Merge branch 'android-omap-3.0' into p-android-omap-3.0

* android-omap-3.0:
  rpmsg: serialize transmissions and add proper barriers
  gpu: pvr: Update to DDK 1.8@279068
  gpu: pvr: Update to DDK 1.8@278427
  gpu: pvr: Update to DDK 1.8@277528
  netfilter: xt_qtaguid: fix dev_stats for missing NETDEV_UNREGISTER
  fuse: Freeze client on suspend when request sent to userspace

Conflicts:
	drivers/gpu/pvr/pvrversion.h

Change-Id: I7f9c4cae75fc6b70c1a330b471802149ecde2370

7 files changed, 147 insertions, 27 deletions

diff --git a/drivers/gpu/pvr/pvrversion.h b/drivers/gpu/pvr/pvrversion.h
index 712fd4b..f501462 100644
--- a/drivers/gpu/pvr/pvrversion.h
+++ b/drivers/gpu/pvr/pvrversion.h
@@ -36,7 +36,7 @@
 
 #define PVRVERSION_FAMILY           "sgxddk"
 #define PVRVERSION_BRANCHNAME       "1.8"
-#define PVRVERSION_BUILD             277528
+#define PVRVERSION_BUILD             279068
 #define PVRVERSION_BSCONTROL        "CustomerGoogle_Android_ogles1_ogles2_GPL"
 
 #define PVRVERSION_STRING           "CustomerGoogle_Android_ogles1_ogles2_GPL sgxddk 18 1.8@" PVR_STR2(PVRVERSION_BUILD)
@@ -45,7 +45,7 @@
 #define COPYRIGHT_TXT               "Copyright (c) Imagination Technologies Ltd. All Rights Reserved."
 
 #define PVRVERSION_BUILD_HI          27
-#define PVRVERSION_BUILD_LO          7528
+#define PVRVERSION_BUILD_LO          9068
 #define PVRVERSION_STRING_NUMERIC    PVR_STR2(PVRVERSION_MAJ) "." PVR_STR2(PVRVERSION_MIN) "." PVR_STR2(PVRVERSION_BUILD_HI) "." PVR_STR2(PVRVERSION_BUILD_LO)
 
 #endif /* _PVRVERSION_H_ */
diff --git a/drivers/gpu/pvr/sgx/bridged_sgx_bridge.c b/drivers/gpu/pvr/sgx/bridged_sgx_bridge.c
index 2359532..f616d83 100644
--- a/drivers/gpu/pvr/sgx/bridged_sgx_bridge.c
+++ b/drivers/gpu/pvr/sgx/bridged_sgx_bridge.c
@@ -1375,6 +1375,17 @@ SGXDevInitPart2BW(IMG_UINT32 ui32BridgeID,
 		bLookupFailed = IMG_TRUE;
 	}
 #endif
+#if defined(SGX_FEATURE_VDM_CONTEXT_SWITCH) && \
+	defined(FIX_HW_BRN_33657) && defined(SUPPORT_SECURE_33657_FIX)
+	eError = PVRSRVLookupHandle(psPerProc->psHandleBase,
+						   &hDummy,
+						   psSGXDevInitPart2IN->sInitInfo.hKernelVDMStateUpdateBufferMemInfo,
+						   PVRSRV_HANDLE_TYPE_MEM_INFO);
+	if (eError != PVRSRV_OK)
+	{
+		bLookupFailed = IMG_TRUE;
+	}
+#endif
 
 #if defined(PVRSRV_USSE_EDM_STATUS_DEBUG)
 	eError = PVRSRVLookupHandle(psPerProc->psHandleBase,
@@ -1721,6 +1732,17 @@ SGXDevInitPart2BW(IMG_UINT32 ui32BridgeID,
 		bReleaseFailed = IMG_TRUE;
 	}
 #endif
+#if defined(SGX_FEATURE_VDM_CONTEXT_SWITCH) && \
+	defined(FIX_HW_BRN_33657) && defined(SUPPORT_SECURE_33657_FIX)
+	eError = PVRSRVLookupAndReleaseHandle(psPerProc->psHandleBase,
+						   &psSGXDevInitPart2IN->sInitInfo.hKernelVDMStateUpdateBufferMemInfo,
+						   psSGXDevInitPart2IN->sInitInfo.hKernelVDMStateUpdateBufferMemInfo,
+						   PVRSRV_HANDLE_TYPE_MEM_INFO);
+	if (eError != PVRSRV_OK)
+	{
+		bReleaseFailed = IMG_TRUE;
+	}
+#endif
 
