msm: vidc: update with fixes and enhancements

Add LTR support for video encoder.
Add control to enable Hierarchical P num.
Enable vp8 error resilience support.
Avoid re-initialize of v4l2 spin lock.
Fix a race condition with core instances list
Add VP8 QP min and max control.
Add support to set VP8 QP range.
Update msm_media_info with MV Color format.
Cleanup v4l2 buffer flags.
Don't erase buffer flags in EBD
Rewrite v4l2 cluster construction
Detect mbaff information from firmware
Add support for setting initial qp
Configure and set hier-p layers
Fix a race condition in cluster construction
Indicate secure sessions in debugfs
Remove non fatal error messages
Query deblocker parameters from cluster
Set error concealment color to FW
Added v4l2 control to set the color of concealed MBs.
Disable Hier-P when LTR is enabled

Signed-off-by: Praveen Chavan <pchavan@codeaurora.org>
Signed-off-by: Arun Menon <avmenon@codeaurora.org>
Signed-off-by: Deva Ramasubramanian <dramasub@codeaurora.org>

Conflicts:
	drivers/media/platform/msm/vidc/hfi_packetization.c
	drivers/media/platform/msm/vidc/hfi_response_handler.c
	drivers/media/platform/msm/vidc/msm_vdec.c
	drivers/media/platform/msm/vidc/msm_venc.c
	drivers/media/platform/msm/vidc/msm_vidc.c
	drivers/media/platform/msm/vidc/msm_vidc_common.c
	drivers/media/platform/msm/vidc/msm_vidc_internal.h
	drivers/media/platform/msm/vidc/vidc_hfi.h
	drivers/media/platform/msm/vidc/vidc_hfi_api.h
	drivers/media/platform/msm/vidc/vidc_hfi_helper.h
	include/linux/videodev2.h
	include/media/msm_media_info.h
	include/media/msm_vidc.h
msm: vidc: handle dynamic buffers in pendingq during flush

In dynamic buffer mode, if flush was received before
stream-on, driver would have incremented the ref count
for output buffers, but not yet sent to firmware. So,
after flush done, there would be no fbd from firmware
and the reference to these buffers would not be removed.
So when the buffers are dequeued, driver fails to
unmap and free the output buffers.
Subsequently, after flush done, when client queues
the same output buffers again to driver, the ref
count is increased and becomes 2. This results in
the driver holding the buffers with itself, thereby
entering in to a deadlock situation and starving the
firmware of output buffers. This results in a video
freeze.

b/17647776

Change-Id: I0c3d13124bd48b900e56e14666eaed2f0e7ee9d6
Signed-off-by: Arun Menon <avmenon@codeaurora.org>
msm: vidc: fix corruption of registered buffer list

The buffer list for output buffers is accessed from
different threads leading to race conditions. Consider
the case of firmware throwing up a fatal error, which gets
propagated to v4l2 client. The v4l2 client closes the
driver fd, which will trigger msm_vidc_release_buffers
to release all output buffers and free node from
the registered buffer list. During this time, if
firmware sends a release reference event, the buffer
node being accessed in msm_vidc_release_buffers could
be freed, triggering kernel panic.

Change-Id: I522edff06a62dbc2ab60d6cca5990babb18d5c6c
Signed-off-by: Arun Menon <avmenon@codeaurora.org>

Conflicts:
	drivers/media/platform/msm/vidc/msm_vidc.c
net: wireless: bcmdhd: Fix Batch scan get bug

Legacy Batch scan code would issue mutex unlock w/o a lock

bug: 17021370

Signed-off-by: Ashwin <ashwin.bhat@broadcom.com>
camera_v1/v2: Fix multiple JPEG integer overflow issues

Fixes multiple issues in the gemini and jpeg 1.0 cores when parsing
hw commands:

1. Fixes integer overflow issue when calculating the length of the
command buffer.
2. Fixes signedness issue with the command count.

CRs-fixed: 504640
Signed-off-by: Kamen Kirov <kkirov@codeaurora.org>
Change-Id: I0a701c67b93cc97af119b31639db699e5ae58489
msm: kgsl: Do not allow events with bogus timestamp

Do not register an event if the timestamp of that event is greater
than the highest timestamp assigned to the context or global in
case of global event

Change-Id: If12ad2dbc579bbcf7e99b3179ab8f911dc9b41aa
Signed-off-by: Shubhraprakash Das <sadas@codeaurora.org>
msm: kgsl: allow creation of events from the future

For contexts created with the KGSL_CONTEXT_USER_GENERATED_TS,
allow events to be created for timestamps that have not
been issued yet. Presumably these contexts know what they
are doing.

