Userspace can cause the kref to handles to increment
arbitrarily high. Ensure it does not overflow.
Signed-off-by: Daniel Rosenberg <drosen@google.com>
Bug: 31992382
Test: See bug for poc
Change-Id: I6bff1df385742b1d836d43180dc87fadcea80782
Git-repo: https://android.googlesource.com/kernel/msm
Git-commit: 0c702db4d90de88df11057bcf0d8fb2dfe741605
Signed-off-by: Dennis Cagle <d-cagle@codeaurora.org>
If no matching domains found in response to the request, return error
instead of going ahead with memory allocation which would lead to
other issues.
CRs-Fixed: 2025293
Change-Id: I327b3494812cddc643f6b355c04f85f4baa7c399
Signed-off-by: Satya Durga Srinivasu Prabhala <satyap@codeaurora.org>
PCURx[MSB:LSB] is a 14-bit signed raw data, but treated as two full bytes
during reg reading, as a result bit 14 and 15 are filled with 0s. When
the raw data is negative, the mistreated reading gives positive result.
Hence the eventual PCURx after applying the gain and offset corrections
is incorrect.
Fix it by extending sign bit when negative.
Change-Id: Ia35406809355bd5e2d6cfeb890dd870430e38f66
Signed-off-by: Harry Yang <harryy@codeaurora.org>
As a prerequisite for subsystem restart support,
redesign driver main operations such as open,
read, write, poll, and close methods.
CRs-Fixed: 1097560
Change-Id: I7eb99a09de75a2afa1eb408cace6a03dca85f5fe
Signed-off-by: Sujeev Dias <sdias@codeaurora.org>
Latency involved in handling dwc3 interrupt in real time threaded
interrupt is sometimes resulting into RT throttling. Hence queue
bottom half work from dwc3 hard irq handler to a high priority
workqueue. Also, update the corresponding irq flag in host
controller platform driver.
Change-Id: If65a522efb6d792eea7fa7afc4c5e4dcd1cb6fb8
Signed-off-by: Hemant Kumar <hemantk@codeaurora.org>
Signed-off-by: Mayank Rana <mrana@codeaurora.org>
This is a workaround for STAR 9000961433 which affects only version
3.00a of the DWC_usb3 core. This prevents the controller interrupt from
being masked while handling events. Enabling interrupt moderation allows
us to work around this issue because once the GEVNTCOUNT.count is
written the IRQ is immediately deasserted and won't be asserted again
until GEVNTCOUNT.EHB is cleared.
Signed-off-by: John Youn <johnyoun@synopsys.com>
Signed-off-by: Felipe Balbi <felipe.balbi@linux.intel.com>
Change-Id: I18d507ec98401341d08537cd347aefd940c24da0
Git-commit: 28632b44d129cd2dc677475197a01cced307cfc5
Git-repo: git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
[hemantk@codeaurora.org: Moved WA to dwc3_core_init()]
Signed-off-by: Hemant Kumar <hemantk@codeaurora.org>
Signed-off-by: Mayank Rana <mrana@codeaurora.org>
Implement interrupt moderation which allows the interrupt rate to be
throttled. To enable this feature the dwc->imod_interval must be set to
1 or greater. This value specifies the minimum inter-interrupt interval,
in 250 ns increments. A value of 0 disables interrupt moderation.
This applies for DWC_usb3 version 3.00a and higher and for DWC_usb31
version 1.20a and higher.
Signed-off-by: John Youn <johnyoun@synopsys.com>
Signed-off-by: Felipe Balbi <felipe.balbi@linux.intel.com>
Change-Id: I5c5997c6eea817e49102b8e080f3a9bcf45305b4
Git-commit: cf40b86b6ef6df5262ef5a8463b42524e6aa5590
Git-repo: git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
[hemantk@codeaurora.org: removed write to DWC3_DEV_IMOD in dwc3_interrupt,
and fixed merge conflicts]
Signed-off-by: Hemant Kumar <hemantk@codeaurora.org>
Signed-off-by: Mayank Rana <mrana@codeaurora.org>
Add a helper function to check if we are running on a DWC_usb3 core.
Signed-off-by: John Youn <johnyoun@synopsys.com>
Signed-off-by: Felipe Balbi <felipe.balbi@linux.intel.com>
Change-Id: Ic0c3810b798df8bf34a2ad7e1879884e7bf3c8f5
Git-commit: a987a906e95c4d80a364629d6bcb7cf69d2018e4
Git-repo: git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
[mrana@codeaurora.org: resolved merge conflicts]
Signed-off-by: Mayank Rana <mrana@codeaurora.org>
Add a convenience function to check if the controller is DWC_usb31.