 #if defined(PVRSRV_USSE_EDM_STATUS_DEBUG)
 	eError = PVRSRVLookupAndReleaseHandle(psPerProc->psHandleBase,
@@ -2011,6 +2033,11 @@ SGXDevInitPart2BW(IMG_UINT32 ui32BridgeID,
 	eError = PVRSRVDissociateDeviceMemKM(hDevCookieInt, psSGXDevInitPart2IN->sInitInfo.hKernelVDMCtrlStreamBufferMemInfo);
 	bDissociateFailed |= (IMG_BOOL)(eError != PVRSRV_OK);
 #endif
+#if defined(SGX_FEATURE_VDM_CONTEXT_SWITCH) && \
+	defined(FIX_HW_BRN_33657) && defined(SUPPORT_SECURE_33657_FIX)
+	eError = PVRSRVDissociateDeviceMemKM(hDevCookieInt, psSGXDevInitPart2IN->sInitInfo.hKernelVDMStateUpdateBufferMemInfo);
+	bDissociateFailed |= (IMG_BOOL)(eError != PVRSRV_OK);
+#endif
 
 #if defined(PVRSRV_USSE_EDM_STATUS_DEBUG)
 #if defined (SUPPORT_SID_INTERFACE)
diff --git a/drivers/gpu/pvr/sgx/sgxinfokm.h b/drivers/gpu/pvr/sgx/sgxinfokm.h
index 6b442fc..a25f826 100644
--- a/drivers/gpu/pvr/sgx/sgxinfokm.h
+++ b/drivers/gpu/pvr/sgx/sgxinfokm.h
@@ -131,6 +131,10 @@ typedef struct _PVRSRV_SGXDEV_INFO_
 	PPVRSRV_KERNEL_MEM_INFO	psKernelVDMSnapShotBufferMemInfo; 
 	PPVRSRV_KERNEL_MEM_INFO	psKernelVDMCtrlStreamBufferMemInfo; 
 #endif
+#if defined(SGX_FEATURE_VDM_CONTEXT_SWITCH) && \
+	defined(FIX_HW_BRN_33657) && defined(SUPPORT_SECURE_33657_FIX)
+	PPVRSRV_KERNEL_MEM_INFO	psKernelVDMStateUpdateBufferMemInfo; 
+#endif
 #if defined(PVRSRV_USSE_EDM_STATUS_DEBUG)
 	PPVRSRV_KERNEL_MEM_INFO	psKernelEDMStatusBufferMemInfo; 
 #endif
diff --git a/drivers/gpu/pvr/sgx/sgxinit.c b/drivers/gpu/pvr/sgx/sgxinit.c
index 8b3bbc4..b2924aa 100644
--- a/drivers/gpu/pvr/sgx/sgxinit.c
+++ b/drivers/gpu/pvr/sgx/sgxinit.c
@@ -165,6 +165,10 @@ static PVRSRV_ERROR InitDevInfo(PVRSRV_PER_PROCESS_DATA *psPerProc,
 	psDevInfo->psKernelVDMSnapShotBufferMemInfo = (PVRSRV_KERNEL_MEM_INFO *)psInitInfo->hKernelVDMSnapShotBufferMemInfo;
 	psDevInfo->psKernelVDMCtrlStreamBufferMemInfo = (PVRSRV_KERNEL_MEM_INFO *)psInitInfo->hKernelVDMCtrlStreamBufferMemInfo;
 #endif
+#if defined(SGX_FEATURE_VDM_CONTEXT_SWITCH) && \
+	defined(FIX_HW_BRN_33657) && defined(SUPPORT_SECURE_33657_FIX)
+	psDevInfo->psKernelVDMStateUpdateBufferMemInfo = (PVRSRV_KERNEL_MEM_INFO *)psInitInfo->hKernelVDMStateUpdateBufferMemInfo;
+#endif
 #if defined(PVRSRV_USSE_EDM_STATUS_DEBUG)
 	psDevInfo->psKernelEDMStatusBufferMemInfo = (PVRSRV_KERNEL_MEM_INFO *)psInitInfo->hKernelEDMStatusBufferMemInfo;
 #endif
diff --git a/drivers/gpu/pvr/sgxerrata.h b/drivers/gpu/pvr/sgxerrata.h
index f83a39d..51d009d 100644
--- a/drivers/gpu/pvr/sgxerrata.h
+++ b/drivers/gpu/pvr/sgxerrata.h
@@ -141,7 +141,7 @@
 
