msm: mdss: implement overlay prepare ioctl

Overlay prepare will allow a full frame with multiple overlays to be
configured at once and perform frame level checks before being pushed to
display. This function guarantees that if the call is successful, the
frame can be displayed successfully on the screen when display commit is
called.

Change-Id: I276b6fe3e0a872a2e93170f3cea1002d3ce0dac9
Signed-off-by: Adrian Salido-Moreno <adrianm@codeaurora.org>
Signed-off-by: Anusha Koduru <kanusha@codeaurora.org>

Conflicts:

	include/linux/msm_mdp.h
msm: vidc: Bail out if ocmem allocation failed

We shouldn't need to call venus_hfi_set_ocmem if the allocation of ocmem
failed.

Change-Id: I805f914af4d340fd50beecdb63b87c4cbda19fb0
Signed-off-by: Deva Ramasubramanian <dramasub@codeaurora.org>
msm: vidc: add LTR support for video encoder

Enable LTR support for VP8 codec to add robust error resilience.

Change-Id: I3b87c5cdaef836a6d02d5b9fe71b7165b7f13581
Signed-off-by: Ashray Kulkarni <ashrayk@codeaurora.org>
msm: vidc: Add generic LTR mode support

Use generic LTR HFI APIs for h264 and vp8 formats.

Change-Id: I9f307046d7ec6de4eb6d43704686be902356882a
Signed-off-by: Ashray Kulkarni <ashrayk@codeaurora.org>
msm: vidc: Add support to request frame level QP information

The resulting QP information for H264 is the slice level
QP averaged over whole frame; for all other codecs its
frame level QP.

Change-Id: I288904b05d886c1e94fc113b8bd3fba5b13b48f3
Signed-off-by: Jorge Solano Altamirano <jsolano@codeaurora.org>
msm: vidc: Add support to request frame bits info as extra-data

Provides information regarding number of bits in the frame (i.e frame
size expressed in bits) & also the number of bits in frame header (i.e
frame header size expressed in bits).
Number of bits in header is reported as:
For H264, sum of all slice headers bits for all the slices in the frame.
For all other codecs, number of bits in the frame header.

Change-Id: I6caeca025ff0ce059a20891a6d657b47c4b452b3
Signed-off-by: Jorge Solano Altamirano <jsolano@codeaurora.org>
msm: vidc: Return meaningful information for extra-data plane

Sending meaningful information in the extra-data plane structure
instead of trashy values for some uninitialized fields.

Change-Id: I6d1a5debb801836f48e4cdbd6129b5086ec18a63
Signed-off-by: Jorge Solano Altamirano <jsolano@codeaurora.org>
[media] v4l2: Add enum for frame level QP extra-data

This option is intended to be used to request as extra-data
the frame level QP.

Change-Id: Icaf88bd5a48ac394d1ed7ded8dc320cfeebc2765
Signed-off-by: Jorge Solano Altamirano <jsolano@codeaurora.org>
[media] v4l2: Add enums to request frame bits info as extra-data

This option is intended to be used to request as extra-data
the size in bits from frame header and frame itself.

Change-Id: I207045cda8c8038981bcf4548eb3d221502a67e1
Signed-off-by: Jorge Solano Altamirano <jsolano@codeaurora.org>
msm: vidc: Add support for MBI extradata

Macro Block Information extradata (if enabled) allows interested
clients to query for metadata about each macroblock.

Change-Id: Icfee32770018338e28ae149e1ccb654f5a48cbec
Signed-off-by: Deva Ramasubramanian <dramasub@codeaurora.org>
msm: vidc: add control to enable Hierarchical P num layers

This change will enable firmware to perform Hierarchical
video encoding for P frames. Hierarchical video encoding is
used to improve error resilience and temporal scalability.
The encoded frames are logically organized in to multiple
layers with frames in one layer referencing only frames
from lower layers. The lowest layer, i.e. base layer, is
the only exception.

Change-Id: Ie30e6d075b76b3337ec895584cf1f3be9f4bb6c6
Signed-off-by: Arun Menon <avmenon@codeaurora.org>
msm: vidc: Provide qmenu for V4L2_CID_MPEG_VIDC_VIDEO_INTRA_REFRESH_MODE

The v4l2 control framework requires a qmenu containing a string
description of each menu item.

Change-Id: Id41fd794a6f7ad8711caf9d072975ad6cabad6f9
Signed-off-by: Deva Ramasubramanian <dramasub@codeaurora.org>
msm: vidc: Add description of LTR Extradata

The missing string descriptor caused a mismatch in array sizes
causing the v4l2 control framework make an out of bounds access.

