USB controller may access the dTD one more time after clearing the active
bit in token field. There is a possibility of software freeing it in this
window. When this happens, USB controller may access incorrect memory and
leads to system level issues.
dTDs are freed when requests are freed by function drivers during
disconnect or unbind. The above race condition will come into effect only
for zero length packets. dTDs are dynamically created for sending zero
length packets on IN endpoints. These dTDs are immediately freed after
active bit is cleared. Defer this to next dTD completion. It is safe to
assume that hardware will no longer access the previous dTD when the next
dTD is completed.
Don't allocate/free setup status phase and GET_STATUS data phase requests
dynamically. Use one request for both cases and allocate it during bind.
CRs-Fixed: 474557
Change-Id: I5d41c310e1bb35d93b5af7d90a24ce5aab24f5f9
Signed-off-by: Pavankumar Kondeti <pkondeti@codeaurora.org>
Signed-off-by: Ajay Dudani <adudani@codeaurora.org>
Signed-off-by: Iliyan Malchev <malchev@google.com>
On flo hardware revision C, micbias1 is not grounded with external
capacity, so it should set micbias1 capless setting as 1
(no external bypass capacity) to avoid noise.
Bug:8611206
Change-Id: I82644a9123d092490ccc0acf6cdfa68964ef9c22
Signed-off-by: sam_chen <sam_chen@asus.com>
LVS4 supplies vddio to all sensors.
set LVS4 always on per EE's request.
enable ldo17 on flo and ldo9 on deb.
Change-Id: I26825c637087aaad99a7a8c9ac673558df45d7c2
Reviewed-on: http://mcrd1-5.corpnet.asus/code-review/master/73528
Reviewed-by: Sam hblee <Sam_hblee@asus.com>
Tested-by: Sam hblee <Sam_hblee@asus.com>
Signed-off-by: hsuan-chih_chen <hsuan-chih_chen@asus.com>
1. CABC level 3 is the most power saving level
2. level 3 for all cases (UI and video)
buganizer number: 8514498
Change-Id: I78930ff326410ba922ec565234dde387c670967b
Signed-off-by: yetta_wu <yetta_wu@asus.com>
To restart the individual module when crash occurs
instead of whole system panic.
Change-Id: I3e2374d9a89d4778b0811457042720478aa8683e
Signed-off-by: tzuhsuan_chen <tzuhsuan_chen@asus.com>
This patch corrects a buffer overflow in kernels from 3.0 to 3.4 when calling
log_prefix() function from call_console_drivers().
This bug existed in previous releases but has been revealed with commit
162a7e7500 (2.6.39 => 3.0) that made changes
about how to allocate memory for early printk buffer (use of memblock_alloc).
It disappears with commit 7ff9554bb5 (3.4 => 3.5)
that does a refactoring of printk buffer management.
In log_prefix(), the access to "p[0]", "p[1]", "p[2]" or
"simple_strtoul(&p[1], &endp, 10)" may cause a buffer overflow as this
function is called from call_console_drivers by passing "&LOG_BUF(cur_index)"
where the index must be masked to do not exceed the buffer's boundary.
The trick is to prepare in call_console_drivers() a buffer with the necessary
data (PRI field of syslog message) to be safely evaluated in log_prefix().
This patch can be applied to stable kernel branches 3.0.y, 3.2.y and 3.4.y.
Without this patch, one can freeze a server running this loop from shell :
$ export DUMMY=`cat /dev/urandom | tr -dc '12345AZERTYUIOPQSDFGHJKLMWXCVBNazertyuiopqsdfghjklmwxcvbn' | head -c255`
$ while true do ; echo $DUMMY > /dev/kmsg ; done
The "server freeze" depends on where memblock_alloc does allocate printk buffer :
if the buffer overflow is inside another kernel allocation the problem may not
be revealed, else the server may hangs up.
Signed-off-by: Alexandre SIMON <Alexandre.Simon@univ-lorraine.fr>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
No need to control the PMIC L17 and S4 after SR1 device.
Change-Id: Iad65971f227afb471c829c070aea5da46ed44e38
Signed-off-by: mars_kao <mars_kao@asus.com>
If connect slimport and boot device, the screen would not show because
slimport detect pin is 1 already. No interrupt to trigger slimport
detect and show.
Change-Id: Id53d23d7ae71588d5679ee87c560442d49468e00
Signed-off-by: yetta_wu <yetta_wu@asus.com>
1. Remove the gpio 26 config in board-flo-pmic.c
since this gpio is already config as PWM function in LK.
