msm: mdp: Add retire fence

Generate the retire fence with a +1 offset from the current
release timeline. This would mean that the retire fence of the
last frame is signaled when the current frame has transferred.

Signed-off-by: Naseer Ahmed <naseer@codeaurora.org>
msm: mdss: expose MDP capabilities through sysfs

User space applications currently rely on special private ioctl to query
capabilities of MDP driver. As more capabilities are added it becomes
more difficult to have to extend and maintain header file compatibility.
Provide a sysfs node which can be queried for MDP capabilities.

Change-Id: I59efb29bf465083a1ef65c0419226788b44085b1
Signed-off-by: Adrian Salido-Moreno <adrianm@codeaurora.org>
Signed-off-by: Shalabh Jain <shalabhj@codeaurora.org>
mdss: Fix writeback

Fix retire fence threshold for writeback.
Notify when writeback buf is not available.

Signed-off-by: Adrian Salido-Moreno <adrianm@codeaurora.org>
Signed-off-by: Naseer Ahmed <naseer@codeaurora.org>
mdss: Validate sync timeline object before inc

An earlier commit - 4b7db574f061e13857e3780ceddd24ab0681628b
removed this by mistake. Restore this check.

Bug: 10953656
Signed-off-by: Naseer Ahmed <naseer@codeaurora.org>
msm: mdss: create new vsync timeline for retire fences

Retire fence timeline should follow the actual panel vsync more closely.
In case of command mode the panel vsync can be different from buffer
release timeline. To handle the panel vsyncs better, create a new
timeline for the retire fence signaling.

Change-Id: If8a1eb717d733ca215275a8be4f0054091dbc147
Signed-off-by: Adrian Salido-Moreno <adrianm@codeaurora.org>
msm: mdss: increase retire fence timeline with retire count

Account for cases where multiple retire fences are acquire before
previous ones are signaled. It may happen that the next retire fence is
acquired before the current one has been signaled, we want to signal on
the next vsync instead of the current one.

Change-Id: Ieff3115f9b10ea1a917eebdb6a32e44bc2e71c73
Signed-off-by: Adrian Salido-Moreno <adrianm@codeaurora.org>
video: msm: mdss: am54272844ee: merge fixup
msm: vibrator: Add min/max voltage sysfs entries

Change-Id: Icea99bb76aab73c5ab5bdb0112fbdc081bc62ba6
Signed-off-by: Scott Mertz <smertz@cyngn.com>
msm: vidc: fix cluster control

Change-Id: I5fd327c6897016c8c13b002e3e03603a7e3cfc66
net-fixes: flow_dissector: prevent an infinite loop (CVE-2013-4348)

Jason Wang found that a malicious packet could make skb_flow_dissect()
loop forever. We must check that IP header has a valid ihl to avoid
this loop. It involves IPIP encapsulation and ihl = 0 to trigger.

Given this bug is critical, I cooked a patch before having
a fix in upstream kernel.

Tested:

 Compiled/booted
 Ran some tests on bnx2x and explicitely disabled hardware provided rxhash
 ethtool -K eth1 rxhash off
 ethtool -K eth2 rxhash off

Google-Bug-Id: 11465355
Effort: net-fixes
Change-Id: I813e4dc48cecb05f8edfa218304e1f13fd764323
Signed-off-by: Ed Tam <etam@google.com>
Signed-off-by: Patrick Tjin <pattjin@google.com>
msm: jpeg: Handle ERESTARTSYS properly

ERESTARTSYS return code for wait_* functions should be
propogated all the way to ioctl call.

Bug: 11856490
Signed-off-by: Shuzhen Wang <shuzhenw@codeaurora.org>
Revert "msm: jpeg: Handle ERESTARTSYS properly"

This reverts commit b90c643341b58ba18877aa0181defdb57b3225c6.

Change-Id: I1a25a1211d0b897c0dda8b75ac53b42f61f4ce6a
Revert "Revert "msm: jpeg: Handle ERESTARTSYS properly""

This reverts commit 8e37eb274b986628da2ebad0947a52c7c0325225.

Change-Id: I4b33e161d379445a008196ea4a93b4c919d4a97b
sync: Fix a race condition between release_obj and print_obj

Before this change, a timeline would only be removed from the timeline
list *after* the sync driver had its release_obj() called. However, the
driver's release_obj() may free resources needed by print_obj().

Although the timeline list is locked when print_obj() is called, it is
not locked when release_obj() is called. If one CPU was in print_obj()
when another was in release_obj(), the print_obj() may make unsafe
accesses.

It is not actually necessary to hold the timeline list lock when calling
release_obj() if the call is made after the timeline is unlinked from
the list, since there is no possibility another thread could be in --
or enter -- print_obj() for that timeline.

This change moves the release_obj() call to after the timeline is
unlinked, preventing the above race from occurring.

Signed-off-by: Alistair Strachan <alistair.strachan@imgtec.com>
msm: camera_v2: Handle vfe camif irq before axi irq

For each irq status, axi bits (image/stats) could be set as well
as camif sof bit. In this case, axi bits should be handled first
to better reflect the order of events: buf done of frame N before
SOF of frame N+1.

