Merge "soc: qcom: PIL: handle sw_init_done errors from spss"
diff --git a/Documentation/devicetree/bindings/input/qpnp-power-on.txt b/Documentation/devicetree/bindings/input/qpnp-power-on.txt
index 6789c62..7367934 100644
--- a/Documentation/devicetree/bindings/input/qpnp-power-on.txt
+++ b/Documentation/devicetree/bindings/input/qpnp-power-on.txt
@@ -39,6 +39,12 @@
can be used to reset the system. This property
can only be used by one device on the system. It
is an error to include it more than once.
+- qcom,modem-reset: Boolean which specifies that this PON peripheral
+ can be used to reset the attached modem chip.
+ This property can only be used by one PON device
+ on the system. qcom,modem-reset and
+ qcom,system-reset cannot be specified for the
+ same PON device.
- qcom,s3-debounce: The debounce delay for stage 3 reset trigger in
secs. The values range from 0 to 128.
- qcom,s3-src: The source for stage 3 reset. It can be one of
@@ -62,7 +68,7 @@
for system reset through qcom,system-reset
property.
This should not be defined along with the
- qcom,system-reset property.
+ qcom,system-reset or qcom,modem-reset property.
- qcom,store-hard-reset-reason: Boolean property which if set will store the
hardware reset reason to SOFT_RB_SPARE register
of the core PMIC PON peripheral.
diff --git a/arch/arm64/boot/dts/qcom/kona.dtsi b/arch/arm64/boot/dts/qcom/kona.dtsi
index cc869c6..c7a0d2c 100644
--- a/arch/arm64/boot/dts/qcom/kona.dtsi
+++ b/arch/arm64/boot/dts/qcom/kona.dtsi
@@ -1602,6 +1602,29 @@
};
};
+ spss_utils: qcom,spss_utils {
+ compatible = "qcom,spss-utils";
+ /* spss fuses physical address */
+ qcom,spss-fuse1-addr = <0x007841c4>;
+ qcom,spss-fuse1-bit = <27>;
+ qcom,spss-fuse2-addr = <0x007841c4>;
+ qcom,spss-fuse2-bit = <26>;
+ qcom,spss-dev-firmware-name = "spss1d"; /* 8 chars max */
+ qcom,spss-test-firmware-name = "spss1t"; /* 8 chars max */
+ qcom,spss-prod-firmware-name = "spss1p"; /* 8 chars max */
+ qcom,spss-debug-reg-addr = <0x01886020>;
+ qcom,spss-emul-type-reg-addr = <0x01fc8004>;
+ status = "ok";
+ };
+
+ qcom,spcom {
+ compatible = "qcom,spcom";
+
+ /* predefined channels, remote side is server */
+ qcom,spcom-ch-names = "sp_kernel", "sp_ssr";
+ status = "ok";
+ };
+
qcom,msm_gsi {
compatible = "qcom,msm_gsi";
};
@@ -2018,6 +2041,7 @@
qcom,pil-generic-irq-handler;
status = "ok";
+ qcom,signal-aop;
qcom,complete-ramdump;
qcom,pas-id = <14>;
@@ -2026,6 +2050,7 @@
memory-region = <&pil_spss_mem>;
qcom,spss-scsr-bits = <24 25>;
+ mboxes = <&qmp_aop 0>;
mbox-names = "spss-pil";
};
diff --git a/arch/arm64/boot/dts/qcom/lito-pinctrl.dtsi b/arch/arm64/boot/dts/qcom/lito-pinctrl.dtsi
index 68659b4..53d10bc 100644
--- a/arch/arm64/boot/dts/qcom/lito-pinctrl.dtsi
+++ b/arch/arm64/boot/dts/qcom/lito-pinctrl.dtsi
@@ -12,5 +12,51 @@
#gpio-cells = <2>;
interrupt-controller;
#interrupt-cells = <2>;
+
+ ufs_dev_reset_assert: ufs_dev_reset_assert {
+ config {
+ pins = "ufs_reset";
+ bias-pull-down; /* default: pull down */
+ /*
+ * UFS_RESET driver strengths are having
+ * different values/steps compared to typical
+ * GPIO drive strengths.
+ *
+ * Following table clarifies:
+ *
+ * HDRV value | UFS_RESET | Typical GPIO
+ * (dec) | (mA) | (mA)
+ * 0 | 0.8 | 2
+ * 1 | 1.55 | 4
+ * 2 | 2.35 | 6
+ * 3 | 3.1 | 8
+ * 4 | 3.9 | 10
+ * 5 | 4.65 | 12
+ * 6 | 5.4 | 14
+ * 7 | 6.15 | 16
+ *
+ * POR value for UFS_RESET HDRV is 3 which means
+ * 3.1mA and we want to use that. Hence just
+ * specify 8mA to "drive-strength" binding and
+ * that should result into writing 3 to HDRV
+ * field.
+ */
+ drive-strength = <8>; /* default: 3.1 mA */
+ output-low; /* active low reset */
+ };
+ };
+
+ ufs_dev_reset_deassert: ufs_dev_reset_deassert {
+ config {
+ pins = "ufs_reset";
+ bias-pull-down; /* default: pull down */
+ /*
+ * default: 3.1 mA
+ * check comments under ufs_dev_reset_assert
+ */
+ drive-strength = <8>;
+ output-high; /* active low reset */
+ };
+ };
};
};
diff --git a/arch/arm64/boot/dts/qcom/lito-rumi.dtsi b/arch/arm64/boot/dts/qcom/lito-rumi.dtsi
index 0f22d4d..3473b2e 100644
--- a/arch/arm64/boot/dts/qcom/lito-rumi.dtsi
+++ b/arch/arm64/boot/dts/qcom/lito-rumi.dtsi
@@ -16,3 +16,34 @@
&wdog {
status = "disabled";
};
+
+&ufsphy_mem {
+ compatible = "qcom,ufs-phy-qrbtc-sdm845";
+
+ vdda-phy-supply = <&pm8150_l5>;
+ vdda-pll-supply = <&pm8150_l6>;
+ vdda-phy-max-microamp = <90200>;
+ vdda-pll-max-microamp = <19000>;
+
+ status = "ok";
+};
+
+&ufshc_mem {
+ limit-tx-hs-gear = <1>;
+ limit-rx-hs-gear = <1>;
+
+ vdd-hba-supply = <&ufs_phy_gdsc>;
+ vdd-hba-fixed-regulator;
+ vcc-supply = <&pm8150a_l7>;
+ vccq2-supply = <&pm8150_s4>;
+ vcc-max-microamp = <800000>;
+ vccq2-max-microamp = <800000>;
+
+ qcom,vddp-ref-clk-supply = <&pm8150_l6>;
+ qcom,vddp-ref-clk-max-microamp = <100>;
+
+ qcom,disable-lpm;
+ rpm-level = <0>;
+ spm-level = <0>;
+ status = "ok";
+};
diff --git a/arch/arm64/boot/dts/qcom/lito.dtsi b/arch/arm64/boot/dts/qcom/lito.dtsi
index 093a71d..88e4ff2 100644
--- a/arch/arm64/boot/dts/qcom/lito.dtsi
+++ b/arch/arm64/boot/dts/qcom/lito.dtsi
@@ -23,6 +23,10 @@
qcom,msm-id = <400 0x10000>;
interrupt-parent = <&intc>;
+ aliases {
+ ufshc1 = &ufshc_mem; /* Embedded UFS slot */
+ };
+
cpus {
#address-cells = <2>;
#size-cells = <0>;
@@ -841,6 +845,131 @@
#reset-cells = <1>;
};
+ ufsphy_mem: ufsphy_mem@1d87000 {
+ reg = <0x1d87000 0xe00>; /* PHY regs */
+ reg-names = "phy_mem";
+ #phy-cells = <0>;
+
+ lanes-per-direction = <2>;
+
+ clock-names = "ref_clk_src",
+ "ref_clk",
+ "ref_aux_clk";
+ clocks = <&rpmhcc RPMH_CXO_CLK>,
+ <&gcc GCC_UFS_1X_CLKREF_CLK>,
+ <&gcc GCC_UFS_PHY_PHY_AUX_CLK>;
+
+ status = "disabled";
+ };
+
+ ufshc_mem: ufshc@1d84000 {
+ compatible = "qcom,ufshc";
+ reg = <0x1d84000 0x3000>;
+ interrupts = <GIC_SPI 265 IRQ_TYPE_LEVEL_HIGH>;
+ phys = <&ufsphy_mem>;
+ phy-names = "ufsphy";
+
+ lanes-per-direction = <2>;
+ dev-ref-clk-freq = <0>; /* 19.2 MHz */
+
+ clock-names =
+ "core_clk",
+ "bus_aggr_clk",
+ "iface_clk",
+ "core_clk_unipro",
+ "core_clk_ice",
+ "ref_clk",
+ "tx_lane0_sync_clk",
+ "rx_lane0_sync_clk",
+ "rx_lane1_sync_clk";
+ clocks =
+ <&gcc GCC_UFS_PHY_AXI_CLK>,
+ <&gcc GCC_AGGRE_UFS_PHY_AXI_CLK>,
+ <&gcc GCC_UFS_PHY_AHB_CLK>,
+ <&gcc GCC_UFS_PHY_UNIPRO_CORE_CLK>,
+ <&gcc GCC_UFS_PHY_ICE_CORE_CLK>,
+ <&rpmhcc RPMH_CXO_CLK>,
+ <&gcc GCC_UFS_PHY_TX_SYMBOL_0_CLK>,
+ <&gcc GCC_UFS_PHY_RX_SYMBOL_0_CLK>,
+ <&gcc GCC_UFS_PHY_RX_SYMBOL_1_CLK>;
+ freq-table-hz =
+ <37500000 300000000>,
+ <0 0>,
+ <0 0>,
+ <37500000 150000000>,
+ <75000000 300000000>,
+ <0 0>,
+ <0 0>,
+ <0 0>,
+ <0 0>;
+
+ qcom,msm-bus,name = "ufshc_mem";
+ qcom,msm-bus,num-cases = <22>;
+ qcom,msm-bus,num-paths = <2>;
+ qcom,msm-bus,vectors-KBps =
+ /*
+ * During HS G3 UFS runs at nominal voltage corner, vote
+ * higher bandwidth to push other buses in the data path
+ * to run at nominal to achieve max throughput.
+ * 4GBps pushes BIMC to run at nominal.
+ * 200MBps pushes CNOC to run at nominal.
+ * Vote for half of this bandwidth for HS G3 1-lane.
+ * For max bandwidth, vote high enough to push the buses
+ * to run in turbo voltage corner.
+ */
+ <123 512 0 0>, <1 757 0 0>, /* No vote */
+ <123 512 922 0>, <1 757 1000 0>, /* PWM G1 */
+ <123 512 1844 0>, <1 757 1000 0>, /* PWM G2 */
+ <123 512 3688 0>, <1 757 1000 0>, /* PWM G3 */
+ <123 512 7376 0>, <1 757 1000 0>, /* PWM G4 */
+ <123 512 1844 0>, <1 757 1000 0>, /* PWM G1 L2 */
+ <123 512 3688 0>, <1 757 1000 0>, /* PWM G2 L2 */
+ <123 512 7376 0>, <1 757 1000 0>, /* PWM G3 L2 */
+ <123 512 14752 0>, <1 757 1000 0>, /* PWM G4 L2 */
+ <123 512 127796 0>, <1 757 1000 0>, /* HS G1 RA */
+ <123 512 255591 0>, <1 757 1000 0>, /* HS G2 RA */
+ <123 512 2097152 0>, <1 757 102400 0>, /* HS G3 RA */
+ <123 512 255591 0>, <1 757 1000 0>, /* HS G1 RA L2 */
+ <123 512 511181 0>, <1 757 1000 0>, /* HS G2 RA L2 */
+ <123 512 4194304 0>, <1 757 204800 0>, /* HS G3 RA L2 */
+ <123 512 149422 0>, <1 757 1000 0>, /* HS G1 RB */
+ <123 512 298189 0>, <1 757 1000 0>, /* HS G2 RB */
+ <123 512 2097152 0>, <1 757 102400 0>, /* HS G3 RB */
+ <123 512 298189 0>, <1 757 1000 0>, /* HS G1 RB L2 */
+ <123 512 596378 0>, <1 757 1000 0>, /* HS G2 RB L2 */
+ /* As UFS working in HS G3 RB L2 mode, aggregated
+ * bandwidth (AB) should take care of providing
+ * optimum throughput requested. However, as tested,
+ * in order to scale up CNOC clock, instantaneous
+ * bindwidth (IB) needs to be given a proper value too.
+ */
+ <123 512 4194304 0>, <1 757 204800 409600>, /* HS G3 RB L2 */
+ <123 512 7643136 0>, <1 757 307200 0>; /* Max. bandwidth */
+
+ qcom,bus-vector-names = "MIN",
+ "PWM_G1_L1", "PWM_G2_L1", "PWM_G3_L1", "PWM_G4_L1",
+ "PWM_G1_L2", "PWM_G2_L2", "PWM_G3_L2", "PWM_G4_L2",
+ "HS_RA_G1_L1", "HS_RA_G2_L1", "HS_RA_G3_L1",
+ "HS_RA_G1_L2", "HS_RA_G2_L2", "HS_RA_G3_L2",
+ "HS_RB_G1_L1", "HS_RB_G2_L1", "HS_RB_G3_L1",
+ "HS_RB_G1_L2", "HS_RB_G2_L2", "HS_RB_G3_L2",
+ "MAX";
+
+ /* PM QoS */
+ qcom,pm-qos-cpu-groups = <0x3f 0xc0>;
+ qcom,pm-qos-cpu-group-latency-us = <67 67>;
+ qcom,pm-qos-default-cpu = <0>;
+
+ pinctrl-names = "dev-reset-assert", "dev-reset-deassert";
+ pinctrl-0 = <&ufs_dev_reset_assert>;
+ pinctrl-1 = <&ufs_dev_reset_deassert>;
+
+ resets = <&gcc GCC_UFS_PHY_BCR>;
+ reset-names = "core_reset";
+
+ status = "disabled";
+ };
+
npucc: qcom,npucc {
compatible = "qcom,dummycc";
clock-output-names = "npucc_clocks";
diff --git a/arch/arm64/configs/vendor/kona-perf_defconfig b/arch/arm64/configs/vendor/kona-perf_defconfig
index 6e97341..c8904b2 100644
--- a/arch/arm64/configs/vendor/kona-perf_defconfig
+++ b/arch/arm64/configs/vendor/kona-perf_defconfig
@@ -359,6 +359,7 @@
CONFIG_SND=y
CONFIG_SND_DYNAMIC_MINORS=y
CONFIG_SND_USB_AUDIO=y
+CONFIG_SND_USB_AUDIO_QMI=y
CONFIG_SND_SOC=y
CONFIG_UHID=y
CONFIG_HID_APPLE=y
diff --git a/arch/arm64/configs/vendor/kona_defconfig b/arch/arm64/configs/vendor/kona_defconfig
index f9756dc..7dfefb5 100644
--- a/arch/arm64/configs/vendor/kona_defconfig
+++ b/arch/arm64/configs/vendor/kona_defconfig
@@ -371,6 +371,7 @@
CONFIG_SND=y
CONFIG_SND_DYNAMIC_MINORS=y
CONFIG_SND_USB_AUDIO=y
+CONFIG_SND_USB_AUDIO_QMI=y
CONFIG_SND_SOC=y
CONFIG_UHID=y
CONFIG_HID_APPLE=y
diff --git a/drivers/gpu/drm/msm/sde/sde_hw_catalog.c b/drivers/gpu/drm/msm/sde/sde_hw_catalog.c
index 30a703e..625a1bb 100644
--- a/drivers/gpu/drm/msm/sde/sde_hw_catalog.c
+++ b/drivers/gpu/drm/msm/sde/sde_hw_catalog.c
@@ -1137,6 +1137,12 @@ static void _sde_sspp_setup_vig(struct sde_mdss_cfg *sde_cfg,
sde_cfg->true_inline_dwnscale_nrt;
sblk->in_rot_maxheight =
MAX_PRE_ROT_HEIGHT_INLINE_ROT_DEFAULT;
+ sblk->in_rot_prefill_fudge_lines =
+ sde_cfg->true_inline_prefill_fudge_lines;
+ sblk->in_rot_prefill_lines_nv12 =
+ sde_cfg->true_inline_prefill_lines_nv12;
+ sblk->in_rot_prefill_lines =
+ sde_cfg->true_inline_prefill_lines;
}
if (sde_cfg->sc_cfg.has_sys_cache) {
@@ -3807,6 +3813,9 @@ static int _sde_hardware_pre_caps(struct sde_mdss_cfg *sde_cfg, uint32_t hw_rev)
MAX_DOWNSCALE_RATIO_INLINE_ROT_RT_DEFAULT;
sde_cfg->true_inline_dwnscale_nrt =
MAX_DOWNSCALE_RATIO_INLINE_ROT_NRT_DEFAULT;
+ sde_cfg->true_inline_prefill_fudge_lines = 2;
+ sde_cfg->true_inline_prefill_lines_nv12 = 32;
+ sde_cfg->true_inline_prefill_lines = 48;
sde_cfg->uidle_cfg.uidle_rev = SDE_UIDLE_VERSION_1_0_0;
} else {
SDE_ERROR("unsupported chipset id:%X\n", hw_rev);
diff --git a/drivers/gpu/drm/msm/sde/sde_hw_catalog.h b/drivers/gpu/drm/msm/sde/sde_hw_catalog.h
index 458e9d8..35ad54d 100644
--- a/drivers/gpu/drm/msm/sde/sde_hw_catalog.h
+++ b/drivers/gpu/drm/msm/sde/sde_hw_catalog.h
@@ -591,6 +591,9 @@ struct sde_qos_lut_tbl {
* @in_rot_maxdwnscale_rt: max downscale ratio for inline rotation rt clients
* @in_rot_maxdwnscale_nrt: max downscale ratio for inline rotation nrt clients
* @in_rot_maxheight: max pre rotated height for inline rotation
+ * @in_rot_prefill_fudge_lines: prefill fudge lines for inline rotation
+ * @in_rot_prefill_lines_mv12: prefill lines for nv12 format inline rotation
+ * @in_rot_prefill_lines: prefill lines for inline rotation
* @llcc_scid: scid for the system cache
* @llcc_slice size: slice size of the system cache
*/
@@ -625,6 +628,9 @@ struct sde_sspp_sub_blks {
u32 in_rot_maxdwnscale_rt;
u32 in_rot_maxdwnscale_nrt;
u32 in_rot_maxheight;
+ u32 in_rot_prefill_fudge_lines;
+ u32 in_rot_prefill_lines_nv12;
+ u32 in_rot_prefill_lines;
int llcc_scid;
size_t llcc_slice_size;
};
@@ -1155,6 +1161,9 @@ struct sde_perf_cfg {
* @true_inline_rot_rev inline rotator feature revision
* @true_inline_dwnscale_rt true inline rotator downscale ratio for rt
* @true_inline_dwnscale_nrt true inline rotator downscale ratio for nrt
+ * @true_inline_prefill_fudge_lines true inline rotator prefill fudge lines
+ * @true_inline_prefill_lines_nv12 true inline prefill lines for nv12 format
+ * @true_inline_prefill_lines true inline prefill lines
* @macrotile_mode UBWC parameter for macro tile channel distribution
* @pipe_order_type indicate if it is required to specify pipe order
* @delay_prg_fetch_start indicates if throttling the fetch start is required
@@ -1208,6 +1217,9 @@ struct sde_mdss_cfg {
u32 true_inline_rot_rev;
u32 true_inline_dwnscale_rt;
u32 true_inline_dwnscale_nrt;
+ u32 true_inline_prefill_fudge_lines;
+ u32 true_inline_prefill_lines_nv12;
+ u32 true_inline_prefill_lines;
u32 macrotile_mode;
u32 pipe_order_type;
bool delay_prg_fetch_start;
diff --git a/drivers/gpu/drm/msm/sde/sde_plane.c b/drivers/gpu/drm/msm/sde/sde_plane.c
index f66e21f..9de9529 100644
--- a/drivers/gpu/drm/msm/sde/sde_plane.c
+++ b/drivers/gpu/drm/msm/sde/sde_plane.c
@@ -3532,6 +3532,12 @@ static void _sde_plane_install_properties(struct drm_plane *plane,
psde->pipe_sblk->in_rot_maxdwnscale_nrt);
sde_kms_info_add_keyint(info, "true_inline_max_height",
psde->pipe_sblk->in_rot_maxheight);
+ sde_kms_info_add_keyint(info, "true_inline_prefill_fudge_lines",
+ psde->pipe_sblk->in_rot_prefill_fudge_lines);
+ sde_kms_info_add_keyint(info, "true_inline_prefill_lines_nv12",
+ psde->pipe_sblk->in_rot_prefill_lines_nv12);
+ sde_kms_info_add_keyint(info, "true_inline_prefill_lines",
+ psde->pipe_sblk->in_rot_prefill_lines);
inline_rot_fmt_list = psde->pipe_sblk->in_rot_format_list;
diff --git a/drivers/input/misc/qpnp-power-on.c b/drivers/input/misc/qpnp-power-on.c
index 4220b60a..577d57b 100644
--- a/drivers/input/misc/qpnp-power-on.c
+++ b/drivers/input/misc/qpnp-power-on.c
@@ -1,6 +1,6 @@
// SPDX-License-Identifier: GPL-2.0-only
/*
- * Copyright (c) 2012-2018, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2012-2019, The Linux Foundation. All rights reserved.
*/
#include <linux/debugfs.h>
@@ -79,6 +79,9 @@
#define QPNP_PON_PS_HOLD_RST_CTL2(pon) ((pon)->base + 0x5B)
#define QPNP_PON_WD_RST_S2_CTL(pon) ((pon)->base + 0x56)
#define QPNP_PON_WD_RST_S2_CTL2(pon) ((pon)->base + 0x57)
+#define QPNP_PON_SW_RST_S2_CTL(pon) ((pon)->base + 0x62)
+#define QPNP_PON_SW_RST_S2_CTL2(pon) ((pon)->base + 0x63)
+#define QPNP_PON_SW_RST_GO(pon) ((pon)->base + 0x64)
#define QPNP_PON_S3_SRC(pon) ((pon)->base + 0x74)
#define QPNP_PON_S3_DBC_CTL(pon) ((pon)->base + 0x75)
#define QPNP_PON_SMPL_CTL(pon) ((pon)->base + 0x7F)
@@ -88,6 +91,7 @@
#define QPNP_PON_SEC_ACCESS(pon) ((pon)->base + 0xD0)
#define QPNP_PON_SEC_UNLOCK 0xA5
+#define QPNP_PON_SW_RST_GO_VAL 0xA5
#define QPNP_PON_WARM_RESET_TFT BIT(4)
@@ -229,6 +233,7 @@ module_param_named(
);
static struct qpnp_pon *sys_reset_dev;
+static struct qpnp_pon *modem_reset_dev;
static DEFINE_SPINLOCK(spon_list_slock);
static LIST_HEAD(spon_dev_list);
@@ -310,6 +315,17 @@ qpnp_pon_masked_write(struct qpnp_pon *pon, u16 addr, u8 mask, u8 val)
return rc;
}
+static int qpnp_pon_write(struct qpnp_pon *pon, u16 addr, u8 val)
+{
+ int rc;
+
+ rc = regmap_write(pon->regmap, addr, val);
+ if (rc)
+ dev_err(pon->dev, "Register write failed, addr=0x%04X, rc=%d\n",
+ addr, rc);
+ return rc;
+}
+
static int qpnp_pon_read(struct qpnp_pon *pon, u16 addr, unsigned int *val)
{
int rc;
@@ -685,6 +701,53 @@ int qpnp_pon_system_pwr_off(enum pon_power_off_type type)
}
EXPORT_SYMBOL(qpnp_pon_system_pwr_off);
+/**
+ * qpnp_pon_modem_pwr_off() - shutdown or reset the modem PMIC
+ * @type: Determines the type of power off to perform - shutdown, reset, etc
+ *
+ * This function causes the immediate shutdown or reset of the primary PMIC
+ * for an attached modem chip.
+ *
+ * Return: 0 for success or < 0 for errors
+ */
+int qpnp_pon_modem_pwr_off(enum pon_power_off_type type)
+{
+ struct qpnp_pon *pon = modem_reset_dev;
+ int rc;
+
+ if (!modem_reset_dev)
+ return -ENODEV;
+
+ rc = qpnp_pon_write(pon, QPNP_PON_SW_RST_S2_CTL2(pon), 0);
+ if (rc)
+ return rc;
+
+ /* Wait for at least 10 sleep clock cycles. */
+ udelay(500);
+
+ rc = qpnp_pon_write(pon, QPNP_PON_SW_RST_S2_CTL(pon), type);
+ if (rc)
+ return rc;
+
+ rc = qpnp_pon_write(pon, QPNP_PON_SW_RST_S2_CTL2(pon),
+ QPNP_PON_RESET_EN);
+ if (rc)
+ return rc;
+
+ /* Wait for at least 10 sleep clock cycles. */
+ udelay(500);
+
+ rc = qpnp_pon_write(pon, QPNP_PON_SW_RST_GO(pon),
+ QPNP_PON_SW_RST_GO_VAL);
+ if (rc)
+ return rc;
+
+ dev_dbg(pon->dev, "modem sw power off type = 0x%02X\n", type);
+
+ return 0;
+}
+EXPORT_SYMBOL(qpnp_pon_modem_pwr_off);
+
static int _qpnp_pon_is_warm_reset(struct qpnp_pon *pon)
{
if (!pon)
@@ -2190,7 +2253,7 @@ static int qpnp_pon_probe(struct platform_device *pdev)
struct qpnp_pon *pon;
unsigned long flags;
u32 base, delay;
- bool sys_reset;
+ bool sys_reset, modem_reset;
int rc;
pon = devm_kzalloc(dev, sizeof(*pon), GFP_KERNEL);
@@ -2217,6 +2280,15 @@ static int qpnp_pon_probe(struct platform_device *pdev)
return -EINVAL;
}
+ modem_reset = of_property_read_bool(dev->of_node, "qcom,modem-reset");
+ if (modem_reset && modem_reset_dev) {
+ dev_err(dev, "qcom,modem-reset property must only be specified for one PMIC PON device in the system\n");
+ return -EINVAL;
+ } else if (modem_reset && sys_reset) {
+ dev_err(dev, "qcom,modem-reset and qcom,system-reset properties cannot be supported together for one PMIC PON device\n");
+ return -EINVAL;
+ }
+
/* Get the total number of pon configurations and regulators */
for_each_available_child_of_node(dev->of_node, node) {
if (of_find_property(node, "regulator-name", NULL)) {
@@ -2276,6 +2348,9 @@ static int qpnp_pon_probe(struct platform_device *pdev)
if (sys_reset) {
dev_err(dev, "qcom,system-reset property shouldn't be used along with qcom,secondary-pon-reset property\n");
return -EINVAL;
+ } else if (modem_reset) {
+ dev_err(dev, "qcom,modem-reset property shouldn't be used along with qcom,secondary-pon-reset property\n");
+ return -EINVAL;
}
spin_lock_irqsave(&spon_list_slock, flags);
list_add(&pon->list, &spon_dev_list);
@@ -2297,6 +2372,8 @@ static int qpnp_pon_probe(struct platform_device *pdev)
if (sys_reset)
sys_reset_dev = pon;
+ if (modem_reset)
+ modem_reset_dev = pon;
qpnp_pon_debugfs_init(pon);
diff --git a/drivers/media/platform/msm/camera/cam_cdm/cam_cdm_virtual_core.c b/drivers/media/platform/msm/camera/cam_cdm/cam_cdm_virtual_core.c
index 07c3113..edeafcd 100644
--- a/drivers/media/platform/msm/camera/cam_cdm/cam_cdm_virtual_core.c
+++ b/drivers/media/platform/msm/camera/cam_cdm/cam_cdm_virtual_core.c
@@ -1,6 +1,6 @@
// SPDX-License-Identifier: GPL-2.0-only
/*
- * Copyright (c) 2017-2018, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2017-2019, The Linux Foundation. All rights reserved.
*/
#include <linux/delay.h>
@@ -111,6 +111,14 @@ int cam_virtual_cdm_submit_bl(struct cam_hw_info *cdm_hw,
if ((!rc) && (vaddr_ptr) && (len) &&
(len >= cdm_cmd->cmd[i].offset)) {
+
+
+ if ((len - cdm_cmd->cmd[i].offset) <=
+ cdm_cmd->cmd[i].len) {
+ CAM_ERR(CAM_CDM, "Not enough buffer");
+ rc = -EINVAL;
+ break;
+ }
CAM_DBG(CAM_CDM,
"hdl=%x vaddr=%pK offset=%d cmdlen=%d:%zu",
cdm_cmd->cmd[i].bl_addr.mem_handle,
diff --git a/drivers/media/platform/msm/camera/cam_core/cam_context.c b/drivers/media/platform/msm/camera/cam_core/cam_context.c
index e972908..85908a3b 100644
--- a/drivers/media/platform/msm/camera/cam_core/cam_context.c
+++ b/drivers/media/platform/msm/camera/cam_core/cam_context.c
@@ -1,6 +1,6 @@
// SPDX-License-Identifier: GPL-2.0-only
/*
- * Copyright (c) 2017-2018, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2017-2019, The Linux Foundation. All rights reserved.
*/
#include <linux/slab.h>
@@ -165,6 +165,7 @@ int cam_context_handle_crm_apply_req(struct cam_context *ctx,
return -EINVAL;
}
+ mutex_lock(&ctx->ctx_mutex);
if (ctx->state_machine[ctx->state].crm_ops.apply_req) {
rc = ctx->state_machine[ctx->state].crm_ops.apply_req(ctx,
apply);
@@ -173,6 +174,7 @@ int cam_context_handle_crm_apply_req(struct cam_context *ctx,
ctx->dev_hdl, ctx->state);
rc = -EPROTO;
}
+ mutex_unlock(&ctx->ctx_mutex);
return rc;
}
diff --git a/drivers/media/platform/msm/camera/cam_core/cam_context_utils.c b/drivers/media/platform/msm/camera/cam_core/cam_context_utils.c
index 7ba23a5..2a83f0e 100644
--- a/drivers/media/platform/msm/camera/cam_core/cam_context_utils.c
+++ b/drivers/media/platform/msm/camera/cam_core/cam_context_utils.c
@@ -1,6 +1,6 @@
// SPDX-License-Identifier: GPL-2.0-only
/*
- * Copyright (c) 2017-2018, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2017-2019, The Linux Foundation. All rights reserved.
*/
#include <linux/debugfs.h>
@@ -268,6 +268,7 @@ int32_t cam_context_prepare_dev_to_hw(struct cam_context *ctx,
uintptr_t packet_addr;
struct cam_packet *packet;
size_t len = 0;
+ size_t remain_len = 0;
int32_t i = 0, j = 0;
if (!ctx || !cmd) {
@@ -313,11 +314,26 @@ int32_t cam_context_prepare_dev_to_hw(struct cam_context *ctx,
goto free_req;
}
+ if ((len < sizeof(struct cam_packet)) ||
+ (cmd->offset >= (len - sizeof(struct cam_packet)))) {
+ CAM_ERR(CAM_CTXT, "Not enough buf");
+ return -EINVAL;
+
+ }
+ remain_len = len;
+ if ((len < sizeof(struct cam_packet)) ||
+ ((size_t)cmd->offset >= len - sizeof(struct cam_packet))) {
+ CAM_ERR(CAM_CTXT, "invalid buff length: %zu or offset", len);
+ rc = -EINVAL;
+ goto free_cpu_buf;
+ }
+
+ remain_len -= (size_t)cmd->offset;
packet = (struct cam_packet *) ((uint8_t *)packet_addr +
(uint32_t)cmd->offset);
if (packet->header.request_id <= ctx->last_flush_req) {
- CAM_DBG(CAM_CORE,
+ CAM_ERR(CAM_CORE,
"request %lld has been flushed, reject packet",
packet->header.request_id);
rc = -EINVAL;
@@ -330,6 +346,7 @@ int32_t cam_context_prepare_dev_to_hw(struct cam_context *ctx,
/* preprocess the configuration */
memset(&cfg, 0, sizeof(cfg));
cfg.packet = packet;
+ cfg.remain_len = remain_len;
cfg.ctxt_to_hw_map = ctx->ctxt_to_hw_map;
cfg.max_hw_update_entries = CAM_CTX_CFG_MAX;
cfg.num_hw_update_entries = req->num_hw_update_entries;
diff --git a/drivers/media/platform/msm/camera/cam_core/cam_hw_mgr_intf.h b/drivers/media/platform/msm/camera/cam_core/cam_hw_mgr_intf.h
index 82c1786..7f679d5 100644
--- a/drivers/media/platform/msm/camera/cam_core/cam_hw_mgr_intf.h
+++ b/drivers/media/platform/msm/camera/cam_core/cam_hw_mgr_intf.h
@@ -1,6 +1,6 @@
/* SPDX-License-Identifier: GPL-2.0-only */
/*
- * Copyright (c) 2017-2018, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2017-2019, The Linux Foundation. All rights reserved.
*/
#ifndef _CAM_HW_MGR_INTF_H_
@@ -146,6 +146,7 @@ struct cam_hw_mgr_dump_pf_data {
* struct cam_hw_prepare_update_args - Payload for prepare command
*
* @packet: CSL packet from user mode driver
+ * @remain_len Remaining length of CPU buffer after config offset
* @ctxt_to_hw_map: HW context from the acquire
* @max_hw_update_entries: Maximum hardware update entries supported
* @hw_update_entries: Actual hardware update configuration (returned)
@@ -162,6 +163,7 @@ struct cam_hw_mgr_dump_pf_data {
*/
struct cam_hw_prepare_update_args {
struct cam_packet *packet;
+ size_t remain_len;
void *ctxt_to_hw_map;
uint32_t max_hw_update_entries;
struct cam_hw_update_entry *hw_update_entries;
diff --git a/drivers/media/platform/msm/camera/cam_fd/fd_hw_mgr/cam_fd_hw_mgr.c b/drivers/media/platform/msm/camera/cam_fd/fd_hw_mgr/cam_fd_hw_mgr.c
index da190f9b..2509a16 100644
--- a/drivers/media/platform/msm/camera/cam_fd/fd_hw_mgr/cam_fd_hw_mgr.c
+++ b/drivers/media/platform/msm/camera/cam_fd/fd_hw_mgr/cam_fd_hw_mgr.c
@@ -1,6 +1,6 @@
// SPDX-License-Identifier: GPL-2.0-only
/*
- * Copyright (c) 2017-2018, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2017-2019, The Linux Foundation. All rights reserved.
*/
#include <linux/module.h>
@@ -23,7 +23,8 @@
static struct cam_fd_hw_mgr g_fd_hw_mgr;
-static int cam_fd_mgr_util_packet_validate(struct cam_packet *packet)
+static int cam_fd_mgr_util_packet_validate(struct cam_packet *packet,
+ size_t remain_len)
{
struct cam_cmd_buf_desc *cmd_desc = NULL;
int i, rc;
@@ -43,7 +44,7 @@ static int cam_fd_mgr_util_packet_validate(struct cam_packet *packet)
packet->patch_offset, packet->num_patches,
packet->kmd_cmd_buf_offset, packet->kmd_cmd_buf_index);
- if (cam_packet_util_validate_packet(packet)) {
+ if (cam_packet_util_validate_packet(packet, remain_len)) {
CAM_ERR(CAM_FD, "invalid packet:%d %d %d %d %d",
packet->kmd_cmd_buf_index,
packet->num_cmd_buf, packet->cmd_buf_offset,
@@ -155,8 +156,10 @@ static int cam_fd_mgr_util_put_frame_req(
mutex_lock(&g_fd_hw_mgr.frame_req_mutex);
req_ptr = *frame_req;
- if (req_ptr)
+ if (req_ptr) {
+ list_del_init(&req_ptr->list);
list_add_tail(&req_ptr->list, src_list);
+ }
*frame_req = NULL;
mutex_unlock(&g_fd_hw_mgr.frame_req_mutex);
@@ -602,7 +605,14 @@ static int cam_fd_mgr_util_prepare_io_buf_info(int32_t iommu_hdl,
rc);
goto rel_cpu_buf;
}
-
+ if (io_cfg[i].offsets[plane] >= size) {
+ CAM_ERR(CAM_FD,
+ "Invalid cpu buf %d %d %d",
+ io_cfg[i].direction,
+ io_cfg[i].resource_type, plane);
+ rc = -EINVAL;
+ goto rel_cpu_buf;
+ }
cpu_addr[plane] += io_cfg[i].offsets[plane];
}
@@ -1458,6 +1468,16 @@ static int cam_fd_mgr_hw_flush_ctx(void *hw_mgr_priv,
for (i = 0; i < flush_args->num_req_pending; i++) {
flush_req = (struct cam_fd_mgr_frame_request *)
flush_args->flush_req_pending[i];
+ CAM_DBG(CAM_FD, "flush pending req %llu",
+ flush_req->request_id);
+ cam_fd_mgr_util_put_frame_req(&hw_mgr->frame_free_list,
+ &flush_req);
+ }
+
+ for (i = 0; i < flush_args->num_req_active; i++) {
+ flush_req = (struct cam_fd_mgr_frame_request *)
+ flush_args->flush_req_active[i];
+ CAM_DBG(CAM_FD, "flush active req %llu", flush_req->request_id);
cam_fd_mgr_util_put_frame_req(&hw_mgr->frame_free_list,
&flush_req);
}
@@ -1573,7 +1593,8 @@ static int cam_fd_mgr_hw_prepare_update(void *hw_mgr_priv,
goto error;
}
- rc = cam_fd_mgr_util_packet_validate(prepare->packet);
+ rc = cam_fd_mgr_util_packet_validate(prepare->packet,
+ prepare->remain_len);
if (rc) {
CAM_ERR(CAM_FD, "Error in packet validation %d", rc);
goto error;
diff --git a/drivers/media/platform/msm/camera/cam_icp/icp_hw/bps_hw/bps_core.c b/drivers/media/platform/msm/camera/cam_icp/icp_hw/bps_hw/bps_core.c
index 8b788f2..cbb76ae 100644
--- a/drivers/media/platform/msm/camera/cam_icp/icp_hw/bps_hw/bps_core.c
+++ b/drivers/media/platform/msm/camera/cam_icp/icp_hw/bps_hw/bps_core.c
@@ -1,6 +1,6 @@
// SPDX-License-Identifier: GPL-2.0-only
/*
- * Copyright (c) 2017-2018, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2017-2019, The Linux Foundation. All rights reserved.
