SCHEDULER: Autogroup patch group by current user android UID instead of task ID

Change-Id: Ia38a66ab376fcc9ca3c9d34d2c18df72c65b7021
msm: mdss: Enable solid fill on pipe

Add support to enable solid fill on pipe with an option to
configure fill-color by userspace. This support does not confine
to background pipe and can be used to enable solid fill on any source
surface processing pipes irrespective of the z-order.
This support can be used in requirements involving constant
color layers.

Change-Id: Iae3c2968ca2f2f1be161e9c2f857641ffbb859e5
Signed-off-by: Adrian Salido-Moreno <adrianm@codeaurora.org>
Signed-off-by: Mayank Chopra <makchopra@codeaurora.org>
Signed-off-by: Josue Rivera <prbassplayer@gmail.com>
SELinux: Fix kernel BUG on empty security contexts.

Setting an empty security context (length=0) on a file will
lead to incorrectly dereferencing the type and other fields
of the security context structure, yielding a kernel BUG.
As a zero-length security context is never valid, just reject
all such security contexts whether coming from userspace
via setxattr or coming from the filesystem upon a getxattr
request by SELinux.

Setting a security context value (empty or otherwise) unknown to
SELinux in the first place is only possible for a root process
(CAP_MAC_ADMIN), and, if running SELinux in enforcing mode, only
if the corresponding SELinux mac_admin permission is also granted
to the domain by policy.  In Fedora policies, this is only allowed for
specific domains such as livecd for setting down security contexts
that are not defined in the build host policy.

[On Android, this can only be set by root/CAP_MAC_ADMIN processes,
and if running SELinux in enforcing mode, only if mac_admin permission
is granted in policy.  In Android 4.4, this would only be allowed for
root/CAP_MAC_ADMIN processes that are also in unconfined domains. In current
AOSP master, mac_admin is not allowed for any domains except the recovery
console which has a legitimate need for it.  The other potential vector
is mounting a maliciously crafted filesystem for which SELinux fetches
xattrs (e.g. an ext4 filesystem on a SDcard).  However, the end result is
only a local denial-of-service (DOS) due to kernel BUG.  This fix is
queued for 3.14.]

Reproducer:
su
setenforce 0
touch foo
setfattr -n security.selinux foo

Caveat:
Relabeling or removing foo after doing the above may not be possible
without booting with SELinux disabled.  Any subsequent access to foo
after doing the above will also trigger the BUG.

