| Commit message (Collapse) | Author | Age | Files | Lines |
| |
|
|
|
|
|
|
|
|
|
|
|
|
| |
Disable the cpaccess64 driver.
This driver allows user space access to cpu registers.
With this driver enabled, a CTS test causes the
system to crash.
CRs-Fixed: 968777
Bug: 32068683
Change-Id: I3ebe7220c7ca68a25b781c2e836a735d11dcaf08
Signed-off-by: Bruce Levy <blevy@codeaurora.org>
Signed-off-by: Siqi Lin <siqilin@google.com>
(am from https://source.codeaurora.org/quic/la/kernel/msm-3.18/commit/?h=LA.HB.0.3&id=452d2ad331d20b19e8a0768c4b6e7fe1b65abe8f)
|
| |
|
|
|
| |
Bug: 28279646
Change-Id: I49487db3da28cf15174d9bc0c7aedea5b698492b
|
| |\
| |
| |
| |
| |
| | |
https://android.googlesource.com/kernel/msm into cm-14.1
Android 7.1.1 Release 0.52 (N4F26W,seed)
|
| | |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| | |
Disable the cpaccess64 driver.
This driver allows user space access to cpu registers.
With this driver enabled, a CTS test causes the
system to crash.
CRs-Fixed: 968777
Bug: 32068683
Change-Id: I3ebe7220c7ca68a25b781c2e836a735d11dcaf08
Signed-off-by: Bruce Levy <blevy@codeaurora.org>
Signed-off-by: Siqi Lin <siqilin@google.com>
(am from https://source.codeaurora.org/quic/la/kernel/msm-3.18/commit/?h=LA.HB.0.3&id=452d2ad331d20b19e8a0768c4b6e7fe1b65abe8f)
|
| | |
| |
| |
| |
| | |
Bug: 28279646
Change-Id: I693d17fe65acca6962cc0f848c351673037c1319
|
| | |
| |
| |
| | |
Change-Id: I1868be936fc8e1cf2021ccd35c67458d3eca2a9f
|
| | |
| |
| |
| | |
Change-Id: Ic96bae1c82ae3e7be92b5926fbb9c501ae51ce39
|
| | |
| |
| |
| |
| |
| |
| |
| | |
Change-Id: I75fcba66a9839c3be8dc11ced25105c87ac4ee65
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
Git-commit: b2497fc3057ae27db9aa29579f16ae5afb6d6d08
Git-repo: https://android.googlesource.com/kernel/common.git
Signed-off-by: Kaushal Kumar <kaushalk@codeaurora.org>
|
| | |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| | |
iterate_dir(): new helper, replacing vfs_readdir().
struct dir_context: contains the readdir callback (and will get more stuff
in it), embedded into whatever data that callback wants to deal with;
eventually, we'll be passing it to ->readdir() replacement instead of
(data,filldir) pair.
