After cold reset is introduced, the phone is cold reset instead of
warm reset, such as panic. In this case, the power up reason saved
in shared memory will be lost. Consequently, the power up reason on
next boot up time will be normal boot instead of correct ones. To
resolve this issue, we can use the two spared pmic registers which
are power lost safe to save the restart reason for these cases.
Motorola definition of AP panic bit set in extra info pmic reg
conflicts with QC definition of Warm reboot bit set in extra info reg
move Mot bit to available position to avoid conflict
Force a cold reboot for the command "adb reboot bootloader"
to avoid the warm boot when user tries to continue boot from boot menu.
For early kernel panic before PMIC is initialized, the function
qpnp_pon_store_extra_reset_info will fail. Need to set IMEM flag
for fail safe in this case.
For post-panic, post-wdt, post-pmicwdt reboot, we do cold reset.
And set the PMIC register accordingly, to nofity BL the special
reboot behavior.
Configure panic as warm restart, so that we have chance to get panic logs.
According to SR 01277290, 0x88D and 0x88E are spare registers for PMIC
where we could store oem specific reset information
Ported from: https://gerrit.mot.com/1446282
Change-Id: I6704c801435c6586dbe64259c214dcdc926b07cf
Signed-off-by: zhaoxp3 <zhaoxp3@motorola.com>
Reviewed-on: https://gerrit.mot.com/1499584
SLTApproved: Slta Waiver
SME-Granted: SME Approvals Granted
Tested-by: Jira Key
Reviewed-by: Wang Wang <wangwang1@lenovo.com>
Submit-Approved: Jira Key
Export some pmic-voter interfaces for dlkm usage as well
as create access functions that are exported for dlkm to
manipulate the struct.
ported from https://gerrit.mot.com/1200744
Change-Id: I073a4e976f8cd184fa20b262eba9bc962a4a1bb2
Signed-off-by: zhaoxp3 <zhaoxp3@motorola.com>
Reviewed-on: https://gerrit.mot.com/1499583
SLTApproved: Slta Waiver
SME-Granted: SME Approvals Granted
Tested-by: Jira Key
Reviewed-by: Wang Wang <wangwang1@lenovo.com>
Submit-Approved: Jira Key
Moto kernel config does not really take effect during
building MSI.
Set to PRODUCT_SPECIFIC_DEFCONFIGS to KERNEL_DEFCONFIG,
So that MSI build can commonize.
It's for build failure
+++
FAILED: ninja:
'kernel/msm-4.19/arch/arm64/configs/vendor/ext_config/moto-kona.config',
needed by
'out/target/product/msi/obj/kernel/msm-4.19/mapphone_defconfig', missing
and no known rule to make it
ninja failed with: exit status 1
+++
Change-Id: I59710763d8a88a89e6e592dcfde53c7e5486d195
Signed-off-by: zhaoxp3 <zhaoxp3@motorola.com>
Reviewed-on: https://gerrit.mot.com/1499582
SLTApproved: Slta Waiver
SME-Granted: SME Approvals Granted
Tested-by: Jira Key
Reviewed-by: Wang Wang <wangwang1@lenovo.com>
Submit-Approved: Jira Key
Add ext_config feature to extend qcom's defconfig
There make files can compose some kconfig files into one
Change-Id: Ic1444100f61300e7ee16a81c73afde3dac81da0a
Signed-off-by: zhaoxp3 <zhaoxp3@motorola.com>
Reviewed-on: https://gerrit.mot.com/1499581
SLTApproved: Slta Waiver
SME-Granted: SME Approvals Granted
Tested-by: Jira Key
Reviewed-by: Wang Wang <wangwang1@lenovo.com>
Submit-Approved: Jira Key
Introduce a new configuration MMI_DEVICE_DTBS that will allow the
target to only build Motorola devices.
Ported from: https://gerrit.mot.com/#/c/1066190
Change-Id: I3e787432777c282b63cb3619d47f78a5b93964a5
Signed-off-by: zhaoxp3 <zhaoxp3@motorola.com>
Reviewed-on: https://gerrit.mot.com/1499580
SLTApproved: Slta Waiver
SME-Granted: SME Approvals Granted
Tested-by: Jira Key
Reviewed-by: Wang Wang <wangwang1@lenovo.com>
Submit-Approved: Jira Key
Add the support to get the sku information from userspace.