BUG output from Matthew Thode:
[  473.893141] ------------[ cut here ]------------
[  473.962110] kernel BUG at security/selinux/ss/services.c:654!
[  473.995314] invalid opcode: 0000 [#6] SMP
[  474.027196] Modules linked in:
[  474.058118] CPU: 0 PID: 8138 Comm: ls Tainted: G      D   I
3.13.0-grsec #1
[  474.116637] Hardware name: Supermicro X8ST3/X8ST3, BIOS 2.0
07/29/10
[  474.149768] task: ffff8805f50cd010 ti: ffff8805f50cd488 task.ti:
ffff8805f50cd488
[  474.183707] RIP: 0010:[<ffffffff814681c7>]  [<ffffffff814681c7>]
context_struct_compute_av+0xce/0x308
[  474.219954] RSP: 0018:ffff8805c0ac3c38  EFLAGS: 00010246
[  474.252253] RAX: 0000000000000000 RBX: ffff8805c0ac3d94 RCX:
0000000000000100
[  474.287018] RDX: ffff8805e8aac000 RSI: 00000000ffffffff RDI:
ffff8805e8aaa000
[  474.321199] RBP: ffff8805c0ac3cb8 R08: 0000000000000010 R09:
0000000000000006
[  474.357446] R10: 0000000000000000 R11: ffff8805c567a000 R12:
0000000000000006
[  474.419191] R13: ffff8805c2b74e88 R14: 00000000000001da R15:
0000000000000000
[  474.453816] FS:  00007f2e75220800(0000) GS:ffff88061fc00000(0000)
knlGS:0000000000000000
[  474.489254] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[  474.522215] CR2: 00007f2e74716090 CR3: 00000005c085e000 CR4:
00000000000207f0
[  474.556058] Stack:
[  474.584325]  ffff8805c0ac3c98 ffffffff811b549b ffff8805c0ac3c98
ffff8805f1190a40
[  474.618913]  ffff8805a6202f08 ffff8805c2b74e88 00068800d0464990
ffff8805e8aac860
[  474.653955]  ffff8805c0ac3cb8 000700068113833a ffff880606c75060
ffff8805c0ac3d94
[  474.690461] Call Trace:
[  474.723779]  [<ffffffff811b549b>] ? lookup_fast+0x1cd/0x22a
[  474.778049]  [<ffffffff81468824>] security_compute_av+0xf4/0x20b
[  474.811398]  [<ffffffff8196f419>] avc_compute_av+0x2a/0x179
[  474.843813]  [<ffffffff8145727b>] avc_has_perm+0x45/0xf4
[  474.875694]  [<ffffffff81457d0e>] inode_has_perm+0x2a/0x31
[  474.907370]  [<ffffffff81457e76>] selinux_inode_getattr+0x3c/0x3e
[  474.938726]  [<ffffffff81455cf6>] security_inode_getattr+0x1b/0x22
[  474.970036]  [<ffffffff811b057d>] vfs_getattr+0x19/0x2d
[  475.000618]  [<ffffffff811b05e5>] vfs_fstatat+0x54/0x91
[  475.030402]  [<ffffffff811b063b>] vfs_lstat+0x19/0x1b
[  475.061097]  [<ffffffff811b077e>] SyS_newlstat+0x15/0x30
[  475.094595]  [<ffffffff8113c5c1>] ? __audit_syscall_entry+0xa1/0xc3
[  475.148405]  [<ffffffff8197791e>] system_call_fastpath+0x16/0x1b
[  475.179201] Code: 00 48 85 c0 48 89 45 b8 75 02 0f 0b 48 8b 45 a0 48
8b 3d 45 d0 b6 00 8b 40 08 89 c6 ff ce e8 d1 b0 06 00 48 85 c0 49 89 c7
75 02 <0f> 0b 48 8b 45 b8 4c 8b 28 eb 1e 49 8d 7d 08 be 80 01 00 00 e8
[  475.255884] RIP  [<ffffffff814681c7>]
context_struct_compute_av+0xce/0x308
[  475.296120]  RSP <ffff8805c0ac3c38>
[  475.328734] ---[ end trace f076482e9d754adc ]---

[sds:  commit message edited to note Android implications and
to generate a unique Change-Id for gerrit]

Change-Id: I4d5389f0cfa72b5f59dada45081fa47e03805413
Reported-by:  Matthew Thode <mthode@mthode.org>
Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
Cc: stable@vger.kernel.org
Signed-off-by: Paul Moore <pmoore@redhat.com>
Signed-off-by: franciscofranco <franciscofranco.1990@gmail.com>
fix false disconnect due to a signal sent to the reading process

- In the current implementation, when a signal is sent to the reading process,
  read is cancelled by calling usb_ep_dequeue, which lead into calling
  acc_complete_out with ECONNRESET, but the current logic treats it as
  disconnection, which makes the device inaccessible until cable is actually
  disconnected.
- The fix calls disconnect only when ESHUTDOWN error is passed.
- If data has already arrived while trying cancelling, the data is marked
  as available, and it will be read out on the next read. This is necessary
  as USB bulk is assumed to guarantee no data loss.

Change-Id: I87a360685e6760f9bff734c7056fe2488032e1fc
Signed-off-by: keunyoung <keunyoung@google.com>
Signed-off-by: franciscofranco <franciscofranco.1990@gmail.com>
selinux: add a ugly workaround to bail early when selinux tries to free a socket that is still in use and it ends in a Kernel panic. These lines are from opensource.samsung.com. While this will most likely put a bandaid over this Kernel panic it does not fix the bug so it might occur somewhere else if the same conditions are met but since I have only seen panics from this hook then we may as well sleep in peace.