Signed-off-by: John Youn <johnyoun@synopsys.com>
Signed-off-by: Felipe Balbi <balbi@kernel.org>
Change-Id: I2f9080a4a54269790e3594d0e61a76bd37d8b2c9
Git-commit: c4137a9c841ec7fb300782d211f2d6907f4d6e20
Git-repo: git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
Signed-off-by: Mayank Rana <mrana@codeaurora.org>
Now that all the infrastructure is in place, we can
clear events in the top-half handler in order to
bring IRQ line low ASAP.
This is also a necessary step in order to implement
workaround for known erratum in follow-up patches.
Signed-off-by: John Youn <johnyoun@synopsys.com>
Signed-off-by: Felipe Balbi <felipe.balbi@linux.intel.com>
Change-Id: Ic0823f85c0386045ab4865544bef0403ec047a99
Git-commit: 65aca3205046d159b2c79f7531203a53aec9cf35
Git-repo: git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
[hemantk@codeaurora.org: resolved merge conflict by replacing
DWC3_GEVNTCOUNT(0) with DWC3_GEVNTCOUNT(buf)]
Signed-off-by: Hemant Kumar <hemantk@codeaurora.org>
Signed-off-by: Mayank Rana <mrana@codeaurora.org>
RmNet driver provides a transport agnostic MAP (multiplexing and
aggregation protocol) support in embedded and bridge modes. Module
provides virtual network devices which can be attached to any IP-mode
physical device. This will be used to provide all MAP functionality
on future hardware in a single consistent location.
CRs-Fixed: 2022292
Change-Id: I4dd0f4fcf00bbf9dcbec65cec82436d48a813ecc
Signed-off-by: Subash Abhinov Kasiviswanathan <subashab@codeaurora.org>
Add support for subsystem restart and shutdown processing
for slave mode and master mode.
CRs-Fixed: 1097560
Change-Id: I8c60605d202d38a7a8f8fb587a179f95ec402692
Signed-off-by: Sujeev Dias <sdias@codeaurora.org>
Update the KTM boot mitigation configuration to poll at
50 milliseconds and do frequency mitigation at 80c and
hotplug at 90C for msm8996pro.
CRs-Fixed: 1007266
Change-Id: I8537c5d8fd86d90f607a719c618157f4a2fbfad9
Signed-off-by: Ram Chandrasekar <rkumbako@codeaurora.org>
After wlan host driver probe failure and driver unload check the
memory leak and reset the memory pool.
CRs-Fixed: 2027407
Change-Id: Id6e413416ec7ea1d1bf0e69aab7eccb06de753d7
Signed-off-by: Hardik Kantilal Patel <hkpatel@codeaurora.org>
Remove synaptics v2.6 touch driver from the kernel code
as it has never been used in any of the recent platforms.
Change-Id: Ibf14dec548a180e517d9b41098af642577c4328b
Signed-off-by: Shantanu Jain <shjain@codeaurora.org>
This feature adds support to check the pre allocated memory
pool status at runtime. This debugfs entry provide the required
information for wlan host driver memory profiling and adds support
to debug the pre-alloc memory failure issue.
feature:
1. Total amount of pre-alloc memory avail and used in the
memory pool.
2. Pre-alloc memory status per slots(used/free).
CRs-Fixed: 2027352
Change-Id: I61c51f93dd7462b1fa9c36f6eea3814a6acbdd34
Signed-off-by: Sarada Prasanna Garnayak <sgarna@codeaurora.org>
Signed-off-by: Hardik Kantilal Patel <hkpatel@codeaurora.org>
Current implementation adds more delay in wake up time programmed
due to round off errors. Minimize round off errors in calculation.
Change-Id: Iddb19c6dae79c999de9fae444f0c64aac0500f42
Signed-off-by: Maulik Shah <mkshah@codeaurora.org>
Add device tree files for analog audio over USBC support
for RCM platform of SDM660 & SDM630.
Change-Id: I0aa36adcdd71414f4f8091f02cb1ac3b61ab5c07
Signed-off-by: Prateek Sood <prsood@codeaurora.org>
Change the fast charge current of ascent battery to 2A as the
maximum current limit is 2.1 A. Set CC_CV threshold for ST1031GA
battery to 4.39 V.
Change-Id: I3e270105f1d6ae105890d1905906c3648926c314
Signed-off-by: Subbaraman Narayanamurthy <subbaram@codeaurora.org>
Update GFX PM-QoS entries according to the measured
LPM latencies for SDM630 to prevent l2-pc.
