Copy user space process name buffer to kernel space using
copy_from_user.
Change-Id: I5272a42651ac50ddeda3f0f7a4cbd32dbaf495ec
Acked-by: Himateja Reddy <hmreddy@qti.qualcomm.com>
Signed-off-by: Tharun Kumar Merugu <mtharu@codeaurora.org>
Duplicate probing of mdss_mdp device node is now handled
within SDE driver.
Change-Id: I3e4bb5c73c8d43e6fe07ff791ea3815636e50a55
Signed-off-by: Narender Ankam <nankam@codeaurora.org>
Static variable node_list list need to be protected with a mutex
to prevent race conditions and use after free cases.
Change-Id: I4790b06712b8a8b401f43418cfcc53b415fb0019
Signed-off-by: David Dai <daidavid1@codeaurora.org>
Signed-off-by: Odelu Kukatla <okukatla@codeaurora.org>
QRD SDM660 failed on high-speed eye diagram test. Updated
these parameters based on tuning result to pass compliance test.
Change-Id: Ice00698872be4c39c2184dbd5bc2d99af7641b02
Signed-off-by: Ziqi Chen <ziqic@codeaurora.org>
QRD SDM630 failed on high-speed eye diagram test. Update these
parameters based on tuning result to pass compliance test.
Change-Id: I34bb4d7808448ba687bdd9495e1573cb9eac6098
Signed-off-by: Ziqi Chen <ziqic@codeaurora.org>
The WLAN driver request and free the copy engine interrupt
according to the WLAN host target communication and protocol
in different WLAN context and subsystem state. The ath10k snoc
free/request all copy engine interrupt line during wlan subsystem
recovery due to firmware crash or hardware interface down etc.
To avoid the kernel warning and fault due to redundant copy engine
interrupt request/free in different wlan state. Define structure
for copy engine to maintain the stat of copy engine interrupt list
request/free.
Change-Id: I5cf3de4feecfb3a93a930c4939dc0a80bfc14e55
Signed-off-by: Sarada Prasanna Garnayak <sgarna@codeaurora.org>
msm-compr-q6-v2.c and msm-compr-q6-v2.h are no longer used.
CRs-Fixed: 2022953
Change-Id: I856d90a212a3e123a2c8b80092aff003f7c608c7
Signed-off-by: Xiaojun Sang <xsang@codeaurora.org>
Enabling SCSI_UFSHCD_CMD_LOGGING flag in defconfig
file. With this feature eanbled, ufs commands send
through ufshcd shall be logged.
Change-Id: Ibc4d1f39221fbcdc926e030d1df08a9fea31d24c
Signed-off-by: Can Guo <cang@codeaurora.org>
The return values from QMI could be compared directly and was
incorrectly interpreted in service locator and notifier.
Also initialize structure in service locator so as to not have garbage
values in them.
Change-Id: I7f8f27857706e9508b64289d9263c79494c17a8d
Signed-off-by: Puja Gupta <pujag@codeaurora.org>
If f_cdev_alloc() fails it frees the port context and set_inst_name()
call back returns with error. As a result free_func_inst() call back
is called which is dereferencing port context from f_cdev_opts context
which results into NULL ptr dereference. Fix the issue by adding NULL
check for port context pointer in f_cdev_opts context.
Change-Id: I69828761be0a9f7df714eec34894c13f762dcc43
Signed-off-by: Hemant Kumar <hemantk@codeaurora.org>
This likely breaks tracing tools like trace-cmd. It logs in the same
format but now addresses are all 0x0.
Bug: 34277115
Change-Id: Ifb0d4d2a184bf0d95726de05b1acee0287a375d9
Git-repo: https://android.googlesource.com/kernel/msm
Git-commit: 9ad8f2cc1bb73a3e2255dff4ee9c45c909869225
Signed-off-by: Dennis Cagle <d-cagle@codeaurora.org>
The size of uvc_control_mapping is user controlled leading to a
potential heap overflow in the uvc driver. This adds a check to verify
the user provided size fits within the bounds of the defined buffer
size.
Bug: 33300353
Change-Id: If29c1b396633b6137966a12e38f6fd1841b045bd
Signed-off-by: Robb Glasser <rglasser@google.com>
Git-repo: https://android.googlesource.com/kernel/msm
Git-commit: 8bc3ec72a02052187397d0de1a7b8bbe7340451c
Signed-off-by: Dennis Cagle <d-cagle@codeaurora.org>
Transition to D3 hot in system suspend allows the wil6210
device to preserve the active connections in system suspend.
