Retain the old copyright year which was dropped during propagation of
a recent change.
Fixes: dd473e6c28 ("haven: hh_rm_core: Change datatype of
num_fragments").
Change-Id: If8d66b096403ae1c54c072ef86a1bfbda828f50f
Signed-off-by: Guru Das Srinagesh <gurus@codeaurora.org>
This change enables the framework needed to run the link layer
tests on sdxlemur.
Change-Id: I05975750d84cdbb6583bd314cce6912c8b1e9599
Signed-off-by: Elson Roy Serrao <eserrao@codeaurora.org>
Change done to support 32 clients for mac based filtering.
Change-Id: I69e652f2962dc94025dbb0b1936236214034c2d5
Signed-off-by: Praveen Kurapati <pkurapat@codeaurora.org>
Consider a case where DUT is in a low memory condition and
it is switching between host and none frequently. This can
lead the driver to fail the allocation of primary event ring
and go into error path where it will try to cleanup the event
ring. Since secondary event ring was not even initialized, while
fetching the entries to cleanup, it will lead to NULL pointer
dereference.
Avoid this by adding a NULL check for secondary event ring before
fetching the entries and bailing out early from cleanup function.
Change-Id: I21488d0e0a02347a392d890918c5c874b704795f
Signed-off-by: Pratham Pratap <prathampratap@codeaurora.org>
When charging with some fixed voltage USBPD adapters and when VBUS voltage
is moving from 9V to 5V, usbin-ov interrupt is triggered because of the
VBUS voltage is not settled before updating 5V VBUS allowance. To avoid
this, adding 40ms delay before updating 5V VBUS allowance.
Change-Id: I1a439210e7ceb46bf59f900f3c72e71715c590d3
Signed-off-by: Fenglin Wu <fenglinw@codeaurora.org>
Add support to read ibat range factor from nvmem and use it to
scale ibat current for greater than default max supported
ibat range.
Change-Id: Iee83be8d6663920d4df0b792417820d222e3ff46
Signed-off-by: Gopala Krishna Nuthaki <gnuthaki@codeaurora.org>
Add slatecom_interface header file in gen_headers to make it
accessible from userspace modules who uses Android.bp files
for compilation.
Change-Id: Ie298ec28983c16999d941ee8667e2dd7b5c3db22
Signed-off-by: Kiran Gunda <kgunda@codeaurora.org>
Integer overflow can occur for a large value of req_buff_size because
num_fragments is declared as u8. Declare it as int in order to prevent
this from occurring.
Change-Id: I9e3655af13134ec57d123317ebb7b287a7470a19
Signed-off-by: Guru Das Srinagesh <gurus@codeaurora.org>
Signed-off-by: Swetha Chikkaboraiah <schikk@codeaurora.org>
Update the fmax frequency to 200MHz for SDCC clock.
Change-Id: If77e30d586e3b33c35a7ccf3cd67eb98b6dac101
Signed-off-by: Taniya Das <tdas@codeaurora.org>
Smmu driver keeps a vote on cx gdsc to block cx gdsc collapse
when CONFIG_ARM_SMMU_POWER_ALWAYS_ON is enabled. So don't bother
polling for cx gdsc collapse during the slumber sequence when this
config is enabled.
Change-Id: Iacbbfcc76600e0e567610265d5da87146946df66
Signed-off-by: Hareesh Gundu <hareeshg@codeaurora.org>
Adding new API to perform host reset request to device
to collect device side dumps.
Use mhi_soc_reset() API in place of register write
Currently, a direct register write is used when ramdump collection
in panic path occurs. Replace that with new mhi_soc_reset() API
such that a controller defined reset() function is exercised if
one is present and the regular SOC reset is done if it is not.
Change-Id: Ibd15b231072a9b811ced0031387d605184806e9a
Signed-off-by: Vivek Pernamitta <vpernami@codeaurora.org>
Signed-off-by: Bhaumik Bhatt <bbhatt@codeaurora.org>
The MHI specification allows to perform a hard reset of the device
when writing to the SOC_RESET register. It can be used to completely
restart the device (e.g. in case of unrecoverable MHI error).
This is up to the MHI controller driver to determine when this hard
reset should be used, and in case of MHI errors, should be used as
a reset of last resort (after standard MHI stack reset).
This function is a stateless function, the MHI layer do nothing except
triggering the reset by writing into the right register(s), this is up
to the caller to ensure right mhi_controller state (e.g. unregister the
controller if necessary).
