In fast_smmu_alloc size_t variable size is type casted to int
variable count, this variable count can get truncated and can
result in memory corruption during unmap, make count as size_t
and also add a check for count as sg_alloc_table_from_pages
accepts unsigned int value for count.
Change-Id: I4780a554c5c062fd9dd229e5cc0ac804b1ba31d8
Signed-off-by: Vijayanand Jitta <vjitta@codeaurora.org>
Ensure the count of supported encoder and decoder returned
from firmware are within the range of supported sessions
Change-Id: If3eae7bc82dc8302444e2e4104fb6ae3cfbfed5a
Signed-off-by: Dikshita Agarwal <dikshita@codeaurora.org>
Signed-off-by: Vasantha Balla <vballa@codeaurora.org>
The SVA history buffer is out of order if there are
more than 2 continuous RX buffer done from GLINK. Implement
FIFO to ensure sequence consistency.
Change-Id: If70e2d0160e8f3140d621298b0db03bd89ba88ba
Signed-off-by: Xiaojun Sang <xsang@codeaurora.org>
gadget_driver can become null if gadget_stop is called while any other
gadget callbacks are in progress. As gadget callbacks needs to release
spinlock before the callback, store the local copy of gadget_driver to
avoid the race with gadget_stop.
Change-Id: I7f0cbf9af3e3b286f2826647f08215f29f699de1
Signed-off-by: Mayank Rana <mrana@codeaurora.org>
Signed-off-by: Vijayavardhan Vennapusa <vvreddy@codeaurora.org>
Due to improper type conversion compilation
issue will be seen. Made change to access the
appropriate type.
Change-Id: I54777fe71a2f29297b439ac26f80b9684222d89a
Signed-off-by: E V Ravi <evenka@codeaurora.org>
Due to improper type conversion compilation
issue will be seen. Made change to access the
appropriate type.
Change-Id: I2c61364f0385c83aa304788cc705bf4ca48ac2cc
Signed-off-by: Meera Gande <mgande@codeaurora.org>
In db.txt, update ETSI1 and ETSI13 countries with NO-OUTDOOR flag
for frequency ranges: (5170 - 5250) and (5250 - 5330).
CRs-Fixed: 2379868
Change-Id: I8a9ce955e82b14814ead5f0bf118608ea90cbc53
Signed-off-by: Rajeev Kumar Sirasanagandla <rsirasan@codeaurora.org>
The kernel buffer 'ubuf' can overflow while copying data to user
space in debugfs read functions. Fix it by limiting the length of
data to be copied to userspace.
Change-Id: Ibb3d8c4fb637ddc0e63677ec2dff14a4cf8c0c73
Signed-off-by: Srinivasarao P <spathi@codeaurora.org>
A fixed sink PDO request includes both operating current and
max current. Although the max current requested may be greater
than the available source advertisement, as per spec only the
operating current request needs to be considered. The sink will
likely have also set the Capability Mismatch bit as well. Hence,
don't reject the request otherwise the sink will keep
re-requesting and never enter a contract.
Change-Id: Ia15e2e17abe43f2bcbc1fe7011b70ab0e0f5d9eb
Signed-off-by: Jack Pham <jackp@codeaurora.org>
Update country ETSI13 related country's frequency range and tx
power.
Change-Id: Iae27b12df3b36621c395ef9e8a3b1b46461848b6
CRs-Fixed: 2246140
Signed-off-by: Gaole Zhang <gaolez@codeaurora.org>
Per the EU STD. ETSI EN 300 440, sub-band 5725-5875 is
allowed in EU at reduced power of 25 mW. Add the sub-band to
the EU countries that support this sub-band.
CRs-Fixed: 2141740
Change-Id: I0a43e99c4357527f607110faecddd9d0fd444fc6
Signed-off-by: Amar Singhal <asinghal@codeaurora.org>
Signed-off-by: Rajeev Kumar Sirasanagandla <rsirasan@codeaurora.org>
Specify the name of GPU temperature sensor in the device tree.
This name is used to get the sensor's temperature by querying the
thermal driver API.
CRs-Fixed: 1064728
Change-Id: Ia93d93a442aa848cbd42a5fb8ecad5ef875f9abf
Signed-off-by: Harshdeep Dhatt <hdhatt@codeaurora.org>
Signed-off-by: Sunil Khatri <sunilkh@codeaurora.org>
Signed-off-by: Archana Sriram <apsrir@codeaurora.org>
Allocate all memory given to remote subsystem in the kernel
instead of mapping memory allocated in userspace.