Change-Id: Iccf2e549b38e1a11850d26ee64b7279ab0b8a1ae
Signed-off-by: Jeremy Gebben <jgebben@codeaurora.org>
msm: kgsl: Flush the UCHE when context changes

Add commands to flush the GPU UCHE when a new context submits
commands to GPU. The ensures that the new context does not use
stale data present in UCHE.

Change-Id: I123a323be5f3fb9d1f9f96fed5bb68b8d0d27d76
CRs-Fixed: 607976
Signed-off-by: Shubhraprakash Das <sadas@codeaurora.org>
msm: kgsl: Enhance GFT to avoid hang->recover->hang cycle

If GFT recovered more than X times in Y ms invalidate the context
and do not attempt recovery. this is to prevent the case where GFT keeps
recovering continuously.

Change-Id: I9326a4cf0c8d1b6b92497ae5cd086e4b8bb7e89f
Signed-off-by: Tarun Karra <tkarra@codeaurora.org>

Conflicts:
	drivers/gpu/msm/kgsl_device.h
staging: android: ashmem: Avoid deadlock with mmap/shrink

Both ashmem_mmap and ashmem_shrink take the ashmem_lock. It may
be possible for ashmem_mmap to invoke ashmem_shrink:

-000|mutex_lock(lock = 0x0)
-001|ashmem_shrink(?, sc = 0x0) <--- try to take ashmem_mutex again
-002|shrink_slab(shrink = 0xDA5F1CC0, nr_pages_scanned = 0, lru_pages
-002|=
-002|124)
-003|try_to_free_pages(zonelist = 0x0, ?, ?, ?)
-004|__alloc_pages_nodemask(gfp_mask = 21200, order = 1, zonelist =
-004|0xC11D0940,
-005|new_slab(s = 0xE4841E80, ?, node = -1)
-006|__slab_alloc.isra.43.constprop.50(s = 0xE4841E80, gfpflags =
-006|2148925462, ad
-007|kmem_cache_alloc(s = 0xE4841E80, gfpflags = 208)
-008|shmem_alloc_inode(?)
-009|alloc_inode(sb = 0xE480E800)
-010|new_inode_pseudo(?)
-011|new_inode(?)
-012|shmem_get_inode(sb = 0xE480E800, dir = 0x0, ?, dev = 0, flags =
-012|187)
-013|shmem_file_setup(?, ?, flags = 187)
-014|ashmem_mmap(?, vma = 0xC5D64210) <---- Acquire ashmem_mutex
-015|mmap_region(file = 0xDF8E2C00, addr = 1772974080, len = 233472,
-015|flags = 57,
-016|sys_mmap_pgoff(addr = 0, len = 230400, prot = 3, flags = 1, fd =
-016|157, pgoff
-017|ret_fast_syscall(asm)
-->|exception
-018|NUR:0x40097508(asm)
---|end of frame

Avoid this deadlock by using mutex_trylock in ashmem_shrink; if the mutex
is already held, do not attempt to shrink.

Change-Id: I222bbf55856d5849da813b730de0636c80966c8e
Reported-by: Matt Wagantall <mattw@codeaurora.org>
Reported-by: Syed Rameez Mustafa <rameezmustafa@codeaurora.org>
Reported-by: Osvaldo Banuelos <osvaldob@codeaurora.org>
Reported-by: Subbaraman Narayanamurthy <subbaram@codeaurora.org>
Signed-off-by: Laura Abbott <lauraa@codeaurora.org>
sched: Fix migration thread runtime bogosity

commit 8f6189684eb4e85e6c593cd710693f09c944450a upstream.

Make stop scheduler class do the same accounting as other classes,

Migration threads can be caught in the act while doing exec balancing,
leading to the below due to use of unmaintained ->se.exec_start.  The
load that triggered this particular instance was an apparently out of
control heavily threaded application that does system monitoring in
what equated to an exec bomb, with one of the VERY frequently migrated
tasks being ps.