2. Add pwm_init function implementation.
3. Config backlight level in pm8xxx_led_probe(), and remove the
pwm_request() part in panel probe function.
Change-Id: I3ce71a9c792ce155bebabd80a24a8ff8fc361ae9
Signed-off-by: yetta_wu <yetta_wu@asus.com>
1. use mipi command backlight after ER2 hw_id=(1,1)
2. also port cabc, but not turn on yet
3. separate command and backlight "first" parameter
Change-Id: Ie9a2d2d87ab75c2c710c47cf17b7ed1550431e76
Signed-off-by: yetta_wu <yetta_wu@asus.com>
If there had no any pipe blending stage changes, then do not
call belnding set up to avoid unnecessary warning messges.
CRs-fixed: 467556
Change-Id: I07520b3b0917375c41405e736dcb9eb8a3daddc1
Signed-off-by: Kuogee Hsieh <khsieh@codeaurora.org>
Signed-off-by: Naseer Ahmed <naseer@codeaurora.org>
Clean up the blending rule to follow blend_op set from hwc.
Use modulate alpha for plane alpha when it is not 0xff.
Keep backward compatibility if blend_op is not set.
Change-Id: I02fd3c3c7b5ace2e6eec22b2db0284161404a0fc
Signed-off-by: Ken Zhang <kenz@codeaurora.org>
Signed-off-by: Naseer Ahmed <naseer@codeaurora.org>
Send request to a work queue and return right away.
Work queue will go through the commit queue to do the
rotation. wait_for_finish can be set to true to make
rotation go back to blocking.
Change-Id: Ifc2e36bd24d9681d42105f4ccbb62a8777af2a6c
Signed-off-by: Ken Zhang <kenz@codeaurora.org>
Signed-off-by: Naseer Ahmed <naseer@codeaurora.org>
Add MSM_ROTATOR_IOCTL_BUFFER_SYNC ioctl interface.
Rotator will create a timeline for each session at START, wait for
input fence and create released fence in this ioctl call,
signal the timeline after rotation is done.
Change-Id: I3738f8287d804ccd94e0a16ac0afb8b41b299c75
Signed-off-by: Ken Zhang <kenz@codeaurora.org>
Signed-off-by: Naseer Ahmed <naseer@codeaurora.org>
When rotator session reach maximum, it should exit without calling
put_img since no get_img had been called.
CRs-fixed: 466462
Change-Id: I951570227ebd81da6dad19c1b897cde84f8d0451
Signed-off-by: Kuogee Hsieh <khsieh@codeaurora.org>
Signed-off-by: Naseer Ahmed <naseer@codeaurora.org>
Currently, if framework is rebooted while in suspend mode, borderfill
is not unset due to which MDP composition can not be enabled. This patch
fixes the issue.
Change-Id: I8b671eccedebf2bb08724cf2d284d4ab27a71360
Signed-off-by: Vishnuvardhan Prodduturi <vproddut@codeaurora.org>
Conflicts:
drivers/video/msm/msm_fb.c
Signed-off-by: Naseer Ahmed <naseer@codeaurora.org>
Currently when 2/3/4 layer bypass is enabled, doing a adb shell
stop/start is failing overlay and composition happens through
GPU. Fix this issue by proper overlay configuration during this
scenario.
Change-Id: Ia04f1839bf80ed552671e48445af63a4dcd6bdfd
Signed-off-by: Padmanabhan Komanduru <pkomandu@codeaurora.org>
Signed-off-by: Naseer Ahmed <naseer@codeaurora.org>
initialize pinmux setup for keypad pins on all hardware revisions
Change-Id: I788f8cf5731da085abf2c5242f9eb580cca4778a
Signed-off-by: paris_yeh <paris_yeh@asus.com>
A011 is the lastest touch firmware and used for factory image.
firmware update history:
A009:
Update boot-code Ver: 60.47 (Do not turn off WDT in IAP process).
Add Self Check Mechanism to enter suspend mode.
Modification Algorithm, and Digital Parameters for ER Module.
a. Improve "double fat finger (22 phi copper)" performance.
b. Improve "fast drawing straight line" performance.
c. Improve "multi-finger in co-axis (8 phi copper)" performance.
d. Improve "under table lamp" performance.
A010:
Modify Calibration Mechanism.
A011:
Modify Open/Short Calibration Mechanism for ESD problem.
Improve Stylus Performance
Change-Id: I4e87e9cc69d81872106c7f7bd95b76dd1f1811c1
Signed-off-by: mars_kao <mars_kao@asus.com>
new boot version 6047 is for resolving the ESD problem.
