MDSS (2015) driver are fully compatible with S6E8AA0A panels now:
- added dsi_phy resource to dt to allow dsi controller to connect to physical display
- disabled mdp video pingpong for S6E8AA0A to avoid fps drops
- fixed (long) delay between splash screen and bootanimation
- fixed low brightness when calling MDSS_EVENT_PANEL_OFF at init
CMHW uses this to determine the display modes supported by the device.
[javelinanddart]: Do this for all used nodes, for consistency
Change-Id: I3e04f58fbcc13693f9c9eb639d1ce0c8b710e06b
Signed-off-by: Paul Keith <javelinanddart@gmail.com>
CMHW expects these nodes to show only the needed values.
Furthermore, the 'mode' sysfs node was showing completely
off values compared to what was actually being set.
[javelinanddart]: Do this for all used nodes, for consistency
Change-Id: Ie5aaf4d1f258cba6775723e4423f3e13e20b37bb
Signed-off-by: Paul Keith <javelinanddart@gmail.com>
the spec says the frame size will not be greater than
14, but this have a security hole when somebody sends
a message with a size greater than 14. So need check
up-boud of the CEC frame size.
Bug: 64438726
Change-Id: I743208badc5e77ae911cfb2d102f758d4843138f
Signed-off-by: zhaoyuan <yzhao@codeaurora.org>
CVE-2017-9719
Signed-off-by: Kevin F. Haggerty <haggertk@lineageos.org>
Modified the size of the gamut table data-structure in order to
avoid a buffer overflow while copying data from user-space.
Bug: 34170483
Change-Id: I8c5fa1caff450a2d25d7859bd159ab4a60045e54
Signed-off-by: Bharath Gopal <gopalb@codeaurora.org>
CVE-2017-9706
Signed-off-by: Kevin F. Haggerty <haggertk@lineageos.org>
If DMA attachment fail during fb_mmap, all ION memory will get free. It
is necessary to reset the fbmem and fb_attachemnt pointer to NULL,
otherwise during shutdown will perform another free and causing issue.
CRs-Fixed: 1090244
CAF-Change-Id: I92affcf2ce039eecfc72b7c191e058f37815c726
Signed-off-by: Benjamin Chan <bkchan@codeaurora.org>
[haggertk]: Backport to 3.4/msm8974
CVE-2017-7373
Signed-off-by: Kevin F. Haggerty <haggertk@lineageos.org>
Change-Id: Ie90f94fe5016667f6eb984dbbedd05ebc261e16f
commit 2dc705a9930b4806250fbf5a76e55266e59389f2 upstream.
Copying color maps to userspace doesn't check the value of to->start,
which will cause kernel heap buffer OOB read due to signedness wraps.
CVE-2016-8405
Change-Id: Iac32fe0cffcdc91b136bef474b05e9b1a4a9d7dc
Link: http://lkml.kernel.org/r/20170105224249.GA50925@beast
Fixes: 1da177e4c3 ("Linux-2.6.12-rc2")
Signed-off-by: Kees Cook <keescook@chromium.org>
Reported-by: Peter Pi (@heisecode) of Trend Micro
Cc: Min Chong <mchong@google.com>
Cc: Dan Carpenter <dan.carpenter@oracle.com>
Cc: Tomi Valkeinen <tomi.valkeinen@ti.com>
Cc: Bartlomiej Zolnierkiewicz <b.zolnierkie@samsung.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Jiri Slaby <jslaby@suse.cz>
Signed-off-by: Kevin F. Haggerty <haggertk@lineageos.org>
This reverts commit a2b5237ad2.
* Reverted to allow clean commit of fuller fix from korg
Change-Id: If5bc10d050a71963d321e983d1447e1b69fe0b3f
Signed-off-by: Kevin F. Haggerty <haggertk@lineageos.org>
In many parts of the code the sscanf function was getting
an unsigned integer with a wrong format specifier. Changed
the format specifiers appropriately. Single variable sscanf
were replaced by kstrtouint at reported places.
CRs-Fixed: 1024872
CAF-Change-Id: I03ce718b0456d437d31d701586965d0aa7443b51
Signed-off-by: Shalini Krishnamoorthi <shakri@codeaurora.org>
[haggertk]: Backport to 3.4/msm8974
CVE-2016-10232
Change-Id: Ie5913a1479e7517a13addcba72efb44698b773c6
Signed-off-by: Kevin F. Haggerty <haggertk@lineageos.org>
Before writing to a userspace address, verification
of the validity of user space address is required.
Change-Id: I9141e44a6c11aaf3f4d57c08bb0dd26a7b214f34
CRs-fixed: 556356
Signed-off-by: Deepak Verma <dverma@codeaurora.org>
CVE-2014-9880
Signed-off-by: Kevin F. Haggerty <haggertk@lineageos.org>
Other drivers write to these regs (KCAL, Sony) and other developers may
implement more than one driver. Make sure we are always reporting the correct
PCC values.