Change-Id: I39b60fcc430308cd75e67fa400ad9515b5ad4b65
Signed-off-by: Mukesh Ojha <quic_mojha@quicinc.com>
Signed-off-by: Swetha Chikkaboraiah <quic_schikk@quicinc.com>
Below are some new fields are getting updated in socinfo
structure from bootloader under revision 16.
e.g
esku;
nproduct_code;
npartnamemap_offset;
nnum_partname_mapping;
Add the change in socinfo driver to accommodate this.
Change-Id: I11b5182c15af32da61cddbf4bb45d5aef390135a
Signed-off-by: Mukesh Ojha <quic_mojha@quicinc.com>
Signed-off-by: Swetha Chikkaboraiah <quic_schikk@quicinc.com>
Added reference count for contex map indicate memory under used
in remote call. And, this memory would not removed in internal
unmap to avoid UAF.
Change-Id: Ieb4ff6b298ff9c48953bc5b3539fdfe19a14b442
Acked-by: DEEPAK SANNAPAREDDY <sdeeredd@qti.qualcomm.com>
Signed-off-by: Vamsi Krishna Gattupalli <quic_vgattupa@quicinc.com>
Accessing DTCM can cause NoC error sometimes if GMU is accessing
any of its TCMs at the same time as host.
Change-Id: I3d7a3169620854dbd659f378c216a7b15435c914
Signed-off-by: Harshdeep Dhatt <hdhatt@codeaurora.org>
Signed-off-by: Kamal Agrawal <quic_kamaagra@quicinc.com>
walt's accounting issues are not fatal, reset the variables and
raise warning instead of panic.
Change-Id: Id9f8cdbc1bde1539c33c2000590c81567fc5312a
Signed-off-by: Srinivasarao Pathipati <quic_c_spathi@quicinc.com>
sock_init_data() assumes that the `struct socket` passed in input is
contained in a `struct socket_alloc` allocated with sock_alloc().
However, tap_open() passes a `struct socket` embedded in a `struct
tap_queue` allocated with sk_alloc().
This causes a type confusion when issuing a container_of() with
SOCK_INODE() in sock_init_data() which results in assigning a wrong
sk_uid to the `struct sock` in input.
On default configuration, the type confused field overlaps with
padding bytes between `int vnet_hdr_sz` and `struct tap_dev __rcu
*tap` in `struct tap_queue`, which makes the uid of all tap sockets 0,
i.e., the root one.
Fix the assignment by using sock_init_data_uid().
Change-Id: I6337cd5bee057b849a0ddf8205edbcbcd487099b
Fixes: 86741ec254 ("net: core: Add a UID field to struct sock.")
Signed-off-by: Pietro Borrello <borrello@diag.uniroma1.it>
Reviewed-by: Eric Dumazet <edumazet@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Git-commit: 66b2c338adce580dfce2199591e65e2bab889cff
Git-repo: https://git.kernel.org/pub/scm/linux/kernel/git/netdev/net.git
Signed-off-by: Kaustubh Pandey <quic_kapandey@quicinc.com>
sock_init_data() assumes that the `struct socket` passed in input is
contained in a `struct socket_alloc` allocated with sock_alloc().
However, tun_chr_open() passes a `struct socket` embedded in a `struct
tun_file` allocated with sk_alloc().
This causes a type confusion when issuing a container_of() with
SOCK_INODE() in sock_init_data() which results in assigning a wrong
sk_uid to the `struct sock` in input.
On default configuration, the type confused field overlaps with the
high 4 bytes of `struct tun_struct __rcu *tun` of `struct tun_file`,
NULL at the time of call, which makes the uid of all tun sockets 0,
i.e., the root one.
Fix the assignment by using sock_init_data_uid().
Change-Id: I35083661319d08475fbba716d228758e5355c36f
Fixes: 86741ec254 ("net: core: Add a UID field to struct sock.")
Signed-off-by: Pietro Borrello <borrello@diag.uniroma1.it>
Reviewed-by: Eric Dumazet <edumazet@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Git-commit: a096ccca6e503a5c575717ff8a36ace27510ab0a
Git-repo: https://git.kernel.org/pub/scm/linux/kernel/git/netdev/net.git
Signed-off-by: Kaustubh Pandey <quic_kapandey@quicinc.com>
Add sock_init_data_uid() to explicitly initialize the socket uid.