*/
#include <linux/of.h>
@@ -219,6 +219,13 @@ static int cam_bps_cmd_reset(struct cam_hw_soc_info *soc_info,
bool reset_bps_top_fail = false;
CAM_DBG(CAM_ICP, "CAM_ICP_BPS_CMD_RESET");
+
+ if (!core_info->clk_enable || !core_info->cpas_start) {
+ CAM_ERR(CAM_ICP, "BPS reset failed. clk_en %d cpas_start %d",
+ core_info->clk_enable, core_info->cpas_start);
+ return -EINVAL;
+ }
+
/* Reset BPS CDM core*/
cam_io_w_mb((uint32_t)0xF,
soc_info->reg_map[0].mem_base + BPS_CDM_RST_CMD);
diff --git a/drivers/media/platform/msm/camera/cam_icp/icp_hw/icp_hw_mgr/cam_icp_hw_mgr.c b/drivers/media/platform/msm/camera/cam_icp/icp_hw/icp_hw_mgr/cam_icp_hw_mgr.c
index 7de943c..882e2b0 100644
--- a/drivers/media/platform/msm/camera/cam_icp/icp_hw/icp_hw_mgr/cam_icp_hw_mgr.c
+++ b/drivers/media/platform/msm/camera/cam_icp/icp_hw/icp_hw_mgr/cam_icp_hw_mgr.c
@@ -1,6 +1,6 @@
// SPDX-License-Identifier: GPL-2.0-only
/*
- * Copyright (c) 2017-2018, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2017-2019, The Linux Foundation. All rights reserved.
*/
#include <linux/uaccess.h>
@@ -3772,6 +3772,9 @@ static int cam_icp_mgr_prepare_hw_update(void *hw_mgr_priv,
packet = prepare_args->packet;
+ if (cam_packet_util_validate_packet(packet, prepare_args->remain_len))
+ return -EINVAL;
+
rc = cam_icp_mgr_pkt_validation(packet);
if (rc) {
mutex_unlock(&ctx_data->ctx_mutex);
diff --git a/drivers/media/platform/msm/camera/cam_icp/icp_hw/ipe_hw/ipe_core.c b/drivers/media/platform/msm/camera/cam_icp/icp_hw/ipe_hw/ipe_core.c
index c023665..731a5dc 100644
--- a/drivers/media/platform/msm/camera/cam_icp/icp_hw/ipe_hw/ipe_core.c
+++ b/drivers/media/platform/msm/camera/cam_icp/icp_hw/ipe_hw/ipe_core.c
@@ -1,6 +1,6 @@
// SPDX-License-Identifier: GPL-2.0-only
/*
- * Copyright (c) 2017-2018, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2017-2019, The Linux Foundation. All rights reserved.
*/
#include <linux/of.h>
@@ -215,6 +215,12 @@ static int cam_ipe_cmd_reset(struct cam_hw_soc_info *soc_info,
bool reset_ipe_top_fail = false;
CAM_DBG(CAM_ICP, "CAM_ICP_IPE_CMD_RESET");
+ if (!core_info->clk_enable || !core_info->cpas_start) {
+ CAM_ERR(CAM_HFI, "IPE reset failed. clk_en %d cpas_start %d",
+ core_info->clk_enable, core_info->cpas_start);
+ return -EINVAL;
+ }
+
/* IPE CDM core reset*/
cam_io_w_mb((uint32_t)0xF,
soc_info->reg_map[0].mem_base + IPE_CDM_RST_CMD);
diff --git a/drivers/media/platform/msm/camera/cam_isp/cam_isp_context.c b/drivers/media/platform/msm/camera/cam_isp/cam_isp_context.c
index 13529f6..f514850 100644
--- a/drivers/media/platform/msm/camera/cam_isp/cam_isp_context.c
+++ b/drivers/media/platform/msm/camera/cam_isp/cam_isp_context.c
@@ -1,6 +1,6 @@
// SPDX-License-Identifier: GPL-2.0-only
/*
- * Copyright (c) 2017-2018, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2017-2019, The Linux Foundation. All rights reserved.
*/
#include <linux/debugfs.h>
@@ -122,6 +122,8 @@ static void cam_isp_ctx_dump_req(struct cam_isp_ctx_req *req_isp)
size_t len = 0;
uint32_t *buf_addr;
uint32_t *buf_start, *buf_end;
+ size_t remain_len = 0;
+ bool need_put = false;
for (i = 0; i < req_isp->num_cfg; i++) {
rc = cam_packet_util_get_cmd_mem_addr(
@@ -131,20 +133,31 @@ static void cam_isp_ctx_dump_req(struct cam_isp_ctx_req *req_isp)
"Failed to get_cmd_mem_addr, rc=%d",
rc);
} else {
- buf_start = (uint32_t *)((uint8_t *) buf_addr +
- req_isp->cfg[i].offset);
- buf_end = (uint32_t *)((uint8_t *) buf_start +
- req_isp->cfg[i].len - 1);
- if (len < (buf_end - buf_start + 1)) {
- CAM_ERR(CAM_ISP,
- "Invalid len %lld buf_start-end=%d",
- len, (buf_end - buf_start + 1));
+ if (req_isp->cfg[i].offset >= len) {
+ CAM_ERR(CAM_ISP, "Invalid offset");
+ need_put = true;
+ goto put;
+ }
+ remain_len = len - req_isp->cfg[i].offset;
+
+ if (req_isp->cfg[i].len > remain_len) {
+ CAM_ERR(CAM_ISP, "Invalid offset");
+ need_put = true;
+ }
+put:
+ if (need_put) {
if (cam_mem_put_cpu_buf(req_isp->cfg[i].handle))
CAM_WARN(CAM_ISP,
"Failed to put cpu buf: 0x%x",
req_isp->cfg[i].handle);
+ need_put = false;
continue;
}
+
+ buf_start = (uint32_t *)((uint8_t *) buf_addr +
+ req_isp->cfg[i].offset);
+ buf_end = (uint32_t *)((uint8_t *) buf_start +
+ req_isp->cfg[i].len - 1);
cam_cdm_util_dump_cmd_buf(buf_start, buf_end);
if (cam_mem_put_cpu_buf(req_isp->cfg[i].handle))
CAM_WARN(CAM_ISP, "Failed to put cpu buf: 0x%x",
@@ -417,10 +430,11 @@ static int __cam_isp_ctx_handle_buf_done_in_activated_state(
if (!req_isp->bubble_detected) {
CAM_DBG(CAM_ISP,
- "Sync with success: req %lld res 0x%x fd 0x%x",
+ "Sync with success: req %lld res 0x%x fd 0x%x, ctx %u",
req->request_id,
req_isp->fence_map_out[j].resource_handle,
- req_isp->fence_map_out[j].sync_id);
+ req_isp->fence_map_out[j].sync_id,
+ ctx->ctx_id);
rc = cam_sync_signal(req_isp->fence_map_out[j].sync_id,
CAM_SYNC_STATE_SIGNALED_SUCCESS);
@@ -428,11 +442,12 @@ static int __cam_isp_ctx_handle_buf_done_in_activated_state(
CAM_DBG(CAM_ISP, "Sync failed with rc = %d",
rc);
} else if (!req_isp->bubble_report) {
- CAM_DBG(CAM_ISP,
- "Sync with failure: req %lld res 0x%x fd 0x%x",
+ CAM_ERR(CAM_ISP,
+ "Sync with failure: req %lld res 0x%x fd 0x%x, ctx %u",
req->request_id,
req_isp->fence_map_out[j].resource_handle,
- req_isp->fence_map_out[j].sync_id);
+ req_isp->fence_map_out[j].sync_id,
+ ctx->ctx_id);
rc = cam_sync_signal(req_isp->fence_map_out[j].sync_id,
CAM_SYNC_STATE_SIGNALED_ERROR);
@@ -453,9 +468,9 @@ static int __cam_isp_ctx_handle_buf_done_in_activated_state(
continue;
}
- CAM_DBG(CAM_ISP, "req %lld, reset sync id 0x%x",
+ CAM_DBG(CAM_ISP, "req %lld, reset sync id 0x%x ctx %u",
req->request_id,
- req_isp->fence_map_out[j].sync_id);
+ req_isp->fence_map_out[j].sync_id, ctx->ctx_id);
if (!rc) {
req_isp->num_acked++;
req_isp->fence_map_out[j].sync_id = -1;
@@ -465,9 +480,9 @@ static int __cam_isp_ctx_handle_buf_done_in_activated_state(
if (req_isp->num_acked > req_isp->num_fence_map_out) {
/* Should not happen */
CAM_ERR(CAM_ISP,
- "WARNING: req_id %lld num_acked %d > map_out %d",
+ "WARNING: req_id %lld num_acked %d > map_out %d, ctx %u",
req->request_id, req_isp->num_acked,
- req_isp->num_fence_map_out);
+ req_isp->num_fence_map_out, ctx->ctx_id);
WARN_ON(req_isp->num_acked > req_isp->num_fence_map_out);
}
@@ -484,15 +499,15 @@ static int __cam_isp_ctx_handle_buf_done_in_activated_state(
atomic_set(&ctx_isp->process_bubble, 0);
CAM_DBG(CAM_REQ,
- "Move active request %lld to pending list(cnt = %d) [bubble recovery]",
- req->request_id, ctx_isp->active_req_cnt);
+ "Move active request %lld to pending list(cnt = %d) [bubble recovery], ctx %u",
+ req->request_id, ctx_isp->active_req_cnt, ctx->ctx_id);
} else {
list_del_init(&req->list);
list_add_tail(&req->list, &ctx->free_req_list);
CAM_DBG(CAM_REQ,
- "Move active request %lld to free list(cnt = %d) [all fences done]",
- req->request_id, ctx_isp->active_req_cnt);
+ "Move active request %lld to free list(cnt = %d) [all fences done], ctx %u",
+ req->request_id, ctx_isp->active_req_cnt, ctx->ctx_id);
}
end:
@@ -591,14 +606,15 @@ static int __cam_isp_ctx_reg_upd_in_activated_state(
if (req_isp->num_fence_map_out != 0) {
list_add_tail(&req->list, &ctx->active_req_list);
ctx_isp->active_req_cnt++;
- CAM_DBG(CAM_REQ, "move request %lld to active list(cnt = %d)",
- req->request_id, ctx_isp->active_req_cnt);
+ CAM_DBG(CAM_REQ,
+ "move request %lld to active list(cnt = %d), ctx %u",
+ req->request_id, ctx_isp->active_req_cnt, ctx->ctx_id);
} else {
/* no io config, so the request is completed. */
list_add_tail(&req->list, &ctx->free_req_list);
CAM_DBG(CAM_ISP,
- "move active request %lld to free list(cnt = %d)",
- req->request_id, ctx_isp->active_req_cnt);
+ "move active request %lld to free list(cnt = %d), ctx %u",
+ req->request_id, ctx_isp->active_req_cnt, ctx->ctx_id);
}
/*
@@ -637,8 +653,8 @@ static int __cam_isp_ctx_notify_sof_in_activated_state(
notify.trigger = CAM_TRIGGER_POINT_SOF;
ctx->ctx_crm_intf->notify_trigger(¬ify);
- CAM_DBG(CAM_ISP, "Notify CRM SOF frame %lld",
- ctx_isp->frame_id);
+ CAM_DBG(CAM_ISP, "Notify CRM SOF frame %lld ctx %u",
+ ctx_isp->frame_id, ctx->ctx_id);
}
list_for_each_entry(req, &ctx->active_req_list, list) {
@@ -655,7 +671,9 @@ static int __cam_isp_ctx_notify_sof_in_activated_state(
__cam_isp_ctx_send_sof_timestamp(ctx_isp, request_id,
CAM_REQ_MGR_SOF_EVENT_SUCCESS);
} else {
- CAM_ERR_RATE_LIMIT(CAM_ISP, "Can not notify SOF to CRM");
+ CAM_ERR_RATE_LIMIT(CAM_ISP,
+ "Can not notify SOF to CRM for ctx %u",
+ ctx->ctx_id);
rc = -EFAULT;
}
@@ -680,10 +698,11 @@ static int __cam_isp_ctx_notify_eof_in_activated_state(
notify.trigger = CAM_TRIGGER_POINT_EOF;
ctx->ctx_crm_intf->notify_trigger(¬ify);
- CAM_DBG(CAM_ISP, "Notify CRM EOF frame %lld\n",
- ctx_isp->frame_id);
+ CAM_DBG(CAM_ISP, "Notify CRM EOF frame %lld ctx %u",
+ ctx_isp->frame_id, ctx->ctx_id);
} else {
- CAM_ERR(CAM_ISP, "Can not notify EOF to CRM");
+ CAM_ERR(CAM_ISP, "Can not notify EOF to CRM for ctx %u",
+ ctx->ctx_id);
rc = -EFAULT;
}
@@ -718,8 +737,8 @@ static int __cam_isp_ctx_sof_in_activated_state(
ctx_isp->boot_timestamp = sof_event_data->boot_time;
__cam_isp_ctx_update_state_monitor_array(ctx_isp,
CAM_ISP_STATE_CHANGE_TRIGGER_SOF, req->request_id);
- CAM_DBG(CAM_ISP, "frame id: %lld time stamp:0x%llx",
- ctx_isp->frame_id, ctx_isp->sof_timestamp_val);
+ CAM_DBG(CAM_ISP, "frame id: %lld time stamp:0x%llx, ctx %u",
+ ctx_isp->frame_id, ctx_isp->sof_timestamp_val, ctx->ctx_id);
return rc;
}
@@ -800,8 +819,8 @@ static int __cam_isp_ctx_epoch_in_applied(struct cam_isp_context *ctx_isp,
notify.error = CRM_KMD_ERR_BUBBLE;
ctx->ctx_crm_intf->notify_err(¬ify);
atomic_set(&ctx_isp->process_bubble, 1);
- CAM_DBG(CAM_ISP, "Notify CRM about Bubble frame %lld",
- ctx_isp->frame_id);
+ CAM_DBG(CAM_ISP, "Notify CRM about Bubble frame %lld, ctx %u",
+ ctx_isp->frame_id, ctx->ctx_id);
} else {
req_isp->bubble_report = 0;
}
@@ -810,8 +829,8 @@ static int __cam_isp_ctx_epoch_in_applied(struct cam_isp_context *ctx_isp,
* Always move the request to active list. Let buf done
* function handles the rest.
*/
- CAM_DBG(CAM_REQ, "move request %lld to active list(cnt = %d)",
- req->request_id, ctx_isp->active_req_cnt);
+ CAM_DBG(CAM_REQ, "move request %lld to active list(cnt = %d), ctx %u",
+ req->request_id, ctx_isp->active_req_cnt, ctx->ctx_id);
ctx_isp->active_req_cnt++;
list_del_init(&req->list);
list_add_tail(&req->list, &ctx->active_req_list);
@@ -949,8 +968,8 @@ static int __cam_isp_ctx_epoch_in_bubble_applied(
notify.error = CRM_KMD_ERR_BUBBLE;
ctx->ctx_crm_intf->notify_err(¬ify);
CAM_DBG(CAM_REQ,
- "Notify CRM about Bubble req_id %llu frame %lld",
- req->request_id, ctx_isp->frame_id);
+ "Notify CRM about Bubble req_id %llu frame %lld, ctx %u",
+ req->request_id, ctx_isp->frame_id, ctx->ctx_id);
} else {
req_isp->bubble_report = 0;
}
@@ -959,7 +978,7 @@ static int __cam_isp_ctx_epoch_in_bubble_applied(
* Always move the request to active list. Let buf done
* function handles the rest.
*/
- CAM_DBG(CAM_ISP, "move request %lld to active list(cnt = %d)",
+ CAM_DBG(CAM_ISP, "move request %lld to active list(cnt = %d) ctx %u",
req->request_id, ctx_isp->active_req_cnt);
ctx_isp->active_req_cnt++;
list_del_init(&req->list);
@@ -1065,9 +1084,11 @@ static int __cam_isp_ctx_handle_error(struct cam_isp_context *ctx_isp,
for (i = 0; i < req_isp->num_fence_map_out; i++) {
fence_map_out =
&req_isp->fence_map_out[i];
- CAM_ERR(CAM_ISP, "req %llu, Sync fd %x",
+ CAM_ERR(CAM_ISP,
+ "req %llu, Sync fd 0x%x ctx %u",
req->request_id,
- req_isp->fence_map_out[i].sync_id);
+ req_isp->fence_map_out[i].sync_id,
+ ctx->ctx_id);
if (req_isp->fence_map_out[i].sync_id != -1) {
rc = cam_sync_signal(
fence_map_out->sync_id,
@@ -1094,9 +1115,11 @@ static int __cam_isp_ctx_handle_error(struct cam_isp_context *ctx_isp,
for (i = 0; i < req_isp->num_fence_map_out; i++) {
fence_map_out =
&req_isp->fence_map_out[i];
- CAM_ERR(CAM_ISP, "req %llu, Sync fd %x",
+ CAM_ERR(CAM_ISP,
+ "req %llu, Sync fd 0x%x ctx %u",
req->request_id,
- req_isp->fence_map_out[i].sync_id);
+ req_isp->fence_map_out[i].sync_id,
+ ctx->ctx_id);
if (req_isp->fence_map_out[i].sync_id != -1) {
rc = cam_sync_signal(
fence_map_out->sync_id,
@@ -1183,8 +1206,8 @@ static int __cam_isp_ctx_handle_error(struct cam_isp_context *ctx_isp,
notify.error = CRM_KMD_ERR_FATAL;
}
- CAM_WARN(CAM_ISP, "Notify CRM: req %lld, frame %lld\n",
- error_request_id, ctx_isp->frame_id);
+ CAM_WARN(CAM_ISP, "Notify CRM: req %lld, frame %lld ctx %u",
+ error_request_id, ctx_isp->frame_id, ctx->ctx_id);
ctx->ctx_crm_intf->notify_err(¬ify);
@@ -1207,12 +1230,15 @@ static int __cam_isp_ctx_handle_error(struct cam_isp_context *ctx_isp,
V4L_EVENT_CAM_REQ_MGR_ERROR,
V4L_EVENT_CAM_REQ_MGR_EVENT))
CAM_ERR(CAM_ISP,
- "Error in notifying the error time for req id:%lld",
- ctx_isp->last_applied_req_id);
+ "Error in notifying the error time for req id:%lld ctx %u",
+ ctx_isp->last_applied_req_id,
+ ctx->ctx_id);
}
ctx_isp->substate_activated = CAM_ISP_CTX_ACTIVATED_HW_ERROR;
} else {
- CAM_ERR_RATE_LIMIT(CAM_ISP, "Can not notify ERRROR to CRM");
+ CAM_ERR_RATE_LIMIT(CAM_ISP,
+ "Can not notify ERRROR to CRM for ctx %u",
+ ctx->ctx_id);
rc = -EFAULT;
}
@@ -1649,15 +1675,16 @@ static int __cam_isp_ctx_apply_req_in_activated_state(
goto end;
}
- CAM_DBG(CAM_REQ, "Apply request %lld in substate %d", req->request_id,
- ctx_isp->substate_activated);
+ CAM_DBG(CAM_REQ, "Apply request %lld in substate %d ctx %u",
+ req->request_id, ctx_isp->substate_activated, ctx->ctx_id);
req_isp = (struct cam_isp_ctx_req *) req->req_priv;
if (ctx_isp->active_req_cnt >= 2) {
CAM_ERR_RATE_LIMIT(CAM_ISP,
- "Reject apply request (id %lld) due to congestion(cnt = %d)",
+ "Reject apply request (id %lld) due to congestion(cnt = %d) ctx %u",
req->request_id,
- ctx_isp->active_req_cnt);
+ ctx_isp->active_req_cnt,
+ ctx->ctx_id);
spin_lock_bh(&ctx->lock);
if (!list_empty(&ctx->active_req_list))
@@ -2536,6 +2563,7 @@ static int __cam_isp_ctx_config_dev_in_top_state(
uintptr_t packet_addr;
struct cam_packet *packet;
size_t len = 0;
+ size_t remain_len = 0;
struct cam_hw_prepare_update_args cfg;
struct cam_req_mgr_add_request add_req;
struct cam_isp_context *ctx_isp =
@@ -2569,6 +2597,15 @@ static int __cam_isp_ctx_config_dev_in_top_state(
goto free_req;
}
+ remain_len = len;
+ if ((len < sizeof(struct cam_packet)) ||
+ ((size_t)cmd->offset >= len - sizeof(struct cam_packet))) {
+ CAM_ERR(CAM_ISP, "invalid buff length: %zu or offset", len);
+ rc = -EINVAL;
+ goto free_cpu_buf;
+ }
+
+ remain_len -= (size_t)cmd->offset;
packet = (struct cam_packet *)(packet_addr + (uint32_t)cmd->offset);
CAM_DBG(CAM_ISP, "pack_handle %llx", cmd->packet_handle);
CAM_DBG(CAM_ISP, "packet address is 0x%zx", packet_addr);
@@ -2591,6 +2628,7 @@ static int __cam_isp_ctx_config_dev_in_top_state(
/* preprocess the configuration */
memset(&cfg, 0, sizeof(cfg));
cfg.packet = packet;
+ cfg.remain_len = remain_len;
cfg.ctxt_to_hw_map = ctx_isp->hw_ctx;
cfg.max_hw_update_entries = CAM_ISP_CTX_CFG_MAX;
cfg.hw_update_entries = req_isp->cfg;
diff --git a/drivers/media/platform/msm/camera/cam_isp/isp_hw_mgr/cam_ife_hw_mgr.c b/drivers/media/platform/msm/camera/cam_isp/isp_hw_mgr/cam_ife_hw_mgr.c
index 1539fe5..e66cd9b 100644
--- a/drivers/media/platform/msm/camera/cam_isp/isp_hw_mgr/cam_ife_hw_mgr.c
+++ b/drivers/media/platform/msm/camera/cam_isp/isp_hw_mgr/cam_ife_hw_mgr.c
@@ -2353,8 +2353,9 @@ static int cam_ife_mgr_config_hw(void *hw_mgr_priv,
}
}
- CAM_DBG(CAM_ISP, "Enter ctx id:%d req_id:%lld num_hw_upd_entries %d",
- ctx->ctx_index, cfg->request_id, cfg->num_hw_update_entries);
+ CAM_DBG(CAM_ISP,
+ "Enter ctx id:%d num_hw_upd_entries %d request id: %llu",
+ ctx->ctx_index, cfg->num_hw_update_entries, cfg->request_id);
if (cfg->num_hw_update_entries > 0) {
cdm_cmd = ctx->cdm_cmd;
@@ -2401,7 +2402,7 @@ static int cam_ife_mgr_config_hw(void *hw_mgr_priv,
} else {
CAM_ERR(CAM_ISP, "No commands to config");
}
- CAM_DBG(CAM_ISP, "Exit");
+ CAM_DBG(CAM_ISP, "Exit: Config Done: %llu", cfg->request_id);
return rc;
}
@@ -2581,23 +2582,6 @@ static int cam_ife_mgr_stop_hw(void *hw_mgr_priv, void *stop_hw_args)
CAM_DBG(CAM_ISP, "Halting CSIDs");
- CAM_DBG(CAM_ISP, "Going to stop IFE Mux");
-
- /* IFE mux in resources */
- list_for_each_entry(hw_mgr_res, &ctx->res_list_ife_src, list) {
- cam_ife_hw_mgr_stop_hw_res(hw_mgr_res);
- }
-
- /* IFE bus rd resources */
- list_for_each_entry(hw_mgr_res, &ctx->res_list_ife_in_rd, list) {
- cam_ife_hw_mgr_stop_hw_res(hw_mgr_res);
- }
-
- CAM_DBG(CAM_ISP, "Going to stop IFE Out");
-
- /* IFE out resources */
- for (i = 0; i < CAM_IFE_HW_OUT_RES_MAX; i++)
- cam_ife_hw_mgr_stop_hw_res(&ctx->res_list_ife_out[i]);
/* get master base index first */
for (i = 0; i < ctx->num_base; i++) {
if (ctx->base[i].split_id == CAM_ISP_HW_SPLIT_LEFT) {
@@ -2606,15 +2590,6 @@ static int cam_ife_mgr_stop_hw(void *hw_mgr_priv, void *stop_hw_args)
}
}
- CAM_DBG(CAM_ISP, "Going to stop IFE Mux");
-
- /* IFE mux in resources */
- list_for_each_entry(hw_mgr_res, &ctx->res_list_ife_src, list) {
- cam_ife_hw_mgr_stop_hw_res(hw_mgr_res);
- }
-
- cam_tasklet_stop(ctx->common.tasklet_info);
-
/*
* If Context does not have PIX resources and has only RDI resource
* then take the first base index.
@@ -2654,6 +2629,26 @@ static int cam_ife_mgr_stop_hw(void *hw_mgr_priv, void *stop_hw_args)
ctx->base[i].idx, csid_halt_type);
}
+ CAM_DBG(CAM_ISP, "Going to stop IFE Out");
+
+ /* IFE out resources */
+ for (i = 0; i < CAM_IFE_HW_OUT_RES_MAX; i++)
+ cam_ife_hw_mgr_stop_hw_res(&ctx->res_list_ife_out[i]);
+
+ /* IFE bus rd resources */
+ list_for_each_entry(hw_mgr_res, &ctx->res_list_ife_in_rd, list) {
+ cam_ife_hw_mgr_stop_hw_res(hw_mgr_res);
+ }
+
+ CAM_DBG(CAM_ISP, "Going to stop IFE Mux");
+
+ /* IFE mux in resources */
+ list_for_each_entry(hw_mgr_res, &ctx->res_list_ife_src, list) {
+ cam_ife_hw_mgr_stop_hw_res(hw_mgr_res);
+ }
+
+ cam_tasklet_stop(ctx->common.tasklet_info);
+
cam_ife_mgr_pause_hw(ctx);
if (stop_isp->stop_only)
@@ -2975,7 +2970,6 @@ static int cam_ife_mgr_start_hw(void *hw_mgr_priv, void *start_hw_args)
deinit_hw:
cam_ife_hw_mgr_deinit_hw(ctx);
- ctx->init_done = false;
tasklet_stop:
cam_tasklet_stop(ctx->common.tasklet_info);
@@ -3629,7 +3623,8 @@ static int cam_ife_mgr_prepare_hw_update(void *hw_mgr_priv,
ctx = (struct cam_ife_hw_mgr_ctx *) prepare->ctxt_to_hw_map;
hw_mgr = (struct cam_ife_hw_mgr *)hw_mgr_priv;
- rc = cam_packet_util_validate_packet(prepare->packet);
+ rc = cam_packet_util_validate_packet(prepare->packet,
+ prepare->remain_len);
if (rc)
return rc;
@@ -3820,7 +3815,8 @@ static void cam_ife_mgr_print_io_bufs(struct cam_packet *packet,
if (!io_cfg[i].mem_handle[j])
break;
- if (GET_FD_FROM_HANDLE(io_cfg[i].mem_handle[j]) ==
+ if (pf_buf_info &&
+ GET_FD_FROM_HANDLE(io_cfg[i].mem_handle[j]) ==
GET_FD_FROM_HANDLE(pf_buf_info)) {
CAM_INFO(CAM_ISP,
"Found PF at port: 0x%x mem 0x%x fd: 0x%x",
diff --git a/drivers/media/platform/msm/camera/cam_isp/isp_hw_mgr/hw_utils/cam_isp_packet_parser.c b/drivers/media/platform/msm/camera/cam_isp/isp_hw_mgr/hw_utils/cam_isp_packet_parser.c
index 0cb1a45..741ffa9 100644
--- a/drivers/media/platform/msm/camera/cam_isp/isp_hw_mgr/hw_utils/cam_isp_packet_parser.c
+++ b/drivers/media/platform/msm/camera/cam_isp/isp_hw_mgr/hw_utils/cam_isp_packet_parser.c
@@ -1,6 +1,6 @@
// SPDX-License-Identifier: GPL-2.0-only
/*
- * Copyright (c) 2017-2018, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2017-2019, The Linux Foundation. All rights reserved.
*/
#include <uapi/media/cam_defs.h>
@@ -98,7 +98,7 @@ static int cam_isp_update_dual_config(
struct cam_isp_hw_dual_isp_update_args dual_isp_update_args;
uint32_t outport_id;
uint32_t ports_plane_idx;
- size_t len = 0;
+ size_t len = 0, remain_len = 0;
uint32_t *cpu_addr;
uint32_t i, j;
@@ -110,9 +110,22 @@ static int cam_isp_update_dual_config(
if (rc)
return rc;
+ if ((len < sizeof(struct cam_isp_dual_config)) ||
+ (cmd_desc->offset >=
+ (len - sizeof(struct cam_isp_dual_config)))) {
+ CAM_ERR(CAM_UTIL, "not enough buffer provided");
+ return -EINVAL;
+ }
+ remain_len = len - cmd_desc->offset;
cpu_addr += (cmd_desc->offset / 4);
dual_config = (struct cam_isp_dual_config *)cpu_addr;
+ if ((dual_config->num_ports *
+ sizeof(struct cam_isp_dual_stripe_config)) >
+ (remain_len - offsetof(struct cam_isp_dual_config, stripes))) {
+ CAM_ERR(CAM_UTIL, "not enough buffer for all the dual configs");
+ return -EINVAL;
+ }
for (i = 0; i < dual_config->num_ports; i++) {
if (i >= CAM_ISP_IFE_OUT_RES_MAX) {
diff --git a/drivers/media/platform/msm/camera/cam_isp/isp_hw_mgr/isp_hw/ife_csid_hw/cam_ife_csid_core.c b/drivers/media/platform/msm/camera/cam_isp/isp_hw_mgr/isp_hw/ife_csid_hw/cam_ife_csid_core.c
index 165cf79..c7f5600 100644
--- a/drivers/media/platform/msm/camera/cam_isp/isp_hw_mgr/isp_hw/ife_csid_hw/cam_ife_csid_core.c
+++ b/drivers/media/platform/msm/camera/cam_isp/isp_hw_mgr/isp_hw/ife_csid_hw/cam_ife_csid_core.c
@@ -1801,6 +1801,7 @@ static int cam_ife_csid_disable_pxl_path(
enum cam_ife_csid_halt_cmd stop_cmd)
{
int rc = 0;
+ uint32_t val = 0;
const struct cam_ife_csid_reg_offset *csid_reg;
struct cam_hw_soc_info *soc_info;
struct cam_ife_csid_path_cfg *path_data;
@@ -1861,6 +1862,17 @@ static int cam_ife_csid_disable_pxl_path(
cam_io_w_mb(0, soc_info->reg_map[0].mem_base +
pxl_reg->csid_pxl_irq_mask_addr);
+ if (path_data->sync_mode == CAM_ISP_HW_SYNC_MASTER ||
+ path_data->sync_mode == CAM_ISP_HW_SYNC_NONE) {
+ /* configure Halt */
+ val = cam_io_r_mb(soc_info->reg_map[0].mem_base +
+ pxl_reg->csid_pxl_ctrl_addr);
+ val &= ~0x3;
+ val |= stop_cmd;
+ cam_io_w_mb(val, soc_info->reg_map[0].mem_base +
+ pxl_reg->csid_pxl_ctrl_addr);
+ }
+
return rc;
}
@@ -2112,7 +2124,7 @@ static int cam_ife_csid_disable_rdi_path(
enum cam_ife_csid_halt_cmd stop_cmd)
{
int rc = 0;
- uint32_t id;
+ uint32_t id, val = 0;
const struct cam_ife_csid_reg_offset *csid_reg;
struct cam_hw_soc_info *soc_info;
@@ -2157,6 +2169,62 @@ static int cam_ife_csid_disable_rdi_path(
cam_io_w_mb(0, soc_info->reg_map[0].mem_base +
csid_reg->rdi_reg[id]->csid_rdi_irq_mask_addr);
+ /* Halt the RDI path */
+ val = cam_io_r_mb(soc_info->reg_map[0].mem_base +
+ csid_reg->rdi_reg[id]->csid_rdi_ctrl_addr);
+ val &= ~0x3;
+ val |= stop_cmd;
+ cam_io_w_mb(val, soc_info->reg_map[0].mem_base +
+ csid_reg->rdi_reg[id]->csid_rdi_ctrl_addr);
+
+ return rc;
+}
+
+static int cam_ife_csid_poll_stop_status(
+ struct cam_ife_csid_hw *csid_hw,
+ uint32_t res_mask)
+{
+ int rc = 0;
+ uint32_t csid_status_addr = 0, val = 0, res_id = 0;
+ const struct cam_ife_csid_reg_offset *csid_reg;
+ struct cam_hw_soc_info *soc_info;
+
+ csid_reg = csid_hw->csid_info->csid_reg;
+ soc_info = &csid_hw->hw_info->soc_info;
+
+ for (; res_id < CAM_IFE_PIX_PATH_RES_MAX; res_id++, res_mask >>= 1) {
+ if ((res_mask & 0x1) == 0)
+ continue;
+ val = 0;
+
+ if (res_id == CAM_IFE_PIX_PATH_RES_IPP) {
+ csid_status_addr =
+ csid_reg->ipp_reg->csid_pxl_status_addr;
+ } else if (res_id == CAM_IFE_PIX_PATH_RES_PPP) {
+ csid_status_addr =
+ csid_reg->ppp_reg->csid_pxl_status_addr;
+ } else {
+ csid_status_addr =
+ csid_reg->rdi_reg[res_id]->csid_rdi_status_addr;
+ }
+
+ CAM_DBG(CAM_ISP, "start polling CSID:%d res_id:%d",
+ csid_hw->hw_intf->hw_idx, res_id);
+
+ rc = readl_poll_timeout(soc_info->reg_map[0].mem_base +
+ csid_status_addr, val, (val & 0x1) == 0x1,
+ CAM_IFE_CSID_TIMEOUT_SLEEP_US,
+ CAM_IFE_CSID_TIMEOUT_ALL_US);
+ if (rc < 0) {
+ CAM_ERR(CAM_ISP, "CSID:%d res:%d halt failed rc %d",
+ csid_hw->hw_intf->hw_idx, res_id, rc);
+ rc = -ETIMEDOUT;
+ break;
+ }
+ CAM_DBG(CAM_ISP, "End polling CSID:%d res_id:%d",
+ csid_hw->hw_intf->hw_idx, res_id);
+ }
+
return rc;
}
@@ -2734,6 +2802,7 @@ static int cam_ife_csid_stop(void *hw_priv,
struct cam_isp_resource_node *res;
struct cam_csid_hw_stop_args *csid_stop;
uint32_t i;
+ uint32_t res_mask = 0;
if (!hw_priv || !stop_args ||
(arg_size != sizeof(struct cam_csid_hw_stop_args))) {
@@ -2765,6 +2834,7 @@ static int cam_ife_csid_stop(void *hw_priv,
rc = cam_ife_csid_tpg_stop(csid_hw, res);
break;
case CAM_ISP_RESOURCE_PIX_PATH:
+ res_mask |= (1 << res->res_id);
if (res->res_id == CAM_IFE_PIX_PATH_RES_IPP ||
res->res_id == CAM_IFE_PIX_PATH_RES_PPP)
rc = cam_ife_csid_disable_pxl_path(csid_hw,
@@ -2782,6 +2852,9 @@ static int cam_ife_csid_stop(void *hw_priv,
}
}
+ if (res_mask)
+ rc = cam_ife_csid_poll_stop_status(csid_hw, res_mask);
+
for (i = 0; i < csid_stop->num_res; i++) {
res = csid_stop->node_res[i];
res->res_state = CAM_ISP_RESOURCE_STATE_INIT_HW;
diff --git a/drivers/media/platform/msm/camera/cam_isp/isp_hw_mgr/isp_hw/vfe_hw/vfe17x/cam_vfe175.h b/drivers/media/platform/msm/camera/cam_isp/isp_hw_mgr/isp_hw/vfe_hw/vfe17x/cam_vfe175.h
index 75e61f1..82ffa44 100644
--- a/drivers/media/platform/msm/camera/cam_isp/isp_hw_mgr/isp_hw/vfe_hw/vfe17x/cam_vfe175.h
+++ b/drivers/media/platform/msm/camera/cam_isp/isp_hw_mgr/isp_hw/vfe_hw/vfe17x/cam_vfe175.h
@@ -1,6 +1,6 @@
/* SPDX-License-Identifier: GPL-2.0-only */
/*
- * Copyright (c) 2018, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2018-2019, The Linux Foundation. All rights reserved.
*/
#ifndef _CAM_VFE175_H_
@@ -289,6 +289,8 @@ static struct cam_vfe_bus_ver2_hw_info vfe175_bus_hw_info = {
.addr_sync_cfg = 0x0000207C,
.addr_sync_frame_hdr = 0x00002080,
.addr_sync_no_sync = 0x00002084,
+ .debug_status_cfg = 0x0000226C,
+ .debug_status_0 = 0x00002270,
},
.num_client = 24,
.bus_client_reg = {
diff --git a/drivers/media/platform/msm/camera/cam_jpeg/jpeg_hw/cam_jpeg_hw_mgr.c b/drivers/media/platform/msm/camera/cam_jpeg/jpeg_hw/cam_jpeg_hw_mgr.c
index ba78b14..113ba1b 100644
--- a/drivers/media/platform/msm/camera/cam_jpeg/jpeg_hw/cam_jpeg_hw_mgr.c
+++ b/drivers/media/platform/msm/camera/cam_jpeg/jpeg_hw/cam_jpeg_hw_mgr.c
@@ -1,6 +1,6 @@
// SPDX-License-Identifier: GPL-2.0-only
/*
- * Copyright (c) 2017-2018, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2017-2019, The Linux Foundation. All rights reserved.
*/
#include <linux/uaccess.h>
@@ -272,6 +272,12 @@ static int cam_jpeg_insert_cdm_change_base(
"unable to get src buf info for cmd buf: %d", rc);
return rc;
}
+
+ if (config_args->hw_update_entries[CAM_JPEG_CHBASE].offset >=
+ ch_base_len) {
+ CAM_ERR(CAM_JPEG, "Not enough buf");
+ return -EINVAL;
+ }
CAM_DBG(CAM_JPEG, "iova %pK len %zu offset %d",
(void *)iova_addr, ch_base_len,
config_args->hw_update_entries[CAM_JPEG_CHBASE].offset);
@@ -719,7 +725,7 @@ static int cam_jpeg_mgr_prepare_hw_update(void *hw_mgr_priv,
return -EINVAL;
}
- rc = cam_packet_util_validate_packet(packet);
+ rc = cam_packet_util_validate_packet(packet, prepare_args->remain_len);
if (rc) {
CAM_ERR(CAM_JPEG, "invalid packet %d", rc);
return rc;
diff --git a/drivers/media/platform/msm/camera/cam_lrme/lrme_hw_mgr/cam_lrme_hw_mgr.c b/drivers/media/platform/msm/camera/cam_lrme/lrme_hw_mgr/cam_lrme_hw_mgr.c
index 0ef7b77..d649ef1 100644
--- a/drivers/media/platform/msm/camera/cam_lrme/lrme_hw_mgr/cam_lrme_hw_mgr.c
+++ b/drivers/media/platform/msm/camera/cam_lrme/lrme_hw_mgr/cam_lrme_hw_mgr.c
@@ -1,6 +1,6 @@
// SPDX-License-Identifier: GPL-2.0-only
/*
- * Copyright (c) 2017-2018, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2017-2019, The Linux Foundation. All rights reserved.
