From 9a1e9a92e975274f4b3507922b7ab4805defe975 Mon Sep 17 00:00:00 2001 From: Naveen Kumar S Date: Wed, 20 Jul 2016 16:47:05 +0530 Subject: video: tegra: hdmi: choose clk rate above 100MHz pll_d2 runs at a minimum of 100MHz on T124. Update logic to choose parent clock rate more than 100MHz. e.g.: A mode with 32MHz pclk chooses parent clock of 96MHz with a divider of 3.0, which fails as pll_d can't be pulled below 100MHz. bug 1785365 Change-Id: I12400549a3ed42295ddd46adcb6493232f2d896a Signed-off-by: Naveen Kumar S Reviewed-on: http://git-master/r/1184235 Reviewed-by: Automatic_Commit_Validation_User GVS: Gerrit_Virtual_Submit Reviewed-by: Aleksandr Frid Reviewed-by: Aly Hirani Reviewed-by: Venu Byravarasu Reviewed-by: Bibek Basu --- drivers/video/tegra/dc/hdmi.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/drivers/video/tegra/dc/hdmi.c b/drivers/video/tegra/dc/hdmi.c index cb1a6c838839..eb8cf5d83852 100644 --- a/drivers/video/tegra/dc/hdmi.c +++ b/drivers/video/tegra/dc/hdmi.c @@ -4,7 +4,7 @@ * Copyright (C) 2010 Google, Inc. * Author: Erik Gilling * - * Copyright (c) 2010-2015, NVIDIA CORPORATION, All rights reserved. + * Copyright (c) 2010-2016, NVIDIA CORPORATION, All rights reserved. * * This software is licensed under the terms of the GNU General Public * License version 2, as published by the Free Software Foundation, and @@ -2219,6 +2219,10 @@ static unsigned long tegra12x_hdmi_determine_parent( f = m % 1000; /* fractional parts */ f = (0 == f) ? f : (1000 - f); /* round-up */ if (0 == f) { /* exact match */ + if ((ref / 2 * b) < 100000000) { + /* parent clock runs at a minumum of 100MHz */ + continue; + } b = n; fr = f; break; -- cgit v1.2.3 From bc15da6c6fc2f50109e866fe053b035721a23c3a Mon Sep 17 00:00:00 2001 From: Deepak Nibade Date: Mon, 27 Jun 2016 14:03:15 +0530 Subject: video: tegra: host: fix possible overflow with num_syncpt_incrs We allocate below without checking if num_syncpt_incrs is valid or not struct nvhost_ctrl_sync_fence_info pts[num_syncpt_incrs]; If UMD passes a negative value in num_syncpt_incrs, then it is possible to corrupt the stack Hence, first check if num_syncpt_incrs is valid (i.e. not negative) And then allocate the array dynamically using kzalloc instead of allocating it on stack Bug 1781393 Change-Id: I5389fd271149b457f63831a41c104c9814299ddf Signed-off-by: Deepak Nibade Reviewed-on: http://git-master/r/1171747 (cherry picked from commit 07fb347b4060a888b19df3524f36fcf7974a79d1) Reviewed-on: http://git-master/r/1172518 (cherry picked from commit 1db2d69b6abeb6fc9d4257db88f631d9c8aef74d) Reviewed-on: http://git-master/r/1190211 GVS: Gerrit_Virtual_Submit Reviewed-by: Jeetesh Burman Tested-by: Jeetesh Burman Reviewed-by: Arto Merilainen Reviewed-by: Bibek Basu Reviewed-by: Winnie Hsu --- drivers/video/tegra/host/bus_client.c | 14 +++++++++++++- 1 file changed, 13 insertions(+), 1 deletion(-) diff --git a/drivers/video/tegra/host/bus_client.c b/drivers/video/tegra/host/bus_client.c index 2bf11ed426c0..fb37a9e06ab3 100644 --- a/drivers/video/tegra/host/bus_client.c +++ b/drivers/video/tegra/host/bus_client.c @@ -402,6 +402,9 @@ static int nvhost_ioctl_channel_submit(struct nvhost_channel_userctx *ctx, if (num_syncpt_incrs > host->info.nb_pts) return -EINVAL; + if (num_cmdbufs < 0 || num_syncpt_incrs < 0) + return -EINVAL; + job = nvhost_job_alloc(ctx->ch, ctx->hwctx, num_cmdbufs, @@ -580,7 +583,15 @@ static int nvhost_ioctl_channel_submit(struct nvhost_channel_userctx *ctx, * syncpoint is used. */ if (args->flags & BIT(NVHOST_SUBMIT_FLAG_SYNC_FENCE_FD)) { - struct nvhost_ctrl_sync_fence_info pts[num_syncpt_incrs]; + struct nvhost_ctrl_sync_fence_info *pts; + + pts = kzalloc(num_syncpt_incrs * + sizeof(struct nvhost_ctrl_sync_fence_info), + GFP_KERNEL); + if (!pts) { + err = -ENOMEM; + goto fail; + } for (i = 0; i < num_syncpt_incrs; i++) { pts[i].id = job->sp[i].id; @@ -589,6 +600,7 @@ static int nvhost_ioctl_channel_submit(struct nvhost_channel_userctx *ctx, err = nvhost_sync_create_fence_fd(ctx->ch->dev, pts, num_syncpt_incrs, "fence", &args->fence); + kfree(pts); if (err) goto fail; } else if (num_syncpt_incrs == 1) -- cgit v1.2.3 From 964ef1d4d2932f4d2dc1d97459f0d7026cdccffd Mon Sep 17 00:00:00 2001 From: Deepak Nibade Date: Mon, 27 Jun 2016 14:13:26 +0530 Subject: video: tegra: host: fix integer overflow Below addition on 32 bit architecture machines could cause integer overflow since we will assign overflowed value to "num_unpins" s64 num_unpins = num_cmdbufs + num_relocs Fix this and other calculations by explicitly typecasting variables to u64 first Bug 1781393 Change-Id: Ib7d9c0be4ac61dc404512b4bb0331aa20a6978bc Signed-off-by: Deepak Nibade Reviewed-on: http://git-master/r/1171748 (cherry picked from commit 8f00b96c137b9c4cb43a8dbe2e153fae49524113) Reviewed-on: http://git-master/r/1172519 (cherry picked from commit 61229625b1e19d5a93a9458f04e0cce356dbdee3) Reviewed-on: http://git-master/r/1190218 Reviewed-by: Automatic_Commit_Validation_User GVS: Gerrit_Virtual_Submit Reviewed-by: Jeetesh Burman Tested-by: Jeetesh Burman Reviewed-by: Arto Merilainen Reviewed-by: Bibek Basu Reviewed-by: Winnie Hsu --- drivers/video/tegra/host/nvhost_job.c | 19 ++++++++++--------- 1 file changed, 10 insertions(+), 9 deletions(-) diff --git a/drivers/video/tegra/host/nvhost_job.c b/drivers/video/tegra/host/nvhost_job.c index 2100749d60dc..cd83b965a112 100644 --- a/drivers/video/tegra/host/nvhost_job.c +++ b/drivers/video/tegra/host/nvhost_job.c @@ -3,7 +3,7 @@ * * Tegra Graphics Host Job * - * Copyright (c) 2010-2014, NVIDIA CORPORATION. All rights reserved. + * Copyright (c) 2010-2016, NVIDIA CORPORATION. All rights reserved. * * This program is free software; you can redistribute it and/or modify it * under the terms and conditions of the GNU General Public License, @@ -38,21 +38,22 @@ static size_t job_size(u32 num_cmdbufs, u32 num_relocs, u32 num_waitchks, u32 num_syncpts) { - s64 num_unpins = num_cmdbufs + num_relocs; - s64 total; + u64 num_unpins = (u64)num_cmdbufs + (u64)num_relocs; + u64 total; total = sizeof(struct nvhost_job) - + num_relocs * sizeof(struct nvhost_reloc) - + num_relocs * sizeof(struct nvhost_reloc_shift) + + (u64)num_relocs * sizeof(struct nvhost_reloc) + + (u64)num_relocs * sizeof(struct nvhost_reloc_shift) + num_unpins * sizeof(struct nvhost_job_unpin) - + num_waitchks * sizeof(struct nvhost_waitchk) - + num_cmdbufs * sizeof(struct nvhost_job_gather) + + (u64)num_waitchks * sizeof(struct nvhost_waitchk) + + (u64)num_cmdbufs * sizeof(struct nvhost_job_gather) + num_unpins * sizeof(dma_addr_t) + num_unpins * sizeof(struct nvhost_pinid) - + num_syncpts * sizeof(struct nvhost_job_syncpt); + + (u64)num_syncpts * sizeof(struct nvhost_job_syncpt); - if(total > ULONG_MAX) + if (total > UINT_MAX) return 0; + return (size_t)total; } -- cgit v1.2.3 From 17db3ff7afbc5a92638f7d1d7d1d82767623fcc7 Mon Sep 17 00:00:00 2001 From: Peter Chiang Date: Mon, 4 Jul 2016 18:52:33 +0800 Subject: usb: gadget: tegra: Fix short packet issue Fix Tranaction Error due to short packet with ISO mult-transaction. Set new value in Override Mult field to support short packet Bug 1745903 Change-Id: I7409ba8943c2490afe714a0da9f7c05a63c949b4 Signed-off-by: Peter Chiang Reviewed-on: http://git-master/r/1175184 GVS: Gerrit_Virtual_Submit Reviewed-by: Laxman Dewangan --- drivers/usb/gadget/tegra_udc.c | 16 +++++++++++++++- drivers/usb/gadget/tegra_udc.h | 4 +++- 2 files changed, 18 insertions(+), 2 deletions(-) diff --git a/drivers/usb/gadget/tegra_udc.c b/drivers/usb/gadget/tegra_udc.c index d8efe20d5bb8..89ed8be52d16 100644 --- a/drivers/usb/gadget/tegra_udc.c +++ b/drivers/usb/gadget/tegra_udc.c @@ -1,5 +1,5 @@ /* - * Copyright (c) 2012-2014, NVIDIA CORPORATION. All rights reserved. + * Copyright (c) 2012-2016, NVIDIA CORPORATION. All rights reserved. * * Description: * High-speed USB device controller driver. @@ -911,6 +911,20 @@ static struct ep_td_struct *tegra_build_dtd(struct tegra_req *req, dtd->size_ioc_sts = cpu_to_le32(swap_temp); + /* The short packet happened with ISO multi-transaction */ + if (req->ep->ep.mult && ((req->ep->desc->bmAttributes & + 0x3) == USB_ENDPOINT_XFER_ISOC)) { + if (*length <= req->ep->ep.maxpacket) { + swap_temp = cpu_to_le32(dtd->size_ioc_sts); + swap_temp |= DTD_MULTO_MULTIPLIER_1; + dtd->size_ioc_sts = cpu_to_le32(swap_temp); + } else if (*length <= (req->ep->ep.maxpacket * + req->ep->ep.mult)) { + swap_temp = cpu_to_le32(dtd->size_ioc_sts); + swap_temp |= DTD_MULTO_MULTIPLIER_2; + dtd->size_ioc_sts = cpu_to_le32(swap_temp); + } + } mb(); VDBG("length = %d address= 0x%x", *length, (int)*dma); diff --git a/drivers/usb/gadget/tegra_udc.h b/drivers/usb/gadget/tegra_udc.h index a7fe163785ff..67484720bc31 100644 --- a/drivers/usb/gadget/tegra_udc.h +++ b/drivers/usb/gadget/tegra_udc.h @@ -1,5 +1,5 @@ /* - * Copyright (c) 2012-2014, NVIDIA CORPORATION. All rights reserved. + * Copyright (c) 2012-2016, NVIDIA CORPORATION. All rights reserved. * * Description: * High-speed USB device controller driver. @@ -321,6 +321,8 @@ /* Endpoint Transfer Descriptor bit Masks */ #define DTD_NEXT_TERMINATE 0x00000001 +#define DTD_MULTO_MULTIPLIER_1 0x00000400 +#define DTD_MULTO_MULTIPLIER_2 0x00000800 #define DTD_IOC 0x00008000 #define DTD_STATUS_ACTIVE 0x00000080 #define DTD_STATUS_HALTED 0x00000040 -- cgit v1.2.3 From 39d7779c3d24376c6162dd328b24f9d902a85bdb Mon Sep 17 00:00:00 2001 From: Jianqiang Zhao Date: Tue, 2 Aug 2016 11:57:13 +0800 Subject: quadd: fix stack info leak when getting capabilities Fix stack info leak when getting capabilities Bug 1797747 Change-Id: Ic39112748fb2f053e6963b88e46ba2d953390edf Signed-off-by: Jianqiang Zhao Reviewed-on: http://git-master/r/1205756 GVS: Gerrit_Virtual_Submit Tested-by: Bibek Basu Reviewed-by: Matthew Pedro --- drivers/misc/tegra-profiler/comm.c | 1 + 1 file changed, 1 insertion(+) diff --git a/drivers/misc/tegra-profiler/comm.c b/drivers/misc/tegra-profiler/comm.c index 80c84614081a..b8bbb2621841 100644 --- a/drivers/misc/tegra-profiler/comm.c +++ b/drivers/misc/tegra-profiler/comm.c @@ -483,6 +483,7 @@ device_ioctl(struct file *file, break; case IOCTL_GET_CAP: + memset(&cap, 0, sizeof(cap)); comm_ctx.control->get_capabilities(&cap); if (copy_to_user((void __user *)ioctl_param, &cap, sizeof(struct quadd_comm_cap))) { -- cgit v1.2.3 From 64d410cfe6de23abfcc060de096f658a254fa870 Mon Sep 17 00:00:00 2001 From: Jianqiang Zhao Date: Fri, 15 Jul 2016 16:58:55 +0800 Subject: tegra: quadd: fix stack information disclose bug fix stack information disclose bug Bug 1797747 Change-Id: I7d2d33b9dbe3e81e8bb33aa9d7401dbb50525dce Signed-off-by: Jianqiang Zhao Reviewed-on: http://git-master/r/1205757 GVS: Gerrit_Virtual_Submit Tested-by: Bibek Basu Reviewed-by: Matthew Pedro --- drivers/misc/tegra-profiler/comm.c | 1 + 1 file changed, 1 insertion(+) diff --git a/drivers/misc/tegra-profiler/comm.c b/drivers/misc/tegra-profiler/comm.c index b8bbb2621841..f99ee849fcff 100644 --- a/drivers/misc/tegra-profiler/comm.c +++ b/drivers/misc/tegra-profiler/comm.c @@ -494,6 +494,7 @@ device_ioctl(struct file *file, break; case IOCTL_GET_VERSION: + memset(&versions, 0, sizeof(versions)); strcpy((char *)versions.branch, QUADD_MODULE_BRANCH); strcpy((char *)versions.version, QUADD_MODULE_VERSION); -- cgit v1.2.3 From 08590cd62f8b63776f54cb8ad1b2d329e45341e5 Mon Sep 17 00:00:00 2001 From: Krishna Yarlagadda Date: Mon, 8 Feb 2016 16:47:35 +0530 Subject: spi: tegra: option to boost register access SPI register access for T210 and earlier chips depend on SPI clock frequency. Provided an option to set SPI clock at max frequency for register access. Bug 1675625 Change-Id: Ie52c83cd4602604822462d9f02ddf31ead83aafc Reviewed-on: http://git-master/r/1009782 (cherry picked from commit a2ccd28f2850538064668568432fee5d70a22e82) Signed-off-by: Krishna Yarlagadda Reviewed-on: http://git-master/r/1174581 Reviewed-by: Automatic_Commit_Validation_User GVS: Gerrit_Virtual_Submit Reviewed-by: Laxman Dewangan --- .../bindings/spi/nvidia,spi-tegra114.txt | 4 ++ drivers/spi/spi-tegra114.c | 63 ++++++++++++++++++++-- include/linux/spi/spi-tegra.h | 3 +- 3 files changed, 64 insertions(+), 6 deletions(-) diff --git a/Documentation/devicetree/bindings/spi/nvidia,spi-tegra114.txt b/Documentation/devicetree/bindings/spi/nvidia,spi-tegra114.txt index 2d961d8e3d69..04ed4dc8653c 100644 --- a/Documentation/devicetree/bindings/spi/nvidia,spi-tegra114.txt +++ b/Documentation/devicetree/bindings/spi/nvidia,spi-tegra114.txt @@ -12,6 +12,10 @@ Recommended properties: Documentation/devicetree/bindings/spi/spi-bus.txt Optional properties: - nvidia,clock-always-on: Enable clock of spi always. +- nvidia,boost-reg-access: In T210 and earlier chips SPI register access + is dependant on SPI clock frequency. Setting this option would + allow SPI clock frequency to be boosted. Benefitial when running + SPI at low frequencies with cpu based transfers. Default false. spi-client device controller properties: - nvidia,enable-hw-based-cs: (Boolean) Use the HW based CS if enabled. diff --git a/drivers/spi/spi-tegra114.c b/drivers/spi/spi-tegra114.c index 5f693d0ddfbc..252635e8ff0f 100644 --- a/drivers/spi/spi-tegra114.c +++ b/drivers/spi/spi-tegra114.c @@ -1,7 +1,7 @@ /* * SPI driver for NVIDIA's Tegra114 SPI Controller. * - * Copyright (c) 2013-2014, NVIDIA CORPORATION. All rights reserved. + * Copyright (c) 2013-2016, NVIDIA CORPORATION. All rights reserved. * * This program is free software; you can redistribute it and/or modify it * under the terms and conditions of the GNU General Public License, @@ -184,6 +184,7 @@ struct tegra_spi_data { phys_addr_t phys; unsigned irq; bool clock_always_on; + bool boost_reg_access; u32 spi_max_frequency; u32 cur_speed; @@ -233,6 +234,7 @@ struct tegra_spi_data { static int tegra_spi_runtime_suspend(struct device *dev); static int tegra_spi_runtime_resume(struct device *dev); +static int tegra_spi_set_clock_rate(struct tegra_spi_data *tspi, u32 speed); static inline unsigned long tegra_spi_readl(struct tegra_spi_data *tspi, unsigned long reg) @@ -503,6 +505,7 @@ static int tegra_spi_start_dma_based_transfer( unsigned int len; int ret = 0; unsigned long status; + u32 speed; /* Make sure that Rx and Tx fifo are empty */ status = tegra_spi_readl(tspi, SPI_FIFO_STATUS); @@ -562,6 +565,15 @@ static int tegra_spi_start_dma_based_transfer( return ret; } } + + if (tspi->boost_reg_access) { + speed = t->speed_hz ? t->speed_hz : + tspi->cur_spi->max_speed_hz; + ret = tegra_spi_set_clock_rate(tspi, speed); + if (ret < 0) + return ret; + } + tspi->is_curr_dma_xfer = true; tspi->dma_control_reg = val; @@ -575,6 +587,9 @@ static int tegra_spi_start_cpu_based_transfer( { unsigned long val; unsigned cur_words; + int ret = 0; + u32 speed; + if (tspi->cur_direction & DATA_DIR_TX) cur_words = tegra_spi_fill_tx_fifo_from_client_txbuf(tspi, t); @@ -594,6 +609,14 @@ static int tegra_spi_start_cpu_based_transfer( tegra_spi_writel(tspi, val, SPI_DMA_CTL); tspi->dma_control_reg = val; + if (tspi->boost_reg_access) { + speed = t->speed_hz ? t->speed_hz : + tspi->cur_spi->max_speed_hz; + ret = tegra_spi_set_clock_rate(tspi, speed); + if (ret < 0) + return ret; + } + tspi->is_curr_dma_xfer = false; val = tspi->command1_reg; val |= SPI_PIO; @@ -685,6 +708,22 @@ static void tegra_spi_deinit_dma_param(struct tegra_spi_data *tspi, dma_release_channel(dma_chan); } +static int tegra_spi_set_clock_rate(struct tegra_spi_data *tspi, u32 speed) +{ + int ret; + + if (speed == tspi->cur_speed) + return 0; + ret = clk_set_rate(tspi->clk, speed); + if (ret) { + dev_err(tspi->dev, "Failed to set clk freq %d\n", ret); + return -EINVAL; + } + tspi->cur_speed = speed; + + return 0; +} + static int tegra_spi_start_transfer_one(struct spi_device *spi, struct spi_transfer *t, bool is_first_of_msg, bool is_single_xfer) @@ -702,10 +741,13 @@ static int tegra_spi_start_transfer_one(struct spi_device *spi, speed = t->speed_hz ? t->speed_hz : spi->max_speed_hz; if (!speed) speed = tspi->spi_max_frequency; - if (speed != tspi->cur_speed) { - clk_set_rate(tspi->clk, speed); - tspi->cur_speed = speed; - } + /* set max clock for faster register access */ + if (tspi->boost_reg_access) + ret = tegra_spi_set_clock_rate(tspi, tspi->spi_max_frequency); + else + ret = tegra_spi_set_clock_rate(tspi, speed); + if (ret < 0) + return ret; tspi->cur_spi = spi; tspi->cur_pos = 0; @@ -1029,6 +1071,13 @@ static int tegra_spi_handle_message(struct tegra_spi_data *tspi, int ret = 0; long wait_status; + if (tspi->boost_reg_access) { + /* set max clock for faster register access */ + ret = tegra_spi_set_clock_rate(tspi, tspi->spi_max_frequency); + if (ret < 0) + return ret; + } + if (!tspi->is_curr_dma_xfer) { if (tspi->cur_direction & DATA_DIR_RX) tegra_spi_read_rx_fifo_to_client_rxbuf(tspi, xfer); @@ -1248,6 +1297,9 @@ static struct tegra_spi_platform_data *tegra_spi_parse_dt( if (of_find_property(np, "nvidia,clock-always-on", NULL)) pdata->is_clkon_always = true; + if (of_find_property(np, "nvidia,boost-reg-access", NULL)) + pdata->boost_reg_access = true; + return pdata; } @@ -1306,6 +1358,7 @@ static int tegra_spi_probe(struct platform_device *pdev) tspi = spi_master_get_devdata(master); tspi->master = master; tspi->clock_always_on = pdata->is_clkon_always; + tspi->boost_reg_access = pdata->boost_reg_access; tspi->dev = &pdev->dev; spin_lock_init(&tspi->lock); diff --git a/include/linux/spi/spi-tegra.h b/include/linux/spi/spi-tegra.h index 4b9385d2c93d..10e773094ce8 100644 --- a/include/linux/spi/spi-tegra.h +++ b/include/linux/spi/spi-tegra.h @@ -1,7 +1,7 @@ /* * spi-tegra.h: SPI interface for Nvidia Tegra20 SLINK controller. * - * Copyright (C) 2011 NVIDIA Corporation + * Copyright (c) 2011-2016, NVIDIA CORPORATION. All rights reserved. * * This program is free software; you can redistribute it and/or modify * it under the terms of the GNU General Public License as published by @@ -25,6 +25,7 @@ struct tegra_spi_platform_data { int dma_req_sel; unsigned int spi_max_frequency; bool is_clkon_always; + bool boost_reg_access; }; /* -- cgit v1.2.3 From e2f168a5d0232c5d90af07bdf9e544c1e326f6ca Mon Sep 17 00:00:00 2001 From: Krishna Yarlagadda Date: Mon, 8 Feb 2016 19:18:17 +0530 Subject: spi: tegra: Reduce register access Reduce register accesses to SPI as it is dependent on slow, variable SPI clock frequency. Bug 1675619 Change-Id: I5d638b8f95d9207fbad1e30e21234fc7433e03b3 Reviewed-on: http://git-master/r/1009503 (cherry picked from commit 890a422a7b75507c33b53f1ca4c512f7911d61c4) Signed-off-by: Krishna Yarlagadda Reviewed-on: http://git-master/r/1174582 Reviewed-by: Automatic_Commit_Validation_User GVS: Gerrit_Virtual_Submit Reviewed-by: Laxman Dewangan --- drivers/spi/spi-tegra114.c | 62 ++++++++++++++++++++++++++++++++-------------- 1 file changed, 43 insertions(+), 19 deletions(-) diff --git a/drivers/spi/spi-tegra114.c b/drivers/spi/spi-tegra114.c index 252635e8ff0f..576bf2cef68c 100644 --- a/drivers/spi/spi-tegra114.c +++ b/drivers/spi/spi-tegra114.c @@ -161,13 +161,14 @@ #define SPI_DMA_TIMEOUT (msecs_to_jiffies(10000)) #define DEFAULT_SPI_DMA_BUF_LEN (16*1024) -#define TX_FIFO_EMPTY_COUNT_MAX SPI_TX_FIFO_EMPTY_COUNT(0x40) -#define RX_FIFO_FULL_COUNT_ZERO SPI_RX_FIFO_FULL_COUNT(0) +#define TX_FIFO_EMPTY_COUNT_MAX (0x40) +#define RX_FIFO_FULL_COUNT_ZERO (0) #define MAX_HOLD_CYCLES 16 #define SPI_DEFAULT_SPEED 25000000 #define MAX_CHIP_SELECT 4 #define SPI_FIFO_DEPTH 64 +#define SPI_FIFO_FLUSH_MAX_DELAY 2000 #ifdef CONFIG_ARCH_TEGRA_12x_SOC #define