aboutsummaryrefslogtreecommitdiff
AgeCommit message (Collapse)Author
2022-10-28arm64: dts: qcom: sc8280xp: Add bwmon instanceslenovo-x13s/6.0-bwmonBjorn Andersson
Add the two bwmon instances and define votes for CPU -> LLCC and LLCC -> DDR, with bandwidth values based on the downstream DeviceTree. Signed-off-by: Bjorn Andersson <quic_bjorande@quicinc.com>
2022-10-28arm64: dts: qcom: sc8280xp: Set up L3 scalingBjorn Andersson
Add the L3 interconnect path to all CPUs and define the bandwidth requirements for all opp entries across sc8280xp and sa8540p. The values are based on the tables reported by the hardware, distributed such that each value is the largest value, lower than the cluster frequency. Signed-off-by: Bjorn Andersson <quic_bjorande@quicinc.com>
2022-10-28arm64: dts: qcom: sc8280xp: Add epss_l3 nodeBjorn Andersson
Add a device node for the EPSS L3 frequency domain. Signed-off-by: Bjorn Andersson <quic_bjorande@quicinc.com>
2022-10-28arm64: dts: qcom: Align with generic osm-l3/epss-l3Bjorn Andersson
Update all references to OSM or EPSS L3 compatibles, to include the generic compatible, as defined by the updated binding. Signed-off-by: Bjorn Andersson <quic_bjorande@quicinc.com>
2022-10-28dt-bindings: interconnect: Add sm8350, sc8280xp and generic OSM L3 compatiblesBjorn Andersson
Add EPSS L3 compatibles for sm8350 and sc8280xp, but while at it also introduce generic compatible for both qcom,osm-l3 and qcom,epss-l3. Signed-off-by: Bjorn Andersson <quic_bjorande@quicinc.com>
2022-10-28interconnect: qcom: osm-l3: Simplify osm_l3_set()Bjorn Andersson
The aggregation over votes for all nodes in the provider will always only find the bandwidth votes for the destination side of the path. Further more, the average kBps value will always be 0. Simplify the logic by directly looking at the destination node's peak bandwidth request. Signed-off-by: Bjorn Andersson <quic_bjorande@quicinc.com>
2022-10-28interconnect: qcom: osm-l3: Add per-core EPSS L3 supportBjorn Andersson
The EPSS instance in e.g. SM8350 and SC8280XP has per-core L3 voting enabled. In this configuration, the "shared" vote is done using the REG_L3_VOTE register instead of PERF_STATE. Rename epss_l3 to clarify that it's affecting the PERF_STATE register and add a new L3_VOTE description. Given platform lineage it's assumed that the L3_VOTE-based case will be the predominant one, so use this for a new generic qcom,epss-l3 compatible. While adding the EPSS generic, also add qcom,osm-l3. Signed-off-by: Bjorn Andersson <quic_bjorande@quicinc.com>
2022-10-28interconnect: qcom: osm-l3: Squash common descriptorsBjorn Andersson
Each platform defines their own OSM L3 descriptor, but in practice there's only two: one for OSM and one for EPSS. Remove the duplicated definitions. Signed-off-by: Bjorn Andersson <quic_bjorande@quicinc.com>
2022-10-28interconnect: qcom: osm-l3: Use platform-independent node idsBjorn Andersson
The identifiers used for nodes needs to be unique in the running system, but defining them per platform results in a lot of duplicated definitions and prevents us from using generic compatibles. As these identifiers are not exposed outside the kernel, change to use driver-local numbers, picked completely at random. Signed-off-by: Bjorn Andersson <quic_bjorande@quicinc.com>
2022-10-28phy: qcom-qmp-combo: fix NULL-deref on runtime resumeJohan Hovold
Commit fc64623637da ("phy: qcom-qmp-combo,usb: add support for separate PCS_USB region") started treating the PCS_USB registers as potentially separate from the PCS registers but used the wrong base when no PCS_USB offset has been provided. Fix the PCS_USB base used at runtime resume to prevent dereferencing a NULL pointer on platforms that do not provide a PCS_USB offset (e.g. SC7180). Fixes: fc64623637da ("phy: qcom-qmp-combo,usb: add support for separate PCS_USB region") Cc: stable@vger.kernel.org # 5.20 Signed-off-by: Johan Hovold <johan+linaro@kernel.org>
