In the case of a linkdown during pm_suspend, the
pci_saved_state during enumeration(default_state) is
used to restore config space. But this state is freed up
during pm_resume as part of pm_load_and_free_saved_state.
And if this state (default_state) is used again in case
of another linkdown, this leads to use after free.
Fix this by using a copy of the default_state instead
of the original copy for restoring config space incase
of a linkdown.
Change-Id: I6ac763ed88341c739f0b26992d1e31bf2513fdab
Signed-off-by: Sriharsha Allenki <sallenki@codeaurora.org>
A potential use after free can occur in _vm_unmap_aliases where an already
freed vmap_area could be accessed, Consider the following scenario:
Process 1 Process 2
__vm_unmap_aliases __vm_unmap_aliases
purge_fragmented_blocks_allcpus rcu_read_lock()
rcu_read_lock()
list_del_rcu(&vb->free_list)
list_for_each_entry_rcu(vb .. )
__purge_vmap_area_lazy
kmem_cache_free(va)
va_start = vb->va->va_start
Here Process 1 is in purge path and it does list_del_rcu on vmap_block and
later frees the vmap_area, since Process 2 was holding the rcu lock at
this time vmap_block will still be present in and Process 2 accesse it and
thereby it tries to access vmap_area of that vmap_block which was already
freed by Process 1 and this results in use after free.
Fix this by adding a check for vb->dirty before accessing vmap_area
structure since vb->dirty will be set to VMAP_BBMAP_BITS in purge path
checking for this will prevent the use after free.
Change-Id: Ibba0e2ee0d0f049aa0158b78b086aeaad6b70f68
Link: https://lkml.kernel.org/r/1616062105-23263-1-git-send-email-vjitta@codeaurora.org
Signed-off-by: Vijayanand Jitta <vjitta@codeaurora.org>
Git-Commit: ad216c0316ad6391d90f4de0a7f59396b2925a06
Git-Repo: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
Reviewed-by: Uladzislau Rezki (Sony) <urezki@gmail.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Add measure only support for QDSS related GCC clocks for
YUPIK.
Change-Id: Ia27282433a63d21929cad3bd8098cc91df445db8
Signed-off-by: Madhuri Medasani <mmedasan@codeaurora.org>
Add measure only support for QDSS related GCC clocks for
SHIMA.
Change-Id: I8aac50323865f71cc44461abb45a8ae97e75c314
Signed-off-by: Madhuri Medasani <mmedasan@codeaurora.org>
Moving boot KPI to sysnode by using “place_marker".
Change-Id: I0680584b23a63e4f185cf68c118e696ac956dd2e
Signed-off-by: Madhab Sharma <madhshar@codeaurora.org>
Update gcc_qup clocks of pm8008 to measure only
since these are not registered in GCC to avoid
the crash because of parent index in BLAIR.
Change-Id: Ia9d19b95331a43eab3c229405218e5871c073be1
Signed-off-by: Madhuri Medasani <mmedasan@codeaurora.org>
When changing USB speed via sysfs, the device might utilize the
idle time between DISCONNECT and CONNECT events and enter suspend.
As a result the pending CONNECT might get delayed thus pushing USB
enumeration during the next resume. Avoid this by not releasing the
wakeup source when usb restart is in progress.
Change-Id: I754b76eb7b36923a2dcd4d58587101750d1cd83c
Signed-off-by: Elson Roy Serrao <eserrao@codeaurora.org>
Defer mhi resume till M0 ack is notified to host.
This is to ensure no outstanding transfer completion events are
send to host before M0 ack.
Change-Id: Ia10fabc554b1cdef14a0771012b9ffea68851e25
Signed-off-by: Veerabhadrarao Badiganti <vbadigan@codeaurora.org>
When qdss open and close are called back to back at a high rate,
connect_work that gets queued in qdss open can execute after
qdss close. For qdss HW path the connect work that gets scheduled
as part of the next qdss open results in ep config failure as the
ep is already configured during previous connect work. Now before
queuing the request if there is a qdss close it would reset the dbm
ep configuration thus routing this request via software path instead
of dbm path. The subsequent dequeue would lead to a NULL pointer
dereference of completion callback. Fix this by flushing connect_work
as part of qdss close for graceful termination.
Change-Id: I8edf73ea1f87e297297828e6e25c7c14a422ec3a
Signed-off-by: Elson Roy Serrao <eserrao@codeaurora.org>
We would see the GPU recovery failure (or) GPU wake up problems
incase cx regulator disable wait timeouts. It’s important to dump
the cx regulator consumer list to understand the failures in case
of cx regulator disable wait timeouts.