 	#if SGX_CORE_REV == 112
 		#define FIX_HW_BRN_23281
-		#define FIX_HW_BRN_23410
+		#define FIX_HW_BRN_23410 
 		#define FIX_HW_BRN_22693
 		#define FIX_HW_BRN_22934	
 		#define FIX_HW_BRN_22997
@@ -273,6 +273,9 @@
  		#define FIX_HW_BRN_31780
 		#define FIX_HW_BRN_31542
 		#define FIX_HW_BRN_32044 
+		#if defined(SUPPORT_SGX_LOW_LATENCY_SCHEDULING) && defined(SGX_FEATURE_MP)
+			#define FIX_HW_BRN_33657
+		#endif
 		#define FIX_HW_BRN_33920
 	#else
 	#if SGX_CORE_REV == 122
@@ -291,8 +294,11 @@
 		#define FIX_HW_BRN_31542
 		#define FIX_HW_BRN_32044 
 		#define FIX_HW_BRN_32085 
-			
+		#if defined(SUPPORT_SGX_LOW_LATENCY_SCHEDULING) && defined(SGX_FEATURE_MP)
+			#define FIX_HW_BRN_33657
+		#endif
 		#define FIX_HW_BRN_33920
+			
 	#else
 	#if SGX_CORE_REV == 1221
 		#define FIX_HW_BRN_29954
@@ -307,8 +313,11 @@
  		#define FIX_HW_BRN_31780
 		#define FIX_HW_BRN_32044
 		#define FIX_HW_BRN_32085 
-			
+		#if defined(SUPPORT_SGX_LOW_LATENCY_SCHEDULING) && defined(SGX_FEATURE_MP)
+			#define FIX_HW_BRN_33657
+		#endif
 		#define FIX_HW_BRN_33920
+			
 	#else
 	#if SGX_CORE_REV == 140
 		#define FIX_HW_BRN_29954
@@ -325,8 +334,11 @@
 		#define FIX_HW_BRN_31542
 		#define FIX_HW_BRN_32044 
 		#define FIX_HW_BRN_32085 
-			
 		#define FIX_HW_BRN_33920
+		#if defined(SUPPORT_SGX_LOW_LATENCY_SCHEDULING) && defined(SGX_FEATURE_MP)
+			#define FIX_HW_BRN_33657
+		#endif
+			
 	#else
 	#if SGX_CORE_REV == 1401
 		#define FIX_HW_BRN_29954
@@ -342,8 +354,11 @@
  		#define FIX_HW_BRN_31780
 		#define FIX_HW_BRN_32044 
 		#define FIX_HW_BRN_32085 
-			
 		#define FIX_HW_BRN_33920
+		#if defined(SUPPORT_SGX_LOW_LATENCY_SCHEDULING) && defined(SGX_FEATURE_MP)
+			#define FIX_HW_BRN_33657
+		#endif
+			
 	#else
 	#if SGX_CORE_REV == 141
 		#define FIX_HW_BRN_29954
@@ -351,8 +366,11 @@
 			#define FIX_HW_BRN_31425
 		#endif
 		#define FIX_HW_BRN_31671 
-			
  		#define FIX_HW_BRN_31780
+		#if defined(SUPPORT_SGX_LOW_LATENCY_SCHEDULING) && defined(SGX_FEATURE_MP)
+			#define FIX_HW_BRN_33657
+		#endif
+			
 	#else
 	#if SGX_CORE_REV == 142
 		#define FIX_HW_BRN_29954
@@ -360,8 +378,11 @@
 			#define FIX_HW_BRN_31425
 		#endif
 		#define FIX_HW_BRN_31671 
-			
  		#define FIX_HW_BRN_31780
+		#if defined(SUPPORT_SGX_LOW_LATENCY_SCHEDULING) && defined(SGX_FEATURE_MP)
+			#define FIX_HW_BRN_33657
+		#endif
+			
 	#else
 	#if SGX_CORE_REV == 211
 		#define FIX_HW_BRN_31093
@@ -376,8 +397,11 @@
 		#define FIX_HW_BRN_31542
 		#define FIX_HW_BRN_32044 
 		#define FIX_HW_BRN_32085 
-			
+		#if defined(SUPPORT_SGX_LOW_LATENCY_SCHEDULING) && defined(SGX_FEATURE_MP)
+			#define FIX_HW_BRN_33657
+		#endif
 		#define FIX_HW_BRN_33920
+			
 	#else
 	#if SGX_CORE_REV == 2111
 		#define FIX_HW_BRN_30982 
@@ -393,8 +417,11 @@
 		#define FIX_HW_BRN_31542
 		#define FIX_HW_BRN_32044 
 		#define FIX_HW_BRN_32085 
-			
+		#if defined(SUPPORT_SGX_LOW_LATENCY_SCHEDULING) && defined(SGX_FEATURE_MP)
+			#define FIX_HW_BRN_33657
+		#endif
 		#define FIX_HW_BRN_33920
+			
 	#else
 	#if SGX_CORE_REV == 213
 		#define FIX_HW_BRN_31272
@@ -404,15 +431,23 @@
 		#define FIX_HW_BRN_31671 
  		#define FIX_HW_BRN_31780
 		#define FIX_HW_BRN_32085 
-			