*/
#include <linux/module.h>
@@ -76,7 +76,8 @@ static int cam_lrme_mgr_util_get_device(struct cam_lrme_hw_mgr *hw_mgr,
return 0;
}
-static int cam_lrme_mgr_util_packet_validate(struct cam_packet *packet)
+static int cam_lrme_mgr_util_packet_validate(struct cam_packet *packet,
+ size_t remain_len)
{
struct cam_cmd_buf_desc *cmd_desc = NULL;
int i, rc;
@@ -98,7 +99,7 @@ static int cam_lrme_mgr_util_packet_validate(struct cam_packet *packet)
packet->patch_offset, packet->num_patches,
packet->kmd_cmd_buf_offset, packet->kmd_cmd_buf_index);
- if (cam_packet_util_validate_packet(packet)) {
+ if (cam_packet_util_validate_packet(packet, remain_len)) {
CAM_ERR(CAM_LRME, "invalid packet:%d %d %d %d %d",
packet->kmd_cmd_buf_index,
packet->num_cmd_buf, packet->cmd_buf_offset,
@@ -179,6 +180,12 @@ static int cam_lrme_mgr_util_prepare_io_buffer(int32_t iommu_hdl,
return -ENOMEM;
}
+ if ((size_t)io_cfg[i].offsets[plane] >= size) {
+ CAM_ERR(CAM_LRME, "Invalid plane offset: %zu",
+ (size_t)io_cfg[i].offsets[plane]);
+ return -EINVAL;
+ }
+
io_addr[plane] += io_cfg[i].offsets[plane];
CAM_DBG(CAM_LRME, "IO Address[%d][%d] : %llu",
@@ -834,7 +841,7 @@ static int cam_lrme_mgr_hw_prepare_update(void *hw_mgr_priv,
goto error;
}
- rc = cam_lrme_mgr_util_packet_validate(args->packet);
+ rc = cam_lrme_mgr_util_packet_validate(args->packet, args->remain_len);
if (rc) {
CAM_ERR(CAM_LRME, "Error in packet validation %d", rc);
goto error;
diff --git a/drivers/media/platform/msm/camera/cam_req_mgr/cam_mem_mgr.c b/drivers/media/platform/msm/camera/cam_req_mgr/cam_mem_mgr.c
index 36ceae6..382e364 100644
--- a/drivers/media/platform/msm/camera/cam_req_mgr/cam_mem_mgr.c
+++ b/drivers/media/platform/msm/camera/cam_req_mgr/cam_mem_mgr.c
@@ -1,6 +1,6 @@
// SPDX-License-Identifier: GPL-2.0-only
/*
- * Copyright (c) 2016-2018, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2016-2019, The Linux Foundation. All rights reserved.
*/
#include <linux/module.h>
@@ -18,6 +18,7 @@
#include "cam_debug_util.h"
static struct cam_mem_table tbl;
+static atomic_t cam_mem_mgr_state = ATOMIC_INIT(CAM_MEM_MGR_UNINITIALIZED);
static int cam_mem_util_get_dma_dir(uint32_t flags)
{
@@ -139,6 +140,8 @@ int cam_mem_mgr_init(void)
}
mutex_init(&tbl.m_lock);
+ atomic_set(&cam_mem_mgr_state, CAM_MEM_MGR_INITIALIZED);
+
return 0;
}
@@ -179,6 +182,11 @@ int cam_mem_get_io_buf(int32_t buf_handle, int32_t mmu_handle,
*len_ptr = 0;
+ if (!atomic_read(&cam_mem_mgr_state)) {
+ CAM_ERR(CAM_MEM, "failed. mem_mgr not initialized");
+ return -EINVAL;
+ }
+
idx = CAM_MEM_MGR_GET_HDL_IDX(buf_handle);
if (idx >= CAM_MEM_BUFQ_MAX || idx <= 0)
return -EINVAL;
@@ -224,6 +232,11 @@ int cam_mem_get_cpu_buf(int32_t buf_handle, uintptr_t *vaddr_ptr, size_t *len)
int idx;
struct dma_buf *dmabuf = NULL;
+ if (!atomic_read(&cam_mem_mgr_state)) {
+ CAM_ERR(CAM_MEM, "failed. mem_mgr not initialized");
+ return -EINVAL;
+ }
+
if (!buf_handle || !vaddr_ptr || !len)
return -EINVAL;
@@ -268,6 +281,11 @@ int cam_mem_put_cpu_buf(int32_t buf_handle)
int idx;
struct dma_buf *dmabuf = NULL;
+ if (!atomic_read(&cam_mem_mgr_state)) {
+ CAM_ERR(CAM_MEM, "failed. mem_mgr not initialized");
+ return -EINVAL;
+ }
+
if (!buf_handle)
return -EINVAL;
@@ -309,6 +327,11 @@ int cam_mem_mgr_cache_ops(struct cam_mem_cache_ops_cmd *cmd)
uint32_t cache_dir;
unsigned long dmabuf_flag = 0;
+ if (!atomic_read(&cam_mem_mgr_state)) {
+ CAM_ERR(CAM_MEM, "failed. mem_mgr not initialized");
+ return -EINVAL;
+ }
+
if (!cmd)
return -EINVAL;
@@ -598,6 +621,11 @@ int cam_mem_mgr_alloc_and_map(struct cam_mem_mgr_alloc_cmd *cmd)
uintptr_t kvaddr = 0;
size_t klen;
+ if (!atomic_read(&cam_mem_mgr_state)) {
+ CAM_ERR(CAM_MEM, "failed. mem_mgr not initialized");
+ return -EINVAL;
+ }
+
if (!cmd) {
CAM_ERR(CAM_MEM, " Invalid argument");
return -EINVAL;
@@ -715,6 +743,11 @@ int cam_mem_mgr_map(struct cam_mem_mgr_map_cmd *cmd)
dma_addr_t hw_vaddr = 0;
size_t len = 0;
+ if (!atomic_read(&cam_mem_mgr_state)) {
+ CAM_ERR(CAM_MEM, "failed. mem_mgr not initialized");
+ return -EINVAL;
+ }
+
if (!cmd || (cmd->fd < 0)) {
CAM_ERR(CAM_MEM, "Invalid argument");
return -EINVAL;
@@ -922,6 +955,7 @@ static int cam_mem_mgr_cleanup_table(void)
void cam_mem_mgr_deinit(void)
{
+ atomic_set(&cam_mem_mgr_state, CAM_MEM_MGR_UNINITIALIZED);
cam_mem_mgr_cleanup_table();
mutex_lock(&tbl.m_lock);
bitmap_zero(tbl.bitmap, tbl.bits);
@@ -1018,6 +1052,11 @@ int cam_mem_mgr_release(struct cam_mem_mgr_release_cmd *cmd)
int idx;
int rc;
+ if (!atomic_read(&cam_mem_mgr_state)) {
+ CAM_ERR(CAM_MEM, "failed. mem_mgr not initialized");
+ return -EINVAL;
+ }
+
if (!cmd) {
CAM_ERR(CAM_MEM, "Invalid argument");
return -EINVAL;
@@ -1066,6 +1105,11 @@ int cam_mem_mgr_request_mem(struct cam_mem_mgr_request_desc *inp,
enum cam_smmu_region_id region = CAM_SMMU_REGION_SHARED;
+ if (!atomic_read(&cam_mem_mgr_state)) {
+ CAM_ERR(CAM_MEM, "failed. mem_mgr not initialized");
+ return -EINVAL;
+ }
+
if (!inp || !out) {
CAM_ERR(CAM_MEM, "Invalid params");
return -EINVAL;
@@ -1186,6 +1230,11 @@ int cam_mem_mgr_release_mem(struct cam_mem_mgr_memory_desc *inp)
int32_t idx;
int rc;
+ if (!atomic_read(&cam_mem_mgr_state)) {
+ CAM_ERR(CAM_MEM, "failed. mem_mgr not initialized");
+ return -EINVAL;
+ }
+
if (!inp) {
CAM_ERR(CAM_MEM, "Invalid argument");
return -EINVAL;
@@ -1234,6 +1283,11 @@ int cam_mem_mgr_reserve_memory_region(struct cam_mem_mgr_request_desc *inp,
int32_t smmu_hdl = 0;
int32_t num_hdl = 0;
+ if (!atomic_read(&cam_mem_mgr_state)) {
+ CAM_ERR(CAM_MEM, "failed. mem_mgr not initialized");
+ return -EINVAL;
+ }
+
if (!inp || !out) {
CAM_ERR(CAM_MEM, "Invalid param(s)");
return -EINVAL;
@@ -1323,6 +1377,11 @@ int cam_mem_mgr_free_memory_region(struct cam_mem_mgr_memory_desc *inp)
int rc;
int32_t smmu_hdl;
+ if (!atomic_read(&cam_mem_mgr_state)) {
+ CAM_ERR(CAM_MEM, "failed. mem_mgr not initialized");
+ return -EINVAL;
+ }
+
if (!inp) {
CAM_ERR(CAM_MEM, "Invalid argument");
return -EINVAL;
diff --git a/drivers/media/platform/msm/camera/cam_req_mgr/cam_mem_mgr.h b/drivers/media/platform/msm/camera/cam_req_mgr/cam_mem_mgr.h
index 5767d44..6ce30db 100644
--- a/drivers/media/platform/msm/camera/cam_req_mgr/cam_mem_mgr.h
+++ b/drivers/media/platform/msm/camera/cam_req_mgr/cam_mem_mgr.h
@@ -1,6 +1,6 @@
/* SPDX-License-Identifier: GPL-2.0-only */
/*
- * Copyright (c) 2016-2018, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2016-2019, The Linux Foundation. All rights reserved.
*/
#ifndef _CAM_MEM_MGR_H_
@@ -13,6 +13,12 @@
#define CAM_MEM_BUFQ_MAX 1024
+/* Enum for possible mem mgr states */
+enum cam_mem_mgr_state {
+ CAM_MEM_MGR_UNINITIALIZED,
+ CAM_MEM_MGR_INITIALIZED,
+};
+
/*Enum for possible SMMU operations */
enum cam_smmu_mapping_client {
CAM_SMMU_MAPPING_USER,
diff --git a/drivers/media/platform/msm/camera/cam_req_mgr/cam_req_mgr_core.c b/drivers/media/platform/msm/camera/cam_req_mgr/cam_req_mgr_core.c
index bbceef6..22dd601 100644
--- a/drivers/media/platform/msm/camera/cam_req_mgr/cam_req_mgr_core.c
+++ b/drivers/media/platform/msm/camera/cam_req_mgr/cam_req_mgr_core.c
@@ -1,6 +1,6 @@
// SPDX-License-Identifier: GPL-2.0-only
/*
- * Copyright (c) 2016-2018, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2016-2019, The Linux Foundation. All rights reserved.
*/
#include <linux/module.h>
@@ -39,6 +39,8 @@ void cam_req_mgr_core_link_reset(struct cam_req_mgr_core_link *link)
link->sync_link_sof_skip = false;
link->open_req_cnt = 0;
link->last_flush_id = 0;
+ link->initial_sync_req = -1;
+ link->in_msync_mode = false;
}
void cam_req_mgr_handle_core_shutdown(void)
@@ -634,6 +636,7 @@ static int __cam_req_mgr_check_sync_for_mslave(
struct cam_req_mgr_slot *slot)
{
struct cam_req_mgr_core_link *sync_link = NULL;
+ struct cam_req_mgr_slot *sync_slot = NULL;
int sync_slot_idx = 0, prev_idx, next_idx, rd_idx, rc = 0;
int64_t req_id = 0, sync_req_id = 0;
@@ -646,8 +649,10 @@ static int __cam_req_mgr_check_sync_for_mslave(
req_id = slot->req_id;
CAM_DBG(CAM_CRM,
- "link_hdl %x req %lld frame_skip_flag %d ",
- link->link_hdl, req_id, link->sync_link_sof_skip);
+ "link_hdl %x req %lld frame_skip_flag %d open_req_cnt:%d initial_sync_req [%lld,%lld] is_master:%d",
+ link->link_hdl, req_id, link->sync_link_sof_skip,
+ link->open_req_cnt, link->initial_sync_req,
+ sync_link->initial_sync_req, link->is_master);
if (sync_link->sync_link_sof_skip) {
CAM_DBG(CAM_CRM,
@@ -679,6 +684,7 @@ static int __cam_req_mgr_check_sync_for_mslave(
CAM_DBG(CAM_CRM,
"Req: %lld [master] not ready on link: %x, rc=%d",
req_id, link->link_hdl, rc);
+ link->sync_link_sof_skip = true;
return rc;
}
@@ -689,7 +695,8 @@ static int __cam_req_mgr_check_sync_for_mslave(
rd_idx = sync_link->req.in_q->rd_idx;
sync_req_id = link->req.in_q->slot[prev_idx].req_id;
- if (sync_req_id != -1) {
+ if ((sync_link->initial_sync_req != -1) &&
+ (sync_link->initial_sync_req <= sync_req_id)) {
sync_slot_idx = __cam_req_mgr_find_slot_for_req(
sync_link->req.in_q, sync_req_id);
@@ -697,6 +704,7 @@ static int __cam_req_mgr_check_sync_for_mslave(
CAM_DBG(CAM_CRM,
"Prev Req: %lld [master] not found on link: %x [slave]",
sync_req_id, sync_link->link_hdl);
+ link->sync_link_sof_skip = true;
return -EINVAL;
}
@@ -720,6 +728,7 @@ static int __cam_req_mgr_check_sync_for_mslave(
CAM_DBG(CAM_CRM,
"Req: %lld not ready on [slave] link: %x, rc=%d",
sync_req_id, sync_link->link_hdl, rc);
+ link->sync_link_sof_skip = true;
return rc;
}
}
@@ -727,23 +736,6 @@ static int __cam_req_mgr_check_sync_for_mslave(
if (link->initial_skip)
link->initial_skip = false;
- sync_slot_idx = __cam_req_mgr_find_slot_for_req(
- sync_link->req.in_q, req_id);
- if (sync_slot_idx == -1) {
- CAM_DBG(CAM_CRM,
- "Req: %lld not found on link: %x [master]",
- req_id, sync_link->link_hdl);
- return -EINVAL;
- }
-
- if (sync_link->req.in_q->slot[sync_slot_idx].status !=
- CRM_SLOT_STATUS_REQ_APPLIED) {
- CAM_DBG(CAM_CRM,
- "Req: %lld [master] not applied yet: %x",
- req_id, sync_link->link_hdl);
- return -EAGAIN;
- }
-
rc = __cam_req_mgr_inject_delay(link->req.l_tbl, slot->idx);
if (rc) {
CAM_DBG(CAM_CRM,
@@ -753,6 +745,15 @@ static int __cam_req_mgr_check_sync_for_mslave(
return rc;
}
+ rc = __cam_req_mgr_check_link_is_ready(link, slot->idx, true);
+ if (rc) {
+ CAM_DBG(CAM_CRM,
+ "Req: %lld [slave] not ready on link: %x, rc=%d",
+ req_id, link->link_hdl, rc);
+ link->sync_link_sof_skip = true;
+ return rc;
+ }
+
next_idx = link->req.in_q->rd_idx;
rd_idx = sync_link->req.in_q->rd_idx;
__cam_req_mgr_inc_idx(&next_idx,
@@ -760,34 +761,41 @@ static int __cam_req_mgr_check_sync_for_mslave(
link->req.in_q->num_slots);
sync_req_id = link->req.in_q->slot[next_idx].req_id;
- sync_slot_idx = __cam_req_mgr_find_slot_for_req(
- sync_link->req.in_q, sync_req_id);
- if (sync_slot_idx == -1) {
- CAM_DBG(CAM_CRM,
- "Next Req: %lld [slave] not found on link: %x [master]",
- sync_req_id, sync_link->link_hdl);
- return -EINVAL;
- }
- if ((sync_link->req.in_q->slot[sync_slot_idx].status !=
- CRM_SLOT_STATUS_REQ_APPLIED) &&
- ((sync_slot_idx - rd_idx) >= 1) &&
- (sync_link->req.in_q->slot[rd_idx].status !=
- CRM_SLOT_STATUS_REQ_APPLIED)) {
- CAM_DBG(CAM_CRM,
- "Next Req: %lld [slave] not next on link: %x [master]",
- sync_req_id, sync_link->link_hdl);
- return -EINVAL;
- }
+ if ((sync_link->initial_sync_req != -1) &&
+ (sync_link->initial_sync_req <= sync_req_id)) {
+ sync_slot_idx = __cam_req_mgr_find_slot_for_req(
+ sync_link->req.in_q, sync_req_id);
+ if (sync_slot_idx == -1) {
+ CAM_DBG(CAM_CRM,
+ "Next Req: %lld [slave] not found on link: %x [master]",
+ sync_req_id, sync_link->link_hdl);
+ link->sync_link_sof_skip = true;
+ return -EINVAL;
+ }
- rc = __cam_req_mgr_check_link_is_ready(sync_link,
- sync_slot_idx, true);
- if (rc && (sync_link->req.in_q->slot[sync_slot_idx].status !=
- CRM_SLOT_STATUS_REQ_APPLIED)) {
- CAM_DBG(CAM_CRM,
- "Next Req: %lld [slave] not ready on [master] link: %x, rc=%d",
- sync_req_id, sync_link->link_hdl, rc);
- return rc;
+ if ((sync_link->req.in_q->slot[sync_slot_idx].status !=
+ CRM_SLOT_STATUS_REQ_APPLIED) &&
+ ((sync_slot_idx - rd_idx) >= 1) &&
+ (sync_link->req.in_q->slot[rd_idx].status !=
+ CRM_SLOT_STATUS_REQ_APPLIED)) {
+ CAM_DBG(CAM_CRM,
+ "Next Req: %lld [slave] not next on link: %x [master]",
+ sync_req_id, sync_link->link_hdl);
+ return -EINVAL;
+ }
+
+ sync_slot = &sync_link->req.in_q->slot[sync_slot_idx];
+ rc = __cam_req_mgr_check_link_is_ready(sync_link,
+ sync_slot_idx, true);
+ if (rc && (sync_slot->status !=
+ CRM_SLOT_STATUS_REQ_APPLIED)) {
+ CAM_DBG(CAM_CRM,
+ "Next Req: %lld [slave] not ready on [master] link: %x, rc=%d",
+ sync_req_id, sync_link->link_hdl, rc);
+ link->sync_link_sof_skip = true;
+ return rc;
+ }
}
}
@@ -972,13 +980,31 @@ static int __cam_req_mgr_process_req(struct cam_req_mgr_core_link *link,
if ((slot->sync_mode == CAM_REQ_MGR_SYNC_MODE_SYNC) &&
(link->sync_link)) {
- if (link->is_master || link->sync_link->is_master)
+ if (link->is_master || link->sync_link->is_master) {
+ if (!link->in_msync_mode) {
+ CAM_DBG(CAM_CRM,
+ "Settings master-slave sync mode for link 0x%x",
+ link->link_hdl);
+ link->in_msync_mode = true;
+ }
+
rc = __cam_req_mgr_check_sync_for_mslave(
link, slot);
- else
+ } else {
rc = __cam_req_mgr_check_sync_req_is_ready(
link, slot);
+ }
} else {
+ if (link->in_msync_mode) {
+ CAM_DBG(CAM_CRM,
+ "Settings master-slave non sync mode for link 0x%x",
+ link->link_hdl);
+ link->in_msync_mode = false;
+ link->initial_sync_req = -1;
+ if (link->sync_link)
+ link->sync_link->initial_sync_req = -1;
+ }
+
rc = __cam_req_mgr_inject_delay(link->req.l_tbl,
slot->idx);
if (!rc)
@@ -1703,9 +1729,11 @@ int cam_req_mgr_process_sched_req(void *priv, void *data)
sched_req = (struct cam_req_mgr_sched_request *)&task_data->u;
in_q = link->req.in_q;
- CAM_DBG(CAM_CRM, "link_hdl %x req_id %lld at slot %d sync_mode %d",
+ CAM_DBG(CAM_CRM,
+ "link_hdl %x req_id %lld at slot %d sync_mode %d is_master:%d",
sched_req->link_hdl, sched_req->req_id,
- in_q->wr_idx, sched_req->sync_mode);
+ in_q->wr_idx, sched_req->sync_mode,
+ link->is_master);
mutex_lock(&link->req.lock);
slot = &in_q->slot[in_q->wr_idx];
@@ -1721,6 +1749,14 @@ int cam_req_mgr_process_sched_req(void *priv, void *data)
slot->recover = sched_req->bubble_enable;
link->open_req_cnt++;
__cam_req_mgr_inc_idx(&in_q->wr_idx, 1, in_q->num_slots);
+
+ if (slot->sync_mode == CAM_REQ_MGR_SYNC_MODE_SYNC) {
+ if (link->initial_sync_req == -1)
+ link->initial_sync_req = slot->req_id;
+ } else {
+ link->initial_sync_req = -1;
+ }
+
mutex_unlock(&link->req.lock);
end:
@@ -2528,16 +2564,17 @@ int cam_req_mgr_link(struct cam_req_mgr_link_info *link_info)
return -EINVAL;
}
+ mutex_lock(&g_crm_core_dev->crm_lock);
+
/* session hdl's priv data is cam session struct */
cam_session = (struct cam_req_mgr_core_session *)
cam_get_device_priv(link_info->session_hdl);
if (!cam_session) {
CAM_DBG(CAM_CRM, "NULL pointer");
+ mutex_unlock(&g_crm_core_dev->crm_lock);
return -EINVAL;
}
- mutex_lock(&g_crm_core_dev->crm_lock);
-
/* Allocate link struct and map it with session's request queue */
link = __cam_req_mgr_reserve_link(cam_session);
if (!link) {
@@ -2822,6 +2859,11 @@ int cam_req_mgr_sync_config(
link1->initial_skip = false;
link2->initial_skip = false;
+ link1->in_msync_mode = false;
+ link2->in_msync_mode = false;
+ link1->initial_sync_req = -1;
+ link2->initial_sync_req = -1;
+
if (sync_info->sync_mode == CAM_REQ_MGR_SYNC_MODE_SYNC) {
link1->sync_link = link2;
link2->sync_link = link1;
diff --git a/drivers/media/platform/msm/camera/cam_req_mgr/cam_req_mgr_core.h b/drivers/media/platform/msm/camera/cam_req_mgr/cam_req_mgr_core.h
index e7e3200..8f07b3b 100644
--- a/drivers/media/platform/msm/camera/cam_req_mgr/cam_req_mgr_core.h
+++ b/drivers/media/platform/msm/camera/cam_req_mgr/cam_req_mgr_core.h
@@ -1,6 +1,6 @@
/* SPDX-License-Identifier: GPL-2.0-only */
/*
- * Copyright (c) 2016-2018, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2016-2019, The Linux Foundation. All rights reserved.
*/
#ifndef _CAM_REQ_MGR_CORE_H_
#define _CAM_REQ_MGR_CORE_H_
@@ -307,7 +307,9 @@ struct cam_req_mgr_connected_device {
* is assigned as master
* @initial_skip : Flag to determine if slave has started streaming in
* master-slave sync
- *
+ * @in_msync_mode : Flag to determine if a link is in master-slave mode
+ * @initial_sync_req : The initial req which is required to sync with the
+ * other link
*/
struct cam_req_mgr_core_link {
int32_t link_hdl;
@@ -332,6 +334,8 @@ struct cam_req_mgr_core_link {
atomic_t is_used;
bool is_master;
bool initial_skip;
+ bool in_msync_mode;
+ int64_t initial_sync_req;
};
/**
diff --git a/drivers/media/platform/msm/camera/cam_sensor_module/cam_actuator/cam_actuator_core.c b/drivers/media/platform/msm/camera/cam_sensor_module/cam_actuator/cam_actuator_core.c
index b56af08..bcfb2f5 100644
--- a/drivers/media/platform/msm/camera/cam_sensor_module/cam_actuator/cam_actuator_core.c
+++ b/drivers/media/platform/msm/camera/cam_sensor_module/cam_actuator/cam_actuator_core.c
@@ -1,6 +1,6 @@
// SPDX-License-Identifier: GPL-2.0-only
/*
- * Copyright (c) 2017-2018, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2017-2019, The Linux Foundation. All rights reserved.
*/
#include <linux/module.h>
@@ -10,6 +10,7 @@
#include "cam_trace.h"
#include "cam_res_mgr_api.h"
#include "cam_common_util.h"
+#include "cam_packet_util.h"
int32_t cam_actuator_construct_default_power_setting(
struct cam_sensor_power_ctrl_t *power_info)
@@ -205,12 +206,12 @@ static int32_t cam_actuator_i2c_modes_util(
}
int32_t cam_actuator_slaveInfo_pkt_parser(struct cam_actuator_ctrl_t *a_ctrl,
- uint32_t *cmd_buf)
+ uint32_t *cmd_buf, size_t len)
{
int32_t rc = 0;
struct cam_cmd_i2c_info *i2c_info;
- if (!a_ctrl || !cmd_buf) {
+ if (!a_ctrl || !cmd_buf || (len < sizeof(struct cam_cmd_i2c_info))) {
CAM_ERR(CAM_ACTUATOR, "Invalid Args");
return -EINVAL;
}
@@ -404,6 +405,7 @@ int32_t cam_actuator_i2c_pkt_parse(struct cam_actuator_ctrl_t *a_ctrl,
int32_t i = 0;
uint32_t total_cmd_buf_in_bytes = 0;
size_t len_of_buff = 0;
+ size_t remain_len = 0;
uint32_t *offset = NULL;
uint32_t *cmd_buf = NULL;
uintptr_t generic_ptr;
@@ -441,18 +443,29 @@ int32_t cam_actuator_i2c_pkt_parse(struct cam_actuator_ctrl_t *a_ctrl,
return rc;
}
- if (config.offset > len_of_buff) {
+ remain_len = len_of_buff;
+ if ((sizeof(struct cam_packet) > len_of_buff) ||
+ ((size_t)config.offset >= len_of_buff -
+ sizeof(struct cam_packet))) {
CAM_ERR(CAM_ACTUATOR,
- "offset is out of bounds: offset: %lld len: %zu",
- config.offset, len_of_buff);
+ "Inval cam_packet strut size: %zu, len_of_buff: %zu",
+ sizeof(struct cam_packet), len_of_buff);
rc = -EINVAL;
goto rel_pkt_buf;
}
+ remain_len -= (size_t)config.offset;
csl_packet = (struct cam_packet *)
(generic_pkt_ptr + (uint32_t)config.offset);
- CAM_DBG(CAM_ACTUATOR, "Pkt opcode: %d",
- csl_packet->header.op_code);
+
+ if (cam_packet_util_validate_packet(csl_packet,
+ remain_len)) {
+ CAM_ERR(CAM_ACTUATOR, "Invalid packet params");
+ rc = -EINVAL;
+ goto rel_pkt_buf;
+ }
+
+ CAM_DBG(CAM_ACTUATOR, "Pkt opcode: %d", csl_packet->header.op_code);
if ((csl_packet->header.op_code & 0xFFFFFF) !=
CAM_ACTUATOR_PACKET_OPCODE_INIT &&
@@ -461,7 +474,8 @@ int32_t cam_actuator_i2c_pkt_parse(struct cam_actuator_ctrl_t *a_ctrl,
CAM_DBG(CAM_ACTUATOR,
"reject request %lld, last request to flush %lld",
csl_packet->header.request_id, a_ctrl->last_flush_req);
- return -EINVAL;
+ rc = -EINVAL;
+ goto rel_pkt_buf;
}
if (csl_packet->header.request_id > a_ctrl->last_flush_req)
@@ -489,6 +503,15 @@ int32_t cam_actuator_i2c_pkt_parse(struct cam_actuator_ctrl_t *a_ctrl,
CAM_ERR(CAM_ACTUATOR, "invalid cmd buf");
goto rel_cmd_buf;
}
+ if ((len_of_buff < sizeof(struct common_header)) ||
+ (cmd_desc[i].offset > (len_of_buff -
+ sizeof(struct common_header)))) {
+ CAM_ERR(CAM_ACTUATOR,
+ "Invalid length for sensor cmd");
+ rc = -EINVAL;
+ goto rel_cmd_buf;
+ }
+ remain_len = len_of_buff - cmd_desc[i].offset;
cmd_buf += cmd_desc[i].offset / sizeof(uint32_t);
cmm_hdr = (struct common_header *)cmd_buf;
@@ -497,7 +520,7 @@ int32_t cam_actuator_i2c_pkt_parse(struct cam_actuator_ctrl_t *a_ctrl,
CAM_DBG(CAM_ACTUATOR,
"Received slave info buffer");
rc = cam_actuator_slaveInfo_pkt_parser(
- a_ctrl, cmd_buf);
+ a_ctrl, cmd_buf, remain_len);
if (rc < 0) {
CAM_ERR(CAM_ACTUATOR,
"Failed to parse slave info: %d", rc);
@@ -511,7 +534,7 @@ int32_t cam_actuator_i2c_pkt_parse(struct cam_actuator_ctrl_t *a_ctrl,
rc = cam_sensor_update_power_settings(
cmd_buf,
total_cmd_buf_in_bytes,
- power_info);
+ power_info, remain_len);
if (rc) {
CAM_ERR(CAM_ACTUATOR,
"Failed:parse power settings: %d",
diff --git a/drivers/media/platform/msm/camera/cam_sensor_module/cam_csiphy/cam_csiphy_core.c b/drivers/media/platform/msm/camera/cam_sensor_module/cam_csiphy/cam_csiphy_core.c
index edd8b85..456afa3 100644
--- a/drivers/media/platform/msm/camera/cam_sensor_module/cam_csiphy/cam_csiphy_core.c
+++ b/drivers/media/platform/msm/camera/cam_sensor_module/cam_csiphy/cam_csiphy_core.c
@@ -1,6 +1,6 @@
// SPDX-License-Identifier: GPL-2.0-only
/*
- * Copyright (c) 2017-2018, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2017-2019, The Linux Foundation. All rights reserved.
*/
#include <linux/module.h>
@@ -8,6 +8,8 @@
#include "cam_csiphy_dev.h"
#include "cam_csiphy_soc.h"
#include "cam_common_util.h"
+#include "cam_packet_util.h"
+
#include <soc/qcom/scm.h>
#include <cam_mem_mgr.h>
@@ -157,6 +159,7 @@ int32_t cam_cmd_buf_parser(struct csiphy_device *csiphy_dev,
uint32_t *cmd_buf = NULL;
struct cam_csiphy_info *cam_cmd_csiphy_info = NULL;
size_t len;
+ size_t remain_len;
if (!cfg_dev || !csiphy_dev) {
CAM_ERR(CAM_CSIPHY, "Invalid Args");
@@ -170,17 +173,27 @@ int32_t cam_cmd_buf_parser(struct csiphy_device *csiphy_dev,
return rc;
}
- if (cfg_dev->offset > len) {
+ remain_len = len;
+ if ((sizeof(struct cam_packet) > len) ||
+ ((size_t)cfg_dev->offset >= len - sizeof(struct cam_packet))) {
CAM_ERR(CAM_CSIPHY,
- "offset is out of bounds: offset: %lld len: %zu",
- cfg_dev->offset, len);
+ "Inval cam_packet strut size: %zu, len_of_buff: %zu",
+ sizeof(struct cam_packet), len);
rc = -EINVAL;
goto rel_pkt_buf;
}
+ remain_len -= (size_t)cfg_dev->offset;
csl_packet = (struct cam_packet *)
(generic_pkt_ptr + (uint32_t)cfg_dev->offset);
+ if (cam_packet_util_validate_packet(csl_packet,
+ remain_len)) {
+ CAM_ERR(CAM_CSIPHY, "Invalid packet params");
+ rc = -EINVAL;
+ goto rel_pkt_buf;
+ }
+
cmd_desc = (struct cam_cmd_buf_desc *)
((uint32_t *)&csl_packet->payload +
csl_packet->cmd_buf_offset / 4);
@@ -193,6 +206,14 @@ int32_t cam_cmd_buf_parser(struct csiphy_device *csiphy_dev,
goto rel_pkt_buf;
}
+ if ((len < sizeof(struct cam_csiphy_info)) ||
+ (cmd_desc->offset > (len - sizeof(struct cam_csiphy_info)))) {
+ CAM_ERR(CAM_CSIPHY,
+ "Not enough buffer provided for cam_cisphy_info");
+ rc = -EINVAL;
+ goto rel_pkt_buf;
+ }
+
cmd_buf = (uint32_t *)generic_ptr;
cmd_buf += cmd_desc->offset / 4;
cam_cmd_csiphy_info = (struct cam_csiphy_info *)cmd_buf;
diff --git a/drivers/media/platform/msm/camera/cam_sensor_module/cam_eeprom/cam_eeprom_core.c b/drivers/media/platform/msm/camera/cam_sensor_module/cam_eeprom/cam_eeprom_core.c
index 66de7f6..8f6b6e2 100644
--- a/drivers/media/platform/msm/camera/cam_sensor_module/cam_eeprom/cam_eeprom_core.c
+++ b/drivers/media/platform/msm/camera/cam_sensor_module/cam_eeprom/cam_eeprom_core.c
@@ -11,6 +11,7 @@
#include "cam_eeprom_soc.h"
#include "cam_debug_util.h"
#include "cam_common_util.h"
+#include "cam_packet_util.h"
#define MAX_READ_SIZE 0x7FFFF
@@ -408,7 +409,7 @@ static int32_t cam_eeprom_update_slaveInfo(struct cam_eeprom_ctrl_t *e_ctrl,
static int32_t cam_eeprom_parse_memory_map(
struct cam_eeprom_memory_block_t *data,
void *cmd_buf, int cmd_length, uint32_t *cmd_length_bytes,
- int *num_map)
+ int *num_map, size_t remain_buf_len)
{
int32_t rc = 0;
int32_t cnt = 0;
@@ -422,8 +423,21 @@ static int32_t cam_eeprom_parse_memory_map(
struct cam_cmd_i2c_continuous_rd *i2c_cont_rd = NULL;
struct cam_cmd_conditional_wait *i2c_poll = NULL;
struct cam_cmd_unconditional_wait *i2c_uncond_wait = NULL;
+ size_t validate_size = 0;
generic_op_code = cmm_hdr->fifth_byte;
+
+ if (cmm_hdr->cmd_type == CAMERA_SENSOR_CMD_TYPE_I2C_RNDM_WR)
+ validate_size = sizeof(struct cam_cmd_i2c_random_wr);
+ else if (cmm_hdr->cmd_type == CAMERA_SENSOR_CMD_TYPE_I2C_CONT_RD)
+ validate_size = sizeof(struct cam_cmd_i2c_continuous_rd);
+ else if (cmm_hdr->cmd_type == CAMERA_SENSOR_CMD_TYPE_WAIT)
+ validate_size = sizeof(struct cam_cmd_unconditional_wait);
+
+ if (remain_buf_len < validate_size) {
+ CAM_ERR(CAM_EEPROM, "not enough buffer");
+ return -EINVAL;
+ }
switch (cmm_hdr->cmd_type) {
case CAMERA_SENSOR_CMD_TYPE_I2C_RNDM_WR:
i2c_random_wr = (struct cam_cmd_i2c_random_wr *)cmd_buf;
@@ -883,6 +897,7 @@ static int32_t cam_eeprom_init_pkt_parser(struct cam_eeprom_ctrl_t *e_ctrl,
uint32_t *cmd_buf = NULL;
uintptr_t generic_pkt_addr;
size_t pkt_len = 0;
+ size_t remain_len = 0;
uint32_t total_cmd_buf_in_bytes = 0;
uint32_t processed_cmd_buf_in_bytes = 0;
struct common_header *cmm_hdr = NULL;
@@ -926,13 +941,40 @@ static int32_t cam_eeprom_init_pkt_parser(struct cam_eeprom_ctrl_t *e_ctrl,
rc = -EINVAL;
goto rel_cmd_buf;
}
+
+ if ((pkt_len < sizeof(struct common_header)) ||
+ (cmd_desc[i].offset > (pkt_len -
+ sizeof(struct common_header)))) {
+ CAM_ERR(CAM_EEPROM, "Not enough buffer");
+ rc = -EINVAL;
+ goto rel_cmd_buf;
+ }
+ remain_len = pkt_len - cmd_desc[i].offset;
cmd_buf += cmd_desc[i].offset / sizeof(uint32_t);
+
+ if (total_cmd_buf_in_bytes > remain_len) {
+ CAM_ERR(CAM_EEPROM, "Not enough buffer for command");
+ rc = -EINVAL;
+ goto rel_cmd_buf;
+ }
/* Loop through multiple cmd formats in one cmd buffer */
while (processed_cmd_buf_in_bytes < total_cmd_buf_in_bytes) {
+ if ((remain_len - processed_cmd_buf_in_bytes) <
+ sizeof(struct common_header)) {
+ CAM_ERR(CAM_EEPROM, "Not enough buf");
+ rc = -EINVAL;
+ goto rel_cmd_buf;
+ }
cmm_hdr = (struct common_header *)cmd_buf;
switch (cmm_hdr->cmd_type) {
case CAMERA_SENSOR_CMD_TYPE_I2C_INFO:
i2c_info = (struct cam_cmd_i2c_info *)cmd_buf;
+ if ((remain_len - processed_cmd_buf_in_bytes) <
+ sizeof(struct cam_cmd_i2c_info)) {
+ CAM_ERR(CAM_EEPROM, "Not enough buf");
+ rc = -EINVAL;
+ goto rel_cmd_buf;
+ }
/* Configure the following map slave address */
map[num_map + 1].saddr = i2c_info->slave_addr;
rc = cam_eeprom_update_slaveInfo(e_ctrl,
@@ -948,7 +990,9 @@ static int32_t cam_eeprom_init_pkt_parser(struct cam_eeprom_ctrl_t *e_ctrl,
case CAMERA_SENSOR_CMD_TYPE_PWR_DOWN:
cmd_length_in_bytes = total_cmd_buf_in_bytes;
rc = cam_sensor_update_power_settings(cmd_buf,
- cmd_length_in_bytes, power_info);
+ cmd_length_in_bytes, power_info,
+ (remain_len -
+ processed_cmd_buf_in_bytes));
processed_cmd_buf_in_bytes +=
cmd_length_in_bytes;
cmd_buf += cmd_length_in_bytes/
@@ -965,7 +1009,9 @@ static int32_t cam_eeprom_init_pkt_parser(struct cam_eeprom_ctrl_t *e_ctrl,
rc = cam_eeprom_parse_memory_map(
&e_ctrl->cal_data, cmd_buf,
total_cmd_buf_in_bytes,
- &cmd_length_in_bytes, &num_map);
+ &cmd_length_in_bytes, &num_map,
+ (remain_len -
+ processed_cmd_buf_in_bytes));
processed_cmd_buf_in_bytes +=
cmd_length_in_bytes;
cmd_buf += cmd_length_in_bytes/sizeof(uint32_t);
@@ -1007,6 +1053,7 @@ static int32_t cam_eeprom_get_cal_data(struct cam_eeprom_ctrl_t *e_ctrl,
uintptr_t buf_addr;
size_t buf_size;
uint8_t *read_buffer;
+ size_t remain_len = 0;
io_cfg = (struct cam_buf_io_cfg *) ((uint8_t *)
&csl_packet->payload +
@@ -1025,7 +1072,13 @@ static int32_t cam_eeprom_get_cal_data(struct cam_eeprom_ctrl_t *e_ctrl,
rc);
return rc;
}
+ if (buf_size <= io_cfg->offsets[0]) {
+ CAM_ERR(CAM_EEPROM, "Not enough buffer");
+ rc = -EINVAL;
+ goto rel_cmd_buf;
+ }
+ remain_len = buf_size - io_cfg->offsets[0];
CAM_DBG(CAM_EEPROM, "buf_addr : %pK, buf_size : %zu\n",
(void *)buf_addr, buf_size);
@@ -1038,7 +1091,7 @@ static int32_t cam_eeprom_get_cal_data(struct cam_eeprom_ctrl_t *e_ctrl,
}
read_buffer += io_cfg->offsets[0];
- if (buf_size < e_ctrl->cal_data.num_data) {
+ if (remain_len < e_ctrl->cal_data.num_data) {
CAM_ERR(CAM_EEPROM,
"failed to copy, Invalid size");
rc = -EINVAL;
@@ -1137,6 +1190,7 @@ static int32_t cam_eeprom_pkt_parse(struct cam_eeprom_ctrl_t *e_ctrl, void *arg)
struct cam_config_dev_cmd dev_config;
uintptr_t generic_pkt_addr;
size_t pkt_len;
+ size_t remain_len = 0;
struct cam_packet *csl_packet = NULL;
struct cam_eeprom_soc_private *soc_private =
(struct cam_eeprom_soc_private *)e_ctrl->soc_info.soc_private;
@@ -1156,16 +1210,28 @@ static int32_t cam_eeprom_pkt_parse(struct cam_eeprom_ctrl_t *e_ctrl, void *arg)
return rc;
}
- if (dev_config.offset > pkt_len) {
+ remain_len = pkt_len;
+ if ((sizeof(struct cam_packet) > pkt_len) ||
+ ((size_t)dev_config.offset >= pkt_len -
+ sizeof(struct cam_packet))) {
CAM_ERR(CAM_EEPROM,
- "Offset is out of bound: off: %lld, %zu",
- dev_config.offset, pkt_len);
+ "Inval cam_packet strut size: %zu, len_of_buff: %zu",
+ sizeof(struct cam_packet), pkt_len);
rc = -EINVAL;
goto release_buf;
}
+ remain_len -= (size_t)dev_config.offset;
csl_packet = (struct cam_packet *)
(generic_pkt_addr + (uint32_t)dev_config.offset);
+
+ if (cam_packet_util_validate_packet(csl_packet,
+ remain_len)) {
+ CAM_ERR(CAM_EEPROM, "Invalid packet params");
+ rc = -EINVAL;
+ goto release_buf;
+ }
+
switch (csl_packet->header.op_code & 0xFFFFFF) {
case CAM_EEPROM_PACKET_OPCODE_INIT:
if (e_ctrl->userspace_probe == false) {
diff --git a/drivers/media/platform/msm/camera/cam_sensor_module/cam_flash/cam_flash_core.c b/drivers/media/platform/msm/camera/cam_sensor_module/cam_flash/cam_flash_core.c
index e7156bc..eeea59a 100644
--- a/drivers/media/platform/msm/camera/cam_sensor_module/cam_flash/cam_flash_core.c
+++ b/drivers/media/platform/msm/camera/cam_sensor_module/cam_flash/cam_flash_core.c
@@ -1,6 +1,6 @@
// SPDX-License-Identifier: GPL-2.0-only
/*
- * Copyright (c) 2017-2018, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2017-2019, The Linux Foundation. All rights reserved.
