Commit Graph

4 Commits

Author SHA1 Message Date
Ram Chandrasekar 2efbf29d3e msm: limits: Fix error handling to free up memory
Fix error handling to free up allocated memory before
returning back the function call.

CRs-Fixed: 869192
Change-Id: I38c9543baa98a941ee09fd34211fa77445b0e096
Signed-off-by: Ram Chandrasekar <rkumbako@codeaurora.org>
2015-09-22 05:04:33 -07:00
Ram Chandrasekar 7d1fbe4693 msm: limits: Fix out of bound access
Out of bound access is reported by kernel address
sanitizer (KASan) tool.

==================================================================
BUG: KASan: out of bounds access in lmh_mon_init_call+0xec/0x180
at addr ffffffc0a297e108
Write of size 8 by task swapper/0/1

===========================================================================
BUG kmalloc-64 (Not tainted): kasan: bad access detected

---------------------------------------------------------------------------

Disabling lock debugging due to kernel taint
INFO: Slab 0xffffffbc0659eec0 objects=64 used=64 fp=0x(null) flags=0x0080
INFO: Object 0xffffffc0a297e100 @offset=256 fp=0xffffffc0a3b87cb0
Bytes b4 ffffffc0a297e0f0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Object ffffffc0a297e100: b0 7c b8 a3 c0 ff ff ff 00 00 00 00 00 00 00 00
Object ffffffc0a297e110: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Object ffffffc0a297e120: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Object ffffffc0a297e130: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
CPU: 0 PID: 1 Comm: swapper/0 Tainted: G    B
3.10.49-gef71b0c-00348-g4f06d68-dirty #160
Call trace:
[<ffffffc00040a2d4>] dump_backtrace+0x0/0x1d4
[<ffffffc00040a4b8>] show_stack+0x10/0x1c
[<ffffffc000face70>] dump_stack+0x1c/0x28
[<ffffffc00054d3a0>] print_trailer+0x144/0x158
[<ffffffc00054d6fc>] object_err+0x38/0x4c
[<ffffffc0005523dc>] kasan_report_error+0x228/0x3e4
[<ffffffc0005526a8>] kasan_report+0x68/0x78
[<ffffffc00055173c>] __asan_store8+0x94/0xa0
[<ffffffc00183c0a8>] lmh_mon_init_call+0xe8/0x180
[<ffffffc000400b08>] do_one_initcall+0xcc/0x188
[<ffffffc001800bd0>] kernel_init_freeable+0x1c0/0x264
[<ffffffc000f9f338>] kernel_init+0x10/0xcc
Memory state around the buggy address:
ffffffc0a297e000: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
ffffffc0a297e080: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
ffffffc0a297e100: 00 fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
                       ^
ffffffc0a297e180: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
ffffffc0a297e200: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
==================================================================

Fix out of bound access by allocating the buffer
with right size.

Change-Id: I90d669095030dd80c09d3e69ad3fdfa3f7483b19
Signed-off-by: Ram Chandrasekar <rkumbako@codeaurora.org>
2015-04-29 13:00:22 -06:00
Ram Chandrasekar 8d9bfa52f7 msm: limits: Bypass sensor poll disable if sensor throttling
Fix concurrency issues when a read and new throttling
intensity value updation happens simultaneously.

Added a new return value in interrupt reset API to notify
the caller that the particular sensor is still throttling.
On receiving this error, the lmh interface driver should
not reset interrupt but try again to read the throttling
intensity value later.

Change-Id: I883e4c6b9438ff73d9451acc897b623db9c677cf
Signed-off-by: Ram Chandrasekar <rkumbako@codeaurora.org>
2015-03-03 11:58:48 -07:00
Ram Chandrasekar 3e138675f5 msm: limits: A new LMH monitor driver
Add a new Limits management hardware (LMH) monitor driver.
The LMH hardware driver, which interacts with the LMH hardware
via a secure image like TZ or hypervisor should register all
the LMH sensors with this driver. LMH monitor driver in turn
registers the sensors with the thermal sysfs framework.

The LMH monitor driver, when notified of a hardware throttling
interrupt by the hardware driver, will read the throttling
intensity and notify the thermal sysfs framework when
thresholds are crossed.

If the LMH hardware is capable of supporting multiple operating
profiles, then it can register itself separately as LMH
profile device. LMH Monitor driver exposes APIs to get/set the
LMH profiles.

LMH monitor driver exposes the below debugfs interfaces.

/sys/kernel/debug/lmh_monitor/interrupt_poll_delay_msec
  - Configures the interrupt polling interval in the LMH
    monitor driver. This value can be used by the hardware
    driver also.
/sys/kernel/debug/lmh_monitor/hw_trace_enable
  - Enable/disable LMH trace
/sys/kernel/debug/lmh_monitor/hw_trace_interval
  - Interval in XO clock ticks for adding timestamp in the
    trace logs.
/sys/kernel/debug/lmh_monitor/lmh-profile/level
  - Set or get the current LMH operating profile
/sys/kernel/debug/lmh_monitor/lmh-profile/total_levels
  - Total operating profile levels supported in this platform
/sys/kernel/debug/lmh_monitor/lmh-profile/available_levels
  - Lists the available profile levels for this platform.

CRs-Fixed: 704088
CRs-Fixed: 698387
Change-Id: I9afb9b8ef8532d8af383b9afc039654a2d550af4
Signed-off-by: Ram Chandrasekar <rkumbako@codeaurora.org>
2014-10-09 20:31:29 -06:00