+		#if defined(SUPPORT_SGX_LOW_LATENCY_SCHEDULING) && defined(SGX_FEATURE_MP)
+			#define FIX_HW_BRN_33657
+		#endif
 		#define FIX_HW_BRN_33920
+			
 	#else
 	#if SGX_CORE_REV == 216
+		#if defined(SUPPORT_SGX_LOW_LATENCY_SCHEDULING) && defined(SGX_FEATURE_MP)
+			#define FIX_HW_BRN_33657
+		#endif
 	#else
 	#if SGX_CORE_REV == 302
 	#else
 	#if SGX_CORE_REV == SGX_CORE_REV_HEAD
-		
+		#if defined(SUPPORT_SGX_LOW_LATENCY_SCHEDULING) && defined(SGX_FEATURE_MP)
+			#define FIX_HW_BRN_33657
+		#endif
 	#else
 		#error "sgxerrata.h: SGX543 Core Revision unspecified"
 	#endif
@@ -453,6 +488,9 @@
  		#endif
  		#define FIX_HW_BRN_31780
 		#define FIX_HW_BRN_32085 
+		#if defined(SUPPORT_SGX_LOW_LATENCY_SCHEDULING) && defined(SGX_FEATURE_MP)
+			#define FIX_HW_BRN_33657
+		#endif
 		#define FIX_HW_BRN_33920
 	#else
 	#if SGX_CORE_REV == 103
@@ -463,6 +501,9 @@
  		#endif
  		#define FIX_HW_BRN_31780
 		#define FIX_HW_BRN_32085 
+		#if defined(SUPPORT_SGX_LOW_LATENCY_SCHEDULING) && defined(SGX_FEATURE_MP)
+			#define FIX_HW_BRN_33657
+		#endif
 		#define FIX_HW_BRN_33920
 	#else
 	#if SGX_CORE_REV == 104
@@ -480,6 +521,9 @@
  		#define FIX_HW_BRN_31780
 		#define FIX_HW_BRN_32044 
 		#define FIX_HW_BRN_32085 
+		#if defined(SUPPORT_SGX_LOW_LATENCY_SCHEDULING) && defined(SGX_FEATURE_MP)
+			#define FIX_HW_BRN_33657
+		#endif
 		#define FIX_HW_BRN_33920
 	#else	
 	#if SGX_CORE_REV == 105
@@ -487,11 +531,17 @@
  			#define FIX_HW_BRN_31425
  		#endif
  		#define FIX_HW_BRN_31780
+		#if defined(SUPPORT_SGX_LOW_LATENCY_SCHEDULING) && defined(SGX_FEATURE_MP)
+			#define FIX_HW_BRN_33657
+		#endif
 		#define FIX_HW_BRN_33920
 	#else
 	#if SGX_CORE_REV == 106
 		#define FIX_HW_BRN_31272
  		#define FIX_HW_BRN_31780
+		#if defined(SUPPORT_SGX_LOW_LATENCY_SCHEDULING) && defined(SGX_FEATURE_MP)
+			#define FIX_HW_BRN_33657
+		#endif
 		#define FIX_HW_BRN_33920
 	#else
 	#if SGX_CORE_REV == 110
@@ -500,11 +550,17 @@
  			#define FIX_HW_BRN_31425
  		#endif
  		#define FIX_HW_BRN_31780
+		#if defined(SUPPORT_SGX_LOW_LATENCY_SCHEDULING) && defined(SGX_FEATURE_MP)
+			#define FIX_HW_BRN_33657
+		#endif
 		#define FIX_HW_BRN_33920
 	#else
 	#if SGX_CORE_REV == 112
 		#define FIX_HW_BRN_31272
  		#define FIX_HW_BRN_31780
+		#if defined(SUPPORT_SGX_LOW_LATENCY_SCHEDULING) && defined(SGX_FEATURE_MP)
+			#define FIX_HW_BRN_33657
+		#endif
 		#define FIX_HW_BRN_33920
 	#else
 	#if SGX_CORE_REV == 114
@@ -512,15 +568,23 @@
  			#define FIX_HW_BRN_31425
  		#endif
  		#define FIX_HW_BRN_31780
+		#if defined(SUPPORT_SGX_LOW_LATENCY_SCHEDULING) && defined(SGX_FEATURE_MP)
+			#define FIX_HW_BRN_33657
+		#endif
 	#else
 	#if SGX_CORE_REV == 115
  		#if defined(SGX_FEATURE_MP)
  			#define FIX_HW_BRN_31425
  		#endif
  		#define FIX_HW_BRN_31780
+		#if defined(SUPPORT_SGX_LOW_LATENCY_SCHEDULING) && defined(SGX_FEATURE_MP)
+			#define FIX_HW_BRN_33657
+		#endif
 	#else
 	#if SGX_CORE_REV == SGX_CORE_REV_HEAD
-		
+		#if defined(SUPPORT_SGX_LOW_LATENCY_SCHEDULING) && defined(SGX_FEATURE_MP)
+			#define FIX_HW_BRN_33657
+		#endif
 	#else
 		#error "sgxerrata.h: SGX544 Core Revision unspecified"
 	#endif
@@ -592,10 +656,15 @@
 	#endif
 