*/
#include <linux/module.h>
@@ -9,6 +9,7 @@
#include "cam_flash_core.h"
#include "cam_res_mgr_api.h"
#include "cam_common_util.h"
+#include "cam_packet_util.h"
static int cam_flash_prepare(struct cam_flash_ctrl *flash_ctrl,
bool regulator_enable)
@@ -616,11 +617,15 @@ static int cam_flash_pmic_delete_req(struct cam_flash_ctrl *fctrl,
}
static int32_t cam_flash_slaveInfo_pkt_parser(struct cam_flash_ctrl *fctrl,
- uint32_t *cmd_buf)
+ uint32_t *cmd_buf, size_t len)
{
int32_t rc = 0;
struct cam_cmd_i2c_info *i2c_info = (struct cam_cmd_i2c_info *)cmd_buf;
+ if (len < sizeof(struct cam_cmd_i2c_info)) {
+ CAM_ERR(CAM_FLASH, "Not enough buffer");
+ return -EINVAL;
+ }
if (fctrl->io_master_info.master_type == CCI_MASTER) {
fctrl->io_master_info.cci_client->cci_i2c_master =
fctrl->cci_i2c_master;
@@ -895,6 +900,7 @@ int cam_flash_i2c_pkt_parser(struct cam_flash_ctrl *fctrl, void *arg)
uint32_t *offset = NULL;
uint32_t frm_offset = 0;
size_t len_of_buffer;
+ size_t remain_len;
struct cam_flash_init *flash_init = NULL;
struct common_header *cmn_hdr = NULL;
struct cam_control *ioctl_ctrl = NULL;
@@ -922,20 +928,29 @@ int cam_flash_i2c_pkt_parser(struct cam_flash_ctrl *fctrl, void *arg)
rc = cam_mem_get_cpu_buf(config.packet_handle,
&generic_ptr, &len_of_buffer);
if (rc) {
- CAM_ERR(CAM_FLASH, "Failed in getting the buffer : %d", rc);
+ CAM_ERR(CAM_FLASH, "Failed in getting the packet : %d", rc);
return rc;
}
-
- if (config.offset > len_of_buffer) {
+ remain_len = len_of_buffer;
+ if ((sizeof(struct cam_packet) > len_of_buffer) ||
+ ((size_t)config.offset >= len_of_buffer -
+ sizeof(struct cam_packet))) {
CAM_ERR(CAM_FLASH,
- "offset is out of bounds: offset: %lld len: %zu",
- config.offset, len_of_buffer);
+ "Inval cam_packet strut size: %zu, len_of_buff: %zu",
+ sizeof(struct cam_packet), len_of_buffer);
return -EINVAL;
}
+ remain_len -= (size_t)config.offset;
/* Add offset to the flash csl header */
csl_packet = (struct cam_packet *)(generic_ptr + config.offset);
+ if (cam_packet_util_validate_packet(csl_packet,
+ remain_len)) {
+ CAM_ERR(CAM_FLASH, "Invalid packet params");
+ return -EINVAL;
+ }
+
if ((csl_packet->header.op_code & 0xFFFFFF) !=
CAM_FLASH_PACKET_OPCODE_INIT &&
csl_packet->header.request_id <= fctrl->last_flush_req
@@ -973,6 +988,15 @@ int cam_flash_i2c_pkt_parser(struct cam_flash_ctrl *fctrl, void *arg)
CAM_ERR(CAM_FLASH, "invalid cmd buf");
return -EINVAL;
}
+
+ if ((len_of_buffer < sizeof(struct common_header)) ||
+ (cmd_desc[i].offset >
+ (len_of_buffer -
+ sizeof(struct common_header)))) {
+ CAM_ERR(CAM_FLASH, "invalid cmd buf length");
+ return -EINVAL;
+ }
+ remain_len = len_of_buffer - cmd_desc[i].offset;
cmd_buf += cmd_desc[i].offset / sizeof(uint32_t);
cmn_hdr = (struct common_header *)cmd_buf;
@@ -983,6 +1007,12 @@ int cam_flash_i2c_pkt_parser(struct cam_flash_ctrl *fctrl, void *arg)
total_cmd_buf_in_bytes);
switch (cmn_hdr->cmd_type) {
case CAMERA_SENSOR_FLASH_CMD_TYPE_INIT_INFO:
+ if (len_of_buffer <
+ sizeof(struct cam_flash_init)) {
+ CAM_ERR(CAM_FLASH, "Not enough buffer");
+ return -EINVAL;
+ }
+
flash_init = (struct cam_flash_init *)cmd_buf;
fctrl->flash_type = flash_init->flash_type;
cmd_length_in_bytes =
@@ -994,7 +1024,7 @@ int cam_flash_i2c_pkt_parser(struct cam_flash_ctrl *fctrl, void *arg)
break;
case CAMERA_SENSOR_CMD_TYPE_I2C_INFO:
rc = cam_flash_slaveInfo_pkt_parser(
- fctrl, cmd_buf);
+ fctrl, cmd_buf, remain_len);
if (rc < 0) {
CAM_ERR(CAM_FLASH,
"Failed parsing slave info: rc: %d",
@@ -1017,7 +1047,7 @@ int cam_flash_i2c_pkt_parser(struct cam_flash_ctrl *fctrl, void *arg)
rc = cam_sensor_update_power_settings(
cmd_buf,
total_cmd_buf_in_bytes,
- &fctrl->power_info);
+ &fctrl->power_info, remain_len);
processed_cmd_buf_in_bytes +=
cmd_length_in_bytes;
cmd_buf += cmd_length_in_bytes/
@@ -1215,6 +1245,7 @@ int cam_flash_pmic_pkt_parser(struct cam_flash_ctrl *fctrl, void *arg)
uint32_t *offset = NULL;
uint32_t frm_offset = 0;
size_t len_of_buffer;
+ size_t remain_len;
struct cam_control *ioctl_ctrl = NULL;
struct cam_packet *csl_packet = NULL;
struct cam_cmd_buf_desc *cmd_desc = NULL;
@@ -1250,21 +1281,31 @@ int cam_flash_pmic_pkt_parser(struct cam_flash_ctrl *fctrl, void *arg)
rc = cam_mem_get_cpu_buf(config.packet_handle,
&generic_ptr, &len_of_buffer);
if (rc) {
- CAM_ERR(CAM_FLASH, "Failed in getting the buffer : %d", rc);
+ CAM_ERR(CAM_FLASH, "Failed in getting the packet: %d", rc);
return rc;
}
- if (config.offset > len_of_buffer) {
+ remain_len = len_of_buffer;
+ if ((sizeof(struct cam_packet) > len_of_buffer) ||
+ ((size_t)config.offset >= len_of_buffer -
+ sizeof(struct cam_packet))) {
CAM_ERR(CAM_FLASH,
- "offset is out of bounds: offset: %lld len: %zu",
- config.offset, len_of_buffer);
+ "Inval cam_packet strut size: %zu, len_of_buff: %zu",
+ sizeof(struct cam_packet), len_of_buffer);
rc = -EINVAL;
goto rel_pkt_buf;
}
+ remain_len -= (size_t)config.offset;
/* Add offset to the flash csl header */
- csl_packet =
- (struct cam_packet *)(generic_ptr + (uint32_t)config.offset);
+ csl_packet = (struct cam_packet *)(generic_ptr + config.offset);
+
+ if (cam_packet_util_validate_packet(csl_packet,
+ remain_len)) {
+ CAM_ERR(CAM_FLASH, "Invalid packet params");
+ rc = -EINVAL;
+ goto rel_pkt_buf;
+ }
if ((csl_packet->header.op_code & 0xFFFFFF) !=
CAM_FLASH_PACKET_OPCODE_INIT &&
@@ -1292,7 +1333,14 @@ int cam_flash_pmic_pkt_parser(struct cam_flash_ctrl *fctrl, void *arg)
CAM_ERR(CAM_FLASH, "Fail in get buffer: %d", rc);
goto rel_pkt_buf;
}
-
+ if ((len_of_buffer < sizeof(struct cam_flash_init)) ||
+ (cmd_desc->offset >
+ (len_of_buffer - sizeof(struct cam_flash_init)))) {
+ CAM_ERR(CAM_FLASH, "Not enough buffer");
+ rc = -EINVAL;
+ goto rel_pkt_buf;
+ }
+ remain_len = len_of_buffer - cmd_desc->offset;
cmd_buf = (uint32_t *)((uint8_t *)cmd_buf_ptr +
cmd_desc->offset);
cam_flash_info = (struct cam_flash_init *)cmd_buf;
@@ -1322,8 +1370,26 @@ int cam_flash_pmic_pkt_parser(struct cam_flash_ctrl *fctrl, void *arg)
case CAMERA_SENSOR_FLASH_CMD_TYPE_INIT_FIRE: {
CAM_DBG(CAM_FLASH, "INIT_FIRE Operation");
+ if (remain_len < sizeof(struct cam_flash_set_on_off)) {
+ CAM_ERR(CAM_FLASH, "Not enough buffer");
+ rc = -EINVAL;
+ goto rel_cmd_buf;
+ }
+
flash_operation_info =
(struct cam_flash_set_on_off *) cmd_buf;
+ if (!flash_operation_info) {
+ CAM_ERR(CAM_FLASH,
+ "flash_operation_info Null");
+ rc = -EINVAL;
+ goto rel_cmd_buf;
+ }
+ if (flash_operation_info->count >
+ CAM_FLASH_MAX_LED_TRIGGERS) {
+ CAM_ERR(CAM_FLASH, "led count out of limit");
+ rc = -EINVAL;
+ goto rel_cmd_buf;
+ }
fctrl->nrt_info.cmn_attr.count =
flash_operation_info->count;
fctrl->nrt_info.cmn_attr.request_id = 0;
@@ -1382,13 +1448,21 @@ int cam_flash_pmic_pkt_parser(struct cam_flash_ctrl *fctrl, void *arg)
goto rel_pkt_buf;
}
+ if ((len_of_buffer < sizeof(struct common_header)) ||
+ (cmd_desc->offset >
+ (len_of_buffer - sizeof(struct common_header)))) {
+ CAM_ERR(CAM_FLASH, "not enough buffer");
+ rc = -EINVAL;
+ goto rel_pkt_buf;
+ }
+ remain_len = len_of_buffer - cmd_desc->offset;
+
cmd_buf = (uint32_t *)((uint8_t *)cmd_buf_ptr +
cmd_desc->offset);
if (!cmd_buf) {
rc = -EINVAL;
goto rel_cmd_buf;
}
-
cmn_hdr = (struct common_header *)cmd_buf;
switch (cmn_hdr->cmd_type) {
@@ -1403,6 +1477,11 @@ int cam_flash_pmic_pkt_parser(struct cam_flash_ctrl *fctrl, void *arg)
flash_data->cmn_attr.is_settings_valid = false;
goto rel_cmd_buf;
}
+ if (remain_len < sizeof(struct cam_flash_set_on_off)) {
+ CAM_ERR(CAM_FLASH, "Not enough buffer");
+ rc = -EINVAL;
+ goto rel_cmd_buf;
+ }
flash_operation_info =
(struct cam_flash_set_on_off *) cmd_buf;
@@ -1412,6 +1491,12 @@ int cam_flash_pmic_pkt_parser(struct cam_flash_ctrl *fctrl, void *arg)
rc = -EINVAL;
goto rel_cmd_buf;
}
+ if (flash_operation_info->count >
+ CAM_FLASH_MAX_LED_TRIGGERS) {
+ CAM_ERR(CAM_FLASH, "led count out of limit");
+ rc = -EINVAL;
+ goto rel_cmd_buf;
+ }
flash_data->opcode = flash_operation_info->opcode;
flash_data->cmn_attr.count =
@@ -1446,6 +1531,15 @@ int cam_flash_pmic_pkt_parser(struct cam_flash_ctrl *fctrl, void *arg)
CAM_ERR(CAM_FLASH, "Fail in get buffer: %d", rc);
goto rel_pkt_buf;
}
+
+ if ((len_of_buffer < sizeof(struct common_header)) ||
+ (cmd_desc->offset >
+ (len_of_buffer - sizeof(struct common_header)))) {
+ CAM_ERR(CAM_FLASH, "Not enough buffer");
+ rc = -EINVAL;
+ goto rel_pkt_buf;
+ }
+ remain_len = len_of_buffer - cmd_desc->offset;
cmd_buf = (uint32_t *)((uint8_t *)cmd_buf_ptr +
cmd_desc->offset);
cmn_hdr = (struct common_header *)cmd_buf;
@@ -1453,8 +1547,26 @@ int cam_flash_pmic_pkt_parser(struct cam_flash_ctrl *fctrl, void *arg)
switch (cmn_hdr->cmd_type) {
case CAMERA_SENSOR_FLASH_CMD_TYPE_WIDGET: {
CAM_DBG(CAM_FLASH, "Widget Flash Operation");
+ if (remain_len < sizeof(struct cam_flash_set_on_off)) {
+ CAM_ERR(CAM_FLASH, "Not enough buffer");
+ rc = -EINVAL;
+ goto rel_pkt_buf;
+ }
flash_operation_info =
(struct cam_flash_set_on_off *) cmd_buf;
+ if (!flash_operation_info) {
+ CAM_ERR(CAM_FLASH,
+ "flash_operation_info Null");
+ rc = -EINVAL;
+ goto rel_cmd_buf;
+ }
+ if (flash_operation_info->count >
+ CAM_FLASH_MAX_LED_TRIGGERS) {
+ CAM_ERR(CAM_FLASH, "led count out of limit");
+ rc = -EINVAL;
+ goto rel_cmd_buf;
+ }
+
fctrl->nrt_info.cmn_attr.count =
flash_operation_info->count;
fctrl->nrt_info.cmn_attr.request_id = 0;
@@ -1476,6 +1588,11 @@ int cam_flash_pmic_pkt_parser(struct cam_flash_ctrl *fctrl, void *arg)
case CAMERA_SENSOR_FLASH_CMD_TYPE_QUERYCURR: {
int query_curr_ma = 0;
+ if (remain_len < sizeof(struct cam_flash_query_curr)) {
+ CAM_ERR(CAM_FLASH, "Not enough buffer");
+ rc = -EINVAL;
+ goto rel_cmd_buf;
+ }
flash_query_info =
(struct cam_flash_query_curr *)cmd_buf;
@@ -1502,7 +1619,25 @@ int cam_flash_pmic_pkt_parser(struct cam_flash_ctrl *fctrl, void *arg)
}
case CAMERA_SENSOR_FLASH_CMD_TYPE_RER: {
rc = 0;
+ if (remain_len < sizeof(struct cam_flash_set_rer)) {
+ CAM_ERR(CAM_FLASH, "Not enough buffer");
+ rc = -EINVAL;
+ goto rel_cmd_buf;
+ }
flash_rer_info = (struct cam_flash_set_rer *)cmd_buf;
+ if (!flash_rer_info) {
+ CAM_ERR(CAM_FLASH,
+ "flash_rer_info Null");
+ rc = -EINVAL;
+ goto rel_cmd_buf;
+ }
+ if (flash_rer_info->count >
+ CAM_FLASH_MAX_LED_TRIGGERS) {
+ CAM_ERR(CAM_FLASH, "led count out of limit");
+ rc = -EINVAL;
+ goto rel_cmd_buf;
+ }
+
fctrl->nrt_info.cmn_attr.cmd_type =
CAMERA_SENSOR_FLASH_CMD_TYPE_RER;
fctrl->nrt_info.opcode = flash_rer_info->opcode;
diff --git a/drivers/media/platform/msm/camera/cam_sensor_module/cam_ois/cam_ois_core.c b/drivers/media/platform/msm/camera/cam_sensor_module/cam_ois/cam_ois_core.c
index 469f761..e7eca3e 100644
--- a/drivers/media/platform/msm/camera/cam_sensor_module/cam_ois/cam_ois_core.c
+++ b/drivers/media/platform/msm/camera/cam_sensor_module/cam_ois/cam_ois_core.c
@@ -1,6 +1,6 @@
// SPDX-License-Identifier: GPL-2.0-only
/*
- * Copyright (c) 2017-2018, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2017-2019, The Linux Foundation. All rights reserved.
*/
#include <linux/module.h>
@@ -12,6 +12,7 @@
#include "cam_debug_util.h"
#include "cam_res_mgr_api.h"
#include "cam_common_util.h"
+#include "cam_packet_util.h"
int32_t cam_ois_construct_default_power_setting(
struct cam_sensor_power_ctrl_t *power_info)
@@ -247,12 +248,12 @@ static int cam_ois_apply_settings(struct cam_ois_ctrl_t *o_ctrl,
}
static int cam_ois_slaveInfo_pkt_parser(struct cam_ois_ctrl_t *o_ctrl,
- uint32_t *cmd_buf)
+ uint32_t *cmd_buf, size_t len)
{
int32_t rc = 0;
struct cam_cmd_ois_info *ois_info;
- if (!o_ctrl || !cmd_buf) {
+ if (!o_ctrl || !cmd_buf || len < sizeof(struct cam_cmd_ois_info)) {
CAM_ERR(CAM_OIS, "Invalid Args");
return -EINVAL;
}
@@ -265,7 +266,8 @@ static int cam_ois_slaveInfo_pkt_parser(struct cam_ois_ctrl_t *o_ctrl,
ois_info->slave_addr >> 1;
o_ctrl->ois_fw_flag = ois_info->ois_fw_flag;
o_ctrl->is_ois_calib = ois_info->is_ois_calib;
- memcpy(o_ctrl->ois_name, ois_info->ois_name, 32);
+ memcpy(o_ctrl->ois_name, ois_info->ois_name, OIS_NAME_LEN);
+ o_ctrl->ois_name[OIS_NAME_LEN - 1] = '\0';
o_ctrl->io_master_info.cci_client->retries = 3;
o_ctrl->io_master_info.cci_client->id_map = 0;
memcpy(&(o_ctrl->opcode), &(ois_info->opcode),
@@ -424,6 +426,7 @@ static int cam_ois_pkt_parse(struct cam_ois_ctrl_t *o_ctrl, void *arg)
struct cam_cmd_buf_desc *cmd_desc = NULL;
uintptr_t generic_pkt_addr;
size_t pkt_len;
+ size_t remain_len = 0;
struct cam_packet *csl_packet = NULL;
size_t len_of_buff = 0;
uint32_t *offset = NULL, *cmd_buf;
@@ -444,16 +447,29 @@ static int cam_ois_pkt_parse(struct cam_ois_ctrl_t *o_ctrl, void *arg)
return rc;
}
- if (dev_config.offset > pkt_len) {
+ remain_len = pkt_len;
+ if ((sizeof(struct cam_packet) > pkt_len) ||
+ ((size_t)dev_config.offset >= pkt_len -
+ sizeof(struct cam_packet))) {
CAM_ERR(CAM_OIS,
- "offset is out of bound: off: %lld len: %zu",
- dev_config.offset, pkt_len);
+ "Inval cam_packet strut size: %zu, len_of_buff: %zu",
+ sizeof(struct cam_packet), pkt_len);
rc = -EINVAL;
goto rel_pkt;
}
+ remain_len -= (size_t)dev_config.offset;
csl_packet = (struct cam_packet *)
(generic_pkt_addr + (uint32_t)dev_config.offset);
+
+ if (cam_packet_util_validate_packet(csl_packet,
+ remain_len)) {
+ CAM_ERR(CAM_OIS, "Invalid packet params");
+ rc = -EINVAL;
+ goto rel_pkt;
+ }
+
+
switch (csl_packet->header.op_code & 0xFFFFFF) {
case CAM_OIS_PACKET_OPCODE_INIT:
offset = (uint32_t *)&csl_packet->payload;
@@ -479,13 +495,23 @@ static int cam_ois_pkt_parse(struct cam_ois_ctrl_t *o_ctrl, void *arg)
rc = -EINVAL;
goto rel_cmd_buf;
}
+
+ if ((len_of_buff < sizeof(struct common_header)) ||
+ (cmd_desc[i].offset > (len_of_buff -
+ sizeof(struct common_header)))) {
+ CAM_ERR(CAM_OIS,
+ "Invalid length for sensor cmd");
+ rc = -EINVAL;
+ goto rel_cmd_buf;
+ }
+ remain_len = len_of_buff - cmd_desc[i].offset;
cmd_buf += cmd_desc[i].offset / sizeof(uint32_t);
cmm_hdr = (struct common_header *)cmd_buf;
switch (cmm_hdr->cmd_type) {
case CAMERA_SENSOR_CMD_TYPE_I2C_INFO:
rc = cam_ois_slaveInfo_pkt_parser(
- o_ctrl, cmd_buf);
+ o_ctrl, cmd_buf, remain_len);
if (rc < 0) {
CAM_ERR(CAM_OIS,
"Failed in parsing slave info");
@@ -499,7 +525,7 @@ static int cam_ois_pkt_parse(struct cam_ois_ctrl_t *o_ctrl, void *arg)
rc = cam_sensor_update_power_settings(
cmd_buf,
total_cmd_buf_in_bytes,
- power_info);
+ power_info, remain_len);
if (rc) {
CAM_ERR(CAM_OIS,
"Failed: parse power settings");
diff --git a/drivers/media/platform/msm/camera/cam_sensor_module/cam_ois/cam_ois_core.h b/drivers/media/platform/msm/camera/cam_sensor_module/cam_ois/cam_ois_core.h
index 49d018b..6331044 100644
--- a/drivers/media/platform/msm/camera/cam_sensor_module/cam_ois/cam_ois_core.h
+++ b/drivers/media/platform/msm/camera/cam_sensor_module/cam_ois/cam_ois_core.h
@@ -1,6 +1,6 @@
/* SPDX-License-Identifier: GPL-2.0-only */
/*
- * Copyright (c) 2017-2018, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2017-2019, The Linux Foundation. All rights reserved.
*/
#ifndef _CAM_OIS_CORE_H_
#define _CAM_OIS_CORE_H_
@@ -9,6 +9,8 @@
#include <linux/dma-contiguous.h>
#include "cam_ois_dev.h"
+#define OIS_NAME_LEN 32
+
/**
* @power_info: power setting info to control the power
*
diff --git a/drivers/media/platform/msm/camera/cam_sensor_module/cam_sensor/cam_sensor_core.c b/drivers/media/platform/msm/camera/cam_sensor_module/cam_sensor/cam_sensor_core.c
index a709f79..60c76c7 100644
--- a/drivers/media/platform/msm/camera/cam_sensor_module/cam_sensor/cam_sensor_core.c
+++ b/drivers/media/platform/msm/camera/cam_sensor_module/cam_sensor/cam_sensor_core.c
@@ -10,6 +10,8 @@
#include "cam_soc_util.h"
#include "cam_trace.h"
#include "cam_common_util.h"
+#include "cam_packet_util.h"
+
static void cam_sensor_update_req_mgr(
struct cam_sensor_ctrl_t *s_ctrl,
@@ -87,6 +89,7 @@ static int32_t cam_sensor_i2c_pkt_parse(struct cam_sensor_ctrl_t *s_ctrl,
struct cam_cmd_buf_desc *cmd_desc = NULL;
struct i2c_settings_array *i2c_reg_settings = NULL;
size_t len_of_buff = 0;
+ size_t remain_len = 0;
uint32_t *offset = NULL;
struct cam_config_dev_cmd config;
struct i2c_data_settings *i2c_data = NULL;
@@ -108,20 +111,33 @@ static int32_t cam_sensor_i2c_pkt_parse(struct cam_sensor_ctrl_t *s_ctrl,
&generic_ptr,
&len_of_buff);
if (rc < 0) {
- CAM_ERR(CAM_SENSOR, "Failed in getting the buffer: %d", rc);
+ CAM_ERR(CAM_SENSOR, "Failed in getting the packet: %d", rc);
return rc;
}
- csl_packet = (struct cam_packet *)(generic_ptr +
- (uint32_t)config.offset);
- if (config.offset > len_of_buff) {
+ remain_len = len_of_buff;
+ if ((sizeof(struct cam_packet) > len_of_buff) ||
+ ((size_t)config.offset >= len_of_buff -
+ sizeof(struct cam_packet))) {
CAM_ERR(CAM_SENSOR,
- "offset is out of bounds: off: %lld len: %zu",
- config.offset, len_of_buff);
+ "Inval cam_packet strut size: %zu, len_of_buff: %zu",
+ sizeof(struct cam_packet), len_of_buff);
rc = -EINVAL;
goto rel_pkt_buf;
}
+ remain_len -= (size_t)config.offset;
+ csl_packet = (struct cam_packet *)(generic_ptr +
+ (uint32_t)config.offset);
+
+ if (cam_packet_util_validate_packet(csl_packet,
+ remain_len)) {
+ CAM_ERR(CAM_SENSOR, "Invalid packet params");
+ rc = -EINVAL;
+ goto rel_pkt_buf;
+
+ }
+
if ((csl_packet->header.op_code & 0xFFFFFF) !=
CAM_SENSOR_PACKET_OPCODE_SENSOR_INITIAL_CONFIG &&
csl_packet->header.request_id <= s_ctrl->last_flush_req
@@ -360,7 +376,7 @@ int32_t cam_sensor_update_slave_info(struct cam_cmd_probe *probe_info,
int32_t cam_handle_cmd_buffers_for_probe(void *cmd_buf,
struct cam_sensor_ctrl_t *s_ctrl,
- int32_t cmd_buf_num, int cmd_buf_length)
+ int32_t cmd_buf_num, uint32_t cmd_buf_length, size_t remain_len)
{
int32_t rc = 0;
@@ -369,6 +385,13 @@ int32_t cam_handle_cmd_buffers_for_probe(void *cmd_buf,
struct cam_cmd_i2c_info *i2c_info = NULL;
struct cam_cmd_probe *probe_info;
+ if (remain_len <
+ (sizeof(struct cam_cmd_i2c_info) +
+ sizeof(struct cam_cmd_probe))) {
+ CAM_ERR(CAM_SENSOR,
+ "not enough buffer for cam_cmd_i2c_info");
+ return -EINVAL;
+ }
i2c_info = (struct cam_cmd_i2c_info *)cmd_buf;
rc = cam_sensor_update_i2c_info(i2c_info, s_ctrl);
if (rc < 0) {
@@ -387,7 +410,8 @@ int32_t cam_handle_cmd_buffers_for_probe(void *cmd_buf,
break;
case 1: {
rc = cam_sensor_update_power_settings(cmd_buf,
- cmd_buf_length, &s_ctrl->sensordata->power_info);
+ cmd_buf_length, &s_ctrl->sensordata->power_info,
+ remain_len);
if (rc < 0) {
CAM_ERR(CAM_SENSOR,
"Failed in updating power settings");
@@ -408,10 +432,11 @@ int32_t cam_handle_mem_ptr(uint64_t handle, struct cam_sensor_ctrl_t *s_ctrl)
uint32_t *cmd_buf;
void *ptr;
size_t len;
- struct cam_packet *pkt;
- struct cam_cmd_buf_desc *cmd_desc;
+ struct cam_packet *pkt = NULL;
+ struct cam_cmd_buf_desc *cmd_desc = NULL;
uintptr_t cmd_buf1 = 0;
uintptr_t packet = 0;
+ size_t remain_len = 0;
rc = cam_mem_get_cpu_buf(handle,
&packet, &len);
@@ -419,7 +444,21 @@ int32_t cam_handle_mem_ptr(uint64_t handle, struct cam_sensor_ctrl_t *s_ctrl)
CAM_ERR(CAM_SENSOR, "Failed to get the command Buffer");
return -EINVAL;
}
+
pkt = (struct cam_packet *)packet;
+ if (pkt == NULL) {
+ CAM_ERR(CAM_SENSOR, "packet pos is invalid");
+ rc = -EINVAL;
+ goto rel_pkt_buf;
+ }
+
+ if ((len < sizeof(struct cam_packet)) ||
+ (pkt->cmd_buf_offset >= (len - sizeof(struct cam_packet)))) {
+ CAM_ERR(CAM_SENSOR, "Not enough buf provided");
+ rc = -EINVAL;
+ goto rel_pkt_buf;
+ }
+
cmd_desc = (struct cam_cmd_buf_desc *)
((uint32_t *)&pkt->payload + pkt->cmd_buf_offset/4);
if (cmd_desc == NULL) {
@@ -444,12 +483,25 @@ int32_t cam_handle_mem_ptr(uint64_t handle, struct cam_sensor_ctrl_t *s_ctrl)
"Failed to parse the command Buffer Header");
goto rel_pkt_buf;
}
+ if (cmd_desc[i].offset >= len) {
+ CAM_ERR(CAM_SENSOR,
+ "offset past length of buffer");
+ rc = -EINVAL;
+ goto rel_pkt_buf;
+ }
+ remain_len = len - cmd_desc[i].offset;
+ if (cmd_desc[i].length > remain_len) {
+ CAM_ERR(CAM_SENSOR,
+ "Not enough buffer provided for cmd");
+ rc = -EINVAL;
+ goto rel_pkt_buf;
+ }
cmd_buf = (uint32_t *)cmd_buf1;
cmd_buf += cmd_desc[i].offset/4;
ptr = (void *) cmd_buf;
rc = cam_handle_cmd_buffers_for_probe(ptr, s_ctrl,
- i, cmd_desc[i].length);
+ i, cmd_desc[i].length, remain_len);
if (rc < 0) {
CAM_ERR(CAM_SENSOR,
"Failed to parse the command Buffer Header");
diff --git a/drivers/media/platform/msm/camera/cam_sensor_module/cam_sensor_utils/cam_sensor_util.c b/drivers/media/platform/msm/camera/cam_sensor_module/cam_sensor_utils/cam_sensor_util.c
index 379bb63..8d2370d 100644
--- a/drivers/media/platform/msm/camera/cam_sensor_module/cam_sensor_utils/cam_sensor_util.c
+++ b/drivers/media/platform/msm/camera/cam_sensor_module/cam_sensor_utils/cam_sensor_util.c
@@ -290,6 +290,8 @@ int cam_sensor_i2c_command_parser(
size_t len_of_buff = 0;
uintptr_t generic_ptr;
uint16_t cmd_length_in_bytes = 0;
+ size_t remain_len = 0;
+ size_t tot_size = 0;
for (i = 0; i < num_cmd_buffers; i++) {
uint32_t *cmd_buf = NULL;
@@ -317,10 +319,29 @@ int cam_sensor_i2c_command_parser(
cmd_desc[i].mem_handle, rc, len_of_buff);
return rc;
}
+
+ remain_len = len_of_buff;
+ if ((len_of_buff < sizeof(struct common_header)) ||
+ (cmd_desc[i].offset >
+ (len_of_buff - sizeof(struct common_header)))) {
+ CAM_ERR(CAM_SENSOR, "buffer provided too small");
+ return -EINVAL;
+ }
cmd_buf = (uint32_t *)generic_ptr;
cmd_buf += cmd_desc[i].offset / sizeof(uint32_t);
+ if (remain_len < cmd_desc[i].length) {
+ CAM_ERR(CAM_SENSOR, "buffer provided too small");
+ return -EINVAL;
+ }
+
while (byte_cnt < cmd_desc[i].length) {
+ if ((remain_len - byte_cnt) <
+ sizeof(struct common_header)) {
+ CAM_ERR(CAM_SENSOR, "Not enough buffer");
+ rc = -EINVAL;
+ goto rel_buf;
+ }
cmm_hdr = (struct common_header *)cmd_buf;
generic_op_code = cmm_hdr->fifth_byte;
switch (cmm_hdr->cmd_type) {
@@ -330,6 +351,24 @@ int cam_sensor_i2c_command_parser(
*cam_cmd_i2c_random_wr =
(struct cam_cmd_i2c_random_wr *)cmd_buf;
+ if ((remain_len - byte_cnt) <
+ sizeof(struct cam_cmd_i2c_random_wr)) {
+ CAM_ERR(CAM_SENSOR,
+ "Not enough buffer provided");
+ rc = -EINVAL;
+ goto rel_buf;
+ }
+ tot_size = sizeof(struct i2c_rdwr_header) +
+ (sizeof(struct i2c_random_wr_payload) *
+ cam_cmd_i2c_random_wr->header.count);
+
+ if (tot_size > (remain_len - byte_cnt)) {
+ CAM_ERR(CAM_SENSOR,
+ "Not enough buffer provided");
+ rc = -EINVAL;
+ goto rel_buf;
+ }
+
rc = cam_sensor_handle_random_write(
cam_cmd_i2c_random_wr,
i2c_reg_settings,
@@ -337,6 +376,7 @@ int cam_sensor_i2c_command_parser(
if (rc < 0) {
CAM_ERR(CAM_SENSOR,
"Failed in random write %d", rc);
+ rc = -EINVAL;
goto rel_buf;
}
@@ -352,6 +392,26 @@ int cam_sensor_i2c_command_parser(
(struct cam_cmd_i2c_continuous_wr *)
cmd_buf;
+ if ((remain_len - byte_cnt) <
+ sizeof(struct cam_cmd_i2c_continuous_wr)) {
+ CAM_ERR(CAM_SENSOR,
+ "Not enough buffer provided");
+ rc = -EINVAL;
+ goto rel_buf;
+ }
+
+ tot_size = sizeof(struct i2c_rdwr_header) +
+ sizeof(cam_cmd_i2c_continuous_wr->reg_addr) +
+ (sizeof(struct cam_cmd_read) *
+ cam_cmd_i2c_continuous_wr->header.count);
+
+ if (tot_size > (remain_len - byte_cnt)) {
+ CAM_ERR(CAM_SENSOR,
+ "Not enough buffer provided");
+ rc = -EINVAL;
+ goto rel_buf;
+ }
+
rc = cam_sensor_handle_continuous_write(
cam_cmd_i2c_continuous_wr,
i2c_reg_settings,
@@ -368,11 +428,17 @@ int cam_sensor_i2c_command_parser(
break;
}
case CAMERA_SENSOR_CMD_TYPE_WAIT: {
+ if ((remain_len - byte_cnt) <
+ sizeof(struct cam_cmd_unconditional_wait)) {
+ CAM_ERR(CAM_SENSOR,
+ "Not enough buffer space");
+ rc = -EINVAL;
+ goto rel_buf;
+ }
if (generic_op_code ==
CAMERA_SENSOR_WAIT_OP_HW_UCND ||
generic_op_code ==
CAMERA_SENSOR_WAIT_OP_SW_UCND) {
-
rc = cam_sensor_handle_delay(
&cmd_buf, generic_op_code,
i2c_reg_settings, j, &byte_cnt,
@@ -405,12 +471,19 @@ int cam_sensor_i2c_command_parser(
break;
}
case CAMERA_SENSOR_CMD_TYPE_I2C_INFO: {
+ if (remain_len - byte_cnt <
+ sizeof(struct cam_cmd_i2c_info)) {
+ CAM_ERR(CAM_SENSOR,
+ "Not enough buffer space");
+ rc = -EINVAL;
+ goto rel_buf;
+ }
rc = cam_sensor_handle_slave_info(
io_master, cmd_buf);
if (rc) {
CAM_ERR(CAM_SENSOR,
- "Handle slave info failed with rc: %d",
- rc);
+ "Handle slave info failed with rc: %d",
+ rc);
goto rel_buf;
}
cmd_length_in_bytes =
@@ -753,8 +826,32 @@ int cam_sensor_util_request_gpio_table(
return rc;
}
+
+static int32_t cam_sensor_validate(void *ptr, size_t remain_buf)
+{
+ struct common_header *cmm_hdr = (struct common_header *)ptr;
+ size_t validate_size = 0;
+
+ if (remain_buf < sizeof(struct common_header))
+ return -EINVAL;
+
+ if (cmm_hdr->cmd_type == CAMERA_SENSOR_CMD_TYPE_PWR_UP ||
+ cmm_hdr->cmd_type == CAMERA_SENSOR_CMD_TYPE_PWR_DOWN)
+ validate_size = sizeof(struct cam_cmd_power);
+ else if (cmm_hdr->cmd_type == CAMERA_SENSOR_CMD_TYPE_WAIT)
+ validate_size = sizeof(struct cam_cmd_unconditional_wait);
+
+ if (remain_buf < validate_size) {
+ CAM_ERR(CAM_SENSOR, "Invalid cmd_buf len %zu min %zu",
+ remain_buf, validate_size);
+ return -EINVAL;
+ }
+ return 0;
+}
+
int32_t cam_sensor_update_power_settings(void *cmd_buf,
- int cmd_length, struct cam_sensor_power_ctrl_t *power_info)
+ uint32_t cmd_length, struct cam_sensor_power_ctrl_t *power_info,
+ size_t cmd_buf_len)
{
int32_t rc = 0, tot_size = 0, last_cmd_type = 0;
int32_t i = 0, pwr_up = 0, pwr_down = 0;
@@ -763,7 +860,8 @@ int32_t cam_sensor_update_power_settings(void *cmd_buf,
struct cam_cmd_power *pwr_cmd = (struct cam_cmd_power *)cmd_buf;
struct common_header *cmm_hdr = (struct common_header *)cmd_buf;
- if (!pwr_cmd || !cmd_length) {
+ if (!pwr_cmd || !cmd_length || cmd_buf_len < (size_t)cmd_length ||
+ cam_sensor_validate(cmd_buf, cmd_buf_len)) {
CAM_ERR(CAM_SENSOR, "Invalid Args: pwr_cmd %pK, cmd_length: %d",
pwr_cmd, cmd_length);
return -EINVAL;
@@ -788,6 +886,10 @@ int32_t cam_sensor_update_power_settings(void *cmd_buf,
}
while (tot_size < cmd_length) {
+ if (cam_sensor_validate(ptr, (cmd_length - tot_size))) {
+ rc = -EINVAL;
+ goto free_power_settings;
+ }
if (cmm_hdr->cmd_type ==
CAMERA_SENSOR_CMD_TYPE_PWR_UP) {
struct cam_cmd_power *pwr_cmd =
diff --git a/drivers/media/platform/msm/camera/cam_sensor_module/cam_sensor_utils/cam_sensor_util.h b/drivers/media/platform/msm/camera/cam_sensor_module/cam_sensor_utils/cam_sensor_util.h
index 3f051a1..524521c 100644
--- a/drivers/media/platform/msm/camera/cam_sensor_module/cam_sensor_utils/cam_sensor_util.h
+++ b/drivers/media/platform/msm/camera/cam_sensor_module/cam_sensor_utils/cam_sensor_util.h
@@ -1,6 +1,6 @@
/* SPDX-License-Identifier: GPL-2.0-only */
/*
- * Copyright (c) 2017-2018, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2017-2019, The Linux Foundation. All rights reserved.
