Add support for interrupt request and buffer setup. Use device
interrupt for reading measurements of ALS, range and proximity.
Signed-off-by: Jason Zhang <jason.zhang@rock-chips.com>
Change-Id: Idb605241df51519e49e3e4df471c5efe70948dcb
Support power supply and enable using gpio (if provided).
Signed-off-by: Jason Zhang <jason.zhang@rock-chips.com>
Change-Id: I2ed5acf9b38652d1e999a072dda17fa069cde23c
There are AVDD and GPIO0/CE in the pinout of STMicro VL6180:
- AVDD (Digital/analog power supply 2.6 to 3.0 V),
- GPIO0/CE (Power-up default is chip enable (CE)).
These two pins are gpio connected in some reference design boards and
control the power in the Power-up timing constraints. This patch
emulates this situation.
Signed-off-by: Jason Zhang <jason.zhang@rock-chips.com>
Change-Id: I610455ea7ca738303ec6dd6ff496576ff2e716ce
This patch modify the strobe tap number for better compatibility
with HS400ES mode.
Signed-off-by: Yifeng Zhao <yifeng.zhao@rock-chips.com>
Change-Id: I7ceb37c448250170f2bf394381a43bd0e925ddfa
This patch enables ST VL6180 support for the rk3588s tablet platform
with defconfig entry for VL6180.
Signed-off-by: Jason Zhang <jason.zhang@rock-chips.com>
Change-Id: Ic42b8f98309d527b8e73843df9d45ad1c82e4328
This patch adds support for rv1106/3 soc and get
chip version from OS_REG1[2:0] which was written by SPL.
Details ref to Rockchip_Introduction_OS_REG.md
Signed-off-by: Sugar Zhang <sugar.zhang@rock-chips.com>
Change-Id: Ib833a55acb70490945a37b5fdab7a29dcb5c3e6e
For various reasons based on the allocator behaviour and typical
use-cases at the time, when the max32_alloc_size optimisation was
introduced it seemed reasonable to couple the reset of the tracked
size to the update of cached32_node upon freeing a relevant IOVA.
However, since subsequent optimisations focused on helping genuine
32-bit devices make best use of even more limited address spaces, it
is now a lot more likely for cached32_node to be anywhere in a "full"
32-bit address space, and as such more likely for space to become
available from IOVAs below that node being freed.
At this point, the short-cut in __cached_rbnode_delete_update() really
doesn't hold up any more, and we need to fix the logic to reliably
provide the expected behaviour. We still want cached32_node to only move
upwards, but we should reset the allocation size if *any* 32-bit space
has become available.
Reported-by: Yunfei Wang <yf.wang@mediatek.com>
Signed-off-by: Robin Murphy <robin.murphy@arm.com>
Reviewed-by: Miles Chen <miles.chen@mediatek.com>
Link: https://lore.kernel.org/r/033815732d83ca73b13c11485ac39336f15c3b40.1646318408.git.robin.murphy@arm.com
Signed-off-by: Joerg Roedel <jroedel@suse.de>
(cherry picked from commit 5b61343b50)
Signed-off-by: Jianqun Xu <jay.xu@rock-chips.com>
Change-Id: If5b30d12f8d0cef77cfd2f3fe19e99be4897dc0e
According to the latest otp table, do the corresponding change
for 100M and 10M bgs.
Signed-off-by: David Wu <david.wu@rock-chips.com>
Change-Id: I3c56562e1839fd104c7467a5a28469edd8f49db7
Userland can use the flag ROCKCHIP_BO_DMA32 to tell drm gem to get pages
limit to 4GiB memory.
Signed-off-by: Jianqun Xu <jay.xu@rock-chips.com>
Change-Id: Icdc77efae71ed6272f425ad93a07c8d3e98a9ca4
Test on RK3588 with Unigraf DPR-100 DP reference sink.
Signed-off-by: Wyon Bi <bivvy.bi@rock-chips.com>
Change-Id: I01c099e1ad25ab92d9e8efef13c0c2304115a957
1. Set different pre_emphasize strength for rv1106 and rv1103.
- Set pre_emphasize strength to 0x03 for cpu verison_0;
- Set pre_emphasize strength to 0x01 for cpu verison_1;
2. Bypass Squelch detector calibration to improve receiving
sensitivity.
