msm: mdss: dsi: Share panel alignment restrictions through sysfs node

Read panel alignment restrictions on left, top, width and height values of
the updating ROI from the dtsi file and share through sysfs node.
Framework needs these details for configuring MDP for certain
features (e.g. Partial frame update).

Change-Id: Ibe6973b721bb20120a6d7a217bad2d0d159cc836
Signed-off-by: Jeykumar Sankaran <jsanka@codeaurora.org>
msm: mdss: Share minimum width and height limitations on panel ROI

Add panel ROI limitations on minimum width and height values
to the panel info sys_fs node.

Change-Id: I3297beb20e7f207a296e6cec114daf2305324898
Signed-off-by: Jeykumar Sankaran <jsanka@codeaurora.org>
msm: mdss: Consider FLIP flags while optimizing pixel fetch

While calculating source and destination rect of a pipe for the
programmed ROI, consider FLIP flags set for the pipe.

Change-Id: I631453c26f443b08a23556f83195d9914e05b41d
Signed-off-by: Jeykumar Sankaran <jsanka@codeaurora.org>
seq_file: introduce seq_setwidth() and seq_pad()

There are several users who want to know bytes written by seq_*() for
alignment purpose.  Currently they are using %n format for knowing it
because seq_*() returns 0 on success.

This patch introduces seq_setwidth() and seq_pad() for allowing them to
align without using %n format.

Signed-off-by: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>
Signed-off-by: Kees Cook <keescook@chromium.org>
Cc: Joe Perches <joe@perches.com>
Cc: David Miller <davem@davemloft.net>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
seq_file: remove "%n" usage from seq_file users

All seq_printf() users are using "%n" for calculating padding size,
convert them to use seq_setwidth() / seq_pad() pair.

Signed-off-by: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>
Signed-off-by: Kees Cook <keescook@chromium.org>
Cc: Joe Perches <joe@perches.com>
Cc: David Miller <davem@davemloft.net>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Git-commit: 652586df95e5d76b37d07a11839126dcfede1621
Git-repo: git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
[rsiddoji@codeaurora.org: Resolve merge conflicts with ipv4/6 ping
 changes in upstream]
CRs-fixed: 665291
Change-Id: Ia0416c9dbe3d80ff35f24f9c93c3543d1200a327
Signed-off-by: Ravi Kumar <rsiddoji@codeaurora.org>
vsprintf: ignore %n again

This ignores %n in printf again, as was originally documented.
Implementing %n poses a greater security risk than utility, so it should
stay ignored.  To help anyone attempting to use %n, a warning will be
emitted if it is encountered.

Based on an earlier patch by Joe Perches.

Because %n was designed to write to pointers on the stack, it has been
frequently used as an attack vector when bugs are found that leak
user-controlled strings into functions that ultimately process format
strings.  While this class of bug can still be turned into an
information leak, removing %n eliminates the common method of elevating
such a bug into an arbitrary kernel memory writing primitive,
significantly reducing the danger of this class of bug.

For seq_file users that need to know the length of a written string for
padding, please see seq_setwidth() and seq_pad() instead.

Signed-off-by: Kees Cook <keescook@chromium.org>
Cc: Joe Perches <joe@perches.com>
Cc: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>
Cc: David Miller <davem@davemloft.net>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Git-commit: 9196436ab2f713b823a2ba2024cb69f40b2f54a5
Git-repo: git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
CRs-fixed: 665291
Change-Id: Id191acaf66e3c395df92b0a77331269b525e3cad
Signed-off-by: David Brown <davidb@codeaurora.org>
msm: krait-l2-accessors: Remove set_get_l2_indirect_reg() API

There are no remaining users of this API, which writes to an indirect
register and reads back the new value. To simplify the future addition
of RTB logging for L2 indirect CP15 accesses, remove the unused API.

set_l2_indirect_reg() and get_l2_indirect_reg() can be individually
called to accomplish the same purpose that set_get_l2_indirect_reg()
served, with a negligible performance difference for common usecases.

Change-Id: If372370eabda7cf5d9eee488222a17e139609a36
Signed-off-by: Matt Wagantall <mattw@codeaurora.org>
cpaccess: remove use of set_get_l2_indirect_reg()

cpaccess is the only client of set_get_l2_indirect_reg(), a special-
purpose API for writing an indirect Krait CP15 register and reading
back the new value. For simplicity, this API is being removed and
replaced with bacl-to-back calls to set_l2_indirect_reg() and
get_l2_indirect_reg(), which should perform comparably.

Change-Id: I868ae115265c59e58ffd37dc405a91c6962e0c3d
Signed-off-by: Matt Wagantall <mattw@codeaurora.org>
ARM: Don't dump vmalloc addresses with show_data()

Memory-mapped IO address spaces cannot be safely dumped at will.
Some addresses may not be available (clocked, powered) at all times,
and may result in hangs or bus decode errors if accessed. Other
registers that are accessible may have read side-effects, and dumping
them may have adverse affects on stability or the functionality of
the affected peripheral.

Be safe, and skip dumping such addresses altogether.