Change-Id: I2285e5832093a0bbd7dd42b5e4cf26d62703c34e
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
Git-commit: c301a0e047e401d41b26db1009d08e088ae2365a
Git-repo: https://android.googlesource.com/kernel/common.git
Signed-off-by: Kaushal Kumar <kaushalk@codeaurora.org>
|
| | |
| |
| |
| | |
Change-Id: I3853164daae14f3a722cc19fdc45073f982dfd8c
|
| | |
| |
| |
| | |
Change-Id: Iff895d7dc67ca6639222281aefefc20de3def0d1
|
| | |
| |
| |
| | |
Change-Id: I9e170d9357ece8804de96be2f900edb3d9a12017
|
| |\|
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| | |
https://android.googlesource.com/kernel/msm into cm-14.0
616a355 Remove unneeded .a files for ft8716 driver by Robb Glasser · 4 weeks ago android-msm-seed-3.10-nougat android-7.0.0_r0.21
79abacc Revert "Revert "add new tp driver and lcd driver"" by Robb Glasser · 4 weeks ago
1e6834e Revert "add new tp driver and lcd driver" by Robb Glasser · 5 weeks ago
aac1b45 net: ipv6: Fix ping to link-local addresses. by Lorenzo Colitti · 8 weeks ago
7c1b6fb ipv6: fix endianness error in icmpv6_err by Hannes Frederic Sowa · 4 months ago
37734ea add new tp driver and lcd driver by yanghong1 · 7 weeks ago
1f38892 ANDROID: binder: Add strong ref checks by Arve Hjønnevåg · 9 weeks ago
56934a5 ANDROID: binder: Clear binder and cookie when setting handle in flat binder struct by Arve Hjønnevåg · 8 weeks ago
c9a7674 ASoC: msm: qdsp6v2: Add size check in audio cal ioctl by vivek mehta · 3 months ago
1742f13 UPSTREAM: arm64: perf: reject groups spanning multiple HW PMUs by Suzuki K. Poulose · 1 year, 7 months ago
7dc0b6d binder: prevent kptr leak by using %pK format specifier by Ariel Yin · 7 weeks ago
bd49595 BACKPORT: Bluetooth: Fix potential NULL dereference in RFCOMM bind callback by Jaganath Kanakkassery · 1 year, 5 months ago
59cdc27 qcacld-2.0: Remove the support for iw_set_priv ioctl by Ariel Yin · 7 weeks ago
df5503f qseecom: validate the inputs of __qseecom_send_modfd_resp by Ariel Yin · 7 weeks ago
f71e28c input: synaptics: allocate heap memory for temp buf by Ariel Yin · 6 weeks ago
90ac992 msm: camera: sensor: Fix use after free condition by Ariel Yin · 7 weeks ago
25c9ecb arm64: dma-mapping: always clear allocated buffers by Ariel Yin · 7 weeks ago
9df7240 wlan: Remove the support for setwpaie ioctl by Ariel Yin · 7 weeks ago
b0a00a2 BACKPORT: tcp: make challenge acks less predictable by Eric Dumazet · 3 months ago
9ec7e19 msm: crypto: Fix integer overflow check in qcedev driver by Biswajit Paul · 10 weeks ago
48052f2 msm: mdss: Fix to validate data copied from user space by Naseer Ahmed · 9 weeks ago
31e62b1 msm: camera: restructure data handling to be more robust by Ariel Yin · 7 weeks ago
9cbae20 ASoC: msm-lsm-client: free lsm client data in msm_lsm_close by Ariel Yin · 7 weeks ago
364625b staging: android: Change %p to %pK in debug messages by Ariel Yin · 7 weeks ago
5458c42 misc: qcom: qdsp6v2: Add missing initialization by vivek mehta · 8 weeks ago
1e84157 wlan: fix buffer overflow in linkspeed ioctl by Ariel Yin · 7 weeks ago
00c1b70 msm: mdss: Correct block id check for mdss_mdp_misr_table by Ariel Yin · 7 weeks ago
21c7f58 qcacld-2.0: Resolve buffer overflow issue while processing GET_CFG IOCTL by Hanumantha Reddy Pothula · 6 months ago
40ab0c1 wcnss: Avoid user buffer overloading for write cal data by Ariel Yin · 7 weeks ago
49082cb UPSTREAM: net: Fix use after free in the recvmmsg exit path by Arnaldo Carvalho de Melo · 7 months ago
|
| | |
| |
| |
| |
| |
| | |
Bug: 31088350
This reverts commit 1e6834e63a01dd6392aced1d93b72d709e371ce7.
|
| | |
| |
| |
| |
| |
| |
| |
| | |
Change breaks panorama mode on the camera.
Bug: 31173635
This reverts commit 37734ea0cf9a7b37eaac367d77aaaeac6200a905.
|
| | |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| | |
add second LCD truly r61350 panel driver.
add new tp driver,tp FW is 0x3
fix esd check bug.
fix esd check ecc error problem with panel vendor.
fix Himax TP doesn't work problem.
remove TP esd check log
Change-Id: I098f8c7df5cdfac68e4c87d8c3dabe2db82dd7b6
|
| | |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| | |
The perf core implicitly rejects events spanning multiple HW PMUs, as in
these cases the event->ctx will differ. However this validation is
performed after pmu::event_init() is called in perf_init_event(), and
thus pmu::event_init() may be called with a group leader from a
different HW PMU.