- Before: E-17 248.7mv, E-16 112.6mv
- After: E-17 150mv, E-16 98.8mv
Note:
E-17 and E-16 is on page 3 of the "USB 2.0 Electrical Compliance Test Specification"
https://usb.org/document-library/usb-20-electrical-compliance-test-specification-version-107
Signed-off-by: William Wu <william.wu@rock-chips.com>
Change-Id: I0d668b3d126583ada03d9675e0175f02537d915f
The four jpeg enc core are not the same queue, and there is only one
core in a single queue.
So, can not use queue->cores to get different core.
Signed-off-by: Yandong Lin <yandong.lin@rock-chips.com>
Change-Id: If9f56e351af23871e68b83de1917f26e88382dfc
commit d270453a0d upstream.
There are destructive operations such as nfcmrvl_fw_dnld_abort and
gpio_free in nfcmrvl_nci_unregister_dev. The resources such as firmware,
gpio and so on could be destructed while the upper layer functions such as
nfcmrvl_fw_dnld_start and nfcmrvl_nci_recv_frame is executing, which leads
to double-free, use-after-free and null-ptr-deref bugs.
There are three situations that could lead to double-free bugs.
The first situation is shown below:
(Thread 1) | (Thread 2)
nfcmrvl_fw_dnld_start |
... | nfcmrvl_nci_unregister_dev
release_firmware() | nfcmrvl_fw_dnld_abort
kfree(fw) //(1) | fw_dnld_over
| release_firmware
... | kfree(fw) //(2)
| ...
The second situation is shown below:
(Thread 1) | (Thread 2)
nfcmrvl_fw_dnld_start |
... |
mod_timer |
(wait a time) |
fw_dnld_timeout | nfcmrvl_nci_unregister_dev
fw_dnld_over | nfcmrvl_fw_dnld_abort
release_firmware | fw_dnld_over
kfree(fw) //(1) | release_firmware
... | kfree(fw) //(2)
The third situation is shown below:
(Thread 1) | (Thread 2)
nfcmrvl_nci_recv_frame |
if(..->fw_download_in_progress)|
nfcmrvl_fw_dnld_recv_frame |
queue_work |
|
fw_dnld_rx_work | nfcmrvl_nci_unregister_dev
fw_dnld_over | nfcmrvl_fw_dnld_abort
release_firmware | fw_dnld_over
kfree(fw) //(1) | release_firmware
| kfree(fw) //(2)
The firmware struct is deallocated in position (1) and deallocated
in position (2) again.
The crash trace triggered by POC is like below:
BUG: KASAN: double-free or invalid-free in fw_dnld_over
Call Trace:
kfree
fw_dnld_over
nfcmrvl_nci_unregister_dev
nci_uart_tty_close
tty_ldisc_kill
tty_ldisc_hangup
__tty_hangup.part.0
tty_release
...
What's more, there are also use-after-free and null-ptr-deref bugs
in nfcmrvl_fw_dnld_start. If we deallocate firmware struct, gpio or
set null to the members of priv->fw_dnld in nfcmrvl_nci_unregister_dev,
then, we dereference firmware, gpio or the members of priv->fw_dnld in
nfcmrvl_fw_dnld_start, the UAF or NPD bugs will happen.
This patch reorders destructive operations after nci_unregister_device
in order to synchronize between cleanup routine and firmware download
routine.
The nci_unregister_device is well synchronized. If the device is
detaching, the firmware download routine will goto error. If firmware
download routine is executing, nci_unregister_device will wait until
firmware download routine is finished.
Bug: 234690530
Fixes: 3194c68701 ("NFC: nfcmrvl: add firmware download support")
Signed-off-by: Duoming Zhou <duoming@zju.edu.cn>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Lee Jones <lee.jones@linaro.org>
Change-Id: I8cc1f6450c7fecf5f5994033931da1d23a522282
