In async commit case, driver needs to always wait for input fence
before triggering the complete_commit path. Otherwise, there could
be tearing since GPU hasn't finished the composition rendering.
Change-Id: I73a54f5811fdcf8639618ce3cacf4cbaa00b406c
Signed-off-by: Felix Xiong <xayang@codeaurora.org>
Signed-off-by: Jin Li <jinl@codeaurora.org>
Signed-off-by: Yunyun Cao <yunyunc@codeaurora.org>
Assume that there are two threads, thread1 is setting
value of _rndis_qc variable in rndis_qc_bind_config_vendor
function. Thread2 jumps in and get the value of _rndis_qc
in rndis_qc_open_dev function before it is freed in
rndis_qc_bind_config_vendor function, since rndis_ipa_init
or usb_add_function failed. Use-after-free will happen as
Thread2 is referencing freed objects. To prevent this
spinlock is used where ever it is needed to protect
_rndis_qc variable.
Change-Id: I4da50c125e401e90abec3dc6b4e2c4a504a63ba0
Signed-off-by: Pratham Pratap <prathampratap@codeaurora.org>
Add flash handle to camera1 device in SDM660 sensor
MTP/CDP/QRD platforms to support flash on auxiliary camera.
In dual camera usecase, even the auxiliary sensor uses
flash. So the flash handle should be added to this camera
node as well.
Change-Id: Id7b40e5e86e67aa1e5df95d2094641a50f81286e
Signed-off-by: Vijay kumar Tumati <vtumati@codeaurora.org>
Cldata needed to be protected by lock since crash
happened when synchronous update and free.
CRs-Fixed: 2034222
Change-Id: Ied86461b784d69d9758dc3fc793a8a0de86e7f9c
Signed-off-by: Maria Yu <aiquny@codeaurora.org>
QRD SDM660 failed on high-speed eye diagram test. Updated
these parameters based on tuning result to pass compliance test.
Change-Id: Ice00698872be4c39c2184dbd5bc2d99af7641b02
Signed-off-by: Ziqi Chen <ziqic@codeaurora.org>
QRD SDM630 failed on high-speed eye diagram test. Update these
parameters based on tuning result to pass compliance test.
Change-Id: I34bb4d7808448ba687bdd9495e1573cb9eac6098
Signed-off-by: Ziqi Chen <ziqic@codeaurora.org>
The WLAN driver request and free the copy engine interrupt
according to the WLAN host target communication and protocol
in different WLAN context and subsystem state. The ath10k snoc
free/request all copy engine interrupt line during wlan subsystem
recovery due to firmware crash or hardware interface down etc.
To avoid the kernel warning and fault due to redundant copy engine
interrupt request/free in different wlan state. Define structure
for copy engine to maintain the stat of copy engine interrupt list
request/free.
Change-Id: I5cf3de4feecfb3a93a930c4939dc0a80bfc14e55
Signed-off-by: Sarada Prasanna Garnayak <sgarna@codeaurora.org>
msm-compr-q6-v2.c and msm-compr-q6-v2.h are no longer used.
CRs-Fixed: 2022953
Change-Id: I856d90a212a3e123a2c8b80092aff003f7c608c7
Signed-off-by: Xiaojun Sang <xsang@codeaurora.org>
Enabling SCSI_UFSHCD_CMD_LOGGING flag in defconfig
file. With this feature eanbled, ufs commands send
through ufshcd shall be logged.
Change-Id: Ibc4d1f39221fbcdc926e030d1df08a9fea31d24c
Signed-off-by: Can Guo <cang@codeaurora.org>
The return values from QMI could be compared directly and was
incorrectly interpreted in service locator and notifier.
Also initialize structure in service locator so as to not have garbage
values in them.
Change-Id: I7f8f27857706e9508b64289d9263c79494c17a8d
Signed-off-by: Puja Gupta <pujag@codeaurora.org>
Add support for 144k sample rate in the compress driver.
144k is supported for TrueHD pass-through.
Change-Id: I2a0e772e658e64f43ed1864814f91e7a36f67af6
Signed-off-by: Ben Romberger <bromberg@codeaurora.org>
If f_cdev_alloc() fails it frees the port context and set_inst_name()
call back returns with error. As a result free_func_inst() call back
is called which is dereferencing port context from f_cdev_opts context
which results into NULL ptr dereference. Fix the issue by adding NULL
check for port context pointer in f_cdev_opts context.
Change-Id: I69828761be0a9f7df714eec34894c13f762dcc43
Signed-off-by: Hemant Kumar <hemantk@codeaurora.org>
Enabling dynamic fps for nt35597 wqxga panel on msm8998.
The feature helps to reduce fps when static screen
leading to power saving.
Change-Id: Icc040d3d764b70cdf9e9ba2523acd04c9a8691c6
Signed-off-by: Animesh Kishore <animeshk@codeaurora.org>
This likely breaks tracing tools like trace-cmd. It logs in the same
format but now addresses are all 0x0.