Change-Id: I4c24551f91ee7e59d4bfee02b0911c31ae0a05b1
Signed-off-by: Maya Erez <merez@codeaurora.org>
In order to preserve the connection in suspend/resume flow,
wil6210 host allows going to PCIe D3hot state in suspend,
instead of performing a full wil6210 device reset. This
requires the platform ability to initiate wakeup in case of
RX data. To check that, a new platform API is added.
In addition, add cfg80211 suspend/resume callbacks
implementation.
Change-Id: I3846eaaa8d6e9ecbe5adbb0c04c7574865d5af5e
Signed-off-by: Maya Erez <merez@codeaurora.org>
Variable "slave_info->sensor_name", "slave_info->eeprom_name",
"slave_info->actuator_name" and "slave_info->ois_name" are
from user input, which may be not NULL terminated.
OOB will be possible when accessing these variable.
Add a validation for these name length.
Change-Id: I9a570372707b7f8365a625d6b0662e87d1b4926e
Signed-off-by: Depeng Shao <dshao@codeaurora.org>
The pseudo-file char-device-nodes /dev/spcom and /dev/sp_ssr are not
associated with a logical channel for data transfer with the Secure
Processor (SP).
Avoid sending user command by file write() over those device nodes.
The command "create channel" should be done over /dev/sp_kernel rather
than over /dev/spcom.
Verify that glink pass valid channel pointer to spcom callbacks.
Use size_t for channel "actual_rx_size" parameter that is provided by
glink to spcom callback.
Remove "fake SSR" command, since real SSR is supported by SP.
Change-Id: Id9113389d94ab4aed01d3ac1e370c4e8f3c8965b
Signed-off-by: Amir Samuelov <amirs@codeaurora.org>
Clear deferrable_pending everytime timer softirq is run.
This handles a potential race condition, where one CPU
handles all deferrable timers, before the other CPU gets
a change to run timer softirq. Due to the deferrable_pending
not getting cleared, subsequently, CPUs do not raise
the softirq for handling expired deferrable timers,
in nohz idle enter path.
Change-Id: Ie5fd78f9b27e7553ba43101b86ad939c289827e0
Signed-off-by: Neeraj Upadhyay <neeraju@codeaurora.org>
Buffer overflow can happen when finding next set bit
due to type casting of uint32_t to unsigned long.
Fix this to correctly print number of active cores in
rpm_master_stat.
Change-Id: Ibeacc5ac66535e373965d8f8e4919829367cc257
Signed-off-by: Maulik Shah <mkshah@codeaurora.org>
Some cameras have same sensor id in one device,
but camera sensor driver just validate sensor
id now which may result in wrong probe when camera
daemon is killed and camera re-probe sensor again.
Also validate the sensor name if sensor has probed.
Change-Id: I641bf8c346bada9e6cc619389077e25e666c743f
Signed-off-by: Depeng Shao <dshao@codeaurora.org>
Use the same FG ESR timer value (96) for charging and
discharging. This is to avoid the frequent periodic spur
seen in the RF performance with charger connected.
CRs-Fixed: 2046553
Change-Id: I9d1ad61f75f553bf527906715699817236f44b01
Signed-off-by: Anirudh Ghayal <aghayal@codeaurora.org>
At this point, there is nothing left to fail. And submit already has a
fence assigned and is added to the submit_list. Any problems from here
on out are asynchronous (ie. hangcheck/recovery).
Change-Id: Ib6b6bf00099137972649c97cc6cd8c4fe25ce7c3
Signed-off-by: Rob Clark <robdclark@gmail.com>
Git-commit: 1193c3bcb581807d58dd7df90528ec744af387a9
Git-repo: git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
[smasetty@codeaurora.org: fixed merge conflict issues; made corresponding
changes to A5XX submit function.]
Signed-off-by: Sharat Masetty <smasetty@codeaurora.org>
KERNEL_TEXT_RDONLY is similar to DEBUG_RODATA, but it relies on
4k pages to be made, whereas DEBUG_RODATA can work with or
without 4k pages. Let's move the depends on statement from
FORCE_PAGES to KERNEL_TEXT_RDONLY to accurately reflect the real
dependency here. This fixes a warning where we have FORCE_PAGES
enabled but DEBUG_RODATA is also enabled at the same time because
the latter is "default y" now and the depends on for FORCE_PAGES
can't be satisfied. In fact, it's OK for FORCE_PAGES to be
enabled at the same time as DEBUG_RODATA, it's really there to
prevent KERNEL_TEXT_RDONLY being enabled at the same time as
DEBUG_RODATA. Move the depends on to make things clearer.