Change-Id: I9a9f64e16ca95163d800702d94528833f5892537
Signed-off-by: Deva Ramasubramanian <dramasub@codeaurora.org>
msm: vidc: Query the core on VIDIOC_G_FMT

Previously we only queried the core for buffer requirements in
VIDIOC_REQBUFS, and relied on that information in _G_FMT.  However,
there's no expectation that the client calls _REQBUFS before _G_FMT,
which leads to stale information being returned as part of _G_FMT.

As such, always retreive fresh info from the core for either ioctl.

Change-Id: Ife94343f4bd4f62da7f2bef4266076ceed409bca
Signed-off-by: Deva Ramasubramanian <dramasub@codeaurora.org>
futex: Prevent attaching to kernel threads

We happily allow userspace to declare a random kernel thread to be the
owner of a user space PI futex.

Found while analysing the fallout of Dave Jones syscall fuzzer.

We also should validate the thread group for private futexes and find
some fast way to validate whether the "alleged" owner has RW access on
the file which backs the SHM, but that's a separate issue.

Signed-off-by: Thomas Gleixner <tglx@...utronix.de>
Cc: Dave Jones <davej@...hat.com>
Cc: Linus Torvalds <torvalds@...ux-foundation.org>
Cc: Peter Zijlstra <peterz@...radead.org>
Cc: Darren Hart <darren@...art.com>
Cc: Davidlohr Bueso <davidlohr@...com>
Cc: Steven Rostedt <rostedt@...dmis.org>
Cc: Clark Williams <williams@...hat.com>
Cc: Paul McKenney <paulmck@...ux.vnet.ibm.com>
Cc: Lai Jiangshan <laijs@...fujitsu.com>
Cc: Roland McGrath <roland@...k.frob.com>
Cc: Carlos ODonell <carlos@...hat.com>
Cc: Jakub Jelinek <jakub@...hat.com>
Cc: Michael Kerrisk <mtk.manpages@...il.com>
Cc: Sebastian Andrzej Siewior <bigeasy@...utronix.de>
Link: http://lkml.kernel.org/r/20140512201701.194824402@...utronix.de
Signed-off-by: Thomas Gleixner <tglx@...utronix.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@...uxfoundation.org>

Change-Id: I7444c58d00cbded35b078331a8740e8431cb13a5
futex: Add another early deadlock detection check

Dave Jones trinity syscall fuzzer exposed an issue in the deadlock
detection code of rtmutex:
  http://lkml.kernel.org/r/20140429151655.GA14277@...hat.com

That underlying issue has been fixed with a patch to the rtmutex code,
but the futex code must not call into rtmutex in that case because
    - it can detect that issue early
    - it avoids a different and more complex fixup for backing out

If the user space variable got manipulated to 0x80000000 which means
no lock holder, but the waiters bit set and an active pi_state in the
kernel is found we can figure out the recursive locking issue by
looking at the pi_state owner. If that is the current task, then we
can safely return -EDEADLK.

The check should have been added in commit 59fa62451 (futex: Handle
futex_pi OWNER_DIED take over correctly) already, but I did not see
the above issue caused by user space manipulation back then.

Signed-off-by: Thomas Gleixner <tglx@...utronix.de>
Cc: Dave Jones <davej@...hat.com>
Cc: Linus Torvalds <torvalds@...ux-foundation.org>
Cc: Peter Zijlstra <peterz@...radead.org>
Cc: Darren Hart <darren@...art.com>
Cc: Davidlohr Bueso <davidlohr@...com>
Cc: Steven Rostedt <rostedt@...dmis.org>
Cc: Clark Williams <williams@...hat.com>
Cc: Paul McKenney <paulmck@...ux.vnet.ibm.com>
Cc: Lai Jiangshan <laijs@...fujitsu.com>
Cc: Roland McGrath <roland@...k.frob.com>
Cc: Carlos ODonell <carlos@...hat.com>
Cc: Jakub Jelinek <jakub@...hat.com>
Cc: Michael Kerrisk <mtk.manpages@...il.com>
Cc: Sebastian Andrzej Siewior <bigeasy@...utronix.de>
Link: http://lkml.kernel.org/r/20140512201701.097349971@...utronix.de
Signed-off-by: Thomas Gleixner <tglx@...utronix.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@...uxfoundation.org>

Change-Id: I245f77622443435cf36bbd157b98798c235acdb0
futex-prevent-requeue-pi-on-same-futex.patch futex: Forbid uaddr == uaddr2 in futex_requeue(..., requeue_pi=1)

If uaddr == uaddr2, then we have broken the rule of only requeueing
from a non-pi futex to a pi futex with this call. If we attempt this,
then dangling pointers may be left for rt_waiter resulting in an
exploitable condition.