2022-10-28HACK: prevent crash when hotplug event is NULLSteev Klimaszewski
https://lore.kernel.org/linux-arm-msm/Y1efJh11B5UQZ0Tz@hovoldconsulting.com
2022-10-28laptop_defconfig: Add a few options for fedoraAndrew Halaney
This adds a few options to make the x13s more usable on fedora. * CONFIG_SECCOMP for chronyd (to update system clock) * CONFIG_FW_LOADER_COMPRESS for linux-firmware (fedora has xz compressed firmware) * CONFIG_EFI_GENERIC_STUB_INITRD_CMDLINE_LOADER for initrd loading with the EFI stub (used with sd-boot) Two sc8280xp options became removed from make savedefconfig as well, they don't appear to exist in this branch. Signed-off-by: Andrew Halaney <ahalaney@redhat.com>
2022-10-28soc/qcom/pmic_glink: dr_release_t passes data as resEric Chanudet
dr_release_t passes the pointer to the data of the allocated resource directly. Use res as is without dereferencing. The following trace happens reliably when pdr_handle_alloc EPROBE_DEFER (seen on X13s at boot and similar at qcom_battmgr unload): Unable to handle kernel NULL pointer dereference at virtual address 0000000000000958 Mem abort info: ESR = 0x0000000096000004 EC = 0x25: DABT (current EL), IL = 32 bits SET = 0, FnV = 0 EA = 0, S1PTW = 0 FSC = 0x04: level 0 translation fault Data abort info: ISV = 0, ISS = 0x00000004 CM = 0, WnR = 0 user pgtable: 4k pages, 48-bit VAs, pgdp=0000000106b92000 [0000000000000958] pgd=0000000000000000, p4d=0000000000000000 Internal error: Oops: 96000004 [#1] PREEMPT SMP Modules linked in: llcc_qcom qcom_battmgr aes_ce_blk pmic_glink_altmode aes_ce_cipher ghash_ce gf128mul sha2_ce sha256_arm64 sha1_ce gpio_sbu_mux pmic_glink gpio_keys autofs4 CPU: 2 PID: 182 Comm: kworker/u16:5 Not tainted 6.0.0-rc6 #29 Hardware name: LENOVO 21BX0016US/21BX0016US, BIOS N3HET47W (1.19 ) 07/04/2022 Workqueue: events_unbound deferred_probe_work_func pstate: 80400005 (Nzcv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--) pc : mutex_lock+0x1c/0x60 lr : _devm_pmic_glink_release_client+0x2c/0x74 [pmic_glink] sp : ffff80000c553970 x29: ffff80000c553970 x28: 0000000000000000 x27: 0000000000000000 x26: ffffc297e181e0e8 x25: ffffc297e181d000 x24: ffffc2984efd9a80 x23: ffffc2984ea7a008 x22: ffff1738863cc3a0 x21: ffff80000c553a28 x20: 0000000000000958 x19: ffff1738863cc9f8 x18: ffffffffffffffff x17: 0000000000000000 x16: ffffc2984e1bb110 x15: 61622d6d6f63713d x14: ffffc2984f3b23e0 x13: 554e514553007972 x12: 0000000000000000 x11: 00313731333d4d55 x10: 0000000000000000 x9 : ffffc297e181d1cc x8 : ffff80000c553910 x7 : 0000000000000000 x6 : 0000000080200016 x5 : 0000000000000038 x4 : 0000000000000000 x3 : 0000000000000958 x2 : ffff17388522c100 x1 : 0000000000000000 x0 : 0000000000000958 Call trace: mutex_lock+0x1c/0x60 release_nodes+0x68/0x100 devres_release_all+0x94/0xf0 device_unbind_cleanup+0x20/0x70 device_release_driver_internal+0x214/0x260 device_release_driver+0x20/0x30 bus_remove_device+0xdc/0x170 device_del+0x178/0x3ac pmic_glink_probe+0x1e8/0x240 [pmic_glink] platform_probe+0x70/0xcc really_probe+0xc8/0x3e0 __driver_probe_device+0x84/0x190 driver_probe_device+0x44/0x100 __device_attach_driver+0xc4/0x160 bus_for_each_drv+0x84/0xe0 __device_attach+0xa4/0x1c4 device_initial_probe+0x1c/0x30 bus_probe_device+0xa4/0xb0 deferred_probe_work_func+0xc0/0x114 process_one_work+0x1ec/0x470 worker_thread+0x74/0x410 kthread+0xfc/0x110 ret_from_fork+0x10/0x20 Code: d5384102 d503201f d2800001 aa0103e4 (c8e47c02) ---[ end trace 0000000000000000 ]--- Somehow, this results in the display not outputting and a black backlight is all that is seen. Signed-off-by: Eric Chanudet <echanude@redhat.com> [halaney: Add comment about display] Signed-off-by: Andrew Halaney <ahalaney@redhat.com>
