/adreno_a3xx.c

CRs-Fixed: 613940
Change-Id: I8eba72ab50553e72f733034c7fa0ea3ca69db343
Signed-off-by: Shubhraprakash Das <sadas@codeaurora.org>
Signed-off-by: Digish Pandya <digishp@codeaurora.org>
Signed-off-by: Dan Trifan <jimsth@gmail.com>
msm: kgsl: Add ratelimit check to limit excessive kernel logging

In a3xx_err_callback(), ratelimit check is needed to limit error interrupt
reporting messages. This will prevent kernel logs causing watchdog timeout.

Signed-off-by: Dan Trifan <jimsth@gmail.com>

Conflicts:
	drivers/gpu/msm/adreno_a3xx.c

Change-Id: Id01f232fa5dd6b54e1ca9af8d6b7f37f34ed85b8
Signed-off-by: Prabhat Awasthi <pawasthi@codeaurora.org>
Signed-off-by: Digish Pandya <digishp@codeaurora.org>
Signed-off-by: Dan Trifan <jimsth@gmail.com>