Change-Id: I5137878d98db001dd716bf642d48c4bae38dcd7f
Signed-off-by: franciscofranco <franciscofranco.1990@gmail.com>
ipv4: Dump stack on attempt to release alive inet socket

We hide the bug, that will make SELinux bomb out. Let's dump the stack
when it happens to have at least a chance to find the cause.

Change-Id: I9cbe03ef3e97b806fbb09cbab99e2ac6a89656f8
Signed-off-by: franciscofranco <franciscofranco.1990@gmail.com>
msm: vidc: Enable venus power management

Besides clock gating, turn venus core power off
if the core stays idle for given amount of time.
Powering off venus core involves telling TZ to
suspend venus core, detach IOMMU, disable GDSC
regulator, unvote DDR/OCMEM buses.

Turn it on again when driver starts processing new
commands before enabling clocks.

Protect clock and power states and operations
with a common lock.

Change-Id: I49654069920ddaae0e2f8792b14cd1bfeb431c34
Signed-off-by: Sachin Shah <sachins@codeaurora.org>
Signed-off-by: franciscofranco <franciscofranco.1990@gmail.com>
msm: vidc: Make HW timeout and power collapse delay configurable

Provide debugfs node for HW response timeout and a sysfs device
attribute for power collapse delay.

Change-Id: I586f10f3e90df5384c8e465fbfe8e7ebec0915eb
Signed-off-by: Sachin Shah <sachins@codeaurora.org>
Signed-off-by: franciscofranco <franciscofranco.1990@gmail.com>
msm: vidc: Protect remaining clock operations

Clock enable/disable operations are only protected
during interframe clock gating and power collapse.
With this change, clock operations are also protected
during device initialization and removal.

Change-Id: Idcc81b7563349a45affe4abf0a148c4386be3aa0
Signed-off-by: Sachin Shah <sachins@codeaurora.org>
Signed-off-by: franciscofranco <franciscofranco.1990@gmail.com>
msm: vidc: Add clocks and power counts

Enable power and clock ref counts in debugfs
to easily debug any ref count mismatch.

Change-Id: If06ef139f5a4517cb29a84e86193a6cc2c0f9e64
Signed-off-by: Sachin Shah <sachins@codeaurora.org>
Signed-off-by: franciscofranco <franciscofranco.1990@gmail.com>
msm: vidc: Synchronise data shared between controls

Some of the V4L2 controls perform similar tasks and have some shared
data between them.  Unexpected sequences of controls can possibly cause
data coherency issues causing the firmware to be programmed incorrectly.
So, when a control is updated with a new value, update related controls
with a similar enum so that they both have similar values.

Also, change the frame rate values to normal FPS rather than Q16 format.

Change-Id: Iebb0ddc33374ab8eb7106b005965c2eede797aea
Signed-off-by: Deva Ramasubramanian <dramasub@codeaurora.org>
Signed-off-by: franciscofranco <franciscofranco.1990@gmail.com>
msm: vidc: Increase timeout for power collapse

Increase power collase timeout to avoid venus power
collapse before the video video/encoding decoding is
actually started. This is needed to avoid iommu map
failures at the beginning of the playback.

Change-Id: I82457a9b847c6e8e53bd6ffb6a381a64c0d38417
Signed-off-by: Vinay Kalia <vkalia@codeaurora.org>
Signed-off-by: franciscofranco <franciscofranco.1990@gmail.com>
msm: vidc: Handle SYS_IDLE interrupt concurrency

It is possible to receive SYS_IDLE message before
Venus core sends the interrupt for that message.
This results in clocks not being disabled at all
and device will continue to drain power.

This change checks when the interrupt is received
if the venus core is still in IDLE state. If it is
then disable the clocks.