Change-Id: If596dfb27be613e3b26f13e032c23136e659c4a9
Signed-off-by: mars_kao <mars_kao@asus.com>
Modify the driving strength of usb to 6D DC level. Pass the usb eye diagram.
Change-Id: Id572456758ed7d72cfb48862716cac6ccfb8be14
Signed-off-by: yi-hsin_hung <yi-hsin_hung@asus.com>
Signed-off-by: Iliyan Malchev <malchev@google.com>
Initialize workqueues for the pins ACOK and USB ID before the IRQs are
requested. This is to make sure workqueues are ready when IRQ occurs.
Change-Id: I45daa32f40d114588f6bbcfac0ffdd433f6b6865
Signed-off-by: yi-hsin_hung <yi-hsin_hung@asus.com>
Signed-off-by: Iliyan Malchev <malchev@google.com>
1. remove the workaround for resume messy screen
2. add the fix patch for resume messy screen
Set the backlight after resume only after the first display
commit is done. This will avoid panel specific transients to
show up on the panel during its initialization. Also, avoid
backlight scaling during resume until backlight is set.
case 01124703
Change-Id: Iba158db803a7ea06d564b23d5477d916e8635695
Signed-off-by: yetta_wu <yetta_wu@asus.com>
Signed-off-by: Iliyan Malchev <malchev@google.com>
When the new signal handlers are set up, the location of sa_restorer is
not cleared, leaking a parent process's address space location to
children. This allows for a potential bypass of the parent's ASLR by
examining the sa_restorer value returned when calling sigaction().
Based on what should be considered "secret" about addresses, it only
matters across the exec not the fork (since the VMAs haven't changed
until the exec). But since exec sets SIG_DFL and keeps sa_restorer,
this is where it should be fixed.
Given the few uses of sa_restorer, a "set" function was not written
since this would be the only use. Instead, we use
__ARCH_HAS_SA_RESTORER, as already done in other places.
Example of the leak before applying this patch:
$ cat /proc/$$/maps
...
7fb9f3083000-7fb9f3238000 r-xp 00000000 fd:01 404469 .../libc-2.15.so
...
$ ./leak
...
7f278bc74000-7f278be29000 r-xp 00000000 fd:01 404469 .../libc-2.15.so
...
1 0 (nil) 0x7fb9f30b94a0
2 4000000 (nil) 0x7f278bcaa4a0
3 4000000 (nil) 0x7f278bcaa4a0
4 0 (nil) 0x7fb9f30b94a0
...
[akpm@linux-foundation.org: use SA_RESTORER for backportability]
Signed-off-by: Kees Cook <keescook@chromium.org>
Reported-by: Emese Revfy <re.emese@gmail.com>
Cc: Emese Revfy <re.emese@gmail.com>
Cc: PaX Team <pageexec@freemail.hu>
Cc: Al Viro <viro@zeniv.linux.org.uk>
Cc: Oleg Nesterov <oleg@redhat.com>
Cc: "Eric W. Biederman" <ebiederm@xmission.com>
Cc: Serge Hallyn <serge.hallyn@canonical.com>
Cc: Julien Tinnes <jln@google.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Otherwise capture activity on a compressed DAI would mute any playback
on the same DAI.
Signed-off-by: Mark Brown <broonie@opensource.wolfsonmicro.com>
Acked-by: Vinod Koul <vinod.koul@intel.com>
Acked-by: Liam Girdwood <liam.r.girdwood@linux.intel.com>
Fix compilation error after merging commit 1f88eb0
from master: pop_wait is in struct snd_soc_dai
not in struct snd_soc_pcm_runtime.
Signed-off-by: Eric Laurent <elaurent@google.com>
The ASoC compressed API did not implement the copy callback in its
compressed ops which is required for DSPs that are not memory mapped.
This patch creates a local copy of the compress ops for each runtime and
modifies them with a copy callback as appropriate.
Signed-off-by: Charles Keepax <ckeepax@opensource.wolfsonmicro.com>
Acked-by: Vinod Koul <vinod.koul@intel.com>
Signed-off-by: Mark Brown <broonie@opensource.wolfsonmicro.com>
Delayed work was scheduled but not initialised, this patch adds the
actual work and initialises it.
Signed-off-by: Charles Keepax <ckeepax@opensource.wolfsonmicro.com>
Acked-by: Vinod Koul <vinod.koul@intel.com>
Tested-by: Jeeja KP <jeeja.kp@intel.com>
Signed-off-by: Mark Brown <broonie@opensource.wolfsonmicro.com>
Use the pcm_mutex to serialise the compressed ops.