 	#if SGX_CORE_REV == 1251
+		#if defined(SUPPORT_SGX_LOW_LATENCY_SCHEDULING) && defined(SGX_FEATURE_MP)
+			#define FIX_HW_BRN_33657
+		#endif
 		
 	#else	
 	#if SGX_CORE_REV == SGX_CORE_REV_HEAD
-		
+		#if defined(SUPPORT_SGX_LOW_LATENCY_SCHEDULING) && defined(SGX_FEATURE_MP)
+			#define FIX_HW_BRN_33657
+		#endif
 	#else
 		#error "sgxerrata.h: SGX554 Core Revision unspecified"
 	#endif
diff --git a/drivers/gpu/pvr/sgxinfo.h b/drivers/gpu/pvr/sgxinfo.h
index 39330e4..c32dc31 100644
--- a/drivers/gpu/pvr/sgxinfo.h
+++ b/drivers/gpu/pvr/sgxinfo.h
@@ -161,6 +161,10 @@ typedef struct _SGX_BRIDGE_INIT_INFO_
 	IMG_HANDLE	hKernelVDMSnapShotBufferMemInfo;
 	IMG_HANDLE	hKernelVDMCtrlStreamBufferMemInfo;
 #endif
+#if defined(SGX_FEATURE_VDM_CONTEXT_SWITCH) && \
+	defined(FIX_HW_BRN_33657) && defined(SUPPORT_SECURE_33657_FIX)
+	IMG_HANDLE	hKernelVDMStateUpdateBufferMemInfo;
+#endif
 #if defined(PVRSRV_USSE_EDM_STATUS_DEBUG)
 #if defined (SUPPORT_SID_INTERFACE)
 	IMG_SID		hKernelEDMStatusBufferMemInfo;
diff --git a/drivers/rpmsg/virtio_rpmsg_bus.c b/drivers/rpmsg/virtio_rpmsg_bus.c
index 33d3a49..bd6408a 100644
--- a/drivers/rpmsg/virtio_rpmsg_bus.c
+++ b/drivers/rpmsg/virtio_rpmsg_bus.c
@@ -420,9 +420,8 @@ static void *get_a_buf(struct virtproc_info *vrp)
 	unsigned int len;
 	void *buf = NULL;
 