*/
#ifndef _CAM_SENSOR_UTIL_H_
@@ -53,7 +53,8 @@ int msm_camera_fill_vreg_params(struct cam_hw_soc_info *soc_info,
uint16_t power_setting_size);
int32_t cam_sensor_update_power_settings(void *cmd_buf,
- int cmd_length, struct cam_sensor_power_ctrl_t *power_info);
+ uint32_t cmd_length, struct cam_sensor_power_ctrl_t *power_info,
+ size_t cmd_buf_len);
int cam_sensor_bob_pwm_mode_switch(struct cam_hw_soc_info *soc_info,
int bob_reg_idx, bool flag);
diff --git a/drivers/media/platform/msm/camera/cam_utils/cam_packet_util.c b/drivers/media/platform/msm/camera/cam_utils/cam_packet_util.c
index 6e8eb68..643657b 100644
--- a/drivers/media/platform/msm/camera/cam_utils/cam_packet_util.c
+++ b/drivers/media/platform/msm/camera/cam_utils/cam_packet_util.c
@@ -1,6 +1,6 @@
// SPDX-License-Identifier: GPL-2.0-only
/*
- * Copyright (c) 2017-2018, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2017-2019, The Linux Foundation. All rights reserved.
*/
#include <linux/types.h>
@@ -43,23 +43,44 @@ int cam_packet_util_validate_cmd_desc(struct cam_cmd_buf_desc *cmd_desc)
return 0;
}
-int cam_packet_util_validate_packet(struct cam_packet *packet)
+int cam_packet_util_validate_packet(struct cam_packet *packet,
+ size_t remain_len)
{
+ size_t sum_cmd_desc = 0;
+ size_t sum_io_cfgs = 0;
+ size_t sum_patch_desc = 0;
+ size_t pkt_wo_payload = 0;
+
if (!packet)
return -EINVAL;
+ if ((size_t)packet->header.size > remain_len) {
+ CAM_ERR(CAM_UTIL,
+ "Invalid packet size: %zu, CPU buf length: %zu",
+ (size_t)packet->header.size, remain_len);
+ return -EINVAL;
+ }
+
+
CAM_DBG(CAM_UTIL, "num cmd buf:%d num of io config:%d kmd buf index:%d",
packet->num_cmd_buf, packet->num_io_configs,
packet->kmd_cmd_buf_index);
- if ((packet->kmd_cmd_buf_index >= packet->num_cmd_buf) ||
- (!packet->header.size) ||
- (packet->cmd_buf_offset > packet->header.size) ||
- (packet->io_configs_offset > packet->header.size)) {
- CAM_ERR(CAM_UTIL, "invalid packet:%d %d %d %d %d",
- packet->kmd_cmd_buf_index,
- packet->num_cmd_buf, packet->cmd_buf_offset,
- packet->io_configs_offset, packet->header.size);
+ sum_cmd_desc = packet->num_cmd_buf * sizeof(struct cam_cmd_buf_desc);
+ sum_io_cfgs = packet->num_io_configs * sizeof(struct cam_buf_io_cfg);
+ sum_patch_desc = packet->num_patches * sizeof(struct cam_patch_desc);
+ pkt_wo_payload = offsetof(struct cam_packet, payload);
+
+ if ((!packet->header.size) ||
+ ((pkt_wo_payload + (size_t)packet->cmd_buf_offset +
+ sum_cmd_desc) > (size_t)packet->header.size) ||
+ ((pkt_wo_payload + (size_t)packet->io_configs_offset +
+ sum_io_cfgs) > (size_t)packet->header.size) ||
+ ((pkt_wo_payload + (size_t)packet->patch_offset +
+ sum_patch_desc) > (size_t)packet->header.size)) {
+ CAM_ERR(CAM_UTIL, "params not within mem len:%zu %zu %zu %zu",
+ (size_t)packet->header.size, sum_cmd_desc,
+ sum_io_cfgs, sum_patch_desc);
return -EINVAL;
}
@@ -71,6 +92,7 @@ int cam_packet_util_get_kmd_buffer(struct cam_packet *packet,
{
int rc = 0;
size_t len = 0;
+ size_t remain_len = 0;
struct cam_cmd_buf_desc *cmd_desc;
uint32_t *cpu_addr;
@@ -79,6 +101,13 @@ int cam_packet_util_get_kmd_buffer(struct cam_packet *packet,
return -EINVAL;
}
+ if ((packet->kmd_cmd_buf_index < 0) ||
+ (packet->kmd_cmd_buf_index > packet->num_cmd_buf)) {
+ CAM_ERR(CAM_UTIL, "Invalid kmd buf index: %d",
+ packet->kmd_cmd_buf_index);
+ return -EINVAL;
+ }
+
/* Take first command descriptor and add offset to it for kmd*/
cmd_desc = (struct cam_cmd_buf_desc *) ((uint8_t *)
&packet->payload + packet->cmd_buf_offset);
@@ -93,13 +122,23 @@ int cam_packet_util_get_kmd_buffer(struct cam_packet *packet,
if (rc)
return rc;
- if (len < cmd_desc->size) {
+ remain_len = len;
+ if (((size_t)cmd_desc->offset >= len) ||
+ ((size_t)cmd_desc->size >= (len - (size_t)cmd_desc->offset))) {
CAM_ERR(CAM_UTIL, "invalid memory len:%zd and cmd desc size:%d",
len, cmd_desc->size);
rc = -EINVAL;
goto rel_kmd_buf;
}
+ remain_len -= (size_t)cmd_desc->offset;
+ if ((size_t)packet->kmd_cmd_buf_offset >= remain_len) {
+ CAM_ERR(CAM_UTIL, "Invalid kmd cmd buf offset: %zu",
+ (size_t)packet->kmd_cmd_buf_offset);
+ rc = -EINVAL;
+ goto rel_kmd_buf;
+ }
+
cpu_addr += (cmd_desc->offset / 4) + (packet->kmd_cmd_buf_offset / 4);
CAM_DBG(CAM_UTIL, "total size %d, cmd size: %d, KMD buffer size: %d",
cmd_desc->size, cmd_desc->length,
@@ -169,6 +208,20 @@ int cam_packet_util_process_patches(struct cam_packet *packet,
patch_desc[i].dst_buf_hdl, patch_desc[i].dst_offset,
patch_desc[i].src_buf_hdl, patch_desc[i].src_offset);
+ if ((size_t)patch_desc[i].src_offset >= src_buf_size) {
+ CAM_ERR(CAM_UTIL,
+ "Invalid src buf patch offset");
+ return -EINVAL;
+ }
+
+ if ((dst_buf_len < sizeof(void *)) ||
+ ((dst_buf_len - sizeof(void *)) <
+ (size_t)patch_desc[i].dst_offset)) {
+ CAM_ERR(CAM_UTIL,
+ "Invalid dst buf patch offset");
+ return -EINVAL;
+ }
+
dst_cpu_addr = (uint32_t *)((uint8_t *)dst_cpu_addr +
patch_desc[i].dst_offset);
temp += patch_desc[i].src_offset;
@@ -194,6 +247,7 @@ int cam_packet_util_process_generic_cmd_buffer(
int rc;
uintptr_t cpu_addr = 0;
size_t buf_size;
+ size_t remain_len = 0;
uint32_t *blob_ptr;
uint32_t blob_type, blob_size, blob_block_size, len_read;
@@ -216,6 +270,21 @@ int cam_packet_util_process_generic_cmd_buffer(
return rc;
}
+ remain_len = buf_size;
+ if ((buf_size < sizeof(uint32_t)) ||
+ ((size_t)cmd_buf->offset > (buf_size - sizeof(uint32_t)))) {
+ CAM_ERR(CAM_UTIL, "Invalid offset for cmd buf: %zu",
+ (size_t)cmd_buf->offset);
+ goto rel_cmd_buf;
+ }
+ remain_len -= (size_t)cmd_buf->offset;
+
+ if (remain_len < (size_t)cmd_buf->length) {
+ CAM_ERR(CAM_UTIL, "Invalid length for cmd buf: %zu",
+ (size_t)cmd_buf->length);
+ goto rel_cmd_buf;
+ }
+
blob_ptr = (uint32_t *)(((uint8_t *)cpu_addr) +
cmd_buf->offset);
diff --git a/drivers/media/platform/msm/camera/cam_utils/cam_packet_util.h b/drivers/media/platform/msm/camera/cam_utils/cam_packet_util.h
index cef1fb9..f211eb8 100644
--- a/drivers/media/platform/msm/camera/cam_utils/cam_packet_util.h
+++ b/drivers/media/platform/msm/camera/cam_utils/cam_packet_util.h
@@ -1,6 +1,6 @@
/* SPDX-License-Identifier: GPL-2.0-only */
/*
- * Copyright (c) 2017-2018, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2017-2019, The Linux Foundation. All rights reserved.
*/
#ifndef _CAM_PACKET_UTIL_H_
@@ -52,10 +52,13 @@ int cam_packet_util_get_cmd_mem_addr(int handle, uint32_t **buf_addr,
*
* @packet: Packet to be validated
*
+ * @remain_len: CPU buff length after config offset
+ *
* @return: 0 for success
* -EINVAL for Fail
*/
-int cam_packet_util_validate_packet(struct cam_packet *packet);
+int cam_packet_util_validate_packet(struct cam_packet *packet,
+ size_t remain_len);
/**
* cam_packet_util_validate_cmd_desc()
diff --git a/drivers/media/platform/msm/vidc/msm_venc.c b/drivers/media/platform/msm/vidc/msm_venc.c
index 911fd36..c577196 100644
--- a/drivers/media/platform/msm/vidc/msm_venc.c
+++ b/drivers/media/platform/msm/vidc/msm_venc.c
@@ -919,15 +919,15 @@ static struct msm_vidc_ctrl msm_venc_ctrls[] = {
.step = 1,
},
{
- .id = V4L2_CID_MPEG_VIDC_VIDEO_STREAM_FORMAT,
+ .id = V4L2_CID_MPEG_VIDEO_HEVC_SIZE_OF_LENGTH_FIELD,
.name = "NAL Format",
.type = V4L2_CTRL_TYPE_MENU,
- .minimum = V4L2_MPEG_VIDC_VIDEO_NAL_FORMAT_STARTCODES,
- .maximum = V4L2_MPEG_VIDC_VIDEO_NAL_FORMAT_FOUR_BYTE_LENGTH,
- .default_value = V4L2_MPEG_VIDC_VIDEO_NAL_FORMAT_STARTCODES,
+ .minimum = V4L2_MPEG_VIDEO_HEVC_SIZE_0,
+ .maximum = V4L2_MPEG_VIDEO_HEVC_SIZE_4,
+ .default_value = V4L2_MPEG_VIDEO_HEVC_SIZE_0,
.menu_skip_mask = ~(
- (1 << V4L2_MPEG_VIDC_VIDEO_NAL_FORMAT_STARTCODES) |
- (1 << V4L2_MPEG_VIDC_VIDEO_NAL_FORMAT_FOUR_BYTE_LENGTH)
+ (1 << V4L2_MPEG_VIDEO_HEVC_SIZE_0) |
+ (1 << V4L2_MPEG_VIDEO_HEVC_SIZE_4)
),
.qmenu = mpeg_video_stream_format,
},
@@ -1767,7 +1767,7 @@ int msm_venc_s_ctrl(struct msm_vidc_inst *inst, struct v4l2_ctrl *ctrl)
case V4L2_CID_MPEG_VIDC_VIDEO_VPE_CSC_CUSTOM_MATRIX:
case V4L2_CID_MPEG_VIDEO_H264_8X8_TRANSFORM:
case V4L2_CID_MPEG_VIDC_VIDEO_VUI_TIMING_INFO:
- case V4L2_CID_MPEG_VIDC_VIDEO_STREAM_FORMAT:
+ case V4L2_CID_MPEG_VIDEO_HEVC_SIZE_OF_LENGTH_FIELD:
case V4L2_CID_MPEG_VIDEO_H264_VUI_EXT_SAR_WIDTH:
case V4L2_CID_MPEG_VIDEO_H264_VUI_EXT_SAR_HEIGHT:
case V4L2_CID_MPEG_VIDC_VIDEO_BLUR_DIMENSIONS:
@@ -3112,6 +3112,7 @@ int msm_venc_set_vui_timing_info(struct msm_vidc_inst *inst)
return rc;
}
+
int msm_venc_set_nal_stream_format(struct msm_vidc_inst *inst)
{
int rc = 0;
@@ -3129,7 +3130,8 @@ int msm_venc_set_nal_stream_format(struct msm_vidc_inst *inst)
inst->fmts[CAPTURE_PORT].fourcc != V4L2_PIX_FMT_HEVC)
return 0;
- ctrl = msm_venc_get_ctrl(inst, V4L2_CID_MPEG_VIDC_VIDEO_STREAM_FORMAT);
+ ctrl = msm_venc_get_ctrl(inst,
+ V4L2_CID_MPEG_VIDEO_HEVC_SIZE_OF_LENGTH_FIELD);
if (!ctrl) {
dprintk(VIDC_ERR,
"%s: get nal stream format failed\n", __func__);
@@ -3137,11 +3139,11 @@ int msm_venc_set_nal_stream_format(struct msm_vidc_inst *inst)
}
stream_format.nal_stream_format_select = BIT(ctrl->val);
switch (ctrl->val) {
- case V4L2_MPEG_VIDC_VIDEO_NAL_FORMAT_STARTCODES:
+ case V4L2_MPEG_VIDEO_HEVC_SIZE_0:
stream_format.nal_stream_format_select =
HFI_NAL_FORMAT_STARTCODES;
break;
- case V4L2_MPEG_VIDC_VIDEO_NAL_FORMAT_FOUR_BYTE_LENGTH:
+ case V4L2_MPEG_VIDEO_HEVC_SIZE_4:
stream_format.nal_stream_format_select =
HFI_NAL_FORMAT_FOUR_BYTE_LENGTH;
break;
diff --git a/drivers/media/platform/msm/vidc/msm_vidc.c b/drivers/media/platform/msm/vidc/msm_vidc.c
index a9c23a6..af56c94 100644
--- a/drivers/media/platform/msm/vidc/msm_vidc.c
+++ b/drivers/media/platform/msm/vidc/msm_vidc.c
@@ -1617,7 +1617,7 @@ static int try_get_ctrl_for_instance(struct msm_vidc_inst *inst,
dprintk(VIDC_DBG, "g_min: %x : hal_buffer %d min buffers %d\n",
hash32_ptr(inst->session), HAL_BUFFER_INPUT, ctrl->val);
break;
- case V4L2_CID_MPEG_VIDC_VIDEO_STREAM_FORMAT:
+ case V4L2_CID_MPEG_VIDEO_HEVC_SIZE_OF_LENGTH_FIELD:
ctrl->val =
inst->capability.nal_stream_format.nal_stream_format_supported;
break;
diff --git a/include/dt-bindings/phy/qcom,kona-qmp-usb3.h b/include/dt-bindings/phy/qcom,kona-qmp-usb3.h
new file mode 100644
index 0000000..9ae25ec
--- /dev/null
+++ b/include/dt-bindings/phy/qcom,kona-qmp-usb3.h
@@ -0,0 +1,1315 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2019, The Linux Foundation. All rights reserved.
+ */
+
+#ifndef _DT_BINDINGS_PHY_QCOM_KONA_QMP_USB_H
+#define _DT_BINDINGS_PHY_QCOM_KONA_QMP_USB_H
+
+/* USB3-DP Combo PHY register offsets */
+#define USB3_DP_COM_PHY_MODE_CTRL 0x0000
+#define USB3_DP_COM_SW_RESET 0x0004
+#define USB3_DP_COM_POWER_DOWN_CTRL 0x0008
+#define USB3_DP_COM_SWI_CTRL 0x000C
+#define USB3_DP_COM_TYPEC_CTRL 0x0010
+#define USB3_DP_COM_TYPEC_PWRDN_CTRL 0x0014
+#define USB3_DP_COM_DP_BIST_CFG_0 0x0018
+#define USB3_DP_COM_RESET_OVRD_CTRL 0x001C
+#define USB3_DP_COM_DBG_CLK_MUX_CTRL 0x0020
+#define USB3_DP_COM_TYPEC_STATUS 0x0024
+#define USB3_DP_COM_PLACEHOLDER_STATUS 0x0028
+#define USB3_DP_COM_REVISION_ID0 0x002C
+#define USB3_DP_COM_REVISION_ID1 0x0030
+#define USB3_DP_COM_REVISION_ID2 0x0034
+#define USB3_DP_COM_REVISION_ID3 0x0038
+#define USB3_DP_QSERDES_COM_ATB_SEL1 0x1000
+#define USB3_DP_QSERDES_COM_ATB_SEL2 0x1004
+#define USB3_DP_QSERDES_COM_FREQ_UPDATE 0x1008
+#define USB3_DP_QSERDES_COM_BG_TIMER 0x100C
+#define USB3_DP_QSERDES_COM_SSC_EN_CENTER 0x1010
+#define USB3_DP_QSERDES_COM_SSC_ADJ_PER1 0x1014
+#define USB3_DP_QSERDES_COM_SSC_ADJ_PER2 0x1018
+#define USB3_DP_QSERDES_COM_SSC_PER1 0x101C
+#define USB3_DP_QSERDES_COM_SSC_PER2 0x1020
+#define USB3_DP_QSERDES_COM_SSC_STEP_SIZE1_MODE0 0x1024
+#define USB3_DP_QSERDES_COM_SSC_STEP_SIZE2_MODE0 0x1028
+#define USB3_DP_QSERDES_COM_SSC_STEP_SIZE3_MODE0 0x102C
+#define USB3_DP_QSERDES_COM_SSC_STEP_SIZE1_MODE1 0x1030
+#define USB3_DP_QSERDES_COM_SSC_STEP_SIZE2_MODE1 0x1034
+#define USB3_DP_QSERDES_COM_SSC_STEP_SIZE3_MODE1 0x1038
+#define USB3_DP_QSERDES_COM_POST_DIV 0x103C
+#define USB3_DP_QSERDES_COM_POST_DIV_MUX 0x1040
+#define USB3_DP_QSERDES_COM_BIAS_EN_CLKBUFLR_EN 0x1044
+#define USB3_DP_QSERDES_COM_CLK_ENABLE1 0x1048
+#define USB3_DP_QSERDES_COM_SYS_CLK_CTRL 0x104C
+#define USB3_DP_QSERDES_COM_SYSCLK_BUF_ENABLE 0x1050
+#define USB3_DP_QSERDES_COM_PLL_EN 0x1054
+#define USB3_DP_QSERDES_COM_PLL_IVCO 0x1058
+#define USB3_DP_QSERDES_COM_CMN_IETRIM 0x105C
+#define USB3_DP_QSERDES_COM_CMN_IPTRIM 0x1060
+#define USB3_DP_QSERDES_COM_EP_CLOCK_DETECT_CTRL 0x1064
+#define USB3_DP_QSERDES_COM_SYSCLK_DET_COMP_STATUS 0x1068
+#define USB3_DP_QSERDES_COM_CLK_EP_DIV_MODE0 0x106C
+#define USB3_DP_QSERDES_COM_CLK_EP_DIV_MODE1 0x1070
+#define USB3_DP_QSERDES_COM_CP_CTRL_MODE0 0x1074
+#define USB3_DP_QSERDES_COM_CP_CTRL_MODE1 0x1078
+#define USB3_DP_QSERDES_COM_PLL_RCTRL_MODE0 0x107C
+#define USB3_DP_QSERDES_COM_PLL_RCTRL_MODE1 0x1080
+#define USB3_DP_QSERDES_COM_PLL_CCTRL_MODE0 0x1084
+#define USB3_DP_QSERDES_COM_PLL_CCTRL_MODE1 0x1088
+#define USB3_DP_QSERDES_COM_PLL_CNTRL 0x108C
+#define USB3_DP_QSERDES_COM_BIAS_EN_CTRL_BY_PSM 0x1090
+#define USB3_DP_QSERDES_COM_SYSCLK_EN_SEL 0x1094
+#define USB3_DP_QSERDES_COM_CML_SYSCLK_SEL 0x1098
+#define USB3_DP_QSERDES_COM_RESETSM_CNTRL 0x109C
+#define USB3_DP_QSERDES_COM_RESETSM_CNTRL2 0x10A0
+#define USB3_DP_QSERDES_COM_LOCK_CMP_EN 0x10A4
+#define USB3_DP_QSERDES_COM_LOCK_CMP_CFG 0x10A8
+#define USB3_DP_QSERDES_COM_LOCK_CMP1_MODE0 0x10AC
+#define USB3_DP_QSERDES_COM_LOCK_CMP2_MODE0 0x10B0
+#define USB3_DP_QSERDES_COM_LOCK_CMP1_MODE1 0x10B4
+#define USB3_DP_QSERDES_COM_LOCK_CMP2_MODE1 0x10B8
+#define USB3_DP_QSERDES_COM_DEC_START_MODE0 0x10BC
+#define USB3_DP_QSERDES_COM_DEC_START_MSB_MODE0 0x10C0
+#define USB3_DP_QSERDES_COM_DEC_START_MODE1 0x10C4
+#define USB3_DP_QSERDES_COM_DEC_START_MSB_MODE1 0x10C8
+#define USB3_DP_QSERDES_COM_DIV_FRAC_START1_MODE0 0x10CC
+#define USB3_DP_QSERDES_COM_DIV_FRAC_START2_MODE0 0x10D0
+#define USB3_DP_QSERDES_COM_DIV_FRAC_START3_MODE0 0x10D4
+#define USB3_DP_QSERDES_COM_DIV_FRAC_START1_MODE1 0x10D8
+#define USB3_DP_QSERDES_COM_DIV_FRAC_START2_MODE1 0x10DC
+#define USB3_DP_QSERDES_COM_DIV_FRAC_START3_MODE1 0x10E0
+#define USB3_DP_QSERDES_COM_INTEGLOOP_INITVAL 0x10E4
+#define USB3_DP_QSERDES_COM_INTEGLOOP_EN 0x10E8
+#define USB3_DP_QSERDES_COM_INTEGLOOP_GAIN0_MODE0 0x10EC
+#define USB3_DP_QSERDES_COM_INTEGLOOP_GAIN1_MODE0 0x10F0
+#define USB3_DP_QSERDES_COM_INTEGLOOP_GAIN0_MODE1 0x10F4
+#define USB3_DP_QSERDES_COM_INTEGLOOP_GAIN1_MODE1 0x10F8
+#define USB3_DP_QSERDES_COM_INTEGLOOP_P_PATH_GAIN0 0x10FC
+#define USB3_DP_QSERDES_COM_INTEGLOOP_P_PATH_GAIN1 0x1100
+#define USB3_DP_QSERDES_COM_VCOCAL_DEADMAN_CTRL 0x1104
+#define USB3_DP_QSERDES_COM_VCO_TUNE_CTRL 0x1108
+#define USB3_DP_QSERDES_COM_VCO_TUNE_MAP 0x110C
+#define USB3_DP_QSERDES_COM_VCO_TUNE1_MODE0 0x1110
+#define USB3_DP_QSERDES_COM_VCO_TUNE2_MODE0 0x1114
+#define USB3_DP_QSERDES_COM_VCO_TUNE1_MODE1 0x1118
+#define USB3_DP_QSERDES_COM_VCO_TUNE2_MODE1 0x111C
+#define USB3_DP_QSERDES_COM_VCO_TUNE_INITVAL1 0x1120
+#define USB3_DP_QSERDES_COM_VCO_TUNE_INITVAL2 0x1124
+#define USB3_DP_QSERDES_COM_VCO_TUNE_MINVAL1 0x1128
+#define USB3_DP_QSERDES_COM_VCO_TUNE_MINVAL2 0x112C
+#define USB3_DP_QSERDES_COM_VCO_TUNE_MAXVAL1 0x1130
+#define USB3_DP_QSERDES_COM_VCO_TUNE_MAXVAL2 0x1134
+#define USB3_DP_QSERDES_COM_VCO_TUNE_TIMER1 0x1138
+#define USB3_DP_QSERDES_COM_VCO_TUNE_TIMER2 0x113C
+#define USB3_DP_QSERDES_COM_CMN_STATUS 0x1140
+#define USB3_DP_QSERDES_COM_RESET_SM_STATUS 0x1144
+#define USB3_DP_QSERDES_COM_RESTRIM_CODE_STATUS 0x1148
+#define USB3_DP_QSERDES_COM_PLLCAL_CODE1_STATUS 0x114C
+#define USB3_DP_QSERDES_COM_PLLCAL_CODE2_STATUS 0x1150
+#define USB3_DP_QSERDES_COM_CLK_SELECT 0x1154
+#define USB3_DP_QSERDES_COM_HSCLK_SEL 0x1158
+#define USB3_DP_QSERDES_COM_HSCLK_HS_SWITCH_SEL 0x115C
+#define USB3_DP_QSERDES_COM_INTEGLOOP_BINCODE_STATUS 0x1160
+#define USB3_DP_QSERDES_COM_PLL_ANALOG 0x1164
+#define USB3_DP_QSERDES_COM_CORECLK_DIV_MODE0 0x1168
+#define USB3_DP_QSERDES_COM_CORECLK_DIV_MODE1 0x116C
+#define USB3_DP_QSERDES_COM_SW_RESET 0x1170
+#define USB3_DP_QSERDES_COM_CORE_CLK_EN 0x1174
+#define USB3_DP_QSERDES_COM_C_READY_STATUS 0x1178
+#define USB3_DP_QSERDES_COM_CMN_CONFIG 0x117C
+#define USB3_DP_QSERDES_COM_CMN_RATE_OVERRIDE 0x1180
+#define USB3_DP_QSERDES_COM_SVS_MODE_CLK_SEL 0x1184
+#define USB3_DP_QSERDES_COM_DEBUG_BUS0 0x1188
+#define USB3_DP_QSERDES_COM_DEBUG_BUS1 0x118C
+#define USB3_DP_QSERDES_COM_DEBUG_BUS2 0x1190
+#define USB3_DP_QSERDES_COM_DEBUG_BUS3 0x1194
+#define USB3_DP_QSERDES_COM_DEBUG_BUS_SEL 0x1198
+#define USB3_DP_QSERDES_COM_CMN_MISC1 0x119C
+#define USB3_DP_QSERDES_COM_CMN_MISC2 0x11A0
+#define USB3_DP_QSERDES_COM_CMN_MODE 0x11A4
+#define USB3_DP_QSERDES_COM_VCO_DC_LEVEL_CTRL 0x11A8
+#define USB3_DP_QSERDES_COM_BIN_VCOCAL_CMP_CODE1_MODE0 0x11AC
+#define USB3_DP_QSERDES_COM_BIN_VCOCAL_CMP_CODE2_MODE0 0x11B0
+#define USB3_DP_QSERDES_COM_BIN_VCOCAL_CMP_CODE1_MODE1 0x11B4
+#define USB3_DP_QSERDES_COM_BIN_VCOCAL_CMP_CODE2_MODE1 0x11B8
+#define USB3_DP_QSERDES_COM_BIN_VCOCAL_HSCLK_SEL 0x11BC
+#define USB3_DP_QSERDES_TXA_BIST_MODE_LANENO 0x1200
+#define USB3_DP_QSERDES_TXA_BIST_INVERT 0x1204
+#define USB3_DP_QSERDES_TXA_CLKBUF_ENABLE 0x1208
+#define USB3_DP_QSERDES_TXA_TX_EMP_POST1_LVL 0x120C
+#define USB3_DP_QSERDES_TXA_TX_IDLE_LVL_LARGE_AMP 0x1210
+#define USB3_DP_QSERDES_TXA_TX_DRV_LVL 0x1214
+#define USB3_DP_QSERDES_TXA_TX_DRV_LVL_OFFSET 0x1218
+#define USB3_DP_QSERDES_TXA_RESET_TSYNC_EN 0x121C
+#define USB3_DP_QSERDES_TXA_PRE_STALL_LDO_BOOST_EN 0x1220
+#define USB3_DP_QSERDES_TXA_TX_BAND 0x1224
+#define USB3_DP_QSERDES_TXA_SLEW_CNTL 0x1228
+#define USB3_DP_QSERDES_TXA_INTERFACE_SELECT 0x122C
+#define USB3_DP_QSERDES_TXA_LPB_EN 0x1230
+#define USB3_DP_QSERDES_TXA_RES_CODE_LANE_TX 0x1234
+#define USB3_DP_QSERDES_TXA_RES_CODE_LANE_RX 0x1238
+#define USB3_DP_QSERDES_TXA_RES_CODE_LANE_OFFSET_TX 0x123C
+#define USB3_DP_QSERDES_TXA_RES_CODE_LANE_OFFSET_RX 0x1240
+#define USB3_DP_QSERDES_TXA_PERL_LENGTH1 0x1244
+#define USB3_DP_QSERDES_TXA_PERL_LENGTH2 0x1248
+#define USB3_DP_QSERDES_TXA_SERDES_BYP_EN_OUT 0x124C
+#define USB3_DP_QSERDES_TXA_DEBUG_BUS_SEL 0x1250
+#define USB3_DP_QSERDES_TXA_TRANSCEIVER_BIAS_EN 0x1254
+#define USB3_DP_QSERDES_TXA_HIGHZ_DRVR_EN 0x1258
+#define USB3_DP_QSERDES_TXA_TX_POL_INV 0x125C
+#define USB3_DP_QSERDES_TXA_PARRATE_REC_DETECT_IDLE_EN 0x1260
+#define USB3_DP_QSERDES_TXA_BIST_PATTERN1 0x1264
+#define USB3_DP_QSERDES_TXA_BIST_PATTERN2 0x1268
+#define USB3_DP_QSERDES_TXA_BIST_PATTERN3 0x126C
+#define USB3_DP_QSERDES_TXA_BIST_PATTERN4 0x1270
+#define USB3_DP_QSERDES_TXA_BIST_PATTERN5 0x1274
+#define USB3_DP_QSERDES_TXA_BIST_PATTERN6 0x1278
+#define USB3_DP_QSERDES_TXA_BIST_PATTERN7 0x127C
+#define USB3_DP_QSERDES_TXA_BIST_PATTERN8 0x1280
+#define USB3_DP_QSERDES_TXA_LANE_MODE_1 0x1284
+#define USB3_DP_QSERDES_TXA_LANE_MODE_2 0x1288
+#define USB3_DP_QSERDES_TXA_LANE_MODE_3 0x128C
+#define USB3_DP_QSERDES_TXA_ATB_SEL1 0x1290
+#define USB3_DP_QSERDES_TXA_ATB_SEL2 0x1294
+#define USB3_DP_QSERDES_TXA_RCV_DETECT_LVL 0x1298
+#define USB3_DP_QSERDES_TXA_RCV_DETECT_LVL_2 0x129C
+#define USB3_DP_QSERDES_TXA_PRBS_SEED1 0x12A0
+#define USB3_DP_QSERDES_TXA_PRBS_SEED2 0x12A4
+#define USB3_DP_QSERDES_TXA_PRBS_SEED3 0x12A8
+#define USB3_DP_QSERDES_TXA_PRBS_SEED4 0x12AC
+#define USB3_DP_QSERDES_TXA_RESET_GEN 0x12B0
+#define USB3_DP_QSERDES_TXA_RESET_GEN_MUXES 0x12B4
+#define USB3_DP_QSERDES_TXA_TRAN_DRVR_EMP_EN 0x12B8
+#define USB3_DP_QSERDES_TXA_TX_INTERFACE_MODE 0x12BC
+#define USB3_DP_QSERDES_TXA_PWM_CTRL 0x12C0
+#define USB3_DP_QSERDES_TXA_PWM_ENCODED_OR_DATA 0x12C4
+#define USB3_DP_QSERDES_TXA_PWM_GEAR_1_DIVIDER_BAND2 0x12C8
+#define USB3_DP_QSERDES_TXA_PWM_GEAR_2_DIVIDER_BAND2 0x12CC
+#define USB3_DP_QSERDES_TXA_PWM_GEAR_3_DIVIDER_BAND2 0x12D0
+#define USB3_DP_QSERDES_TXA_PWM_GEAR_4_DIVIDER_BAND2 0x12D4
+#define USB3_DP_QSERDES_TXA_PWM_GEAR_1_DIVIDER_BAND0_1 0x12D8
+#define USB3_DP_QSERDES_TXA_PWM_GEAR_2_DIVIDER_BAND0_1 0x12DC
+#define USB3_DP_QSERDES_TXA_PWM_GEAR_3_DIVIDER_BAND0_1 0x12E0
+#define USB3_DP_QSERDES_TXA_PWM_GEAR_4_DIVIDER_BAND0_1 0x12E4
+#define USB3_DP_QSERDES_TXA_VMODE_CTRL1 0x12E8
+#define USB3_DP_QSERDES_TXA_ALOG_OBSV_BUS_CTRL_1 0x12EC
+#define USB3_DP_QSERDES_TXA_BIST_STATUS 0x12F0
+#define USB3_DP_QSERDES_TXA_BIST_ERROR_COUNT1 0x12F4
+#define USB3_DP_QSERDES_TXA_BIST_ERROR_COUNT2 0x12F8
+#define USB3_DP_QSERDES_TXA_ALOG_OBSV_BUS_STATUS_1 0x12FC
+#define USB3_DP_QSERDES_TXA_LANE_DIG_CONFIG 0x1300
+#define USB3_DP_QSERDES_TXA_PI_QEC_CTRL 0x1304
+#define USB3_DP_QSERDES_TXA_PRE_EMPH 0x1308
+#define USB3_DP_QSERDES_TXA_SW_RESET 0x130C
+#define USB3_DP_QSERDES_TXA_DCC_OFFSET 0x1310
+#define USB3_DP_QSERDES_TXA_DIG_BKUP_CTRL 0x1314
+#define USB3_DP_QSERDES_TXA_DEBUG_BUS0 0x1318
+#define USB3_DP_QSERDES_TXA_DEBUG_BUS1 0x131C
+#define USB3_DP_QSERDES_TXA_DEBUG_BUS2 0x1320
+#define USB3_DP_QSERDES_TXA_DEBUG_BUS3 0x1324
+#define USB3_DP_QSERDES_TXA_READ_EQCODE 0x1328
+#define USB3_DP_QSERDES_TXA_READ_OFFSETCODE 0x132C
+#define USB3_DP_QSERDES_TXA_IA_ERROR_COUNTER_LOW 0x1330
+#define USB3_DP_QSERDES_TXA_IA_ERROR_COUNTER_HIGH 0x1334
+#define USB3_DP_QSERDES_TXA_VGA_READ_CODE 0x1338
+#define USB3_DP_QSERDES_TXA_VTH_READ_CODE 0x133C
+#define USB3_DP_QSERDES_TXA_DFE_TAP1_READ_CODE 0x1340
+#define USB3_DP_QSERDES_TXA_DFE_TAP2_READ_CODE 0x1344
+#define USB3_DP_QSERDES_TXA_IDAC_STATUS_I 0x1348
+#define USB3_DP_QSERDES_TXA_IDAC_STATUS_IBAR 0x134C
+#define USB3_DP_QSERDES_TXA_IDAC_STATUS_Q 0x1350
+#define USB3_DP_QSERDES_TXA_IDAC_STATUS_QBAR 0x1354
+#define USB3_DP_QSERDES_TXA_IDAC_STATUS_A 0x1358
+#define USB3_DP_QSERDES_TXA_IDAC_STATUS_ABAR 0x135C
+#define USB3_DP_QSERDES_TXA_IDAC_STATUS_SM_ON 0x1360
+#define USB3_DP_QSERDES_TXA_IDAC_STATUS_CAL_DONE 0x1364
+#define USB3_DP_QSERDES_TXA_IDAC_STATUS_SIGNERROR 0x1368
+#define USB3_DP_QSERDES_TXA_DCC_CAL_STATUS 0x136C
+#define USB3_DP_QSERDES_RXA_UCDR_FO_GAIN_HALF 0x1400
+#define USB3_DP_QSERDES_RXA_UCDR_FO_GAIN_QUARTER 0x1404
+#define USB3_DP_QSERDES_RXA_UCDR_FO_GAIN 0x1408
+#define USB3_DP_QSERDES_RXA_UCDR_SO_GAIN_HALF 0x140C
+#define USB3_DP_QSERDES_RXA_UCDR_SO_GAIN_QUARTER 0x1410
+#define USB3_DP_QSERDES_RXA_UCDR_SO_GAIN 0x1414
+#define USB3_DP_QSERDES_RXA_UCDR_SVS_FO_GAIN_HALF 0x1418
+#define USB3_DP_QSERDES_RXA_UCDR_SVS_FO_GAIN_QUARTER 0x141C