SPI_SPEED_TAP_DELAY_MARGIN 35000000 @@ -203,6 +204,7 @@ struct tegra_spi_data { unsigned max_buf_size; bool is_curr_dma_xfer; bool is_hw_based_cs; + bool transfer_in_progress; struct completion rx_dma_complete; struct completion tx_dma_complete; @@ -248,7 +250,7 @@ static inline void tegra_spi_writel(struct tegra_spi_data *tspi, writel(val, tspi->base + reg); /* Read back register to make sure that register writes completed */ - if (reg != SPI_TX_FIFO) + if ((reg == SPI_COMMAND1) && (val & SPI_PIO)) readl(tspi->base + SPI_COMMAND1); } @@ -258,11 +260,12 @@ static void tegra_spi_clear_status(struct tegra_spi_data *tspi) /* Write 1 to clear status register */ val = tegra_spi_readl(tspi, SPI_TRANS_STATUS); - tegra_spi_writel(tspi, val, SPI_TRANS_STATUS); + if (val & SPI_RDY) + tegra_spi_writel(tspi, val, SPI_TRANS_STATUS); /* Clear fifo status error if any */ - val = tegra_spi_readl(tspi, SPI_FIFO_STATUS); - if (val & SPI_ERR) + tspi->status_reg = tegra_spi_readl(tspi, SPI_FIFO_STATUS); + if (tspi->status_reg & SPI_ERR) tegra_spi_writel(tspi, SPI_ERR | SPI_FIFO_ERROR, SPI_FIFO_STATUS); } @@ -307,7 +310,6 @@ static unsigned tegra_spi_fill_tx_fifo_from_client_txbuf( { unsigned nbytes; unsigned tx_empty_count; - unsigned long fifo_status; unsigned max_n_32bit; unsigned i, count; unsigned long x; @@ -315,8 +317,7 @@ static unsigned tegra_spi_fill_tx_fifo_from_client_txbuf( unsigned fifo_words_left; u8 *tx_buf = (u8 *)t->tx_buf + tspi->cur_tx_pos; - fifo_status = tegra_spi_readl(tspi, SPI_FIFO_STATUS); - tx_empty_count = SPI_TX_FIFO_EMPTY_COUNT(fifo_status); + tx_empty_count = TX_FIFO_EMPTY_COUNT_MAX; if (tspi->is_packed) { fifo_words_left = tx_empty_count * tspi->words_per_32bit; @@ -356,7 +357,7 @@ static unsigned int tegra_spi_read_rx_fifo_to_client_rxbuf( unsigned len; u8 *rx_buf = (u8 *)t->rx_buf + tspi->cur_rx_pos; - fifo_status = tegra_spi_readl(tspi, SPI_FIFO_STATUS); + fifo_status = tspi->status_reg; rx_full_count = SPI_RX_FIFO_FULL_COUNT(fifo_status); if (tspi->is_packed) { len = tspi->curr_dma_words * tspi->bytes_per_word; @@ -498,22 +499,43 @@ static int tegra_spi_start_rx_dma(struct tegra_spi_data *tspi, int len) return 0; } -static int tegra_spi_start_dma_based_transfer( - struct tegra_spi_data *tspi, struct spi_transfer *t) +static int tegra_spi_clear_fifo(struct tegra_spi_data *tspi) { - unsigned long val; - unsigned int len; - int ret = 0; unsigned long status; - u32 speed; + int cnt = SPI_FIFO_FLUSH_MAX_DELAY; /* Make sure that Rx and Tx fifo are empty */ - status = tegra_spi_readl(tspi, SPI_FIFO_STATUS); + status = tspi->status_reg; if ((status & SPI_FIFO_EMPTY) != SPI_FIFO_EMPTY) { + /* flush the fifo */ + status |= (SPI_RX_FIFO_FLUSH | SPI_TX_FIFO_FLUSH); + tegra_spi_writel(tspi, status, SPI_FIFO_STATUS); + do { + status = tegra_spi_readl(tspi, SPI_FIFO_STATUS); + if ((status & SPI_FIFO_EMPTY) == SPI_FIFO_EMPTY) { + tspi->status_reg = status; + return 0; + } + udelay(1); + } while (cnt--); dev_err(tspi->dev, "Rx/Tx fifo are not empty status 0x%08lx\n", status); return -EIO; } + return 0; +} + +static int tegra_spi_start_dma_based_transfer( + struct tegra_spi_data *tspi, struct spi_transfer *t) +{ + unsigned long val; + unsigned int len; + int ret = 0; + u32 speed; + + ret = tegra_spi_clear_fifo(tspi); + if (ret != 0) + return ret; val = SPI_DMA_BLK_SET(tspi->curr_dma_words - 1); tegra_spi_writel(tspi, val, SPI_DMA_BLK); @@ -876,6 +898,8 @@ static int tegra_spi_start_transfer_one(struct spi_device *spi, dev_dbg(tspi->dev, "The def 0x%x and written 0x%lx\n", tspi->def_command1_reg, command1); + tspi->status_reg = tegra_spi_readl(tspi, SPI_FIFO_STATUS); + if (total_fifo_words > SPI_FIFO_DEPTH) ret = tegra_spi_start_dma_based_transfer(tspi, t); else @@ -1034,6 +1058,7 @@ static int tegra_spi_wait_on_message_xfer(struct tegra_spi_data *tspi) } if (tspi->tx_status || tspi->rx_status) { dev_err(tspi->dev, "Error in Transfer\n"); + tegra_spi_clear_fifo(tspi); ret = -EIO; } @@ -1253,7 +1278,7 @@ static irqreturn_t tegra_spi_isr(int irq, void *context_data) { struct tegra_spi_data *tspi = context_data; - tspi->status_reg = tegra_spi_readl(tspi, SPI_FIFO_STATUS); + tegra_spi_clear_status(tspi); if (tspi->cur_direction & DATA_DIR_TX) tspi->tx_status = tspi->status_reg & (SPI_TX_FIFO_UNF | SPI_TX_FIFO_OVF); @@ -1267,7 +1292,6 @@ static irqreturn_t tegra_spi_isr(int irq, void *context_data) dev_err(tspi->dev, "spurious interrupt, status_reg = 0x%x\n", tspi->status_reg); - tegra_spi_clear_status(tspi); if (!tspi->is_curr_dma_xfer) handle_cpu_based_err_xfer(tspi); else -- cgit v1.2.3 From d0080959ebe08f3b4a0f0453eaa8c8c9dff4ae9d Mon Sep 17 00:00:00 2001 From: Krishna Yarlagadda Date: Tue, 17 Nov 2015 19:31:22 +0530 Subject: spi: tegra: support polling mode Added support to use polling mode instead of interrupts through a property in dt Bug 1679083 Change-Id: Ic82ab592822cc96bacda05124d38ddd913e09af9 Reviewed-on: http://git-master/r/840233 (cherry picked from commit cd1c4db5adc8317572106099da37fa434245e699) Reviewed-on: http://git-master/r/1009988 (cherry picked from commit b29ce03a6b7ebb306ff157640470dd5ab99c6f6b) Signed-off-by: Krishna Yarlagadda Reviewed-on: http://git-master/r/1175213 Reviewed-by: Matthew Pedro Tested-by: Matthew Pedro --- .../bindings/spi/nvidia,spi-tegra114.txt | 1 + drivers/spi/spi-tegra114.c | 84 ++++++++++++++++++---- include/linux/spi/spi-tegra.h | 1 + 3 files changed, 74 insertions(+), 12 deletions(-) diff --git a/Documentation/devicetree/bindings/spi/nvidia,spi-tegra114.txt b/Documentation/devicetree/bindings/spi/nvidia,spi-tegra114.txt index 04ed4dc8653c..e3c264d90502 100644 --- a/Documentation/devicetree/bindings/spi/nvidia,spi-tegra114.txt +++ b/Documentation/devicetree/bindings/spi/nvidia,spi-tegra114.txt @@ -12,6 +12,7 @@ Recommended properties: Documentation/devicetree/bindings/spi/spi-bus.txt Optional properties: - nvidia,clock-always-on: Enable clock of spi always. +- nvidia,polling-mode: Use polling method instead of interrupts - nvidia,boost-reg-access: In T210 and earlier chips SPI register access is dependant on SPI clock frequency. Setting this option would allow SPI clock frequency to be boosted. Benefitial when running diff --git a/drivers/spi/spi-tegra114.c b/drivers/spi/spi-tegra114.c index 576bf2cef68c..736d6f68d757 100644 --- a/drivers/spi/spi-tegra114.c +++ b/drivers/spi/spi-tegra114.c @@ -174,6 +174,7 @@ #define SPI_SPEED_TAP_DELAY_MARGIN 35000000 #define SPI_DEFAULT_RX_TAP_DELAY 10 #endif +#define SPI_POLL_TIMEOUT 10000 struct tegra_spi_data { struct device *dev; @@ -185,6 +186,7 @@ struct tegra_spi_data { phys_addr_t phys; unsigned irq; bool clock_always_on; + bool polling_mode; bool boost_reg_access; u32 spi_max_frequency; u32 cur_speed; @@ -236,6 +238,7 @@ struct tegra_spi_data { static int tegra_spi_runtime_suspend(struct device *dev); static int tegra_spi_runtime_resume(struct device *dev); +static int tegra_spi_status_poll(struct tegra_spi_data *tspi); static int tegra_spi_set_clock_rate(struct tegra_spi_data *tspi, u32 speed); static inline unsigned long tegra_spi_readl(struct tegra_spi_data *tspi, @@ -554,11 +557,12 @@ static int tegra_spi_start_dma_based_transfer( else val |= SPI_TX_TRIG_8 | SPI_RX_TRIG_8; - if (tspi->cur_direction & DATA_DIR_TX) - val |= SPI_IE_TX; - - if (tspi->cur_direction & DATA_DIR_RX) - val |= SPI_IE_RX; + if (!tspi->polling_mode) { + if (tspi->cur_direction & DATA_DIR_TX) + val |= SPI_IE_TX; + if (tspi->cur_direction & DATA_DIR_RX) + val |= SPI_IE_RX; + } tegra_spi_writel(tspi, val, SPI_DMA_CTL); tspi->dma_control_reg = val; @@ -622,11 +626,12 @@ static int tegra_spi_start_cpu_based_transfer( tegra_spi_writel(tspi, val, SPI_DMA_BLK); val = 0; - if (tspi->cur_direction & DATA_DIR_TX) - val |= SPI_IE_TX; - - if (tspi->cur_direction & DATA_DIR_RX) - val |= SPI_IE_RX; + if (!tspi->polling_mode) { + if (tspi->cur_direction & DATA_DIR_TX) + val |= SPI_IE_TX; + if (tspi->cur_direction & DATA_DIR_RX) + val |= SPI_IE_RX; + } tegra_spi_writel(tspi, val, SPI_DMA_CTL); tspi->dma_control_reg = val; @@ -1042,8 +1047,11 @@ static int tegra_spi_wait_on_message_xfer(struct tegra_spi_data *tspi) { int ret; - ret = wait_for_completion_timeout(&tspi->xfer_completion, - SPI_DMA_TIMEOUT); + if (tspi->polling_mode) + ret = tegra_spi_status_poll(tspi); + else + ret = wait_for_completion_timeout(&tspi->xfer_completion, + SPI_DMA_TIMEOUT); if (WARN_ON(ret == 0)) { dev_err(tspi->dev, "spi trasfer timeout, err %d\n", ret); @@ -1278,6 +1286,9 @@ static irqreturn_t tegra_spi_isr(int irq, void *context_data) { struct tegra_spi_data *tspi = context_data; + if (tspi->polling_mode) + dev_warn(tspi->dev, "interrupt raised in polling mode\n"); + tegra_spi_clear_status(tspi); if (tspi->cur_direction & DATA_DIR_TX) tspi->tx_status = tspi->status_reg & @@ -1301,6 +1312,51 @@ static irqreturn_t tegra_spi_isr(int irq, void *context_data) return IRQ_HANDLED; } +static int tegra_spi_status_poll(struct tegra_spi_data *tspi) +{ + unsigned int status; + unsigned long timeout; + + timeout = SPI_POLL_TIMEOUT; + /* + * Read register would take between 1~3us and 1us delay added in loop + * Calculate timeout taking this into consideration + */ + do { + status = tegra_spi_readl(tspi, SPI_TRANS_STATUS); + if (status & SPI_RDY) + break; + timeout--; + udelay(1); + } while (timeout); + + if (!timeout) { + dev_err(tspi->dev, "transfer timeout (polling)\n"); + return 0; + } + + tegra_spi_clear_status(tspi); + if (tspi->cur_direction & DATA_DIR_TX) + tspi->tx_status = tspi->status_reg & + (SPI_TX_FIFO_UNF | SPI_TX_FIFO_OVF); + + if (tspi->cur_direction & DATA_DIR_RX) + tspi->rx_status = tspi->status_reg & + (SPI_RX_FIFO_OVF | SPI_RX_FIFO_UNF); + + if (!(tspi->cur_direction & DATA_DIR_TX) && + !(tspi->cur_direction & DATA_DIR_RX)) + dev_err(tspi->dev, "spurious interrupt, status_reg = 0x%x\n", + tspi->status_reg); + + if (!tspi->is_curr_dma_xfer) + handle_cpu_based_err_xfer(tspi); + else + handle_dma_based_err_xfer(tspi); + + return timeout; +} + static struct tegra_spi_platform_data *tegra_spi_parse_dt( struct platform_device *pdev) { @@ -1321,6 +1377,9 @@ static struct tegra_spi_platform_data *tegra_spi_parse_dt( if (of_find_property(np, "nvidia,clock-always-on", NULL)) pdata->is_clkon_always = true; + if (of_find_property(np, "nvidia,polling-mode", NULL)) + pdata->is_polling_mode = true; + if (of_find_property(np, "nvidia,boost-reg-access", NULL)) pdata->boost_reg_access = true; @@ -1382,6 +1441,7 @@ static int tegra_spi_probe(struct platform_device *pdev) tspi = spi_master_get_devdata(master); tspi->master = master; tspi->clock_always_on = pdata->is_clkon_always; + tspi->polling_mode = pdata->is_polling_mode; tspi->boost_reg_access = pdata->boost_reg_access; tspi->dev = &pdev->dev; spin_lock_init(&tspi->lock); diff --git a/include/linux/spi/spi-tegra.h b/include/linux/spi/spi-tegra.h index 10e773094ce8..3e0203c2a671 100644 --- a/include/linux/spi/spi-tegra.h +++ b/include/linux/spi/spi-tegra.h @@ -25,6 +25,7 @@ struct tegra_spi_platform_data { int dma_req_sel; unsigned int spi_max_frequency; bool is_clkon_always; + bool is_polling_mode; bool boost_reg_access; }; -- cgit v1.2.3 From 70ae2d44a04c5a3cd5b036d5a5181ddce5cd5fc8 Mon Sep 17 00:00:00 2001 From: Preetham Chandru R Date: Fri, 19 Aug 2016 12:14:25 +0530 Subject: ata: ahci_tegra: disable devslp Devslp is not POR for T124 anymore. Bug 200231146 Change-Id: Ia5380a17d545d3082a31c5b16b6946fa0e7ce4d5 Signed-off-by: Preetham Chandru R Reviewed-on: http://git-master/r/1207452 Tested-by: Bibek Basu Reviewed-by: Matthew Pedro --- drivers/ata/ahci-tegra.c | 10 ++++------ 1 file changed, 4 insertions(+), 6 deletions(-) diff --git a/drivers/ata/ahci-tegra.c b/drivers/ata/ahci-tegra.c index 791679c2a419..3c93eb831fc4 100644 --- a/drivers/ata/ahci-tegra.c +++ b/drivers/ata/ahci-tegra.c @@ -1081,12 +1081,10 @@ static int tegra_ahci_controller_init(struct tegra_ahci_host_priv *tegra_hpriv, val &= ~NVA2SATA_OOB_ON_POR_MASK; misc_writel(val, SATA_AUX_MISC_CNTL_1_REG); - if (tegra_hpriv->sata_connector != MINI_SATA) { - /* Disable DEVSLP Feature */ - val = misc_readl(SATA_AUX_MISC_CNTL_1_REG); - val &= ~SDS_SUPPORT; - misc_writel(val, SATA_AUX_MISC_CNTL_1_REG); - } + /* Disable DEVSLP Feature */ + val = misc_readl(SATA_AUX_MISC_CNTL_1_REG); + val &= ~SDS_SUPPORT; + misc_writel(val, SATA_AUX_MISC_CNTL_1_REG); val = sata_readl(SATA_CONFIGURATION_0_OFFSET); val |= EN_FPCI; -- cgit v1.2.3 From cd9b8bf34e7d601896c8c019b956feddf56871d6 Mon Sep 17 00:00:00 2001 From: "Praveen Kumar Reddy M.V" Date: Mon, 13 Jun 2016 17:08:32 +0530 Subject: tegra:nvavp: Fix buffer overflow issue Fixed possible buffer overflow issue in func nvavp_pushbuffer_update(). Bug 1774401 Change-Id: Id0dec1cbf91d492335d0809c3c0bf146f6cb9d3d Signed-off-by: Praveen Kumar Reddy M.V. Reviewed-on: http://git-master/r/1163365 (cherry picked from commit 1e9ba50b225e841b52a93503fce818c1a21100f7) Reviewed-on: http://git-master/r/1164130 Reviewed-by: Automatic_Commit_Validation_User Reviewed-by: Matthew Pedro GVS: Gerrit_Virtual_Submit Reviewed-by: Bibek Basu Tested-by: Bibek Basu --- drivers/media/platform/tegra/nvavp/nvavp_dev.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/drivers/media/platform/tegra/nvavp/nvavp_dev.c b/drivers/media/platform/tegra/nvavp/nvavp_dev.c index 843ea338c949..05c5f997e12f 100644 --- a/drivers/media/platform/tegra/nvavp/nvavp_dev.c +++ b/drivers/media/platform/tegra/nvavp/nvavp_dev.c @@ -871,6 +871,7 @@ static int nvavp_pushbuffer_update(struct nvavp_info *nvavp, u32 phys_addr, u32 wordcount = 0; u32 index, value = -1; int ret = 0; + u32 max_index = 0; mutex_lock(&nvavp->open_lock); nvavp_runtime_get(nvavp); @@ -885,7 +886,9 @@ static int nvavp_pushbuffer_update(struct nvavp_info *nvavp, u32 phys_addr, mutex_lock(&channel_info->pushbuffer_lock); /* check for pushbuffer wrapping */ - if (channel_info->pushbuf_index >= channel_info->pushbuf_fence) + max_index = channel_info->pushbuf_fence; + max_index = ext_ucode_flag ? max_index : max_index - (sizeof(u32) * 4); + if (channel_info->pushbuf_index >= max_index) channel_info->pushbuf_index = 0; if (!ext_ucode_flag) { -- cgit v1.2.3 From ff94d4ba6858af3861eb902c5677aed0acfc01fe Mon Sep 17 00:00:00 2001 From: Soumen Kumar Dey Date: Tue, 14 Jun 2016 14:31:57 +0530 Subject: nvavp: Add mutex lock for all avp submit Add mutex lock for nvavp_submit to avoid race condition. bug 1775299 Change-Id: I11a66a58a1f048d6a0ee5aa949f852bfef56dc07 Signed-off-by: Soumen Kumar Dey Reviewed-on: http://git-master/r/1164117 (cherry picked from commit 1faa6a739996fdacff3dbc85ad46235f42ad79c9) Reviewed-on: http://git-master/r/1214643 GVS: Gerrit_Virtual_Submit Reviewed-by: Matthew Pedro --- drivers/media/platform/tegra/nvavp/nvavp_dev.c | 39 +++++++++++++++++++++----- 1 file changed, 32 insertions(+), 7 deletions(-) diff --git a/drivers/media/platform/tegra/nvavp/nvavp_dev.c b/drivers/media/platform/tegra/nvavp/nvavp_dev.c index 05c5f997e12f..cc98f192d086 100644 --- a/drivers/media/platform/tegra/nvavp/nvavp_dev.c +++ b/drivers/media/platform/tegra/nvavp/nvavp_dev.c @@ -135,6 +135,7 @@ struct nvavp_info { int mbox_from_avp_pend_irq; struct mutex open_lock; + struct mutex submit_lock; int refcount; int video_initialized; int video_refcnt; @@ -1521,15 +1522,20 @@ static int nvavp_pushbuffer_submit_ioctl(struct file *filp, unsigned int cmd, syncpt.id = NVSYNCPT_INVALID; syncpt.value = 0; + mutex_lock(&nvavp->submit_lock); if (_IOC_DIR(cmd) & _IOC_WRITE) { if (copy_from_user(&hdr, (void __user *)arg, - sizeof(struct nvavp_pushbuffer_submit_hdr))) + sizeof(struct nvavp_pushbuffer_submit_hdr))) { + mutex_unlock(&nvavp->submit_lock); return -EFAULT; + } } - if (!hdr.cmdbuf.mem) + if (!hdr.cmdbuf.mem) { + mutex_unlock(&nvavp->submit_lock); return 0; + } if (hdr.num_relocs > NVAVP_MAX_RELOCATION_COUNT) { dev_err(&nvavp->nvhost_dev->dev, @@ -1539,6 +1545,7 @@ static int nvavp_pushbuffer_submit_ioctl(struct file *filp, unsigned int cmd, if (copy_from_user(clientctx->relocs, (void __user *)hdr.relocs, sizeof(struct nvavp_reloc) * hdr.num_relocs)) { + mutex_unlock(&nvavp->submit_lock); return -EFAULT; } @@ -1546,6 +1553,7 @@ static int nvavp_pushbuffer_submit_ioctl(struct file *filp, unsigned int cmd, if (IS_ERR(cmdbuf_dmabuf)) { dev_err(&nvavp->nvhost_dev->dev, "invalid cmd buffer handle %08x\n", hdr.cmdbuf.mem); + mutex_unlock(&nvavp->submit_lock); return PTR_ERR(cmdbuf_dmabuf); } @@ -1682,6 +1690,7 @@ err_dmabuf_map: dma_buf_detach(cmdbuf_dmabuf, cmdbuf_attach); err_dmabuf_attach: dma_buf_put(cmdbuf_dmabuf); + mutex_unlock(&nvavp->submit_lock); return ret; } @@ -1695,19 +1704,26 @@ static int nvavp_pushbuffer_submit_compat_ioctl(struct file *filp, struct nvavp_pushbuffer_submit_hdr_v32 hdr_v32; struct nvavp_pushbuffer_submit_hdr __user *user_hdr; int ret = 0; + mutex_lock(&nvavp->submit_lock); if (_IOC_DIR(cmd) & _IOC_WRITE) { if (copy_from_user(&hdr_v32, (void __user *)arg, - sizeof(struct nvavp_pushbuffer_submit_hdr_v32))) + sizeof(struct nvavp_pushbuffer_submit_hdr_v32))) { + mutex_unlock(&nvavp->submit_lock); return -EFAULT; + } } - if (!hdr_v32.cmdbuf.mem) + if (!hdr_v32.cmdbuf.mem) { + mutex_unlock(&nvavp->submit_lock); return 0; + } user_hdr = compat_alloc_user_space(sizeof(*user_hdr)); - if (!access_ok(VERIFY_WRITE, user_hdr, sizeof(*user_hdr))) + if (!access_ok(VERIFY_WRITE, user_hdr, sizeof(*user_hdr))) { + mutex_unlock(&nvavp->submit_lock); return -EFAULT; + } if (__put_user(hdr_v32.cmdbuf.mem, &user_hdr->cmdbuf.mem) || __put_user(hdr_v32.cmdbuf.offset, &user_hdr->cmdbuf.offset) @@ -1717,21 +1733,29 @@ static int nvavp_pushbuffer_submit_compat_ioctl(struct file *filp, || __put_user(hdr_v32.num_relocs, &user_hdr->num_relocs) || __put_user((void __user *)(unsigned long)hdr_v32.syncpt, &user_hdr->syncpt) - || __put_user(hdr_v32.flags, &user_hdr->flags)) + || __put_user(hdr_v32.flags, &user_hdr->flags)) { + mutex_unlock(&nvavp->submit_lock); return -EFAULT; + } + mutex_unlock(&nvavp->submit_lock); ret = nvavp_pushbuffer_submit_ioctl(filp, cmd, (unsigned long)user_hdr); if (ret) return ret; - if (__get_user(hdr_v32.syncpt, &user_hdr->syncpt)) + mutex_lock(&nvavp->submit_lock); + if (__get_user(hdr_v32.syncpt, (uintptr_t *)&user_hdr->syncpt)) + { + mutex_unlock(&nvavp->submit_lock); return -EFAULT; + } if (copy_to_user((void __user *)arg, &hdr_v32, sizeof(struct nvavp_pushbuffer_submit_hdr_v32))) { ret = -EFAULT; } + mutex_unlock(&nvavp->submit_lock); return ret; } #endif @@ -2383,6 +2407,7 @@ static int tegra_nvavp_probe(struct platform_device *ndev) nvavp->mbox_from_avp_pend_irq = irq; mutex_init(&nvavp->open_lock); + mutex_init(&nvavp->submit_lock); for (channel_id = 0; channel_id < NVAVP_NUM_CHANNELS; channel_id++) mutex_init(&nvavp->channel_info[channel_id].pushbuffer_lock); -- cgit v1.2.3 From 60f51c7e8069154598533f9f3c5c2e6b3991cfe3 Mon Sep 17 00:00:00 2001 From: Soumen Kumar Dey Date: Thu, 15 Sep 2016 09:23:29 +0530 Subject: nvavp: Add missing mutex unlock Add missing mutex unlock for nvavp_submit. bug 1775299 Change-Id: I1b525e192bfd9dd19bcd0211484400445eda7b2b Signed-off-by: Soumen Kumar Dey Reviewed-on: http://git-master/r/1221210 GVS: Gerrit_Virtual_Submit Reviewed-by: Matthew Pedro --- drivers/media/platform/tegra/nvavp/nvavp_dev.c | 1 + 1 file changed, 1 insertion(+) diff --git a/drivers/media/platform/tegra/nvavp/nvavp_dev.c b/drivers/media/platform/tegra/nvavp/nvavp_dev.c index cc98f192d086..f2cb6a593dd2 100644 --- a/drivers/media/platform/tegra/nvavp/nvavp_dev.c +++ b/drivers/media/platform/tegra/nvavp/nvavp_dev.c @@ -1540,6 +1540,7 @@ static int nvavp_pushbuffer_submit_ioctl(struct file *filp, unsigned int cmd, if (hdr.num_relocs > NVAVP_MAX_RELOCATION_COUNT) { dev_err(&nvavp->nvhost_dev->dev, "invalid num_relocs %d\n", hdr.num_relocs); + mutex_unlock(&nvavp->submit_lock); return -EINVAL; } -- cgit v1.2.3 From e0197788da51e95824f6d83f9ef12db9e8266168 Mon Sep 17 00:00:00 2001 From: Rohit Khanna Date: Wed, 7 Sep 2016 13:00:23 -0700 Subject: Revert "arm64:mm: rm swtch to ASID0 in ctxt swtch" This reverts commit 584b60200b8bdcc895c8edacb94f48db5929f70a. Change-Id: Ibe5b217521b77fa5799400b9460182e3329e1779 Signed-off-by: Rohit Khanna Reviewed-on: http://git-master/r/1216501 (cherry picked from commit 04c8d66d61e15198b95d54672b2f2fe047d180b3) Reviewed-on: http://git-master/r/1223596 Reviewed-by: Bibek Basu Tested-by: Bibek Basu GVS: Gerrit_Virtual_Submit Reviewed-by: Winnie Hsu --- arch/arm64/include/asm/mmu_context.h | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/arch/arm64/include/asm/mmu_context.h b/arch/arm64/include/asm/mmu_context.h index 04586a88487b..237635d8a46f 100644 --- a/arch/arm64/include/asm/mmu_context.h +++ b/arch/arm64/include/asm/mmu_context.h @@ -78,8 +78,11 @@ static inline void switch_new_context(struct mm_struct *mm) static inline void check_and_switch_context(struct mm_struct *mm, struct task_struct *tsk) { - /* unneeded switch to ASID0 */ - /* cpu_set_reserved_ttbr0(); */ + /* + * Required during context switch to avoid speculative page table + * walking with the wrong TTBR. + */ + cpu_set_reserved_ttbr0(); if (!