This change brings futex_requeue() into line with
futex_wait_requeue_pi() which performs the same check as per commit
6f7b0a2a5 (futex: Forbid uaddr == uaddr2 in futex_wait_requeue_pi())

[ tglx: Compare the resulting keys as well, as uaddrs might be
  	different depending on the mapping ]

Fixes CVE-2014-3153.

Reported-by: Pinkie Pie
Signed-off-by: Will Drewry <wad@chromium.org>
Signed-off-by: Kees Cook <keescook@chromium.org>
Cc: stable@vger.kernel.org
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>

Change-Id: Iea1dfe1d877d63a374db2623dca6cea4e7a544b9
futex: Validate atomic acquisition in futex_lock_pi_atomic()

We need to protect the atomic acquisition in the kernel against rogue
user space which sets the user space futex to 0, so the kernel side
acquisition succeeds while there is existing state in the kernel
associated to the real owner.

Verify whether the futex has waiters associated with kernel state. If
it has, return -EINVAL. The state is corrupted already, so no point in
cleaning it up. Subsequent calls will fail as well. Not our problem.

[ tglx: Use futex_top_waiter() and explain why we do not need to try
  	restoring the already corrupted user space state. ]

Signed-off-by: Darren Hart <dvhart@linux.intel.com>
Cc: Kees Cook <keescook@chromium.org>
Cc: Will Drewry <wad@chromium.org>
Cc: stable@vger.kernel.org
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>

Change-Id: I6c19ae4a5e85fbc9c560723e672d5136c4786ab6
futex: Always cleanup owner tid in unlock_pi

If the owner died bit is set at futex_unlock_pi, we currently do not
cleanup the user space futex. So the owner TID of the current owner
(the unlocker) persists. That's observable inconsistant state,
especially when the ownership of the pi state got transferred.

Clean it up unconditionally.

Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Cc: Kees Cook <keescook@chromium.org>
Cc: Will Drewry <wad@chromium.org>
Cc: Darren Hart <dvhart@linux.intel.com>
Cc: stable@vger.kernel.org

Change-Id: Ic84473a62bdf3e5702f46e04b266afa38e9ec40e
futex: Make lookup_pi_state more robust

The current implementation of lookup_pi_state has ambigous handling of
the TID value 0 in the user space futex. We can get into the kernel
even if the TID value is 0, because either there is a stale waiters
bit or the owner died bit is set or we are called from the requeue_pi
path or from user space just for fun.

The current code avoids an explicit sanity check for pid = 0 in case
that kernel internal state (waiters) are found for the user space
address. This can lead to state leakage and worse under some
circumstances.

Handle the cases explicit:

     Waiter | pi_state | pi->owner | uTID      | uODIED | ?

[1]  NULL   | ---      | ---       | 0         | 0/1    | Valid
[2]  NULL   | ---      | ---       | >0        | 0/1    | Valid

[3]  Found  | NULL     | --        | Any       | 0/1    | Invalid

[4]  Found  | Found    | NULL      | 0         | 1      | Valid
[5]  Found  | Found    | NULL      | >0        | 1      | Invalid

[6]  Found  | Found    | task      | 0         | 1      | Valid

[7]  Found  | Found    | NULL      | Any       | 0      | Invalid

[8]  Found  | Found    | task      | ==taskTID | 0/1    | Valid
[9]  Found  | Found    | task      | 0         | 0      | Invalid
[10] Found  | Found    | task      | !=taskTID | 0/1    | Invalid

[1]  Indicates that the kernel can acquire the futex atomically. We
     came came here due to a stale FUTEX_WAITERS/FUTEX_OWNER_DIED bit.

[2]  Valid, if TID does not belong to a kernel thread. If no matching
     thread is found then it indicates that the owner TID has died.

[3]  Invalid. The waiter is queued on a non PI futex

[4]  Valid state after exit_robust_list(), which sets the user space
     value to FUTEX_WAITERS | FUTEX_OWNER_DIED.

[5]  The user space value got manipulated between exit_robust_list()
     and exit_pi_state_list()

[6]  Valid state after exit_pi_state_list() which sets the new owner in
     the pi_state but cannot access the user space value.

[7]  pi_state->owner can only be NULL when the OWNER_DIED bit is set.

[8]  Owner and user space value match

[9]  There is no transient state which sets the user space TID to 0
     except exit_robust_list(), but this is indicated by the
     FUTEX_OWNER_DIED bit. See [4]

[10] There is no transient state which leaves owner and user space
     TID out of sync.

Backport to 3.13
  conflicts: kernel/futex.c

Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Signed-off-by: John Johansen <john.johansen@canonical.com>
Cc: Kees Cook <keescook@chromium.org>
Cc: Will Drewry <wad@chromium.org>
Cc: Darren Hart <dvhart@linux.intel.com>
Cc: stable@vger.kernel.org

Change-Id: I967e3bb07b239941ea51af6b09d61d7b08138f40