Change-Id: I3a59a26bf19d79393c4b45c8a3b243897f3f6eb2
Signed-off-by: Deepak Kumar <dkumar@codeaurora.org>
Modify detection sequence to support the fast special headset
detection with more reliable plug type result.
Change-Id: I74df2c8c54e49a3888511843a15122ca708425ed
CRs-Fixed: 2022622
Signed-off-by: Walter Yang <yandongy@codeaurora.org>
It is observed that the USB_PHY may interfere with APSD
when the charger is inserted at PON. This may lead to
incorrect charger type detection.
Fix this by doing a APSD re-run during driver initialization
if USB is present and regardless of the charger type.
CRs-Fixed: 2011764
Change-Id: Icc9ee7bacf0eecdb311ca52979758514abca154e
Signed-off-by: Anirudh Ghayal <aghayal@codeaurora.org>
commit 82f2935616 ("usb: gadget: f_mass_storage: Allow USB LPM
upon ep disable") just increments power usage count by 1 for dwc3 device
in thread handler. Since child count for dwc3 parent remains 0, there is
possibility of dwc3 parent going into suspend even if dwc3 power usage
count is set to 1. This causes unclocked register access as mdwc gets
runtime suspended and mass storage thread handler disables the endpoint.
Fix this issue by calling usb_gadget_autopm_get_async() in set_alt which
increments dwc3 power usage count and carry out resume asynchronously.
Change-Id: Iccce928590d8e67e234f0aa371f78eb1e6a326b7
Signed-off-by: Mayank Rana <mrana@codeaurora.org>
In ipc_log_string() the return value from vsnprintf(), data_size,
is used to increment ectxt.offset. However, this length could
actually be much larger than that of ectxt.buff itself. This is a
typical mistake of [v]snprintf() usage [1], in that it returns
not the number of characters written but how many characters
*would* have been written regardless of whether it was truncated.
The result is that even though ectxt.buff itself is not overrun,
the incorrect size in ectxt.offset will be later used as the length
parameter when memcpy()'ing to the ipc_log_page's data, overflowing
that memory and beyond. The write_page's write_offset would also
indicate an out-of-bounds (greater than PAGE_SIZE) length.
The fix is simple: use vscnprintf() instead of vsnprintf().
[1] https://lwn.net/Articles/69419/
Change-Id: I2e9d44e74f5f30a009732e31a554d82e31946999
Signed-off-by: Jack Pham <jackp@codeaurora.org>
Due to an existing HW workaround, the UFP_EN_CMD bit may end up
getting cleared even after having been set. The result of this
is the Type-C state machine returns to DRP behavior despite SW
intention to force sink mode, such as PR Swap or Try.SNK.
Temporarily disable this particular HW trigger whenever the
typec_power_role property is getting set to sink-only mode, and
restore it when leaving sink mode.
Change-Id: I21e840bfeee3ad88b0562645378b1fea200e3803
Signed-off-by: Jack Pham <jackp@codeaurora.org>
Signed-off-by: Abhijeet Dharmapurikar <adharmap@codeaurora.org>
Update secondary MI2S DAI entry to use SD0 for TX path and SD1
for RX path, and add secondary MI2S DAI in the automotive sound
card entry for msm8996 automotive ADP/CDP platforms.
CRs-fixed: 2026814
Change-Id: I7c29aa605549f54339b108beae39a4e8816ac6dd
Signed-off-by: Honghao Liu <honghaol@codeaurora.org>
Make sure rate for camss vfe clock is set before enabling it.
Also, reuse existing variables for the vfe src clk.
CRs-Fixed: 2013802
Change-Id: Ic4acd4c8330b9300ea6bb84eb99a120453841f7a
Signed-off-by: Alok Kediya <kediya@codeaurora.org>
Currently when WIGIG FW crashes and SSR is in SYSTEM mode,
SSR causes a kernel panic and its panic handler will call
msm_11ad_ssr_crash_shutdown which will copy the FW crash
dump. However this is done when kernel panic is in progress
and kernel is not fully operational, so sometimes the copy
fails and the FW crash dump will not be found in the DDR
dump from the device.
Fix this problem by copying the FW crash dump before
notifying SSR, so the crash dump will always be copied
correctly when WIGIG FW crashes.
We also keep copying in crash_shutdown so the WIGIG FW
crash dump will be available also after normal kernel
panics, though it is not always copied in this case.
Change-Id: Idabb1497d8a1f60a74191f1c93ec5b2ce3b3043c
Signed-off-by: Lior David <liord@codeaurora.org>