+#define USB3_DP_QSERDES_RXA_UCDR_SVS_FO_GAIN 0x1420
+#define USB3_DP_QSERDES_RXA_UCDR_SVS_SO_GAIN_HALF 0x1424
+#define USB3_DP_QSERDES_RXA_UCDR_SVS_SO_GAIN_QUARTER 0x1428
+#define USB3_DP_QSERDES_RXA_UCDR_SVS_SO_GAIN 0x142C
+#define USB3_DP_QSERDES_RXA_UCDR_FASTLOCK_FO_GAIN 0x1430
+#define USB3_DP_QSERDES_RXA_UCDR_SO_SATURATION_AND_ENABLE 0x1434
+#define USB3_DP_QSERDES_RXA_UCDR_FO_TO_SO_DELAY 0x1438
+#define USB3_DP_QSERDES_RXA_UCDR_FASTLOCK_COUNT_LOW 0x143C
+#define USB3_DP_QSERDES_RXA_UCDR_FASTLOCK_COUNT_HIGH 0x1440
+#define USB3_DP_QSERDES_RXA_UCDR_PI_CONTROLS 0x1444
+#define USB3_DP_QSERDES_RXA_UCDR_PI_CTRL2 0x1448
+#define USB3_DP_QSERDES_RXA_UCDR_SB2_THRESH1 0x144C
+#define USB3_DP_QSERDES_RXA_UCDR_SB2_THRESH2 0x1450
+#define USB3_DP_QSERDES_RXA_UCDR_SB2_GAIN1 0x1454
+#define USB3_DP_QSERDES_RXA_UCDR_SB2_GAIN2 0x1458
+#define USB3_DP_QSERDES_RXA_AUX_CONTROL 0x145C
+#define USB3_DP_QSERDES_RXA_AUX_DATA_TCOARSE_TFINE 0x1460
+#define USB3_DP_QSERDES_RXA_RCLK_AUXDATA_SEL 0x1464
+#define USB3_DP_QSERDES_RXA_AC_JTAG_ENABLE 0x1468
+#define USB3_DP_QSERDES_RXA_AC_JTAG_INITP 0x146C
+#define USB3_DP_QSERDES_RXA_AC_JTAG_INITN 0x1470
+#define USB3_DP_QSERDES_RXA_AC_JTAG_LVL 0x1474
+#define USB3_DP_QSERDES_RXA_AC_JTAG_MODE 0x1478
+#define USB3_DP_QSERDES_RXA_AC_JTAG_RESET 0x147C
+#define USB3_DP_QSERDES_RXA_RX_TERM_BW 0x1480
+#define USB3_DP_QSERDES_RXA_RX_RCVR_IQ_EN 0x1484
+#define USB3_DP_QSERDES_RXA_RX_IDAC_I_DC_OFFSETS 0x1488
+#define USB3_DP_QSERDES_RXA_RX_IDAC_IBAR_DC_OFFSETS 0x148C
+#define USB3_DP_QSERDES_RXA_RX_IDAC_Q_DC_OFFSETS 0x1490
+#define USB3_DP_QSERDES_RXA_RX_IDAC_QBAR_DC_OFFSETS 0x1494
+#define USB3_DP_QSERDES_RXA_RX_IDAC_A_DC_OFFSETS 0x1498
+#define USB3_DP_QSERDES_RXA_RX_IDAC_ABAR_DC_OFFSETS 0x149C
+#define USB3_DP_QSERDES_RXA_RX_IDAC_EN 0x14A0
+#define USB3_DP_QSERDES_RXA_RX_IDAC_ENABLES 0x14A4
+#define USB3_DP_QSERDES_RXA_RX_IDAC_SIGN 0x14A8
+#define USB3_DP_QSERDES_RXA_RX_HIGHZ_HIGHRATE 0x14AC
+#define USB3_DP_QSERDES_RXA_RX_TERM_AC_BYPASS_DC_COUPLE_OFFSET 0x14B0
+#define USB3_DP_QSERDES_RXA_DFE_1 0x14B4
+#define USB3_DP_QSERDES_RXA_DFE_2 0x14B8
+#define USB3_DP_QSERDES_RXA_DFE_3 0x14BC
+#define USB3_DP_QSERDES_RXA_DFE_4 0x14C0
+#define USB3_DP_QSERDES_RXA_TX_ADAPT_PRE_THRESH1 0x14C4
+#define USB3_DP_QSERDES_RXA_TX_ADAPT_PRE_THRESH2 0x14C8
+#define USB3_DP_QSERDES_RXA_TX_ADAPT_POST_THRESH 0x14CC
+#define USB3_DP_QSERDES_RXA_TX_ADAPT_MAIN_THRESH 0x14D0
+#define USB3_DP_QSERDES_RXA_VGA_CAL_CNTRL1 0x14D4
+#define USB3_DP_QSERDES_RXA_VGA_CAL_CNTRL2 0x14D8
+#define USB3_DP_QSERDES_RXA_GM_CAL 0x14DC
+#define USB3_DP_QSERDES_RXA_RX_VGA_GAIN2_LSB 0x14E0
+#define USB3_DP_QSERDES_RXA_RX_VGA_GAIN2_MSB 0x14E4
+#define USB3_DP_QSERDES_RXA_RX_EQU_ADAPTOR_CNTRL1 0x14E8
+#define USB3_DP_QSERDES_RXA_RX_EQU_ADAPTOR_CNTRL2 0x14EC
+#define USB3_DP_QSERDES_RXA_RX_EQU_ADAPTOR_CNTRL3 0x14F0
+#define USB3_DP_QSERDES_RXA_RX_EQU_ADAPTOR_CNTRL4 0x14F4
+#define USB3_DP_QSERDES_RXA_RX_IDAC_TSETTLE_LOW 0x14F8
+#define USB3_DP_QSERDES_RXA_RX_IDAC_TSETTLE_HIGH 0x14FC
+#define USB3_DP_QSERDES_RXA_RX_IDAC_MEASURE_TIME 0x1500
+#define USB3_DP_QSERDES_RXA_RX_IDAC_ACCUMULATOR 0x1504
+#define USB3_DP_QSERDES_RXA_RX_EQ_OFFSET_LSB 0x1508
+#define USB3_DP_QSERDES_RXA_RX_EQ_OFFSET_MSB 0x150C
+#define USB3_DP_QSERDES_RXA_RX_EQ_OFFSET_ADAPTOR_CNTRL1 0x1510
+#define USB3_DP_QSERDES_RXA_RX_OFFSET_ADAPTOR_CNTRL2 0x1514
+#define USB3_DP_QSERDES_RXA_SIGDET_ENABLES 0x1518
+#define USB3_DP_QSERDES_RXA_SIGDET_CNTRL 0x151C
+#define USB3_DP_QSERDES_RXA_SIGDET_LVL 0x1520
+#define USB3_DP_QSERDES_RXA_SIGDET_DEGLITCH_CNTRL 0x1524
+#define USB3_DP_QSERDES_RXA_RX_BAND 0x1528
+#define USB3_DP_QSERDES_RXA_CDR_FREEZE_UP_DN 0x152C
+#define USB3_DP_QSERDES_RXA_CDR_RESET_OVERRIDE 0x1530
+#define USB3_DP_QSERDES_RXA_RX_INTERFACE_MODE 0x1534
+#define USB3_DP_QSERDES_RXA_JITTER_GEN_MODE 0x1538
+#define USB3_DP_QSERDES_RXA_SJ_AMP1 0x153C
+#define USB3_DP_QSERDES_RXA_SJ_AMP2 0x1540
+#define USB3_DP_QSERDES_RXA_SJ_PER1 0x1544
+#define USB3_DP_QSERDES_RXA_SJ_PER2 0x1548
+#define USB3_DP_QSERDES_RXA_PPM_OFFSET1 0x154C
+#define USB3_DP_QSERDES_RXA_PPM_OFFSET2 0x1550
+#define USB3_DP_QSERDES_RXA_SIGN_PPM_PERIOD1 0x1554
+#define USB3_DP_QSERDES_RXA_SIGN_PPM_PERIOD2 0x1558
+#define USB3_DP_QSERDES_RXA_RX_PWM_ENABLE_AND_DATA 0x155C
+#define USB3_DP_QSERDES_RXA_RX_PWM_GEAR1_TIMEOUT_COUNT 0x1560
+#define USB3_DP_QSERDES_RXA_RX_PWM_GEAR2_TIMEOUT_COUNT 0x1564
+#define USB3_DP_QSERDES_RXA_RX_PWM_GEAR3_TIMEOUT_COUNT 0x1568
+#define USB3_DP_QSERDES_RXA_RX_PWM_GEAR4_TIMEOUT_COUNT 0x156C
+#define USB3_DP_QSERDES_RXA_RX_MODE_00_LOW 0x1570
+#define USB3_DP_QSERDES_RXA_RX_MODE_00_HIGH 0x1574
+#define USB3_DP_QSERDES_RXA_RX_MODE_00_HIGH2 0x1578
+#define USB3_DP_QSERDES_RXA_RX_MODE_00_HIGH3 0x157C
+#define USB3_DP_QSERDES_RXA_RX_MODE_00_HIGH4 0x1580
+#define USB3_DP_QSERDES_RXA_RX_MODE_01_LOW 0x1584
+#define USB3_DP_QSERDES_RXA_RX_MODE_01_HIGH 0x1588
+#define USB3_DP_QSERDES_RXA_RX_MODE_01_HIGH2 0x158C
+#define USB3_DP_QSERDES_RXA_RX_MODE_01_HIGH3 0x1590
+#define USB3_DP_QSERDES_RXA_RX_MODE_01_HIGH4 0x1594
+#define USB3_DP_QSERDES_RXA_RX_MODE_10_LOW 0x1598
+#define USB3_DP_QSERDES_RXA_RX_MODE_10_HIGH 0x159C
+#define USB3_DP_QSERDES_RXA_RX_MODE_10_HIGH2 0x15A0
+#define USB3_DP_QSERDES_RXA_RX_MODE_10_HIGH3 0x15A4
+#define USB3_DP_QSERDES_RXA_RX_MODE_10_HIGH4 0x15A8
+#define USB3_DP_QSERDES_RXA_PHPRE_CTRL 0x15AC
+#define USB3_DP_QSERDES_RXA_PHPRE_INITVAL 0x15B0
+#define USB3_DP_QSERDES_RXA_DFE_EN_TIMER 0x15B4
+#define USB3_DP_QSERDES_RXA_DFE_CTLE_POST_CAL_OFFSET 0x15B8
+#define USB3_DP_QSERDES_RXA_DCC_CTRL1 0x15BC
+#define USB3_DP_QSERDES_RXA_DCC_CTRL2 0x15C0
+#define USB3_DP_QSERDES_RXA_VTH_CODE 0x15C4
+#define USB3_DP_QSERDES_RXA_VTH_MIN_THRESH 0x15C8
+#define USB3_DP_QSERDES_RXA_VTH_MAX_THRESH 0x15CC
+#define USB3_DP_QSERDES_RXA_ALOG_OBSV_BUS_CTRL_1 0x15D0
+#define USB3_DP_QSERDES_RXA_PI_CTRL1 0x15D4
+#define USB3_DP_QSERDES_RXA_PI_CTRL2 0x15D8
+#define USB3_DP_QSERDES_RXA_PI_QUAD 0x15DC
+#define USB3_DP_QSERDES_RXA_IDATA1 0x15E0
+#define USB3_DP_QSERDES_RXA_IDATA2 0x15E4
+#define USB3_DP_QSERDES_RXA_AUX_DATA1 0x15E8
+#define USB3_DP_QSERDES_RXA_AUX_DATA2 0x15EC
+#define USB3_DP_QSERDES_RXA_AC_JTAG_OUTP 0x15F0
+#define USB3_DP_QSERDES_RXA_AC_JTAG_OUTN 0x15F4
+#define USB3_DP_QSERDES_RXA_RX_SIGDET 0x15F8
+#define USB3_DP_QSERDES_RXA_ALOG_OBSV_BUS_STATUS_1 0x15FC
+#define USB3_DP_QSERDES_TXB_BIST_MODE_LANENO 0x1600
+#define USB3_DP_QSERDES_TXB_BIST_INVERT 0x1604
+#define USB3_DP_QSERDES_TXB_CLKBUF_ENABLE 0x1608
+#define USB3_DP_QSERDES_TXB_TX_EMP_POST1_LVL 0x160C
+#define USB3_DP_QSERDES_TXB_TX_IDLE_LVL_LARGE_AMP 0x1610
+#define USB3_DP_QSERDES_TXB_TX_DRV_LVL 0x1614
+#define USB3_DP_QSERDES_TXB_TX_DRV_LVL_OFFSET 0x1618
+#define USB3_DP_QSERDES_TXB_RESET_TSYNC_EN 0x161C
+#define USB3_DP_QSERDES_TXB_PRE_STALL_LDO_BOOST_EN 0x1620
+#define USB3_DP_QSERDES_TXB_TX_BAND 0x1624
+#define USB3_DP_QSERDES_TXB_SLEW_CNTL 0x1628
+#define USB3_DP_QSERDES_TXB_INTERFACE_SELECT 0x162C
+#define USB3_DP_QSERDES_TXB_LPB_EN 0x1630
+#define USB3_DP_QSERDES_TXB_RES_CODE_LANE_TX 0x1634
+#define USB3_DP_QSERDES_TXB_RES_CODE_LANE_RX 0x1638
+#define USB3_DP_QSERDES_TXB_RES_CODE_LANE_OFFSET_TX 0x163C
+#define USB3_DP_QSERDES_TXB_RES_CODE_LANE_OFFSET_RX 0x1640
+#define USB3_DP_QSERDES_TXB_PERL_LENGTH1 0x1644
+#define USB3_DP_QSERDES_TXB_PERL_LENGTH2 0x1648
+#define USB3_DP_QSERDES_TXB_SERDES_BYP_EN_OUT 0x164C
+#define USB3_DP_QSERDES_TXB_DEBUG_BUS_SEL 0x1650
+#define USB3_DP_QSERDES_TXB_TRANSCEIVER_BIAS_EN 0x1654
+#define USB3_DP_QSERDES_TXB_HIGHZ_DRVR_EN 0x1658
+#define USB3_DP_QSERDES_TXB_TX_POL_INV 0x165C
+#define USB3_DP_QSERDES_TXB_PARRATE_REC_DETECT_IDLE_EN 0x1660
+#define USB3_DP_QSERDES_TXB_BIST_PATTERN1 0x1664
+#define USB3_DP_QSERDES_TXB_BIST_PATTERN2 0x1668
+#define USB3_DP_QSERDES_TXB_BIST_PATTERN3 0x166C
+#define USB3_DP_QSERDES_TXB_BIST_PATTERN4 0x1670
+#define USB3_DP_QSERDES_TXB_BIST_PATTERN5 0x1674
+#define USB3_DP_QSERDES_TXB_BIST_PATTERN6 0x1678
+#define USB3_DP_QSERDES_TXB_BIST_PATTERN7 0x167C
+#define USB3_DP_QSERDES_TXB_BIST_PATTERN8 0x1680
+#define USB3_DP_QSERDES_TXB_LANE_MODE_1 0x1684
+#define USB3_DP_QSERDES_TXB_LANE_MODE_2 0x1688
+#define USB3_DP_QSERDES_TXB_LANE_MODE_3 0x168C
+#define USB3_DP_QSERDES_TXB_ATB_SEL1 0x1690
+#define USB3_DP_QSERDES_TXB_ATB_SEL2 0x1694
+#define USB3_DP_QSERDES_TXB_RCV_DETECT_LVL 0x1698
+#define USB3_DP_QSERDES_TXB_RCV_DETECT_LVL_2 0x169C
+#define USB3_DP_QSERDES_TXB_PRBS_SEED1 0x16A0
+#define USB3_DP_QSERDES_TXB_PRBS_SEED2 0x16A4
+#define USB3_DP_QSERDES_TXB_PRBS_SEED3 0x16A8
+#define USB3_DP_QSERDES_TXB_PRBS_SEED4 0x16AC
+#define USB3_DP_QSERDES_TXB_RESET_GEN 0x16B0
+#define USB3_DP_QSERDES_TXB_RESET_GEN_MUXES 0x16B4
+#define USB3_DP_QSERDES_TXB_TRAN_DRVR_EMP_EN 0x16B8
+#define USB3_DP_QSERDES_TXB_TX_INTERFACE_MODE 0x16BC
+#define USB3_DP_QSERDES_TXB_PWM_CTRL 0x16C0
+#define USB3_DP_QSERDES_TXB_PWM_ENCODED_OR_DATA 0x16C4
+#define USB3_DP_QSERDES_TXB_PWM_GEAR_1_DIVIDER_BAND2 0x16C8
+#define USB3_DP_QSERDES_TXB_PWM_GEAR_2_DIVIDER_BAND2 0x16CC
+#define USB3_DP_QSERDES_TXB_PWM_GEAR_3_DIVIDER_BAND2 0x16D0
+#define USB3_DP_QSERDES_TXB_PWM_GEAR_4_DIVIDER_BAND2 0x16D4
+#define USB3_DP_QSERDES_TXB_PWM_GEAR_1_DIVIDER_BAND0_1 0x16D8
+#define USB3_DP_QSERDES_TXB_PWM_GEAR_2_DIVIDER_BAND0_1 0x16DC
+#define USB3_DP_QSERDES_TXB_PWM_GEAR_3_DIVIDER_BAND0_1 0x16E0
+#define USB3_DP_QSERDES_TXB_PWM_GEAR_4_DIVIDER_BAND0_1 0x16E4
+#define USB3_DP_QSERDES_TXB_VMODE_CTRL1 0x16E8
+#define USB3_DP_QSERDES_TXB_ALOG_OBSV_BUS_CTRL_1 0x16EC
+#define USB3_DP_QSERDES_TXB_BIST_STATUS 0x16F0
+#define USB3_DP_QSERDES_TXB_BIST_ERROR_COUNT1 0x16F4
+#define USB3_DP_QSERDES_TXB_BIST_ERROR_COUNT2 0x16F8
+#define USB3_DP_QSERDES_TXB_ALOG_OBSV_BUS_STATUS_1 0x16FC
+#define USB3_DP_QSERDES_TXB_LANE_DIG_CONFIG 0x1700
+#define USB3_DP_QSERDES_TXB_PI_QEC_CTRL 0x1704
+#define USB3_DP_QSERDES_TXB_PRE_EMPH 0x1708
+#define USB3_DP_QSERDES_TXB_SW_RESET 0x170C
+#define USB3_DP_QSERDES_TXB_DCC_OFFSET 0x1710
+#define USB3_DP_QSERDES_TXB_DIG_BKUP_CTRL 0x1714
+#define USB3_DP_QSERDES_TXB_DEBUG_BUS0 0x1718
+#define USB3_DP_QSERDES_TXB_DEBUG_BUS1 0x171C
+#define USB3_DP_QSERDES_TXB_DEBUG_BUS2 0x1720
+#define USB3_DP_QSERDES_TXB_DEBUG_BUS3 0x1724
+#define USB3_DP_QSERDES_TXB_READ_EQCODE 0x1728
+#define USB3_DP_QSERDES_TXB_READ_OFFSETCODE 0x172C
+#define USB3_DP_QSERDES_TXB_IA_ERROR_COUNTER_LOW 0x1730
+#define USB3_DP_QSERDES_TXB_IA_ERROR_COUNTER_HIGH 0x1734
+#define USB3_DP_QSERDES_TXB_VGA_READ_CODE 0x1738
+#define USB3_DP_QSERDES_TXB_VTH_READ_CODE 0x173C
+#define USB3_DP_QSERDES_TXB_DFE_TAP1_READ_CODE 0x1740
+#define USB3_DP_QSERDES_TXB_DFE_TAP2_READ_CODE 0x1744
+#define USB3_DP_QSERDES_TXB_IDAC_STATUS_I 0x1748
+#define USB3_DP_QSERDES_TXB_IDAC_STATUS_IBAR 0x174C
+#define USB3_DP_QSERDES_TXB_IDAC_STATUS_Q 0x1750
+#define USB3_DP_QSERDES_TXB_IDAC_STATUS_QBAR 0x1754
+#define USB3_DP_QSERDES_TXB_IDAC_STATUS_A 0x1758
+#define USB3_DP_QSERDES_TXB_IDAC_STATUS_ABAR 0x175C
+#define USB3_DP_QSERDES_TXB_IDAC_STATUS_SM_ON 0x1760
+#define USB3_DP_QSERDES_TXB_IDAC_STATUS_CAL_DONE 0x1764
+#define USB3_DP_QSERDES_TXB_IDAC_STATUS_SIGNERROR 0x1768
+#define USB3_DP_QSERDES_TXB_DCC_CAL_STATUS 0x176C
+#define USB3_DP_QSERDES_RXB_UCDR_FO_GAIN_HALF 0x1800
+#define USB3_DP_QSERDES_RXB_UCDR_FO_GAIN_QUARTER 0x1804
+#define USB3_DP_QSERDES_RXB_UCDR_FO_GAIN 0x1808
+#define USB3_DP_QSERDES_RXB_UCDR_SO_GAIN_HALF 0x180C
+#define USB3_DP_QSERDES_RXB_UCDR_SO_GAIN_QUARTER 0x1810
+#define USB3_DP_QSERDES_RXB_UCDR_SO_GAIN 0x1814
+#define USB3_DP_QSERDES_RXB_UCDR_SVS_FO_GAIN_HALF 0x1818
+#define USB3_DP_QSERDES_RXB_UCDR_SVS_FO_GAIN_QUARTER 0x181C
+#define USB3_DP_QSERDES_RXB_UCDR_SVS_FO_GAIN 0x1820
+#define USB3_DP_QSERDES_RXB_UCDR_SVS_SO_GAIN_HALF 0x1824
+#define USB3_DP_QSERDES_RXB_UCDR_SVS_SO_GAIN_QUARTER 0x1828
+#define USB3_DP_QSERDES_RXB_UCDR_SVS_SO_GAIN 0x182C
+#define USB3_DP_QSERDES_RXB_UCDR_FASTLOCK_FO_GAIN 0x1830
+#define USB3_DP_QSERDES_RXB_UCDR_SO_SATURATION_AND_ENABLE 0x1834
+#define USB3_DP_QSERDES_RXB_UCDR_FO_TO_SO_DELAY 0x1838
+#define USB3_DP_QSERDES_RXB_UCDR_FASTLOCK_COUNT_LOW 0x183C
+#define USB3_DP_QSERDES_RXB_UCDR_FASTLOCK_COUNT_HIGH 0x1840
+#define USB3_DP_QSERDES_RXB_UCDR_PI_CONTROLS 0x1844
+#define USB3_DP_QSERDES_RXB_UCDR_PI_CTRL2 0x1848
+#define USB3_DP_QSERDES_RXB_UCDR_SB2_THRESH1 0x184C
+#define USB3_DP_QSERDES_RXB_UCDR_SB2_THRESH2 0x1850
+#define USB3_DP_QSERDES_RXB_UCDR_SB2_GAIN1 0x1854
+#define USB3_DP_QSERDES_RXB_UCDR_SB2_GAIN2 0x1858
+#define USB3_DP_QSERDES_RXB_AUX_CONTROL 0x185C
+#define USB3_DP_QSERDES_RXB_AUX_DATA_TCOARSE_TFINE 0x1860
+#define USB3_DP_QSERDES_RXB_RCLK_AUXDATA_SEL 0x1864
+#define USB3_DP_QSERDES_RXB_AC_JTAG_ENABLE 0x1868
+#define USB3_DP_QSERDES_RXB_AC_JTAG_INITP 0x186C
+#define USB3_DP_QSERDES_RXB_AC_JTAG_INITN 0x1870
+#define USB3_DP_QSERDES_RXB_AC_JTAG_LVL 0x1874
+#define USB3_DP_QSERDES_RXB_AC_JTAG_MODE 0x1878
+#define USB3_DP_QSERDES_RXB_AC_JTAG_RESET 0x187C
+#define USB3_DP_QSERDES_RXB_RX_TERM_BW 0x1880
+#define USB3_DP_QSERDES_RXB_RX_RCVR_IQ_EN 0x1884
+#define USB3_DP_QSERDES_RXB_RX_IDAC_I_DC_OFFSETS 0x1888
+#define USB3_DP_QSERDES_RXB_RX_IDAC_IBAR_DC_OFFSETS 0x188C
+#define USB3_DP_QSERDES_RXB_RX_IDAC_Q_DC_OFFSETS 0x1890
+#define USB3_DP_QSERDES_RXB_RX_IDAC_QBAR_DC_OFFSETS 0x1894
+#define USB3_DP_QSERDES_RXB_RX_IDAC_A_DC_OFFSETS 0x1898
+#define USB3_DP_QSERDES_RXB_RX_IDAC_ABAR_DC_OFFSETS 0x189C
+#define USB3_DP_QSERDES_RXB_RX_IDAC_EN 0x18A0
+#define USB3_DP_QSERDES_RXB_RX_IDAC_ENABLES 0x18A4
+#define USB3_DP_QSERDES_RXB_RX_IDAC_SIGN 0x18A8
+#define USB3_DP_QSERDES_RXB_RX_HIGHZ_HIGHRATE 0x18AC
+#define USB3_DP_QSERDES_RXB_RX_TERM_AC_BYPASS_DC_COUPLE_OFFSET 0x18B0
+#define USB3_DP_QSERDES_RXB_DFE_1 0x18B4
+#define USB3_DP_QSERDES_RXB_DFE_2 0x18B8
+#define USB3_DP_QSERDES_RXB_DFE_3 0x18BC
+#define USB3_DP_QSERDES_RXB_DFE_4 0x18C0
+#define USB3_DP_QSERDES_RXB_TX_ADAPT_PRE_THRESH1 0x18C4
+#define USB3_DP_QSERDES_RXB_TX_ADAPT_PRE_THRESH2 0x18C8
+#define USB3_DP_QSERDES_RXB_TX_ADAPT_POST_THRESH 0x18CC
+#define USB3_DP_QSERDES_RXB_TX_ADAPT_MAIN_THRESH 0x18D0
+#define USB3_DP_QSERDES_RXB_VGA_CAL_CNTRL1 0x18D4
+#define USB3_DP_QSERDES_RXB_VGA_CAL_CNTRL2 0x18D8
+#define USB3_DP_QSERDES_RXB_GM_CAL 0x18DC
+#define USB3_DP_QSERDES_RXB_RX_VGA_GAIN2_LSB 0x18E0
+#define USB3_DP_QSERDES_RXB_RX_VGA_GAIN2_MSB 0x18E4
+#define USB3_DP_QSERDES_RXB_RX_EQU_ADAPTOR_CNTRL1 0x18E8
+#define USB3_DP_QSERDES_RXB_RX_EQU_ADAPTOR_CNTRL2 0x18EC
+#define USB3_DP_QSERDES_RXB_RX_EQU_ADAPTOR_CNTRL3 0x18F0
+#define USB3_DP_QSERDES_RXB_RX_EQU_ADAPTOR_CNTRL4 0x18F4
+#define USB3_DP_QSERDES_RXB_RX_IDAC_TSETTLE_LOW 0x18F8
+#define USB3_DP_QSERDES_RXB_RX_IDAC_TSETTLE_HIGH 0x18FC
+#define USB3_DP_QSERDES_RXB_RX_IDAC_MEASURE_TIME 0x1900
+#define USB3_DP_QSERDES_RXB_RX_IDAC_ACCUMULATOR 0x1904
+#define USB3_DP_QSERDES_RXB_RX_EQ_OFFSET_LSB 0x1908
+#define USB3_DP_QSERDES_RXB_RX_EQ_OFFSET_MSB 0x190C
+#define USB3_DP_QSERDES_RXB_RX_EQ_OFFSET_ADAPTOR_CNTRL1 0x1910
+#define USB3_DP_QSERDES_RXB_RX_OFFSET_ADAPTOR_CNTRL2 0x1914
+#define USB3_DP_QSERDES_RXB_SIGDET_ENABLES 0x1918
+#define USB3_DP_QSERDES_RXB_SIGDET_CNTRL 0x191C
+#define USB3_DP_QSERDES_RXB_SIGDET_LVL 0x1920
+#define USB3_DP_QSERDES_RXB_SIGDET_DEGLITCH_CNTRL 0x1924
+#define USB3_DP_QSERDES_RXB_RX_BAND 0x1928
+#define USB3_DP_QSERDES_RXB_CDR_FREEZE_UP_DN 0x192C
+#define USB3_DP_QSERDES_RXB_CDR_RESET_OVERRIDE 0x1930
+#define USB3_DP_QSERDES_RXB_RX_INTERFACE_MODE 0x1934
+#define USB3_DP_QSERDES_RXB_JITTER_GEN_MODE 0x1938
+#define USB3_DP_QSERDES_RXB_SJ_AMP1 0x193C
+#define USB3_DP_QSERDES_RXB_SJ_AMP2 0x1940
+#define USB3_DP_QSERDES_RXB_SJ_PER1 0x1944
+#define USB3_DP_QSERDES_RXB_SJ_PER2 0x1948
+#define USB3_DP_QSERDES_RXB_PPM_OFFSET1 0x194C
+#define USB3_DP_QSERDES_RXB_PPM_OFFSET2 0x1950
+#define USB3_DP_QSERDES_RXB_SIGN_PPM_PERIOD1 0x1954
+#define USB3_DP_QSERDES_RXB_SIGN_PPM_PERIOD2 0x1958
+#define USB3_DP_QSERDES_RXB_RX_PWM_ENABLE_AND_DATA 0x195C
+#define USB3_DP_QSERDES_RXB_RX_PWM_GEAR1_TIMEOUT_COUNT 0x1960
+#define USB3_DP_QSERDES_RXB_RX_PWM_GEAR2_TIMEOUT_COUNT 0x1964
+#define USB3_DP_QSERDES_RXB_RX_PWM_GEAR3_TIMEOUT_COUNT 0x1968
+#define USB3_DP_QSERDES_RXB_RX_PWM_GEAR4_TIMEOUT_COUNT 0x196C
+#define USB3_DP_QSERDES_RXB_RX_MODE_00_LOW 0x1970
+#define USB3_DP_QSERDES_RXB_RX_MODE_00_HIGH 0x1974
+#define USB3_DP_QSERDES_RXB_RX_MODE_00_HIGH2 0x1978
+#define USB3_DP_QSERDES_RXB_RX_MODE_00_HIGH3 0x197C
+#define USB3_DP_QSERDES_RXB_RX_MODE_00_HIGH4 0x1980
+#define USB3_DP_QSERDES_RXB_RX_MODE_01_LOW 0x1984
+#define USB3_DP_QSERDES_RXB_RX_MODE_01_HIGH 0x1988
+#define USB3_DP_QSERDES_RXB_RX_MODE_01_HIGH2 0x198C
+#define USB3_DP_QSERDES_RXB_RX_MODE_01_HIGH3 0x1990
+#define USB3_DP_QSERDES_RXB_RX_MODE_01_HIGH4 0x1994
+#define USB3_DP_QSERDES_RXB_RX_MODE_10_LOW 0x1998
+#define USB3_DP_QSERDES_RXB_RX_MODE_10_HIGH 0x199C
+#define USB3_DP_QSERDES_RXB_RX_MODE_10_HIGH2 0x19A0
+#define USB3_DP_QSERDES_RXB_RX_MODE_10_HIGH3 0x19A4
+#define USB3_DP_QSERDES_RXB_RX_MODE_10_HIGH4 0x19A8
+#define USB3_DP_QSERDES_RXB_PHPRE_CTRL 0x19AC
+#define USB3_DP_QSERDES_RXB_PHPRE_INITVAL 0x19B0
+#define USB3_DP_QSERDES_RXB_DFE_EN_TIMER 0x19B4
+#define USB3_DP_QSERDES_RXB_DFE_CTLE_POST_CAL_OFFSET 0x19B8
+#define USB3_DP_QSERDES_RXB_DCC_CTRL1 0x19BC
+#define USB3_DP_QSERDES_RXB_DCC_CTRL2 0x19C0
+#define USB3_DP_QSERDES_RXB_VTH_CODE 0x19C4
+#define USB3_DP_QSERDES_RXB_VTH_MIN_THRESH 0x19C8
+#define USB3_DP_QSERDES_RXB_VTH_MAX_THRESH 0x19CC
+#define USB3_DP_QSERDES_RXB_ALOG_OBSV_BUS_CTRL_1 0x19D0
+#define USB3_DP_QSERDES_RXB_PI_CTRL1 0x19D4
+#define USB3_DP_QSERDES_RXB_PI_CTRL2 0x19D8
+#define USB3_DP_QSERDES_RXB_PI_QUAD 0x19DC
+#define USB3_DP_QSERDES_RXB_IDATA1 0x19E0
+#define USB3_DP_QSERDES_RXB_IDATA2 0x19E4
+#define USB3_DP_QSERDES_RXB_AUX_DATA1 0x19E8
+#define USB3_DP_QSERDES_RXB_AUX_DATA2 0x19EC
+#define USB3_DP_QSERDES_RXB_AC_JTAG_OUTP 0x19F0
+#define USB3_DP_QSERDES_RXB_AC_JTAG_OUTN 0x19F4
+#define USB3_DP_QSERDES_RXB_RX_SIGDET 0x19F8
+#define USB3_DP_QSERDES_RXB_ALOG_OBSV_BUS_STATUS_1 0x19FC
+#define USB3_DP_PCS_MISC_TYPEC_CTRL 0x1A00
+#define USB3_DP_PCS_MISC_TYPEC_PWRDN_CTRL 0x1A04
+#define USB3_DP_PCS_MISC_PCS_MISC_CONFIG1 0x1A08
+#define USB3_DP_PCS_MISC_CLAMP_ENABLE 0x1A0C
+#define USB3_DP_PCS_MISC_TYPEC_STATUS 0x1A10
+#define USB3_DP_PCS_MISC_PLACEHOLDER_STATUS 0x1A14
+#define USB3_DP_PCS_LN_PCS_STATUS1 0x1B00
+#define USB3_DP_PCS_LN_PCS_STATUS2 0x1B04
+#define USB3_DP_PCS_LN_PCS_STATUS2_CLEAR 0x1B08
+#define USB3_DP_PCS_LN_PCS_STATUS3 0x1B0C
+#define USB3_DP_PCS_LN_BIST_CHK_ERR_CNT_L_STATUS 0x1B10
+#define USB3_DP_PCS_LN_BIST_CHK_ERR_CNT_H_STATUS 0x1B14
+#define USB3_DP_PCS_LN_BIST_CHK_STATUS 0x1B18
+#define USB3_DP_PCS_LN_INSIG_SW_CTRL1 0x1B1C
+#define USB3_DP_PCS_LN_INSIG_MX_CTRL1 0x1B20
+#define USB3_DP_PCS_LN_OUTSIG_SW_CTRL1 0x1B24
+#define USB3_DP_PCS_LN_OUTSIG_MX_CTRL1 0x1B28
+#define USB3_DP_PCS_LN_TEST_CONTROL 0x1B2C
+#define USB3_DP_PCS_LN_BIST_CTRL 0x1B30
+#define USB3_DP_PCS_LN_PRBS_SEED0 0x1B34
+#define USB3_DP_PCS_LN_PRBS_SEED1 0x1B38
+#define USB3_DP_PCS_LN_FIXED_PAT_CTRL 0x1B3C
+#define USB3_DP_PCS_SW_RESET 0x1C00
+#define USB3_DP_PCS_REVISION_ID0 0x1C04
+#define USB3_DP_PCS_REVISION_ID1 0x1C08
+#define USB3_DP_PCS_REVISION_ID2 0x1C0C
+#define USB3_DP_PCS_REVISION_ID3 0x1C10
+#define USB3_DP_PCS_PCS_STATUS1 0x1C14
+#define USB3_DP_PCS_PCS_STATUS2 0x1C18
+#define USB3_DP_PCS_PCS_STATUS3 0x1C1C
+#define USB3_DP_PCS_PCS_STATUS4 0x1C20
+#define USB3_DP_PCS_PCS_STATUS5 0x1C24
+#define USB3_DP_PCS_PCS_STATUS6 0x1C28
+#define USB3_DP_PCS_PCS_STATUS7 0x1C2C
+#define USB3_DP_PCS_DEBUG_BUS_0_STATUS 0x1C30
+#define USB3_DP_PCS_DEBUG_BUS_1_STATUS 0x1C34
+#define USB3_DP_PCS_DEBUG_BUS_2_STATUS 0x1C38
+#define USB3_DP_PCS_DEBUG_BUS_3_STATUS 0x1C3C
+#define USB3_DP_PCS_POWER_DOWN_CONTROL 0x1C40
+#define USB3_DP_PCS_START_CONTROL 0x1C44
+#define USB3_DP_PCS_INSIG_SW_CTRL1 0x1C48
+#define USB3_DP_PCS_INSIG_SW_CTRL2 0x1C4C
+#define USB3_DP_PCS_INSIG_SW_CTRL3 0x1C50
+#define USB3_DP_PCS_INSIG_SW_CTRL4 0x1C54
+#define USB3_DP_PCS_INSIG_SW_CTRL5 0x1C58
+#define USB3_DP_PCS_INSIG_SW_CTRL6 0x1C5C
+#define USB3_DP_PCS_INSIG_SW_CTRL7 0x1C60
+#define USB3_DP_PCS_INSIG_SW_CTRL8 0x1C64
+#define USB3_DP_PCS_INSIG_MX_CTRL1 0x1C68
+#define USB3_DP_PCS_INSIG_MX_CTRL2 0x1C6C
+#define USB3_DP_PCS_INSIG_MX_CTRL3 0x1C70
+#define USB3_DP_PCS_INSIG_MX_CTRL4 0x1C74
+#define USB3_DP_PCS_INSIG_MX_CTRL5 0x1C78
+#define USB3_DP_PCS_INSIG_MX_CTRL7 0x1C7C
+#define USB3_DP_PCS_INSIG_MX_CTRL8 0x1C80
+#define USB3_DP_PCS_OUTSIG_SW_CTRL1 0x1C84
+#define USB3_DP_PCS_OUTSIG_MX_CTRL1 0x1C88
+#define USB3_DP_PCS_CLAMP_ENABLE 0x1C8C
+#define USB3_DP_PCS_POWER_STATE_CONFIG1 0x1C90
+#define USB3_DP_PCS_POWER_STATE_CONFIG2 0x1C94
+#define USB3_DP_PCS_FLL_CNTRL1 0x1C98
+#define USB3_DP_PCS_FLL_CNTRL2 0x1C9C
+#define USB3_DP_PCS_FLL_CNT_VAL_L 0x1CA0
+#define USB3_DP_PCS_FLL_CNT_VAL_H_TOL 0x1CA4
+#define USB3_DP_PCS_FLL_MAN_CODE 0x1CA8
+#define USB3_DP_PCS_TEST_CONTROL1 0x1CAC
+#define USB3_DP_PCS_TEST_CONTROL2 0x1CB0
+#define USB3_DP_PCS_TEST_CONTROL3 0x1CB4
+#define USB3_DP_PCS_TEST_CONTROL4 0x1CB8
+#define USB3_DP_PCS_TEST_CONTROL5 0x1CBC
+#define USB3_DP_PCS_TEST_CONTROL6 0x1CC0
+#define USB3_DP_PCS_LOCK_DETECT_CONFIG1 0x1CC4
+#define USB3_DP_PCS_LOCK_DETECT_CONFIG2 0x1CC8
+#define USB3_DP_PCS_LOCK_DETECT_CONFIG3 0x1CCC
+#define USB3_DP_PCS_LOCK_DETECT_CONFIG4 0x1CD0
+#define USB3_DP_PCS_LOCK_DETECT_CONFIG5 0x1CD4
+#define USB3_DP_PCS_LOCK_DETECT_CONFIG6 0x1CD8
+#define USB3_DP_PCS_REFGEN_REQ_CONFIG1 0x1CDC
+#define USB3_DP_PCS_REFGEN_REQ_CONFIG2 0x1CE0
+#define USB3_DP_PCS_REFGEN_REQ_CONFIG3 0x1CE4
+#define USB3_DP_PCS_BIST_CTRL 0x1CE8
+#define USB3_DP_PCS_PRBS_POLY0 0x1CEC
+#define USB3_DP_PCS_PRBS_POLY1 0x1CF0
+#define USB3_DP_PCS_FIXED_PAT0 0x1CF4
+#define USB3_DP_PCS_FIXED_PAT1 0x1CF8
+#define USB3_DP_PCS_FIXED_PAT2 0x1CFC
+#define USB3_DP_PCS_FIXED_PAT3 0x1D00
+#define USB3_DP_PCS_FIXED_PAT4 0x1D04
+#define USB3_DP_PCS_FIXED_PAT5 0x1D08
+#define USB3_DP_PCS_FIXED_PAT6 0x1D0C
+#define USB3_DP_PCS_FIXED_PAT7 0x1D10
+#define USB3_DP_PCS_FIXED_PAT8 0x1D14
+#define USB3_DP_PCS_FIXED_PAT9 0x1D18
+#define USB3_DP_PCS_FIXED_PAT10 0x1D1C
+#define USB3_DP_PCS_FIXED_PAT11 0x1D20
+#define USB3_DP_PCS_FIXED_PAT12 0x1D24
+#define USB3_DP_PCS_FIXED_PAT13 0x1D28
+#define USB3_DP_PCS_FIXED_PAT14 0x1D2C
+#define USB3_DP_PCS_FIXED_PAT15 0x1D30