Change-Id: Id4a28602d6678d8032f1328c49163b52c15d52b1
* MDSS5 supports Polynomial Color Correction. Use this to implement
a simple sysfs API for adjusting RGB scaling values. This can be
used to implement color temperature and other controls.
* Why use this when we have KCAL? This code is dead simple, the
interface is in the right place, and it allows for 128X accuracy.
Change-Id: Ib848d6c9dbdf41f61cc7539a61138d6632ceba94
Ticket: NIGHTLIES-2873
Signed-off-by: Kevin F. Haggerty <haggertk@lineageos.org>
* The function prototype for this function has become :
int mdss_panel_dt_get_dst_fmt(u32 bpp, char mipi_mode, u32 pixel_packing,char *dst_format);
in the latest source drop
Validate the input arguments of MDP, MDDI and HDMI offset
values in the respective write functions.
Change-Id: Ida1b7ec292c365701fe17446019f625fdaff38d2
Signed-off-by: Raghavendra Ambadas <rambad@codeaurora.org>
There are few cases where the count argument passed by the user
space is not validated, which can potentially lead to out of bounds
or overflow issues. In some cases, kernel might copy more data than
what is requested. Add necessary checks to avoid such cases.
Change-Id: Ifa42fbd475665a0ca581c907ce5432584ea0e7ed
[veeras@codeaurora.org: Resolved conflicts in mdss_debug.c]
Signed-off-by: Veera Sundaram Sankaran <veeras@codeaurora.org>
Signed-off-by: Raghavendra Ambadas <rambad@codeaurora.org>
Crash is seen in cleanup function while accessing
corrupted pipe list. To avoid this, initialize the pipe
list before destroying the pipe.
Change-Id: I64ae0113d99491a18ad4d9f6e30e935f8ec0edbb
Signed-off-by: Raghavendra Ambadas <rambad@codeaurora.org>
Currently the DSI_PLL_UNLOCKED event is defined as 0x1,
DSI_FIFO_UNDERFLOW as 0x2 and DSI_FIFO_EMPTY event is 0x3.
This will cause issues since when a DSI_FIFO_EMPTY event
is triggered, it causes a false event for DSI_FIFO_UNDERFLOW
and DSI_PLL_UNLOCKED events also. Fix this issue by changing
the macro definition of DSI_FIFO_EMPTY to 0x4.
Change-Id: I2a25096c1fd97345cef3800fcf3a96f658844804
Signed-off-by: Padmanabhan Komanduru <pkomandu@codeaurora.org>
Signed-off-by: Raghavendra Ambadas <rambad@codeaurora.org>
During rapid suspend/resume usecases assertive display is being turned
on with backlight level zero. When on command is received with backlight
level zero driver bails out with out turning on AD and doesn't signal
the client that worker queue has stopped processing which results in a
timeout for on command. Change will ensure that client is signalled if
driver is skipping the processing of AD due to backlight being zero.
Change-Id: Iaa6229f10ce54f44ec64c175f67ef7584ad4c8b2
Signed-off-by: Gopikrishnaiah Anandan <agopik@codeaurora.org>
Signed-off-by: Raghavendra Ambadas <rambad@codeaurora.org>
Currently there is a page fault and flicker while programming
DMA pipe registers in Line mode. To prevent this acquire wb_lock
between writeback kickoff (N-Cycle) and rotator setup(N+1 Cycle).
wb_lock avoid rotator to update the pipe structure before writeback
is finished programming to the hardware.
Change-Id: I589032831ec1813f12ce3f91e3aa8a6b187ebfdd
Signed-off-by: Raghavendra Ambadas <rambad@codeaurora.org>
On mdp3 targets iommu operation is not properly protected
by mutex lock. This is causing iommu to be detached while
hardware is fetching the data from the iommu mapped
address leading to SNOC errors. Use mutex lock properly
while using the iommu to fix the issue.
Change-Id: Ife59791b08b123f6b60d3ffa6d8061839244934c
Signed-off-by: Shivaraj Shetty <shivaraj@codeaurora.org>
While splash logo feature is enabled and after splash logo
is completed, no need to wait for vsync while suspend-resume.
This will improve wakeup time around 90ms.
Change-Id: I9a6a04b7abbb8898534f24341f78bd657a1ad643
Signed-off-by: Raghavendra Ambadas <rambad@codeaurora.org>
Calling backlight lock on every commit iteration was adding
overhead. Altering the conditions to allow locking only for
case when unset backlight level is not zero.