2022-10-26soc: qcom: stats: Mark device as having no PM supportStephen Boyd
This driver purely exposes information from memory to the kernel. Let's mark it as not having any device PM functionality, so that during suspend we skip even trying to call a suspend function on this device. This clears up suspend logs more than anything else, but it also shaves a few cycles off suspend. Cc: Konrad Dybcio <konrad.dybcio@somainline.org> Signed-off-by: Stephen Boyd <swboyd@chromium.org>
2022-10-26soc: qcom: cmd-db: Mark device as having no PM supportStephen Boyd
This driver purely exposes information from memory to the kernel. Let's mark it as not having any device PM functionality, so that during suspend we skip even trying to call a suspend function on this device. This clears up suspend logs more than anything else, but it also shaves a few cycles off suspend. Cc: Konrad Dybcio <konrad.dybcio@somainline.org> Signed-off-by: Stephen Boyd <swboyd@chromium.org>
2022-10-26drm/msm: Remove redundant check for 'submit'Aashish Sharma
Rectify the below smatch warning: drivers/gpu/drm/msm/msm_gem_submit.c:963 msm_ioctl_gem_submit() warn: variable dereferenced before check 'submit' 'submit' is normally error pointer or valid, so remove its NULL initializer as it's confusing and also remove a redundant check for it's value. Signed-off-by: Aashish Sharma <shraash@google.com> Reported-by: kernel test robot <lkp@intel.com> Reported-by: Dan Carpenter <dan.carpenter@oracle.com> Reviewed-by: Guenter Roeck <groeck@chromium.org>
2022-10-26bus: mhi: host: Fix race between channel preparation and M0 eventQiang Yu
There is a race condition where mhi_prepare_channel() updates the read and write pointers as the base address and in parallel, if an M0 transition occurs, the tasklet goes ahead and rings doorbells for all channels with a delta in TRE rings assuming they are already enabled. This causes a null pointer access. Fix it by adding a channel enabled check before ringing channel doorbells. Signed-off-by: Qiang Yu <quic_qianyu@quicinc.com>
2022-10-26bus: mhi: host: Add session ID to MHI controllerQiang Yu
Session ID to be used during BHI transfers to recognize a particular session are currently not being stored in the MHI controller structure. Store them to allow for tracking and other future usage. Signed-off-by: Qiang Yu <quic_qianyu@quicinc.com>
2022-10-26bus: mhi: host: Use mhi_soc_reset() API in place of register writeQiang Yu
Currently, a direct register write is used when ramdump collection in panic path occurs. Replace that with new mhi_soc_reset() API such that a controller defined reset() function is exercised if one is present and the regular SOC reset is done if it is not. Signed-off-by: Qiang Yu <quic_qianyu@quicinc.com> Reviewed-by: Loic Poulain <loic.poulain@linaro.org> Reviewed-by: Jeffrey Hugo <quic_jhugo@quicinc.com>
2022-10-26cpufreq: qcom: fix writes in read-only memory regionFabien Parent
This commit fixes a kernel oops because of a write in some read-only memory: [ 9.068287] Unable to handle kernel write to read-only memory at virtual address ffff800009240ad8 ..snip.. [ 9.138790] Internal error: Oops: 9600004f [#1] PREEMPT SMP ..snip.. [ 9.269161] Call trace: [ 9.276271] __memcpy+0x5c/0x230 [ 9.278531] snprintf+0x58/0x80 [ 9.282002] qcom_cpufreq_msm8939_name_version+0xb4/0x190 [ 9.284869] qcom_cpufreq_probe+0xc8/0x39c ..snip.. The following line defines a pointer that point to a char buffer stored in read-only memory: char *pvs_name = PVS_NAME; This pointer is meant to hold a template "speedXX-pvsXX-vXX" where the XX values get overridden by the qcom_cpufreq_krait_name_version function. Since the template is actually stored in read-only memory, when the function executes the following call we get an oops: snprintf(*pvs_name, sizeof(PVS_NAME), "speed%d-pvs%d-v%d", speed, pvs, pvs_ver); To fix this issue, we instead store the template name onto the stack by using the following syntax: char pvs_name_buffer[] = PVS_NAME; Because the `pvs_name` needs to be able to be assigned to NULL, the template buffer is stored in the pvs_name_template and not under the pvs_name variable. Signed-off-by: Fabien Parent <fabien.parent@linaro.org>