Change-Id: I79c1f40d426e271403afa67514714fe6af26cf4e
Acked-by: Thyagarajan Venkatanarayanan <venkatan@qti.qualcomm.com>
Signed-off-by: Tharun Kumar Merugu <mtharu@codeaurora.org>
To resolve the timing issue between usb-driver
and android framework, made the change on rndis
ipa to send the usb-connect msg when usb-driver
connect the IPA pipes.
Change-Id: I51de37bc7610cb0a94659c64146f10ed322210b2
Acked-by: Pooja Kumari <kumarip@qti.qualcomm.com>
Signed-off-by: Mohammed Javid <mjavid@codeaurora.org>
Signed-off-by: Skylar Chang <chiaweic@codeaurora.org>
WDSP private data structure is freed in wdsp_glink_release()
but some of the member variables like work_queue pointer is
accessed even after free. Fix this issue by making sure that
glink callback functions are finished execution
before freeing up wdsp private data structure.
Change-Id: Ia4dd9d667109168874dc9188d70741cb9541b0c6
Signed-off-by: Vidyakumar Athota <vathota@codeaurora.org>
Signed-off-by: Ashish Jain <ashishj@codeaurora.org>
If user passes an aribitary command with _IOC_DIR(cmd) == _IOC_NONE,
"arg" should point to any arbitrary address.
Check for invalid command and return error.
Change-Id: If60191a07bb80939af2d471a5acf1b17dd68aa58
CRs-Fixed: 2299567
Signed-off-by: Abhishek Abbanaveni <aabban@codeaurora.org>
Invalid type conversion with x64 bit command VIDIOC_MSM_LASER_LED_CFG
passed in,for which the type should be "msm_laser_led_cfg_data_t"
Change-Id: I43e112224c612fb5390fa5fc23e8ae9c0e553288
CRs-Fixed: 2299699
Signed-off-by: Abhishek Abbanaveni <aabban@codeaurora.org>
Signed-off-by: E V Ravi <evenka@codeaurora.org>
If the user passes the arbitrary command with _IOC_DIR(cmd) == _IOC_NONE,
"arg" should point to any arbitrary address.
Check for invalid command and return error.
CRs-Fixed: 2299567
Change-Id: Ibd77adfe53ef0777ff4eb96c914e21f43dfd6749
Signed-off-by: E V Ravi <evenka@codeaurora.org>
Sanitize debugfs inputs to only allow access to mdp memory block
specified in dtsi file. This change will allow only one single block
to be read at the time and will avoid accessing memory outside of valid
decode space which can trigger AHB error bus response.
Change-Id: I91b91ac2b31eac4facb0c402c92ed8fcfc01d91e
Signed-off-by: Amine Najahi <anajahi@codeaurora.org>
There is a possibility of use-after-free and
double free because of not marking buffer as
NULL after freeing. The patch marks buffer
as NULL after freeing in error case.
Change-Id: Iacf8f8a4a4e644f48c87d5445ccd594766f2e156
Signed-off-by: Hardik Arya <harya@codeaurora.org>
Add initial device trees for SDM455 RCM devices for both external
and internal codec variant.
Change-Id: Idd6034727acc8b9ef600da421963becf5f2305cd
Signed-off-by: Teng Fei Fan <tengfei@codeaurora.org>
Signed-off-by: Maria Yu <aiquny@codeaurora.org>
Signed-off-by: Tengfei Fan <tengfeif@codeaurora.org>
In few scenarios where the buffers are not
queued from HAL, request queue overflow is seen.
Added changes to reset the queue at destroy and
when the buffer is not available to process.
Change-Id: I7239175dda9cbc26fb65f568cbc5f7183ceaa24d
Signed-off-by: Meera Gande <mgande@codeaurora.org>
In few scenarios, where the register update ioctl is
missed, the handling of frame drop is not working
in such scenarios as the frame drop pattern is not
set correctly. Once the epoch handling is done,
we need to re-configure the buffer and pattern.
Change-Id: I87b2cecda7e7e1addc68511dad6a80498051f87a
Signed-off-by: Meera Gande <mgande@codeaurora.org>
In few scenarios, the request frame may get
delayed and current and request frame id may
become same. To handle such scenarios, made
changes to inform user to delay a frame and
process the request.
Change-Id: I31fa04c386922c48a043c511a163c76316e21987
Signed-off-by: Meera Gande <mgande@codeaurora.org>
The correct sequence for enabling HOLB drop is first
to suspend the pipe and then to HOLB drop.
Change-Id: I78b7b268eec230a4993e446bd90846f800364e06
CRs-Fixed: 2141518
Acked-by: Ady Abraham <adya@qti.qualcomm.com>
Signed-off-by: Skylar Chang <chiaweic@codeaurora.org>