CRs-Fixed: 625442
Change-Id: I4cfa75f027ededf841a0240715af0db385857cbe
Signed-off-by: Matt Wagantall <mattw@codeaurora.org>
(cherry picked from commit 23bbd49b56e4854067337c16ad2c2c95abbf7100)
ARM: Improve vmalloc address checking in show_data()

There is an unhandled corner case with the current check
which has recently been hit. The nbytes argument may be
large enough for the range being dumped to cross a
boundary between page-table mappings, and dump addresses
which are vmalloc'd in the neighboring mapping.

Check every address being dumped to see if its vmalloc'd,
not just the address passed to show_data().

CRs-Fixed: 625442
Change-Id: I255b093808177321f5202dcacea337ee333bfc63
Signed-off-by: Matt Wagantall <mattw@codeaurora.org>
(cherry picked from commit 2811c0946b2164cc3ede5350ce04dae32ce863e2)
msm: msm-krait-l2-accessors: Add RTB logging

Accesses to indirect CP15 registers are important system events that
are worth recording in the RTB logs. The logs may aid in debugging
issues seen following operations that use these APIs, like CPU clock
source selection changes.

Change-Id: Ibc98ba2d58ab809a9e22bab4b6fcadd1e00e5f70
Signed-off-by: Matt Wagantall <mattw@codeaurora.org>
msm: kgsl: Take the pagetable reference count only when needed

There could be a race condition where one thread is iterating
over ptlist inside kgsl_get_pagetable() with spinlock acquired
and going to call kref_put(). At the same time another thread is
inside kgsl_put_pagetable() without any spinlock calls kref_put()
and returns without calling kgsl_destroy_pagetable(). The decrement
of refcount by second thread leads to a situation where first thread
enters kgsl_destroy_pagetable_locked() and hence destroying the pt
node from list. This causes the destroyed pt node's next and prev
pointers set to POISON value resulting in kernel panic while executing
next iteration of ptlist.

Taking pt refcount while iterating over ptlist should be avoided if the
spinlock is already held and the pt is not returned to the caller. In
kgsl_get_pagetable(), since the loop is already holding the mutex, it
is safe to look at pt before taking a reference.

CRs-Fixed: 661374
Change-Id: Ide1f57cc1eb3cbf66fa399b6b72491755b999c7a
Signed-off-by: Prabhat Awasthi <pawasthi@codeaurora.org>
msm: kgsl: Remove the "global" locking from the ioctl path

Remove the lock code from the generic ioctl handler and move the
mutex lock/unlock code to the places that really need it.  In
particular try not to hold a lock while doing user memory functions
(copy_to_user/copy_from_user) to avoid the potential of a deadlock
with the memory semaphore.

CRs-Fixed: 671080
Change-Id: Ic0dedbad6f7325b53d71a5dbbed50f92483871c8
Signed-off-by: Jordan Crouse <jcrouse@codeaurora.org>
Signed-off-by: Hareesh Gundu <hareeshg@codeaurora.org>
msm: kgsl: Fix power api's used in fault interrupt sysfs control

Sysfs control of fault interrupt is using incorrect GPU power
control api's. *_clk api should not be used by rest of the
GPU driver, use the correct api for consistency.

Change-Id: I32f161c1fbf60ffe9458a5f64a8f8efb0dc79311
Signed-off-by: Tarun Karra <tkarra@codeaurora.org>
msm: kgsl: Remove unused legacy IB timeout variables

Remove unused variables from legacy IB timeout detection.

Change-Id: I4df94ee43072ccebff4045c5950edbc406de38a8
Signed-off-by: Hareesh Gundu <hareeshg@codeaurora.org>
msm: kgsl: Dump snapshot for long IB timeout

Dump snapshot when long IB timeout is detected. The GPU
command processor is halted on long IB timeout detection,
this will halt the GPU pipeline, dumping the snapshot at
this point is safe and gives us information to debug
long IB timeout.

Change-Id: I51bb73b66e11c3b6945c3dfe92af03e21e3c0e62
Signed-off-by: Tarun Karra <tkarra@codeaurora.org>
msm: kgsl: don't use sscanf()

Friends do not let friends use sscanf().

CRs-Fixed: 563605
Change-Id: Ic0dedbad56af5bbee4fc833701d8bc93b118efa9
Signed-off-by: Jordan Crouse <jcrouse@codeaurora.org>
msm: kgsl: Enhance GFT to avoid hang->recover->hang cycle

If GFT recovered more than X times in Y ms invalidate the context
and do not attempt recovery. this is to prevent the case where GFT keeps
recovering continuously.

Change-Id: I9326a4cf0c8d1b6b92497ae5cd086e4b8bb7e89f
Signed-off-by: Tarun Karra <tkarra@codeaurora.org>
msm: kgsl: Skip the entire command during fault recovery

During fault recovery the algorithm may choose to skip the faulting
command. To skip just one indirect buffer we have to rely on
CP_IB1_BASE but depending on where the fault happened the base could
already be pointing to the next buffer. This causes the code to skip
over the wrong buffer. There is no advantage to skipping just one
buffer vs the entire submission.

Change-Id: I28dc999b2156d05f7b5084df6bdd95c5b9308579
Signed-off-by: Tarun Karra <tkarra@codeaurora.org>
msm: kgsl: Policy change to skip entire command during fault recovery

During fault recovery change default policy to skip entire command instead
of skipping faulting indirect buffer.

Change-Id: I3c2d159dbb3f2523a05f4bcbf65195673e26c020
Signed-off-by: Tarun Karra <tkarra@codeaurora.org>