2022-10-26cpufreq: qcom: pass pvs_name size along with its bufferFabien Parent
The get_version handler takes a pvs_name buffer and can override it with the speed, pvs, and pvs version values. The function does not take as argument the buffer size and is currently being determined by calling `sizeof("speedXX-pvsXX-vXX")`. This is not great because it duplicates the string in several locations which makes it error-prone if we need to modify the string someday. Also since the buffer and its size are tied together, it makes sense that they should both be passed together to the get_version as parameters. This commit makes sure that the PVS name template string is only defined once, and that the pvs_name buffer is passed with its size. Signed-off-by: Fabien Parent <fabien.parent@linaro.org>
2022-10-26cpufreq: qcom: fix memory leak in error pathFabien Parent
If for some reason the speedbin length is incorrect, then there is a memory leak in the error path because we never free the speedbin buffer. This commit fixes the error path to always free the speedbin buffer. Signed-off-by: Fabien Parent <fabien.parent@linaro.org>
2022-10-26clk: gcc-sc8280xp: use retention for USB power domainsJohan Hovold
Since commit d399723950c4 ("clk: qcom: gdsc: Fix the handling of PWRSTS_RET support) retention mode can be used on sc8280xp to maintain state during suspend instead of leaving the domain always on. This is needed to eventually allow the parent CX domain to be powered down during suspend. Signed-off-by: Johan Hovold <johan+linaro@kernel.org>
2022-10-26clk: qcom: gdsc: add missing error handlingJohan Hovold
Since commit 7eb231c337e0 ("PM / Domains: Convert pm_genpd_init() to return an error code") pm_genpd_init() can return an error which the caller must handle. The current error handling was also incomplete as the runtime PM and regulator use counts were not balanced in all error paths. Add the missing error handling to the GDSC initialisation to avoid continuing as if nothing happened on errors. Signed-off-by: Johan Hovold <johan+linaro@kernel.org> Reviewed-by: Bjorn Andersson <andersson@kernel.org>
2022-10-26phy: qcom-qmp-usb: Use dev_err_probe() to simplify codeYuan Can
In the probe path, dev_err() can be replaced with dev_err_probe() which will check if error code is -EPROBE_DEFER and prints the error name. It also sets the defer probe reason which can be checked later through debugfs. Signed-off-by: Yuan Can <yuancan@huawei.com> Reviewed-by: Neil Armstrong <neil.armstrong@linaro.org> Reviewed-by: Dmitry Baryshkov <dmitry.baryshkov@linaro.org> Reviewed-by: Andrew Halaney <ahalaney@redhat.com>
2022-10-26phy: qcom-qmp-ufs: Use dev_err_probe() to simplify codeYuan Can
In the probe path, dev_err() can be replaced with dev_err_probe() which will check if error code is -EPROBE_DEFER and prints the error name. It also sets the defer probe reason which can be checked later through debugfs. Signed-off-by: Yuan Can <yuancan@huawei.com> Reviewed-by: Dmitry Baryshkov <dmitry.baryshkov@linaro.org> Reviewed-by: Andrew Halaney <ahalaney@redhat.com>
2022-10-26phy: qcom-qmp-combo: Use dev_err_probe() to simplify codeYuan Can
In the probe path, dev_err() can be replaced with dev_err_probe() which will check if error code is -EPROBE_DEFER and prints the error name. It also sets the defer probe reason which can be checked later through debugfs. Signed-off-by: Yuan Can <yuancan@huawei.com> Reviewed-by: Dmitry Baryshkov <dmitry.baryshkov@linaro.org> Reviewed-by: Andrew Halaney <ahalaney@redhat.com>