+#define USB3_DP_PCS_TXMGN_CONFIG 0x1D34
+#define USB3_DP_PCS_G12S1_TXMGN_V0 0x1D38
+#define USB3_DP_PCS_G12S1_TXMGN_V1 0x1D3C
+#define USB3_DP_PCS_G12S1_TXMGN_V2 0x1D40
+#define USB3_DP_PCS_G12S1_TXMGN_V3 0x1D44
+#define USB3_DP_PCS_G12S1_TXMGN_V4 0x1D48
+#define USB3_DP_PCS_G12S1_TXMGN_V0_RS 0x1D4C
+#define USB3_DP_PCS_G12S1_TXMGN_V1_RS 0x1D50
+#define USB3_DP_PCS_G12S1_TXMGN_V2_RS 0x1D54
+#define USB3_DP_PCS_G12S1_TXMGN_V3_RS 0x1D58
+#define USB3_DP_PCS_G12S1_TXMGN_V4_RS 0x1D5C
+#define USB3_DP_PCS_G3S2_TXMGN_MAIN 0x1D60
+#define USB3_DP_PCS_G3S2_TXMGN_MAIN_RS 0x1D64
+#define USB3_DP_PCS_G12S1_TXDEEMPH_M6DB 0x1D68
+#define USB3_DP_PCS_G12S1_TXDEEMPH_M3P5DB 0x1D6C
+#define USB3_DP_PCS_G3S2_PRE_GAIN 0x1D70
+#define USB3_DP_PCS_G3S2_POST_GAIN 0x1D74
+#define USB3_DP_PCS_G3S2_PRE_POST_OFFSET 0x1D78
+#define USB3_DP_PCS_G3S2_PRE_GAIN_RS 0x1D7C
+#define USB3_DP_PCS_G3S2_POST_GAIN_RS 0x1D80
+#define USB3_DP_PCS_G3S2_PRE_POST_OFFSET_RS 0x1D84
+#define USB3_DP_PCS_RX_SIGDET_LVL 0x1D88
+#define USB3_DP_PCS_RX_SIGDET_DTCT_CNTRL 0x1D8C
+#define USB3_DP_PCS_RCVR_DTCT_DLY_P1U2_L 0x1D90
+#define USB3_DP_PCS_RCVR_DTCT_DLY_P1U2_H 0x1D94
+#define USB3_DP_PCS_RATE_SLEW_CNTRL1 0x1D98
+#define USB3_DP_PCS_RATE_SLEW_CNTRL2 0x1D9C
+#define USB3_DP_PCS_PWRUP_RESET_DLY_TIME_AUXCLK 0x1DA0
+#define USB3_DP_PCS_P2U3_WAKEUP_DLY_TIME_AUXCLK_L 0x1DA4
+#define USB3_DP_PCS_P2U3_WAKEUP_DLY_TIME_AUXCLK_H 0x1DA8
+#define USB3_DP_PCS_TSYNC_RSYNC_TIME 0x1DAC
+#define USB3_DP_PCS_CDR_RESET_TIME 0x1DB0
+#define USB3_DP_PCS_TSYNC_DLY_TIME 0x1DB4
+#define USB3_DP_PCS_ELECIDLE_DLY_SEL 0x1DB8
+#define USB3_DP_PCS_CMN_ACK_OUT_SEL 0x1DBC
+#define USB3_DP_PCS_ALIGN_DETECT_CONFIG1 0x1DC0
+#define USB3_DP_PCS_ALIGN_DETECT_CONFIG2 0x1DC4
+#define USB3_DP_PCS_ALIGN_DETECT_CONFIG3 0x1DC8
+#define USB3_DP_PCS_ALIGN_DETECT_CONFIG4 0x1DCC
+#define USB3_DP_PCS_PCS_TX_RX_CONFIG 0x1DD0
+#define USB3_DP_PCS_RX_IDLE_DTCT_CNTRL 0x1DD4
+#define USB3_DP_PCS_RX_DCC_CAL_CONFIG 0x1DD8
+#define USB3_DP_PCS_EQ_CONFIG1 0x1DDC
+#define USB3_DP_PCS_EQ_CONFIG2 0x1DE0
+#define USB3_DP_PCS_EQ_CONFIG3 0x1DE4
+#define USB3_DP_PCS_EQ_CONFIG4 0x1DE8
+#define USB3_DP_PCS_EQ_CONFIG5 0x1DEC
+#define USB3_DP_PCS_USB3_POWER_STATE_CONFIG1 0x1F00
+#define USB3_DP_PCS_USB3_AUTONOMOUS_MODE_STATUS 0x1F04
+#define USB3_DP_PCS_USB3_AUTONOMOUS_MODE_CTRL 0x1F08
+#define USB3_DP_PCS_USB3_AUTONOMOUS_MODE_CTRL2 0x1F0C
+#define USB3_DP_PCS_USB3_LFPS_RXTERM_IRQ_SOURCE_STATUS 0x1F10
+#define USB3_DP_PCS_USB3_LFPS_RXTERM_IRQ_CLEAR 0x1F14
+#define USB3_DP_PCS_USB3_LFPS_DET_HIGH_COUNT_VAL 0x1F18
+#define USB3_DP_PCS_USB3_LFPS_TX_ECSTART 0x1F1C
+#define USB3_DP_PCS_USB3_LFPS_PER_TIMER_VAL 0x1F20
+#define USB3_DP_PCS_USB3_LFPS_TX_END_CNT_U3_START 0x1F24
+#define USB3_DP_PCS_USB3_RXEQTRAINING_LOCK_TIME 0x1F28
+#define USB3_DP_PCS_USB3_RXEQTRAINING_WAIT_TIME 0x1F2C
+#define USB3_DP_PCS_USB3_RXEQTRAINING_CTLE_TIME 0x1F30
+#define USB3_DP_PCS_USB3_RXEQTRAINING_WAIT_TIME_S2 0x1F34
+#define USB3_DP_PCS_USB3_RXEQTRAINING_DFE_TIME_S2 0x1F38
+#define USB3_DP_PCS_USB3_RCVR_DTCT_DLY_U3_L 0x1F3C
+#define USB3_DP_PCS_USB3_RCVR_DTCT_DLY_U3_H 0x1F40
+#define USB3_DP_PCS_USB3_ARCVR_DTCT_EN_PERIOD 0x1F44
+#define USB3_DP_PCS_USB3_ARCVR_DTCT_CM_DLY 0x1F48
+#define USB3_DP_PCS_USB3_TXONESZEROS_RUN_LENGTH 0x1F4C
+#define USB3_DP_PCS_USB3_ALFPS_DEGLITCH_VAL 0x1F50
+#define USB3_DP_PCS_USB3_SIGDET_STARTUP_TIMER_VAL 0x1F54
+#define USB3_DP_PCS_USB3_TEST_CONTROL 0x1F58
+
+/* USB3 Uni PHY register offsets */
+#define USB3_UNI_QSERDES_COM_ATB_SEL1 0x0000
+#define USB3_UNI_QSERDES_COM_ATB_SEL2 0x0004
+#define USB3_UNI_QSERDES_COM_FREQ_UPDATE 0x0008
+#define USB3_UNI_QSERDES_COM_BG_TIMER 0x000C
+#define USB3_UNI_QSERDES_COM_SSC_EN_CENTER 0x0010
+#define USB3_UNI_QSERDES_COM_SSC_ADJ_PER1 0x0014
+#define USB3_UNI_QSERDES_COM_SSC_ADJ_PER2 0x0018
+#define USB3_UNI_QSERDES_COM_SSC_PER1 0x001C
+#define USB3_UNI_QSERDES_COM_SSC_PER2 0x0020
+#define USB3_UNI_QSERDES_COM_SSC_STEP_SIZE1_MODE0 0x0024
+#define USB3_UNI_QSERDES_COM_SSC_STEP_SIZE2_MODE0 0x0028
+#define USB3_UNI_QSERDES_COM_SSC_STEP_SIZE3_MODE0 0x002C
+#define USB3_UNI_QSERDES_COM_SSC_STEP_SIZE1_MODE1 0x0030
+#define USB3_UNI_QSERDES_COM_SSC_STEP_SIZE2_MODE1 0x0034
+#define USB3_UNI_QSERDES_COM_SSC_STEP_SIZE3_MODE1 0x0038
+#define USB3_UNI_QSERDES_COM_POST_DIV 0x003C
+#define USB3_UNI_QSERDES_COM_POST_DIV_MUX 0x0040
+#define USB3_UNI_QSERDES_COM_BIAS_EN_CLKBUFLR_EN 0x0044
+#define USB3_UNI_QSERDES_COM_CLK_ENABLE1 0x0048
+#define USB3_UNI_QSERDES_COM_SYS_CLK_CTRL 0x004C
+#define USB3_UNI_QSERDES_COM_SYSCLK_BUF_ENABLE 0x0050
+#define USB3_UNI_QSERDES_COM_PLL_EN 0x0054
+#define USB3_UNI_QSERDES_COM_PLL_IVCO 0x0058
+#define USB3_UNI_QSERDES_COM_CMN_IETRIM 0x005C
+#define USB3_UNI_QSERDES_COM_CMN_IPTRIM 0x0060
+#define USB3_UNI_QSERDES_COM_EP_CLOCK_DETECT_CTRL 0x0064
+#define USB3_UNI_QSERDES_COM_SYSCLK_DET_COMP_STATUS 0x0068
+#define USB3_UNI_QSERDES_COM_CLK_EP_DIV_MODE0 0x006C
+#define USB3_UNI_QSERDES_COM_CLK_EP_DIV_MODE1 0x0070
+#define USB3_UNI_QSERDES_COM_CP_CTRL_MODE0 0x0074
+#define USB3_UNI_QSERDES_COM_CP_CTRL_MODE1 0x0078
+#define USB3_UNI_QSERDES_COM_PLL_RCTRL_MODE0 0x007C
+#define USB3_UNI_QSERDES_COM_PLL_RCTRL_MODE1 0x0080
+#define USB3_UNI_QSERDES_COM_PLL_CCTRL_MODE0 0x0084
+#define USB3_UNI_QSERDES_COM_PLL_CCTRL_MODE1 0x0088
+#define USB3_UNI_QSERDES_COM_PLL_CNTRL 0x008C
+#define USB3_UNI_QSERDES_COM_BIAS_EN_CTRL_BY_PSM 0x0090
+#define USB3_UNI_QSERDES_COM_SYSCLK_EN_SEL 0x0094
+#define USB3_UNI_QSERDES_COM_CML_SYSCLK_SEL 0x0098
+#define USB3_UNI_QSERDES_COM_RESETSM_CNTRL 0x009C
+#define USB3_UNI_QSERDES_COM_RESETSM_CNTRL2 0x00A0
+#define USB3_UNI_QSERDES_COM_LOCK_CMP_EN 0x00A4
+#define USB3_UNI_QSERDES_COM_LOCK_CMP_CFG 0x00A8
+#define USB3_UNI_QSERDES_COM_LOCK_CMP1_MODE0 0x00AC
+#define USB3_UNI_QSERDES_COM_LOCK_CMP2_MODE0 0x00B0
+#define USB3_UNI_QSERDES_COM_LOCK_CMP1_MODE1 0x00B4
+#define USB3_UNI_QSERDES_COM_LOCK_CMP2_MODE1 0x00B8
+#define USB3_UNI_QSERDES_COM_DEC_START_MODE0 0x00BC
+#define USB3_UNI_QSERDES_COM_DEC_START_MSB_MODE0 0x00C0
+#define USB3_UNI_QSERDES_COM_DEC_START_MODE1 0x00C4
+#define USB3_UNI_QSERDES_COM_DEC_START_MSB_MODE1 0x00C8
+#define USB3_UNI_QSERDES_COM_DIV_FRAC_START1_MODE0 0x00CC
+#define USB3_UNI_QSERDES_COM_DIV_FRAC_START2_MODE0 0x00D0
+#define USB3_UNI_QSERDES_COM_DIV_FRAC_START3_MODE0 0x00D4
+#define USB3_UNI_QSERDES_COM_DIV_FRAC_START1_MODE1 0x00D8
+#define USB3_UNI_QSERDES_COM_DIV_FRAC_START2_MODE1 0x00DC
+#define USB3_UNI_QSERDES_COM_DIV_FRAC_START3_MODE1 0x00E0
+#define USB3_UNI_QSERDES_COM_INTEGLOOP_INITVAL 0x00E4
+#define USB3_UNI_QSERDES_COM_INTEGLOOP_EN 0x00E8
+#define USB3_UNI_QSERDES_COM_INTEGLOOP_GAIN0_MODE0 0x00EC
+#define USB3_UNI_QSERDES_COM_INTEGLOOP_GAIN1_MODE0 0x00F0
+#define USB3_UNI_QSERDES_COM_INTEGLOOP_GAIN0_MODE1 0x00F4
+#define USB3_UNI_QSERDES_COM_INTEGLOOP_GAIN1_MODE1 0x00F8
+#define USB3_UNI_QSERDES_COM_INTEGLOOP_P_PATH_GAIN0 0x00FC
+#define USB3_UNI_QSERDES_COM_INTEGLOOP_P_PATH_GAIN1 0x0100
+#define USB3_UNI_QSERDES_COM_VCOCAL_DEADMAN_CTRL 0x0104
+#define USB3_UNI_QSERDES_COM_VCO_TUNE_CTRL 0x0108
+#define USB3_UNI_QSERDES_COM_VCO_TUNE_MAP 0x010C
+#define USB3_UNI_QSERDES_COM_VCO_TUNE1_MODE0 0x0110
+#define USB3_UNI_QSERDES_COM_VCO_TUNE2_MODE0 0x0114
+#define USB3_UNI_QSERDES_COM_VCO_TUNE1_MODE1 0x0118
+#define USB3_UNI_QSERDES_COM_VCO_TUNE2_MODE1 0x011C
+#define USB3_UNI_QSERDES_COM_VCO_TUNE_INITVAL1 0x0120
+#define USB3_UNI_QSERDES_COM_VCO_TUNE_INITVAL2 0x0124
+#define USB3_UNI_QSERDES_COM_VCO_TUNE_MINVAL1 0x0128
+#define USB3_UNI_QSERDES_COM_VCO_TUNE_MINVAL2 0x012C
+#define USB3_UNI_QSERDES_COM_VCO_TUNE_MAXVAL1 0x0130
+#define USB3_UNI_QSERDES_COM_VCO_TUNE_MAXVAL2 0x0134
+#define USB3_UNI_QSERDES_COM_VCO_TUNE_TIMER1 0x0138
+#define USB3_UNI_QSERDES_COM_VCO_TUNE_TIMER2 0x013C
+#define USB3_UNI_QSERDES_COM_CMN_STATUS 0x0140
+#define USB3_UNI_QSERDES_COM_RESET_SM_STATUS 0x0144
+#define USB3_UNI_QSERDES_COM_RESTRIM_CODE_STATUS 0x0148
+#define USB3_UNI_QSERDES_COM_PLLCAL_CODE1_STATUS 0x014C
+#define USB3_UNI_QSERDES_COM_PLLCAL_CODE2_STATUS 0x0150
+#define USB3_UNI_QSERDES_COM_CLK_SELECT 0x0154
+#define USB3_UNI_QSERDES_COM_HSCLK_SEL 0x0158
+#define USB3_UNI_QSERDES_COM_HSCLK_HS_SWITCH_SEL 0x015C
+#define USB3_UNI_QSERDES_COM_INTEGLOOP_BINCODE_STATUS 0x0160
+#define USB3_UNI_QSERDES_COM_PLL_ANALOG 0x0164
+#define USB3_UNI_QSERDES_COM_CORECLK_DIV_MODE0 0x0168
+#define USB3_UNI_QSERDES_COM_CORECLK_DIV_MODE1 0x016C
+#define USB3_UNI_QSERDES_COM_SW_RESET 0x0170
+#define USB3_UNI_QSERDES_COM_CORE_CLK_EN 0x0174
+#define USB3_UNI_QSERDES_COM_C_READY_STATUS 0x0178
+#define USB3_UNI_QSERDES_COM_CMN_CONFIG 0x017C
+#define USB3_UNI_QSERDES_COM_CMN_RATE_OVERRIDE 0x0180
+#define USB3_UNI_QSERDES_COM_SVS_MODE_CLK_SEL 0x0184
+#define USB3_UNI_QSERDES_COM_DEBUG_BUS0 0x0188
+#define USB3_UNI_QSERDES_COM_DEBUG_BUS1 0x018C
+#define USB3_UNI_QSERDES_COM_DEBUG_BUS2 0x0190
+#define USB3_UNI_QSERDES_COM_DEBUG_BUS3 0x0194
+#define USB3_UNI_QSERDES_COM_DEBUG_BUS_SEL 0x0198
+#define USB3_UNI_QSERDES_COM_CMN_MISC1 0x019C
+#define USB3_UNI_QSERDES_COM_CMN_MISC2 0x01A0
+#define USB3_UNI_QSERDES_COM_CMN_MODE 0x01A4
+#define USB3_UNI_QSERDES_COM_VCO_DC_LEVEL_CTRL 0x01A8
+#define USB3_UNI_QSERDES_COM_BIN_VCOCAL_CMP_CODE1_MODE0 0x01AC
+#define USB3_UNI_QSERDES_COM_BIN_VCOCAL_CMP_CODE2_MODE0 0x01B0
+#define USB3_UNI_QSERDES_COM_BIN_VCOCAL_CMP_CODE1_MODE1 0x01B4
+#define USB3_UNI_QSERDES_COM_BIN_VCOCAL_CMP_CODE2_MODE1 0x01B8
+#define USB3_UNI_QSERDES_COM_BIN_VCOCAL_HSCLK_SEL 0x01BC
+#define USB3_UNI_QSERDES_TX_BIST_MODE_LANENO 0x0200
+#define USB3_UNI_QSERDES_TX_BIST_INVERT 0x0204
+#define USB3_UNI_QSERDES_TX_CLKBUF_ENABLE 0x0208
+#define USB3_UNI_QSERDES_TX_TX_EMP_POST1_LVL 0x020C
+#define USB3_UNI_QSERDES_TX_TX_IDLE_LVL_LARGE_AMP 0x0210
+#define USB3_UNI_QSERDES_TX_TX_DRV_LVL 0x0214
+#define USB3_UNI_QSERDES_TX_TX_DRV_LVL_OFFSET 0x0218
+#define USB3_UNI_QSERDES_TX_RESET_TSYNC_EN 0x021C
+#define USB3_UNI_QSERDES_TX_PRE_STALL_LDO_BOOST_EN 0x0220
+#define USB3_UNI_QSERDES_TX_TX_BAND 0x0224
+#define USB3_UNI_QSERDES_TX_SLEW_CNTL 0x0228
+#define USB3_UNI_QSERDES_TX_INTERFACE_SELECT 0x022C
+#define USB3_UNI_QSERDES_TX_LPB_EN 0x0230
+#define USB3_UNI_QSERDES_TX_RES_CODE_LANE_TX 0x0234
+#define USB3_UNI_QSERDES_TX_RES_CODE_LANE_RX 0x0238
+#define USB3_UNI_QSERDES_TX_RES_CODE_LANE_OFFSET_TX 0x023C
+#define USB3_UNI_QSERDES_TX_RES_CODE_LANE_OFFSET_RX 0x0240
+#define USB3_UNI_QSERDES_TX_PERL_LENGTH1 0x0244
+#define USB3_UNI_QSERDES_TX_PERL_LENGTH2 0x0248
+#define USB3_UNI_QSERDES_TX_SERDES_BYP_EN_OUT 0x024C
+#define USB3_UNI_QSERDES_TX_DEBUG_BUS_SEL 0x0250
+#define USB3_UNI_QSERDES_TX_TRANSCEIVER_BIAS_EN 0x0254
+#define USB3_UNI_QSERDES_TX_HIGHZ_DRVR_EN 0x0258
+#define USB3_UNI_QSERDES_TX_TX_POL_INV 0x025C
+#define USB3_UNI_QSERDES_TX_PARRATE_REC_DETECT_IDLE_EN 0x0260
+#define USB3_UNI_QSERDES_TX_BIST_PATTERN1 0x0264
+#define USB3_UNI_QSERDES_TX_BIST_PATTERN2 0x0268
+#define USB3_UNI_QSERDES_TX_BIST_PATTERN3 0x026C
+#define USB3_UNI_QSERDES_TX_BIST_PATTERN4 0x0270
+#define USB3_UNI_QSERDES_TX_BIST_PATTERN5 0x0274
+#define USB3_UNI_QSERDES_TX_BIST_PATTERN6 0x0278
+#define USB3_UNI_QSERDES_TX_BIST_PATTERN7 0x027C
+#define USB3_UNI_QSERDES_TX_BIST_PATTERN8 0x0280
+#define USB3_UNI_QSERDES_TX_LANE_MODE_1 0x0284
+#define USB3_UNI_QSERDES_TX_LANE_MODE_2 0x0288
+#define USB3_UNI_QSERDES_TX_LANE_MODE_3 0x028C
+#define USB3_UNI_QSERDES_TX_ATB_SEL1 0x0290
+#define USB3_UNI_QSERDES_TX_ATB_SEL2 0x0294
+#define USB3_UNI_QSERDES_TX_RCV_DETECT_LVL 0x0298
+#define USB3_UNI_QSERDES_TX_RCV_DETECT_LVL_2 0x029C
+#define USB3_UNI_QSERDES_TX_PRBS_SEED1 0x02A0
+#define USB3_UNI_QSERDES_TX_PRBS_SEED2 0x02A4
+#define USB3_UNI_QSERDES_TX_PRBS_SEED3 0x02A8
+#define USB3_UNI_QSERDES_TX_PRBS_SEED4 0x02AC
+#define USB3_UNI_QSERDES_TX_RESET_GEN 0x02B0
+#define USB3_UNI_QSERDES_TX_RESET_GEN_MUXES 0x02B4
+#define USB3_UNI_QSERDES_TX_TRAN_DRVR_EMP_EN 0x02B8
+#define USB3_UNI_QSERDES_TX_TX_INTERFACE_MODE 0x02BC
+#define USB3_UNI_QSERDES_TX_PWM_CTRL 0x02C0
+#define USB3_UNI_QSERDES_TX_PWM_ENCODED_OR_DATA 0x02C4
+#define USB3_UNI_QSERDES_TX_PWM_GEAR_1_DIVIDER_BAND2 0x02C8
+#define USB3_UNI_QSERDES_TX_PWM_GEAR_2_DIVIDER_BAND2 0x02CC
+#define USB3_UNI_QSERDES_TX_PWM_GEAR_3_DIVIDER_BAND2 0x02D0
+#define USB3_UNI_QSERDES_TX_PWM_GEAR_4_DIVIDER_BAND2 0x02D4
+#define USB3_UNI_QSERDES_TX_PWM_GEAR_1_DIVIDER_BAND0_1 0x02D8
+#define USB3_UNI_QSERDES_TX_PWM_GEAR_2_DIVIDER_BAND0_1 0x02DC
+#define USB3_UNI_QSERDES_TX_PWM_GEAR_3_DIVIDER_BAND0_1 0x02E0
+#define USB3_UNI_QSERDES_TX_PWM_GEAR_4_DIVIDER_BAND0_1 0x02E4
+#define USB3_UNI_QSERDES_TX_VMODE_CTRL1 0x02E8
+#define USB3_UNI_QSERDES_TX_ALOG_OBSV_BUS_CTRL_1 0x02EC
+#define USB3_UNI_QSERDES_TX_BIST_STATUS 0x02F0
+#define USB3_UNI_QSERDES_TX_BIST_ERROR_COUNT1 0x02F4
+#define USB3_UNI_QSERDES_TX_BIST_ERROR_COUNT2 0x02F8
+#define USB3_UNI_QSERDES_TX_ALOG_OBSV_BUS_STATUS_1 0x02FC
+#define USB3_UNI_QSERDES_TX_LANE_DIG_CONFIG 0x0300
+#define USB3_UNI_QSERDES_TX_PI_QEC_CTRL 0x0304
+#define USB3_UNI_QSERDES_TX_PRE_EMPH 0x0308
+#define USB3_UNI_QSERDES_TX_SW_RESET 0x030C
+#define USB3_UNI_QSERDES_TX_DCC_OFFSET 0x0310
+#define USB3_UNI_QSERDES_TX_DIG_BKUP_CTRL 0x0314
+#define USB3_UNI_QSERDES_TX_DEBUG_BUS0 0x0318
+#define USB3_UNI_QSERDES_TX_DEBUG_BUS1 0x031C
+#define USB3_UNI_QSERDES_TX_DEBUG_BUS2 0x0320
+#define USB3_UNI_QSERDES_TX_DEBUG_BUS3 0x0324
+#define USB3_UNI_QSERDES_TX_READ_EQCODE 0x0328
+#define USB3_UNI_QSERDES_TX_READ_OFFSETCODE 0x032C
+#define USB3_UNI_QSERDES_TX_IA_ERROR_COUNTER_LOW 0x0330
+#define USB3_UNI_QSERDES_TX_IA_ERROR_COUNTER_HIGH 0x0334
+#define USB3_UNI_QSERDES_TX_VGA_READ_CODE 0x0338
+#define USB3_UNI_QSERDES_TX_VTH_READ_CODE 0x033C
+#define USB3_UNI_QSERDES_TX_DFE_TAP1_READ_CODE 0x0340
+#define USB3_UNI_QSERDES_TX_DFE_TAP2_READ_CODE 0x0344
+#define USB3_UNI_QSERDES_TX_IDAC_STATUS_I 0x0348
+#define USB3_UNI_QSERDES_TX_IDAC_STATUS_IBAR 0x034C
+#define USB3_UNI_QSERDES_TX_IDAC_STATUS_Q 0x0350
+#define USB3_UNI_QSERDES_TX_IDAC_STATUS_QBAR 0x0354
+#define USB3_UNI_QSERDES_TX_IDAC_STATUS_A 0x0358
+#define USB3_UNI_QSERDES_TX_IDAC_STATUS_ABAR 0x035C
+#define USB3_UNI_QSERDES_TX_IDAC_STATUS_SM_ON 0x0360
+#define USB3_UNI_QSERDES_TX_IDAC_STATUS_CAL_DONE 0x0364
+#define USB3_UNI_QSERDES_TX_IDAC_STATUS_SIGNERROR 0x0368
+#define USB3_UNI_QSERDES_TX_DCC_CAL_STATUS 0x036C
+#define USB3_UNI_QSERDES_RX_UCDR_FO_GAIN_HALF 0x0400
+#define USB3_UNI_QSERDES_RX_UCDR_FO_GAIN_QUARTER 0x0404
+#define USB3_UNI_QSERDES_RX_UCDR_FO_GAIN 0x0408
+#define USB3_UNI_QSERDES_RX_UCDR_SO_GAIN_HALF 0x040C
+#define USB3_UNI_QSERDES_RX_UCDR_SO_GAIN_QUARTER 0x0410
+#define USB3_UNI_QSERDES_RX_UCDR_SO_GAIN 0x0414
+#define USB3_UNI_QSERDES_RX_UCDR_SVS_FO_GAIN_HALF 0x0418
+#define USB3_UNI_QSERDES_RX_UCDR_SVS_FO_GAIN_QUARTER 0x041C
+#define USB3_UNI_QSERDES_RX_UCDR_SVS_FO_GAIN 0x0420
+#define USB3_UNI_QSERDES_RX_UCDR_SVS_SO_GAIN_HALF 0x0424
+#define USB3_UNI_QSERDES_RX_UCDR_SVS_SO_GAIN_QUARTER 0x0428
+#define USB3_UNI_QSERDES_RX_UCDR_SVS_SO_GAIN 0x042C
+#define USB3_UNI_QSERDES_RX_UCDR_FASTLOCK_FO_GAIN 0x0430
+#define USB3_UNI_QSERDES_RX_UCDR_SO_SATURATION_AND_ENABLE 0x0434
+#define USB3_UNI_QSERDES_RX_UCDR_FO_TO_SO_DELAY 0x0438
+#define USB3_UNI_QSERDES_RX_UCDR_FASTLOCK_COUNT_LOW 0x043C
+#define USB3_UNI_QSERDES_RX_UCDR_FASTLOCK_COUNT_HIGH 0x0440
+#define USB3_UNI_QSERDES_RX_UCDR_PI_CONTROLS 0x0444
+#define USB3_UNI_QSERDES_RX_UCDR_PI_CTRL2 0x0448
+#define USB3_UNI_QSERDES_RX_UCDR_SB2_THRESH1 0x044C
+#define USB3_UNI_QSERDES_RX_UCDR_SB2_THRESH2 0x0450
+#define USB3_UNI_QSERDES_RX_UCDR_SB2_GAIN1 0x0454
+#define USB3_UNI_QSERDES_RX_UCDR_SB2_GAIN2 0x0458
+#define USB3_UNI_QSERDES_RX_AUX_CONTROL 0x045C
+#define USB3_UNI_QSERDES_RX_AUX_DATA_TCOARSE_TFINE 0x0460
+#define USB3_UNI_QSERDES_RX_RCLK_AUXDATA_SEL 0x0464
+#define USB3_UNI_QSERDES_RX_AC_JTAG_ENABLE 0x0468
+#define USB3_UNI_QSERDES_RX_AC_JTAG_INITP 0x046C
+#define USB3_UNI_QSERDES_RX_AC_JTAG_INITN 0x0470
+#define USB3_UNI_QSERDES_RX_AC_JTAG_LVL 0x0474
+#define USB3_UNI_QSERDES_RX_AC_JTAG_MODE 0x0478
+#define USB3_UNI_QSERDES_RX_AC_JTAG_RESET 0x047C
+#define USB3_UNI_QSERDES_RX_RX_TERM_BW 0x0480
+#define USB3_UNI_QSERDES_RX_RX_RCVR_IQ_EN 0x0484
+#define USB3_UNI_QSERDES_RX_RX_IDAC_I_DC_OFFSETS 0x0488
+#define USB3_UNI_QSERDES_RX_RX_IDAC_IBAR_DC_OFFSETS 0x048C
+#define USB3_UNI_QSERDES_RX_RX_IDAC_Q_DC_OFFSETS 0x0490
+#define USB3_UNI_QSERDES_RX_RX_IDAC_QBAR_DC_OFFSETS 0x0494
+#define USB3_UNI_QSERDES_RX_RX_IDAC_A_DC_OFFSETS 0x0498
+#define USB3_UNI_QSERDES_RX_RX_IDAC_ABAR_DC_OFFSETS 0x049C
+#define USB3_UNI_QSERDES_RX_RX_IDAC_EN 0x04A0
+#define USB3_UNI_QSERDES_RX_RX_IDAC_ENABLES 0x04A4
+#define USB3_UNI_QSERDES_RX_RX_IDAC_SIGN 0x04A8
+#define USB3_UNI_QSERDES_RX_RX_HIGHZ_HIGHRATE 0x04AC
+#define USB3_UNI_QSERDES_RX_RX_TERM_AC_BYPASS_DC_COUPLE_OFFSET 0x04B0
+#define USB3_UNI_QSERDES_RX_DFE_1 0x04B4
+#define USB3_UNI_QSERDES_RX_DFE_2 0x04B8
+#define USB3_UNI_QSERDES_RX_DFE_3 0x04BC
+#define USB3_UNI_QSERDES_RX_DFE_4 0x04C0
+#define USB3_UNI_QSERDES_RX_TX_ADAPT_PRE_THRESH1 0x04C4
+#define USB3_UNI_QSERDES_RX_TX_ADAPT_PRE_THRESH2 0x04C8
+#define USB3_UNI_QSERDES_RX_TX_ADAPT_POST_THRESH 0x04CC
+#define USB3_UNI_QSERDES_RX_TX_ADAPT_MAIN_THRESH 0x04D0
+#define USB3_UNI_QSERDES_RX_VGA_CAL_CNTRL1 0x04D4
+#define USB3_UNI_QSERDES_RX_VGA_CAL_CNTRL2 0x04D8
+#define USB3_UNI_QSERDES_RX_GM_CAL 0x04DC
+#define USB3_UNI_QSERDES_RX_RX_VGA_GAIN2_LSB 0x04E0
+#define USB3_UNI_QSERDES_RX_RX_VGA_GAIN2_MSB 0x04E4
+#define USB3_UNI_QSERDES_RX_RX_EQU_ADAPTOR_CNTRL1 0x04E8
+#define USB3_UNI_QSERDES_RX_RX_EQU_ADAPTOR_CNTRL2 0x04EC
+#define USB3_UNI_QSERDES_RX_RX_EQU_ADAPTOR_CNTRL3 0x04F0
+#define USB3_UNI_QSERDES_RX_RX_EQU_ADAPTOR_CNTRL4 0x04F4
+#define USB3_UNI_QSERDES_RX_RX_IDAC_TSETTLE_LOW 0x04F8
+#define USB3_UNI_QSERDES_RX_RX_IDAC_TSETTLE_HIGH 0x04FC
+#define USB3_UNI_QSERDES_RX_RX_IDAC_MEASURE_TIME 0x0500
+#define USB3_UNI_QSERDES_RX_RX_IDAC_ACCUMULATOR 0x0504
+#define USB3_UNI_QSERDES_RX_RX_EQ_OFFSET_LSB 0x0508
+#define USB3_UNI_QSERDES_RX_RX_EQ_OFFSET_MSB 0x050C
+#define USB3_UNI_QSERDES_RX_RX_EQ_OFFSET_ADAPTOR_CNTRL1 0x0510
+#define USB3_UNI_QSERDES_RX_RX_OFFSET_ADAPTOR_CNTRL2 0x0514
+#define USB3_UNI_QSERDES_RX_SIGDET_ENABLES 0x0518
+#define USB3_UNI_QSERDES_RX_SIGDET_CNTRL 0x051C
+#define USB3_UNI_QSERDES_RX_SIGDET_LVL 0x0520
+#define USB3_UNI_QSERDES_RX_SIGDET_DEGLITCH_CNTRL 0x0524
+#define USB3_UNI_QSERDES_RX_RX_BAND 0x0528
+#define USB3_UNI_QSERDES_RX_CDR_FREEZE_UP_DN 0x052C
+#define USB3_UNI_QSERDES_RX_CDR_RESET_OVERRIDE 0x0530
+#define USB3_UNI_QSERDES_RX_RX_INTERFACE_MODE 0x0534
+#define USB3_UNI_QSERDES_RX_JITTER_GEN_MODE 0x0538
+#define USB3_UNI_QSERDES_RX_SJ_AMP1 0x053C
+#define USB3_UNI_QSERDES_RX_SJ_AMP2 0x0540
+#define USB3_UNI_QSERDES_RX_SJ_PER1 0x0544
+#define USB3_UNI_QSERDES_RX_SJ_PER2 0x0548
+#define USB3_UNI_QSERDES_RX_PPM_OFFSET1 0x054C
+#define USB3_UNI_QSERDES_RX_PPM_OFFSET2 0x0550
+#define USB3_UNI_QSERDES_RX_SIGN_PPM_PERIOD1 0x0554
+#define USB3_UNI_QSERDES_RX_SIGN_PPM_PERIOD2 0x0558
+#define USB3_UNI_QSERDES_RX_RX_PWM_ENABLE_AND_DATA 0x055C
+#define USB3_UNI_QSERDES_RX_RX_PWM_GEAR1_TIMEOUT_COUNT 0x0560
+#define USB3_UNI_QSERDES_RX_RX_PWM_GEAR2_TIMEOUT_COUNT 0x0564
+#define USB3_UNI_QSERDES_RX_RX_PWM_GEAR3_TIMEOUT_COUNT 0x0568
+#define USB3_UNI_QSERDES_RX_RX_PWM_GEAR4_TIMEOUT_COUNT 0x056C
+#define USB3_UNI_QSERDES_RX_RX_MODE_00_LOW 0x0570
+#define USB3_UNI_QSERDES_RX_RX_MODE_00_HIGH 0x0574
+#define USB3_UNI_QSERDES_RX_RX_MODE_00_HIGH2 0x0578
+#define USB3_UNI_QSERDES_RX_RX_MODE_00_HIGH3 0x057C
+#define USB3_UNI_QSERDES_RX_RX_MODE_00_HIGH4 0x0580
+#define USB3_UNI_QSERDES_RX_RX_MODE_01_LOW 0x0584
+#define USB3_UNI_QSERDES_RX_RX_MODE_01_HIGH 0x0588
+#define USB3_UNI_QSERDES_RX_RX_MODE_01_HIGH2 0x058C
+#define USB3_UNI_QSERDES_RX_RX_MODE_01_HIGH3 0x0590
+#define USB3_UNI_QSERDES_RX_RX_MODE_01_HIGH4 0x0594
+#define USB3_UNI_QSERDES_RX_RX_MODE_10_LOW 0x0598
+#define USB3_UNI_QSERDES_RX_RX_MODE_10_HIGH 0x059C
+#define USB3_UNI_QSERDES_RX_RX_MODE_10_HIGH2 0x05A0
+#define USB3_UNI_QSERDES_RX_RX_MODE_10_HIGH3 0x05A4
+#define USB3_UNI_QSERDES_RX_RX_MODE_10_HIGH4 0x05A8
+#define USB3_UNI_QSERDES_RX_PHPRE_CTRL 0x05AC
+#define USB3_UNI_QSERDES_RX_PHPRE_INITVAL 0x05B0
+#define USB3_UNI_QSERDES_RX_DFE_EN_TIMER 0x05B4
+#define USB3_UNI_QSERDES_RX_DFE_CTLE_POST_CAL_OFFSET 0x05B8
+#define USB3_UNI_QSERDES_RX_DCC_CTRL1 0x05BC
+#define USB3_UNI_QSERDES_RX_DCC_CTRL2 0x05C0
+#define USB3_UNI_QSERDES_RX_VTH_CODE 0x05C4
+#define USB3_UNI_QSERDES_RX_VTH_MIN_THRESH 0x05C8
+#define USB3_UNI_QSERDES_RX_VTH_MAX_THRESH 0x05CC
+#define USB3_UNI_QSERDES_RX_ALOG_OBSV_BUS_CTRL_1 0x05D0
+#define USB3_UNI_QSERDES_RX_PI_CTRL1 0x05D4
+#define USB3_UNI_QSERDES_RX_PI_CTRL2 0x05D8
+#define USB3_UNI_QSERDES_RX_PI_QUAD 0x05DC
+#define USB3_UNI_QSERDES_RX_IDATA1 0x05E0
+#define USB3_UNI_QSERDES_RX_IDATA2 0x05E4
+#define USB3_UNI_QSERDES_RX_AUX_DATA1 0x05E8
+#define USB3_UNI_QSERDES_RX_AUX_DATA2 0x05EC
+#define USB3_UNI_QSERDES_RX_AC_JTAG_OUTP 0x05F0
+#define USB3_UNI_QSERDES_RX_AC_JTAG_OUTN 0x05F4
+#define USB3_UNI_QSERDES_RX_RX_SIGDET 0x05F8
+#define USB3_UNI_QSERDES_RX_ALOG_OBSV_BUS_STATUS_1 0x05FC
+#define USB3_UNI_PCS_LN_PCS_STATUS1 0x0600
+#define USB3_UNI_PCS_LN_PCS_STATUS2 0x0604
+#define USB3_UNI_PCS_LN_PCS_STATUS2_CLEAR 0x0608
+#define USB3_UNI_PCS_LN_PCS_STATUS3 0x060C
+#define USB3_UNI_PCS_LN_BIST_CHK_ERR_CNT_L_STATUS 0x0610
+#define USB3_UNI_PCS_LN_BIST_CHK_ERR_CNT_H_STATUS 0x0614
+#define USB3_UNI_PCS_LN_BIST_CHK_STATUS 0x0618
+#define USB3_UNI_PCS_LN_INSIG_SW_CTRL1 0x061C
+#define USB3_UNI_PCS_LN_INSIG_MX_CTRL1 0x0620
+#define USB3_UNI_PCS_LN_OUTSIG_SW_CTRL1 0x0624
+#define USB3_UNI_PCS_LN_OUTSIG_MX_CTRL1 0x0628
+#define USB3_UNI_PCS_LN_TEST_CONTROL 0x062C
+#define USB3_UNI_PCS_LN_BIST_CTRL 0x0630
+#define USB3_UNI_PCS_LN_PRBS_SEED0 0x0634
+#define USB3_UNI_PCS_LN_PRBS_SEED1 0x0638
+#define USB3_UNI_PCS_LN_FIXED_PAT_CTRL 0x063C
+#define USB3_UNI_PCS_PCIE_LN_PRESET_OVERRIDE_PRE_POST 0x0700
+#define USB3_UNI_PCS_PCIE_LN_PRESET_OVERRIDE_PRE_POST_RS 0x0704
+#define USB3_UNI_PCS_PCIE_LN_PRESET_OVERRIDE_EN 0x0708
+#define USB3_UNI_PCS_PCIE_LN_PRESET_DSBL_L 0x070C
+#define USB3_UNI_PCS_PCIE_LN_PRESET_DSBL_H 0x0710
+#define USB3_UNI_PCS_PCIE_LN_LANE_OFF_CONFIG 0x0714
+#define USB3_UNI_PCS_PCIE_LN_RXEQ_DONE_CONFIG1 0x0718