Signed-off-by: Charles Keepax <ckeepax@opensource.wolfsonmicro.com>
Acked-by: Vinod Koul <vinod.koul@intel.com>
Tested-by: Jeeja KP <jeeja.kp@intel.com>
Signed-off-by: Mark Brown <broonie@opensource.wolfsonmicro.com>
Fix compilation error after merging commit 1245b700
from master: snd_soc_dapm_stream_event() protoype has changed.
Signed-off-by: Eric Laurent <elaurent@google.com>
This patch adds the support to parse the compress dai's and then also adds the
soc-compress.c file while handles the compress stream operations, mostly analogus
to what is done in the soc-pcm.c and aditional handling of the compress
opertaions
Conflicts:
sound/soc/soc-core.c
Signed-off-by: Namarta Kohli <namartax.kohli@intel.com>
Signed-off-by: Ramesh Babu K V <ramesh.babu@intel.com>
Signed-off-by: Vinod Koul <vinod.koul@linux.intel.com>
Signed-off-by: Mark Brown <broonie@opensource.wolfsonmicro.com>
Here we update the asoc structures to add compress stream definations
First the struct snd_soc_dai_driver adds a new member to indicate if the dai is
compressed or pcm. Next we add a new structre the struct snd_soc_compr_ops in
the struct snd_soc_dai_link. This is to be used for machine driver to perform
any opertaions required for setting up compressed audio streams
next is the compressed data operations, they are added using struct
snd_compr_ops in the struct snd_soc_platform_driver.
Signed-off-by: Namarta Kohli <namartax.kohli@intel.com>
Signed-off-by: Ramesh Babu K V <ramesh.babu@intel.com>
Signed-off-by: Vinod Koul <vinod.koul@linux.intel.com>
Signed-off-by: Mark Brown <broonie@opensource.wolfsonmicro.com>
this add new API for sound compress to support gapless playback.
As noted in Documentation change, we add API to send metadata of encoder and
padding delay to DSP. Also add API for indicating EOF and switching to
subsequent track
Also bump the compress API version
Conflicts:
include/uapi/sound/compress_offload.h
Signed-off-by: Jeeja KP <jeeja.kp@intel.com>
Signed-off-by: Vinod Koul <vinod.koul@intel.com>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
The snd_compr_update_tstamp() can only fill in the snd_compr_tstamp
if the codec implements the pointer() function. If that happened
the code was previously returning uninitialized garbage in the
tstamp because it wasn't initialized anywhere.
This change zero-fills the tstamp in the two places it is used
before calling snd_compr_update_tstamp(), and also has
snd_compr_update_tstamp() return an error indication if it
can't provide a tstamp. For the case of snd_compr_calc_avail()
it ignores this error because we still need to return info on
the available buffer space even if we can't provide tstamp
info - when the tstamp is not valid all fields are now
guaranteed to be zero.
Signed-off-by: Richard Fitzgerald <rf@opensource.wolfsonmicro.com>
Signed-off-by: Mark Brown <broonie@opensource.wolfsonmicro.com>
Acked-by: Vinod Koul <vinod.koul@intel.com>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Commit ALSA: compress_core: integer overflow in snd_compr_allocate_buffer()
added a new error check for input params.
this add new routine for input checks and moves buffer overflow check to this
new routine. This allows the error value to be propogated to user space
Signed-off-by: Vinod Koul <vinod.koul@linux.intel.com>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
These are 32 bit values that come from the user, we need to check for
integer overflows or we could end up allocating a smaller buffer than
expected.
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
O_RDONLY is zero so the original test (f->f_flags & O_RDONLY) is always
false and it will never do compress capture. The test for O_WRONLY is
also slightly off. The original test would consider "->flags =
(O_WRONLY | O_RDWR)" as write only instead of rejecting it as invalid.
I've also removed the pr_err() because that could flood dmesg.
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
as the start can be called after stop again, we need to reset state
Signed-off-by: Namarta Kohli <namartax.kohli@intel.com>
Signed-off-by: Vinod Koul <vinod.koul@linux.intel.com>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
during pause the core should maintain the status-quo on the device and pointers
and not wake up. If app needs it should call DROP explcitly.
Signed-off-by: Namarta Kohli <namartax.kohli@intel.com>
Signed-off-by: Vinod Koul <vinod.koul@linux.intel.com>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