To initialise the socket uid, sock_init_data() assumes a the struct
socket* sock is always embedded in a struct socket_alloc, used to
access the corresponding inode uid. This may not be true.
Examples are sockets created in tun_chr_open() and tap_open().
Change-Id: I1f6b197165284ca8dd798af73136157a12f44d36
Fixes: 86741ec254 ("net: core: Add a UID field to struct sock.")
Signed-off-by: Pietro Borrello <borrello@diag.uniroma1.it>
Reviewed-by: Eric Dumazet <edumazet@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Git-commit: 584f3742890e966d2f0a1f3c418c9ead70b2d99e
Git-repo: https://git.kernel.org/pub/scm/linux/kernel/git/netdev/net.git
Signed-off-by: Kaustubh Pandey <quic_kapandey@quicinc.com>
Postamble packets are executed in privileged mode by gpu. So we should keep
them in a privileged scratch buffer to block userspace access. For
targets with APRIV feature support, we can mark the preemption scratch
buffer as privileged too to avoid similar issues in future.
Change-Id: Ifda360dda251083f38dfde80ce1b5dc83daae902
Signed-off-by: Akhil P Oommen <quic_akhilpo@quicinc.com>
Signed-off-by: Kaushal Sanadhya <quic_ksanadhy@quicinc.com>
find_get_page() returns a page with increased refcount, assuming a page
exists at the given index. Ensure this refcount is dropped on error.
Bug: 271079833
Fixes: 59d4d125 ("BACKPORT: FROMLIST: mm: implement speculative handling in filemap_fault()")
Change-Id: Idc7b9e3f11f32a02bed4c6f4e11cec9200a5c790
Signed-off-by: Patrick Daly <quic_pdaly@quicinc.com>
(cherry picked from commit 6232eecfa7ca0d8d0ca088da6d0edb2c3a879ff9)
Signed-off-by: Zhenhua Huang <quic_zhenhuah@quicinc.com>
Git-commit: 1d05213028b6dbdb8801e20f29b6a6f91c216033
Git-repo: https://android.googlesource.com/kernel/common/
Signed-off-by: Srinivasarao Pathipati <quic_c_spathi@quicinc.com>
qiib_cleanup in qiib_driver_data_deinit is redundant since
this cleanup is already done in driver remove.
Remove qiib_cleanup in deinit and add required NULL check to
avoid any use-after-free scenario.
Change-Id: I95fa3cf91b5ca6cbaeb66d304a0572ba1d294a69
Signed-off-by: Sarannya S <quic_sarannya@quicinc.com>
SPF attempts page faults without taking the mmap lock, but takes the
PTL. If there is a concurrent fast mremap (at PMD/PUD level), this
can lead to a UAF as fast mremap will only take the PTL locks at the
PMD/PUD level. SPF cannot take the PTL locks at the larger subtree
granularity since this introduces much contention in the page fault
paths.
To address the race:
1) Only try fast mremaps if there are no users of the VMA. Android
is concerned with this optimization in the context of
GC stop-the-world pause. So there are no other threads active
and this should almost always succeed.
2) Speculative faults detect ongoing fast mremaps and fallback
to conventional fault handling (taking mmap read lock).
Bug: 263177905
Change-Id: I23917e493ddc8576de19883cac053dfde9982b7f
Signed-off-by: Kalesh Singh <kaleshsingh@google.com>
Git-commit: 529351c4c8202aa7f5bc4a8a100e583a70ab6110
Git-repo: https://android.googlesource.com/kernel/common/
[quic_c_spathi@quicinc.com: resolve merge conflicts. Not applying
mremap changes due to absence of applicable configs for race.]
Signed-off-by: Srinivasarao Pathipati <quic_c_spathi@quicinc.com>
vm_write_{begin|end} has to be called when mmap_lock is taken
exlusively. Add an assert statement in vm_write_begin to enforce
that. free_pgtables can free page tables without exclusive mmap_lock
if the vma was isolated, therefore avoid assertions in such cases.