The ARM64 PMU driver does not take this fact into account, and when
validating groups assumes that it can call to_arm_pmu(event->pmu) for
any HW event. When the event in question is from another HW PMU this is
wrong, and results in dereferencing garbage.
This patch updates the ARM64 PMU driver to first test for and reject
events from other PMUs, moving the to_arm_pmu and related logic after
this test. Fixes a crash triggered by perf_fuzzer on Linux-4.0-rc2, with
a CCI PMU present:
Bad mode in Synchronous Abort handler detected, code 0x86000006 -- IABT (current EL)
CPU: 0 PID: 1371 Comm: perf_fuzzer Not tainted 3.19.0+ #249
Hardware name: V2F-1XV7 Cortex-A53x2 SMM (DT)
task: ffffffc07c73a280 ti: ffffffc07b0a0000 task.ti: ffffffc07b0a0000
PC is at 0x0
LR is at validate_event+0x90/0xa8
pc : [<0000000000000000>] lr : [<ffffffc000090228>] pstate: 00000145
sp : ffffffc07b0a3ba0
[< (null)>] (null)
[<ffffffc0000907d8>] armpmu_event_init+0x174/0x3cc
[<ffffffc00015d870>] perf_try_init_event+0x34/0x70
[<ffffffc000164094>] perf_init_event+0xe0/0x10c
[<ffffffc000164348>] perf_event_alloc+0x288/0x358
[<ffffffc000164c5c>] SyS_perf_event_open+0x464/0x98c
Code: bad PC value
Also cleans up the code to use the arm_pmu only when we know
that we are dealing with an arm pmu event.
Cc: Will Deacon <will.deacon@arm.com>
Acked-by: Mark Rutland <mark.rutland@arm.com>
Acked-by: Peter Ziljstra (Intel) <peterz@infradead.org>
Signed-off-by: Suzuki K. Poulose <suzuki.poulose@arm.com>
Signed-off-by: Will Deacon <will.deacon@arm.com>
(cherry picked from commit 8fff105e13041e49b82f92eef034f363a6b1c071)
Bug: 29508816
Change-Id: I6fa1860d561fbcdf88101eea319815eb4b8e3e29
|
| | |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| | |
[Upstream commit 6829e274a623187c24f7cfc0e3d35f25d087fcc5]
Buffers allocated by dma_alloc_coherent() are always zeroed on Alpha,
ARM (32bit), MIPS, PowerPC, x86/x86_64 and probably other architectures.
It turned out that some drivers rely on this 'feature'. Allocated buffer
might be also exposed to userspace with dma_mmap() call, so clearing it
is desired from security point of view to avoid exposing random memory
to userspace. This patch unifies dma_alloc_coherent() behavior on ARM64
architecture with other implementations by unconditionally zeroing
allocated buffer.
CRs-Fixed: 1041735
Change-Id: I74bf024e0f603ca8c0b05430dc2ee154d579cfb2
Cc: <stable@vger.kernel.org> # v3.14+
Signed-off-by: Marek Szyprowski <m.szyprowski@samsung.com>
Signed-off-by: Will Deacon <will.deacon@arm.com>
Signed-off-by: Sasha Levin <sasha.levin@oracle.com>
Git-commit: a142e9641dcbead2c8845c949ad518acac96ed28
Git-repo:
git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
[lmark@codeaurora.org: resolve merge conflicts]
Signed-off-by: Liam Mark <lmark@codeaurora.org>
|
| | |
| |
| |
| | |
Change-Id: I6a2738014bbeeb48767d3d7cae367c36e6a1b2c4
|
| | |
| |
| |
| | |
Change-Id: I7ef9c59be137192bcbaf2ac8935b7c8f6186c4df
|
| |/
|
|
|
|
|
|
|
| |
Change-Id: I438d11f82ae2c33b9b69416b8e2f974c39303de4
Conflicts:
arch/arm/boot/dts/qcom/crackling/msm8916-crackling.dtsi
arch/arm/boot/dts/qcom/crackling/msm8916-pinctrl-crackling.dtsi
arch/arm/boot/dts/qcom/msm8916-crackling.dts
|
| |
|
|
|
|
| |
Bug: 9580643
Bug: 30298058
Change-Id: Ib66204868d610345960a8818e291d75edac833f0
|
| |
|
|
| |
Change-Id: I0b8cc24f8cd4d1bbeddebc6a8f25f211bd5e17be
|
| |
|
|
|
| |
Bug: 29119870
Change-Id: I6a1541a1691f23722364b901f6245209ca809762
|
| |
|
|
|
|
|
| |
Size was too small for seed. Increasing it to remove distortion.