%CPU   PID USER     CMD
99.3    45 root     [migration/10]
97.7    53 root     [migration/12]
97.0    57 root     [migration/13]
90.1    49 root     [migration/11]
89.6    65 root     [migration/15]
88.7    17 root     [migration/3]
80.4    37 root     [migration/8]
78.1    41 root     [migration/9]
44.2    13 root     [migration/2]

Signed-off-by: Mike Galbraith <mgalbraith@suse.de>
Signed-off-by: Peter Zijlstra <a.p.zijlstra@chello.nl>
Link: http://lkml.kernel.org/r/1344051854.6739.19.camel@marge.simpson.net
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Cc: Steven Rostedt <rostedt@goodmis.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
ASoC: msm: Fix AUXPCM Sample Rate settings

Fix strings for defining sample rates of AUXPCM.
This wrong string causes mixer settings to fail
for anything other than default 8000.

Bug: 13763881

Signed-off-by: Ravi Kumar Alamanda <ralama@codeaurora.org>
Handle 'sk' being NULL in UID-based routing.

Bug: 15413527
Change-Id: If33bebb7b52c0ebfa8dac2452607bce0c2b0faa0
Signed-off-by: Sreeram Ramachandran <sreeram@google.com>
cgroup: Take css_set_lock from cgroup_css_sets_empty()

As indicated in the comment above cgroup_css_sets_empty it needs the
css_set_lock. But neither of the 2 call points have it, so rather then fixing
the callers just take the lock inside cgroup_css_sets_empty().

Signed-off-by: Hans de Goede <hdegoede@redhat.com>
Change-Id: If7aea71824f6d0e3f2cc6c1ce236c3ae6be2037b
cgroup: Fix use after free of cgrp (cgrp->css_sets)

Running a 3.4 kernel + Fedora-18 (systemd) userland on my Allwinner A10
(arm cortex a8), I'm seeing repeated, reproducable list_del list corruption
errors when build with CONFIG_DEBUG_LIST, and the backtrace always shows
free_css_set_work as the function making the problematic list_del call.

I've tracked this doen to a use after free of the cgrp struct, specifically
of the cgrp->css_sets list_head, which gets cleared by free_css_set_work.

Since free_css_set_work runs form a workqueue, it is possible for it to not be
done with clearing the list when the cgrp gets free-ed. To avoid this the code
adding the links increases cgrp->count, and the freeing code running from the
workqueue decreases cgrp->count *after* doing list_del, and then if the count
goes to 0 calls cgroup_wakeup_rmdir_waiter().

However cgroup_rmdir() is missing a check for cgrp->count != 0, causing it
to still continue with the rmdir (which leads to the free-ing of the cgrp),
before free_css_set_work is done. Sometimes the free-ed memory is re-used
before free_css_set_work gets around to unlinking link->cgrp_link_list,
triggering the list_del list corruption messages.

This patch fixes this by properly checking for cgrp->count != 0 and waiting
for the cgroup_rmdir_waitq in that case.

Change-Id: I9dbc02a0a75d5dffa1b65d67456e00139dea57c3
Signed-off-by: Hans de Goede <hdegoede@redhat.com>
Enable setting security contexts on rootfs inodes.

rootfs (ramfs) can support setting of security contexts
by userspace due to the vfs fallback behavior of calling
the security module to set the in-core inode state
for security.* attributes when the filesystem does not
provide an xattr handler.  No xattr handler required
as the inodes are pinned in memory and have no backing
store.

This is useful in allowing early userspace to label individual
files within a rootfs while still providing a policy-defined
default via genfs.

Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
mm: Increase number of GFP masks

The __GFP_CMA mask is now placed after all available GFP masks.
With this we need to increase the total number of GFP flags.
Do so accordingly.

Bug: 17626969
CRs-Fixed: 648978
Change-Id: I53f5f064ac16a50ee10c84ff2bb50fdb7e085bd0
Signed-off-by: Laura Abbott <lauraa@codeaurora.org>
Signed-off-by: Naveen Ramaraj <nramaraj@codeaurora.org>
Revert "msm: vidc: update with fixes and enhancements"

This reverts commit 8132b521053d2c8b73e279748b3618dff4a0dc10.
Screwed up piece of crap, stick to what we have...

Signed-off-by: Rashed Abdel-Tawab <rashed@linux.com>