Bug: 34277115
Change-Id: Ifb0d4d2a184bf0d95726de05b1acee0287a375d9
Git-repo: https://android.googlesource.com/kernel/msm
Git-commit: 9ad8f2cc1bb73a3e2255dff4ee9c45c909869225
Signed-off-by: Dennis Cagle <d-cagle@codeaurora.org>
The size of uvc_control_mapping is user controlled leading to a
potential heap overflow in the uvc driver. This adds a check to verify
the user provided size fits within the bounds of the defined buffer
size.
Bug: 33300353
Change-Id: If29c1b396633b6137966a12e38f6fd1841b045bd
Signed-off-by: Robb Glasser <rglasser@google.com>
Git-repo: https://android.googlesource.com/kernel/msm
Git-commit: 8bc3ec72a02052187397d0de1a7b8bbe7340451c
Signed-off-by: Dennis Cagle <d-cagle@codeaurora.org>
Transition to D3 hot in system suspend allows the wil6210
device to preserve the active connections in system suspend.
Change-Id: I4c24551f91ee7e59d4bfee02b0911c31ae0a05b1
Signed-off-by: Maya Erez <merez@codeaurora.org>
In order to preserve the connection in suspend/resume flow,
wil6210 host allows going to PCIe D3hot state in suspend,
instead of performing a full wil6210 device reset. This
requires the platform ability to initiate wakeup in case of
RX data. To check that, a new platform API is added.
In addition, add cfg80211 suspend/resume callbacks
implementation.
Change-Id: I3846eaaa8d6e9ecbe5adbb0c04c7574865d5af5e
Signed-off-by: Maya Erez <merez@codeaurora.org>
Serializing reset_hw and reset_irq, to avoid race condition.
Change-Id: I0fd4fc8cfcdef9fe0e0679c3cee44b2dddc7b506
Signed-off-by: Ramesh V <ramev@codeaurora.org>
Variable "slave_info->sensor_name", "slave_info->eeprom_name",
"slave_info->actuator_name" and "slave_info->ois_name" are
from user input, which may be not NULL terminated.
OOB will be possible when accessing these variable.
Add a validation for these name length.
Change-Id: I9a570372707b7f8365a625d6b0662e87d1b4926e
Signed-off-by: Depeng Shao <dshao@codeaurora.org>
Running SMP2P tests from multiple threads causes simultaneous access to
the global loopback data and resulting into unexpected behavior.
Protect the global loopback data by synchronizing the SMP2P tests.
CRs-Fixed: 2041374
Change-Id: Ifb0e7ce5198af27602881a9132afb353f1a4fc2f
Signed-off-by: Arun Kumar Neelakantam <aneela@codeaurora.org>
The pseudo-file char-device-nodes /dev/spcom and /dev/sp_ssr are not
associated with a logical channel for data transfer with the Secure
Processor (SP).
Avoid sending user command by file write() over those device nodes.
The command "create channel" should be done over /dev/sp_kernel rather
than over /dev/spcom.
Verify that glink pass valid channel pointer to spcom callbacks.
Use size_t for channel "actual_rx_size" parameter that is provided by
glink to spcom callback.
Remove "fake SSR" command, since real SSR is supported by SP.
Change-Id: Id9113389d94ab4aed01d3ac1e370c4e8f3c8965b
Signed-off-by: Amir Samuelov <amirs@codeaurora.org>
Initial driver directory setup for automotive
imaging subsystem - ais. The camera kernel drivers
for mobile and automotive platforms have been decoupled
and placed in separate directories as automotive usecases
will require significant divergence from mobile drivers.
The changes to the imaging pipeline drivers enable
automotive imaging subsystem interface from userspace.
This snapshot is taken as of msm-3.18 'commit c3d5931bbc51
("msm: Initial ais driver for automotive camera")'
Change-Id: I49b8e827818994d0a8b320ffe92f8031ffbb69ca
Signed-off-by: Terence Ho <terenceh@codeaurora.org>
Signed-off-by: Andy Sun <bins@codeaurora.org>
The SPLIT related registers are only for DSI interfaces. Without
checking the interface type, they could be overwrote by
configurations through HDMI path.
CRs-Fixed: 1085586
Change-Id: I7ace9fd8dfe5ee99cb750b2723e8f22701039552
Signed-off-by: Jin Li <jinl@codeaurora.org>
Signed-off-by: Yunyun Cao <yunyunc@codeaurora.org>
The h/v polarity should always be set from the panel configuration.
For HDMI display, it's from the EDID information. For DSI display,
it's from the panel settings in the dtsi.
CRs-Fixed: 1085021
Change-Id: I3776603d7055e69eb2c8e5003ab83bc0483ab7c8
Signed-off-by: Jin Li <jinl@codeaurora.org>
Signed-off-by: Yunyun Cao <yunyunc@codeaurora.org>
Clear deferrable_pending everytime timer softirq is run.
This handles a potential race condition, where one CPU
handles all deferrable timers, before the other CPU gets
a change to run timer softirq. Due to the deferrable_pending
not getting cleared, subsequently, CPUs do not raise
the softirq for handling expired deferrable timers,
in nohz idle enter path.
