ion: invalidate buffers before zero'ing

Currently, we invalidate the cache for buffers being zero'd *after* we
zero them. However, this is racey since a dirty cache line from an
earlier mapping could be written out to memory between the zero'ing and
the invalidation. Fix this by invalidating the cache *before* zero'ing
the buffer.

Before this change, I was seeing corruption with:

    $ cat <<EOF | ./memory_prof -e -i -
    simple_alloc,1,ION_SYSTEM_HEAP_ID,ION_FLAG_CACHED,0x100000,1MB
    simple_basic_sanity,1
    simple_profile,1
    simple_free,1
    EOF

After this change, no corruption.

CRs-Fixed: 585524
Change-Id: I1f2603604efc9be4ebf9112b06728e0aeca60ea0
Signed-off-by: Mitchel Humpherys <mitchelh@codeaurora.org>
qseecom: Validate pointer offset in qseecom_send_modfd_cmd

Validate cmd_req_buf pointer offset in qseecom_send_modfy_cmd, and
make sure cmd buffer address to be within shared bufffer.

Change-Id: I431511a92ab2cccbc2daebc0cf76cc3872689a97
Signed-off-by: Zhen Kong <zkong@codeaurora.org>
msm: kgsl: Mark the IOMMU setstate memory as read only

Mark the IOMMU setstate memory as read only in the pagetable.

Change-Id: Ic0dedbadb19e499c749cd744c3e89be3bcb4c2a2
Signed-off-by: Jordan Crouse <jcrouse@codeaurora.org>
msm: kgsl: Enable protected register mode for A3XX

Turn on protected register mode for the A3XX GPU family and add 0x63
(RBBM_INT_0_MASK) to the list of protected registers.

Conflicts:

        drivers/gpu/msm/adreno.h
        drivers/gpu/msm/adreno_a3xx.c

Change-Id: Ic0dedbad10ebfa6eb6d3d815b5aa9b6b6f0e8e35
Signed-off-by: Jordan Crouse <jcrouse@codeaurora.org>
Signed-off-by: Digish Pandya <digishp@codeaurora.org>
msm: kgsl: Protect CP_STATE_DEBUG_INDEX

Put CP_STATE_DEBUG_INDEX and CP_STATE_DEBUG_DATA under protection
to keep it from being written from an IB1. Doing so however opens
up a subtle "feature" in the microcode: memory read opcodes turn off
protected mode in the microcode to do the read and then turns it
back on regardless of the initial state. This is a problem if the
memory read happens while protected mode is turned off and then we
try to access a protected register which then complains and goes boom.

To account for this irregularity explicitly turn back off protected
mode in all the places where we know this will be a problem.

Change-Id: Ic0dedbad1397ca9b80132241ac006560a615e042
Signed-off-by: Jordan Crouse <jcrouse@codeaurora.org>
Signed-off-by: Digish Pandya <digishp@codeaurora.org>
msm: kgsl: Fix protected mode for A3XX

Prior merges of the A3XX protected mode code were incorrect. Fix
up the changes to get the branch fully updated with the changes
from msm-3.10.

Change-Id: Ic0dedbad5a0e1aea181141de1527d74b42002e3c
Signed-off-by: Jordan Crouse <jcrouse@codeaurora.org>
msm: kgsl: Protect SMMU registers from being written by the GPU

Put the SMMU register range in protected mode to shield them from
IB1/IB2 writes from userspace.

CRs-Fixed: 599971
Change-Id: Ic0dedbad8c03fc1c54ff73221231e2440d3c34dd
Signed-off-by: Jordan Crouse <jcrouse@codeaurora.org>
lowmemorykiller: Account for highmem during kswapd reclaim

Currenlty most memory reclaim is done through kswapd.
Since kswapd uses a gfp mask of GFP_KERNEL, and because
the lowmemorykiller is zone aware, the lowmemorykiller will
ignore highmem most of the time.
This results in the lowmemorykiller being overly aggressive.

The fix to this issue is to allow the lowmemorykiller to
count highmem when being called by the kswapd if the lowmem
watermarks are satisfied.