Change-Id: I7bfca3d64dafae44645ae0651bf07580d7530829
Signed-off-by: Hareesh Gundu <hareeshg@codeaurora.org>
Use unshifted value to set the clock req override value
and enable fields as the register write function already
shifts the values to the correct position.
Change-Id: I0b5dea0f6f8462363471910ffe93f8f8975e7929
Signed-off-by: Siva Kumar Akkireddi <sivaa@codeaurora.org>
Signed-off-by: Veerabhadrarao Badiganti <vbadigan@codeaurora.org>
During D3hot, we are explicitly blocking L1 state by setting
REQ_EXIT_L1 bit of PM_CTRL register. If we transitioning back to D0
from D3 (without D3cold), REQ_EXIT_L1 bit won't get cleared. And
L1 would get blocked till next D3cold. Clear this explicitly during
D0 to avoid this scenario.
Change-Id: Ib168dee255f29832600ebca14eea1ac2ea393985
Signed-off-by: Veerabhadrarao Badiganti <vbadigan@codeaurora.org>
Change the clk_regmap_div_ro ops to clk_regmap_div ops to
allow dynamic configuration of the cdivs. This is required
for cphy configuration where the byte intf clock need to be
the same frequency as its byte clock.
Change-Id: Iddf733697b7287577f690bd5535a60f406b7129a
Signed-off-by: BIVASH KUMAR SINGH <bkumarsi@codeaurora.org>
Updating the return value of vchan_store, ctx_store, expimp_show
functions to return an integer count.
Submit code on behalf of Yashovardhan Bhatt.
Change-Id: I5c1ec7ed7add2471ed5809a9bb359d0b02792486
Signed-off-by: Zelong Ren <zeloren@codeaurora.org>
This mem_lock will cause deadlock when usb close router call back to
usb_notifier. so remove it.
Change-Id: I9530c843702ca605f6935cc0ac6d9649bf204594
Signed-off-by: Yuanfang Zhang <zhangyuanfang@codeaurora.org>
Allow IOSS Shim layer to be dynamically loaded as a kernel module.
Change-Id: Iac293adfb29954b12253b1ee08f64077606091cc
Signed-off-by: Manuel Gomez <gomez@codeaurora.org>
Disable access to PCIE config space registers and notify client
driver to recover link on reading PCIE endpoint config registers
as FF's.
Change-Id: Iea6b25036bc6d967d6598d08348bb41fc18ef304
Signed-off-by: Vivek Pernamitta <vpernami@codeaurora.org>
Currently we are not initializing cb_num for secure context.
This is causing problems in the kgsl fault handler path when
there is a pagefault for secure context. Hence initialize cb_num
for secure context.
Change-Id: I35a37193f512f315f443e9f0d92fdae11411bbd2
Signed-off-by: Harshitha Sai Neelati <hsaineel@codeaurora.org>
rpmh_rsc_debug() can race with tcs_tx_done() interrupt handler and
may not see any tcs busy and hence won't do bug_on(). Later it may
go ahead and free() the request which interrupt handler is processing.
Lets always bug_on() upon timeout.
Change-Id: I238a6a3639077850df158cb1f0190656e014bb57
Signed-off-by: Maulik Shah <mkshah@codeaurora.org>
Add check for maximum thermal state while setting
current state.
Change-Id: I4ade853d0cda1d8754486dc6dd8f53596fae7a9a
Signed-off-by: Naman Padhiar <npadhiar@codeaurora.org>
There is possibility of failure in getting large memory
during panic notifier callback. Hence try atomic snapshot
with 1MB in case default memory allocation fails.
Change-Id: I8f5ff29139d272dc35094c230e1868623585b476
Signed-off-by: Rohan Sethi <rohsethi@codeaurora.org>
This change is to avoid potential race btw stop rx and incoming
SOC RX data in parallel. During suspend path wait_for_transfers_inflight()
logic will check for TX/RX data pending for completion. Check for RX_LEN_IN
status in wait_for_transfers_inflight() and return -EBUSY to avoid race
between stop_rx and SOC RX data.
Change-Id: I28702d3dc11ee4b6d3fe5b4bad9a19099d8cf725
Signed-off-by: Chandana Kishori Chiluveru <cchiluve@codeaurora.org>