Change-Id: I84a7c02b243301fd6e7d61fe8d23443aa4f8a171
Signed-off-by: Loic Poulain <loic.poulain@linaro.org>
Reviewed-by: Manivannan Sadhasivam <manivannan.sadhasivam@linaro.org>
Signed-off-by: Manivannan Sadhasivam <manivannan.sadhasivam@linaro.org>
Git-commit: b5a8d233a588b3acf2a7a3a8da30f8f68f376626
Git-repo: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
Signed-off-by: Bhaumik Bhatt <bbhatt@codeaurora.org>
Signed-off-by: Vivek Pernamitta <vpernami@codeaurora.org>
It is expected from the clients to follow the below steps on an imported
dmabuf fd:
a) dmabuf = dma_buf_get(fd) // Get the dmabuf from fd
b) dma_buf_attach(dmabuf); // Clients attach to the dmabuf
o Here the kernel does some slab allocations, say for
dma_buf_attachment and may be some other slab allocation in the
dmabuf->ops->attach().
c) Client may need to do dma_buf_map_attachment().
d) Accordingly dma_buf_unmap_attachment() should be called.
e) dma_buf_detach () // Clients detach to the dmabuf.
o Here the slab allocations made in b) are freed.
f) dma_buf_put(dmabuf) // Can free the dmabuf if it is the last
reference.
Now say an erroneous client failed at step c) above thus it directly
called dma_buf_put(), step f) above. Considering that it may be the last
reference to the dmabuf, buffer will be freed with pending attachments
left to the dmabuf which can show up as the 'memory leak'. This should
at least be reported as the WARN().
Change-Id: Ia58b41500be943fe3c2da3eb0f5480ae99715de2
Signed-off-by: Charan Teja Reddy <charante@codeaurora.org>
Reviewed-by: Christian König <christian.koenig@amd.com>
Link: https://patchwork.freedesktop.org/patch/msgid/1627043468-16381-1-git-send-email-charante@codeaurora.org
Signed-off-by: Christian König <christian.koenig@amd.com>
This change enables the host mode compliance config on sdxlemur.
Change-Id: Ied9e01d73fec84918ece143b8c54b4b30f9045bc
Signed-off-by: Elson Roy Serrao <eserrao@codeaurora.org>
is_flush_rq() is called from bt_iter()/bt_tags_iter(), and runs the
following check:
hctx->fq->flush_rq == req
but the passed hctx from bt_iter()/bt_tags_iter() may be NULL because:
1) memory re-order in blk_mq_rq_ctx_init():
rq->mq_hctx = data->hctx;
...
refcount_set(&rq->ref, 1);
OR
2) tag re-use and ->rqs[] isn't updated with new request.
Fix the issue by re-writing is_flush_rq() as:
return rq->end_io == flush_end_io;
which turns out simpler to follow and immune to data race since we have
ordered WRITE rq->end_io and refcount_set(&rq->ref, 1).
Fixes: 2e315dc07df0 ("blk-mq: grab rq->refcount before calling ->fn in
blk_mq_tagset_busy_iter")
Cc: "Blank-Burian, Markus, Dr." <blankburian@uni-muenster.de>
Cc: Yufen Yu <yuyufen@huawei.com>
Signed-off-by: Ming Lei <ming.lei@redhat.com>.
Bug: 197804811
Change-Id: I4c19fc2c7d39235b0e95a622f26646a353a19ee9
[Upstream: cherry picked from commit a9ed27a764156929efe714033edb3e9023c5f321]
[Pradeep: Resolved conflicts in block/blk.h]
Signed-off-by: Pradeep P V K <pragalla@codeaurora.org>
Git-commit: ec1b6ab9fe
Git-repo: https://android.googlesource.com/kernel/common/
Signed-off-by: Pradeep P V K <pragalla@codeaurora.org>
Before we free request queue, clearing flush request reference in
tags->rqs[], so that potential UAF can be avoided.
Based on one patch written by David Jeffery.
Tested-by: John Garry <john.garry@huawei.com>
Reviewed-by: Bart Van Assche <bvanassche@acm.org>
Reviewed-by: David Jeffery <djeffery@redhat.com>
Signed-off-by: Ming Lei <ming.lei@redhat.com>.