((mm->context.id ^ cpu_last_asid) >> max_asid_bits)) /* -- cgit v1.2.3 From 563bca879a039771c666a03965e14d10989a5b07 Mon Sep 17 00:00:00 2001 From: Yevgeny Pats Date: Tue, 19 Jan 2016 22:09:04 +0000 Subject: UPSTREAM: KEYS: Fix keyring ref leak in join_session_keyring() (cherry pick from commit 23567fd052a9abb6d67fe8e7a9ccdd9800a540f2) This fixes CVE-2016-0728. If a thread is asked to join as a session keyring the keyring that's already set as its session, we leak a keyring reference. This can be tested with the following program: #include #include #include #include int main(int argc, const char *argv[]) { int i = 0; key_serial_t serial; serial = keyctl(KEYCTL_JOIN_SESSION_KEYRING, "leaked-keyring"); if (serial < 0) { perror("keyctl"); return -1; } if (keyctl(KEYCTL_SETPERM, serial, KEY_POS_ALL | KEY_USR_ALL) < 0) { perror("keyctl"); return -1; } for (i = 0; i < 100; i++) { serial = keyctl(KEYCTL_JOIN_SESSION_KEYRING, "leaked-keyring"); if (serial < 0) { perror("keyctl"); return -1; } } return 0; } If, after the program has run, there something like the following line in /proc/keys: 3f3d898f I--Q--- 100 perm 3f3f0000 0 0 keyring leaked-keyring: empty with a usage count of 100 * the number of times the program has been run, then the kernel is malfunctioning. If leaked-keyring has zero usages or has been garbage collected, then the problem is fixed. Bug 1720836 Reported-by: Yevgeny Pats Signed-off-by: David Howells Acked-by: Don Zickus Acked-by: Prarit Bhargava Acked-by: Jarod Wilson Signed-off-by: James Morris Change-Id: I10177a58a7b3178eda95017557edaa7298594d06 (cherry picked from commit 9fc5f368bb89b65b591c4f800dfbcc7432e49de5) Signed-off-by: Sumit Singh Reviewed-on: http://git-master/r/935565 GVS: Gerrit_Virtual_Submit Reviewed-by: Bharat Nihalani (cherry picked from commit 07be7f19b4c356ce94642d0c2cecb93179a9a9bc) Signed-off-by: Bibek Basu Reviewed-on: http://git-master/r/1210637 Reviewed-by: Jeetesh Burman --- security/keys/process_keys.c | 1 + 1 file changed, 1 insertion(+) diff --git a/security/keys/process_keys.c b/security/keys/process_keys.c index 42defae1e161..cd871dc8b7c0 100644 --- a/security/keys/process_keys.c +++ b/security/keys/process_keys.c @@ -792,6 +792,7 @@ long join_session_keyring(const char *name) ret = PTR_ERR(keyring); goto error2; } else if (keyring == new->session_keyring) { + key_put(keyring); ret = 0; goto error2; } -- cgit v1.2.3 From 1b1420c3fd59880e0a9220bae507b2191d73e2b0 Mon Sep 17 00:00:00 2001 From: Gagan Grover Date: Wed, 12 Oct 2016 17:05:06 +0530 Subject: gpu: nvgpu: fix use-after-free in case of error notifier A use-after-free scenario is possible where one thread in gk20a_free_error_notifiers() is trying to free the error notifier and another thread in gk20a_set_error_notifier() is still using the error notifier Fix this by introducing mutex error_notifier_mutex for error notifier accesses Take mutex in gk20a_free_error_notifiers() and in gk20a_set_error_notifier() before accessing notifier In gk20a_init_error_notifier(), set the pointer ch->error_notifier_ref inside the mutex and only after notifier is completely initialized Bug 1824788 Change-Id: I47e1ab57d54f391799f5a0999840b663fd34585f Reviewed-on: http://git-master/r/1233988 Signed-off-by: Gagan Grover Signed-off-by: Gaurav Singh Reviewed-on: http://git-master/r/1236695 GVS: Gerrit_Virtual_Submit Reviewed-by: Deepak Nibade Reviewed-by: Bibek Basu --- drivers/gpu/nvgpu/gk20a/channel_gk20a.c | 32 +++++++++++++++++++++++--------- drivers/gpu/nvgpu/gk20a/channel_gk20a.h | 1 + 2 files changed, 24 insertions(+), 9 deletions(-) diff --git a/drivers/gpu/nvgpu/gk20a/channel_gk20a.c b/drivers/gpu/nvgpu/gk20a/channel_gk20a.c index f64bda9b6dc5..b1b59a9a55b9 100644 --- a/drivers/gpu/nvgpu/gk20a/channel_gk20a.c +++ b/drivers/gpu/nvgpu/gk20a/channel_gk20a.c @@ -552,8 +552,7 @@ static int gk20a_init_error_notifier(struct channel_gk20a *ch, dmabuf = dma_buf_get(args->mem); - if (ch->error_notifier_ref) - gk20a_free_error_notifiers(ch); + gk20a_free_error_notifiers(ch); if (IS_ERR(dmabuf)) { pr_err("Invalid handle: %d\n", args->mem); @@ -574,16 +573,23 @@ static int gk20a_init_error_notifier(struct channel_gk20a *ch, return -ENOMEM; } - /* set channel notifiers pointer */ - ch->error_notifier_ref = dmabuf; ch->error_notifier = va + args->offset; ch->error_notifier_va = va; memset(ch->error_notifier, 0, sizeof(struct nvhost_notification)); + + /* set channel notifiers pointer */ + mutex_lock(&ch->error_notifier_mutex); + ch->error_notifier_ref = dmabuf; + mutex_unlock(&ch->error_notifier_mutex); + return 0; } void gk20a_set_error_notifier(struct channel_gk20a *ch, __u32 error) { + bool notifier_set = false; + + mutex_lock(&ch->error_notifier_mutex); if (ch->error_notifier_ref) { struct timespec time_data; u64 nsec; @@ -596,20 +602,27 @@ void gk20a_set_error_notifier(struct channel_gk20a *ch, __u32 error) (u32)(nsec >> 32); ch->error_notifier->info32 = error; ch->error_notifier->status = 0xffff; - gk20a_err(dev_from_gk20a(ch->g), - "error notifier set to %d\n", error); + + notifier_set = true; } + mutex_unlock(&ch->error_notifier_mutex); + + if (notifier_set) + gk20a_err(dev_from_gk20a(ch->g), + "error notifier set to %d for ch %d", error, ch->hw_chid); } static void gk20a_free_error_notifiers(struct channel_gk20a *ch) { + mutex_lock(&ch->error_notifier_mutex); if (ch->error_notifier_ref) { dma_buf_vunmap(ch->error_notifier_ref, ch->error_notifier_va); dma_buf_put(ch->error_notifier_ref); - ch->error_notifier_ref = 0; - ch->error_notifier = 0; - ch->error_notifier_va = 0; + ch->error_notifier_ref = NULL; + ch->error_notifier = NULL; + ch->error_notifier_va = NULL; } + mutex_unlock(&ch->error_notifier_mutex); } void gk20a_free_channel(struct channel_gk20a *ch, bool finish) @@ -1630,6 +1643,7 @@ int gk20a_init_channel_support(struct gk20a *g, u32 chid) c->bound = false; c->remove_support = gk20a_remove_channel_support; mutex_init(&c->jobs_lock); + mutex_init(&c->error_notifier_mutex); INIT_LIST_HEAD(&c->jobs); #if defined(CONFIG_GK20A_CYCLE_STATS) mutex_init(&c->cyclestate.cyclestate_buffer_mutex); diff --git a/drivers/gpu/nvgpu/gk20a/channel_gk20a.h b/drivers/gpu/nvgpu/gk20a/channel_gk20a.h index 320ada62a965..547bb064fd63 100644 --- a/drivers/gpu/nvgpu/gk20a/channel_gk20a.h +++ b/drivers/gpu/nvgpu/gk20a/channel_gk20a.h @@ -132,6 +132,7 @@ struct channel_gk20a { struct dma_buf *error_notifier_ref; struct nvhost_notification *error_notifier; void *error_notifier_va; + struct mutex error_notifier_mutex; struct gk20a_channel_sync *sync; }; -- cgit v1.2.3 From d0d666fcd21dea1424006c34fd158067ced90ce2 Mon Sep 17 00:00:00 2001 From: Linus Torvalds Date: Thu, 13 Oct 2016 13:07:36 -0700 Subject: mm: remove gup_flags FOLL_WRITE games from __get_user_pages() commit 19be0eaffa3ac7d8eb6784ad9bdbc7d67ed8e619 upstream. This is an ancient bug that was actually attempted to be fixed once (badly) by me eleven years ago in commit 4ceb5db9757a ("Fix get_user_pages() race for write access") but that was then undone due to problems on s390 by commit f33ea7f404e5 ("fix get_user_pages bug"). In the meantime, the s390 situation has long been fixed, and we can now fix it by checking the pte_dirty() bit properly (and do it better). The s390 dirty bit was implemented in abf09bed3cce ("s390/mm: implement software dirty bits") which made it into v3.9. Earlier kernels will have to look at the page state itself. Also, the VM has become more scalable, and what used a purely theoretical race back then has become easier to trigger. To fix it, we introduce a new internal FOLL_COW flag to mark the "yes, we already did a COW" rather than play racy games with FOLL_WRITE that is very fundamental, and then use the pte dirty flag to validate that the FOLL_COW flag is still valid. Reported-and-tested-by: Phil "not Paul" Oester Acked-by: Hugh Dickins Reviewed-by: Michal Hocko Cc: Andy Lutomirski Cc: Kees Cook Cc: Oleg Nesterov Cc: Willy Tarreau Cc: Nick Piggin Cc: Greg Thelen Cc: stable@vger.kernel.org Signed-off-by: Linus Torvalds [wt: s/gup.c/memory.c; s/follow_page_pte/follow_page_mask; s/faultin_page/__get_user_page] Signed-off-by: Willy Tarreau Change-Id: I6fbb1abf656ff7e05ec4c65f07dbbdd694546fb4 Signed-off-by: Krishna Reddy Signed-off-by: Sumit Gupta Reviewed-on: http://git-master/r/1241321 GVS: Gerrit_Virtual_Submit Reviewed-by: Bibek Basu Tested-by: Bibek Basu --- include/linux/mm.h | 1 + mm/memory.c | 14 ++++++++++++-- 2 files changed, 13 insertions(+), 2 deletions(-) diff --git a/include/linux/mm.h b/include/linux/mm.h index a23bb6b1f449..03a60a38ec45 100644 --- a/include/linux/mm.h +++ b/include/linux/mm.h @@ -1714,6 +1714,7 @@ static inline struct page *follow_page(struct vm_area_struct *vma, #define FOLL_NUMA 0x200 /* force NUMA hinting page fault */ #define FOLL_MIGRATION 0x400 /* wait for page to replace migration entry */ #define FOLL_DURABLE 0x800 /* get the page reference for a long time */ +#define FOLL_COW 0x4000 /* internal GUP flag */ typedef int (*pte_fn_t)(pte_t *pte, pgtable_t token, unsigned long addr, void *data); diff --git a/mm/memory.c b/mm/memory.c index 76399cfd8927..6be9914ddc0d 100644 --- a/mm/memory.c +++ b/mm/memory.c @@ -1462,6 +1462,16 @@ int zap_vma_ptes(struct vm_area_struct *vma, unsigned long address, } EXPORT_SYMBOL_GPL(zap_vma_ptes); +/* + * FOLL_FORCE can write to even unwritable pte's, but only + * after we've gone through a COW cycle and they are dirty. + */ +static inline bool can_follow_write_pte(pte_t pte, unsigned int flags) +{ + return pte_write(pte) || + ((flags & FOLL_FORCE) && (flags & FOLL_COW) && pte_dirty(pte)); +} + /** * follow_page_mask - look up a page descriptor from a user-virtual address * @vma: vm_area_struct mapping @address @@ -1574,7 +1584,7 @@ split_fallthrough: } if ((flags & FOLL_NUMA) && pte_numa(pte)) goto no_page; - if ((flags & FOLL_WRITE) && !pte_write(pte)) + if ((flags & FOLL_WRITE) && !can_follow_write_pte(pte, flags)) goto unlock; page = vm_normal_page(vma, address, pte); @@ -1923,7 +1933,7 @@ long __get_user_pages(struct task_struct *tsk, struct mm_struct *mm, */ if ((ret & VM_FAULT_WRITE) && !(vma->vm_flags & VM_WRITE)) - foll_flags &= ~FOLL_WRITE; + foll_flags |= FOLL_COW; cond_resched(); } -- cgit v1.2.3 From 023d6603c588e3e592a2750bf6eff16212bbe9f7 Mon Sep 17 00:00:00 2001 From: Xia Yang Date: Mon, 15 Aug 2016 14:56:51 -0700 Subject: mmc: card: test: Fix out of boundary array access Allocate buffer with 1 extra byte for NULL terminator. Bug 1791602 Change-Id: I3c3658315c2cd2a1dc7be7d72953998a5275e71e Signed-off-by: Xia Yang Reviewed-on: http://git-master/r/1216897 GVS: Gerrit_Virtual_Submit Reviewed-by: Bibek Basu Tested-by: Bibek Basu --- drivers/mmc/card/mmc_test.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/drivers/mmc/card/mmc_test.c b/drivers/mmc/card/mmc_test.c index 69f549d17a53..784e5b4dc46d 100644 --- a/drivers/mmc/card/mmc_test.c +++ b/drivers/mmc/card/mmc_test.c @@ -3021,7 +3021,7 @@ static ssize_t mtf_test_write(struct file *file, const char __user *buf, char *data_buf = NULL; long testcase; - data_buf = kzalloc(count, GFP_KERNEL); + data_buf = kzalloc(count+1, GFP_KERNEL); if (data_buf == NULL) return -ENOMEM; @@ -3029,7 +3029,6 @@ static ssize_t mtf_test_write(struct file *file, const char __user *buf, kfree(data_buf); return -EFAULT; } - data_buf[strlen(data_buf) - 1] = '\0'; if (mmc_test_extract_parameters(data_buf)) { mmc_test_usage(sf); return -EFAULT; -- cgit v1.2.3 From 2d4ffd693dda1f2753e2b1b3af58deb3a899a143 Mon Sep 17 00:00:00 2001 From: Anubhav Jain Date: Wed, 29 Jun 2016 16:12:18 +0530 Subject: mmc: core: update EXT_CSD version to 8 Bug 1779090 Change-Id: I733c6ff7b3e39216fcf25f9c0d048b4c752a9e84 Signed-off-by: Anubhav Jain Reviewed-on: http://git-master/r/1173092 GVS: Gerrit_Virtual_Submit Reviewed-by: Venu Byravarasu --- drivers/mmc/core/mmc.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/mmc/core/mmc.c b/drivers/mmc/core/mmc.c index 2ed77066e8d6..3e1cabd21919 100644 --- a/drivers/mmc/core/mmc.c +++ b/drivers/mmc/core/mmc.c @@ -294,7 +294,7 @@ static int mmc_read_ext_csd(struct mmc_card *card, u8 *ext_csd) } card->ext_csd.rev = ext_csd[EXT_CSD_REV]; - if (card->ext_csd.rev > 7) { + if (card->ext_csd.rev > 8) { pr_err("%s: unrecognised EXT_CSD revision %d\n", mmc_hostname(card->host), card->ext_csd.rev); err = -EINVAL; -- cgit v1.2.3 From 926790418b128ccd1786e8ce3b112864e77b8554 Mon Sep 17 00:00:00 2001 From: Martin Chi Date: Mon, 24 Oct 2016 16:57:37 +0800 Subject: gpio: pca953x: fix gpio input on gpio offsets >= 8 This change fixes a regression introduced by commit f5f0b7aa8 (gpio: pca953x: make the register access by GPIO bank) When the pca953x driver was converted to using 8-bit reads/writes the bitmask in pca953x_gpio_get_value wasn't adjusted with a modulus BANK_SZ and consequently looks at the wrong bits in the input register. Bug 1826501 Change-Id: Id9c9d1cab9fb97e2fdf9408b03873722f787fbec Signed-off-by: Andrew Ruder Reviewed-by: Gregory CLEMENT Signed-off-by: Linus Walleij (cherry picked from commit 40a625daa88653d7942dc85483f6f289cd687cb7) Signed-off-by: Martin Chi Reviewed-on: http://git-master/r/1241694 Reviewed-by: Laxman Dewangan Reviewed-on: http://git-master/r/1242944 GVS: Gerrit_Virtual_Submit --- drivers/gpio/gpio-pca953x.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/gpio/gpio-pca953x.c b/drivers/gpio/gpio-pca953x.c index a5653ea0342f..3d4cbd5cb126 100644 --- a/drivers/gpio/gpio-pca953x.c +++ b/drivers/gpio/gpio-pca953x.c @@ -308,7 +308,7 @@ static int pca953x_gpio_get_value(struct gpio_chip *gc, unsigned off) return 0; } - return (reg_val & (1u << off)) ? 1 : 0; + return (reg_val & (1u << (off % BANK_SZ))) ? 1 : 0; } static void pca953x_gpio_set_value(struct gpio_chip *gc, unsigned off, int val) -- cgit v1.2.3 From 2caf4affa29d959a592727d87d0dec200b98a05b Mon Sep 17 00:00:00 2001 From: Gagan Grover Date: Fri, 21 Oct 2016 16:03:47 +0530 Subject: video: tegra: host: add lower bound to num_syncpt_incrs Check if there is at least one syncpt_incrs in each job. Bug 1812182 Change-Id: I0bd0b2e7c4d01641c83ba729ec34390ddea81496 Reviewed-on: http://git-master/r/1221226 Signed-off-by: Gagan Grover Reviewed-on: http://git-master/r/1248797 GVS: Gerrit_Virtual_Submit Reviewed-by: Arto Merilainen --- drivers/video/tegra/host/bus_client.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/drivers/video/tegra/host/bus_client.c b/drivers/video/tegra/host/bus_client.c index fb37a9e06ab3..267a977c410b 100644 --- a/drivers/video/tegra/host/bus_client.c +++ b/drivers/video/tegra/host/bus_client.c @@ -399,7 +399,8 @@ static int nvhost_ioctl_channel_submit(struct nvhost_channel_userctx *ctx, u32 *local_waitbases = NULL, *local_class_ids = NULL; int err, i, hwctx_syncpt_idx = -1; - if (num_syncpt_incrs > host->info.nb_pts) + if ((num_syncpt_incrs < 1) || (num_syncpt_incrs > + host->info.nb_pts)) return -EINVAL; if (num_cmdbufs < 0 || num_syncpt_incrs < 0) -- cgit v1.2.3 From 6454f3735146944761701de980bd6205dc979c15 Mon Sep 17 00:00:00 2001 From: Gagan Grover Date: Fri, 4 Nov 2016 16:39:33 +0530 Subject: video: tegra: host: Prevent the race between channel open and close Moved fd_install() at the end of the channel_open ioctl. So, the fd can't be used until open ioctl completes. Bug 1832094 Change-Id: Ib33d43bf5164418a38f98677d4e3295f3d1c1450 Signed-off-by: Gagan Grover Reviewed-on: http://git-master/r/1248180 (cherry picked from commit e6a41d5c0049c2878543006b67b7ee2b2bbda2ab) Reviewed-on: http://git-master/r/1249505 Reviewed-by: Winnie Hsu Tested-by: Winnie Hsu --- drivers/video/tegra/host/bus_client.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/video/tegra/host/bus_client.c b/drivers/video/tegra/host/bus_client.c index 267a977c410b..ee21c80e6871 100644 --- a/drivers/video/tegra/host/bus_client.c +++ b/drivers/video/tegra/host/bus_client.c @@ -785,7 +785,6 @@ static long nvhost_channelctl(struct file *filp, put_unused_fd(fd); break; } - fd_install(fd, file); err = __nvhost_channelopen(NULL, priv->ch, file); if (err) { @@ -795,6 +794,7 @@ static long nvhost_channelctl(struct file *filp, } ((struct nvhost_channel_open_args *)buf)->channel_fd = fd; + fd_install(fd, file); break; } case NVHOST_IOCTL_CHANNEL_GET_SYNCPOINTS: -- cgit v1.2.3 From b8491114a4a0fe7a675c03d600003ea434c33a96 Mon Sep 17 00:00:00 2001 From: Bibek Basu Date: Thu, 10 Nov 2016 15:48:17 +0530 Subject: dvfs: tegra: Validate CLDVFS register address Bug 1783583 Change-Id: I8b0e865db02c00f741dafb473d4bd39c5075f23f Signed-off-by: Alex Frid Reviewed-on: http://git-master/r/1173469 (cherry picked from commit 453a77c5cd9a1316307458203365f9eb5bda62de) Reviewed-on: http://git-master/r/1174714 (cherry picked from commit f2ce702f49c5631e8a7cbda6fbf09140f8fb55d9) Reviewed-on: http://git-master/r/1239794 (cherry picked from commit f62bd56958ca743d512f757555e4a3b66f4c9cff) Signed-off-by: Bibek Basu Reviewed-on: http://git-master/r/1251020 GVS: Gerrit_Virtual_Submit Reviewed-by: Winnie Hsu --- arch/arm/mach-tegra/tegra_cl_dvfs.c | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/arch/arm/mach-tegra/tegra_cl_dvfs.c b/arch/arm/mach-tegra/tegra_cl_dvfs.c index 6dd7712b7961..0b2f50a0e8d2 100644 --- a/arch/arm/mach-tegra/tegra_cl_dvfs.c +++ b/arch/arm/mach-tegra/tegra_cl_dvfs.c @@ -150,6 +150,8 @@ #define CL_DVFS_OUTPUT_LUT 0x200 +#define CL_DVFS_APERTURE 0x400 + #define CL_DVFS_CALIBR_TIME 40000 #define CL_DVFS_OUTPUT_PENDING_TIMEOUT 1000 #define CL_DVFS_OUTPUT_RAMP_DELAY 100 @@ -3243,6 +3245,9 @@ static ssize_t cl_register_write(struct file *file, if (sscanf(buf, "[0x%x] = 0x%x", &offs, &val) != 2) return -1; + if (offs >= CL_DVFS_APERTURE) + return -1; + clk_enable(cld->soc_clk); cl_dvfs_writel(cld, val, offs & (~0x3)); clk_disable(cld->soc_clk); -- cgit v1.2.3 From 304b07bf74c5022458616285de941ae1063b8e6d Mon Sep 17 00:00:00 2001 From: Bibek Basu Date: Thu, 15 Dec 2016 13:53:27 +0530 Subject: arm: tegra: fix cpu speedo check for UCM1 for UCM1 CD575M, check for cpu speedo 5 to apply edp contraints Bug 200195229 Bug 200199079 Change-Id: I704dd64f32c82c7499b6c5f0c96c04fdc062cf71 Signed-off-by: Bibek Basu Reviewed-on: http://git-master/r/1271709 GVS: Gerrit_Virtual_Submit --- arch/arm/mach-tegra/edp.