+#define USB3_UNI_PCS_PCIE_LN_RXEQ_DONE_CONFIG2 0x071C
+#define USB3_UNI_PCS_PCIE_LN_PCIE_PCS_STATUS 0x0720
+#define USB3_UNI_PCS_SW_RESET 0x0800
+#define USB3_UNI_PCS_REVISION_ID0 0x0804
+#define USB3_UNI_PCS_REVISION_ID1 0x0808
+#define USB3_UNI_PCS_REVISION_ID2 0x080C
+#define USB3_UNI_PCS_REVISION_ID3 0x0810
+#define USB3_UNI_PCS_PCS_STATUS1 0x0814
+#define USB3_UNI_PCS_PCS_STATUS2 0x0818
+#define USB3_UNI_PCS_PCS_STATUS3 0x081C
+#define USB3_UNI_PCS_PCS_STATUS4 0x0820
+#define USB3_UNI_PCS_PCS_STATUS5 0x0824
+#define USB3_UNI_PCS_PCS_STATUS6 0x0828
+#define USB3_UNI_PCS_PCS_STATUS7 0x082C
+#define USB3_UNI_PCS_DEBUG_BUS_0_STATUS 0x0830
+#define USB3_UNI_PCS_DEBUG_BUS_1_STATUS 0x0834
+#define USB3_UNI_PCS_DEBUG_BUS_2_STATUS 0x0838
+#define USB3_UNI_PCS_DEBUG_BUS_3_STATUS 0x083C
+#define USB3_UNI_PCS_POWER_DOWN_CONTROL 0x0840
+#define USB3_UNI_PCS_START_CONTROL 0x0844
+#define USB3_UNI_PCS_INSIG_SW_CTRL1 0x0848
+#define USB3_UNI_PCS_INSIG_SW_CTRL2 0x084C
+#define USB3_UNI_PCS_INSIG_SW_CTRL3 0x0850
+#define USB3_UNI_PCS_INSIG_SW_CTRL4 0x0854
+#define USB3_UNI_PCS_INSIG_SW_CTRL5 0x0858
+#define USB3_UNI_PCS_INSIG_SW_CTRL6 0x085C
+#define USB3_UNI_PCS_INSIG_SW_CTRL7 0x0860
+#define USB3_UNI_PCS_INSIG_SW_CTRL8 0x0864
+#define USB3_UNI_PCS_INSIG_MX_CTRL1 0x0868
+#define USB3_UNI_PCS_INSIG_MX_CTRL2 0x086C
+#define USB3_UNI_PCS_INSIG_MX_CTRL3 0x0870
+#define USB3_UNI_PCS_INSIG_MX_CTRL4 0x0874
+#define USB3_UNI_PCS_INSIG_MX_CTRL5 0x0878
+#define USB3_UNI_PCS_INSIG_MX_CTRL7 0x087C
+#define USB3_UNI_PCS_INSIG_MX_CTRL8 0x0880
+#define USB3_UNI_PCS_OUTSIG_SW_CTRL1 0x0884
+#define USB3_UNI_PCS_OUTSIG_MX_CTRL1 0x0888
+#define USB3_UNI_PCS_CLAMP_ENABLE 0x088C
+#define USB3_UNI_PCS_POWER_STATE_CONFIG1 0x0890
+#define USB3_UNI_PCS_POWER_STATE_CONFIG2 0x0894
+#define USB3_UNI_PCS_FLL_CNTRL1 0x0898
+#define USB3_UNI_PCS_FLL_CNTRL2 0x089C
+#define USB3_UNI_PCS_FLL_CNT_VAL_L 0x08A0
+#define USB3_UNI_PCS_FLL_CNT_VAL_H_TOL 0x08A4
+#define USB3_UNI_PCS_FLL_MAN_CODE 0x08A8
+#define USB3_UNI_PCS_TEST_CONTROL1 0x08AC
+#define USB3_UNI_PCS_TEST_CONTROL2 0x08B0
+#define USB3_UNI_PCS_TEST_CONTROL3 0x08B4
+#define USB3_UNI_PCS_TEST_CONTROL4 0x08B8
+#define USB3_UNI_PCS_TEST_CONTROL5 0x08BC
+#define USB3_UNI_PCS_TEST_CONTROL6 0x08C0
+#define USB3_UNI_PCS_LOCK_DETECT_CONFIG1 0x08C4
+#define USB3_UNI_PCS_LOCK_DETECT_CONFIG2 0x08C8
+#define USB3_UNI_PCS_LOCK_DETECT_CONFIG3 0x08CC
+#define USB3_UNI_PCS_LOCK_DETECT_CONFIG4 0x08D0
+#define USB3_UNI_PCS_LOCK_DETECT_CONFIG5 0x08D4
+#define USB3_UNI_PCS_LOCK_DETECT_CONFIG6 0x08D8
+#define USB3_UNI_PCS_REFGEN_REQ_CONFIG1 0x08DC
+#define USB3_UNI_PCS_REFGEN_REQ_CONFIG2 0x08E0
+#define USB3_UNI_PCS_REFGEN_REQ_CONFIG3 0x08E4
+#define USB3_UNI_PCS_BIST_CTRL 0x08E8
+#define USB3_UNI_PCS_PRBS_POLY0 0x08EC
+#define USB3_UNI_PCS_PRBS_POLY1 0x08F0
+#define USB3_UNI_PCS_FIXED_PAT0 0x08F4
+#define USB3_UNI_PCS_FIXED_PAT1 0x08F8
+#define USB3_UNI_PCS_FIXED_PAT2 0x08FC
+#define USB3_UNI_PCS_FIXED_PAT3 0x0900
+#define USB3_UNI_PCS_FIXED_PAT4 0x0904
+#define USB3_UNI_PCS_FIXED_PAT5 0x0908
+#define USB3_UNI_PCS_FIXED_PAT6 0x090C
+#define USB3_UNI_PCS_FIXED_PAT7 0x0910
+#define USB3_UNI_PCS_FIXED_PAT8 0x0914
+#define USB3_UNI_PCS_FIXED_PAT9 0x0918
+#define USB3_UNI_PCS_FIXED_PAT10 0x091C
+#define USB3_UNI_PCS_FIXED_PAT11 0x0920
+#define USB3_UNI_PCS_FIXED_PAT12 0x0924
+#define USB3_UNI_PCS_FIXED_PAT13 0x0928
+#define USB3_UNI_PCS_FIXED_PAT14 0x092C
+#define USB3_UNI_PCS_FIXED_PAT15 0x0930
+#define USB3_UNI_PCS_TXMGN_CONFIG 0x0934
+#define USB3_UNI_PCS_G12S1_TXMGN_V0 0x0938
+#define USB3_UNI_PCS_G12S1_TXMGN_V1 0x093C
+#define USB3_UNI_PCS_G12S1_TXMGN_V2 0x0940
+#define USB3_UNI_PCS_G12S1_TXMGN_V3 0x0944
+#define USB3_UNI_PCS_G12S1_TXMGN_V4 0x0948
+#define USB3_UNI_PCS_G12S1_TXMGN_V0_RS 0x094C
+#define USB3_UNI_PCS_G12S1_TXMGN_V1_RS 0x0950
+#define USB3_UNI_PCS_G12S1_TXMGN_V2_RS 0x0954
+#define USB3_UNI_PCS_G12S1_TXMGN_V3_RS 0x0958
+#define USB3_UNI_PCS_G12S1_TXMGN_V4_RS 0x095C
+#define USB3_UNI_PCS_G3S2_TXMGN_MAIN 0x0960
+#define USB3_UNI_PCS_G3S2_TXMGN_MAIN_RS 0x0964
+#define USB3_UNI_PCS_G12S1_TXDEEMPH_M6DB 0x0968
+#define USB3_UNI_PCS_G12S1_TXDEEMPH_M3P5DB 0x096C
+#define USB3_UNI_PCS_G3S2_PRE_GAIN 0x0970
+#define USB3_UNI_PCS_G3S2_POST_GAIN 0x0974
+#define USB3_UNI_PCS_G3S2_PRE_POST_OFFSET 0x0978
+#define USB3_UNI_PCS_G3S2_PRE_GAIN_RS 0x097C
+#define USB3_UNI_PCS_G3S2_POST_GAIN_RS 0x0980
+#define USB3_UNI_PCS_G3S2_PRE_POST_OFFSET_RS 0x0984
+#define USB3_UNI_PCS_RX_SIGDET_LVL 0x0988
+#define USB3_UNI_PCS_RX_SIGDET_DTCT_CNTRL 0x098C
+#define USB3_UNI_PCS_RCVR_DTCT_DLY_P1U2_L 0x0990
+#define USB3_UNI_PCS_RCVR_DTCT_DLY_P1U2_H 0x0994
+#define USB3_UNI_PCS_RATE_SLEW_CNTRL1 0x0998
+#define USB3_UNI_PCS_RATE_SLEW_CNTRL2 0x099C
+#define USB3_UNI_PCS_PWRUP_RESET_DLY_TIME_AUXCLK 0x09A0
+#define USB3_UNI_PCS_P2U3_WAKEUP_DLY_TIME_AUXCLK_L 0x09A4
+#define USB3_UNI_PCS_P2U3_WAKEUP_DLY_TIME_AUXCLK_H 0x09A8
+#define USB3_UNI_PCS_TSYNC_RSYNC_TIME 0x09AC
+#define USB3_UNI_PCS_CDR_RESET_TIME 0x09B0
+#define USB3_UNI_PCS_TSYNC_DLY_TIME 0x09B4
+#define USB3_UNI_PCS_ELECIDLE_DLY_SEL 0x09B8
+#define USB3_UNI_PCS_CMN_ACK_OUT_SEL 0x09BC
+#define USB3_UNI_PCS_ALIGN_DETECT_CONFIG1 0x09C0
+#define USB3_UNI_PCS_ALIGN_DETECT_CONFIG2 0x09C4
+#define USB3_UNI_PCS_ALIGN_DETECT_CONFIG3 0x09C8
+#define USB3_UNI_PCS_ALIGN_DETECT_CONFIG4 0x09CC
+#define USB3_UNI_PCS_PCS_TX_RX_CONFIG 0x09D0
+#define USB3_UNI_PCS_RX_IDLE_DTCT_CNTRL 0x09D4
+#define USB3_UNI_PCS_RX_DCC_CAL_CONFIG 0x09D8
+#define USB3_UNI_PCS_EQ_CONFIG1 0x09DC
+#define USB3_UNI_PCS_EQ_CONFIG2 0x09E0
+#define USB3_UNI_PCS_EQ_CONFIG3 0x09E4
+#define USB3_UNI_PCS_EQ_CONFIG4 0x09E8
+#define USB3_UNI_PCS_EQ_CONFIG5 0x09EC
+#define USB3_UNI_PCS_PCIE_INT_AUX_CLK_STATUS 0x0C00
+#define USB3_UNI_PCS_PCIE_OSC_DTCT_STATUS 0x0C04
+#define USB3_UNI_PCS_PCIE_POWER_STATE_CONFIG1 0x0C08
+#define USB3_UNI_PCS_PCIE_POWER_STATE_CONFIG2 0x0C0C
+#define USB3_UNI_PCS_PCIE_POWER_STATE_CONFIG3 0x0C10
+#define USB3_UNI_PCS_PCIE_POWER_STATE_CONFIG4 0x0C14
+#define USB3_UNI_PCS_PCIE_PCS_TX_RX_CONFIG 0x0C18
+#define USB3_UNI_PCS_PCIE_ENDPOINT_REFCLK_DRIVE 0x0C1C
+#define USB3_UNI_PCS_PCIE_ENDPOINT_REFCLK_CNTRL 0x0C20
+#define USB3_UNI_PCS_PCIE_EPCLK_PRE_PLL_LOCK_DLY_AUXCLK 0x0C24
+#define USB3_UNI_PCS_PCIE_EPCLK_DLY_COUNT_VAL_L 0x0C28
+#define USB3_UNI_PCS_PCIE_EPCLK_DLY_COUNT_VAL_H 0x0C2C
+#define USB3_UNI_PCS_PCIE_RX_IDLE_DTCT_CNTRL1 0x0C30
+#define USB3_UNI_PCS_PCIE_RX_IDLE_DTCT_CNTRL2 0x0C34
+#define USB3_UNI_PCS_PCIE_SIGDET_CNTRL 0x0C38
+#define USB3_UNI_PCS_PCIE_SIGDET_LOW_2_IDLE_TIME 0x0C3C
+#define USB3_UNI_PCS_PCIE_L1P1_WAKEUP_DLY_TIME_AUXCLK_L 0x0C40
+#define USB3_UNI_PCS_PCIE_L1P1_WAKEUP_DLY_TIME_AUXCLK_H 0x0C44
+#define USB3_UNI_PCS_PCIE_L1P2_WAKEUP_DLY_TIME_AUXCLK_L 0x0C48
+#define USB3_UNI_PCS_PCIE_L1P2_WAKEUP_DLY_TIME_AUXCLK_H 0x0C4C
+#define USB3_UNI_PCS_PCIE_INT_AUX_CLK_CONFIG1 0x0C50
+#define USB3_UNI_PCS_PCIE_INT_AUX_CLK_CONFIG2 0x0C54
+#define USB3_UNI_PCS_PCIE_OSC_DTCT_CONFIG1 0x0C58
+#define USB3_UNI_PCS_PCIE_OSC_DTCT_CONFIG2 0x0C5C
+#define USB3_UNI_PCS_PCIE_OSC_DTCT_CONFIG3 0x0C60
+#define USB3_UNI_PCS_PCIE_OSC_DTCT_CONFIG4 0x0C64
+#define USB3_UNI_PCS_PCIE_OSC_DTCT_CONFIG5 0x0C68
+#define USB3_UNI_PCS_PCIE_OSC_DTCT_CONFIG6 0x0C6C
+#define USB3_UNI_PCS_PCIE_OSC_DTCT_CONFIG7 0x0C70
+#define USB3_UNI_PCS_PCIE_OSC_DTCT_MODE2_CONFIG1 0x0C74
+#define USB3_UNI_PCS_PCIE_OSC_DTCT_MODE2_CONFIG2 0x0C78
+#define USB3_UNI_PCS_PCIE_OSC_DTCT_MODE2_CONFIG3 0x0C7C
+#define USB3_UNI_PCS_PCIE_OSC_DTCT_MODE2_CONFIG4 0x0C80
+#define USB3_UNI_PCS_PCIE_OSC_DTCT_MODE2_CONFIG5 0x0C84
+#define USB3_UNI_PCS_PCIE_OSC_DTCT_MODE2_CONFIG6 0x0C88
+#define USB3_UNI_PCS_PCIE_OSC_DTCT_MODE2_CONFIG7 0x0C8C
+#define USB3_UNI_PCS_PCIE_OSC_DTCT_ACTIONS 0x0C90
+#define USB3_UNI_PCS_PCIE_LOCAL_FS 0x0C94
+#define USB3_UNI_PCS_PCIE_LOCAL_LF 0x0C98
+#define USB3_UNI_PCS_PCIE_LOCAL_FS_RS 0x0C9C
+#define USB3_UNI_PCS_PCIE_EQ_CONFIG1 0x0CA0
+#define USB3_UNI_PCS_PCIE_EQ_CONFIG2 0x0CA4
+#define USB3_UNI_PCS_PCIE_PRESET_P0_P1_PRE 0x0CA8
+#define USB3_UNI_PCS_PCIE_PRESET_P2_P3_PRE 0x0CAC
+#define USB3_UNI_PCS_PCIE_PRESET_P4_P5_PRE 0x0CB0
+#define USB3_UNI_PCS_PCIE_PRESET_P6_P7_PRE 0x0CB4
+#define USB3_UNI_PCS_PCIE_PRESET_P8_P9_PRE 0x0CB8
+#define USB3_UNI_PCS_PCIE_PRESET_P10_PRE 0x0CBC
+#define USB3_UNI_PCS_PCIE_PRESET_P1_P3_PRE_RS 0x0CC0
+#define USB3_UNI_PCS_PCIE_PRESET_P4_P5_PRE_RS 0x0CC4
+#define USB3_UNI_PCS_PCIE_PRESET_P6_P9_PRE_RS 0x0CC8
+#define USB3_UNI_PCS_PCIE_PRESET_P0_P1_POST 0x0CCC
+#define USB3_UNI_PCS_PCIE_PRESET_P2_P3_POST 0x0CD0
+#define USB3_UNI_PCS_PCIE_PRESET_P4_P5_POST 0x0CD4
+#define USB3_UNI_PCS_PCIE_PRESET_P6_P7_POST 0x0CD8
+#define USB3_UNI_PCS_PCIE_PRESET_P8_P9_POST 0x0CDC
+#define USB3_UNI_PCS_PCIE_PRESET_P10_POST 0x0CE0
+#define USB3_UNI_PCS_PCIE_PRESET_P1_P3_POST_RS 0x0CE4
+#define USB3_UNI_PCS_PCIE_PRESET_P4_P5_POST_RS 0x0CE8
+#define USB3_UNI_PCS_PCIE_PRESET_P6_P9_POST_RS 0x0CEC
+#define USB3_UNI_PCS_PCIE_RXEQEVAL_TIME 0x0CF0
+#define USB3_UNI_PCS_USB3_POWER_STATE_CONFIG1 0x0E00
+#define USB3_UNI_PCS_USB3_AUTONOMOUS_MODE_STATUS 0x0E04
+#define USB3_UNI_PCS_USB3_AUTONOMOUS_MODE_CTRL 0x0E08
+#define USB3_UNI_PCS_USB3_AUTONOMOUS_MODE_CTRL2 0x0E0C
+#define USB3_UNI_PCS_USB3_LFPS_RXTERM_IRQ_SOURCE_STATUS 0x0E10
+#define USB3_UNI_PCS_USB3_LFPS_RXTERM_IRQ_CLEAR 0x0E14
+#define USB3_UNI_PCS_USB3_LFPS_DET_HIGH_COUNT_VAL 0x0E18
+#define USB3_UNI_PCS_USB3_LFPS_TX_ECSTART 0x0E1C
+#define USB3_UNI_PCS_USB3_LFPS_PER_TIMER_VAL 0x0E20
+#define USB3_UNI_PCS_USB3_LFPS_TX_END_CNT_U3_START 0x0E24
+#define USB3_UNI_PCS_USB3_RXEQTRAINING_LOCK_TIME 0x0E28
+#define USB3_UNI_PCS_USB3_RXEQTRAINING_WAIT_TIME 0x0E2C
+#define USB3_UNI_PCS_USB3_RXEQTRAINING_CTLE_TIME 0x0E30
+#define USB3_UNI_PCS_USB3_RXEQTRAINING_WAIT_TIME_S2 0x0E34
+#define USB3_UNI_PCS_USB3_RXEQTRAINING_DFE_TIME_S2 0x0E38
+#define USB3_UNI_PCS_USB3_RCVR_DTCT_DLY_U3_L 0x0E3C
+#define USB3_UNI_PCS_USB3_RCVR_DTCT_DLY_U3_H 0x0E40
+#define USB3_UNI_PCS_USB3_ARCVR_DTCT_EN_PERIOD 0x0E44
+#define USB3_UNI_PCS_USB3_ARCVR_DTCT_CM_DLY 0x0E48
+#define USB3_UNI_PCS_USB3_TXONESZEROS_RUN_LENGTH 0x0E4C
+#define USB3_UNI_PCS_USB3_ALFPS_DEGLITCH_VAL 0x0E50
+#define USB3_UNI_PCS_USB3_SIGDET_STARTUP_TIMER_VAL 0x0E54
+#define USB3_UNI_PCS_USB3_TEST_CONTROL 0x0E58
+#define USB3_UNI_PCS_USB3_RXTERMINATION_DLY_SEL 0x0E5C
+
+#endif /* _DT_BINDINGS_PHY_QCOM_KONA_QMP_USB_H */
diff --git a/include/linux/input/qpnp-power-on.h b/include/linux/input/qpnp-power-on.h
index 443d513..d80ab2b 100644
--- a/include/linux/input/qpnp-power-on.h
+++ b/include/linux/input/qpnp-power-on.h
@@ -1,6 +1,6 @@
-/* SPDX-License-Identifier: GPL-2.0 */
+/* SPDX-License-Identifier: GPL-2.0-only */
/*
- * Copyright (c) 2012-2015, 2017-2018, The Linux Foundation.
+ * Copyright (c) 2012-2015, 2017-2019, The Linux Foundation.
* All rights reserved.
*/
@@ -63,33 +63,46 @@ int qpnp_pon_trigger_config(enum pon_trigger_source pon_src, bool enable);
int qpnp_pon_wd_config(bool enable);
int qpnp_pon_set_restart_reason(enum pon_restart_reason reason);
bool qpnp_pon_check_hard_reset_stored(void);
+int qpnp_pon_modem_pwr_off(enum pon_power_off_type type);
#else
+
static int qpnp_pon_system_pwr_off(enum pon_power_off_type type)
{
return -ENODEV;
}
+
static inline int qpnp_pon_is_warm_reset(void)
{
return -ENODEV;
}
+
static inline int qpnp_pon_trigger_config(enum pon_trigger_source pon_src,
bool enable)
{
return -ENODEV;
}
+
int qpnp_pon_wd_config(bool enable)
{
return -ENODEV;
}
+
static inline int qpnp_pon_set_restart_reason(enum pon_restart_reason reason)
{
return -ENODEV;
}
+
static inline bool qpnp_pon_check_hard_reset_stored(void)
{
return false;
}
+
+static inline int qpnp_pon_modem_pwr_off(enum pon_power_off_type type)
+{
+ return -ENODEV;
+}
+
#endif
#endif
diff --git a/include/trace/events/sched.h b/include/trace/events/sched.h
index 43f5f0e..50ab515 100644
--- a/include/trace/events/sched.h
+++ b/include/trace/events/sched.h
@@ -261,9 +261,12 @@ TRACE_EVENT(sched_migrate_task,
* Tracepoint for load balancing:
*/
#ifdef CONFIG_SMP
-#if NR_CPUS > 32
-#error "Unsupported NR_CPUS for lb tracepoint."
-#endif
+#if NR_CPUS > BITS_PER_LONG
+#define trace_sched_load_balance_sg_stats(...)
+#define trace_sched_load_balance_stats(...)
+#define trace_sched_load_balance(...)
+#define trace_sched_load_balance_nohz_kick(...)
+#else
TRACE_EVENT(sched_load_balance,
TP_PROTO(int cpu, enum cpu_idle_type idle, int balance,
@@ -436,7 +439,8 @@ TRACE_EVENT(sched_load_balance_stats,
__entry->lavg_load, __entry->llpt, __entry->sds_avg,
__entry->imbalance)
);
-#endif
+#endif /* NR_CPUS > BITS_PER_LONG */
+#endif /* CONFIG_SMP */
DECLARE_EVENT_CLASS(sched_process_template,
diff --git a/include/trace/events/walt.h b/include/trace/events/walt.h
index 320641e..2c10a02 100644
--- a/include/trace/events/walt.h
+++ b/include/trace/events/walt.h
@@ -545,11 +545,11 @@ DEFINE_EVENT(sched_cpu_load, sched_cpu_load_lb,
TRACE_EVENT(sched_load_to_gov,
TP_PROTO(struct rq *rq, u64 aggr_grp_load, u32 tt_load,
- u64 freq_aggr_thresh, u64 load, int policy,
+ int freq_aggr, u64 load, int policy,
int big_task_rotation,
unsigned int sysctl_sched_little_cluster_coloc_fmin_khz,
u64 coloc_boost_load),
- TP_ARGS(rq, aggr_grp_load, tt_load, freq_aggr_thresh, load, policy,
+ TP_ARGS(rq, aggr_grp_load, tt_load, freq_aggr, load, policy,
big_task_rotation, sysctl_sched_little_cluster_coloc_fmin_khz,
coloc_boost_load),
@@ -558,7 +558,7 @@ TRACE_EVENT(sched_load_to_gov,
__field(int, policy)
__field(int, ed_task_pid)
__field(u64, aggr_grp_load)
- __field(u64, freq_aggr_thresh)
+ __field(int, freq_aggr)
__field(u64, tt_load)
__field(u64, rq_ps)
__field(u64, grp_rq_ps)
@@ -577,7 +577,7 @@ TRACE_EVENT(sched_load_to_gov,
__entry->policy = policy;
__entry->ed_task_pid = rq->ed_task ? rq->ed_task->pid : -1;
__entry->aggr_grp_load = aggr_grp_load;
- __entry->freq_aggr_thresh = freq_aggr_thresh;
+ __entry->freq_aggr = freq_aggr;
__entry->tt_load = tt_load;
__entry->rq_ps = rq->prev_runnable_sum;
__entry->grp_rq_ps = rq->grp_time.prev_runnable_sum;
@@ -592,9 +592,9 @@ TRACE_EVENT(sched_load_to_gov,
__entry->coloc_boost_load = coloc_boost_load;
),
- TP_printk("cpu=%d policy=%d ed_task_pid=%d aggr_grp_load=%llu freq_aggr_thresh=%llu tt_load=%llu rq_ps=%llu grp_rq_ps=%llu nt_ps=%llu grp_nt_ps=%llu pl=%llu load=%llu big_task_rotation=%d sysctl_sched_little_cluster_coloc_fmin_khz=%u coloc_boost_load=%llu",
+ TP_printk("cpu=%d policy=%d ed_task_pid=%d aggr_grp_load=%llu freq_aggr=%d tt_load=%llu rq_ps=%llu grp_rq_ps=%llu nt_ps=%llu grp_nt_ps=%llu pl=%llu load=%llu big_task_rotation=%d sysctl_sched_little_cluster_coloc_fmin_khz=%u coloc_boost_load=%llu",
__entry->cpu, __entry->policy, __entry->ed_task_pid,
- __entry->aggr_grp_load, __entry->freq_aggr_thresh,
+ __entry->aggr_grp_load, __entry->freq_aggr,
__entry->tt_load, __entry->rq_ps, __entry->grp_rq_ps,
__entry->nt_ps, __entry->grp_nt_ps, __entry->pl, __entry->load,
__entry->big_task_rotation,
diff --git a/kernel/sched/boost.c b/kernel/sched/boost.c
index 9e9cb11..29b0b682 100644
--- a/kernel/sched/boost.c
+++ b/kernel/sched/boost.c
@@ -4,6 +4,7 @@
*/
#include "sched.h"
+#include "walt.h"
#include <linux/of.h>
#include <linux/sched/core_ctl.h>
#include <trace/events/sched.h>
@@ -19,7 +20,6 @@ unsigned int sysctl_sched_boost;
static enum sched_boost_policy boost_policy;
static enum sched_boost_policy boost_policy_dt = SCHED_BOOST_NONE;
static DEFINE_MUTEX(boost_mutex);
-static unsigned int freq_aggr_threshold_backup;
static int boost_refcount[MAX_NUM_BOOST_TYPE];
/*
@@ -69,6 +69,7 @@ static void _sched_set_boost(int type)
case NO_BOOST: /* All boost clear */
if (boost_refcount[FULL_THROTTLE_BOOST] > 0) {
core_ctl_set_boost(false);
+ walt_enable_frequency_aggregation(false);
boost_refcount[FULL_THROTTLE_BOOST] = 0;
}
if (boost_refcount[CONSERVATIVE_BOOST] > 0) {
@@ -76,8 +77,7 @@ static void _sched_set_boost(int type)
boost_refcount[CONSERVATIVE_BOOST] = 0;
}
if (boost_refcount[RESTRAINED_BOOST] > 0) {
- update_freq_aggregate_threshold(
- freq_aggr_threshold_backup);
+ walt_enable_frequency_aggregation(false);
boost_refcount[RESTRAINED_BOOST] = 0;
}
break;
@@ -87,6 +87,8 @@ static void _sched_set_boost(int type)
if (boost_refcount[FULL_THROTTLE_BOOST] == 1) {
core_ctl_set_boost(true);
restore_cgroup_boost_settings();
+ if (!boost_refcount[RESTRAINED_BOOST])
+ walt_enable_frequency_aggregation(true);
}
break;
@@ -99,10 +101,9 @@ static void _sched_set_boost(int type)
case RESTRAINED_BOOST:
boost_refcount[RESTRAINED_BOOST]++;
- if (boost_refcount[RESTRAINED_BOOST] == 1) {
- freq_aggr_threshold_backup =
- update_freq_aggregate_threshold(1);
- }
+ if (boost_refcount[RESTRAINED_BOOST] == 1 &&
+ !boost_refcount[FULL_THROTTLE_BOOST])
+ walt_enable_frequency_aggregation(true);
break;
case FULL_THROTTLE_BOOST_DISABLE:
@@ -112,6 +113,9 @@ static void _sched_set_boost(int type)
core_ctl_set_boost(false);
if (boost_refcount[CONSERVATIVE_BOOST] >= 1)
update_cgroup_boost_settings();
+ if (!boost_refcount[RESTRAINED_BOOST])
+ walt_enable_frequency_aggregation(
+ false);
}
}
break;
@@ -127,9 +131,9 @@ static void _sched_set_boost(int type)
case RESTRAINED_BOOST_DISABLE:
if (boost_refcount[RESTRAINED_BOOST] >= 1) {
boost_refcount[RESTRAINED_BOOST]--;
- if (!boost_refcount[RESTRAINED_BOOST])
- update_freq_aggregate_threshold(
- freq_aggr_threshold_backup);
+ if (!boost_refcount[RESTRAINED_BOOST] &&
+ !boost_refcount[FULL_THROTTLE_BOOST])
+ walt_enable_frequency_aggregation(false);
}
break;
diff --git a/kernel/sched/sched.h b/kernel/sched/sched.h
index 86831199..45a2f8d 100644
--- a/kernel/sched/sched.h
+++ b/kernel/sched/sched.h
@@ -2759,7 +2759,6 @@ extern int update_preferred_cluster(struct related_thread_group *grp,
struct task_struct *p, u32 old_load);
extern void set_preferred_cluster(struct related_thread_group *grp);
extern void add_new_task_to_grp(struct task_struct *new);
-extern unsigned int update_freq_aggregate_threshold(unsigned int threshold);
#define NO_BOOST 0
#define FULL_THROTTLE_BOOST 1
diff --git a/kernel/sched/walt.c b/kernel/sched/walt.c
index 8039269..e7add54 100644
--- a/kernel/sched/walt.c
+++ b/kernel/sched/walt.c
@@ -287,7 +287,7 @@ void fixup_walt_sched_stats_common(struct rq *rq, struct task_struct *p,
* C1 busy time = 5 + 5 + 6 = 16ms
*
*/
-__read_mostly int sched_freq_aggregate_threshold;
+__read_mostly bool sched_freq_aggr_en;
static u64
update_window_start(struct rq *rq, u64 wallclock, int event)
@@ -489,7 +489,6 @@ static u32 top_task_load(struct rq *rq)
u64 freq_policy_load(struct rq *rq)
{
unsigned int reporting_policy = sysctl_sched_freq_reporting_policy;
- int freq_aggr_thresh = sched_freq_aggregate_threshold;
struct sched_cluster *cluster = rq->cluster;
u64 aggr_grp_load = cluster->aggr_grp_load;
u64 load, tt_load = 0;
@@ -500,7 +499,7 @@ u64 freq_policy_load(struct rq *rq)
goto done;
}
- if (aggr_grp_load > freq_aggr_thresh)
+ if (sched_freq_aggr_en)
load = rq->prev_runnable_sum + aggr_grp_load;
else
load = rq->prev_runnable_sum + rq->grp_time.prev_runnable_sum;
@@ -523,7 +522,7 @@ u64 freq_policy_load(struct rq *rq)
}
done:
- trace_sched_load_to_gov(rq, aggr_grp_load, tt_load, freq_aggr_thresh,
+ trace_sched_load_to_gov(rq, aggr_grp_load, tt_load, sched_freq_aggr_en,
load, reporting_policy, walt_rotation_enabled,
sysctl_sched_little_cluster_coloc_fmin_khz,
coloc_boost_load);
@@ -2489,15 +2488,10 @@ static void transfer_busy_time(struct rq *rq, struct related_thread_group *grp,
*/
unsigned int __read_mostly sysctl_sched_enable_thread_grouping;
-/* Maximum allowed threshold before freq aggregation must be enabled */
-#define MAX_FREQ_AGGR_THRESH 1000
-
struct related_thread_group *related_thread_groups[MAX_NUM_CGROUP_COLOC_ID];
static LIST_HEAD(active_related_thread_groups);
DEFINE_RWLOCK(related_thread_group_lock);
-unsigned int __read_mostly sysctl_sched_freq_aggregate_threshold_pct;
-
/*
* Task groups whose aggregate demand on a cpu is more than
* sched_group_upmigrate need to be up-migrated if possible.
@@ -2649,23 +2643,6 @@ DEFINE_MUTEX(policy_mutex);
#define pct_to_real(tunable) \
(div64_u64((u64)tunable * (u64)max_task_load(), 100))
-unsigned int update_freq_aggregate_threshold(unsigned int threshold)
-{
- unsigned int old_threshold;
-
- mutex_lock(&policy_mutex);
-
- old_threshold = sysctl_sched_freq_aggregate_threshold_pct;
-
- sysctl_sched_freq_aggregate_threshold_pct = threshold;
- sched_freq_aggregate_threshold =
- pct_to_real(sysctl_sched_freq_aggregate_threshold_pct);
-
- mutex_unlock(&policy_mutex);
-
- return old_threshold;
-}
-
#define ADD_TASK 0
#define REM_TASK 1
@@ -2896,7 +2873,6 @@ static int __init create_default_coloc_group(void)
list_add(&grp->list, &active_related_thread_groups);
write_unlock_irqrestore(&related_thread_group_lock, flags);
- update_freq_aggregate_threshold(MAX_FREQ_AGGR_THRESH);
return 0;
}
late_initcall(create_default_coloc_group);
diff --git a/kernel/sched/walt.h b/kernel/sched/walt.h
index 496a8e5..44d1277 100644
--- a/kernel/sched/walt.h
+++ b/kernel/sched/walt.h
@@ -39,7 +39,6 @@ extern struct mutex cluster_lock;
extern rwlock_t related_thread_group_lock;
extern __read_mostly unsigned int sched_ravg_hist_size;
extern __read_mostly unsigned int sched_freq_aggregate;
-extern __read_mostly int sched_freq_aggregate_threshold;
extern __read_mostly unsigned int sched_window_stats_policy;
extern __read_mostly unsigned int sched_group_upmigrate;
extern __read_mostly unsigned int sched_group_downmigrate;
@@ -298,6 +297,12 @@ extern void walt_rotation_checkpoint(int nr_big);
extern unsigned int walt_rotation_enabled;
extern unsigned int walt_get_default_coloc_group_load(void);
+extern __read_mostly bool sched_freq_aggr_en;
+static inline void walt_enable_frequency_aggregation(bool enable)
+{
+ sched_freq_aggr_en = enable;
+}
+
#else /* CONFIG_SCHED_WALT */
static inline void walt_sched_init_rq(struct rq *rq) { }
diff --git a/net/netlink/genetlink.c b/net/netlink/genetlink.c
index 25eeb6d..edcc786 100644
--- a/net/netlink/genetlink.c
+++ b/net/netlink/genetlink.c
@@ -963,7 +963,7 @@ static struct genl_family genl_ctrl __ro_after_init = {
static int genl_bind(struct net *net, int group)
{
struct genl_family *f;
- int err = -ENOENT;
+ int err = 0;
unsigned int id;
down_read(&cb_lock);