Bug: 29322545
Change-Id: Ifd8fbbcd95ca24fb4af258488c9219fb4596c8ff
|
| |
|
|
|
|
|
|
| |
This reverts commit f72129c2203e0e7f4381411a9060c6d46f71ce1b.
Bug: 28557020
Change-Id: I4e5bde6b9ee86ce27692add6da7e4dc3dc9751d6
Signed-off-by: Thierry Strudel <tstrudel@google.com>
|
| |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
During a perf_event_enable, kernel/events/core.c calls pmu->add() which
is platform implementation(arch/arm/kernel/perf_event.c). Due to the
duplicate constraints, arch/arm/mach-msm/perf_event_msm_krait_l2.c
drivers marks the event as OFF but returns TRUE to perf_event.c which
goes ahead and allocates the hw_event and enables it.
Since event is marked OFF, kernel events core will try to enable this event
again during next perf_event_enable. Which results in same event enabled
on multiple hw_events. But during the perf_release, event struct is freed
and only one hw_event is released. This results in dereferencing the
invalid pointer and hence the crash.
Fix this by returning error in case of constraint event duplicate. Hence
avoiding the same event programmed on multiple hw event counters.
Change-Id: Ia3360be027dfe87ac753191ffe7e0bc947e72455
Signed-off-by: Arun KS <arunks@codeaurora.org>
Signed-off-by: Veena Sambasivan <veenas@codeaurora.org>
|
| |
|
|
|
|
|
|
|
| |
No, WV L1 - so reduce qseecom region accordingly.
Original splash screen assumes worst case allocation, right-size
it for 720P display that we have on seed.
Change-Id: Id3e9c8d29dfd83cb17a1eebe2f9fe937635717d4
Signed-off-by: Ajay Dudani <adudani@google.com>
|
| |
|
|
|
|
|
|
| |
seed does not support widevine level 1, nor wfd; drop these CMA
secure buffers to reclaim memory.
Change-Id: I5b3404a8433ee5ee8e5753b4f81b3aab7af1c03f
Signed-off-by: Ajay Dudani <adudani@google.com>
|
| |
|
|
|
|
|
|
|
| |
Use 4KB block device size instead of 1KB which is ideal for emmc
Reduce cached fragments to reduce memory pressure
BUG: 28096242
Signed-off-by: Mohamad Ayyash <mkayyash@google.com>
Change-Id: I470b74224b62d506db4cdbe2c4012a14324e9a0f
|
| |
|
|
|
| |
bug:28026495
Change-Id: I4f8d247e5bc999a0cf6faca1fd71710d7e1c47fb
|
| |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
add booyi otm1287 sec panel driver init code
Touchscreen: support booyi-himax module
- firmware version: 0x15
- Increase i2c rate for touchscreen
- add 10 point
- fix tp bug
Change-Id: I3e08bec2c5c59c4f58d977a835985a64fa6c0fe7
Signed-off-by: yanghong1 <yanghong1@longcheer.net>
|
| |
|
|
|
|
|
|
|
| |
Make the various timeout values HZ agnostic by using the proper
macros and values instead.
