msm: vidc: fix corruption of registered buffer list

The buffer list for output buffers is accessed from
different threads leading to race conditions. Consider
the case of firmware throwing up a fatal error, which gets
propagated to v4l2 client. The v4l2 client closes the
driver fd, which will trigger msm_vidc_release_buffers
to release all output buffers and free node from
the registered buffer list. During this time, if
firmware sends a release reference event, the buffer
node being accessed in msm_vidc_release_buffers could
be freed, triggering kernel panic.

Change-Id: I522edff06a62dbc2ab60d6cca5990babb18d5c6c
Signed-off-by: Arun Menon <avmenon@codeaurora.org>
msm: vidc: do not send release buffer to f/w in dynamic buffer mode

In dynamic buffer mode, the output buffers are not registered
with the firmware. So the v4l2 video driver does not need
to send release buffer command for output buffers to firmware.

Change-Id: I3b8f37fafe9fa07a45a68ded1de77e90f2764f6c
Signed-off-by: Arun Menon <avmenon@codeaurora.org>
msm: mdss: synchronize wfd driver iommu mmap/munmap with mdss

Add clocks reference during wfd driver iommu mdp_mmap/mdp_munmap
to ensure iommu is in proper state while wfd driver map/un-map
any buffers.

Change-Id: Id1a24285b81d5047e5e9f002ade9694ea49be59d
Signed-off-by: Pawan Kumar <pavaku@codeaurora.org>
msm: vidc: add support to set VP8 QP range

QP range differs from codec to codec. This change adds support
for VP8 QP min and max range.

Change-Id: Ia44cf885a8b6f71b7eef51076968021ae68d7a7e
CRs-Fixed: 578892
Signed-off-by: Jorge Solano Altamirano <jsolano@codeaurora.org>
msm: vidc: eliminate race condition in dynamic buffer mode

Function get_same_fd_buffer returned a pointer to
registered buffer, which shared the same fd as the
current buffer being mapped. While this buffer was
being accessed in map_and_register_buf(), it was
not guarded by the inst lock. So if the buffer was
erroneously freed, while it's still being accessed
in map_and_register_buf(), we may see a kernel
panic due to garbage values. To avoid this race
condition, introduce more checks in get_same_fd_buffer()
and return only the required handle information back to
map_and_register_buf.

Change-Id: I798c33dc344977c5db3bd74e5f863ca5cda14cb9
Signed-off-by: Arun Menon <avmenon@codeaurora.org>
msm: vidc: Increase maximum buffer count limit

Some clients want to allocate more buffers on decoder
input port than required (mainly for performance reasons).
Video decoder should honor the client request as long as
V4L2 framework permits.

Change-Id: Idd8101e84823b10736ab75ced2ea3235d944ef55
CRs-fixed: 509088
Signed-off-by: Vinay Kalia <vkalia@codeaurora.org>

Conflicts:
	drivers/media/platform/msm/vidc/msm_vdec.c
msm: vidc: Suppress spammy log

Suppress a needlessly spammy log that shows up when secure content is
being played.  Also make some other logs print out something useful.

Change-Id: I971e8f45393730218bc7a6947bdd938aa6b0732c
Signed-off-by: Deva Ramasubramanian <dramasub@codeaurora.org>
msm: vidc: fix issues raised by static analyzer

This change fixes the warnings raised by the
static code analyzer.

Change-Id: Ibbefb9bb945128ece8923dbb23679716a0654f7b
Signed-off-by: Arun Menon <avmenon@codeaurora.org>
msm: vidc: Check if buffers are mapped before validating buffer_info

When buffers are not mapped by the driver (i.e. buffer being used by
kernel client), inst->registered_buffers is usually empty.  As a result,
in *_dqbuf(), binfo is always NULL.  This commit bypasses the NULL check
if buffers aren't being mapped by the driver.

CRs-Fixed: 610866
Change-Id: I111150564549a74f077ba8a7115129f497d734fc
Signed-off-by: Deva Ramasubramanian <dramasub@codeaurora.org>
msm: vidc: initialize venus hfi locks during hfi creation

Venus hfi locks were initialized during core init,
which is invoked when the first video instance is
created. If a debugfs command is executed before
starting the first video instance, then video driver
crashes trying to lock an uninitialized mutex.

