There is a chance of use after release of client data in
cdm internal operation calls. Hence acquire mutex lock whenever
accessing client data to avoid use after release scenario.
CRs-Fixed: 3010261
Change-Id: Iaf7f41d56301299a6f63a5dc1090334063019881
Signed-off-by: Shravya Samala <shravyas@codeaurora.org>
Issue:
strlcpy calls strlen on src ptr. If src is not NULL terminated then OOB
access will occur in below stack.
strlen
strlcpy
cam_sync_init_row
cam_sync_handle_create
cam_sync_dev_ioctl
Fix:
Pad user-space supplied name with NULL.
CRs-Fixed: 3010262
Change-Id: Ib5c2fbfe395025ec05e0bb2980f86111e95ff54c
Signed-off-by: Trishansh Bhardwaj <tbhardwa@codeaurora.org>
- Apply flash off register settings at the time of stream off.
- Add support to send fire command in initial config command.
CRs-Fixed: 2998772
Change-Id: I8897a68e637d283afd98e386b6a7b1fbaaf63c61
Signed-off-by: shiwgupt <shiwgupt@codeaurora.org>
For recovery of the bubble the request from active list
should be added back to pending request list.
Change-Id: I8d7d6726ddc3e720665e53e4979a7907b09d86aa
CRs-Fixed: 3011917
Signed-off-by: Wyes Karny <wkarny@codeaurora.org>
Handle I2C flash request deletion in the buffer so that
new request can be added.
CRs-Fixed: 3002966
Change-Id: I774a49c687832ef566071ae3ec4249bf425e94c2
Signed-off-by: shiwgupt <shiwgupt@codeaurora.org>
OPE probe is failing due to incorrect OPE version.
Correcting OPE version as a fix.
CRs-Fixed: 2994159
External Impact: No
Change-Id: I8c4de8aa76c1da883a922b1ca873b31e8937ca03
Signed-off-by: Alok Pandey <akumarpa@codeaurora.org>
Currently cam-res-mgr uses the virtual gpio number (A global gpio number
among all the gpio modules) in case of shared gpio. We cannot know this
upfront as the mapping varies between targets. This change allows to use
the shared gpios using gpios property, where we can mention the gpio module
and the gpio number used.
CRs-Fixed: 2994159
Change-Id: Ic60eeace89e5223eaeee5a7709bb3beee4127bb0
Signed-off-by: Tony Lijo Jose <tjose@codeaurora.org>
CSID probe is failing due to PPI getting probed later than CSID.
Fix:
- PPI initialization failure as non-fatal.
- Reordering compilation to call PPI probe before csid.
CRs-Fixed: 2994159
External Impact: No
Change-Id: I43948b28ef044eaaef2c72027e991f1fa63bee02
Signed-off-by: Alok Pandey <akumarpa@codeaurora.org>
- Add Regulator power up for I2C flash
- Add GPIO support in probe call for I2C flash
- Add flash type in query capability call of flash.
CRs-Fixed: 3660915
Change-Id: I64ecba3fa4176972e819b11f2a65340c24f85d4f
Signed-off-by: shiwgupt <shiwgupt@codeaurora.org>
CSIPHY settings are propagated for version 1.2.1 from
4.0 to 3.1.
CRs-Fixed: 2966344
Change-Id: Id315bfcde4c29d2fa491be17d46544371716c5a9
Signed-off-by: shiwgupt <shiwgupt@codeaurora.org>
PPI is a bridge between CSIPHY and CSID. Responsibilty of this driver is to
enable and configure PPI bridge from CSID as per the configuration.
CRs-Fixed: 2960970
Change-Id: I0606b8ee06f6fbc2f84c3be628f356192a79f5a5
Signed-off-by: Ayush Kumar <ayushkr@codeaurora.org>
Khaje has different version of CPAS version which
requires camnoc interface changes and CPAS version
change. This change adds the same.
CRs-Fixed: 2960970
Change-Id: Iff58b7872129966879ecadab058d1d57cd439bea
Signed-off-by: Ayush Kumar <ayushkr@codeaurora.org>
This change adds validity check for ife out res. If ife out res is
NULL we can run into crash or issues.
CRs-Fixed: 2915741
Change-Id: I8722b2a4e2634bda42f0080e00bf09050bbd6b91
Signed-off-by: Vikram Sharma <vikramsa@codeaurora.org>
KASAN identified global-out-of-bounds issue on:
msm_cam_hw_cdm_dt_match
Due to no null-terminating struct in the array.
CRs-Fixed: 2883523
Change-Id: I36e4811f239993e1e6de158df959157217c28bfe
Signed-off-by: Karthik Jayakumar <kjayakum@codeaurora.org>
In WQ congestion case do not trigger UMD recovery as for back to back
apply, apply failure is expected because ISP is in still in applied
state.
CRs-Fixed: 2840473
Change-Id: Ib57e1db1e5bf8f20e5e454d985efc002d50e3ba6
Signed-off-by: Wyes Karny <wkarny@codeaurora.org>
There is chance that handle error info get scheduled
after cdm deinit. As clock and regulator gets disabled
as part of deinit so this can cause issue for cdm hw
interaction as part of handle error.
Added cdm power state check before dumping CDM HW
status at the time of error.
CRs-Fixed: 2833653
Change-Id: I4bf01ce3900196909cf66ffdb24607c50ab03295
Signed-off-by: Alok Chauhan <alokc@codeaurora.org>
In process timer, if there are no empty taks then it
returns without unlocking context mutext. This lead
to deadlock later if other tasks are waiting on this
lock.
CRs-Fixed: 2823721
Change-Id: I478d1797be59d975e9d58e005a5fad5c22656f51
Signed-off-by: Alok Chauhan <alokc@codeaurora.org>
Add support to dynamically switch pix_pattern of read clients
based on data received in each request.
CRs-Fixed: 2811530
Change-Id: Icb3ebd33cae59b8db87bc0011d6560492ad29c3a
Signed-off-by: Rishabh Jain <risjai@codeaurora.org>
In corner case, there is a chance that userspace can submit
request while flush is ongoing. In some cases submitted request
can get flushed and corresponding data structures memory gets
freed.
Add a logic to check for pending request before submitting request
to cdm hw.
CRs-Fixed: 2815901
Change-Id: I74096201e204f204c4f15d14698b4e9af6435f55
Signed-off-by: Alok Chauhan <alokc@codeaurora.org>
After Hw Bl cmd write, we are decrementing write count.
Again after committing BL we are decrementing write count.
Due to this there is a chance of write count becoming -1 thus
leading to CDM overflow issue. Hence decrement write count
only after committing BL.
CRs-Fixed: 2768031
Change-Id: I8faf6ea7d5e9e34e1e034c89132ed131b4d6cafc
Signed-off-by: Shravya Samala <shravyas@codeaurora.org>
Increase max bl limit for OPE to 24 to support maximum
48 stripes.
CRs-Fixed: 2761455
Change-Id: I961be1344fac0084649df321225e94a50d4e5a98
Signed-off-by: Rishabh Jain <risjai@codeaurora.org>