Change-Id: I6b75b3f7795e6670220b1eec3df9a03b75b8c8f9
Signed-off-by: Suman Tatiraju <sumant@codeaurora.org>
Signed-off-by: Ajay Dudani <adudani@codeaurora.org>
|
| |
|
|
|
| |
Change-Id: I56ccde3bd7967c3126ad61b6b5380881fa609318
Signed-off-by: Ajay Dudani <adudani@google.com>
|
| |
|
|
|
| |
Change-Id: Idbfdf0a3b29b575650dfdfe15fde1dae4a921ca6
Signed-off-by: Ajay Dudani <adudani@google.com>
|
| |
|
|
|
| |
Change-Id: I8043c781177411827939c053c1fa2bfcf4b7991e
Signed-off-by: Ajay Dudani <adudani@google.com>
|
| |
|
|
|
| |
Change-Id: I32403554d6ee48042967a88916639b01c7df53e3
Signed-off-by: Ajay Dudani <adudani@google.com>
|
| |
|
|
|
|
|
|
| |
* For lack of optimized firmware, revert back to original firmware sizes
* Drop continous splash screen to save memory
* Update maxx, maxy display resolution
Change-Id: Ie58f0d31d95474b78bf7f8005d8a07a2505e6ee0
|
| |
|
|
|
| |
Change-Id: Ifbe18943564ba5ceda2298b670dd37b132b663e7
Signed-off-by: Ajay Dudani <adudani@google.com>
|
| |
|
|
|
|
|
|
|
| |
Remove the buspm module from msm_bus since it adds
no functionality to the bus bandwidth aggregation
driver. It is a loadable module used for profiling
purposes.
Change-Id: I125cc734988101b9ae400be1d2fcb17852473191
|
| |
|
|
|
|
| |
Bug: 27794037
Change-Id: Ibbc085b31be037a1970dcf486dee4d422131c581
Signed-off-by: Daniel Rosenberg <drosen@google.com>
|
| |
|
|
|
| |
Change-Id: I033b91d1df7e8eb3463141a993dfa6096914d3c9
Signed-off-by: Daniel Rosenberg <drosen@google.com>
|
| |
|
|
|
|
|
|
|
|
|
|
|
| |
(cherry picked from commit https://lkml.org/lkml/2016/2/4/833)
Replace calls to get_random_int() followed by a cast to (unsigned long)
with calls to get_random_long(). Also address shifting bug which, in case
of x86 removed entropy mask for mmap_rnd_bits values > 31 bits.
Bug: 26963541
Signed-off-by: Daniel Cashman <dcashman@android.com>
Signed-off-by: Daniel Cashman <dcashman@google.com>
Change-Id: Ie577b21a0678cf4b21eae06bddd8ccb27cbe70ff
|
| |
|
|
|
| |
Change-Id: I1167c4850f144dcc087c8c2e0b9f096c68e36b0d
Signed-off-by: Ajay Dudani <adudani@google.com>
|
| |
|
|
| |
Signed-off-by: Ajay Dudani <adudani@google.com>
|
| |
|
|
| |
Signed-off-by: Ajay Dudani <adudani@google.com>
|
| |
|
|
| |
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
|
| |
|
|
|
|
|
|
|
|
|
|
|
| |
New method - ->iterate(file, ctx). That's the replacement for ->readdir();
it takes callback from ctx->actor, uses ctx->pos instead of file->f_pos and
calls dir_emit(ctx, ...) instead of filldir(data, ...). It does *not*
update file->f_pos (or look at it, for that matter); iterate_dir() does the
update.
Note that dir_emit() takes the offset from ctx->pos (and eventually
filldir_t will lose that argument).
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
|
| |
|
|
|
|
|
|
|
|
|
| |
iterate_dir(): new helper, replacing vfs_readdir().
struct dir_context: contains the readdir callback (and will get more stuff
in it), embedded into whatever data that callback wants to deal with;
eventually, we'll be passing it to ->readdir() replacement instead of
(data,filldir) pair.
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
|
| |
|
|
|
|
| |
BUG=26976388
Change-Id: Ic85f75b6a6f1a9a6db2dd2fe2dc7af6fd1a5fcd6
|