2022-10-26MAINTAINERS: Add myself as the maintainer for qcom_edac driverManivannan Sadhasivam
The current maintainers have left Qualcomm and their email addresses were bouncing. Since I couldn't get hold of them now, I'm volunteering myself to maintain this driver. Acked-by: Sai Prakash Ranjan <quic_saipraka@quicinc.com> Signed-off-by: Manivannan Sadhasivam <manivannan.sadhasivam@linaro.org>
2022-10-26EDAC/qcom: Remove extra error no assignment in qcom_llcc_core_setup()Manivannan Sadhasivam
If the ret variable is initialized with -EINVAL, then there is no need to assign it again in the default case of qcom_llcc_core_setup(). Signed-off-by: Manivannan Sadhasivam <manivannan.sadhasivam@linaro.org> Reviewed-by: Sai Prakash Ranjan <quic_saipraka@quicinc.com>
2022-10-26EDAC/qcom: Get rid of hardcoded register offsetsManivannan Sadhasivam
The LLCC EDAC register offsets varies between each SoC. Hardcoding the register offsets won't work and will often result in crash due to accessing the wrong locations. Hence, get the register offsets from the LLCC driver matching the individual SoCs. Signed-off-by: Manivannan Sadhasivam <manivannan.sadhasivam@linaro.org> Reviewed-by: Sai Prakash Ranjan <quic_saipraka@quicinc.com>
2022-10-26soc: qcom: llcc: Pass LLCC version based register offsets to EDAC driverManivannan Sadhasivam
The LLCC EDAC register offsets varies between each SoCs. Until now, the EDAC driver used the hardcoded register offsets. But this caused crash on SM8450 SoC where the register offsets has been changed. So to avoid this crash and also to make it easy to accommodate changes for new SoCs, let's pass the LLCC version specific register offsets to the EDAC driver. Currently, two set of offsets are used. One is starting from LLCC version v1.0.0 used by all SoCs other than SM8450. For SM8450, LLCC version starting from v2.1.0 is used. Signed-off-by: Manivannan Sadhasivam <manivannan.sadhasivam@linaro.org> Reviewed-by: Sai Prakash Ranjan <quic_saipraka@quicinc.com>
2022-10-26soc: qcom: llcc: Rename reg_offset structs to reflect LLCC versionManivannan Sadhasivam
The register offsets used by the LLCC block retains its layout for multiple versions. For instance, starting from version v1.0.0 to v2.0.1 the offsets are same. And starting from v2.1.0, the offsets changed. But the current reg_offset naming convention is confusing. So to reflect this change correctly in driver, let's encode the start version from which the offsets got changed in reg_offset struct name. This will be llcc_v1_reg_offset for v1.0.0 and llcc_v2_1_reg_offset for v2.1.0. This will allow multiple SoCs to use the same reg_offset clearly. And in the future if the offsets got changed again, then that specific version could be encoded in the struct name. Suggested-by: Sai Prakash Ranjan <quic_saipraka@quicinc.com> Signed-off-by: Manivannan Sadhasivam <manivannan.sadhasivam@linaro.org> Reviewed-by: Sai Prakash Ranjan <quic_saipraka@quicinc.com>
2022-10-26arm64: dts: qcom: sc8280xp: fix UFS PHY serdes sizeJohan Hovold
The size of the UFS PHY serdes register region is 0x1c8 and the corresponding 'reg' property should specifically not include the adjacent regions that are defined in the child node (e.g. tx and rx). Fixes: 152d1faf1e2f ("arm64: dts: qcom: add SC8280XP platform") Signed-off-by: Johan Hovold <johan+linaro@kernel.org> Reviewed-by: Bjorn Andersson <andersson@kernel.org>
2022-10-26arm64: dts: qcom: sc8280xp: fix USB1 PHY RX1 registersJohan Hovold
The USB1 SS PHY node had the RX1 register block (0x600) replaced with RX2 (0xc00). Fixes: 152d1faf1e2f ("arm64: dts: qcom: add SC8280XP platform") Signed-off-by: Johan Hovold <johan+linaro@kernel.org>
2022-10-26arm64: dts: qcom: sc8280xp: add rpmh-stats nodeJohan Hovold
