msm: vidc: Query the core on VIDIOC_G_FMT

Previously we only queried the core for buffer requirements in
VIDIOC_REQBUFS, and relied on that information in _G_FMT.  However,
there's no expectation that the client calls _REQBUFS before _G_FMT,
which leads to stale information being returned as part of _G_FMT.

As such, always retreive fresh info from the core for either ioctl.

Change-Id: Ife94343f4bd4f62da7f2bef4266076ceed409bca
Signed-off-by: Deva Ramasubramanian <dramasub@codeaurora.org>
msm: vidc: added v4l2 control to set the color of concealed MBs.

The conceal color is set to be green by default, while some users
required it to be black.
Set it to be configurable by adding this v4l2 control.

Change-Id: I25565ee837c011f5875ce91bde23a169fbdb0709
Signed-off-by: Jia Meng <jmeng@codeaurora.org>

Conflicts:
	drivers/media/platform/msm/vidc/msm_vdec.c
msm: vidc: detect mbaff information from firmware

Firmware will set the FBD flags if mbaff interface
is detected for decoded video bitstream. Previously
the mbaff information was parsed in the v4l2 video
client, but now firmware parses and sends the information.

Change-Id: Ic557cdb7bf49aab3eb29a3f3aa3e363bf7223a36
Signed-off-by: Arun Menon <avmenon@codeaurora.org>
msm: vidc: update max P frames num for encode

Remove the restriction on the max number of
P frame interval.

Change-Id: I637372d7b0d409602df251bad4a135b25514dc95
Signed-off-by: Arun Menon <avmenon@codeaurora.org>
Signed-off-by: houst0nn <houstonn@gmail.com>
msm: vidc: set ctrl to request sequence header for encoder

The encoder depended on a debug variable i.e. ftb_count, to
request firmware to send sequence header. Remove this
dependency and make the request only when the encoder
client requests using the provided set ctrl.

b/11051201

Change-Id: Iac4104c33eef62da553066c736b7adc87834d2ac
Signed-off-by: Arun Menon <avmenon@codeaurora.org>
Signed-off-by: houst0nn <houstonn@gmail.com>
msm: kgsl: Enable protected mode for A3XX

Enable protected register mode for A3XX with these commits from
msm-3.10:

msm: kgsl: Enable protected register mode for A3XX
msm: kgsl: Print the register that causes a protected mode error
msm: kgsl: Unprotect the VBIF performance counters

Change-Id: Ic0dedbad950ffbd063fd861d9440bb5dce8d5fb1
Signed-off-by: Jordan Crouse <jcrouse@codeaurora.org>
msm: kgsl: Protect SMMU registers from being written by the GPU

Put the SMMU register range in protected mode to shield them from
IB1/IB2 writes from userspace.

CRs-Fixed: 599971
Change-Id: Ic0dedbad8c03fc1c54ff73221231e2440d3c34dd
Signed-off-by: Jordan Crouse <jcrouse@codeaurora.org>
msm: kgsl: Mark the IOMMU setstate memory as read only

Mark the IOMMU setstate memory as read only in the pagetable.

Change-Id: Ic0dedbadb19e499c749cd744c3e89be3bcb4c2a2
Signed-off-by: Jordan Crouse <jcrouse@codeaurora.org>
msm: kgsl: Protect CP_STATE_DEBUG_INDEX

Put CP_STATE_DEBUG_INDEX and CP_STATE_DEBUG_DATA under protection
to keep it from being written from an IB1. Doing so however opens
up a subtle "feature" in the microcode: memory read opcodes turn off
protected mode in the microcode to do the read and then turns it
back on regardless of the initial state. This is a problem if the
memory read happens while protected mode is turned off and then we
try to access a protected register which then complains and goes boom.

To account for this irregularity explicitly turn back off protected
mode in all the places where we know this will be a problem.

Change-Id: Ic0dedbad1397ca9b80132241ac006560a615e042
Signed-off-by: Jordan Crouse <jcrouse@codeaurora.org>
msm: mdss: add retire fence support

Retire fence timeline should follow the actual panel vsync more closely.
For video mode the retire fence can be signaled along with the release
timeline with +1 offset, since this is signaled at vsync.
In case of command mode the panel vsync can be different from buffer
release timeline. To handle the command mode panel vsyncs better, create
a new timeline for the retire fence signaling.