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/arch/arm/mach-tegra/edp.c b/arch/arm/mach-tegra/edp.c index 75685443eb28..0e13bb13cb0b 100644 --- a/arch/arm/mach-tegra/edp.c +++ b/arch/arm/mach-tegra/edp.c @@ -480,7 +480,7 @@ static int init_cpu_edp_limits_calculated(void) else if (tegra_cpu_speedo_id() == 8) limit = 1887000; /* CD575M UCM1 default */ - else if (tegra_cpu_speedo_id() == -1) + else if (tegra_cpu_speedo_id() == 5) limit = 1887000; } else limit = cpu_edp_calculate_maxf(params, -- cgit v1.2.3 From f01956fc2151561a7845ebdb8f836ad4851af69e Mon Sep 17 00:00:00 2001 From: Deepak Nibade Date: Thu, 4 Aug 2016 19:42:38 +0530 Subject: gpu: nvgpu: initialize local variable Initialize character array buf in gk20a_channel_ioctl() to zero Keeping it uninitialized can result in leaking kernel stack info to user space since we pass this buffer to UMD Bug 1793398 Change-Id: Iffd654dbaca3b4e3c8fd2ac270d0febd01c165b8 Signed-off-by: Deepak Nibade Reviewed-on: http://git-master/r/1195862 (cherry picked from commit 118809f4bd07af20df2b6c012828834695a5fccf from dev-kernel linux-nvgpu.git) Reviewed-on: http://git-master/r/1269683 Reviewed-by: Matthew Pedro GVS: Gerrit_Virtual_Submit Reviewed-by: Christian Gonzalez Tested-by: Christian Gonzalez Reviewed-by: Bibek Basu --- drivers/gpu/nvgpu/gk20a/channel_gk20a.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/gpu/nvgpu/gk20a/channel_gk20a.c b/drivers/gpu/nvgpu/gk20a/channel_gk20a.c index b1b59a9a55b9..19156d6921d1 100644 --- a/drivers/gpu/nvgpu/gk20a/channel_gk20a.c +++ b/drivers/gpu/nvgpu/gk20a/channel_gk20a.c @@ -1996,7 +1996,7 @@ long gk20a_channel_ioctl(struct file *filp, { struct channel_gk20a *ch = filp->private_data; struct platform_device *dev = ch->g->dev; - u8 buf[NVHOST_IOCTL_CHANNEL_MAX_ARG_SIZE]; + u8 buf[NVHOST_IOCTL_CHANNEL_MAX_ARG_SIZE] = {0}; int err = 0; if ((_IOC_TYPE(cmd) != NVHOST_IOCTL_MAGIC) || -- cgit v1.2.3 From fe2aed5a0d1b353f723d9e4dc6669dfa63b64e0a Mon Sep 17 00:00:00 2001 From: Sri Krishna chowdary Date: Fri, 10 Feb 2017 15:02:14 +0530 Subject: video: tegra: nvmap: fix time-of-check,time-of-use vulnerability Validate the region specified by offset and size before performing the operations like nvmap_prot_handle, nvmap_cache_maint and nvmap_handle_mk*. This validation of offset and size once the values are in local variables guarantees that even though user space changes the values in user buffers, nvmap continues to perform operations with the contents that are validated. Fixes Google Bug 34113000. bug 1862379 Change-Id: Ief81887b3d94b49f3dcf4d2680d9d7b257c54092 Signed-off-by: Sri Krishna chowdary Signed-off-by: Bibek Basu Reviewed-on: http://git-master/r/1298712 (cherry picked from commit f45441da608d8015ece73d253d4bdb48863f99e2) Reviewed-on: http://git-master/r/1310316 (cherry picked from commit 57367ab3be5f1c52dd6b885f114ae90dfce5a363) Reviewed-on: http://git-master/r/1319910 GVS: Gerrit_Virtual_Submit --- drivers/video/tegra/nvmap/nvmap_ioctl.c | 9 +++++++-- drivers/video/tegra/nvmap/nvmap_mm.c | 6 +++++- drivers/video/tegra/nvmap/nvmap_priv.h | 11 +++++++---- 3 files changed, 19 insertions(+), 7 deletions(-) diff --git a/drivers/video/tegra/nvmap/nvmap_ioctl.c b/drivers/video/tegra/nvmap/nvmap_ioctl.c index 850afd1ff437..7e59d245069f 100644 --- a/drivers/video/tegra/nvmap/nvmap_ioctl.c +++ b/drivers/video/tegra/nvmap/nvmap_ioctl.c @@ -3,7 +3,7 @@ * * User-space interface to nvmap * - * Copyright (c) 2011-2014, NVIDIA CORPORATION. All rights reserved. + * Copyright (c) 2011-2017, NVIDIA CORPORATION. All rights reserved. * * This program is free software; you can redistribute it and/or modify * it under the terms of the GNU General Public License as published by @@ -936,6 +936,11 @@ int __nvmap_do_cache_maint(struct nvmap_client *client, if (!h) return -EFAULT; + if ((start >= h->size) || (end > h->size)) { + nvmap_handle_put(h); + return -EFAULT; + } + if (op == NVMAP_CACHE_OP_INV) op = NVMAP_CACHE_OP_WB_INV; @@ -1088,7 +1093,7 @@ int nvmap_ioctl_cache_maint_list(struct file *filp, void __user *arg, if (copy_from_user(&op, arg, sizeof(op))) return -EFAULT; - if (!op.nr) + if (!op.nr || op.nr > UINT_MAX / sizeof(u32)) return -EINVAL; if (!access_ok(VERIFY_READ, op.handles, op.nr * sizeof(u32))) diff --git a/drivers/video/tegra/nvmap/nvmap_mm.c b/drivers/video/tegra/nvmap/nvmap_mm.c index 133f00b1aaa9..30994e681121 100644 --- a/drivers/video/tegra/nvmap/nvmap_mm.c +++ b/drivers/video/tegra/nvmap/nvmap_mm.c @@ -3,7 +3,7 @@ * * Some MM related functionality specific to nvmap. * - * Copyright (c) 2013-2014, NVIDIA CORPORATION. All rights reserved. + * Copyright (c) 2013-2017, NVIDIA CORPORATION. All rights reserved. * * This program is free software; you can redistribute it and/or modify * it under the terms of the GNU General Public License as published by @@ -193,6 +193,10 @@ void nvmap_zap_handle(struct nvmap_handle *handle, u32 offset, u32 size) size = PAGE_ALIGN((offset & ~PAGE_MASK) + size); + if ((offset >= handle->size) || (offset > handle->size - size) || + (size > handle->size)) + return; + mutex_lock(&handle->lock); vmas = &handle->vmas; list_for_each_entry(vma_list, vmas, list) { diff --git a/drivers/video/tegra/nvmap/nvmap_priv.h b/drivers/video/tegra/nvmap/nvmap_priv.h index a90a3269cd62..705745702abd 100644 --- a/drivers/video/tegra/nvmap/nvmap_priv.h +++ b/drivers/video/tegra/nvmap/nvmap_priv.h @@ -3,7 +3,7 @@ * * GPU memory management driver for Tegra * - * Copyright (c) 2009-2016, NVIDIA CORPORATION. All rights reserved. + * Copyright (c) 2009-2017, NVIDIA CORPORATION. All rights reserved. * * This program is free software; you can redistribute it and/or modify * it under the terms of the GNU General Public License as published by @@ -467,10 +467,13 @@ static inline void nvmap_handle_mk(struct nvmap_handle *h, void (*fn)(struct page **)) { int i; - int start_page = PAGE_ALIGN(offset) >> PAGE_SHIFT; - int end_page = (offset + size) >> PAGE_SHIFT; + u32 start_page = offset >> PAGE_SHIFT; + u32 end_page = PAGE_ALIGN(offset + size) >> PAGE_SHIFT; - if (h->heap_pgalloc) { + if (h->heap_pgalloc && + (offset < h->size) && + (size <= h->size) && + (offset <= (h->size - size))) { for (i = start_page; i < end_page; i++) fn(&h->pgalloc.pages[i]); } -- cgit v1.2.3 From f93b0de608beb4d492bb45d7c264f1cf45940dc8 Mon Sep 17 00:00:00 2001 From: Sandipan Patra Date: Tue, 21 Mar 2017 15:44:31 +0530 Subject: dccp: fix freeing skb too early for IPV6_RECVPKTINFO In the current DCCP implementation an skb for a DCCP_PKT_REQUEST packet is forcibly freed via __kfree_skb in dccp_rcv_state_process if dccp_v6_conn_request successfully returns. However, if IPV6_RECVPKTINFO is set on a socket, the address of the skb is saved to ireq->pktopts and the ref count for skb is incremented in dccp_v6_conn_request, so skb is still in use. Nevertheless, it gets freed in dccp_rcv_state_process. Fix by calling consume_skb instead of doing goto discard and therefore calling __kfree_skb. Similar fixes for TCP: fb7e2399ec17f1004c0e0ccfd17439f8759ede01 [TCP]: skb is unexpectedly freed. 0aea76d35c9651d55bbaf746e7914e5f9ae5a25d tcp: SYN packets are now simply consumed Signed-off-by: Andrey Konovalov Acked-by: Eric Dumazet Signed-off-by: David S. Miller Bug 200285540 Change-Id: I3bec712b03278102c88933d4684324c3f414b606 Signed-off-by: Sandipan Patra Reviewed-on: http://git-master/r/1325204 GVS: Gerrit_Virtual_Submit Reviewed-by: Bibek Basu --- net/dccp/input.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/net/dccp/input.c b/net/dccp/input.c index 14cdafad7a90..e511ccc74a07 100644 --- a/net/dccp/input.c +++ b/net/dccp/input.c @@ -606,7 +606,8 @@ int dccp_rcv_state_process(struct sock *sk, struct sk_buff *skb, if (inet_csk(sk)->icsk_af_ops->conn_request(sk, skb) < 0) return 1; - goto discard; + consume_skb(skb); + return 0; } if (dh->dccph_type == DCCP_PKT_RESET) goto discard; -- cgit v1.2.3 From b16c5fd826c790df730665dcb0835ce9631ac5e1 Mon Sep 17 00:00:00 2001 From: Konduri Praveen Date: Thu, 27 Apr 2017 14:40:36 +0530 Subject: tegra-cryptodev:check valid SHA message length SHA message length is provided from user space through IOCTL call. If this length is not valid, then it can lead to panic due to buffer overflow. Fix by checking message length for SHA before copying from user space Bug 1883640 Change-Id: Idc5c6074784290b4622b1c23e5feb43849100cb5 Signed-off-by: Konduri Praveen Reviewed-on: http://git-master/r/1471180 Reviewed-by: Automatic_Commit_Validation_User GVS: Gerrit_Virtual_Submit Reviewed-by: Mallikarjun Kasoju Reviewed-by: Bibek Basu --- drivers/misc/tegra-cryptodev.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/drivers/misc/tegra-cryptodev.c b/drivers/misc/tegra-cryptodev.c index 7d95fcc6f156..a5434b66cc30 100644 --- a/drivers/misc/tegra-cryptodev.c +++ b/drivers/misc/tegra-cryptodev.c @@ -3,7 +3,7 @@ * * crypto dev node for NVIDIA tegra aes hardware * - * Copyright (c) 2010-2014, NVIDIA Corporation. All Rights Reserved. + * Copyright (c) 2010-2017, NVIDIA Corporation. All Rights Reserved. * * This program is free software; you can redistribute it and/or modify * it under the terms of the GNU General Public License as published by @@ -539,6 +539,11 @@ static int tegra_crypto_sha(struct tegra_sha_req *sha_req) unsigned long *xbuf[XBUFSIZE]; int ret = -ENOMEM; + if (sha_req->plaintext_sz > PAGE_SIZE) { + pr_err("alg:hash: invalid plaintext_sz for sha_req\n"); + return -EINVAL; + } + tfm = crypto_alloc_ahash(sha_req->algo, 0, 0); if (IS_ERR(tfm)) { pr_err("alg:hash:Failed to load transform for %s:%ld\n", -- cgit v1.2.3 From 555a69ad03e354d20a7a9bd5eb4d966d5b25c7b5 Mon Sep 17 00:00:00 2001 From: Konduri Praveen Date: Tue, 2 May 2017 14:50:40 +0530 Subject: drivers: crypto: Avoid use of tainted scalar value Copy from user may taint the scalar value members in the respective struct variables. Add check for verifying the validity of the scalar value members to avoid undefined behaviour. Bug 1903278 Signed-off-by: Konduri Praveen Change-Id: Ic01c8d10886f9b02c61156f811b430acce8aca23 Reviewed-on: http://git-master/r/1473534 Reviewed-by: Winnie Hsu Tested-by: Winnie Hsu --- drivers/misc/tegra-cryptodev.c | 32 ++++++++++++++++++++++++++++++-- drivers/misc/tegra-cryptodev.h | 34 +++++++++++++++++----------------- 2 files changed, 47 insertions(+), 19 deletions(-) diff --git a/drivers/misc/tegra-cryptodev.c b/drivers/misc/tegra-cryptodev.c index a5434b66cc30..88c9cb217880 100644 --- a/drivers/misc/tegra-cryptodev.c +++ b/drivers/misc/tegra-cryptodev.c @@ -40,6 +40,10 @@ #define XBUFSIZE 8 #define RNG_DRBG 1 #define RNG 0 +#define NUM_RSA_ALGO 4 +#define ECC_MODE_MIN_INDEX 7 +#define ECC_MODE_MAX_INDEX 13 +#define MAX_RSA_MSG_LEN 256 #define TEGRA_RSA512 0 #define TEGRA_RSA1024 1 @@ -658,6 +662,11 @@ static long tegra_crypto_dev_ioctl(struct file *filp, ret = copy_from_user(&crypt_req_32, (void __user *)arg, sizeof(crypt_req_32)); + if (crypt_req_32.keylen > TEGRA_CRYPTO_MAX_KEY_SIZE) { + pr_err("key length %d exceeds max value %d\n", + crypt_req_32.keylen, TEGRA_CRYPTO_MAX_KEY_SIZE); + return -EINVAL; + } crypt_req.op = crypt_req_32.op; crypt_req.encrypt = crypt_req_32.encrypt; crypt_req.skip_key = crypt_req_32.skip_key; @@ -797,6 +806,11 @@ rng_out: ret = copy_from_user(&sha_req_32, (void __user *)arg, sizeof(sha_req_32)); + if (sha_req_32.keylen > TEGRA_CRYPTO_MAX_KEY_SIZE) { + pr_err("key length %d not within the range [0,%d]\n", + sha_req_32.keylen, TEGRA_CRYPTO_MAX_KEY_SIZE); + return -EINVAL; + } for (i = 0; i < sha_req_32.keylen; i++) sha_req.key[i] = sha_req_32.key[i]; sha_req.keylen = sha_req_32.keylen; @@ -821,7 +835,12 @@ rng_out: __func__, ret); return ret; } - + if (sha_req.keylen > TEGRA_CRYPTO_MAX_KEY_SIZE) { + pr_err("key length %d out of range [0,%d]\n", + sha_req.keylen + , TEGRA_CRYPTO_MAX_KEY_SIZE); + return -EINVAL; + } ret = tegra_crypto_sha(&sha_req); } else { ret = -EINVAL; @@ -861,7 +880,16 @@ rng_out: pr_err("%s: copy_from_user fail(%d)\n", __func__, ret); return ret; } - + if (rsa_req.msg_len > MAX_RSA_MSG_LEN) { + pr_err("Illegal message from user of length = %d\n", + rsa_req.msg_len); + return -EINVAL; + } + if (rsa_req.algo >= NUM_RSA_ALGO) { + pr_err("Invalid value of algo index %d\n", + rsa_req.algo); + return -EINVAL; + } ret = tegra_crypt_rsa(ctx, &rsa_req); break; diff --git a/drivers/misc/tegra-cryptodev.h b/drivers/misc/tegra-cryptodev.h index 706d0af25d57..e3ee4cacfb79 100644 --- a/drivers/misc/tegra-cryptodev.h +++ b/drivers/misc/tegra-cryptodev.h @@ -1,5 +1,5 @@ /* - * Copyright (c) 2010-2014, NVIDIA Corporation. All Rights Reserved. + * Copyright (c) 2010-2017, NVIDIA Corporation. All Rights Reserved. * * This program is free software; you can redistribute it and/or modify * it under the terms of the GNU General Public License as published by @@ -50,7 +50,7 @@ struct tegra_crypt_req { int op; /* e.g. TEGRA_CRYPTO_ECB */ bool encrypt; char key[TEGRA_CRYPTO_MAX_KEY_SIZE]; - int keylen; + unsigned int keylen; char iv[TEGRA_CRYPTO_IV_SIZE]; int ivlen; u8 *plaintext; @@ -67,7 +67,7 @@ struct tegra_crypt_req_32 { int op; /* e.g. TEGRA_CRYPTO_ECB */ bool encrypt; char key[TEGRA_CRYPTO_MAX_KEY_SIZE]; - int keylen; + unsigned int keylen; char iv[TEGRA_CRYPTO_IV_SIZE]; int ivlen; __u32 plaintext; @@ -112,12 +112,12 @@ struct tegra_rsa_req { char *key; char *message; char *result; - int algo; - int keylen; - int msg_len; - int modlen; - int pub_explen; - int prv_explen; + unsigned int algo; + unsigned int keylen; + unsigned int msg_len; + unsigned int modlen; + unsigned int pub_explen; + unsigned int prv_explen; int skip_key; }; #define TEGRA_CRYPTO_IOCTL_RSA_REQ \ @@ -128,12 +128,12 @@ struct tegra_rsa_req_32 { __u32 key; __u32 message; __u32 result; - int algo; - int keylen; - int msg_len; - int modlen; - int pub_explen; - int prv_explen; + __u32 algo; + __u32 keylen; + __u32 msg_len; + __u32 modlen; + __u32 pub_explen; + __u32 prv_explen; int skip_key; }; #define TEGRA_CRYPTO_IOCTL_RSA_REQ_32 \ @@ -142,7 +142,7 @@ struct tegra_rsa_req_32 { struct tegra_sha_req { char key[TEGRA_CRYPTO_MAX_KEY_SIZE]; - int keylen; + unsigned int keylen; unsigned char *algo; unsigned char *plaintext; unsigned char *result; @@ -154,7 +154,7 @@ struct tegra_sha_req { #ifdef CONFIG_COMPAT struct tegra_sha_req_32 { char key[TEGRA_CRYPTO_MAX_KEY_SIZE]; - int keylen; + unsigned int keylen; __u32 algo; __u32 plaintext; __u32 result; -- cgit v1.2.3 From 7c7162fbc912dd6c751d929d188b27f71bd2ede3 Mon Sep 17 00:00:00 2001 From: Sri Krishna chowdary Date: Tue, 15 Nov 2016 11:23:30 +0530 Subject: video: tegra: nvmap: Check if handle holds a buffer before map Consider the following case: 1. NVMAP_IOC_CREATE gives a valid fd to user space 2. user space calls NVMAP_IOC_ALLOC and it fails. So, all of the handle's allocation fields are zero. 3. Subsequent dma_buf_vmap, mmap on fd leads to __nvmap_mmap call. 4. handle is valid but h->alloc, h->carveout, h->heap_pgalloc, h->vaddr all are 0. 5. We check for h->heap_pgalloc which is false, so proceed and dereference h->carveout leading to NULL pointer exception. A valid __nvmap_mmap should occur only when h->alloc is true. So, add check for it. bug 1837468 Change-Id: I9be9d94f9b74c25b9b588fb1a16a74e96161ceda Signed-off-by: Sri Krishna chowdary Reviewed-on: http://git-master/r/1253236 (cherry picked from commit c5da78cf3d0c19f1e04501a4b3f64a5acacd0ff3) Reviewed-on: http://git-master/r/1312264 GVS: Gerrit_Virtual_Submit Reviewed-by: Bibek Basu Tested-by: Bibek Basu --- drivers/video/tegra/nvmap/nvmap.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/drivers/video/tegra/nvmap/nvmap.c b/drivers/video/tegra/nvmap/nvmap.c index 16eeeb2638d5..09f436102c6b 100644 --- a/drivers/video/tegra/nvmap/nvmap.c +++ b/drivers/video/tegra/nvmap/nvmap.c @@ -265,6 +265,9 @@ void *__nvmap_mmap(struct nvmap_handle *h) if (!h) return NULL; + if (!h->alloc) + return NULL; + prot = nvmap_pgprot(h, PG_PROT_KERNEL); if (h->heap_pgalloc) { -- cgit v1.2.3 From 698ba25737bead5af8dc5bd962d3378400cb39ae Mon Sep 17 00:00:00 2001 From: Mikko Perttunen Date: Fri, 27 Jan 2017 09:32:20 +0200 Subject: video: tegra: host: Fix overflow issue allocation Change kmalloc to kmalloc_array to prevent overflow issues caused by large values supplied by user. Based on "video: tegra: host: Fix overflow issues in allocation" in nvhost/. Coverity ID 27942 Bug 1856419 Change-Id: I5e96d0ec184543782dfe8814ad7e856b3b71221c Signed-off-by: Mikko Perttunen Reviewed-on: http://git-master/r/1295062 GVS: Gerrit_Virtual_Submit Reviewed-by: Bibek Basu --- drivers/video/tegra/host/host1x/host1x.