Bug: 257443051
Change-Id: Ie81aefe025c743cda6f66717d2f08f4d78a55608
Signed-off-by: Suren Baghdasaryan <surenb@google.com>
Git-commit: d65d4a0538c3511eb02fed4b628e3588715c90d8
Git-repo: https://android.googlesource.com/kernel/common/
[quic_c_spathi@quicinc.com: fix build error]
Signed-off-by: Srinivasarao Pathipati <quic_c_spathi@quicinc.com>
In a number of cases vm_write_{begin|end} is called while mmap_lock is
not owned exclusively. This is unnecessary and can affect correctness of
the sequence counting protecting speculative page fault handlers. Remove
extra calls.
Bug: 257443051
Change-Id: I1278638a0794448e22fbdab5601212b3b2eaebdc
Signed-off-by: Suren Baghdasaryan <surenb@google.com>
Git-commit: bfdcf47ca34dc3b7b63ca16b0a1856e57c57ee47
Git-repo: https://android.googlesource.com/kernel/common/
[quic_c_spathi@quicinc.com: resolve trivial merge conflicts]
Signed-off-by: Srinivasarao Pathipati <quic_c_spathi@quicinc.com>
Speculative page fault handler needs to detect concurrent pmd changes
and relies on vma seqcount for that. pmdp_collapse_flush(), set_huge_pmd() and collapse_and_free_pmd() can modify a pmd.
vm_write_{begin|end} are needed in the paths which can call these
functions for page fault handler to detect pmd changes.
Bug: 257443051
Change-Id: Ieb784b5f44901b66a594f61b9e7c91190ff97f80
Signed-off-by: Suren Baghdasaryan <surenb@google.com>
Git-commit: 5ed391bd8ad8481d82c1bbb05a35f5538966dce9
Git-repo: https://android.googlesource.com/kernel/common/
[quic_c_spathi@quicinc.com: resolve trivial merge conflicts]
Signed-off-by: Srinivasarao Pathipati <quic_c_spathi@quicinc.com>
Extend filemap_fault() to handle speculative faults.
In the speculative case, we will only be fishing existing pages out of
the page cache. The logic we use mirrors what is done in the
non-speculative case, assuming that pages are found in the page cache,
are up to date and not already locked, and that readahead is not
necessary at this time. In all other cases, the fault is aborted to be
handled non-speculatively.
Signed-off-by: Michel Lespinasse <michel@lespinasse.org>
Link: https://lore.kernel.org/all/20210407014502.24091-26-michel@lespinasse.org/
Conflicts:
mm/filemap.c
1. Added back file_ra_state variable used by SPF path.
2. Updated comment for filemap_fault to reflect SPF locking rules.
Bug: 161210518
Signed-off-by: Suren Baghdasaryan <surenb@google.com>
Change-Id: I82eba7fcfc81876245c2e65bc5ae3d33ddfcc368
Git-commit: 59d4d125b7d0108b54860ea8584679d514ef07b0
Git-repo: https://android.googlesource.com/kernel/common/
[quic_c_spathi@quicinc.com: resolve trivial merge conflicts]
Signed-off-by: Srinivasarao Pathipati <quic_c_spathi@quicinc.com>
Checks of pmd during speculative page fault handling are racy because
pmd is unprotected and might be modified or cleared. This might cause
use-after-free reads from speculative path, therefore prevent such
checks. At the beginning of speculation pmd is checked to be valid and
if it's changed before page fault is handled, the change will be detected
and page fault will be retried under mmap_lock protection.
Bug: 257443051
Change-Id: I0cbd3b0b44e8296cf0d6cb298fae48c696580068
Signed-off-by: Suren Baghdasaryan <surenb@google.com>
Git-commit: 2bb39b912175c3c087978ae5547e277a8422c601
Git-repo: https://android.googlesource.com/kernel/common/
[quic_c_spathi@quicinc.com: resolve merge conflicts]
Signed-off-by: Srinivasarao Pathipati <quic_c_spathi@quicinc.com>
Speculative page fault checks pmd to be valid before starting to handle
the page fault and pte_alloc() should do nothing if pmd stays valid.
If pmd gets changed during speculative page fault, we will detect the
change later and retry with mmap_lock. Therefore pte_alloc() can be
safely skipped and this prevents the racy pmd_lock() call which can
access pmd->ptl after pmd was cleared.
