ExynosVideoEncodeAccelerator

content/common/sandbox_seccomp_bpf_linux.cc

Index: content/common/sandbox_seccomp_bpf_linux.cc
diff --git a/content/common/sandbox_seccomp_bpf_linux.cc b/content/common/sandbox_seccomp_bpf_linux.cc
index 5d8c42a951d07c7cf25818592f2a98d74d992f8d..3217564e44337f4a75f12fefc51abd83c2212f6b 100644
--- a/content/common/sandbox_seccomp_bpf_linux.cc
+++ b/content/common/sandbox_seccomp_bpf_linux.cc
@@ -1794,13 +1794,18 @@ void AddArmMaliGpuWhitelist(std::vector<std::string>* read_whitelist,
   static const char kDevMfcDecPath[] = "/dev/mfc-dec";
   static const char kDevGsc1Path[] = "/dev/gsc1";
 
+  // Devices needed for video encode acceleration on ARM.
+  static const char kDevMfcEncPath[] = "/dev/mfc-enc";

[jln (very slow on Chromium), 2013/08/14 04:30:17]

Is there no way that this device could be opened, once, prior to engaging the
sandbox?

Same question for kDevMfcDecPath[]. Since the code to use this seems to be in
Chromium, hopefully it could be "Pre warmed" ?

See WarmUpSandbox() in gpu_main.cc.

We really need to remove complexity from the sandbox and instead have
sandbox-friendly code.

[sheu, 2013/08/14 05:44:44]

Yep.

Every time you open the device you get another encoder/decoder context.  We need
a new context for each encode/decode.

+
   read_whitelist->push_back(kMali0Path);
   read_whitelist->push_back(kDevMfcDecPath);
   read_whitelist->push_back(kDevGsc1Path);
+  read_whitelist->push_back(kDevMfcEncPath);
 
   write_whitelist->push_back(kMali0Path);
   write_whitelist->push_back(kDevMfcDecPath);
   write_whitelist->push_back(kDevGsc1Path);
+  read_whitelist->push_back(kDevMfcEncPath);

[hshi1, 2013/08/14 01:21:35]

Did you mean write_whitelist->push_back(kDevMfcEncPath); ?

[jln (very slow on Chromium), 2013/08/14 04:30:17]

If this works fine without write access, please remove this line entirely, but
that seems very surprising.

[sheu, 2013/08/14 05:44:44]

Lulz.  I forgot to actually remove the --no-sandbox flag when testing.

Tested now.

 }
 
 void AddArmTegraGpuWhitelist(std::vector<std::string>* read_whitelist,