Change-Id: Ie73b768ed4540cdb4d752a9b5f1a049bf644bc7e
Signed-off-by: Stephen Boyd <sboyd@codeaurora.org>
Kconfig doesn't have the CONFIG_ part of the option, so don't use
it here. This fixes a kconfig warning about missing a dependency
for "CONFIG_SPI" which doesn't exist because it's supposed to be
"SPI".
Change-Id: Ie449ff250dd87b0a445d34ee079082c6e91f147c
Signed-off-by: Stephen Boyd <sboyd@codeaurora.org>
When the USB_ID line is pulled low for a very short time there is a
possibility that the SW misses rising edge(removal) event. This may
lead to the state where charger is stuck in the boost-mode forever.
Fix this my adding a SW based glitch logic which checks for the
USB_ID after a SW debounce time and then notifies its presence/removal to
the USB driver.
CRs-Fixed: 2044958
Change-Id: I31974f7d68b435bbef329278cedbd726ada02e3f
Signed-off-by: Ashay Jaiswal <ashayj@codeaurora.org>
In case of emmc5.0 cards where HS400 mode and CMD5(awake) partial
init is enabled -> mmc_partial_init is broken and gives below errors.
Fix this by adding calibration logic in case of HS400 mode.
NOTE: In HS400 mode tuning is only performed once during bootup (in
HS200 mode).
Post to that it is always DLL calibration which is performed (in
system/runtime resume).
So even for below issue since timing is already changed using
cached_ios, then do the calibration using ->execute_tuning.
<dmesg errors w/o patch>
root@msm8996:/ # [ 76.011036] mmc0: mmc_runtime_suspend:
[ 77.315903] mmc0: mmc_runtime_resume:
[ 77.367866] mmc0: mmc_partial_init: starting partial init
[ 77.376225] mmc0: mmc_test_awake_ext_csd: mmc_get_ext_csd failed
(-110)
[ 77.382190] mmc0: mmc_partial_init: done partial init (-110)
[ 77.387536] mmc0: _mmc_resume: awake failed (-110), fallback to full
init
[ 77.394405] mmc0: mmc_init_card:
[ 77.402762] mmc0: mmc_init_card: mmc_send_op_cond() fails -110
[ 77.407573] mmc0: MMC card re-init failed rc = -110 (retries = 3)
[ 77.507261] mmc0: _mmc_resume: awake failed (-110), fallback to full
init
[ 77.513293] mmc0: mmc_init_card:
<dmesg with patch>
[ 74.002624] mmc0: mmc_runtime_resume:
[ 74.056089] mmc0: mmc_partial_init: starting partial init
[ 74.067143] mmc0: mmc_partial_init: done partial init (0)
Change-Id: I0e55efb7863b75bd584843c3fc920c845996eb5c
Signed-off-by: Ritesh Harjani <riteshh@codeaurora.org>
For a BADD 3.0 device, the Data Endpoint wMaxPacketSize
of an Alt Setting must be one of the values mentioned in
the specifications. Similarly, the unit IDs of the source
units of any entity is prescribed by the specs. Add
support for checking the error(default) branches in the
relevant switch cases and accordingly handle them.
Change-Id: Ib88eee21df012089d41c4e78a161ddc6767e1bd4
Signed-off-by: Ajay Agarwal <ajaya@codeaurora.org>
Verify cid variable before accessing it and
initialize invoket variable before bailing out.
Change-Id: Idec133bf8ba1a000b83f92bb567f0b75bbdab340
Signed-off-by: Tharun Kumar Merugu <mtharu@codeaurora.org>
The patch updates the client's free memory
count variable after the successful allocation.
CRs-Fixed: 2046258
Change-Id: Ibae317596557e23d2b2278daf433bd293a8bd0be
Signed-off-by: Manoj Prabhu B <bmanoj@codeaurora.org>
Protect polling interval update event in the governor
with mutex lock.
This will avoid parallel execution of update interval event
on different cores, resulting in memory poison overwritten.
CRs-Fixed: 2035633
Change-Id: Ib919d9774317bc01e3cf581c169c5d18555f484f
Signed-off-by: Santosh Mardi <gsantosh@codeaurora.org>