Bug: 257443051
Change-Id: Iec57df5530dba6e0e0bdf9f7500f910851c3d3fd
Signed-off-by: Suren Baghdasaryan <surenb@google.com>
Git-commit: 1169f70f8f15ea4378ecadb9baba8791824c8b2a
Git-repo: https://android.googlesource.com/kernel/common/
Signed-off-by: Srinivasarao Pathipati <quic_c_spathi@quicinc.com>
Kgsl shmem pages are always pinned but still endup in the evictable lru
leading to inteference with the reclaim logic making the later spending
more time in scanning the pages. This time can result into the PSI
events generation leading to oom/lmkd logic to take the wrong
decissions. Move such pages to unevictable LRU thus kept out of the
reclaimable list.
Change-Id: Iee82ce101526f04a8f294a10dce9598356701977
Signed-off-by: Charan Teja Kalla <quic_charante@quicinc.com>
Signed-off-by: Srinivasarao Pathipati <quic_c_spathi@quicinc.com>
Internal with two kinds of reference devices;
One is the Nordic DFU/OTA supported and
the other is DFU/OTA not upported.
Add this DFU func to check device type to
adjust all test cases.
Change-Id: I2ae93fa05eff0e332fad30760efbdde5081f1bd8
Signed-off-by: Wei Tan <quic_weitan@quicinc.com>
Enable IV_INO_LBLK_32 flag only for F2FS
and this flag is not required for ext4 as
ext4 uses sector number as IV.
Tests:
1. File Based Encryption(FBE) on adb remount and normal reboot.
2. File Based Encryption(FBE) properties are set.
Change-Id: Ie3fa6fddf7318410324d6a7da3d89326c1d1c6ff
Signed-off-by: Yuvaraj Ranganathan <quic_yrangana@quicinc.com>
Currently we don't ensure if vma->vm_file is associated with dma_buf. This
can cause issues later when private_data from a non dma_buf file is used as
dma_buf structure. Hence get the fd that is associated with vma->vm_file
and use dma_buf_get() to get pointer to dma_buf structure. dma_buf_get()
ensures that the file from the input fd is associated with dma_buf.
Change-Id: Ib78aef8b16bedca5ca86d3a132278ff9f07dce73
Signed-off-by: Puranam V G Tejaswi <quic_pvgtejas@quicinc.com>
Before putting a page back in the pool be sure that it doesn't have
any additional references that would be a signal that somebody else
is looking at the page and that it would be a bad idea to keep it
around and run the risk of accidentally handing it to a different
process.
Change-Id: Ic0dedbad0cf2ffb34b76ad23e393c5a911114b82
Signed-off-by: Jordan Crouse <jcrouse@codeaurora.org>
Signed-off-by: Kamal Agrawal <quic_kamaagra@quicinc.com>
Enable dcc configuration to parse dcc data in dumps
to debug crashes.
Change-Id: I954696d01ec05f74d6eb38758fc95b4395e7f855
Signed-off-by: Kishor Krishna Bhat <quic_kishkris@quicinc.com>
Cleanup the tracing code to print the trace for
clk_measure correctly.
Change-Id: I66f4382f07fc70fac94f5f478e4467410f72b3e0
Signed-off-by: Kalpak Kawadkar <quic_kkawadka@quicinc.com>
In issue case, geni_wake pointer is initialized while UART probe
and as a part of UART exit path wakeup_source_unregister is being
called to free the geni_wake pointer from memory but still caller
function can have the garbage value of geni_wake pointer which is
being accessed in uart_remove_one_port and leading to UAF.
To fix the issue we will make geni_wake pointer value as NULL after
freeing it to from memory.
Change-Id: I213026286bef9774f7a426b9348a7302d3e67ff0
Signed-off-by: Yatish Kumar Singh <quic_yatishku@quicinc.com>
Add remove API for unloading spmi-pmic module as the SPMI
framework right now requires drivers under it to have a
remove API defined when removing them.
Change-Id: Iaf5b9f602fb9389c75a68702eaceb847abcf2876
Signed-off-by: Jishnu Prakash <quic_jprakash@quicinc.com>
zhaoxp3