Add a node describing the RPMh shared memory that can be used to retrieve statistics for the SoC low-power modes. Signed-off-by: Johan Hovold <johan+linaro@kernel.org> Reviewed-by: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
2022-10-26hack: power: supply: qcom_battmgr: Add present propertySteev Klimaszewski
Signed-off-by: Steev Klimaszewski <steev@kali.org>
2022-10-26phy: qcom-qmp-combo: fix sc8280xp PCS_USB offsetJohan Hovold
The PCS_USB register block lives at an offset of 0x300 from the PCS region on SC8280XP so add the missing offset to avoid corrupting unrelated registers on runtime suspend. Note that this region should probably be described separately in the binding. Fixes: a2e927b0e50d ("phy: qcom-qmp-combo: Add sc8280xp USB/DP combo phys") Signed-off-by: Johan Hovold <johan+linaro@kernel.org>
2022-10-26arm64: dts: qcom: sc8280xp: fix USB PHY PCS registersJohan Hovold
With the current binding, the PCS register block (0x1400) needs to include the PCS_USB registers (0x1700). Fixes: 152d1faf1e2f ("arm64: dts: qcom: add SC8280XP platform") Signed-off-by: Johan Hovold <johan+linaro@kernel.org>
2022-10-26sound: soc: codecs: wcd-mbhc-v2: expose ALSA control for jackDylan Van Assche
Jack detection is currently fully functional via the input interface together with multimedia buttons, but is not exposed as an ALSA control. Therefore, ALSA clients such as PulseAudio do not pick up the jack detection events as they only support one of the possible interface (ALSA control or input interface, but not both). Expose the jack events as an ALSA control and input interface to provide ALSA clients both interfaces. Signed-off-by: Dylan Van Assche <me@dylanvanassche.be> Reviewed-by: Caleb Connolly <caleb@connolly.tech>
2022-10-26arm64: configs: laptop_defconfig: dump latest configSteev Klimaszewski
Signed-off-by: Steev Klimaszewski <steev@kali.org>
2022-10-26hack: power: supply: qcom_battmgr: Add 0x81 notification and move INFOSteev Klimaszewski
Signed-off-by: Steev Klimaszewski <steev@kali.org>
2022-10-26rpmsg: glink: Add lock to rpmsg_ctrldev_removeDeepak Kumar Singh
Hold ctrl device lock in rpmsg_ctrldev_remove to avoid any new create ept call to proceed, otherwise new ept creation and associted char device may suceed. Any further call from user space for rpmsg_eptdev_open will reference already freed rpdev and will result in crash. Below crash signature was observed - rpmsg_create_ept+0x40/0xa0 rpmsg_eptdev_open+0x88/0x138 chrdev_open+0xc4/0x1c8 do_dentry_open+0x230/0x378 vfs_open+0x3c/0x48 path_openat+0x93c/0xa78 do_filp_open+0x98/0x118 do_sys_openat2+0x90/0x220 do_sys_open+0x64/0x8c Signed-off-by: Deepak Kumar Singh <quic_deesin@quicinc.com>
2022-10-26rpmsg: glink: Add lock to avoid race when rpmsg device is releasedDeepak Kumar Singh
When remote host goes down glink char device channel is freed, At the same time user space apps can still try to open/poll rpmsg char device which will result in calling rpmsg_create_ept. This may cause reference to already freed context of glink chardev channel and result in below crash signatures - 1) rpmsg_create_ept+0x40/0xa0 rpmsg_eptdev_open+0x88/0x138 chrdev_open+0xc4/0x1c8 do_dentry_open+0x230/0x378 2) rpmsg_poll+0x5c/0x80 rpmsg_eptdev_poll+0x84/0xa4 do_sys_poll+0x22c/0x5c8 This patch adds proper lock and check condition to avoid such crash. Signed-off-by: Deepak Kumar Singh <quic_deesin@quicinc.com>
2022-10-26misc: fastrpc: Fix use-after-free race condition for mapsOla Jeppsson