Bug: 11614033
Change-Id: Ie40552678306ba948bfa7dd791a01a38e38a4c31
Signed-off-by: Shuzhen Wang <shuzhenw@codeaurora.org>
seq_file: always update file->f_pos in seq_lseek()

This issue was first pointed out by Jiaxing Wang several months ago, but no
further comments:
https://lkml.org/lkml/2013/6/29/41

As we know pread() does not change f_pos, so after pread(), file->f_pos
and m->read_pos become different. And seq_lseek() does not update file->f_pos
if offset equals to m->read_pos, so after pread() and seq_lseek()(lseek to
m->read_pos), then a subsequent read may read from a wrong position, the
following program produces the problem:

    char str1[32] = { 0 };
    char str2[32] = { 0 };
    int poffset = 10;
    int count = 20;

    /*open any seq file*/
    int fd = open("/proc/modules", O_RDONLY);

    pread(fd, str1, count, poffset);
    printf("pread:%s\n", str1);

    /*seek to where m->read_pos is*/
    lseek(fd, poffset+count, SEEK_SET);

    /*supposed to read from poffset+count, but this read from position 0*/
    read(fd, str2, count);
    printf("read:%s\n", str2);

out put:
pread:
 ck_netbios_ns 12665
read:
 nf_conntrack_netbios

/proc/modules:
nf_conntrack_netbios_ns 12665 0 - Live 0xffffffffa038b000
nf_conntrack_broadcast 12589 1 nf_conntrack_netbios_ns, Live 0xffffffffa0386000

So we always update file->f_pos to offset in seq_lseek() to fix this issue.

cherry-picked from https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/fs/seq_file.c?id=05e16745c0c471bba313961b605b6da3b21a853d

Signed-off-by: Jiaxing Wang <hello.wjx@gmail.com>
Signed-off-by: Gu Zheng <guz.fnst@cn.fujitsu.com>
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>

Conflicts:
	fs/seq_file.c

Change-Id: If419b92498e2c3e08669a4342e9b9ebf99ad3768
Signed-off-by: Devin Kim <dojip.kim@lge.com>
seq_file: always clear m->count when we free m->buf

Once we'd freed m->buf, m->count should become zero - we have no valid
contents reachable via m->buf.

cherry-picked from https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/fs/seq_file.c?id=801a76050bcf8d4e500eb8d048ff6265f37a61c8

Change-Id: I4c1d3e69db4ecf5362e2a5d05bfd7db754dc6dc6
Reported-by: Charley (Hao Chuan) Chu <charley.chu@broadcom.com>
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Devin Kim <dojip.kim@lge.com>
fs/dcache.c: Fix the too small buffer for dname

temp[64] is used for internal temporary buffer in dynamic_dname().
This is for dname. But It's too small. dname's size may be > 64.
In that case, it returns as -ENAMETOOLONG. So Increase the buffer size
to 256 for avoiding this issue.

The following was caused by the small buffer.
WARNING: at /kernel/mm/page_alloc.c:2470 __alloc_pages_nodemask+0x24c/0x938()
CPU: 2 PID: 505 Comm: android.bg Not tainted 3.10.0-g2f73780-00003-g2ff41d9-dirty #13
[<c010ba3c>] (unwind_backtrace+0x0/0x11c) from [<c0109cac>] (show_stack+0x10/0x14)
[<c0109cac>] (show_stack+0x10/0x14) from [<c01939a0>] (warn_slowpath_common+0x48/0x68)
[<c01939a0>] (warn_slowpath_common+0x48/0x68) from [<c0193a7c>] (warn_slowpath_null+0x18/0x20)
[<c0193a7c>] (warn_slowpath_null+0x18/0x20) from [<c0222454>] (__alloc_pages_nodemask+0x24c/0x938)
[<c0222454>] (__alloc_pages_nodemask+0x24c/0x938) from [<c0222b50>] (__get_free_pages+0x10/0x24)
[<c0222b50>] (__get_free_pages+0x10/0x24) from [<c024faf8>] (kmalloc_order_trace+0x24/0xf0)
[<c024faf8>] (kmalloc_order_trace+0x24/0xf0) from [<c024fe20>] (__kmalloc+0x30/0x244)
[<c024fe20>] (__kmalloc+0x30/0x244) from [<c02723c8>] (seq_read+0x270/0x464)
[<c02723c8>] (seq_read+0x270/0x464) from [<c0256a18>] (vfs_read+0xa4/0x134)
[<c0256a18>] (vfs_read+0xa4/0x134) from [<c0256de8>] (SyS_read+0x38/0x68)
[<c0256de8>] (SyS_read+0x38/0x68) from [<c0106140>] (ret_fast_syscall+0x0/0x30)

Change-Id: I74f5217ba3c4be73e91f33f900f1f0c26810cc05
Signed-off-by: Devin Kim <dojip.kim@lge.com>
msm: thermal: Fix kernel thermal sysfs nodes permission

Fix the permission of the sysfs nodes exposed by the kernel
thermal monitor (KTM).The KTM sysfs nodes had wrong permissions
defined, which restricted access to thermal-engine/thermald with
SELinux policy. The sysfsnodes permissions are fixed in order to
allow access to thermal userspace processes with SELinux policy.

Bug: 12450712

Change-Id: I6f088f0bca889acbf0fd6a1d1dac09edc89c366c
Signed-off-by: Ram Chandrasekar <rkumbako@codeaurora.org>
Signed-off-by: Mekala Natarajan <mekalan@codeaurora.org>
SELinux: include definition of new capabilities

The kernel has added CAP_WAKE_ALARM and CAP_EPOLLWAKEUP.  We need to
define these in SELinux so they can be mediated by policy.

Change-Id: I8a3e0db15ec5f4eb05d455a57e8446a8c2b484c2
Signed-off-by: Eric Paris <eparis@redhat.com>
Signed-off-by: James Morris <james.l.morris@oracle.com>
[sds: rename epollwakeup to block_suspend to match upstream merge]
Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>