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/drivers/video/tegra/host/host1x/host1x.c b/drivers/video/tegra/host/host1x/host1x.c index 5631189c354f..522219484286 100644 --- a/drivers/video/tegra/host/host1x/host1x.c +++ b/drivers/video/tegra/host/host1x/host1x.c @@ -206,11 +206,11 @@ static int nvhost_ioctl_ctrl_sync_fence_create(struct nvhost_ctrl_userctx *ctx, name[0] = '\0'; } - pts = kmalloc(sizeof(*pts) * args->num_pts, GFP_KERNEL); + pts = kmalloc_array(args->num_pts, sizeof(*pts), GFP_KERNEL); if (!pts) return -ENOMEM; - + /* Multiplication overflow would have errored in kmalloc_array */ if (copy_from_user(pts, args_pts, sizeof(*pts) * args->num_pts)) { err = -EFAULT; goto out; -- cgit v1.2.3 From eeedfd3f36090f9d15e9749a1ede09a036b86a1f Mon Sep 17 00:00:00 2001 From: Roger Hsieh Date: Thu, 16 Feb 2017 18:00:32 +0800 Subject: arm: tegra12: jetson: disable usb charging detection Jetson TK1 doesn't support usb charging but the detection is still running. Disable it to avoid unexpected behavior. Bug 1861049 Change-Id: I13425d69e190a75084486ff1fc9afeb8aa7acb60 Signed-off-by: Roger Hsieh Reviewed-on: http://git-master/r/1308015 GVS: Gerrit_Virtual_Submit Reviewed-by: Bibek Basu --- arch/arm/mach-tegra/board-ardbeg.c | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/arch/arm/mach-tegra/board-ardbeg.c b/arch/arm/mach-tegra/board-ardbeg.c index 46c4d3f338e1..d6423a38cb87 100644 --- a/arch/arm/mach-tegra/board-ardbeg.c +++ b/arch/arm/mach-tegra/board-ardbeg.c @@ -660,6 +660,11 @@ static void ardbeg_usb_init(void) tegra_ehci1_utmi_pdata.id_det_type = TEGRA_USB_PMU_ID; } tegra_ehci1_utmi_pdata.id_extcon_dev_name = "as3722-extcon"; + + /* Disable Charging detection on Jetson */ + if (board_info.board_id == BOARD_PM375) + tegra_udc_pdata.u_data.dev.charging_supported = false; + } else { /* Ardbeg and TN8 */ -- cgit v1.2.3 From 80297568c1a53f70d335e1dcc734f2ce654bd4bc Mon Sep 17 00:00:00 2001 From: Sandipan Patra Date: Tue, 28 Feb 2017 15:46:07 +0530 Subject: T124: Add emc table to program SAMSUNG DRAM New emc table for samsung dram is added on JetsonTK1 target. Based on tegra bct strap value it can be chosen dynamically. Both emc table and embedded emc table has been updated accordingly. Bug 1752744 Change-Id: Ifc577d925712690daec6c6f1121458f01f720846 Signed-off-by: Sandipan Patra Reviewed-on: http://git-master/r/1312498 GVS: Gerrit_Virtual_Submit Reviewed-by: Bibek Basu --- arch/arm/mach-tegra/board-ardbeg-memory.c | 3648 ++++++++++++++++++++++++++++- 1 file changed, 3647 insertions(+), 1 deletion(-) diff --git a/arch/arm/mach-tegra/board-ardbeg-memory.c b/arch/arm/mach-tegra/board-ardbeg-memory.c index be97ef452170..3a5ebc78d1dc 100644 --- a/arch/arm/mach-tegra/board-ardbeg-memory.c +++ b/arch/arm/mach-tegra/board-ardbeg-memory.c @@ -1,5 +1,5 @@ /* - * Copyright (c) 2013-2014, NVIDIA CORPORATION. All rights reserved. + * Copyright (c) 2013-2017, NVIDIA CORPORATION. All rights reserved. * * This program is free software; you can redistribute it and/or modify * it under the terms of the GNU General Public License version 2 as @@ -26616,7 +26616,3643 @@ static struct tegra12_emc_table jetson_tk1_pm377_ddr3_emc_table[] = { }, }; +static struct tegra12_emc_table jetson_tk1_ddr3_K4B4G1646D_BFMA03_emc_table[] = { + { + 0x19, /* V5.0.18 */ + "01_12750_01_V5.0.18_V1.1", /* DVFS table version */ + 12750, /* SDRAM frequency */ + 800, /* min voltage */ + 800, /* gpu min voltage */ + "pllp_out0", /* clock source id */ + 0x4000003e, /* CLK_SOURCE_EMC */ + 165, /* number of burst_regs */ + 31, /* number of up_down_regs */ + { + 0x00000000, /* EMC_RC */ + 0x00000003, /* EMC_RFC */ + 0x00000000, /* EMC_RFC_SLR */ + 0x00000000, /* EMC_RAS */ + 0x00000000, /* EMC_RP */ + 0x00000004, /* EMC_R2W */ + 0x0000000a, /* EMC_W2R */ + 0x00000005, /* EMC_R2P */ + 0x0000000b, /* EMC_W2P */ + 0x00000000, /* EMC_RD_RCD */ + 0x00000000, /* EMC_WR_RCD */ + 0x00000003, /* EMC_RRD */ + 0x00000003, /* EMC_REXT */ + 0x00000000, /* EMC_WEXT */ + 0x00000006, /* EMC_WDV */ + 0x00000006, /* EMC_WDV_MASK */ + 0x00000006, /* EMC_QUSE */ + 0x00000002, /* EMC_QUSE_WIDTH */ + 0x00000000, /* EMC_IBDLY */ + 0x00000005, /* EMC_EINPUT */ + 0x00000005, /* EMC_EINPUT_DURATION */ + 0x00010000, /* EMC_PUTERM_EXTRA */ + 0x00000003, /* EMC_PUTERM_WIDTH */ + 0x00000000, /* EMC_PUTERM_ADJ */ + 0x00000000, /* EMC_CDB_CNTL_1 */ + 0x00000000, /* EMC_CDB_CNTL_2 */ + 0x00000000, /* EMC_CDB_CNTL_3 */ + 0x00000004, /* EMC_QRST */ + 0x0000000c, /* EMC_QSAFE */ + 0x0000000d, /* EMC_RDV */ + 0x0000000f, /* EMC_RDV_MASK */ + 0x00000060, /* EMC_REFRESH */ + 0x00000000, /* EMC_BURST_REFRESH_NUM */ + 0x00000018, /* EMC_PRE_REFRESH_REQ_CNT */ + 0x00000002, /* EMC_PDEX2WR */ + 0x00000002, /* EMC_PDEX2RD */ + 0x00000001, /* EMC_PCHG2PDEN */ + 0x00000000, /* EMC_ACT2PDEN */ + 0x00000007, /* EMC_AR2PDEN */ + 0x0000000f, /* EMC_RW2PDEN */ + 0x00000005, /* EMC_TXSR */ + 0x00000005, /* EMC_TXSRDLL */ + 0x00000004, /* EMC_TCKE */ + 0x00000005, /* EMC_TCKESR */ + 0x00000004, /* EMC_TPD */ + 0x00000000, /* EMC_TFAW */ + 0x00000000, /* EMC_TRPAB */ + 0x00000005, /* EMC_TCLKSTABLE */ + 0x00000005, /* EMC_TCLKSTOP */ + 0x00000064, /* EMC_TREFBW */ + 0x00000000, /* EMC_FBIO_CFG6 */ + 0x00000000, /* EMC_ODT_WRITE */ + 0x00000000, /* EMC_ODT_READ */ + 0x106aa298, /* EMC_FBIO_CFG5 */ + 0x002c00a0, /* EMC_CFG_DIG_DLL */ + 0x00008000, /* EMC_CFG_DIG_DLL_PERIOD */ + 0x00080000, /* EMC_DLL_XFORM_DQS0 */ + 0x00080000, /* EMC_DLL_XFORM_DQS1 */ + 0x00080000, /* EMC_DLL_XFORM_DQS2 */ + 0x00080000, /* EMC_DLL_XFORM_DQS3 */ + 0x00080000, /* EMC_DLL_XFORM_DQS4 */ + 0x00080000, /* EMC_DLL_XFORM_DQS5 */ + 0x00080000, /* EMC_DLL_XFORM_DQS6 */ + 0x00080000, /* EMC_DLL_XFORM_DQS7 */ + 0x00080000, /* EMC_DLL_XFORM_DQS8 */ + 0x00080000, /* EMC_DLL_XFORM_DQS9 */ + 0x00080000, /* EMC_DLL_XFORM_DQS10 */ + 0x00080000, /* EMC_DLL_XFORM_DQS11 */ + 0x00080000, /* EMC_DLL_XFORM_DQS12 */ + 0x00080000, /* EMC_DLL_XFORM_DQS13 */ + 0x00080000, /* EMC_DLL_XFORM_DQS14 */ + 0x00080000, /* EMC_DLL_XFORM_DQS15 */ + 0x00000000, /* EMC_DLL_XFORM_QUSE0 */ + 0x00000000, /* EMC_DLL_XFORM_QUSE1 */ + 0x00000000, /* EMC_DLL_XFORM_QUSE2 */ + 0x00000000, /* EMC_DLL_XFORM_QUSE3 */ + 0x00000000, /* EMC_DLL_XFORM_QUSE4 */ + 0x00000000, /* EMC_DLL_XFORM_QUSE5 */ + 0x00000000, /* EMC_DLL_XFORM_QUSE6 */ + 0x00000000, /* EMC_DLL_XFORM_QUSE7 */ + 0x00000000, /* EMC_DLL_XFORM_ADDR0 */ + 0x00000000, /* EMC_DLL_XFORM_ADDR1 */ + 0x00000000, /* EMC_DLL_XFORM_ADDR2 */ + 0x00000000, /* EMC_DLL_XFORM_ADDR3 */ + 0x00000000, /* EMC_DLL_XFORM_ADDR4 */ + 0x00000000, /* EMC_DLL_XFORM_ADDR5 */ + 0x00000000, /* EMC_DLL_XFORM_QUSE8 */ + 0x00000000, /* EMC_DLL_XFORM_QUSE9 */ + 0x00000000, /* EMC_DLL_XFORM_QUSE10 */ + 0x00000000, /* EMC_DLL_XFORM_QUSE11 */ + 0x00000000, /* EMC_DLL_XFORM_QUSE12 */ + 0x00000000, /* EMC_DLL_XFORM_QUSE13 */ + 0x00000000, /* EMC_DLL_XFORM_QUSE14 */ + 0x00000000, /* EMC_DLL_XFORM_QUSE15 */ + 0x00000000, /* EMC_DLI_TRIM_TXDQS0 */ + 0x00000000, /* EMC_DLI_TRIM_TXDQS1 */ + 0x00000000, /* EMC_DLI_TRIM_TXDQS2 */ + 0x00000000, /* EMC_DLI_TRIM_TXDQS3 */ + 0x00000000, /* EMC_DLI_TRIM_TXDQS4 */ + 0x00000000, /* EMC_DLI_TRIM_TXDQS5 */ + 0x00000000, /* EMC_DLI_TRIM_TXDQS6 */ + 0x00000000, /* EMC_DLI_TRIM_TXDQS7 */ + 0x00000000, /* EMC_DLI_TRIM_TXDQS8 */ + 0x00000000, /* EMC_DLI_TRIM_TXDQS9 */ + 0x00000000, /* EMC_DLI_TRIM_TXDQS10 */ + 0x00000000, /* EMC_DLI_TRIM_TXDQS11 */ + 0x00000000, /* EMC_DLI_TRIM_TXDQS12 */ + 0x00000000, /* EMC_DLI_TRIM_TXDQS13 */ + 0x00000000, /* EMC_DLI_TRIM_TXDQS14 */ + 0x00000000, /* EMC_DLI_TRIM_TXDQS15 */ + 0x000fc000, /* EMC_DLL_XFORM_DQ0 */ + 0x000fc000, /* EMC_DLL_XFORM_DQ1 */ + 0x000fc000, /* EMC_DLL_XFORM_DQ2 */ + 0x000fc000, /* EMC_DLL_XFORM_DQ3 */ + 0x0000fc00, /* EMC_DLL_XFORM_DQ4 */ + 0x0000fc00, /* EMC_DLL_XFORM_DQ5 */ + 0x0000fc00, /* EMC_DLL_XFORM_DQ6 */ + 0x0000fc00, /* EMC_DLL_XFORM_DQ7 */ + 0x10000280, /* EMC_XM2CMDPADCTRL */ + 0x00000000, /* EMC_XM2CMDPADCTRL4 */ + 0x00111111, /* EMC_XM2CMDPADCTRL5 */ + 0x0130b118, /* EMC_XM2DQSPADCTRL2 */ + 0x00000000, /* EMC_XM2DQPADCTRL2 */ + 0x00000000, /* EMC_XM2DQPADCTRL3 */ + 0x77ffc081, /* EMC_XM2CLKPADCTRL */ + 0x00000e0e, /* EMC_XM2CLKPADCTRL2 */ + 0x81f1f108, /* EMC_XM2COMPPADCTRL */ + 0x07070004, /* EMC_XM2VTTGENPADCTRL */ + 0x0000003f, /* EMC_XM2VTTGENPADCTRL2 */ + 0x016eeeee, /* EMC_XM2VTTGENPADCTRL3 */ + 0x51451400, /* EMC_XM2DQSPADCTRL3 */ + 0x00514514, /* EMC_XM2DQSPADCTRL4 */ + 0x00514514, /* EMC_XM2DQSPADCTRL5 */ + 0x51451400, /* EMC_XM2DQSPADCTRL6 */ + 0x0000003f, /* EMC_DSR_VTTGEN_DRV */ + 0x00000007, /* EMC_TXDSRVTTGEN */ + 0x00000000, /* EMC_FBIO_SPARE */ + 0x00000000, /* EMC_ZCAL_INTERVAL */ + 0x00000042, /* EMC_ZCAL_WAIT_CNT */ + 0x000e000e, /* EMC_MRS_WAIT_CNT */ + 0x000e000e, /* EMC_MRS_WAIT_CNT2 */ + 0x00000000, /* EMC_CTT */ + 0x00000003, /* EMC_CTT_DURATION */ + 0x0000f2f3, /* EMC_CFG_PIPE */ + 0x800001c5, /* EMC_DYN_SELF_REF_CONTROL */ + 0x0000000a, /* EMC_QPOP */ + 0x40040001, /* MC_EMEM_ARB_CFG */ + 0x8000000a, /* MC_EMEM_ARB_OUTSTANDING_REQ */ + 0x00000001, /* MC_EMEM_ARB_TIMING_RCD */ + 0x00000001, /* MC_EMEM_ARB_TIMING_RP */ + 0x00000002, /* MC_EMEM_ARB_TIMING_RC */ + 0x00000000, /* MC_EMEM_ARB_TIMING_RAS */ + 0x00000002, /* MC_EMEM_ARB_TIMING_FAW */ + 0x00000001, /* MC_EMEM_ARB_TIMING_RRD */ + 0x00000003, /* MC_EMEM_ARB_TIMING_RAP2PRE */ + 0x00000008, /* MC_EMEM_ARB_TIMING_WAP2PRE */ + 0x00000003, /* MC_EMEM_ARB_TIMING_R2R */ + 0x00000002, /* MC_EMEM_ARB_TIMING_W2W */ + 0x00000003, /* MC_EMEM_ARB_TIMING_R2W */ + 0x00000006, /* MC_EMEM_ARB_TIMING_W2R */ + 0x06030203, /* MC_EMEM_ARB_DA_TURNS */ + 0x000a0502, /* MC_EMEM_ARB_DA_COVERS */ + 0x77e30303, /* MC_EMEM_ARB_MISC0 */ + 0x70000f03, /* MC_EMEM_ARB_MISC1 */ + 0x001f0000, /* MC_EMEM_ARB_RING1_THROTTLE */ + }, + { + 0x00000001, /* MC_MLL_MPCORER_PTSA_RATE */ + 0x00000007, /* MC_PTSA_GRANT_DECREMENT */ + 0x00ff00ff, /* MC_LATENCY_ALLOWANCE_XUSB_0 */ + 0x00ff00ff, /* MC_LATENCY_ALLOWANCE_XUSB_1 */ + 0x00ff00ff, /* MC_LATENCY_ALLOWANCE_TSEC_0 */ + 0x00ff00ff, /* MC_LATENCY_ALLOWANCE_SDMMCA_0 */ + 0x00ff00ff, /* MC_LATENCY_ALLOWANCE_SDMMCAA_0 */ + 0x00ff00ff, /* MC_LATENCY_ALLOWANCE_SDMMC_0 */ + 0x00ff00ff, /* MC_LATENCY_ALLOWANCE_SDMMCAB_0 */ + 0x00ff0049, /* MC_LATENCY_ALLOWANCE_PPCS_0 */ + 0x00ff0080, /* MC_LATENCY_ALLOWANCE_PPCS_1 */ + 0x00ff0004, /* MC_LATENCY_ALLOWANCE_MPCORE_0 */ + 0x00ff0004, /* MC_LATENCY_ALLOWANCE_MPCORELP_0 */ + 0x000800ff, /* MC_LATENCY_ALLOWANCE_HC_0 */ + 0x000000ff, /* MC_LATENCY_ALLOWANCE_HC_1 */ + 0x00ff0004, /* MC_LATENCY_ALLOWANCE_AVPC_0 */ + 0x00ff00ff, /* MC_LATENCY_ALLOWANCE_GPU_0 */ + 0x00ff00ff, /* MC_LATENCY_ALLOWANCE_MSENC_0 */ + 0x00ff0024, /* MC_LATENCY_ALLOWANCE_HDA_0 */ + 0x00ff00ff, /* MC_LATENCY_ALLOWANCE_VIC_0 */ + 0x000000ff, /* MC_LATENCY_ALLOWANCE_VI2_0 */ + 0x000000ff, /* MC_LATENCY_ALLOWANCE_ISP2_0 */ + 0x00ff00ff, /* MC_LATENCY_ALLOWANCE_ISP2_1 */ + 0x000000ff, /* MC_LATENCY_ALLOWANCE_ISP2B_0 */ + 0x00ff00ff, /* MC_LATENCY_ALLOWANCE_ISP2B_1 */ + 0x00ff00ff, /* MC_LATENCY_ALLOWANCE_VDE_0 */ + 0x00ff00ff, /* MC_LATENCY_ALLOWANCE_VDE_1 */ + 0x00ff00ff, /* MC_LATENCY_ALLOWANCE_VDE_2 */ + 0x00ff00ff, /* MC_LATENCY_ALLOWANCE_VDE_3 */ + 0x00ff00ff, /* MC_LATENCY_ALLOWANCE_SATA_0 */ + 0x00ff00ff, /* MC_LATENCY_ALLOWANCE_AFI_0 */ + }, + 0x00000042, /* EMC_ZCAL_WAIT_CNT after clock change */ + 0x001fffff, /* EMC_AUTO_CAL_INTERVAL */ + 0x00000802, /* EMC_CTT_TERM_CTRL */ + 0x73240000, /* EMC_CFG */ + 0x000008c5, /* EMC_CFG_2 */ + 0x00040000, /* EMC_SEL_DPD_CTRL */ + 0x002c0068, /* EMC_CFG_DIG_DLL */ + 0x00000008, /* EMC_BGBIAS_CTL0 */ + 0x00000000, /* EMC_AUTO_CAL_CONFIG2 */ + 0x00000000, /* EMC_AUTO_CAL_CONFIG3 */ + 0xa1430000, /* EMC_AUTO_CAL_CONFIG */ + 0x80001221, /* Mode Register 0 */ + 0x80100003, /* Mode Register 1 */ + 0x80200008, /* Mode Register 2 */ + 0x00000000, /* Mode Register 4 */ + 57820, /* expected dvfs latency (ns) */ + }, + { + 0x19, /* V5.0.18 */ + "01_20400_01_V5.0.18_V1.1", /* DVFS table version */ + 20400, /* SDRAM frequency */ + 800, /* min voltage */ + 800, /* gpu min voltage */ + "pllp_out0", /* clock source id */ + 0x40000026, /* CLK_SOURCE_EMC */ + 165, /* number of burst_regs */ + 31, /* number of up_down_regs */ + { + 0x00000000, /* EMC_RC */ + 0x00000005, /* EMC_RFC */ + 0x00000000, /* EMC_RFC_SLR */ + 0x00000000, /* EMC_RAS */ + 0x00000000, /* EMC_RP */ + 0x00000004, /* EMC_R2W */ + 0x0000000a, /* EMC_W2R */ + 0x00000005, /* EMC_R2P */ + 0x0000000b, /* EMC_W2P */ + 0x00000000, /* EMC_RD_RCD */ + 0x00000000, /* EMC_WR_RCD */ + 0x00000003, /* EMC_RRD */ + 0x00000003, /* EMC_REXT */ + 0x00000000, /* EMC_WEXT */ + 0x00000006, /* EMC_WDV */ + 0x00000006, /* EMC_WDV_MASK */ + 0x00000006, /* EMC_QUSE */ + 0x00000002, /* EMC_QUSE_WIDTH */ + 0x00000000, /* EMC_IBDLY */ + 0x00000005, /* EMC_EINPUT */ + 0x00000005, /* EMC_EINPUT_DURATION */ + 0x00010000, /* EMC_PUTERM_EXTRA */ + 0x00000003, /* EMC_PUTERM_WIDTH */ + 0x00000000, /* EMC_PUTERM_ADJ */ + 0x00000000, /* EMC_CDB_CNTL_1 */ + 0x00000000, /* EMC_CDB_CNTL_2 */ + 0x00000000, /* EMC_CDB_CNTL_3 */ + 0x00000004, /* EMC_QRST */ + 0x0000000c, /* EMC_QSAFE */ + 0x0000000d, /* EMC_RDV */ + 0x0000000f, /* EMC_RDV_MASK */ + 0x0000009a, /* EMC_REFRESH */ + 0x00000000, /* EMC_BURST_REFRESH_NUM */ + 0x00000026, /* EMC_PRE_REFRESH_REQ_CNT */ + 0x00000002, /* EMC_PDEX2WR */ + 0x00000002, /* EMC_PDEX2RD */ + 0x00000001, /* EMC_PCHG2PDEN */ + 0x00000000, /* EMC_ACT2PDEN */ + 0x00000007, /* EMC_AR2PDEN */ + 0x0000000f, /* EMC_RW2PDEN */ + 0x00000006, /* EMC_TXSR */ + 0x00000006, /* EMC_TXSRDLL */ + 0x00000004, /* EMC_TCKE */ + 0x00000005, /* EMC_TCKESR */ + 0x00000004, /* EMC_TPD */ + 0x00000000, /* EMC_TFAW */ + 0x00000000, /* EMC_TRPAB */ + 0x00000005, /* EMC_TCLKSTABLE */ + 0x00000005, /* EMC_TCLKSTOP */ + 0x000000a0, /* EMC_TREFBW */ + 0x00000000, /* EMC_FBIO_CFG6 */ + 0x00000000, /* EMC_ODT_WRITE */ + 0x00000000, /* EMC_ODT_READ */ + 0x106aa298, /* EMC_FBIO_CFG5 */ + 0x002c00a0, /* EMC_CFG_DIG_DLL */ + 0x00008000, /* EMC_CFG_DIG_DLL_PERIOD */ + 0x00080000, /* EMC_DLL_XFORM_DQS0 */ + 0x00080000, /* EMC_DLL_XFORM_DQS1 */ + 0x00080000, /* EMC_DLL_XFORM_DQS2 */ + 0x00080000, /* EMC_DLL_XFORM_DQS3 */ + 0x00080000, /* EMC_DLL_XFORM_DQS4 */ + 0x00080000, /* EMC_DLL_XFORM_DQS5 */ + 0x00080000, /* EMC_DLL_XFORM_DQS6 */ + 0x00080000, /* EMC_DLL_XFORM_DQS7 */ + 0x00080000, /* EMC_DLL_XFORM_DQS8 */ + 0x00080000, /* EMC_DLL_XFORM_DQS9 */ + 0x00080000, /* EMC_DLL_XFORM_DQS10 */ + 0x00080000, /* EMC_DLL_XFORM_DQS11 */ + 0x00080000, /* EMC_DLL_XFORM_DQS12 */ + 0x00080000, /* EMC_DLL_XFORM_DQS13 */ + 0x00080000, /* EMC_DLL_XFORM_DQS14 */ + 0x00080000, /* EMC_DLL_XFORM_DQS15 */ + 0x00000000, /* EMC_DLL_XFORM_QUSE0 */ + 0x00000000, /* EMC_DLL_XFORM_QUSE1 */ + 0x00000000, /* EMC_DLL_XFORM_QUSE2 */ + 0x00000000, /* EMC_DLL_XFORM_QUSE3 */ + 0x00000000, /* EMC_DLL_XFORM_QUSE4 */ + 0x00000000, /* EMC_DLL_XFORM_QUSE5 */ + 0x00000000, /* EMC_DLL_XFORM_QUSE6 */ + 0x00000000, /* EMC_DLL_XFORM_QUSE7 */ + 0x00000000, /* EMC_DLL_XFORM_ADDR0 */ + 0x00000000, /* EMC_DLL_XFORM_ADDR1 */ + 0x00000000, /* EMC_DLL_XFORM_ADDR2 */ + 0x00000000, /* EMC_DLL_XFORM_ADDR3 */ + 0x00000000, /* EMC_DLL_XFORM_ADDR4 */ + 0x00000000, /* EMC_DLL_XFORM_ADDR5 */ + 0x00000000, /* EMC_DLL_XFORM_QUSE8 */ + 0x00000000, /* EMC_DLL_XFORM_QUSE9 */ + 0x00000000, /* EMC_DLL_XFORM_QUSE10 */ + 0x00000000, /* EMC_DLL_XFORM_QUSE11 */ + 0x00000000, /* EMC_DLL_XFORM_QUSE12 */ + 0x00000000, /* EMC_DLL_XFORM_QUSE13 */ + 0x00000000, /* EMC_DLL_XFORM_QUSE14 */ + 0x00000000, /* EMC_DLL_XFORM_QUSE15 */ + 0x00000000, /* EMC_DLI_TRIM_TXDQS0 */ + 0x00000000, /* EMC_DLI_TRIM_TXDQS1 */ + 0x00000000, /* EMC_DLI_TRIM_TXDQS2 */ + 0x00000000, /* EMC_DLI_TRIM_TXDQS3 */ + 0x00000000, /* EMC_DLI_TRIM_TXDQS4 */ + 0x00000000, /* EMC_DLI_TRIM_TXDQS5 */ + 0x00000000, /* EMC_DLI_TRIM_TXDQS6 */ + 0x00000000, /* EMC_DLI_TRIM_TXDQS7 */ + 0x00000000, /* EMC_DLI_TRIM_TXDQS8 */ + 0x00000000, /* EMC_DLI_TRIM_TXDQS9 */ + 0x00000000, /* EMC_DLI_TRIM_TXDQS10 */ + 0x00000000, /* EMC_DLI_TRIM_TXDQS11 */ + 0x00000000, /* EMC_DLI_TRIM_TXDQS12 */ + 0x00000000, /* EMC_DLI_TRIM_TXDQS13 */ + 0x00000000, /* EMC_DLI_TRIM_TXDQS14 */ + 0x00000000, /* EMC_DLI_TRIM_TXDQS15 */ + 0x000fc000, /* EMC_DLL_XFORM_DQ0 */ + 0x000fc000, /* EMC_DLL_XFORM_DQ1 */ + 0x000fc000, /* EMC_DLL_XFORM_DQ2 */ + 0x000fc000, /* EMC_DLL_XFORM_DQ3 */ + 0x0000fc00, /* EMC_DLL_XFORM_DQ4 */ + 0x0000fc00, /* EMC_DLL_XFORM_DQ5 */ + 0x0000fc00, /* EMC_DLL_XFORM_DQ6 */ + 0x0000fc00, /* EMC_DLL_XFORM_DQ7 */ + 0x10000280, /* EMC_XM2CMDPADCTRL */ + 0x00000000, /* EMC_XM2CMDPADCTRL4 */ + 0x00111111, /* EMC_XM2CMDPADCTRL5 */ + 0x0130b118, /* EMC_XM2DQSPADCTRL2 */ + 0x00000000, /* EMC_XM2DQPADCTRL2 */ + 0x00000000, /* EMC_XM2DQPADCTRL3 */ + 0x77ffc081, /* EMC_XM2CLKPADCTRL */ + 0x00000e0e, /* EMC_XM2CLKPADCTRL2 */ + 0x81f1f108, /* EMC_XM2COMPPADCTRL */ + 0x07070004, /* EMC_XM2VTTGENPADCTRL */ + 0x0000003f, /* EMC_XM2VTTGENPADCTRL2 */ + 0x016eeeee, /* EMC_XM2VTTGENPADCTRL3 */ + 0x51451400, /* EMC_XM2DQSPADCTRL3 */ + 0x00514514, /* EMC_XM2DQSPADCTRL4 */ + 0x00514514, /* EMC_XM2DQSPADCTRL5 */ + 0x51451400, /* EMC_XM2DQSPADCTRL6 */ + 0x0000003f, /* EMC_DSR_VTTGEN_DRV */ + 0x0000000b, /* EMC_TXDSRVTTGEN */ + 0x00000000, /* EMC_FBIO_SPARE */ + 0x00000000, /* EMC_ZCAL_INTERVAL */ + 0x00000042, /* EMC_ZCAL_WAIT_CNT */ + 0x000e000e, /* EMC_MRS_WAIT_CNT */ + 0x000e000e, /* EMC_MRS_WAIT_CNT2 */ + 0x00000000, /* EMC_CTT */ + 0x00000003, /* EMC_CTT_DURATION */ + 0x0000f2f3, /* EMC_CFG_PIPE */ + 0x8000023a, /* EMC_DYN_SELF_REF_CONTROL */ + 0x0000000a, /* EMC_QPOP */ + 0x40020001, /* MC_EMEM_ARB_CFG */ + 0x80000012, /* MC_EMEM_ARB_OUTSTANDING_REQ */ + 0x00000001, /* MC_EMEM_ARB_TIMING_RCD */ + 0x00000001, /* MC_EMEM_ARB_TIMING_RP */ + 0x00000002, /* MC_EMEM_ARB_TIMING_RC */ + 0x00000000, /* MC_EMEM_ARB_TIMING_RAS */ + 0x00000002, /* MC_EMEM_ARB_TIMING_FAW */ + 0x00000001, /* MC_EMEM_ARB_TIMING_RRD */ + 0x00000003, /* MC_EMEM_ARB_TIMING_RAP2PRE */ + 0x00000008, /* MC_EMEM_ARB_TIMING_WAP2PRE */ + 0x00000003, /* MC_EMEM_ARB_TIMING_R2R */ + 0x00000002, /* MC_EMEM_ARB_TIMING_W2W */ + 0x00000003, /* MC_EMEM_ARB_TIMING_R2W */ + 0x00000006, /* MC_EMEM_ARB_TIMING_W2R */ + 0x06030203, /* MC_EMEM_ARB_DA_TURNS */ + 0x000a0502, /* MC_EMEM_ARB_DA_COVERS */ + 0x76230303, /* MC_EMEM_ARB_MISC0 */ + 0x70000f03, /* MC_EMEM_ARB_MISC1 */ + 0x001f0000, /* MC_EMEM_ARB_RING1_THROTTLE */ + }, + { + 0x00000001, /* MC_MLL_MPCORER_PTSA_RATE */ + 0x0000000a, /* MC_PTSA_GRANT_DECREMENT */ + 0x00ff00ff, /* MC_LATENCY_ALLOWANCE_XUSB_0 */ + 0x00ff00ff, /* MC_LATENCY_ALLOWANCE_XUSB_1 */ + 0x00ff00ff, /* MC_LATENCY_ALLOWANCE_TSEC_0 */ + 0x00ff00ff, /* MC_LATENCY_ALLOWANCE_SDMMCA_0 */ + 0x00ff00ff, /* MC_LATENCY_ALLOWANCE_SDMMCAA_0 */ + 0x00ff00ff, /* MC_LATENCY_ALLOWANCE_SDMMC_0 */ + 0x00ff00ff, /* MC_LATENCY_ALLOWANCE_SDMMCAB_0 */ + 0x00ff0049, /* MC_LATENCY_ALLOWANCE_PPCS_0 */ + 0x00ff0080, /* MC_LATENCY_ALLOWANCE_PPCS_1 */ + 0x00ff0004, /* MC_LATENCY_ALLOWANCE_MPCORE_0 */ + 0x00ff0004, /* MC_LATENCY_ALLOWANCE_MPCORELP_0 */ + 0x000800ff, /* MC_LATENCY_ALLOWANCE_HC_0 */ + 0x000000ff, /* MC_LATENCY_ALLOWANCE_HC_1 */ + 0x00ff0004, /* MC_LATENCY_ALLOWANCE_AVPC_0 */ + 0x00ff00ff, /* MC_LATENCY_ALLOWANCE_GPU_0 */ + 0x00ff00ff, /* MC_LATENCY_ALLOWANCE_MSENC_0 */ + 0x00ff0024, /* MC_LATENCY_ALLOWANCE_HDA_0 */ + 0x00ff00ff, /* MC_LATENCY_ALLOWANCE_VIC_0 */ + 0x000000ff, /* MC_LATENCY_ALLOWANCE_VI2_0 */ + 0x000000ff, /* MC_LATENCY_ALLOWANCE_ISP2_0 */ + 0x00ff00ff, /* MC_LATENCY_ALLOWANCE_ISP2_1 */ + 0x000000ff, /* MC_LATENCY_ALLOWANCE_ISP2B_0 */ + 0x00ff00ff, /* MC_LATENCY_ALLOWANCE_ISP2B_1 */ + 0x00ff00ff, /* MC_LATENCY_ALLOWANCE_VDE_0 */ + 0x00ff00ff, /* MC_LATENCY_ALLOWANCE_VDE_1 */ + 0x00ff00ff, /* MC_LATENCY_ALLOWANCE_VDE_2 */ + 0x00ff00ff, /* MC_LATENCY_ALLOWANCE_VDE_3 */ + 0x00ff00ff, /* MC_LATENCY_ALLOWANCE_SATA_0 */ + 0x00ff00ff, /* MC_LATENCY_ALLOWANCE_AFI_0 */ + }, + 0x00000042, /* EMC_ZCAL_WAIT_CNT after clock change */ + 0x001fffff, /* EMC_AUTO_CAL_INTERVAL */ + 0x00000802, /* EMC_CTT_TERM_CTRL */ + 0x73240000, /* EMC_CFG */ + 0x000008c5, /* EMC_CFG_2 */ + 0x00040000, /* EMC_SEL_DPD_CTRL */ + 0x002c0068, /* EMC_CFG_DIG_DLL */ + 0x00000008, /* EMC_BGBIAS_CTL0 */ + 0x00000000, /* EMC_AUTO_CAL_CONFIG2 */ + 0x00000000, /* EMC_AUTO_CAL_CONFIG3 */ + 0xa1430000, /* EMC_AUTO_CAL_CONFIG */ + 0x80001221, /* Mode Register 0 */ + 0x80100003, /* Mode Register 1 */ + 0x80200008, /* Mode Register 2 */ + 0x00000000, /* Mode Register 4 */ + 35610, /* expected dvfs latency (ns) */ + }, + { + 0x19, /* V5.0.18 */ + "01_40800_01_V5.0.18_V1.1", /* DVFS table version */ + 40800, /* SDRAM frequency */ + 800, /* min voltage */ + 800, /* gpu min voltage */ + "pllp_out0", /* clock source id */ + 0x40000012, /* CLK_SOURCE_EMC */ + 165, /* number of burst_regs */ + 31, /* number of up_down_regs */ + { + 0x00000001, /* EMC_RC */ + 0x0000000a, /* EMC_RFC */ + 0x00000000, /* EMC_RFC_SLR */ + 0x00000001, /* EMC_RAS */ + 0x00000000, /* EMC_RP */ + 0x00000004, /* EMC_R2W */ + 0x0000000a, /* EMC_W2R */ + 0x00000005, /* EMC_R2P */ + 0x0000000b, /* EMC_W2P */ + 0x00000000, /* EMC_RD_RCD */ + 0x00000000, /* EMC_WR_RCD */ + 0x00000003, /* EMC_RRD */ + 0x00000003, /* EMC_REXT */ + 0x00000000, /* EMC_WEXT */ + 0x00000006, /* EMC_WDV */ + 0x00000006, /* EMC_WDV_MASK */ + 0x00000006, /* EMC_QUSE */ + 0x00000002, /* EMC_QUSE_WIDTH */ + 0x00000000, /* EMC_IBDLY */ + 0x00000005, /* EMC_EINPUT */ + 0x00000005, /* EMC_EINPUT_DURATION */ + 0x00010000, /* EMC_PUTERM_EXTRA */ + 0x00000003, /* EMC_PUTERM_WIDTH */ + 0x00000000, /* EMC_PUTERM_ADJ */ + 0x00000000, /* EMC_CDB_CNTL_1 */ + 0x00000000, /* EMC_CDB_CNTL_2 */ + 0x00000000, /* EMC_CDB_CNTL_3 */ + 0x00000004, /* EMC_QRST */ + 0x0000000c, /* EMC_QSAFE */ + 0x0000000d, /* EMC_RDV */ + 0x0000000f, /* EMC_RDV_MASK */ + 0x00000134, /* EMC_REFRESH */ + 0x00000000, /* EMC_BURST_REFRESH_NUM */ + 0x0000004d, /* EMC_PRE_REFRESH_REQ_CNT */ + 0x00000002, /* EMC_PDEX2WR */ + 0x00000002, /* EMC_PDEX2RD */ + 0x00000001, /* EMC_PCHG2PDEN */ + 0x00000000, /* EMC_ACT2PDEN */ + 0x00000008, /* EMC_AR2PDEN */ + 0x0000000f, /* EMC_RW2PDEN */ + 0x0000000c, /* EMC_TXSR */ + 0x0000000c, /* EMC_TXSRDLL */ + 0x00000004, /* EMC_TCKE */ + 0x00000005, /* EMC_TCKESR */ + 0x00000004, /* EMC_TPD */ + 0x00000000, /* EMC_TFAW */ + 0x00000000, /* EMC_TRPAB */ + 0x00000005, /* EMC_TCLKSTABLE */ + 