Change-Id: If2b8d778054a702eada40ac3588e2ec3a3fbd80a
CRs-fixed: 548745
Signed-off-by: Sachin Shah <sachins@codeaurora.org>
Signed-off-by: franciscofranco <franciscofranco.1990@gmail.com>
msm: vidc: Fix handling of ocmem_notifier_register() return value

The ocmem driver might return -EPROBE_DEFER (or any other error)
as a ERR_PTR.  These shouldn't be construed as a valid handle.

CRs-fixed: 565882

Change-Id: I57c9739ae766a1b512ce930005c1cb310aa74034
Signed-off-by: Vinay Kalia <vkalia@codeaurora.org>
Signed-off-by: franciscofranco <franciscofranco.1990@gmail.com>
msm: vidc: Halt axi bus before clock disable

Before turning off venus clock, host should make sure
that there are no pending AXI transactions. This is achieved
by halting AXI.

CRs-Fixed: 578007

Change-Id: Ib4a71d1097f2f62e910e00c7be5d32e006d4c62b
Signed-off-by: Vikash Garodia <vgarodia@codeaurora.org>
Signed-off-by: franciscofranco <franciscofranco.1990@gmail.com>
msm: vidc: Mask interrupts from venus after receiving IDLE message

IDLE message from venus indicates that the venus is idle and its
clocks are turned off. These clocks should not be turned on by any
pending or spurious(interrupts without any message) interrupts to save
power.

Change-Id: I622212a7e8c51106fbf69c491d129f219eb6ce54
CRs-fixed: 583989
Signed-off-by: Vinay Kalia <vkalia@codeaurora.org>
Signed-off-by: franciscofranco <franciscofranco.1990@gmail.com>
msm: vidc: Fix a race condition in masking interrupts

Fix a race condition when interaction with firmware happens
in following sequence:

1. Firmware writes IDLE message into the message queue.
2. Driver writes a new command into command queue.
3. Firmware reads this command and starts processing it.
4. Driver checks if command queue is empty and finds it empty.
5. Firmware writes the response (of the command sent in 2) in
   message queue. Firmware also writes another IDLE message and
   sets the idle register.
6. Driver check if the IDLE register is set and finds it set.
7. Driver masks the interrupts. Since interrupts are masked,
   driver misses the response written by firmware in 5.

This race condition is fixed by checking if message queue is
empty or not between 6 and 7.

Change-Id: I4aa17cfc5fd9e33f6b41b6c1b12625789ff02283
msm: vidc: Disable clock gating for 8x26

There are stability issue observed on 8x26 with
inter-frame clock gating enabled so disable
interframe clock gating on 8x26.

Change-Id: I0e2b89a0ce36ed4d5f15903ffe68b7c7275719c9
Signed-off-by: Vinay Kalia <vkalia@codeaurora.org>
Signed-off-by: franciscofranco <franciscofranco.1990@gmail.com>
msm: vidc: fix memory leak issue in dynamic buffer mode

While flushing output buffers held in v4l2 video
driver, i.e, with ref count equal to 2, the driver
was freeing the binfo structure. This would leak
the mapped output buffer memory. By avoiding
freeing of the binfo structure, the driver waits
for the release reference event from the firmware
to free and unmap the output buffer. Also move
initialization of dequeued flag for buffers to be
held in driver, till the time we queue this buffer
to firmware. By not doing so, the video driver can
enter a race condition, whereby, a output buffer could
be unmapped and freed before v4l2 client has called
dequeue on the buffer.

Change-Id: Ic95f13b9f4426574012539a76c0b87bedb8e805a
Signed-off-by: Arun Menon <avmenon@codeaurora.org>
Signed-off-by: franciscofranco <franciscofranco.1990@gmail.com>
msm: vidc: update max P frames num for encode

Remove the restriction on the max number of
P frame interval.

Change-Id: I637372d7b0d409602df251bad4a135b25514dc95
Signed-off-by: Arun Menon <avmenon@codeaurora.org>
Signed-off-by: franciscofranco <franciscofranco.1990@gmail.com>