-	/* protect svq from simultaneous concurrent manipulations */
-	mutex_lock(&vrp->svq_lock);
-
+	/* make sure the descriptors are updated before reading */
+	rmb();
 	/* either pick the next unused buffer */
 	if (vrp->last_sbuf < vrp->num_bufs / 2)
 		buf = vrp->sbufs + vrp->buf_size * vrp->last_sbuf++;
@@ -430,7 +429,6 @@ static void *get_a_buf(struct virtproc_info *vrp)
 	else
 		buf = virtqueue_get_buf(vrp->svq, &len);
 
-	mutex_unlock(&vrp->svq_lock);
 	return buf;
 }
 
@@ -457,10 +455,18 @@ int rpmsg_send_offchannel_raw(struct rpmsg_channel *rpdev, u32 src, u32 dst,
 		return -EMSGSIZE;
 	}
 
+	/*
+	 * protect svq from simultaneous concurrent manipulations,
+	 * and serialize the sending of messages
+	 */
+	if (mutex_lock_interruptible(&vrp->svq_lock))
+		return -ERESTARTSYS;
 	/* grab a buffer */
 	msg = get_a_buf(vrp);
-	if (!msg && !wait)
-		return -ENOMEM;
+	if (!msg && !wait) {
+		err = -ENOMEM;
+		goto out;
+	}
 
 	/* no free buffer ? wait for one (but bail after 15 seconds) */
 	if (!msg) {
@@ -480,12 +486,15 @@ int rpmsg_send_offchannel_raw(struct rpmsg_channel *rpdev, u32 src, u32 dst,
 		/* on success, suppress "tx-complete" interrupts again */
 		virtqueue_disable_cb(vrp->svq);
 
-		if (err < 0)
-			return -ERESTARTSYS;
+		if (err < 0) {
+			err = -ERESTARTSYS;
+			goto out;
+		}
 
 		if (!msg) {
 			dev_err(dev, "timeout waiting for buffer\n");
-			return -ETIMEDOUT;
+			err = -ETIMEDOUT;
+			goto out;
 		}
 	}
 
@@ -506,15 +515,14 @@ int rpmsg_send_offchannel_raw(struct rpmsg_channel *rpdev, u32 src, u32 dst,
 	sim_addr = vrp->sim_base + offset;
 	sg_init_one(&sg, sim_addr, sizeof(*msg) + len);
 
-	/* protect svq from simultaneous concurrent manipulations */
-	mutex_lock(&vrp->svq_lock);
-
 	/* add message to the remote processor's virtqueue */
 	err = virtqueue_add_buf_gfp(vrp->svq, &sg, 1, 0, msg, GFP_KERNEL);
 	if (err < 0) {
 		dev_err(dev, "virtqueue_add_buf_gfp failed: %d\n", err);
 		goto out;
 	}
+	/* descriptors must be written before kicking remote processor */
+	wmb();
 
 	/* tell the remote processor it has a pending message to read */
 	virtqueue_kick(vrp->svq);
@@ -538,6 +546,8 @@ static void rpmsg_recv_done(struct virtqueue *rvq)
 	struct device *dev = &rvq->vdev->dev;
 	int err;
 
+	/* make sure the descriptors are updated before reading */
+	rmb();
 	msg = virtqueue_get_buf(rvq, &len);
 	if (!msg) {
 		dev_err(dev, "uhm, incoming signal, but no used buffer ?\n");
@@ -570,6 +580,8 @@ static void rpmsg_recv_done(struct virtqueue *rvq)
 		dev_err(dev, "failed to add a virtqueue buffer: %d\n", err);
 		return;
 	}
+	/* descriptors must be written before kicking remote processor */
+	wmb();
 
 	/* tell the remote processor we added another available rx buffer */
 	virtqueue_kick(vrp->rvq);