ion: replace userspace handle cookies with idr

Userspace handles should not leak kernel virtual addresses to
userspace.  They have to be validated by looking them up in an
rbtree anyways, so replace them with an idr and validate them
by using idr_find to convert the id number to the struct
ion_handle pointer.

Change-Id: Iab5667ba6f3a73256fec3949b23a9a6f8e14a283
Signed-off-by: Colin Cross <ccross@android.com>
Git-commit: 1126d98d8e34d771afcc72ce5d1c37ad4d474402
Git-repo: https://android.googlesource.com/kernel/common
[mitchelh@codeaurora.org: conflicts due to msm changes]
Signed-off-by: Mitchel Humpherys <mitchelh@codeaurora.org>
ion: don't use id 0 for handle cookie

ion userspace clients think that the cookie is a pointer, so they
use NULL to check if the handle has been initialized.  Set the first
id number to 1.

Change-Id: Ifb9af6029a8b08f57e41bc6160cc11e11001a2a9
Signed-off-by: Colin Cross <ccross@android.com>
Git-commit: 66df93b4c9e78cf433b76d7fe3da4cc7fd06c36b
Git-repo: https://android.googlesource.com/kernel/common
Signed-off-by: Mitchel Humpherys <mitchelh@codeaurora.org>
ion: add new ion_user_handle_t type for the user-space token

Declare new ion_user_handle_t type to contain the token returned to user-space.
This allows a 2-step migration of the user-space code to a new kernel header
first, then will allow us to change the definition of the ion_user_handle_type_t
to int without breaking the API.

Change-Id: I4200b6600df8e56fe98cf1580a13a65cb25ec646
Signed-off-by: Rom Lemarchand <romlem@google.com>
(cherry picked from commit ebb8269bbb05b06ecedca3e21b3e65f23d48eadd)
Git-commit: 29f271de6ffdf6a96375cd244986617e87afc8d0
Git-repo: https://android.googlesource.com/kernel/common
Signed-off-by: Mitchel Humpherys <mitchelh@codeaurora.org>
ion: hold reference to handle after ion_uhandle_get

commit 1262ab1846cf76f7549c66ef709120dbfbe6d49f (ion: replace
userspace handle cookies with idr) broke the locking in ion.
The ION_IOC_FREE and ION_IOC_MAP ioctls were relying on
ion_handle_validate to detect the case where a call raced
with another ION_IOC_FREE which may have freed the struct
ion_handle.

Rename ion_uhandle_get to ion_handle_get_by_id, and have it
take the client lock and return with an extra reference to
the handle.  Make each caller put its reference once it
is done with the handle.

Also modify users of ion_handle_validate to continue to hold
the client lock after calling ion_handle_validate until
they are done with the handle, and warn if ion_handle_validate
is called without the client lock held.

Change-Id: I56da5624fca3bed4ee24806b6ec39de903543341
Signed-off-by: Colin Cross <ccross@android.com>
Git-commit: 33a57aa073dac709bcdcba23bc4e2e7fcc6330f6
Git-repo: https://android.googlesource.com/kernel/common
[mitchelh@codeaurora.org: minor merge conflicts due to some missing
 casts since we haven't brought in the change that makes
 ion_user_handle_t an int.]
Signed-off-by: Mitchel Humpherys <mitchelh@codeaurora.org>
ion: export a few handle-related APIs

There are a few APIs (ion_handle_put and ion_handle_get_by_id) that are
useful for implementing Ion extensions (e.g. custom ioctl
handlers). Remove the `static' to make these APIs available to other Ion
code.

Change-Id: Ice8767853f628d8178e96a36db3da02fa97f3235
Signed-off-by: Mitchel Humpherys <mitchelh@codeaurora.org>
ion: msm: update custom caching ioctls for new handle format

The userspace API for Ion handles has changed slightly. Update the MSM
caching ioctls to work with the new format.

Change-Id: I6dee3190f5cad117a4d7059f1c7f0f01e05692c0
Signed-off-by: Mitchel Humpherys <mitchelh@codeaurora.org>
ion: msm: fix bug with handle id handling

0 is not a valid handle id value. If we get a 0 we should try to do the
dma_buf import.

Change-Id: I2b9355a5ad65c91247c0369047f921cf02908b1c
Signed-off-by: Mitchel Humpherys <mitchelh@codeaurora.org>
ion: invalidate cache after zero'ing buffers even if uncached

Currently, we don't invalidate the cache if we're working with uncached
buffers. However, the memory for those mappings might actually be stale
in the cache since someone else might have touched it. Just invalidate
the cache for everyone, cached or uncached.

Without this change, corruption was observed on the display due to stale
data in graphics buffers from Ion.

CRs-Fixed: 585524
Change-Id: I0037beaadfde983af15d8f45918f7798264dd3ca
Signed-off-by: Mitchel Humpherys <mitchelh@codeaurora.org>
msm: mdss: implement overlay prepare ioctl

Overlay prepare will allow a full frame with multiple overlays to be
configured at once and perform frame level checks before being pushed to
display. This function guarantees that if the call is successful, the
frame can be displayed successfully on the screen when display commit is
called.

Change-Id: I276b6fe3e0a872a2e93170f3cea1002d3ce0dac9
Signed-off-by: Adrian Salido-Moreno <adrianm@codeaurora.org>
Signed-off-by: Anusha Koduru <kanusha@codeaurora.org>

Conflicts:
	include/linux/msm_mdp.h
msm: display: Add pipe type selection in overlay request

Allow user to specify the type when requesting an overlay pipe.
If field is set the pipe type indication in the flags will be
ignored.
Change-Id: Iee51d24b96c7a2a987dc70a439342e6548dfc8fa
Signed-off-by: Vineet Bajaj <vbajaj@codeaurora.org>
msm: mdss: add retire fence support

Retire fence timeline should follow the actual panel vsync more closely.
For video mode the retire fence can be signaled along with the release
timeline with +1 offset, since this is signaled at vsync.
In case of command mode the panel vsync can be different from buffer
release timeline. To handle the command mode panel vsyncs better, create
a new timeline for the retire fence signaling.

Change-Id: If8a1eb717d733ca215275a8be4f0054091dbc147
Signed-off-by: Adrian Salido-Moreno <adrianm@codeaurora.org>

Conflicts:
	drivers/video/msm/mdss/mdss_mdp_overlay.c