Change-Id: I938644584f374763d10d429d835e74daa4854a38
Signed-off-by: Liam Mark <lmark@codeaurora.org>
n_tty: Fix n_tty_write crash when echoing in raw mode

The tty atomic_write_lock does not provide an exclusion guarantee for
the tty driver if the termios settings are LECHO & !OPOST. And since
it is unexpected and not allowed to call TTY buffer helpers like
tty_insert_flip_string concurrently, this may lead to crashes when
concurrect writers call pty_write. In that case the following two
writers:
* the ECHOing from a workqueue and
* pty_write from the process
race and can overflow the corresponding TTY buffer like follows.

If we look into tty_insert_flip_string_fixed_flag, there is:
  int space = __tty_buffer_request_room(port, goal, flags);
  struct tty_buffer *tb = port->buf.tail;
  ...
  memcpy(char_buf_ptr(tb, tb->used), chars, space);
  ...
  tb->used += space;

so the race of the two can result in something like this:
          A                             B
   __tty_buffer_request_room
                                  __tty_buffer_request_room
   memcpy(buf(tb->used), ...)
   tb->used += space;
                                 memcpy(buf(tb->used), ...) ->BOOM

B's memcpy is past the tty_buffer due to the previous A's tb->used
increment.

Since the N_TTY line discipline input processing can output
concurrently with a tty write, obtain the N_TTY ldisc output_lock to
serialize echo output with normal tty writes. This ensures the tty
buffer helper tty_insert_flip_string is not called concurrently and
everything is fine.

Note that this is nicely reproducible by an ordinary user using
forkpty and some setup around that (raw termios + ECHO). And it is
present in kernels at least after commit
d945cb9cce20ac7143c2de8d88b187f62db99bdc (pty: Rework the pty layer to
use the normal buffering logic) in 2.6.31-rc3.

js: add more info to the commit log
js: switch to bool
js: lock unconditionally
js: lock only the tty->ops->write call

Signed-off-by: Peter Hurley <peter@hurleysoftware.com>
Signed-off-by: Jiri Slaby <jslaby@suse.cz>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Change-Id: I9e235db6ec2bb950f26bd8a23f6145dab5dc0a15
Git-commit: 4291086b1f081b869c6d79e5b7441633dc3ace00
Git-repo: git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
Signed-off-by: Avijit Kanti Das <avijitnsec@codeaurora.org>
[rsiddoji@codeaurora.org: resolve trivial merge conflicts]
Signed-off-by: Ravi Kumar S <rsiddoji@codeaurora.org>
msm: mdss: move mdss fudge factors to device-tree

Mdss has a common driver for multiple chip-sets. Each of these chip-sets
can have their own fudge factors for calculations of resource demand.
Move these pre-defined fudge factors to device-tree since they are
platform dependent.

Conflicts:

	Documentation/devicetree/bindings/fb/mdss-mdp.txt
	arch/arm/boot/dts/msmsamarium-mdss.dtsi
	drivers/video/msm/mdss/mdss.h

Change-Id: Ia558a2ad0a096b49cdabf41dd25cf30c843149c4
Signed-off-by: Ujwal Patel <ujwalp@codeaurora.org>
Signed-off-by: Huaibin Yang <huaibiny@codeaurora.org>
Signed-off-by: Jayant Shekhar <jshekhar@codeaurora.org>
mdp: mdss: Tune bandwidth and clock based on ROI

Calculate bandwidth and MDP clock requirement considering
the ROI submitted for a frame. When doing partial frame update
for smart panels, the data actually fetched for a pipe is not
always the full resolution of the buffer programmed. Use the
ROI passed to find out the region of fetching and calculate the
bandwidth and clock values accordingly.