It is possible that in between calling fastrpc_map_get() until map->fl->lock is taken in fastrpc_free_map(), another thread can call fastrpc_map_lookup() and get a reference to a map that is about to be deleted. Rewrite fastrpc_map_get() to only increase the reference count of a map if it's non-zero. Propagate this to callers so they can know if a map is about to be deleted. Fixes this warning: refcount_t: addition on 0; use-after-free. WARNING: CPU: 5 PID: 10100 at lib/refcount.c:25 refcount_warn_saturate ... Call trace: refcount_warn_saturate [fastrpc_map_get inlined] [fastrpc_map_lookup inlined] fastrpc_map_create fastrpc_internal_invoke fastrpc_device_ioctl __arm64_sys_ioctl invoke_syscall Fixes: c68cfb718c8f9 ("misc: fastrpc: Add support for context Invoke method") Signed-off-by: Ola Jeppsson <ola@snap.com> Signed-off-by: Abel Vesa <abel.vesa@linaro.org>
2022-10-26misc: fastrpc: Don't remove map on creater_process and device_releaseAbel Vesa
Do not remove the map from the list on error path in fastrpc_init_create_process, instead call fastrpc_map_put, to avoid use-after-free. Do not remove it on fastrpc_device_release either, call fastrpc_map_put instead. The fastrpc_free_map is the only proper place to remove the map. This is called only after the reference count is 0. Fixes: b49f6d83e290f ("misc: fastrpc: Fix a possible double free") Co-developed-by: Ola Jeppsson <ola@snap.com> Signed-off-by: Ola Jeppsson <ola@snap.com> Signed-off-by: Abel Vesa <abel.vesa@linaro.org>
2022-10-26misc: fastrpc: Fix use-after-free and race in fastrpc_map_findAbel Vesa
Currently, there is a race window between the point when the mutex is unlocked in fastrpc_map_lookup and the reference count increasing (fastrpc_map_get) in fastrpc_map_find, which can also lead to use-after-free. So lets merge fastrpc_map_find into fastrpc_map_lookup which allows us to both protect the maps list by also taking the &fl->lock spinlock and the reference count, since the spinlock will be released only after. Add take_ref argument to make this suitable for all callers. Fixes: 8f6c1d8c4f0c ("misc: fastrpc: Add fdlist implementation") Co-developed-by: Ola Jeppsson <ola@snap.com> Signed-off-by: Ola Jeppsson <ola@snap.com> Signed-off-by: Abel Vesa <abel.vesa@linaro.org>
2022-10-26clk: qcom: gcc-sc7280: Update the .pwrsts for usb gdscRajendra Nayak
USB on sc7280 cannot support wakeups from low power states if the GDSC is turned OFF. Update the .pwrsts for usb GDSC so it only transitions to RET in low power. Signed-off-by: Rajendra Nayak <quic_rjendra@quicinc.com> Reviewed-by: Matthias Kaehlcke <mka@chromium.org> Tested-by: Matthias Kaehlcke <mka@chromium.org>
2022-10-26clk: qcom: gcc-sc7180: Update the .pwrsts for usb gdscRajendra Nayak
USB on sc7180 cannot support wakeups from low power states if the GDSC is turned OFF. Update the .pwrsts for usb GDSC so it only transitions to RET in low power. Signed-off-by: Rajendra Nayak <quic_rjendra@quicinc.com> Reviewed-by: Matthias Kaehlcke <mka@chromium.org> Tested-by: Matthias Kaehlcke <mka@chromium.org>
2022-10-26clk: qcom: gdsc: Fix the handling of PWRSTS_RET supportRajendra Nayak
GDSCs cannot be transitioned into a Retention state in SW. When either the RETAIN_MEM bit, or both the RETAIN_MEM and RETAIN_PERIPH bits are set, and the GDSC is left ON, the HW takes care of retaining the memory/logic for the domain when the parent domain transitions to low power state. The existing logic handling the PWRSTS_RET seems to set the RETAIN_MEM/RETAIN_PERIPH bits but then explicitly turns the GDSC OFF as part of _gdsc_disable(). Fix that by leaving the GDSC in ON state. Signed-off-by: Rajendra Nayak <quic_rjendra@quicinc.com> Cc: AngeloGioacchino Del Regno <angelogioacchino.delregno@somainline.org>
2022-10-26drm/msm/dp: move dp_request_irq() call to dp_display_probe()Dmitry Baryshkov
As the MDSS registers the IRQ domain before populating child devices, there is little point in deferring the IRQ request up to the msm_dp_modeset_init(). Following the 'get resources as early as possible' paradigm, move dp_request_irq() call to dp_display_probe(). Signed-off-by: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>