Change-Id: I472e9de91dada94a2728dd02c747e7fde63e3e4f
Signed-off-by: Arun Menon <avmenon@codeaurora.org>
msm: vidc: Free smem client after moving core to UNINIT

If userspace crashes prematurely, there will be a good chance that the
driver hasn't unmapped or freed certain buffers.  These buffers will be
freed in the state transition to UNINIT.  At that point the smem client
needs to be valid for the free/unmaps to be valid.

CRs-Fixed: 611946
Change-Id: I089dcbd1e79f1c2a8671e5719d3a5dbc9926b252
Signed-off-by: Deva Ramasubramanian <dramasub@codeaurora.org>
msm: vidc: Re-program the vbif settings post-power collapse

As part of power collapse we turn off the venus GDSC. When we turn it
back on, we need to re-program the VBIF registers to overwrite the
reset values.

CRs-Fixed: 585609
Change-Id: Ic2ac40274773f9592f510ccb573b9d4920a8647f
Signed-off-by: Deva Ramasubramanian <dramasub@codeaurora.org>
msm: vidc: Add min resolution check for video session

Add a check for minimum supported video resolution, based
on firmware capabilities and reject unsupported video sessions.

Change-Id: Ib5a4eb6e6ab66408cf13829e20d3933138f357c1
Signed-off-by: Arun Menon <avmenon@codeaurora.org>
Revert "msm: wfd: Restart hrtimer after forwarding it"

This reverts commit Ia8e82a6ad327acddc135835268a755e3646d2ee8.
Calling hrtimer_forward_now() outside of the hrtimer callback context
and not restarting it seems to be a misuse of the hrt APIs.

Change-Id: Idd3f967d8037435ec43bbd843ce122d989aa838a
Signed-off-by: Srinu Gorle <sgorle@codeaurora.org>
msm: wfd: Add timeouts to completions

In the case of Venus going into a bad state and not returning buffers,
timeout of the completion so that the driver isn't stuck perpetually
waiting for a buffer.  This at least gives the driver a chance to clean
up and exit gracefully.

Change-Id: I05dd1e2977999bd17bd79e78eb8882fddf6a4aa4
CRs-Fixed: 589645
Signed-off-by: Deva Ramasubramanian <dramasub@codeaurora.org>
msm: wfd: Lock the state in vsg_start

Protect the state in vsg_start with a mutex as it can be accessed from
other threads.

CRs-Fixed: 634425
Change-Id: I823b34f1b310092ea100d366d92a3293a0c74e6d
Signed-off-by: Deva Ramasubramanian <dramasub@codeaurora.org>
msm: vidc: send release buffers cmd during instance clean up

During instance cleanup, if internal or output buffer
list is not empty, respective buffers are unmapped.
Modify the cleanup instance to send release buffers to
video core if internal or output buffer list is not
empty and then unmap the respective buffers.

CRs-Fixed: 619239
Change-Id: I56bd4248173992dedfb36098dfa9ddf35fc12a4e
Signed-off-by: Rajeshwar Kurapaty <rkurapat@codeaurora.org>
msm: vidc: change error msg for max sessions condition

When the max sessions condition is reached, the firmware
sends session init to the driver. Change the error message
from 'core is in a bad state' to reflect the actual
behavior.

CRs-fixed: 625684
Change-Id: Iddf7d3fc72c1c2696200789954c1e69fd0419dca
Signed-off-by: Pushkaraj Patil <ppatil@codeaurora.org>
msm: vidc: remove non fatal error messages

V4L2 core fails reqbufs ioctl if file IO is in
progress. This message is non fatal, so avoid
logging it as a error message in the video driver.

Change-Id: Ie5ea22925f9c698c82cfaeb6e77b66cf77e5e866
Signed-off-by: Arun Menon <avmenon@codeaurora.org>
msm: vidc: return EBUSY when hw is overloaded

Component reports hw error to client immediately in
the same thread after stream on failure and blocks
subsequence errors to client. Therefore, the async
v4l2 event "V4L2_EVENT_MSM_VIDC_HW_OVERLOAD" will
be ignored in component.
When loading resource fails because of hw
overload, instead of sending V4l2 event, we are
going to return EBUSY and this return value will
be checked in userspace.

Change-Id: I26b3315afbe4c7cc4be9e740595d1db5153467dc
Signed-off-by: Jia Meng <jmeng@codeaurora.org>