Dummy transport is only way to access if_ptr. When dummy
transport is freed, if_ptr allocated for dummy transport is
not freed. This result in memory leak.
kfree of if_ptr is called before freeing dummy transport.
CRs-Fixed: 2116744
Change-Id: I832e0fcde418b7c3d992f50e817866bc9075da3c
Signed-off-by: Dhoat Harpal <hdhoat@codeaurora.org>
Data of intent is not freed even in purge_intent_list. This results
in memory leak.
Kfree is done for data before freeing intent.
CRs-Fixed: 2116744
Change-Id: Ib99261208df1cc9b63b4cd0a35ac0c7942efb4a8
Signed-off-by: Dhoat Harpal <hdhoat@codeaurora.org>
spcom server app might open the channel before the SP client app.
The asynchronous CONNECTED callback might be called while the server
is waiting for data.
Avoid locking the channel while waiting for data to avoid dead lock
while handling the CONNECTED callabck.
Change-Id: I7c576f240b60720a6f1461b3e48f4422c110e7c4
Signed-off-by: Amir Samuelov <amirs@codeaurora.org>
spcom_notify_state() is a callback called by glink upon channel connect.
It is asynchronous callback, that might be called after glink_close().
Avoid storing stale glink handle in such case.
Change-Id: I10359f38ca48f618899673f677a6409b01bc6618
Signed-off-by: Amir Samuelov <amirs@codeaurora.org>
MBA image size comparison check is currently being
done with a signed count whose value can possibly be
negative. If count value is negative then comparison
will always succeed and invoke memcpy with incorrect
value of count leading to buffer overflow. Fix this
by not using signed comparison.
Change-Id: Id2d0cafae01f940f36cfd559d4656fc0f022d6a5
Signed-off-by: Kaushal Kumar <kaushalk@codeaurora.org>
This change add a new ramdump device node which is only used to collect
SSR minidump by ramdump process.
Change-Id: I3af5c15798d3c74896a499c8db30e5733743f106
Signed-off-by: Avaneesh Kumar Dwivedi <akdwived@codeaurora.org>
This change does additional checks for more imem ToC entries
before invoking minidump.
This change also add few debug logs to ease process of debugging.
Change-Id: Ie70301d70fe85ec9f85573c0167098319c2b1cfe
Signed-off-by: Avaneesh Kumar Dwivedi <akdwived@codeaurora.org>
If userspace sends non-null terminated channel name then
out of bounds read is possible while printing channel name.
Fix this issue by validating channel name before use.
Change-Id: I418b7f446c6a849450dd4314592c1d3810163bdc
Signed-off-by: Vidyakumar Athota <vathota@codeaurora.org>
APPS interact with MPSS through 32 bit register interface.
Set dma mask for 32 bit so that mba and mdt memory are allocated
from 32 bit physical address range.
Change-Id: I623f00097d464b1bdd8f609e2d6c9a126f4bea4d
Signed-off-by: Arun KS <arunks@codeaurora.org>
spcom expose "pseudo file" char-device to user space.
The file operation callback function definition is using size_t for user
buffer size.
The spcom API uses uint32 as the spcom communication buffers are about
300 bytes, and the user space file operation read()/write() are limited to
PAGE_SIZE which is about 4KB.
Use explicit casting rather than implicit casting when fops callbacks
calls spcom internal functions.
CRs-Fixed: 2025174
Change-Id: I5d6bf71ab77f97ea350178bb8b3473fd4cefddfd
Signed-off-by: Amir Samuelov <amirs@codeaurora.org>
Initialize the has_locked member before running SSR
spinlock test to ensure consistent results.
CRs-Fixed: 2091946
Change-Id: Ifad37541a94668b496aa9204dc80920b9a7ff244
Signed-off-by: Chris Lew <clew@codeaurora.org>
Register the current stack and task_struct of all cpus to
the minidump table on panic.
Change-Id: I6906721f8c734dbf8142dc49e80dc730530f028c
Signed-off-by: Lingutla Chandrasekhar <clingutla@codeaurora.org>
Initialize glink link state to GLINK_LINK_STATE_DOWN to
return error if userspace sends glink command packet
before glink link is up.
Change-Id: I79b5e4eb5a743dd0b118ba1b28523bfea24044d7
Signed-off-by: Vidyakumar Athota <vathota@codeaurora.org>
Minidump is concise and bare minimum dump to enable technology
teams to debug most of subsystem issues. This change adds required
driver code changes to provide support of subsystem minidump.
Increase PIL timeout to give MBA more time for encryption
and decryption for modem segments.
Change-Id: I1d04a9306ce507bc610777bc476197f26c1e18ac
Signed-off-by: Avaneesh Kumar Dwivedi <akdwived@codeaurora.org>
free allocated memory in error handling of spcom_register_client()
and spcom_register_service() kernel API.
Change-Id: Ieb5787cb1a11d4b3320237fa8cdde3dc357d9084
Signed-off-by: Amir Samuelov <amirs@codeaurora.org>
In function glink_xprt_notify_rxv work item is queued without
wakelock. This allows system to go in suspend state without
scheduling this work item.
Wakelock is taken to avoid system suspend before workqueue
execution.