Bug: 197804811
Change-Id: I9600626e807a4eed546c21be808fabed2a9db9b1
[Upstream: cherry picked from commit 364b61818f65045479e42e76ed8dd6f051778280]
[Todd: refactored to avoid breaking KMI ]
Signed-off-by: Pradeep P V K <pragalla@codeaurora.org>
Signed-off-by: Todd Kjos <tkjos@google.com>
Git-commit: c9a3b51b07
Git-repo: https://android.googlesource.com/kernel/common/
Signed-off-by: Pradeep P V K <pragalla@codeaurora.org>
refcount_inc_not_zero() in bt_tags_iter() still may read one freed
request.
Fix the issue by the following approach:
1) hold a per-tags spinlock when reading ->rqs[tag] and calling
refcount_inc_not_zero in bt_tags_iter()
2) clearing stale request referred via ->rqs[tag] before freeing
request pool, the per-tags spinlock is held for clearing stale
->rq[tag]
So after we cleared stale requests, bt_tags_iter() won't observe
freed request any more, also the clearing will wait for pending
request reference.
The idea of clearing ->rqs[] is borrowed from John Garry's previous
patch and one recent David's patch.
Tested-by: John Garry <john.garry@huawei.com>
Reviewed-by: David Jeffery <djeffery@redhat.com>
Reviewed-by: Bart Van Assche <bvanassche@acm.org>
Signed-off-by: Ming Lei <ming.lei@redhat.com>.
Bug: 197804811
Change-Id: If49478d7b05d3f5b0a26966ddf9ae764cf2fb6b0
[Upstream: cherry picked from commit bd63141d585bef14f4caf111f6d0e27fe2300ec6]
[Todd: refactored to avoid breaking KMI ]
Signed-off-by: Pradeep P V K <pragalla@codeaurora.org>
Signed-off-by: Todd Kjos <tkjos@google.com>
Git-commit: bb96e7f45d
Git-repo: https://android.googlesource.com/kernel/common/
Signed-off-by: Pradeep P V K <pragalla@codeaurora.org>
Grab rq->refcount before calling ->fn in blk_mq_tagset_busy_iter(), and
this way will prevent the request from being re-used when ->fn is
running. The approach is same as what we do during handling timeout.
Fix request use-after-free(UAF) related with completion race or queue
releasing:
- If one rq is referred before rq->q is frozen, then queue won't be
frozen before the request is released during iteration.
- If one rq is referred after rq->q is frozen, refcount_inc_not_zero()
will return false, and we won't iterate over this request.
However, still one request UAF not covered: refcount_inc_not_zero() may
read one freed request, and it will be handled in next patch.
Tested-by: John Garry <john.garry@huawei.com>
Reviewed-by: Christoph Hellwig <hch@lst.de>
Reviewed-by: Bart Van Assche <bvanassche@acm.org>
Signed-off-by: Ming Lei <ming.lei@redhat.com>.
Bug: 197804811
Change-Id: I0e431a8361d1412aaca3f7c0310780d9a9ad0db8
[Upstream: cherry picked from commit 2e315dc07df009c3e29d6926871f62a30cfae394]
[Pradeep: Resolved conflicts in block/blk-mq-tag.c]
Git-commit: a5d38e7c26
Git-repo: https://android.googlesource.com/kernel/common/
Signed-off-by: Pradeep P V K <pragalla@codeaurora.org>
If host is not using qrtr channel, Tx on device may block for
availabilty of tre. If we try to unregister qrtr endpoint at
the same time it will block for endpoint lock held in Tx path.
Unblock any Tx before calling qrtr endpoint unregister.
Change-Id: I59b1a68fd2279ba6bc472a3a532102e82f094175
Signed-off-by: Deepak Kumar Singh <deesin@codeaurora.org>
The pm8008 regulator is connected over I2C and the I2C device configures
its BW vote in runtime_resume and runtime_suspend. These callbacks are
triggered from the pm8008 driver's regmap calls. This means regulator
framework requests for pm8008 call into the ICC framework which in turn
calls into clock framework.
The qcom rpm smd clock providers calls into RPM message with the
the regulator framework, ICC framework and clock framework locks held.
To prevent these deadlocks, enable the I2C qup clocks required for pm8008
by default during probe and stop requesting for clock enable/rate from the
framework.
Change-Id: Ifd486bec85a46139ccb15f4b5dbd2d43c33f3fda
Signed-off-by: Taniya Das <tdas@codeaurora.org>