Change-Id: Ie5fd78f9b27e7553ba43101b86ad939c289827e0
Signed-off-by: Neeraj Upadhyay <neeraju@codeaurora.org>
Buffer overflow can happen when finding next set bit
due to type casting of uint32_t to unsigned long.
Fix this to correctly print number of active cores in
rpm_master_stat.
Change-Id: Ibeacc5ac66535e373965d8f8e4919829367cc257
Signed-off-by: Maulik Shah <mkshah@codeaurora.org>
The initial version of the patch save the command submit_time and
queue_time in seconds, but its desired by the users of this profiling
API to return the time in nanoseconds resolution.
Change-Id: I3a56e3ffd3ebe86f51a00a12b7c3e7c4b4c9a956
Signed-off-by: Sharat Masetty <smasetty@codeaurora.org>
Some cameras have same sensor id in one device,
but camera sensor driver just validate sensor
id now which may result in wrong probe when camera
daemon is killed and camera re-probe sensor again.
Also validate the sensor name if sensor has probed.
Change-Id: I641bf8c346bada9e6cc619389077e25e666c743f
Signed-off-by: Depeng Shao <dshao@codeaurora.org>
Throttle clocks are always on, add entries in device node so that
driver can enable during session is running and disable it when
session is closed to save power.
Change-Id: I818d0c9121b0830cbaeb3bc0b89ea3c421f6028d
CRs-Fixed: 2036215
Signed-off-by: Deepak Kushwah <dkushwah@codeaurora.org>
Use the same FG ESR timer value (96) for charging and
discharging. This is to avoid the frequent periodic spur
seen in the RF performance with charger connected.
CRs-Fixed: 2046553
Change-Id: I9d1ad61f75f553bf527906715699817236f44b01
Signed-off-by: Anirudh Ghayal <aghayal@codeaurora.org>
At this point, there is nothing left to fail. And submit already has a
fence assigned and is added to the submit_list. Any problems from here
on out are asynchronous (ie. hangcheck/recovery).
Change-Id: Ib6b6bf00099137972649c97cc6cd8c4fe25ce7c3
Signed-off-by: Rob Clark <robdclark@gmail.com>
Git-commit: 1193c3bcb581807d58dd7df90528ec744af387a9
Git-repo: git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
[smasetty@codeaurora.org: fixed merge conflict issues; made corresponding
changes to A5XX submit function.]
Signed-off-by: Sharat Masetty <smasetty@codeaurora.org>
commit 19b7ccf8651df09d274671b53039c672a52ad84d upstream.
Commit 25520d55cd ("block: Inline blk_integrity in struct gendisk")
introduced blk_integrity_revalidate(), which seems to assume ownership
of the stable pages flag and unilaterally clears it if no blk_integrity
profile is registered:
if (bi->profile)
disk->queue->backing_dev_info->capabilities |=
BDI_CAP_STABLE_WRITES;
else
disk->queue->backing_dev_info->capabilities &=
~BDI_CAP_STABLE_WRITES;
It's called from revalidate_disk() and rescan_partitions(), making it
impossible to enable stable pages for drivers that support partitions
and don't use blk_integrity: while the call in revalidate_disk() can be
trivially worked around (see zram, which doesn't support partitions and
hence gets away with zram_revalidate_disk()), rescan_partitions() can
be triggered from userspace at any time. This breaks rbd, where the
ceph messenger is responsible for generating/verifying CRCs.
Since blk_integrity_{un,}register() "must" be used for (un)registering
the integrity profile with the block layer, move BDI_CAP_STABLE_WRITES
setting there. This way drivers that call blk_integrity_register() and
use integrity infrastructure won't interfere with drivers that don't
but still want stable pages.
Fixes: 25520d55cd ("block: Inline blk_integrity in struct gendisk")
Cc: "Martin K. Petersen" <martin.petersen@oracle.com>
Cc: Christoph Hellwig <hch@lst.de>
Cc: Mike Snitzer <snitzer@redhat.com>
Tested-by: Dan Williams <dan.j.williams@intel.com>
Signed-off-by: Ilya Dryomov <idryomov@gmail.com>
[idryomov@gmail.com: backport to < 4.11: bdi is embedded in queue]
Signed-off-by: Jens Axboe <axboe@fb.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
commit 3089c1df10e2931b1d72d2ffa7d86431084c86b3 upstream.
The vm fault handler relies on the fact that the VMA owns a reference
to the BO. However, once mmap_sem is released, other tasks are free to
destroy the VMA, which can lead to the BO being freed. Fix two code
paths where that can happen, both related to vm fault retries.
Found via a lock debugging warning which flagged &bo->wu_mutex as
locked while being destroyed.
Fixes: cbe12e74ee ("drm/ttm: Allow vm fault retries")
Signed-off-by: Nicolai Hähnle <nicolai.haehnle@amd.com>
Reviewed-by: Christian König <christian.koenig@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