CRs-Fixed: 2098623
Change-Id: Ic5f74dbb4bf315f1cb6aa528367a6fb80e8a11b6
Signed-off-by: Dhoat Harpal <hdhoat@codeaurora.org>
Update the function return value and input scm_ret variable
type for restore secure configuration in scm_restore_sec_cfg() fn.
Adding scm_ret input variable for scm_get_feat_version() fn.
Change-Id: I5fff488f973b018f898eef616801a4b5e5a900fb
Signed-off-by: Zhiqiang Tu <ztu@codeaurora.org>
During Modem graceful shutdown, QMI messages from WLAN FW can
still be delivered to host even after icnss receives Modem
shutdown notification from SSR framework. So prevent processing
any such messages from FW after Modem shutdown.
CRs-Fixed: 2095386
Change-Id: Ice21d043393b0f7b97aaccd68e1b28702cc9e393
Signed-off-by: Sameer Thalappil <sameert@codeaurora.org>
spcom_device_poll() return POLLERR rather than -EINVAL.
Change-Id: Ifce0fa9c6a0a5136ae1d109543a9345ad77359bf
Signed-off-by: Amir Samuelov <amirs@codeaurora.org>
As part of optimization in msa permissions assignment
source and destination vmids are introduced as uninitialized
arrays.
The fix is for initialization of the array as zero initially
so that variables doesnot have the garbage value from the stack.
Change-Id: Ie30d61f3be9ed5a5a2cef2e63348d987e894c22a
CRs-fixed: 2096940
Signed-off-by: Anurag Chouhan <achouhan@codeaurora.org>
Add socinfo support and CPU IDs for SDM636
and SDA636 SOCs.
Change-Id: If14654c3fb93a52e4db0270e60cb6e6371ef077f
Signed-off-by: Srinivas Ramana <sramana@codeaurora.org>
This new driver is meant to be a cross-platform abstraction
layer for utilizing the underlying hypervisor system.
This API can be accessed from both user and kernel sides.
The intended users of this are the multimedia drivers who want
to communicate with the host OS to use the multimedia hardware.
Conflicts:
drivers/soc/qcom/Kconfig
drivers/soc/qcom/Makefile
include/uapi/linux/Kbuild
Change-Id: I37743df490d14249a9d378225771367750899eb0
Signed-off-by: Edward Lee <eleekimk@codeaurora.org>
Signed-off-by: Yimin Peng <yiminp@codeaurora.org>
The TX FIFO write reg and the RX FIFO read reg are controlled
by this processor. Keep track of the state of these two indexes
to reduce the amount of SPI reads.
CRs-Fixed: 2093123
Change-Id: I4ffa0e08bce6dabd57f33a13fef8107211ce3f09
Signed-off-by: Chris Lew <clew@codeaurora.org>
Initialize member value of struct apr_client_data after declaration.
CRs-Fixed: 2091948
Change-Id: I8a185ebd4126f7d064de90bf652bc96c2ab7b408
Signed-off-by: Yidong Huang <yidongh@codeaurora.org>
Currently ion fd is used to extract ion handle to free ion client.
ION FD is not valid if user-space application is crashed so ion handle
is returned to the client during msm_audio_ion_phys_assign() API which
is used to destroy ion client in msm_audio_ion_phys_free() API.
Change-Id: Idcc4ca838741aac26662a679117af9d9c935e630
Signed-off-by: Vidyakumar Athota <vathota@codeaurora.org>
Few function pointers are left uninitialized in dummy transport.
System can crash if these function pointer get dereferenced.
Initialize all the function pointers which can get called, with
dummy functions.
CRs-Fixed: 2067859
Change-Id: I9172776d9ffa0af5deb9898125fc6403fdcdee0f
Signed-off-by: Dhoat Harpal <hdhoat@codeaurora.org>
Add support to validate the result and error code
received from the WLAN firmware service.
CRs-fixed: 2095184
Change-Id: I454df58e293fbf2d99601d1c6820e67b5cae370c
Signed-off-by: Anurag Chouhan <achouhan@codeaurora.org>
In function parse_qos_dt_params, memory is allocated to arr32 but it
is never freed.
Free memory when exiting the function.
CRs-Fixed: 2093722
Change-Id: Ic1fc58c6685990e2865ef4033b54303d47311560
Signed-off-by: Dhoat Harpal <hdhoat@codeaurora.org>
Changes to reflect slight change in HAB API return values.
Change-Id: I8825f6fca6a50449a929f05c317d0beeb6908d26
Signed-off-by: Amit Blay <ablay@codeaurora.org>
Changes to reflect slight change in HAB API return values.
Change-Id: I8825f6fca6a50449a929f05c317d0beeb6908d26
Signed-off-by: Amit Blay <ablay@codeaurora.org>
Add changes to qbt1000 fingerprint driver to enable
input device to report KEY_VOLUMEDOWN when a finger
is detected. Add changes for supporting CBGE with
retry logic and multiple IPC messages.
Change-Id: I29a52c516a8f9216abc623ca3bfaebe19f89eaa3
Signed-off-by: Abir Ghosh <abirg@codeaurora.org>