Change-Id: If8a1eb717d733ca215275a8be4f0054091dbc147
Signed-off-by: Adrian Salido-Moreno <adrianm@codeaurora.org>
Signed-off-by: houst0nn <houstonn@gmail.com>

Conflicts:
	drivers/video/msm/mdss/mdss_fb.c
ion: replace userspace handle cookies with idr

Userspace handles should not leak kernel virtual addresses to
userspace.  They have to be validated by looking them up in an
rbtree anyways, so replace them with an idr and validate them
by using idr_find to convert the id number to the struct
ion_handle pointer.

Change-Id: Iab5667ba6f3a73256fec3949b23a9a6f8e14a283
Signed-off-by: Colin Cross <ccross@android.com>
Git-commit: 1126d98d8e34d771afcc72ce5d1c37ad4d474402
Git-repo: https://android.googlesource.com/kernel/common
[mitchelh@codeaurora.org: conflicts due to msm changes]
Signed-off-by: Mitchel Humpherys <mitchelh@codeaurora.org>
ion: don't use id 0 for handle cookie

ion userspace clients think that the cookie is a pointer, so they
use NULL to check if the handle has been initialized.  Set the first
id number to 1.

Change-Id: Ifb9af6029a8b08f57e41bc6160cc11e11001a2a9
Signed-off-by: Colin Cross <ccross@android.com>
Git-commit: 66df93b4c9e78cf433b76d7fe3da4cc7fd06c36b
Git-repo: https://android.googlesource.com/kernel/common
Signed-off-by: Mitchel Humpherys <mitchelh@codeaurora.org>
ion: add new ion_user_handle_t type for the user-space token

Declare new ion_user_handle_t type to contain the token returned to user-space.
This allows a 2-step migration of the user-space code to a new kernel header
first, then will allow us to change the definition of the ion_user_handle_type_t
to int without breaking the API.

Change-Id: I4200b6600df8e56fe98cf1580a13a65cb25ec646
Signed-off-by: Rom Lemarchand <romlem@google.com>
(cherry picked from commit ebb8269bbb05b06ecedca3e21b3e65f23d48eadd)
Git-commit: 29f271de6ffdf6a96375cd244986617e87afc8d0
Git-repo: https://android.googlesource.com/kernel/common
Signed-off-by: Mitchel Humpherys <mitchelh@codeaurora.org>
ion: hold reference to handle after ion_uhandle_get

commit 1262ab1846cf76f7549c66ef709120dbfbe6d49f (ion: replace
userspace handle cookies with idr) broke the locking in ion.
The ION_IOC_FREE and ION_IOC_MAP ioctls were relying on
ion_handle_validate to detect the case where a call raced
with another ION_IOC_FREE which may have freed the struct
ion_handle.

Rename ion_uhandle_get to ion_handle_get_by_id, and have it
take the client lock and return with an extra reference to
the handle.  Make each caller put its reference once it
is done with the handle.

Also modify users of ion_handle_validate to continue to hold
the client lock after calling ion_handle_validate until
they are done with the handle, and warn if ion_handle_validate
is called without the client lock held.

Change-Id: I56da5624fca3bed4ee24806b6ec39de903543341
Signed-off-by: Colin Cross <ccross@android.com>
Git-commit: 33a57aa073dac709bcdcba23bc4e2e7fcc6330f6
Git-repo: https://android.googlesource.com/kernel/common
[mitchelh@codeaurora.org: minor merge conflicts due to some missing
 casts since we haven't brought in the change that makes
 ion_user_handle_t an int.]
Signed-off-by: Mitchel Humpherys <mitchelh@codeaurora.org>
ion: export a few handle-related APIs

There are a few APIs (ion_handle_put and ion_handle_get_by_id) that are
useful for implementing Ion extensions (e.g. custom ioctl
handlers). Remove the `static' to make these APIs available to other Ion
code.

Change-Id: Ice8767853f628d8178e96a36db3da02fa97f3235
Signed-off-by: Mitchel Humpherys <mitchelh@codeaurora.org>