Change-Id: I01f24f8fd9a42a2c4d705b8eb0a7658e79884175
Signed-off-by: Jeykumar Sankaran <jsanka@codeaurora.org>
Signed-off-by: Jayant Shekhar <jshekhar@codeaurora.org>
msm: mdss: calculate mdp clk requirement of each pipe with the fudge factor

Currently the mdp clk margin is added for the final calculated max of
all individual pipe clk requirements to avoid underruns. When this
final rate is greater than the max rate that h/w can support, pipe
decimation mode may not be enabled to avoid underruns. So, move this
margin calculation into each pipe clk so that when any individual pipe
has higher clk rate than the max, pipe decimation can be enabled.

CRs-fixed: 538803
Change-Id: Ia4dc500cfc27e7e4d08f03066b511ed3e4ae4664
Signed-off-by: Huaibin Yang <huaibiny@codeaurora.org>
Signed-off-by: Jayant Shekhar <jshekhar@codeaurora.org>
msm: mdss: refactor performance calculations

Current logic could potentially lead to drop in performance (and
underflow) when multiple panels are there and both are updating mixer
configuration independently, as we may end up raising bus bandwidth for
another panel which may not be ready just yet. This is addressed by
updating performance configuration values until it's ready to switch
rather than updating values and performing these later (other panel
update could come in between).

Change-Id: I247ef0cd3e0616de3e5ddd9599233af570e422a5
Signed-off-by: Adrian Salido-Moreno <adrianm@codeaurora.org>
Signed-off-by: Huaibin Yang <huaibiny@codeaurora.org>
Signed-off-by: Jayant Shekhar <jshekhar@codeaurora.org>
arm: mach-msm: Remove the unused rmt_storage code

The rmt_storage module is no longer used.
Remove the unused module and cleanup the makefile and kconfig.

CRs-Fixed: 549951
Change-Id: Ie9ebaa2209ea9fa0df05dc892504fcb882f00f29
Signed-off-by: Nikhilesh Reddy <reddyn@codeaurora.org>
msm: mdss: implement overlay prepare ioctl

Overlay prepare will allow a full frame with multiple overlays to be
configured at once and perform frame level checks before being pushed to
display. This function guarantees that if the call is successful, the
frame can be displayed successfully on the screen when display commit is
called.

Change-Id: I276b6fe3e0a872a2e93170f3cea1002d3ce0dac9
Signed-off-by: Adrian Salido-Moreno <adrianm@codeaurora.org>
Signed-off-by: Anusha Koduru <kanusha@codeaurora.org>
msm: vidc: add LTR support for video encoder

Enable LTR support for VP8 codec to add robust error resilience.

Change-Id: I3b87c5cdaef836a6d02d5b9fe71b7165b7f13581
Signed-off-by: Ashray Kulkarni <ashrayk@codeaurora.org>
msm: vidc: Add generic LTR mode support

Use generic LTR HFI APIs for h264 and vp8 formats.

Change-Id: I9f307046d7ec6de4eb6d43704686be902356882a
Signed-off-by: Ashray Kulkarni <ashrayk@codeaurora.org>
msm: vidc: Add support to request frame level QP information

The resulting QP information for H264 is the slice level
QP averaged over whole frame; for all other codecs its
frame level QP.

Change-Id: I288904b05d886c1e94fc113b8bd3fba5b13b48f3
Signed-off-by: Jorge Solano Altamirano <jsolano@codeaurora.org>
msm: vidc: Add support to request frame bits info as extra-data

Provides information regarding number of bits in the frame (i.e frame
size expressed in bits) & also the number of bits in frame header (i.e
frame header size expressed in bits).
Number of bits in header is reported as:
For H264, sum of all slice headers bits for all the slices in the frame.
For all other codecs, number of bits in the frame header.

Change-Id: I6caeca025ff0ce059a20891a6d657b47c4b452b3
Signed-off-by: Jorge Solano Altamirano <jsolano@codeaurora.org>
msm: vidc: Return meaningful information for extra-data plane

Sending meaningful information in the extra-data plane structure
instead of trashy values for some uninitialized fields.

Change-Id: I6d1a5debb801836f48e4cdbd6129b5086ec18a63
Signed-off-by: Jorge Solano Altamirano <jsolano@codeaurora.org>