Change-Id: I023dccfa584cf641d042565b7ad2cb32c0724c55
Signed-off-by: Krishna Chaitanya Parimi <cparimi@codeaurora.org>
Signed-off-by: Nirmal Abraham <nabrah@codeaurora.org>
The queued work for an iteration of pp_ad_calc_worker might run
post the final fb release call. This can cause NULL pointer
dereferences. Now cancelling the pending AD calc work and
destroying the workqueue upon shutdown call to prevent any
such scenarios.
The vsync handler would continue to work until a call for
POWERDOWN arrives from userspace post shutdown notification.
So vsync handler might continue to queue work regardless of
existence of AD workqueue. Preventing this by checking the
ad state to see if shutdown has been set. If shutdown is set
then we do not queue AD calc work. The shutdown mask will be
set in state during a call to fb shutdown.
Change-Id: I10b6f3001b49b010eb4ca52d3b0dc03b2f7c190c
Signed-off-by: Krishna Chaitanya Parimi <cparimi@codeaurora.org>
Signed-off-by: Justin Philip <jphili@codeaurora.org>
If AD block offsets are absent in the device tree then do not
initialize ad_calc_bl. This would prevent unnecessary function
calls into AD backlight processing functions on targets where
AD is not enabled.
Change-Id: I6257d46a8ece9db134697170b91af9a9bead3b72
Signed-off-by: Krishna Chaitanya Parimi <cparimi@codeaurora.org>
Signed-off-by: Justin Philip <jphili@codeaurora.org>
Since DSI status checking is purely DSI operation, it's not
necessary to acquire ov_lock in case of video mode, otherwise
this function could block other overlay functions, therefore
introducing extra delay.
CRs-fixed: 714531
Change-Id: I5051ff3495d516b405cd3bf5dc32ea712187975e
Signed-off-by: Ray Zhang <rayz@codeaurora.org>
Signed-off-by: Raghavendra Ambadas <rambad@codeaurora.org>
Instead of calling two different functions for enable/disable and
prepare/unprepare clk functions for dsi link clocks, call single
function to fix the clk stuck issue while disable clks.
Change-Id: I6fc7428ff30b70c3ec8a99a698acc4571ddd1c94
Signed-off-by: Raghavendra Ambadas <rambad@codeaurora.org>
Secure display state is MDP hardware state instead of
individual interface state. All interfaces should push
only secure content data when MDP hardware is in secure state.
All non-secure content should be rejected to avoid XPU
violation. DSI hardware should also avoid DCS command
communication in this state to avoid non-secure VBIF access.
CRs-fixed: 686451
Change-Id: I3beb6c24361e3c42e18107d2a2ebebafc5da1b52
Signed-off-by: Dhaval Patel <pdhaval@codeaurora.org>
Signed-off-by: Nirmal Abraham <nabrah@codeaurora.org>
Get the panel backlight info from the correct bl_mfd.
Change-Id: Icc4568eb4ae9f4091f7ccf5f60e97bfd7f745420
Signed-off-by: Ping Li <pingli@codeaurora.org>
During bootup while splash logo feature is enabled, Iommu page fault and
Lock up issue is observed. Wait for vsync completion to fix the Iommu
page fault. As mdss_mdp_splash_cleanup function is called from
mdss_mdp_overlay_start and mdss_mdp_splash_ctl_cb function, it results in a
race condition for ctl->lock. So remove the mdss_mdp_splash_cleanup
function from mdss_mdp_splash_ctl_cb to fix the lock up issue.
Change-Id: I44e1ad49084f6ba0c48c35f026143e27932f252e
Signed-off-by: Raghavendra Ambadas <rambad@codeaurora.org>
DMA pipe can only be shared on the writeback mixer for
concurrent line and block mode operations. Only allow
sharing if the mixer attached to the pipe is already a
writeback mixer.
Change-Id: I9a0e5144fdf87f681493cd92d9cc809836ab1a5c
Signed-off-by: Sree Sesha Aravind Vadrevu <svadrevu@codeaurora.org>
Signed-off-by: Nirmal Abraham <nabrah@codeaurora.org>
Y-T-G
xXPR0T0TYPEXx
Francescodario Cuzzocrea
Zhao Wei Liew
zhaoyuan
Bharath Gopal
Paul Keith
Benjamin Chan
Kees Cook
Kevin F. Haggerty
Shalini Krishnamoorthi
Deepak Verma
savoca
Steve Kondik
Raghavendra Ambadas
Veera Sundaram Sankaran
Linux Build Service Account
Padmanabhan Komanduru
Gopikrishnaiah Anandan
Shivaraj Shetty
Krishna Chaitanya Parimi
Ray Zhang
Dhaval Patel
Ping Li
Sree Sesha Aravind Vadrevu