0x00000005, /* EMC_TCLKSTOP */ + 0x0000013f, /* EMC_TREFBW */ + 0x00000000, /* EMC_FBIO_CFG6 */ + 0x00000000, /* EMC_ODT_WRITE */ + 0x00000000, /* EMC_ODT_READ */ + 0x106aa298, /* EMC_FBIO_CFG5 */ + 0x002c00a0, /* EMC_CFG_DIG_DLL */ + 0x00008000, /* EMC_CFG_DIG_DLL_PERIOD */ + 0x00080000, /* EMC_DLL_XFORM_DQS0 */ + 0x00080000, /* EMC_DLL_XFORM_DQS1 */ + 0x00080000, /* EMC_DLL_XFORM_DQS2 */ + 0x00080000, /* EMC_DLL_XFORM_DQS3 */ + 0x00080000, /* EMC_DLL_XFORM_DQS4 */ + 0x00080000, /* EMC_DLL_XFORM_DQS5 */ + 0x00080000, /* EMC_DLL_XFORM_DQS6 */ + 0x00080000, /* EMC_DLL_XFORM_DQS7 */ + 0x00080000, /* EMC_DLL_XFORM_DQS8 */ + 0x00080000, /* EMC_DLL_XFORM_DQS9 */ + 0x00080000, /* EMC_DLL_XFORM_DQS10 */ + 0x00080000, /* EMC_DLL_XFORM_DQS11 */ + 0x00080000, /* EMC_DLL_XFORM_DQS12 */ + 0x00080000, /* EMC_DLL_XFORM_DQS13 */ + 0x00080000, /* EMC_DLL_XFORM_DQS14 */ + 0x00080000, /* EMC_DLL_XFORM_DQS15 */ + 0x00000000, /* EMC_DLL_XFORM_QUSE0 */ + 0x00000000, /* EMC_DLL_XFORM_QUSE1 */ + 0x00000000, /* EMC_DLL_XFORM_QUSE2 */ + 0x00000000, /* EMC_DLL_XFORM_QUSE3 */ + 0x00000000, /* EMC_DLL_XFORM_QUSE4 */ + 0x00000000, /* EMC_DLL_XFORM_QUSE5 */ + 0x00000000, /* EMC_DLL_XFORM_QUSE6 */ + 0x00000000, /* EMC_DLL_XFORM_QUSE7 */ + 0x00000000, /* EMC_DLL_XFORM_ADDR0 */ + 0x00000000, /* EMC_DLL_XFORM_ADDR1 */ + 0x00000000, /* EMC_DLL_XFORM_ADDR2 */ + 0x00000000, /* EMC_DLL_XFORM_ADDR3 */ + 0x00000000, /* EMC_DLL_XFORM_ADDR4 */ + 0x00000000, /* EMC_DLL_XFORM_ADDR5 */ + 0x00000000, /* EMC_DLL_XFORM_QUSE8 */ + 0x00000000, /* EMC_DLL_XFORM_QUSE9 */ + 0x00000000, /* EMC_DLL_XFORM_QUSE10 */ + 0x00000000, /* EMC_DLL_XFORM_QUSE11 */ + 0x00000000, /* EMC_DLL_XFORM_QUSE12 */ + 0x00000000, /* EMC_DLL_XFORM_QUSE13 */ + 0x00000000, /* EMC_DLL_XFORM_QUSE14 */ + 0x00000000, /* EMC_DLL_XFORM_QUSE15 */ + 0x00000000, /* EMC_DLI_TRIM_TXDQS0 */ + 0x00000000, /* EMC_DLI_TRIM_TXDQS1 */ + 0x00000000, /* EMC_DLI_TRIM_TXDQS2 */ + 0x00000000, /* EMC_DLI_TRIM_TXDQS3 */ + 0x00000000, /* EMC_DLI_TRIM_TXDQS4 */ + 0x00000000, /* EMC_DLI_TRIM_TXDQS5 */ + 0x00000000, /* EMC_DLI_TRIM_TXDQS6 */ + 0x00000000, /* EMC_DLI_TRIM_TXDQS7 */ + 0x00000000, /* EMC_DLI_TRIM_TXDQS8 */ + 0x00000000, /* EMC_DLI_TRIM_TXDQS9 */ + 0x00000000, /* EMC_DLI_TRIM_TXDQS10 */ + 0x00000000, /* EMC_DLI_TRIM_TXDQS11 */ + 0x00000000, /* EMC_DLI_TRIM_TXDQS12 */ + 0x00000000, /* EMC_DLI_TRIM_TXDQS13 */ + 0x00000000, /* EMC_DLI_TRIM_TXDQS14 */ + 0x00000000, /* EMC_DLI_TRIM_TXDQS15 */ + 0x000fc000, /* EMC_DLL_XFORM_DQ0 */ + 0x000fc000, /* EMC_DLL_XFORM_DQ1 */ + 0x000fc000, /* EMC_DLL_XFORM_DQ2 */ + 0x000fc000, /* EMC_DLL_XFORM_DQ3 */ + 0x0000fc00, /* EMC_DLL_XFORM_DQ4 */ + 0x0000fc00, /* EMC_DLL_XFORM_DQ5 */ + 0x0000fc00, /* EMC_DLL_XFORM_DQ6 */ + 0x0000fc00, /* EMC_DLL_XFORM_DQ7 */ + 0x10000280, /* EMC_XM2CMDPADCTRL */ + 0x00000000, /* EMC_XM2CMDPADCTRL4 */ + 0x00111111, /* EMC_XM2CMDPADCTRL5 */ + 0x0130b118, /* EMC_XM2DQSPADCTRL2 */ + 0x00000000, /* EMC_XM2DQPADCTRL2 */ + 0x00000000, /* EMC_XM2DQPADCTRL3 */ + 0x77ffc081, /* EMC_XM2CLKPADCTRL */ + 0x00000e0e, /* EMC_XM2CLKPADCTRL2 */ + 0x81f1f108, /* EMC_XM2COMPPADCTRL */ + 0x07070004, /* EMC_XM2VTTGENPADCTRL */ + 0x0000003f, /* EMC_XM2VTTGENPADCTRL2 */ + 0x016eeeee, /* EMC_XM2VTTGENPADCTRL3 */ + 0x51451400, /* EMC_XM2DQSPADCTRL3 */ + 0x00514514, /* EMC_XM2DQSPADCTRL4 */ + 0x00514514, /* EMC_XM2DQSPADCTRL5 */ + 0x51451400, /* EMC_XM2DQSPADCTRL6 */ + 0x0000003f, /* EMC_DSR_VTTGEN_DRV */ + 0x00000015, /* EMC_TXDSRVTTGEN */ + 0x00000000, /* EMC_FBIO_SPARE */ + 0x00000000, /* EMC_ZCAL_INTERVAL */ + 0x00000042, /* EMC_ZCAL_WAIT_CNT */ + 0x000e000e, /* EMC_MRS_WAIT_CNT */ + 0x000e000e, /* EMC_MRS_WAIT_CNT2 */ + 0x00000000, /* EMC_CTT */ + 0x00000003, /* EMC_CTT_DURATION */ + 0x0000f2f3, /* EMC_CFG_PIPE */ + 0x80000370, /* EMC_DYN_SELF_REF_CONTROL */ + 0x0000000a, /* EMC_QPOP */ + 0xa0000001, /* MC_EMEM_ARB_CFG */ + 0x80000017, /* MC_EMEM_ARB_OUTSTANDING_REQ */ + 0x00000001, /* MC_EMEM_ARB_TIMING_RCD */ + 0x00000001, /* MC_EMEM_ARB_TIMING_RP */ + 0x00000002, /* MC_EMEM_ARB_TIMING_RC */ + 0x00000000, /* MC_EMEM_ARB_TIMING_RAS */ + 0x00000002, /* MC_EMEM_ARB_TIMING_FAW */ + 0x00000001, /* MC_EMEM_ARB_TIMING_RRD */ + 0x00000003, /* MC_EMEM_ARB_TIMING_RAP2PRE */ + 0x00000008, /* MC_EMEM_ARB_TIMING_WAP2PRE */ + 0x00000003, /* MC_EMEM_ARB_TIMING_R2R */ + 0x00000002, /* MC_EMEM_ARB_TIMING_W2W */ + 0x00000003, /* MC_EMEM_ARB_TIMING_R2W */ + 0x00000006, /* MC_EMEM_ARB_TIMING_W2R */ + 0x06030203, /* MC_EMEM_ARB_DA_TURNS */ + 0x000a0502, /* MC_EMEM_ARB_DA_COVERS */ + 0x74a30303, /* MC_EMEM_ARB_MISC0 */ + 0x70000f03, /* MC_EMEM_ARB_MISC1 */ + 0x001f0000, /* MC_EMEM_ARB_RING1_THROTTLE */ + }, + { + 0x00000001, /* MC_MLL_MPCORER_PTSA_RATE */ + 0x00000014, /* MC_PTSA_GRANT_DECREMENT */ + 0x00ff00ff, /* MC_LATENCY_ALLOWANCE_XUSB_0 */ + 0x00ff00ff, /* MC_LATENCY_ALLOWANCE_XUSB_1 */ + 0x00ff00ff, /* MC_LATENCY_ALLOWANCE_TSEC_0 */ + 0x00ff00ff, /* MC_LATENCY_ALLOWANCE_SDMMCA_0 */ + 0x00ff00ff, /* MC_LATENCY_ALLOWANCE_SDMMCAA_0 */ + 0x00ff00ff, /* MC_LATENCY_ALLOWANCE_SDMMC_0 */ + 0x00ff00ff, /* MC_LATENCY_ALLOWANCE_SDMMCAB_0 */ + 0x00ff0049, /* MC_LATENCY_ALLOWANCE_PPCS_0 */ + 0x00ff0080, /* MC_LATENCY_ALLOWANCE_PPCS_1 */ + 0x00ff0004, /* MC_LATENCY_ALLOWANCE_MPCORE_0 */ + 0x00ff0004, /* MC_LATENCY_ALLOWANCE_MPCORELP_0 */ + 0x000800ff, /* MC_LATENCY_ALLOWANCE_HC_0 */ + 0x000000ff, /* MC_LATENCY_ALLOWANCE_HC_1 */ + 0x00ff0004, /* MC_LATENCY_ALLOWANCE_AVPC_0 */ + 0x00ff00ff, /* MC_LATENCY_ALLOWANCE_GPU_0 */ + 0x00ff00ff, /* MC_LATENCY_ALLOWANCE_MSENC_0 */ + 0x00ff0024, /* MC_LATENCY_ALLOWANCE_HDA_0 */ + 0x00ff00ff, /* MC_LATENCY_ALLOWANCE_VIC_0 */ + 0x000000ff, /* MC_LATENCY_ALLOWANCE_VI2_0 */ + 0x000000ff, /* MC_LATENCY_ALLOWANCE_ISP2_0 */ + 0x00ff00ff, /* MC_LATENCY_ALLOWANCE_ISP2_1 */ + 0x000000ff, /* MC_LATENCY_ALLOWANCE_ISP2B_0 */ + 0x00ff00ff, /* MC_LATENCY_ALLOWANCE_ISP2B_1 */ + 0x00ff00ff, /* MC_LATENCY_ALLOWANCE_VDE_0 */ + 0x00ff00ff, /* MC_LATENCY_ALLOWANCE_VDE_1 */ + 0x00ff00ff, /* MC_LATENCY_ALLOWANCE_VDE_2 */ + 0x00ff00ff, /* MC_LATENCY_ALLOWANCE_VDE_3 */ + 0x00ff00ff, /* MC_LATENCY_ALLOWANCE_SATA_0 */ + 0x00ff00ff, /* MC_LATENCY_ALLOWANCE_AFI_0 */ + }, + 0x00000042, /* EMC_ZCAL_WAIT_CNT after clock change */ + 0x001fffff, /* EMC_AUTO_CAL_INTERVAL */ + 0x00000802, /* EMC_CTT_TERM_CTRL */ + 0x73240000, /* EMC_CFG */ + 0x000008c5, /* EMC_CFG_2 */ + 0x00040000, /* EMC_SEL_DPD_CTRL */ + 0x002c0068, /* EMC_CFG_DIG_DLL */ + 0x00000008, /* EMC_BGBIAS_CTL0 */ + 0x00000000, /* EMC_AUTO_CAL_CONFIG2 */ + 0x00000000, /* EMC_AUTO_CAL_CONFIG3 */ + 0xa1430000, /* EMC_AUTO_CAL_CONFIG */ + 0x80001221, /* Mode Register 0 */ + 0x80100003, /* Mode Register 1 */ + 0x80200008, /* Mode Register 2 */ + 0x00000000, /* Mode Register 4 */ + 20850, /* expected dvfs latency (ns) */ + }, + { + 0x19, /* V5.0.18 */ + "01_68000_01_V5.0.18_V1.1", /* DVFS table version */ + 68000, /* SDRAM frequency */ + 800, /* min voltage */ + 800, /* gpu min voltage */ + "pllp_out0", /* clock source id */ + 0x4000000a, /* CLK_SOURCE_EMC */ + 165, /* number of burst_regs */ + 31, /* number of up_down_regs */ + { + 0x00000003, /* EMC_RC */ + 0x00000011, /* EMC_RFC */ + 0x00000000, /* EMC_RFC_SLR */ + 0x00000002, /* EMC_RAS */ + 0x00000000, /* EMC_RP */ + 0x00000004, /* EMC_R2W */ + 0x0000000a, /* EMC_W2R */ + 0x00000005, /* EMC_R2P */ + 0x0000000b, /* EMC_W2P */ + 0x00000000, /* EMC_RD_RCD */ + 0x00000000, /* EMC_WR_RCD */ + 0x00000003, /* EMC_RRD */ + 0x00000003, /* EMC_REXT */ + 0x00000000, /* EMC_WEXT */ + 0x00000006, /* EMC_WDV */ + 0x00000006, /* EMC_WDV_MASK */ + 0x00000006, /* EMC_QUSE */ + 0x00000002, /* EMC_QUSE_WIDTH */ + 0x00000000, /* EMC_IBDLY */ + 0x00000005, /* EMC_EINPUT */ + 0x00000005, /* EMC_EINPUT_DURATION */ + 0x00010000, /* EMC_PUTERM_EXTRA */ + 0x00000003, /* EMC_PUTERM_WIDTH */ + 0x00000000, /* EMC_PUTERM_ADJ */ + 0x00000000, /* EMC_CDB_CNTL_1 */ + 0x00000000, /* EMC_CDB_CNTL_2 */ + 0x00000000, /* EMC_CDB_CNTL_3 */ + 0x00000004, /* EMC_QRST */ + 0x0000000c, /* EMC_QSAFE */ + 0x0000000d, /* EMC_RDV */ + 0x0000000f, /* EMC_RDV_MASK */ + 0x00000202, /* EMC_REFRESH */ + 0x00000000, /* EMC_BURST_REFRESH_NUM */ + 0x00000080, /* EMC_PRE_REFRESH_REQ_CNT */ + 0x00000002, /* EMC_PDEX2WR */ + 0x00000002, /* EMC_PDEX2RD */ + 0x00000001, /* EMC_PCHG2PDEN */ + 0x00000000, /* EMC_ACT2PDEN */ + 0x0000000f, /* EMC_AR2PDEN */ + 0x0000000f, /* EMC_RW2PDEN */ + 0x00000013, /* EMC_TXSR */ + 0x00000013, /* EMC_TXSRDLL */ + 0x00000004, /* EMC_TCKE */ + 0x00000005, /* EMC_TCKESR */ + 0x00000004, /* EMC_TPD */ + 0x00000001, /* EMC_TFAW */ + 0x00000000, /* EMC_TRPAB */ + 0x00000005, /* EMC_TCLKSTABLE */ + 0x00000005, /* EMC_TCLKSTOP */ + 0x00000213, /* EMC_TREFBW */ + 0x00000000, /* EMC_FBIO_CFG6 */ + 0x00000000, /* EMC_ODT_WRITE */ + 0x00000000, /* EMC_ODT_READ */ + 0x106aa298, /* EMC_FBIO_CFG5 */ + 0x002c00a0, /* EMC_CFG_DIG_DLL */ + 0x00008000, /* EMC_CFG_DIG_DLL_PERIOD */ + 0x00080000, /* EMC_DLL_XFORM_DQS0 */ + 0x00080000, /* EMC_DLL_XFORM_DQS1 */ + 0x00080000, /* EMC_DLL_XFORM_DQS2 */ + 0x00080000, /* EMC_DLL_XFORM_DQS3 */ + 0x00080000, /* EMC_DLL_XFORM_DQS4 */ + 0x00080000, /* EMC_DLL_XFORM_DQS5 */ + 0x00080000, /* EMC_DLL_XFORM_DQS6 */ + 0x00080000, /* EMC_DLL_XFORM_DQS7 */ + 0x00080000, /* EMC_DLL_XFORM_DQS8 */ + 0x00080000, /* EMC_DLL_XFORM_DQS9 */ + 0x00080000, /* EMC_DLL_XFORM_DQS10 */ + 0x00080000, /* EMC_DLL_XFORM_DQS11 */ + 0x00080000, /* EMC_DLL_XFORM_DQS12 */ + 0x00080000, /* EMC_DLL_XFORM_DQS13 */ + 0x00080000, /* EMC_DLL_XFORM_DQS14 */ + 0x00080000, /* EMC_DLL_XFORM_DQS15 */ + 0x00000000, /* EMC_DLL_XFORM_QUSE0 */ + 0x00000000, /* EMC_DLL_XFORM_QUSE1 */ + 0x00000000, /* EMC_DLL_XFORM_QUSE2 */ + 0x00000000, /* EMC_DLL_XFORM_QUSE3 */ + 0x00000000, /* EMC_DLL_XFORM_QUSE4 */ + 0x00000000, /* EMC_DLL_XFORM_QUSE5 */ + 0x00000000, /* EMC_DLL_XFORM_QUSE6 */ + 0x00000000, /* EMC_DLL_XFORM_QUSE7 */ + 0x00000000, /* EMC_DLL_XFORM_ADDR0 */ + 0x00000000, /* EMC_DLL_XFORM_ADDR1 */ + 0x00000000, /* EMC_DLL_XFORM_ADDR2 */ + 0x00000000, /* EMC_DLL_XFORM_ADDR3 */ + 0x00000000, /* EMC_DLL_XFORM_ADDR4 */ + 0x00000000, /* EMC_DLL_XFORM_ADDR5 */ + 0x00000000, /* EMC_DLL_XFORM_QUSE8 */ + 0x00000000, /* EMC_DLL_XFORM_QUSE9 */ + 0x00000000, /* EMC_DLL_XFORM_QUSE10 */ + 0x00000000, /* EMC_DLL_XFORM_QUSE11 */ + 0x00000000, /* EMC_DLL_XFORM_QUSE12 */ + 0x00000000, /* EMC_DLL_XFORM_QUSE13 */ + 0x00000000, /* EMC_DLL_XFORM_QUSE14 */ + 0x00000000, /* EMC_DLL_XFORM_QUSE15 */ + 0x00000000, /* EMC_DLI_TRIM_TXDQS0 */ + 0x00000000, /* EMC_DLI_TRIM_TXDQS1 */ + 0x00000000, /* EMC_DLI_TRIM_TXDQS2 */ + 0x00000000, /* EMC_DLI_TRIM_TXDQS3 */ + 0x00000000, /* EMC_DLI_TRIM_TXDQS4 */ + 0x00000000, /* EMC_DLI_TRIM_TXDQS5 */ + 0x00000000, /* EMC_DLI_TRIM_TXDQS6 */ + 0x00000000, /* EMC_DLI_TRIM_TXDQS7 */ + 0x00000000, /* EMC_DLI_TRIM_TXDQS8 */ + 0x00000000, /* EMC_DLI_TRIM_TXDQS9 */ + 0x00000000, /* EMC_DLI_TRIM_TXDQS10 */ + 0x00000000, /* EMC_DLI_TRIM_TXDQS11 */ + 0x00000000, /* EMC_DLI_TRIM_TXDQS12 */ + 0x00000000, /* EMC_DLI_TRIM_TXDQS13 */ + 0x00000000, /* EMC_DLI_TRIM_TXDQS14 */ + 0x00000000, /* EMC_DLI_TRIM_TXDQS15 */ + 0x000fc000, /* EMC_DLL_XFORM_DQ0 */ + 0x000fc000, /* EMC_DLL_XFORM_DQ1 */ + 0x000fc000, /* EMC_DLL_XFORM_DQ2 */ + 0x000fc000, /* EMC_DLL_XFORM_DQ3 */ + 0x0000fc00, /* EMC_DLL_XFORM_DQ4 */ + 0x0000fc00, /* EMC_DLL_XFORM_DQ5 */ + 0x0000fc00, /* EMC_DLL_XFORM_DQ6 */ + 0x0000fc00, /* EMC_DLL_XFORM_DQ7 */ + 0x10000280, /* EMC_XM2CMDPADCTRL */ + 0x00000000, /* EMC_XM2CMDPADCTRL4 */ + 0x00111111, /* EMC_XM2CMDPADCTRL5 */ + 0x0130b118, /* EMC_XM2DQSPADCTRL2 */ + 0x00000000, /* EMC_XM2DQPADCTRL2 */ + 0x00000000, /* EMC_XM2DQPADCTRL3 */ + 0x77ffc081, /* EMC_XM2CLKPADCTRL */ + 0x00000e0e, /* EMC_XM2CLKPADCTRL2 */ + 0x81f1f108, /* EMC_XM2COMPPADCTRL */ + 0x07070004, /* EMC_XM2VTTGENPADCTRL */ + 0x0000003f, /* EMC_XM2VTTGENPADCTRL2 */ + 0x016eeeee, /* EMC_XM2VTTGENPADCTRL3 */ + 0x51451400, /* EMC_XM2DQSPADCTRL3 */ + 0x00514514, /* EMC_XM2DQSPADCTRL4 */ + 0x00514514, /* EMC_XM2DQSPADCTRL5 */ + 0x51451400, /* EMC_XM2DQSPADCTRL6 */ + 0x0000003f, /* EMC_DSR_VTTGEN_DRV */ + 0x00000022, /* EMC_TXDSRVTTGEN */ + 0x00000000, /* EMC_FBIO_SPARE */ + 0x00000000, /* EMC_ZCAL_INTERVAL */ + 0x00000042, /* EMC_ZCAL_WAIT_CNT */ + 0x000e000e, /* EMC_MRS_WAIT_CNT */ + 0x000e000e, /* EMC_MRS_WAIT_CNT2 */ + 0x00000000, /* EMC_CTT */ + 0x00000003, /* EMC_CTT_DURATION */ + 0x0000f2f3, /* EMC_CFG_PIPE */ + 0x8000050e, /* EMC_DYN_SELF_REF_CONTROL */ + 0x0000000a, /* EMC_QPOP */ + 0x00000001, /* MC_EMEM_ARB_CFG */ + 0x8000001e, /* MC_EMEM_ARB_OUTSTANDING_REQ */ + 0x00000001, /* MC_EMEM_ARB_TIMING_RCD */ + 0x00000001, /* MC_EMEM_ARB_TIMING_RP */ + 0x00000002, /* MC_EMEM_ARB_TIMING_RC */ + 0x00000000, /* MC_EMEM_ARB_TIMING_RAS */ + 0x00000002, /* MC_EMEM_ARB_TIMING_FAW */ + 0x00000001, /* MC_EMEM_ARB_TIMING_RRD */ + 0x00000003, /* MC_EMEM_ARB_TIMING_RAP2PRE */ + 0x00000008, /* MC_EMEM_ARB_TIMING_WAP2PRE */ + 0x00000003, /* MC_EMEM_ARB_TIMING_R2R */ + 0x00000002, /* MC_EMEM_ARB_TIMING_W2W */ + 0x00000003, /* MC_EMEM_ARB_TIMING_R2W */ + 0x00000006, /* MC_EMEM_ARB_TIMING_W2R */ + 0x06030203, /* MC_EMEM_ARB_DA_TURNS */ + 0x000a0502, /* MC_EMEM_ARB_DA_COVERS */ + 0x74230403, /* MC_EMEM_ARB_MISC0 */ + 0x70000f03, /* MC_EMEM_ARB_MISC1 */ + 0x001f0000, /* MC_EMEM_ARB_RING1_THROTTLE */ + }, + { + 0x00000001, /* MC_MLL_MPCORER_PTSA_RATE */ + 0x00000021, /* MC_PTSA_GRANT_DECREMENT */ + 0x00ff00ff, /* MC_LATENCY_ALLOWANCE_XUSB_0 */ + 0x00ff00ff, /* MC_LATENCY_ALLOWANCE_XUSB_1 */ + 0x00ff00b0, /* MC_LATENCY_ALLOWANCE_TSEC_0 */ + 0x00ff00ff, /* MC_LATENCY_ALLOWANCE_SDMMCA_0 */ + 0x00ff00ec, /* MC_LATENCY_ALLOWANCE_SDMMCAA_0 */ + 0x00ff00ff, /* MC_LATENCY_ALLOWANCE_SDMMC_0 */ + 0x00ff00ec, /* MC_LATENCY_ALLOWANCE_SDMMCAB_0 */ + 0x00e90049, /* MC_LATENCY_ALLOWANCE_PPCS_0 */ + 0x00ff0080, /* MC_LATENCY_ALLOWANCE_PPCS_1 */ + 0x00ff0004, /* MC_LATENCY_ALLOWANCE_MPCORE_0 */ + 0x00ff0004, /* MC_LATENCY_ALLOWANCE_MPCORELP_0 */ + 0x000800ff, /* MC_LATENCY_ALLOWANCE_HC_0 */ + 0x000000ff, /* MC_LATENCY_ALLOWANCE_HC_1 */ + 0x00ff0004, /* MC_LATENCY_ALLOWANCE_AVPC_0 */ + 0x00ff00ff, /* MC_LATENCY_ALLOWANCE_GPU_0 */ + 0x00ff00a3, /* MC_LATENCY_ALLOWANCE_MSENC_0 */ + 0x00ff0024, /* MC_LATENCY_ALLOWANCE_HDA_0 */ + 0x00ff00ff, /* MC_LATENCY_ALLOWANCE_VIC_0 */ + 0x000000ff, /* MC_LATENCY_ALLOWANCE_VI2_0 */ + 0x000000ef, /* MC_LATENCY_ALLOWANCE_ISP2_0 */ + 0x00ff00ff, /* MC_LATENCY_ALLOWANCE_ISP2_1 */ + 0x000000ef, /* MC_LATENCY_ALLOWANCE_ISP2B_0 */ + 0x00ff00ff, /* MC_LATENCY_ALLOWANCE_ISP2B_1 */ + 0x00ff00ff, /* MC_LATENCY_ALLOWANCE_VDE_0 */ + 0x00ee00ef, /* MC_LATENCY_ALLOWANCE_VDE_1 */ + 0x00ff00ff, /* MC_LATENCY_ALLOWANCE_VDE_2 */ + 0x00ff00ff, /* MC_LATENCY_ALLOWANCE_VDE_3 */ + 0x00ff00ff, /* MC_LATENCY_ALLOWANCE_SATA_0 */ + 0x00ff00ff, /* MC_LATENCY_ALLOWANCE_AFI_0 */ + }, + 0x00000042, /* EMC_ZCAL_WAIT_CNT after clock change */ + 0x001fffff, /* EMC_AUTO_CAL_INTERVAL */ + 0x00000802, /* EMC_CTT_TERM_CTRL */ + 0x73240000, /* EMC_CFG */ + 0x000008c5, /* EMC_CFG_2 */ + 0x00040000, /* EMC_SEL_DPD_CTRL */ + 0x002c0068, /* EMC_CFG_DIG_DLL */ + 0x00000008, /* EMC_BGBIAS_CTL0 */ + 0x00000000, /* EMC_AUTO_CAL_CONFIG2 */ + 0x00000000, /* EMC_AUTO_CAL_CONFIG3 */ + 0xa1430000, /* EMC_AUTO_CAL_CONFIG */ + 0x80001221, /* Mode Register 0 */ + 0x80100003, /* Mode Register 1 */ + 0x80200008, /* Mode Register 2 */ + 0x00000000, /* Mode Register 4 */ + 10720, /* expected dvfs latency (ns) */ + }, + { + 0x19, /* V5.0.18 */ + "01_102000_01_V5.0.18_V1.1", /* DVFS table version */ + 102000, /* SDRAM frequency */ + 800, /* min voltage */ + 800, /* gpu min voltage */ + "pllp_out0", /* clock source id */ + 0x40000006, /* CLK_SOURCE_EMC */ + 165, /* number of burst_regs */ + 31, /* number of up_down_regs */ + { + 0x00000004, /* EMC_RC */ + 0x0000001a, /* EMC_RFC */ + 0x00000000, /* EMC_RFC_SLR */ + 0x00000003, /* EMC_RAS */ + 0x00000001, /* EMC_RP */ + 0x00000004, /* EMC_R2W */ + 0x0000000a, /* EMC_W2R */ + 0x00000005, /* EMC_R2P */ + 0x0000000b, /* EMC_W2P */ + 0x00000001, /* EMC_RD_RCD */ + 0x00000001, /* EMC_WR_RCD */ + 0x00000003, /* EMC_RRD */ + 0x00000003, /* EMC_REXT */ + 0x00000000, /* EMC_WEXT */ + 0x00000006, /* EMC_WDV */ + 0x00000006, /* EMC_WDV_MASK */ + 0x00000006, /* EMC_QUSE */ + 0x00000002, /* EMC_QUSE_WIDTH */ + 0x00000000, /* EMC_IBDLY */ + 0x00000005, /* EMC_EINPUT */ + 0x00000005, /* EMC_EINPUT_DURATION */ + 0x00010000, /* EMC_PUTERM_EXTRA */ + 0x00000003, /* EMC_PUTERM_WIDTH */ + 0x00000000, /* EMC_PUTERM_ADJ */ + 0x00000000, /* EMC_CDB_CNTL_1 */ + 0x00000000, /* EMC_CDB_CNTL_2 */ + 0x00000000, /* EMC_CDB_CNTL_3 */ + 0x00000004, /* EMC_QRST */ + 0x0000000c, /* EMC_QSAFE */ + 0x0000000d, /* EMC_RDV */ + 0x0000000f, /* EMC_RDV_MASK */ + 0x00000304, /* EMC_REFRESH */ + 0x00000000, /* EMC_BURST_REFRESH_NUM */ + 0x000000c1, /* EMC_PRE_REFRESH_REQ_CNT */ + 0x00000002, /* EMC_PDEX2WR */ + 0x00000002, /* EMC_PDEX2RD */ + 0x00000001, /* EMC_PCHG2PDEN */ + 0x00000000, /* EMC_ACT2PDEN */ + 0x00000018, /* EMC_AR2PDEN */ + 0x0000000f, /* EMC_RW2PDEN */ + 0x0000001c, /* EMC_TXSR */ + 0x0000001c, /* EMC_TXSRDLL */ + 0x00000004, /* EMC_TCKE */ + 0x00000005, /* EMC_TCKESR */ + 0x00000004, /* EMC_TPD */ + 0x00000002, /* EMC_TFAW */ + 0x00000000, /* EMC_TRPAB */ + 0x00000005, /* EMC_TCLKSTABLE */ + 0x00000005, /* EMC_TCLKSTOP */ + 0x0000031c, /* EMC_TREFBW */ + 0x00000000, /* EMC_FBIO_CFG6 */ + 0x00000000, /* EMC_ODT_WRITE */ + 0x00000000, /* EMC_ODT_READ */ + 0x106aa298, /* EMC_FBIO_CFG5 */ + 0x002c00a0, /* EMC_CFG_DIG_DLL */ + 0x00008000, /* EMC_CFG_DIG_DLL_PERIOD */ + 0x00080000, /* EMC_DLL_XFORM_DQS0 */ + 0x00080000, /* EMC_DLL_XFORM_DQS1 */ + 0x00080000, /* EMC_DLL_XFORM_DQS2 */ + 0x00080000, /* EMC_DLL_XFORM_DQS3 */ + 0x00080000, /* EMC_DLL_XFORM_DQS4 */ + 0x00080000, /* EMC_DLL_XFORM_DQS5 */ + 0x00080000, /* EMC_DLL_XFORM_DQS6 */ + 0x00080000, /* EMC_DLL_XFORM_DQS7 */ + 0x00080000, /* EMC_DLL_XFORM_DQS8 */ + 0x00080000, /* EMC_DLL_XFORM_DQS9 */ + 0x00080000, /* EMC_DLL_XFORM_DQS10 */ + 0x00080000, /* EMC_DLL_XFORM_DQS11 */ + 0x00080000, /* EMC_DLL_XFORM_DQS12 */ + 0x00080000, /* EMC_DLL_XFORM_DQS13 */ + 0x00080000, /* EMC_DLL_XFORM_DQS14 */ + 0x00080000, /* EMC_DLL_XFORM_DQS15 */ + 0x00000000, /* EMC_DLL_XFORM_QUSE0 */ + 0x00000000, /* EMC_DLL_XFORM_QUSE1 */ + 0x00000000, /* EMC_DLL_XFORM_QUSE2 */ + 0x00000000, /* EMC_DLL_XFORM_QUSE3 */ + 0x00000000, /* EMC_DLL_XFORM_QUSE4 */ + 0x00000000, /* EMC_DLL_XFORM_QUSE5 */ + 0x00000000, /* EMC_DLL_XFORM_QUSE6 */ + 0x00000000, /* EMC_DLL_XFORM_QUSE7 */ + 0x00000000, /* EMC_DLL_XFORM_ADDR0 */ + 0x00000000, /* EMC_DLL_XFORM_ADDR1 */ + 0x00000000, /* EMC_DLL_XFORM_ADDR2 */ + 0x00000000, /* EMC_DLL_XFORM_ADDR3 */ + 0x00000000, /* EMC_DLL_XFORM_ADDR4 */ + 0x00000000, /* EMC_DLL_XFORM_ADDR5 */ + 0x00000000, /* EMC_DLL_XFORM_QUSE8 */ + 0x00000000, /* EMC_DLL_XFORM_QUSE9 */ + 0x00000000, /* EMC_DLL_XFORM_QUSE10 */ + 0x00000000, /* EMC_DLL_XFORM_QUSE11 */ + 0x00000000, /* EMC_DLL_XFORM_QUSE12 */ + 0x00000000, /* EMC_DLL_XFORM_QUSE13 */ + 0x00000000, /* EMC_DLL_XFORM_QUSE14 */ + 0x00000000, /* EMC_DLL_XFORM_QUSE15 */ + 0x00000000, /* EMC_DLI_TRIM_TXDQS0 */ + 0x00000000, /* EMC_DLI_TRIM_TXDQS1 */ + 0x00000000, /* EMC_DLI_TRIM_TXDQS2 */ + 0x00000000, /* EMC_DLI_TRIM_TXDQS3 */ + 0x00000000, /* EMC_DLI_TRIM_TXDQS4 */ + 0x00000000, /* EMC_DLI_TRIM_TXDQS5 */ + 0x00000000, /* EMC_DLI_TRIM_TXDQS6 */ + 0x00000000, /* EMC_DLI_TRIM_TXDQS7 */ + 0x00000000, /* EMC_DLI_TRIM_TXDQS8 */ + 0x00000000, /* EMC_DLI_TRIM_TXDQS9 */ + 0x00000000, /* EMC_DLI_TRIM_TXDQS10 */ + 0x00000000, /* EMC_DLI_TRIM_TXDQS11 */ + 0x00000000, /* EMC_DLI_TRIM_TXDQS12 */ + 0x00000000, /* EMC_DLI_TRIM_TXDQS13 */ + 0x00000000, /* EMC_DLI_TRIM_TXDQS14 */ + 0x00000000, /* EMC_DLI_TRIM_TXDQS15 */ + 0x000fc000, /* EMC_DLL_XFORM_DQ0 */ + 0x000fc000, /* EMC_DLL_XFORM_DQ1 */ + 0x000fc000, /* EMC_DLL_XFORM_DQ2 */ + 0x000fc000, /* EMC_DLL_XFORM_DQ3 */ + 0x0000fc00, /* EMC_DLL_XFORM_DQ4 */ + 0x0000fc00, /* EMC_DLL_XFORM_DQ5 */ + 0x0000fc00, /* EMC_DLL_XFORM_DQ6 */ + 0x0000fc00, /* EMC_DLL_XFORM_DQ7 */ + 0x10000280, /* EMC_XM2CMDPADCTRL */ + 0x00000000, /* EMC_XM2CMDPADCTRL4 */ + 0x00111111, /* EMC_XM2CMDPADCTRL5 */ + 0x0130b118, /* EMC_XM2DQSPADCTRL2 */ + 0x00000000, /* EMC_XM2DQPADCTRL2 */ + 0x00000000, /* EMC_XM2DQPADCTRL3 */ + 0x77ffc081, /* EMC_XM2CLKPADCTRL */ + 0x00000e0e, /* EMC_XM2CLKPADCTRL2 */ + 0x81f1f108, /* EMC_XM2COMPPADCTRL */ + 0x07070004, /* EMC_XM2VTTGENPADCTRL */ + 0x0000003f, /* EMC_XM2VTTGENPADCTRL2 */ + 0x016eeeee, /* EMC_XM2VTTGENPADCTRL3 */ + 0x51451400, /* EMC_XM2DQSPADCTRL3 */ + 0x00514514, /* EMC_XM2DQSPADCTRL4 */ + 0x00514514, /* EMC_XM2DQSPADCTRL5 */ + 0x51451400, /* EMC_XM2DQSPADCTRL6 */ + 0x0000003f, /* EMC_DSR_VTTGEN_DRV */ + 0x00000033, /* EMC_TXDSRVTTGEN */ + 0x00000000, /* EMC_FBIO_SPARE */ + 0x00000000, /* EMC_ZCAL_INTERVAL */ + 0x00000042, /* EMC_ZCAL_WAIT_CNT */ + 0x000e000e, /* EMC_MRS_WAIT_CNT */ + 0x000e000e, /* EMC_MRS_WAIT_CNT2 */ + 0x00000000, /* EMC_CTT */ + 0x00000003, /* EMC_CTT_DURATION */ + 0x0000f2f3, /* EMC_CFG_PIPE */ + 0x80000713, /* EMC_DYN_SELF_REF_CONTROL */ + 0x0000000a, /* EMC_QPOP */ + 0x08000001, /* MC_EMEM_ARB_CFG */ + 0x80000026, /* MC_EMEM_ARB_OUTSTANDING_REQ */ + 0x00000001, /* MC_EMEM_ARB_TIMING_RCD */ + 0x00000001, /* MC_EMEM_ARB_TIMING_RP */ + 0x00000003, /* MC_EMEM_ARB_TIMING_RC */ + 0x00000000, /* MC_EMEM_ARB_TIMING_RAS */ + 0x00000002, /* MC_EMEM_ARB_TIMING_FAW */ + 0x00000001, /* MC_EMEM_ARB_TIMING_RRD */ + 0x00000003, /* MC_EMEM_ARB_TIMING_RAP2PRE */ + 0x00000008, /* MC_EMEM_ARB_TIMING_WAP2PRE */ + 0x00000003, /* MC_EMEM_ARB_TIMING_R2R */ + 0x00000002, /* MC_EMEM_ARB_TIMING_W2W */ + 0x00000003, /* MC_EMEM_ARB_TIMING_R2W */ + 0x00000006, /* MC_EMEM_ARB_TIMING_W2R */ + 0x06030203, /* MC_EMEM_ARB_DA_TURNS */ + 0x000a0503, /* MC_EMEM_ARB_DA_COVERS */ + 0x73c30504, /* MC_EMEM_ARB_MISC0 */ + 0x70000f03, /* MC_EMEM_ARB_MISC1 */ + 0x001f0000, /* MC_EMEM_ARB_RING1_THROTTLE */ + }, + { + 0x00000001, /* MC_MLL_MPCORER_PTSA_RATE */ + 0x00000031, /* MC_PTSA_GRANT_DECREMENT */ + 0x00ff00da, /* MC_LATENCY_ALLOWANCE_XUSB_0 */ + 0x00ff00da, /* MC_LATENCY_ALLOWANCE_XUSB_1 */ + 0x00ff0075, /* MC_LATENCY_ALLOWANCE_TSEC_0 */ + 0x00ff00ff, /* MC_LATENCY_ALLOWANCE_SDMMCA_0 */ + 0x00ff009d, /* MC_LATENCY_ALLOWANCE_SDMMCAA_0 */ + 0x00ff00ff, /* MC_LATENCY_ALLOWANCE_SDMMC_0 */ + 0x00ff009d, /* MC_LATENCY_ALLOWANCE_SDMMCAB_0 */ + 0x009b0049, /* MC_LATENCY_ALLOWANCE_PPCS_0 */ + 0x00ff0080, /* MC_LATENCY_ALLOWANCE_PPCS_1 */ + 0x00ff0004, /* MC_LATENCY_ALLOWANCE_MPCORE_0 */ + 0x00ff0004, /* MC_LATENCY_ALLOWANCE_MPCORELP_0 */ + 0x000800ad, /* MC_LATENCY_ALLOWANCE_HC_0 */ + 0x000000ff, /* MC_LATENCY_ALLOWANCE_HC_1 */ + 0x00ff0004, /* MC_LATENCY_ALLOWANCE_AVPC_0 */ + 0x00ff00c6, /* MC_LATENCY_ALLOWANCE_GPU_0 */ + 0x00ff006d, /* MC_LATENCY_ALLOWANCE_MSENC_0 */ + 0x00ff0024, /* MC_LATENCY_ALLOWANCE_HDA_0 */ + 0x00ff00d6, /* MC_LATENCY_ALLOWANCE_VIC_0 */ + 0x000000ff, /* MC_LATENCY_ALLOWANCE_VI2_0 */ + 0x0000009f, /* MC_LATENCY_ALLOWANCE_ISP2_0 */ + 0x00ff00ff, /* MC_LATENCY_ALLOWANCE_ISP2_1 */ + 0x0000009f, /* MC_LATENCY_ALLOWANCE_ISP2B_0 */ + 0x00ff00ff, /* MC_LATENCY_ALLOWANCE_ISP2B_1 */ + 0x00ff00ff, /* MC_LATENCY_ALLOWANCE_VDE_0 */ + 0x009f00a0, /* MC_LATENCY_ALLOWANCE_VDE_1 */ + 0x00ff00ff, /* MC_LATENCY_ALLOWANCE_VDE_2 */ + 0x00ff00ff, /* MC_LATENCY_ALLOWANCE_VDE_3 */ + 0x00ff00ff, /* MC_LATENCY_ALLOWANCE_SATA_0 */ + 0x00ff00da, /* MC_LATENCY_ALLOWANCE_AFI_0 */ + }, + 0x00000042, /* EMC_ZCAL_WAIT_CNT after clock change */ + 0x001fffff, /* EMC_AUTO_CAL_INTERVAL */ + 0x00000802, /* EMC_CTT_TERM_CTRL */ + 0x73240000, /* EMC_CFG */ + 0x000008c5, /* EMC_CFG_2 */ + 0x00040000, /* EMC_SEL_DPD_CTRL */ + 0x002c0068, /* EMC_CFG_DIG_DLL */ + 0x00000008, /* EMC_BGBIAS_CTL0 */ + 0x00000000, /* EMC_AUTO_CAL_CONFIG2 */ + 0x00000000, /* EMC_AUTO_CAL_CONFIG3 */ + 0xa1430000, /* EMC_AUTO_CAL_CONFIG */ + 0x80001221, /* Mode Register 0 */ + 0x80100003, /* Mode Register 1 */ + 0x80200008, /* Mode Register 2 */ + 0x00000000, /* Mode Register 4 */ + 6890, /* expected dvfs latency (ns) */ + }, + { + 0x19, /* V5.0.18 */ + "01_204000_01_V5.0.18_V1.1", /* DVFS table version */ + 204000, /* SDRAM frequency */ + 800, /* min voltage */ + 800, /* gpu min voltage */ + "pllp_out0", /* clock source id */ + 0x40000002, /* CLK_SOURCE_EMC */ + 165, /* number of burst_regs */ + 31, /* number of up_down_regs */ + { + 0x00000009, /* EMC_RC */ + 0x00000035, /* EMC_RFC */ + 0x00000000, /* EMC_RFC_SLR */ + 0x00000006, /* EMC_RAS */ + 0x00000002, /* EMC_RP */ + 0x00000005, /* EMC_R2W */ + 0x0000000a, /* EMC_W2R */ + 0x00000005, /* EMC_R2P */ + 0x0000000b, /* EMC_W2P */ + 0x00000002, /* EMC_RD_RCD */ + 0x00000002, /* EMC_WR_RCD */ + 0x00000003, /* EMC_RRD */ + 0x00000003, /* EMC_REXT */ + 0x00000000, /* EMC_WEXT */ + 0x00000005, /* EMC_WDV */ + 0x00000005, /* EMC_WDV_MASK */ + 0x00000006, /* EMC_QUSE */ + 0x00000002, /* EMC_QUSE_WIDTH */ + 0x00000000, /* EMC_IBDLY */ + 0x00000004, /* EMC_EINPUT */ + 0x00000006, /* EMC_EINPUT_DURATION */ + 0x00010000, /* EMC_PUTERM_EXTRA */ + 0x00000003, /* EMC_PUTERM_WIDTH */ + 0x00000000, /* EMC_PUTERM_ADJ */ + 0x00000000, /* EMC_CDB_CNTL_1 */ + 0x00000000, /* EMC_CDB_CNTL_2 */ + 0x00000000, /* EMC_CDB_CNTL_3 */ + 0x00000003, /* EMC_QRST */ + 0x0000000d, /* EMC_QSAFE */ + 0x0000000f, /* EMC_RDV */ + 0x00000011, /* EMC_RDV_MASK */ + 0x00000607, /* EMC_REFRESH */ + 0x00000000, /* EMC_BURST_REFRESH_NUM */ + 0x00000181, /* EMC_PRE_REFRESH_REQ_CNT */ + 0x00000002, /* EMC_PDEX2WR */ + 0x00000002, /* EMC_PDEX2RD */ + 0x00000001, /* EMC_PCHG2PDEN */ + 0x00000000, /* EMC_ACT2PDEN */ + 0x00000032, /* EMC_AR2PDEN */ + 0x0000000f, /* EMC_RW2PDEN */ + 0x00000038, /* EMC_TXSR */ + 0x00000038, /* EMC_TXSRDLL */ + 0x00000004, /* EMC_TCKE */ + 0x00000005, /* EMC_TCKESR */ + 0x00000004, /* EMC_TPD */ + 0x00000006, /* EMC_TFAW */ + 0x00000000, /* EMC_TRPAB */ + 0x00000005, /* EMC_TCLKSTABLE */ + 0x00000005, /* EMC_TCLKSTOP */ + 0x00000638, /* EMC_TREFBW */ + 0x00000000, /* EMC_FBIO_CFG6 */ + 0x00000000, /* EMC_ODT_WRITE */ + 0x00000000, /* EMC_ODT_READ */ + 0x106aa298, /* EMC_FBIO_CFG5 */ + 0x002c00a0, /* EMC_CFG_DIG_DLL */ + 0x00008000, /* EMC_CFG_DIG_DLL_PERIOD */ + 0x00080000, /* EMC_DLL_XFORM_DQS0 */ + 0x00080000, /* EMC_DLL_XFORM_DQS1 */ + 0x00080000, /* EMC_DLL_XFORM_DQS2 */ + 0x00080000, /* EMC_DLL_XFORM_DQS3 */ + 0x00080000, /* EMC_DLL_XFORM_DQS4 */ + 0x00080000, /* EMC_DLL_XFORM_DQS5 */ + 0x00080000, /* EMC_DLL_XFORM_DQS6 */ + 0x00080000, /* EMC_DLL_XFORM_DQS7 */ + 0x00080000, /* EMC_DLL_XFORM_DQS8 */ + 0x00080000, /* EMC_DLL_XFORM_DQS9 */ + 0x00080000, /* EMC_DLL_XFORM_DQS10 */ + 0x00080000, /* EMC_DLL_XFORM_DQS11 */ + 0x00080000, /* EMC_DLL_XFORM_DQS12 */ + 0x00080000, /* EMC_DLL_XFORM_DQS13 */ + 0x00080000, /* EMC_DLL_XFORM_DQS14 */ + 0x00080000, /* EMC_DLL_XFORM_DQS15 */ + 0x00000000, /* EMC_DLL_XFORM_QUSE0 */ + 0x00000000, /* EMC_DLL_XFORM_QUSE1 */ + 0x00000000, /* EMC_DLL_XFORM_QUSE2 */ + 0x00000000, /* EMC_DLL_XFORM_QUSE3 */ + 0x00000000, /* EMC_DLL_XFORM_QUSE4 */ + 0x00000000, /* EMC_DLL_XFORM_QUSE5 */ + 0x00000000, /* EMC_DLL_XFORM_QUSE6 */ + 0x00000000, /* EMC_DLL_XFORM_QUSE7 */ + 0x00000000, /* EMC_DLL_XFORM_ADDR0 */ + 0x00000000, /* EMC_DLL_XFORM_ADDR1 */ + 0x00008000, /* EMC_DLL_XFORM_ADDR2 */ + 0x00000000, /* EMC_DLL_XFORM_ADDR3 */ + 0x00000000, /* EMC_DLL_XFORM_ADDR4 */ + 0x00008000, /* EMC_DLL_XFORM_ADDR5 */ + 0x00000000, /* EMC_DLL_XFORM_QUSE8 */ + 0x00000000, /* EMC_DLL_XFORM_QUSE9 */ + 0x00000000, /* EMC_DLL_XFORM_QUSE10 */ + 0x00000000, /* EMC_DLL_XFORM_QUSE11 */ + 0x00000000, /* EMC_DLL_XFORM_QUSE12 */ + 0x00000000, /* EMC_DLL_XFORM_QUSE13 */ + 0x00000000, /* EMC_DLL_XFORM_QUSE14 */ + 0x00000000, /* EMC_DLL_XFORM_QUSE15 */ + 0x00000000, /* EMC_DLI_TRIM_TXDQS0 */ + 0x00000000, /* EMC_DLI_TRIM_TXDQS1 */ + 0x00000000, /* EMC_DLI_TRIM_TXDQS2 */ + 0x00000000, /* EMC_DLI_TRIM_TXDQS3 */ + 0x00000000, /* EMC_DLI_TRIM_TXDQS4 */ + 0x00000000, /* EMC_DLI_TRIM_TXDQS5 */ + 0x00000000, /* EMC_DLI_TRIM_TXDQS6 */ + 0x00000000, /* EMC_DLI_TRIM_TXDQS7 */ + 0x00000000, /* EMC_DLI_TRIM_TXDQS8 */ + 0x00000000, /* EMC_DLI_TRIM_TXDQS9 */ + 0x00000000, /* EMC_DLI_TRIM_TXDQS10 */ + 0x00000000, /* EMC_DLI_TRIM_TXDQS11 */ + 0x00000000, /* EMC_DLI_TRIM_TXDQS12 */ + 0x00000000, /* EMC_DLI_TRIM_TXDQS13 */ + 0x00000000, /* EMC_DLI_TRIM_TXDQS14 */ + 0x00000000, /* EMC_DLI_TRIM_TXDQS15 */ + 0x00090000, /* EMC_DLL_XFORM_DQ0 */ + 0x00090000, /* EMC_DLL_XFORM_DQ1 */ + 0x00090000, /* EMC_DLL_XFORM_DQ2 */ + 0x00090000, /* EMC_DLL_XFORM_DQ3 */ + 0x00009000, /* EMC_DLL_XFORM_DQ4 */ + 0x00009000, /* EMC_DLL_XFORM_DQ5 */ + 0x00009000, /* EMC_DLL_XFORM_DQ6 */ + 0x00009000, /* EMC_DLL_XFORM_DQ7 */ + 0x10000280, /* EMC_XM2CMDPADCTRL */ + 0x00000000, /* EMC_XM2CMDPADCTRL4 */ + 0x00111111, /* EMC_XM2CMDPADCTRL5 */ + 0x0130b118, /* EMC_XM2DQSPADCTRL2 */ + 0x00000000, /* EMC_XM2DQPADCTRL2 */ + 0x00000000, /* EMC_XM2DQPADCTRL3 */ + 0x77ffc081, /* EMC_XM2CLKPADCTRL */ + 0x00000707, /* EMC_XM2CLKPADCTRL2 */ + 0x81f1f108, /* EMC_XM2COMPPADCTRL */ + 0x07070004, /* EMC_XM2VTTGENPADCTRL */ + 0x0000003f, /* EMC_XM2VTTGENPADCTRL2 */ + 0x016eeeee, /* EMC_XM2VTTGENPADCTRL3 */ + 0x51451400, /* EMC_XM2DQSPADCTRL3 */ + 0x00514514, /* EMC_XM2DQSPADCTRL4 */ + 0x00514514, /* EMC_XM2DQSPADCTRL5 */ + 0x51451400, /* EMC_XM2DQSPADCTRL6 */ + 0x0000003f, /* EMC_DSR_VTTGEN_DRV */ + 0x00000066, /* EMC_TXDSRVTTGEN */ + 0x00000000, /* EMC_FBIO_SPARE */ + 0x00020000, /* EMC_ZCAL_INTERVAL */ + 0x00000100, /* EMC_ZCAL_WAIT_CNT */ + 0x000e000e, /* EMC_MRS_WAIT_CNT */ + 0x000e000e, /* EMC_MRS_WAIT_CNT2 */ + 0x00000000, /* EMC_CTT */ + 0x00000003, /* EMC_CTT_DURATION */ + 0x0000d2b3, /* EMC_CFG_PIPE */ + 0x80000d22, /* EMC_DYN_SELF_REF_CONTROL */ + 0x0000000a, /* EMC_QPOP */ + 0x01000003, /* MC_EMEM_ARB_CFG */ + 0x80000040, /* MC_EMEM_ARB_OUTSTANDING_REQ */ + 0x00000001, /* MC_EMEM_ARB_TIMING_RCD */ + 0x00000001, /* MC_EMEM_ARB_TIMING_RP */ + 0x00000004, /* MC_EMEM_ARB_TIMING_RC */ + 0x00000002, /* MC_EMEM_ARB_TIMING_RAS */ + 0x00000003, /* MC_EMEM_ARB_TIMING_FAW */ + 0x00000001, /* MC_EMEM_ARB_TIMING_RRD */ + 0x00000003, /* MC_EMEM_ARB_TIMING_RAP2PRE */ + 0x00000008, /* MC_EMEM_ARB_TIMING_WAP2PRE */ + 0x00000003, /* MC_EMEM_ARB_TIMING_R2R */ + 0x00000002, /* MC_EMEM_ARB_TIMING_W2W */ + 0x00000004, /* MC_EMEM_ARB_TIMING_R2W */ + 0x00000006, /* MC_EMEM_ARB_TIMING_W2R */ + 0x06040203, /* MC_EMEM_ARB_DA_TURNS */ + 0x000a0504, /* MC_EMEM_ARB_DA_COVERS */ + 0x73840a05, /* MC_EMEM_ARB_MISC0 */ + 0x70000f03, /* MC_EMEM_ARB_MISC1 */ + 0x001f0000, /* MC_EMEM_ARB_RING1_THROTTLE */ + }, + { + 0x00000001, /* MC_MLL_MPCORER_PTSA_RATE */ + 0x00000062, /* MC_PTSA_GRANT_DECREMENT */ + 0x00ff006d, /* MC_LATENCY_ALLOWANCE_XUSB_0 */ + 0x00ff006d, /* MC_LATENCY_ALLOWANCE_XUSB_1 */ + 0x00ff003c, /* MC_LATENCY_ALLOWANCE_TSEC_0 */ + 0x00ff00af, /* MC_LATENCY_ALLOWANCE_SDMMCA_0 */ + 0x00ff004f, /* MC_LATENCY_ALLOWANCE_SDMMCAA_0 */ + 0x00ff00af, /* MC_LATENCY_ALLOWANCE_SDMMC_0 */ + 0x00ff004f, /* MC_LATENCY_ALLOWANCE_SDMMCAB_0 */ + 0x004e0049, /* MC_LATENCY_ALLOWANCE_PPCS_0 */ + 0x00ff0080, /* MC_LATENCY_ALLOWANCE_PPCS_1 */ + 0x00ff0004, /* MC_LATENCY_ALLOWANCE_MPCORE_0 */ + 0x00ff0004, /* MC_LATENCY_ALLOWANCE_MPCORELP_0 */ + 0x00080057, /* MC_LATENCY_ALLOWANCE_HC_0 */ + 0x000000ff, /* MC_LATENCY_ALLOWANCE_HC_1 */ + 0x00ff0004, /* MC_LATENCY_ALLOWANCE_AVPC_0 */ + 0x00ff0063, /* MC_LATENCY_ALLOWANCE_GPU_0 */ + 0x00ff0036, /* MC_LATENCY_ALLOWANCE_MSENC_0 */ + 0x00ff0024, /* MC_LATENCY_ALLOWANCE_HDA_0 */ + 0x00ff006b, /* MC_LATENCY_ALLOWANCE_VIC_0 */ + 0x000000ff, /* MC_LATENCY_ALLOWANCE_VI2_0 */ + 0x00000050, /* MC_LATENCY_ALLOWANCE_ISP2_0 */ + 0x00ff00ff, /* MC_LATENCY_ALLOWANCE_ISP2_1 */ + 0x00000050, /* MC_LATENCY_ALLOWANCE_ISP2B_0 */ + 0x00ff00ff, /* MC_LATENCY_ALLOWANCE_ISP2B_1 */ + 0x00d400ff, /* MC_LATENCY_ALLOWANCE_VDE_0 */ + 0x00510050, /* MC_LATENCY_ALLOWANCE_VDE_1 */ + 0x00ff00ff, /* MC_LATENCY_ALLOWANCE_VDE_2 */ + 0x00ff00ff, /* MC_LATENCY_ALLOWANCE_VDE_3 */ + 0x00ff00c6, /* MC_LATENCY_ALLOWANCE_SATA_0 */ + 0x00ff006d, /* MC_LATENCY_ALLOWANCE_AFI_0 */ + }, + 0x00000042, /* EMC_ZCAL_WAIT_CNT after clock change */ + 0x001fffff, /* EMC_AUTO_CAL_INTERVAL */ + 0x00000802, /* EMC_CTT_TERM_CTRL */ + 0x73240000, /* EMC_CFG */ + 0x0000088d, /* EMC_CFG_2 */ + 0x00040000, /* EMC_SEL_DPD_CTRL */ + 0x002c0068, /* EMC_CFG_DIG_DLL */ + 0x00000008, /* EMC_BGBIAS_CTL0 */ + 0x00000000, /* EMC_AUTO_CAL_CONFIG2 */ + 0x00000000, /* EMC_AUTO_CAL_CONFIG3 */ + 0xa1430000, /* EMC_AUTO_CAL_CONFIG */ + 0x80001221, /* Mode Register 0 */ + 0x80100003, /* Mode Register 1 */ + 0x80200008, /* Mode Register 2 */ + 0x00000000, /* Mode Register 4 */ + 3420, /* expected dvfs latency (ns) */ + }, + { + 0x19, /* V5.0.18 */ + "01_300000_01_V5.0.18_V1.1", /* DVFS table version */ + 300000, /* SDRAM frequency */ + 820, /* min voltage */ + 820, /* gpu min voltage */ + "pllc_out0", /* clock source id */ + 0x20000002, /* CLK_SOURCE_EMC */ + 165, /* number of burst_regs */ + 31, /* number of up_down_regs */ + { + 0x0000000d, /* EMC_RC */ + 0x0000004c, /* EMC_RFC */ + 0x00000000, /* EMC_RFC_SLR */ + 0x00000009, /* EMC_RAS */ + 0x00000003, /* EMC_RP */ + 0x00000004, /* EMC_R2W */ + 0x00000008, /* EMC_W2R */ + 0x00000002, /* EMC_R2P */ + 0x00000009, /* EMC_W2P */ + 0x00000003, /* EMC_RD_RCD */ + 0x00000003, /* EMC_WR_RCD */ + 0x00000002, /* EMC_RRD */ + 0x00000002, /* EMC_REXT */ + 0x00000000, /* EMC_WEXT */ + 0x00000003, /* EMC_WDV */ + 0x00000003, /* EMC_WDV_MASK */ + 0x00000005, /* EMC_QUSE */ + 0x00000002, /* EMC_QUSE_WIDTH */ + 0x00000000, /* EMC_IBDLY */ + 0x00000002, /* EMC_EINPUT */ + 0x00000007, /* EMC_EINPUT_DURATION */ + 0x00020000, /* EMC_PUTERM_EXTRA */ + 0x00000003, /* EMC_PUTERM_WIDTH */ + 0x00000000, /* EMC_PUTERM_ADJ */ + 0x00000000, /* EMC_CDB_CNTL_1 */ + 0x00000000, /* EMC_CDB_CNTL_2 */ + 0x00000000, /* EMC_CDB_CNTL_3 */ + 0x00000001, /* EMC_QRST */ + 0x0000000e, /* EMC_QSAFE */ + 0x00000010, /* EMC_RDV */ + 0x00000012, /* EMC_RDV_MASK */ + 0x000008e4, /* EMC_REFRESH */ + 0x00000000, /* EMC_BURST_REFRESH_NUM */ + 0x00000239, /* EMC_PRE_REFRESH_REQ_CNT */ + 0x00000001, /* EMC_PDEX2WR */ + 0x00000008, /* EMC_PDEX2RD */ + 0x00000001, /* EMC_PCHG2PDEN */ + 0x00000000, /* EMC_ACT2PDEN */ + 0x0000004a, /* EMC_AR2PDEN */ + 0x0000000e, /* EMC_RW2PDEN */ + 0x00000051, /* EMC_TXSR */ + 0x00000200, /* EMC_TXSRDLL */ + 0x00000004, /* EMC_TCKE */ + 0x00000005, /* EMC_TCKESR */ + 0x00000004, /* EMC_TPD */ + 0x00000008, /* EMC_TFAW */ + 0x00000000, /* EMC_TRPAB */ + 0x00000005, /* EMC_TCLKSTABLE */ + 0x00000005, /* EMC_TCLKSTOP */ + 0x00000924, /* EMC_TREFBW */ + 0x00000000, /* EMC_FBIO_CFG6 */ + 0x00000000, /* EMC_ODT_WRITE */ + 0x00000000, /* EMC_ODT_READ */ + 0x104ab098, /* EMC_FBIO_CFG5 */ + 0x002c00a0, /* EMC_CFG_DIG_DLL */ + 0x00008000, /* EMC_CFG_DIG_DLL_PERIOD */ + 0x00030000, /* EMC_DLL_XFORM_DQS0 */ + 0x00030000, /* EMC_DLL_XFORM_DQS1 */ + 0x00030000, /* EMC_DLL_XFORM_DQS2 */ + 0x00030000, /* EMC_DLL_XFORM_DQS3 */ + 0x00030000, /* EMC_DLL_XFORM_DQS4 */ + 0x00030000, /* EMC_DLL_XFORM_DQS5 */ + 0x00030000, /* EMC_DLL_XFORM_DQS6 */ + 0x00030000, /* EMC_DLL_XFORM_DQS7 */ + 0x00030000, /* EMC_DLL_XFORM_DQS8 */ + 0x00030000, /* EMC_DLL_XFORM_DQS9 */ + 0x00030000, /* EMC_DLL_XFORM_DQS10 */ + 0x00030000, /* EMC_DLL_XFORM_DQS11 */ + 0x00030000, /* EMC_DLL_XFORM_DQS12 */ + 0x00030000, /* EMC_DLL_XFORM_DQS13 */ + 0x00030000, /* EMC_DLL_XFORM_DQS14 */ + 0x00030000, /* EMC_DLL_XFORM_DQS15 */ + 0x00000000, /* EMC_DLL_XFORM_QUSE0 */ + 0x00000000, /* EMC_DLL_XFORM_QUSE1 */ + 0x00000000, /* EMC_DLL_XFORM_QUSE2 */ + 0x00000000, /* EMC_DLL_XFORM_QUSE3 */ + 0x00000000, /* EMC_DLL_XFORM_QUSE4 */ + 0x00000000, /* EMC_DLL_XFORM_QUSE5 */ + 0x00000000, /* EMC_DLL_XFORM_QUSE6 */ + 0x00000000, /* EMC_DLL_XFORM_QUSE7 */ + 0x00098000, /* EMC_DLL_XFORM_ADDR0 */ + 0x00098000, /* EMC_DLL_XFORM_ADDR1 */ + 0x00000000, /* EMC_DLL_XFORM_ADDR2 */ + 0x00098000, /* EMC_DLL_XFORM_ADDR3 */ + 0x00098000, /* EMC_DLL_XFORM_ADDR4 */ + 0x00000000, /* EMC_DLL_XFORM_ADDR5 */ + 0x00000000, /* EMC_DLL_XFORM_QUSE8 */ + 0x00000000, /* EMC_DLL_XFORM_QUSE9 */ + 0x00000000, /* EMC_DLL_XFORM_QUSE10 */ + 0x00000000, /* EMC_DLL_XFORM_QUSE11 */ + 0x00000000, /* EMC_DLL_XFORM_QUSE12 */ + 0x00000000, /* EMC_DLL_XFORM_QUSE13 */ + 0x00000000, /* EMC_DLL_XFORM_QUSE14 */ + 0x00000000, /* EMC_DLL_XFORM_QUSE15 */ + 0x00000000, /* EMC_DLI_TRIM_TXDQS0 */ + 0x00000000, /* EMC_DLI_TRIM_TXDQS1 */ + 0x00000000, /* EMC_DLI_TRIM_TXDQS2 */ + 0x00000000, /* EMC_DLI_TRIM_TXDQS3 */ + 0x00000000, /* EMC_DLI_TRIM_TXDQS4 */ + 0x00000000, /* EMC_DLI_TRIM_TXDQS5 */ + 0x00000000, /* EMC_DLI_TRIM_TXDQS6 */ + 0x00000000, /* EMC_DLI_TRIM_TXDQS7 */ + 0x00000000, /* EMC_DLI_TRIM_TXDQS8 */ + 0x00000000, /* EMC_DLI_TRIM_TXDQS9 */ + 0x00000000, /* EMC_DLI_TRIM_TXDQS10 */ + 0x00000000, /* EMC_DLI_TRIM_TXDQS11 */ + 0x00000000, /* EMC_DLI_TRIM_TXDQS12 */ + 0x00000000, /* EMC_DLI_TRIM_TXDQS13 */ + 0x00000000, /* EMC_DLI_TRIM_TXDQS14 */ + 0x00000000, /* EMC_DLI_TRIM_TXDQS15 */ + 0x00050000, /* EMC_DLL_XFORM_DQ0 */ + 0x00050000, /* EMC_DLL_XFORM_DQ1 */ + 0x00050000, /* EMC_DLL_XFORM_DQ2 */ + 0x00050000, /* EMC_DLL_XFORM_DQ3 */ + 0x00005000, /* EMC_DLL_XFORM_DQ4 */ + 0x00005000, /* EMC_DLL_XFORM_DQ5 */ + 0x00005000, /* EMC_DLL_XFORM_DQ6 */ + 0x00005000, /* EMC_DLL_XFORM_DQ7 */ + 0x10000280, /* EMC_XM2CMDPADCTRL */ + 0x00000000, /* EMC_XM2CMDPADCTRL4 */ + 0x00111111, /* EMC_XM2CMDPADCTRL5 */ + 0x01231339, /* EMC_XM2DQSPADCTRL2 */ + 0x00000000, /* EMC_XM2DQPADCTRL2 */ + 0x00000000, /* EMC_XM2DQPADCTRL3 */ + 0x77ffc081, /* EMC_XM2CLKPADCTRL */ + 0x00000505, /* EMC_XM2CLKPADCTRL2 */ + 0x81f1f108, /* EMC_XM2COMPPADCTRL */ + 0x07070004, /* EMC_XM2VTTGENPADCTRL */ + 0x00000000, /* EMC_XM2VTTGENPADCTRL2 */ + 0x016eeeee, /* EMC_XM2VTTGENPADCTRL3 */ + 0x51451420, /* EMC_XM2DQSPADCTRL3 */ + 0x00514514, /* EMC_XM2DQSPADCTRL4 */ + 0x00514514, /* EMC_XM2DQSPADCTRL5 */ + 0x51451400, /* EMC_XM2DQSPADCTRL6 */ + 0x0000003f, /* EMC_DSR_VTTGEN_DRV */ + 0x00000096, /* EMC_TXDSRVTTGEN */ + 0x00000000, /* EMC_FBIO_SPARE */ + 0x00020000, /* EMC_ZCAL_INTERVAL */ + 0x00000100, /* EMC_ZCAL_WAIT_CNT */ + 0x0174000e, /* EMC_MRS_WAIT_CNT */ + 0x0174000e, /* EMC_MRS_WAIT_CNT2 */ + 0x00000000, /* EMC_CTT */ + 0x00000003, /* EMC_CTT_DURATION */ + 0x000052a3, /* EMC_CFG_PIPE */ + 0x800012d7, /* EMC_DYN_SELF_REF_CONTROL */ + 0x00000009, /* EMC_QPOP */ + 0x08000004, /* MC_EMEM_ARB_CFG */ + 0x80000040, /* MC_EMEM_ARB_OUTSTANDING_REQ */ + 0x00000001, /* MC_EMEM_ARB_TIMING_RCD */ + 0x00000002, /* MC_EMEM_ARB_TIMING_RP */ + 0x00000007, /* MC_EMEM_ARB_TIMING_RC */ + 0x00000004, /* MC_EMEM_ARB_TIMING_RAS */ + 0x00000004, /* MC_EMEM_ARB_TIMING_FAW */ + 0x00000001, /* MC_EMEM_ARB_TIMING_RRD */ + 0x00000002, /* MC_EMEM_ARB_TIMING_RAP2PRE */ + 0x00000007, /* MC_EMEM_ARB_TIMING_WAP2PRE */ + 0x00000002, /* MC_EMEM_ARB_TIMING_R2R */ + 0x00000002, /* MC_EMEM_ARB_TIMING_W2W */ + 0x00000004, /* MC_EMEM_ARB_TIMING_R2W */ + 0x00000006, /* MC_EMEM_ARB_TIMING_W2R */ + 0x06040202, /* MC_EMEM_ARB_DA_TURNS */ + 0x000b0607, /* MC_EMEM_ARB_DA_COVERS */ + 0x77450e08, /* MC_EMEM_ARB_MISC0 */ + 0x70000f03, /* MC_EMEM_ARB_MISC1 */ + 0x001f0000, /* MC_EMEM_ARB_RING1_THROTTLE */ + }, + { + 0x00000004, /* MC_MLL_MPCORER_PTSA_RATE */ + 0x00000090, /* MC_PTSA_GRANT_DECREMENT */ + 0x00ff004a, /* MC_LATENCY_ALLOWANCE_XUSB_0 */ + 0x00ff004a, /* MC_LATENCY_ALLOWANCE_XUSB_1 */ + 0x00ff003c, /* MC_LATENCY_ALLOWANCE_TSEC_0 */ + 0x00ff0090, /* MC_LATENCY_ALLOWANCE_SDMMCA_0 */ + 0x00ff0041, /* MC_LATENCY_ALLOWANCE_SDMMCAA_0 */ + 0x00ff0090, /* MC_LATENCY_ALLOWANCE_SDMMC_0 */ + 0x00ff0041, /* MC_LATENCY_ALLOWANCE_SDMMCAB_0 */ + 0x00350049, /* MC_LATENCY_ALLOWANCE_PPCS_0 */ + 0x00ff0080, /* MC_LATENCY_ALLOWANCE_PPCS_1 */ + 0x00ff0004, /* MC_LATENCY_ALLOWANCE_MPCORE_0 */ + 0x00ff0004, /* MC_LATENCY_ALLOWANCE_MPCORELP_0 */ + 0x0008003b, /* MC_LATENCY_ALLOWANCE_HC_0 */ + 0x000000ff, /* MC_LATENCY_ALLOWANCE_HC_1 */ + 0x00ff0004, /* MC_LATENCY_ALLOWANCE_AVPC_0 */ + 0x00ff0043, /* MC_LATENCY_ALLOWANCE_GPU_0 */ + 0x00ff002d, /* MC_LATENCY_ALLOWANCE_MSENC_0 */ + 0x00ff0024, /* MC_LATENCY_ALLOWANCE_HDA_0 */ + 0x00ff0049, /* MC_LATENCY_ALLOWANCE_VIC_0 */ + 0x000000ff, /* MC_LATENCY_ALLOWANCE_VI2_0 */ + 0x00000036, /* MC_LATENCY_ALLOWANCE_ISP2_0 */ + 0x00ff00ff, /* MC_LATENCY_ALLOWANCE_ISP2_1 */ + 0x00000036, /* MC_LATENCY_ALLOWANCE_ISP2B_0 */ + 0x00ff00ff, /* MC_LATENCY_ALLOWANCE_ISP2B_1 */ + 0x00d400ff, /* MC_LATENCY_ALLOWANCE_VDE_0 */ + 0x00510036, /* MC_LATENCY_ALLOWANCE_VDE_1 */ + 0x00ff00ff, /* MC_LATENCY_ALLOWANCE_VDE_2 */ + 0x00ff00ff, /* MC_LATENCY_ALLOWANCE_VDE_3 */ + 0x00ff0087, /* MC_LATENCY_ALLOWANCE_SATA_0 */ + 0x00ff004a, /* MC_LATENCY_ALLOWANCE_AFI_0 */ + }, + 0x00000042, /* EMC_ZCAL_WAIT_CNT after clock change */ + 0x001fffff, /* EMC_AUTO_CAL_INTERVAL */ + 0x00000802, /* EMC_CTT_TERM_CTRL */ + 0x73340000, /* EMC_CFG */ + 0x000008d5, /* EMC_CFG_2 */ + 0x00040000, /* EMC_SEL_DPD_CTRL */ + 0x002c0068, /* EMC_CFG_DIG_DLL */ + 0x00000000, /* EMC_BGBIAS_CTL0 */ + 0x00000000, /* EMC_AUTO_CAL_CONFIG2 */ + 0x00000000, /* EMC_AUTO_CAL_CONFIG3 */ + 0xa1430000, /* EMC_AUTO_CAL_CONFIG */ + 0x80000321, /* Mode Register 0 */ + 0x80100002, /* Mode Register 1 */ + 0x80200000, /* Mode Register 2 */ + 0x00000000, /* Mode Register 4 */ + 2680, /* expected dvfs latency (ns) */ + }, + { + 0x19, /* V5.0.18 */ + "01_396000_01_V5.0.18_V1.1", /* DVFS table version */ + 396000, /* SDRAM frequency */ + 850, /* min voltage */ + 850, /* gpu min voltage */ + "pllm_out0", /* clock source id */ + 0x00000002, /* CLK_SOURCE_EMC */ + 165, /* number of burst_regs */ + 31, /* number of up_down_regs */ + { + 0x00000011, /* EMC_RC */ + 0x00000065, /* EMC_RFC */ + 0x00000000, /* EMC_RFC_SLR */ + 0x0000000c, /* EMC_RAS */ + 0x00000004, /* EMC_RP */ + 0x00000004, /* EMC_R2W */ + 0x00000008, /* EMC_W2R */ + 0x00000002, /* EMC_R2P */ + 0x0000000a, /* EMC_W2P */ + 0x00000004, /* EMC_RD_RCD */ + 0x00000004, /* EMC_WR_RCD */ + 0x00000002, /* EMC_RRD */ + 0x00000002, /* EMC_REXT */ + 0x00000000, /* EMC_WEXT */ + 0x00000003, /* EMC_WDV */ + 0x00000003, /* EMC_WDV_MASK */ + 0x00000005, /* EMC_QUSE */ + 0x00000002, /* EMC_QUSE_WIDTH */ + 0x00000000, /* EMC_IBDLY */ + 0x00000001, /* EMC_EINPUT */ + 0x00000008, /* EMC_EINPUT_DURATION */ + 0x00020000, /* EMC_PUTERM_EXTRA */ + 0x00000003, /* EMC_PUTERM_WIDTH */ + 0x00000000, /* EMC_PUTERM_ADJ */ + 0x00000000, /* EMC_CDB_CNTL_1 */ + 0x00000000, /* EMC_CDB_CNTL_2 */ + 0x00000000, /* EMC_CDB_CNTL_3 */ + 0x00000000, /* EMC_QRST */ + 0x0000000f, /* EMC_QSAFE */ + 0x00000010, /* EMC_RDV */ + 0x00000012, /* EMC_RDV_MASK */ + 0x00000bd1, /* EMC_REFRESH */ + 0x00000000, /* EMC_BURST_REFRESH_NUM */ + 0x000002f4, /* EMC_PRE_REFRESH_REQ_CNT */ + 0x00000001, /* EMC_PDEX2WR */ + 0x00000008, /* EMC_PDEX2RD */ + 0x00000001, /* EMC_PCHG2PDEN */ + 0x00000000, /* EMC_ACT2PDEN */ + 0x00000063, /* EMC_AR2PDEN */ + 0x0000000f, /* EMC_RW2PDEN */ + 0x0000006b, /* EMC_TXSR */ + 0x00000200, /* EMC_TXSRDLL */ + 0x00000004, /* EMC_TCKE */ + 0x00000005, /* EMC_TCKESR */ + 0x00000004, /* EMC_TPD */ + 0x0000000b, /* EMC_TFAW */ + 0x00000000, /* EMC_TRPAB */ + 0x00000005, /* EMC_TCLKSTABLE */ + 0x00000005, /* EMC_TCLKSTOP */ + 0x00000c11, /* EMC_TREFBW */ + 0x00000000, /* EMC_FBIO_CFG6 */ + 0x00000000, /* EMC_ODT_WRITE */ + 0x00000000, /* EMC_ODT_READ */ + 0x104ab098, /* EMC_FBIO_CFG5 */ + 0x002c00a0, /* EMC_CFG_DIG_DLL */ + 0x00008000, /* EMC_CFG_DIG_DLL_PERIOD */ + 0x00030000, /* EMC_DLL_XFORM_DQS0 */ + 0x00030000, /* EMC_DLL_XFORM_DQS1 */ + 0x00030000, /* EMC_DLL_XFORM_DQS2 */ + 0x00030000, /* EMC_DLL_XFORM_DQS3 */ + 0x00030000, /* EMC_DLL_XFORM_DQS4 */ + 0x00030000, /* EMC_DLL_XFORM_DQS5 */ + 0x00030000, /* EMC_DLL_XFORM_DQS6 */ + 0x00030000, /* EMC_DLL_XFORM_DQS7 */ + 0x00030000, /* EMC_DLL_XFORM_DQS8 */ + 0x00030000, /* EMC_DLL_XFORM_DQS9 */ + 0x00030000, /* EMC_DLL_XFORM_DQS10 */ + 0x00030000, /* EMC_DLL_XFORM_DQS11 */ + 0x00030000, /* EMC_DLL_XFORM_DQS12 */ + 0x00030000, /* EMC_DLL_XFORM_DQS13 */ + 0x00030000, /* EMC_DLL_XFORM_DQS14 */ + 0x00030000, /* EMC_DLL_XFORM_DQS15 */ + 0x00000000, /* EMC_DLL_XFORM_QUSE0 */ + 0x00000000, /* EMC_DLL_XFORM_QUSE1 */ + 0x00000000, /* EMC_DLL_XFORM_QUSE2 */ + 0x00000000, /* EMC_DLL_XFORM_QUSE3 */ + 0x00000000, /* EMC_DLL_XFORM_QUSE4 */ + 0x00000000, /* EMC_DLL_XFORM_QUSE5 */ + 0x00000000, /* EMC_DLL_XFORM_QUSE6 */ + 0x00000000, /* EMC_DLL_XFORM_QUSE7 */ + 0x00070000, /* EMC_DLL_XFORM_ADDR0 */ + 0x00070000, /* EMC_DLL_XFORM_ADDR1 */ + 0x00000000, /* EMC_DLL_XFORM_ADDR2 */ + 0x00070000, /* EMC_DLL_XFORM_ADDR3 */ + 0x00070000, /* EMC_DLL_XFORM_ADDR4 */ + 0x00000000, /* EMC_DLL_XFORM_ADDR5 */ + 0x00000000, /* EMC_DLL_XFORM_QUSE8 */ + 0x00000000, /* EMC_DLL_XFORM_QUSE9 */ + 0x00000000, /* EMC_DLL_XFORM_QUSE10 */ + 0x00000000, /* EMC_DLL_XFORM_QUSE11 */ + 0x00000000, /* EMC_DLL_XFORM_QUSE12 */ + 0x00000000, /* EMC_DLL_XFORM_QUSE13 */ + 0x00000000, /* EMC_DLL_XFORM_QUSE14 */ + 0x00000000, /* EMC_DLL_XFORM_QUSE15 */ + 0x00000000, /* EMC_DLI_TRIM_TXDQS0 */ + 0x00000000, /* EMC_DLI_TRIM_TXDQS1 */ + 0x00000000, /* EMC_DLI_TRIM_TXDQS2 */ + 0x00000000, /* EMC_DLI_TRIM_TXDQS3 */ + 0x00000000, /* EMC_DLI_TRIM_TXDQS4 */ + 0x00000000, /* EMC_DLI_TRIM_TXDQS5 */ + 0x00000000, /* EMC_DLI_TRIM_TXDQS6 */ + 0x00000000, /* EMC_DLI_TRIM_TXDQS7 */ + 0x00000000, /* EMC_DLI_TRIM_TXDQS8 */ + 0x00000000, /* EMC_DLI_TRIM_TXDQS9 */ + 0x00000000, /* EMC_DLI_TRIM_TXDQS10 */ + 0x00000000, /* EMC_DLI_TRIM_TXDQS11 */ + 0x00000000, /* EMC_DLI_TRIM_TXDQS12 */ + 0x00000000, /* EMC_DLI_TRIM_TXDQS13 */ + 0x00000000, /* EMC_DLI_TRIM_TXDQS14 */ + 0x00000000, /* EMC_DLI_TRIM_TXDQS15 */ + 0x00038000, /* EMC_DLL_XFORM_DQ0 */ + 0x00038000, /* EMC_DLL_XFORM_DQ1 */ + 0x00038000, /* EMC_DLL_XFORM_DQ2 */ + 0x00038000, /* EMC_DLL_XFORM_DQ3 */ + 0x00003800, /* EMC_DLL_XFORM_DQ4 */ + 0x00003800, /* EMC_DLL_XFORM_DQ5 */ + 0x00003800, /* EMC_DLL_XFORM_DQ6 */ + 0x00003800, /* EMC_DLL_XFORM_DQ7 */ + 0x10000280, /* EMC_XM2CMDPADCTRL */ + 0x00000000, /* EMC_XM2CMDPADCTRL4 */ + 0x00111111, /* EMC_XM2CMDPADCTRL5 */ + 0x01231339, /* EMC_XM2DQSPADCTRL2 */ + 0x00000000, /* EMC_XM2DQPADCTRL2 */ + 0x00000000, /* EMC_XM2DQPADCTRL3 */ + 0x77ffc081, /* EMC_XM2CLKPADCTRL */ + 0x00000505, /* EMC_XM2CLKPADCTRL2 */ + 0x81f1f108, /* EMC_XM2COMPPADCTRL */ + 0x07070004, /* EMC_XM2VTTGENPADCTRL */ + 0x00000000, /* EMC_XM2VTTGENPADCTRL2 */ + 0x016eeeee, /* EMC_XM2VTTGENPADCTRL3 */ + 0x51451420, /* EMC_XM2DQSPADCTRL3 */ + 0x00514514, /* EMC_XM2DQSPADCTRL4 */ + 0x00514514, /* EMC_XM2DQSPADCTRL5 */ + 0x51451400, /* EMC_XM2DQSPADCTRL6 */ + 0x0000003f, /* EMC_DSR_VTTGEN_DRV */ + 0x000000c6, /* EMC_TXDSRVTTGEN */ + 0x00000000, /* EMC_FBIO_SPARE */ + 0x00020000, /* EMC_ZCAL_INTERVAL */ + 0x00000100, /* EMC_ZCAL_WAIT_CNT */ + 0x015b000e, /* EMC_MRS_WAIT_CNT */ + 0x015b000e, /* EMC_MRS_WAIT_CNT2 */ + 0x00000000, /* EMC_CTT */ + 0x00000003, /* EMC_CTT_DURATION */ + 0x000052a3, /* EMC_CFG_PIPE */ + 0x8000188b, /* EMC_DYN_SELF_REF_CONTROL */ + 0x00000009, /* EMC_QPOP */ + 0x0f000005, /* MC_EMEM_ARB_CFG */ + 0x80000040, /* MC_EMEM_ARB_OUTSTANDING_REQ */ + 0x00000001, /* MC_EMEM_ARB_TIMING_RCD */ + 0x00000002, /* MC_EMEM_ARB_TIMING_RP */ + 0x00000009, /* MC_EMEM_ARB_TIMING_RC */ + 0x00000005, /* MC_EMEM_ARB_TIMING_RAS */ + 0x00000006, /* MC_EMEM_ARB_TIMING_FAW */ + 0x00000001, /* MC_EMEM_ARB_TIMING_RRD */ + 0x00000002, /* MC_EMEM_ARB_TIMING_RAP2PRE */ + 0x00000008, /* MC_EMEM_ARB_TIMING_WAP2PRE */ + 0x00000002, /* MC_EMEM_ARB_TIMING_R2R */ + 0x00000002, /* MC_EMEM_ARB_TIMING_W2W */ + 0x00000004, /* MC_EMEM_ARB_TIMING_R2W */ + 0x00000006, /* MC_EMEM_ARB_TIMING_W2R */ + 0x06040202, /* MC_EMEM_ARB_DA_TURNS */ + 0x000d0709, /* MC_EMEM_ARB_DA_COVERS */ + 0x7586120a, /* MC_EMEM_ARB_MISC0 */ + 0x70000f03, /* MC_EMEM_ARB_MISC1 */ + 0x001f0000, /* MC_EMEM_ARB_RING1_THROTTLE */ + }, + { + 0x0000000a, /* MC_MLL_MPCORER_PTSA_RATE */ + 0x000000be, /* MC_PTSA_GRANT_DECREMENT */ + 0x00ff0038, /* MC_LATENCY_ALLOWANCE_XUSB_0 */ + 0x00ff0038, /* MC_LATENCY_ALLOWANCE_XUSB_1 */ + 0x00ff003c, /* MC_LATENCY_ALLOWANCE_TSEC_0 */ + 0x00ff0090, /* MC_LATENCY_ALLOWANCE_SDMMCA_0 */ + 0x00ff0041, /* MC_LATENCY_ALLOWANCE_SDMMCAA_0 */ + 0x00ff0090, /* MC_LATENCY_ALLOWANCE_SDMMC_0 */ + 0x00ff0041, /* MC_LATENCY_ALLOWANCE_SDMMCAB_0 */ + 0x00280049, /* MC_LATENCY_ALLOWANCE_PPCS_0 */ + 0x00ff0080, /* MC_LATENCY_ALLOWANCE_PPCS_1 */ + 0x00ff0004, /* MC_LATENCY_ALLOWANCE_MPCORE_0 */ + 0x00ff0004, /* MC_LATENCY_ALLOWANCE_MPCORELP_0 */ + 0x0008002d, /* MC_LATENCY_ALLOWANCE_HC_0 */ + 0x000000ff, /* MC_LATENCY_ALLOWANCE_HC_1 */ + 0x00ff0004, /* MC_LATENCY_ALLOWANCE_AVPC_0 */ + 0x00ff0033, /* MC_LATENCY_ALLOWANCE_GPU_0 */ + 0x00ff0022, /* MC_LATENCY_ALLOWANCE_MSENC_0 */ + 0x00ff0024, /* MC_LATENCY_ALLOWANCE_HDA_0 */ + 0x00ff0037, /* MC_LATENCY_ALLOWANCE_VIC_0 */ + 0x000000ff, /* MC_LATENCY_ALLOWANCE_VI2_0 */ + 0x00000036, /* MC_LATENCY_ALLOWANCE_ISP2_0 */ + 0x00ff00ff, /* MC_LATENCY_ALLOWANCE_ISP2_1 */ + 0x00000036, /* MC_LATENCY_ALLOWANCE_ISP2B_0 */ + 0x00ff00ff, /* MC_LATENCY_ALLOWANCE_ISP2B_1 */ + 0x00d400ff, /* MC_LATENCY_ALLOWANCE_VDE_0 */ + 0x00510029, /* MC_LATENCY_ALLOWANCE_VDE_1 */ + 0x00ff00ff, /* MC_LATENCY_ALLOWANCE_VDE_2 */ + 0x00ff00ff, /* MC_LATENCY_ALLOWANCE_VDE_3 */ + 0x00ff0066, /* MC_LATENCY_ALLOWANCE_SATA_0 */ + 0x00ff0038, /* MC_LATENCY_ALLOWANCE_AFI_0 */ + }, + 0x00000042, /* EMC_ZCAL_WAIT_CNT after clock change */ + 0x001fffff, /* EMC_AUTO_CAL_INTERVAL */ + 0x00000802, /* EMC_CTT_TERM_CTRL */ + 0x73340000, /* EMC_CFG */ + 0x00000895, /* EMC_CFG_2 */ + 0x00040000, /* EMC_SEL_DPD_CTRL */ + 0x002c0068, /* EMC_CFG_DIG_DLL */ + 0x00000000, /* EMC_BGBIAS_CTL0 */ + 0x00000000, /* EMC_AUTO_CAL_CONFIG2 */ + 0x00000000, /* EMC_AUTO_CAL_CONFIG3 */ + 0xa1430000, /* EMC_AUTO_CAL_CONFIG */ + 0x80000521, /* Mode Register 0 */ + 0x80100002, /* Mode Register 1 */ + 0x80200000, /* Mode Register 2 */ + 0x00000000, /* Mode Register 4 */ + 2180, /* expected dvfs latency (ns) */ + }, + { + 0x19, /* V5.0.18 */ + "01_528000_01_V5.0.18_V1.1", /* DVFS table version */ + 528000, /* SDRAM frequency */ + 880, /* min voltage */ + 870, /* gpu min voltage */ + "pllm_ud", /* clock source id */ + 0x80000000, /* CLK_SOURCE_EMC */ + 165, /* number of burst_regs */ + 31, /* number of up_down_regs */ + { + 0x00000018, /* EMC_RC */ + 0x00000088, /* EMC_RFC */ + 0x00000000, /* EMC_RFC_SLR */ + 0x00000010, /* EMC_RAS */ + 0x00000006, /* EMC_RP */ + 0x00000006, /* EMC_R2W */ + 0x00000009, /* EMC_W2R */ + 0x00000002, /* EMC_R2P */ + 0x0000000d, /* EMC_W2P */ + 0x00000006, /* EMC_RD_RCD */ + 0x00000006, /* EMC_WR_RCD */ + 0x00000002, /* EMC_RRD */ + 0x00000002, /* EMC_REXT */ + 0x00000000, /* EMC_WEXT */ + 0x00000003, /* EMC_WDV */ + 0x00000003, /* EMC_WDV_MASK */ + 0x00000006, /* EMC_QUSE */ + 0x00000002, /* EMC_QUSE_WIDTH */ + 0x00000000, /* EMC_IBDLY */ + 0x00000001, /* EMC_EINPUT */ + 0x00000009, /* EMC_EINPUT_DURATION */ + 0x00030000, /* EMC_PUTERM_EXTRA */ + 0x00000003, /* EMC_PUTERM_WIDTH */ + 0x00000000, /* EMC_PUTERM_ADJ */ + 0x00000000, /* EMC_CDB_CNTL_1 */ + 0x00000000, /* EMC_CDB_CNTL_2 */ + 0x00000000, /* EMC_CDB_CNTL_3 */ + 0x00000000, /* EMC_QRST */ + 0x00000010, /* EMC_QSAFE */ + 0x00000012, /* EMC_RDV */ + 0x00000014, /* EMC_RDV_MASK */ + 0x00000fd6, /* EMC_REFRESH */ + 0x00000000, /* EMC_BURST_REFRESH_NUM */ + 0x000003f5, /* EMC_PRE_REFRESH_REQ_CNT */ + 0x00000002, /* EMC_PDEX2WR */ + 0x0000000b, /* EMC_PDEX2RD */ + 0x00000001, /* EMC_PCHG2PDEN */ + 0x00000000, /* EMC_ACT2PDEN */ + 0x00000084, /* EMC_AR2PDEN */ + 0x00000012, /* EMC_RW2PDEN */ + 0x0000008f, /* EMC_TXSR */ + 0x00000200, /* EMC_TXSRDLL */ + 0x00000004, /* EMC_TCKE */ + 0x00000005, /* EMC_TCKESR */ + 0x00000004, /* EMC_TPD */ + 0x00000010, /* EMC_TFAW */ + 0x00000000, /* EMC_TRPAB */ + 0x00000006, /* EMC_TCLKSTABLE */ + 0x00000006, /* EMC_TCLKSTOP */ + 0x00001017, /* EMC_TREFBW */ + 0x00000000, /* EMC_FBIO_CFG6 */ + 0x00000000, /* EMC_ODT_WRITE */ + 0x00000000, /* EMC_ODT_READ */ + 0x104ab098, /* EMC_FBIO_CFG5 */ + 0xe01200b1, /* EMC_CFG_DIG_DLL */ + 0x00008000, /* EMC_CFG_DIG_DLL_PERIOD */ + 0x0000000a, /* EMC_DLL_XFORM_DQS0 */ + 0x0000000a, /* EMC_DLL_XFORM_DQS1 */ + 0x0000000a, /* EMC_DLL_XFORM_DQS2 */ + 0x0000000a, /* EMC_DLL_XFORM_DQS3 */ + 0x0000000a, /* EMC_DLL_XFORM_DQS4 */ + 0x0000000a, /* EMC_DLL_XFORM_DQS5 */ + 0x0000000a, /* EMC_DLL_XFORM_DQS6 */ + 0x0000000a, /* EMC_DLL_XFORM_DQS7 */ + 0x0000000a, /* EMC_DLL_XFORM_DQS8 */ + 0x0000000a, /* EMC_DLL_XFORM_DQS9 */ + 0x0000000a, /* EMC_DLL_XFORM_DQS10 */ + 0x0000000a, /* EMC_DLL_XFORM_DQS11 */ + 0x0000000a, /* EMC_DLL_XFORM_DQS12 */ + 0x0000000a, /* EMC_DLL_XFORM_DQS13 */ + 0x0000000a, /* EMC_DLL_XFORM_DQS14 */ + 0x0000000a, /* EMC_DLL_XFORM_DQS15 */ + 0x00000000, /* EMC_DLL_XFORM_QUSE0 */ + 0x00000000, /* EMC_DLL_XFORM_QUSE1 */ + 0x00000000, /* EMC_DLL_XFORM_QUSE2 */ + 0x00000000, /* EMC_DLL_XFORM_QUSE3 */ + 0x00000000, /* EMC_DLL_XFORM_QUSE4 */ + 0x00000000, /* EMC_DLL_XFORM_QUSE5 */ + 0x00000000, /* EMC_DLL_XFORM_QUSE6 */ + 0x00000000, /* EMC_DLL_XFORM_QUSE7 */ + 0x00054000, /* EMC_DLL_XFORM_ADDR0 */ + 0x00054000, /* EMC_DLL_XFORM_ADDR1 */ + 0x00000000, /* EMC_DLL_XFORM_ADDR2 */ + 0x00054000, /* EMC_DLL_XFORM_ADDR3 */ + 0x00054000, /* EMC_DLL_XFORM_ADDR4 */ + 0x00000000, /* EMC_DLL_XFORM_ADDR5 */ + 0x00000000, /* EMC_DLL_XFORM_QUSE8 */ + 0x00000000, /* EMC_DLL_XFORM_QUSE9 */ + 0x00000000, /* EMC_DLL_XFORM_QUSE10 */ + 0x00000000, /* EMC_DLL_XFORM_QUSE11 */ + 0x00000000, /* EMC_DLL_XFORM_QUSE12 */ + 0x00000000, /* EMC_DLL_XFORM_QUSE13 */ + 0x00000000, /* EMC_DLL_XFORM_QUSE14 */ + 0x00000000, /* EMC_DLL_XFORM_QUSE15 */ + 0x00000000, /* EMC_DLI_TRIM_TXDQS0 */ + 0x00000000, /* EMC_DLI_TRIM_TXDQS1 */ + 0x00000000, /* EMC_DLI_TRIM_TXDQS2 */ + 0x00000000, /* EMC_DLI_TRIM_TXDQS3 */ + 0x00000000, /* EMC_DLI_TRIM_TXDQS4 */ + 0x00000000, /* EMC_DLI_TRIM_TXDQS5 */ + 0x00000000, /* EMC_DLI_TRIM_TXDQS6 */ + 0x00000000, /* EMC_DLI_TRIM_TXDQS7 */ + 0x00000000, /* EMC_DLI_TRIM_TXDQS8 */ + 0x00000000, /* EMC_DLI_TRIM_TXDQS9 */ + 0x00000000, /* EMC_DLI_TRIM_TXDQS10 */ + 0x00000000, /* EMC_DLI_TRIM_TXDQS11 */ + 0x00000000, /* EMC_DLI_TRIM_TXDQS12 */ + 0x00000000, /* EMC_DLI_TRIM_TXDQS13 */ + 0x00000000, /* EMC_DLI_TRIM_TXDQS14 */ + 0x00000000, /* EMC_DLI_TRIM_TXDQS15 */ + 0x0000000c, /* EMC_DLL_XFORM_DQ0 */ + 0x0000000c, /* EMC_DLL_XFORM_DQ1 */ + 0x0000000c, /* EMC_DLL_XFORM_DQ2 */ + 0x0000000c, /* EMC_DLL_XFORM_DQ3 */ + 0x0000000c, /* EMC_DLL_XFORM_DQ4 */ + 0x0000000c, /* EMC_DLL_XFORM_DQ5 */ + 0x0000000c, /* EMC_DLL_XFORM_DQ6 */ + 0x0000000c, /* EMC_DLL_XFORM_DQ7 */ + 0x100002a0, /* EMC_XM2CMDPADCTRL */ + 0x00000000, /* EMC_XM2CMDPADCTRL4 */ + 0x00111111, /* EMC_XM2CMDPADCTRL5 */ + 0x0123133d, /* EMC_XM2DQSPADCTRL2 */ + 0x00000000, /* EMC_XM2DQPADCTRL2 */ + 0x00000000, /* EMC_XM2DQPADCTRL3 */ + 0x77ffc085, /* EMC_XM2CLKPADCTRL */ + 0x00000505, /* EMC_XM2CLKPADCTRL2 */ + 0x81f1f108, /* EMC_XM2COMPPADCTRL */ + 0x07070004, /* EMC_XM2VTTGENPADCTRL */ + 0x00000000, /* EMC_XM2VTTGENPADCTRL2 */ + 0x016eeeee, /* EMC_XM2VTTGENPADCTRL3 */ + 0x51451420, /* EMC_XM2DQSPADCTRL3 */ + 0x00514514, /* EMC_XM2DQSPADCTRL4 */ + 0x00514514, /* EMC_XM2DQSPADCTRL5 */ + 0x51451400, /* EMC_XM2DQSPADCTRL6 */ + 0x0606003f, /* EMC_DSR_VTTGEN_DRV */ + 0x00000000, /* EMC_TXDSRVTTGEN */ + 0x00000000, /* EMC_FBIO_SPARE */ + 0x00020000, /* EMC_ZCAL_INTERVAL */ + 0x00000100, /* EMC_ZCAL_WAIT_CNT */ + 0x013a000e, /* EMC_MRS_WAIT_CNT */ + 0x013a000e, /* EMC_MRS_WAIT_CNT2 */ + 0x00000000, /* EMC_CTT */ + 0x00000003, /* EMC_CTT_DURATION */ + 0x000042a0, /* EMC_CFG_PIPE */ + 0x80002062, /* EMC_DYN_SELF_REF_CONTROL */ + 0x0000000a, /* EMC_QPOP */ + 0x0f000007, /* MC_EMEM_ARB_CFG */ + 0x80000040, /* MC_EMEM_ARB_OUTSTANDING_REQ */ + 0x00000002, /* MC_EMEM_ARB_TIMING_RCD */ + 0x00000003, /* MC_EMEM_ARB_TIMING_RP */ + 0x0000000c, /* MC_EMEM_ARB_TIMING_RC */ + 0x00000007, /* MC_EMEM_ARB_TIMING_RAS */ + 0x00000008, /* MC_EMEM_ARB_TIMING_FAW */ + 0x00000001, /* MC_EMEM_ARB_TIMING_RRD */ + 0x00000002, /* MC_EMEM_ARB_TIMING_RAP2PRE */ + 0x00000009, /* MC_EMEM_ARB_TIMING_WAP2PRE */ + 0x00000002, /* MC_EMEM_ARB_TIMING_R2R */ + 0x00000002, /* MC_EMEM_ARB_TIMING_W2W */ + 0x00000005, /* MC_EMEM_ARB_TIMING_R2W */ + 0x00000006, /* MC_EMEM_ARB_TIMING_W2R */ + 0x06050202, /* MC_EMEM_ARB_DA_TURNS */ + 0x0010090c, /* MC_EMEM_ARB_DA_COVERS */ + 0x7428180d, /* MC_EMEM_ARB_MISC0 */ + 0x70000f03, /* MC_EMEM_ARB_MISC1 */ + 0x001f0000, /* MC_EMEM_ARB_RING1_THROTTLE */ + }, + { + 0x0000000d, /* MC_MLL_MPCORER_PTSA_RATE */ + 0x000000fd, /* MC_PTSA_GRANT_DECREMENT */ + 0x00c10038, /* MC_LATENCY_ALLOWANCE_XUSB_0 */ + 0x00c10038, /* MC_LATENCY_ALLOWANCE_XUSB_1 */ + 0x00c1003c, /* MC_LATENCY_ALLOWANCE_TSEC_0 */ + 0x00c10090, /* MC_LATENCY_ALLOWANCE_SDMMCA_0 */ + 0x00c10041, /* MC_LATENCY_ALLOWANCE_SDMMCAA_0 */ + 0x00c10090, /* MC_LATENCY_ALLOWANCE_SDMMC_0 */ + 0x00c10041, /* MC_LATENCY_ALLOWANCE_SDMMCAB_0 */ + 0x00270049, /* MC_LATENCY_ALLOWANCE_PPCS_0 */ + 0x00c10080, /* MC_LATENCY_ALLOWANCE_PPCS_1 */ + 0x00c10004, /* MC_LATENCY_ALLOWANCE_MPCORE_0 */ + 0x00c10004, /* MC_LATENCY_ALLOWANCE_MPCORELP_0 */ + 0x00080021, /* MC_LATENCY_ALLOWANCE_HC_0 */ + 0x000000c1, /* MC_LATENCY_ALLOWANCE_HC_1 */ + 0x00c10004, /* MC_LATENCY_ALLOWANCE_AVPC_0 */ + 0x00c10026, /* MC_LATENCY_ALLOWANCE_GPU_0 */ + 0x00c1001a, /* MC_LATENCY_ALLOWANCE_MSENC_0 */ + 0x00c10024, /* MC_LATENCY_ALLOWANCE_HDA_0 */ + 0x00c10029, /* MC_LATENCY_ALLOWANCE_VIC_0 */ + 0x000000c1, /* MC_LATENCY_ALLOWANCE_VI2_0 */ + 0x00000036, /* MC_LATENCY_ALLOWANCE_ISP2_0 */ + 0x00c100c1, /* MC_LATENCY_ALLOWANCE_ISP2_1 */ + 0x00000036, /* MC_LATENCY_ALLOWANCE_ISP2B_0 */ + 0x00c100c1, /* MC_LATENCY_ALLOWANCE_ISP2B_1 */ + 0x00d400ff, /* MC_LATENCY_ALLOWANCE_VDE_0 */ + 0x00510029, /* MC_LATENCY_ALLOWANCE_VDE_1 */ + 0x00c100c1, /* MC_LATENCY_ALLOWANCE_VDE_2 */ + 0x00c100c1, /* MC_LATENCY_ALLOWANCE_VDE_3 */ + 0x00c10065, /* MC_LATENCY_ALLOWANCE_SATA_0 */ + 0x00c1002a, /* MC_LATENCY_ALLOWANCE_AFI_0 */ + }, + 0x00000042, /* EMC_ZCAL_WAIT_CNT after clock change */ + 0x001fffff, /* EMC_AUTO_CAL_INTERVAL */ + 0x00000802, /* EMC_CTT_TERM_CTRL */ + 0x73300000, /* EMC_CFG */ + 0x0000089d, /* EMC_CFG_2 */ + 0x00040000, /* EMC_SEL_DPD_CTRL */ + 0xe0120069, /* EMC_CFG_DIG_DLL */ + 0x00000000, /* EMC_BGBIAS_CTL0 */ + 0x00000000, /* EMC_AUTO_CAL_CONFIG2 */ + 0x00000000, /* EMC_AUTO_CAL_CONFIG3 */ + 0xa1430000, /* EMC_AUTO_CAL_CONFIG */ + 0x80000941, /* Mode Register 0 */ + 0x80100002, /* Mode Register 1 */ + 0x80200008, /* Mode Register 2 */ + 0x00000000, /* Mode Register 4 */ + 1440, /* expected dvfs latency (ns) */ + }, + { + 0x19, /* V5.0.18 */ + "01_600000_01_V5.0.18_V1.1", /* DVFS table version */ + 600000, /* SDRAM frequency */ + 910, /* min voltage */ + 910, /* gpu min voltage */ + "pllc_ud", /* clock source id */ + 0xe0000000, /* CLK_SOURCE_EMC */ + 165, /* number of burst_regs */ + 31, /* number of up_down_regs */ + { + 0x0000001b, /* EMC_RC */ + 0x0000009a, /* EMC_RFC */ + 0x00000000, /* EMC_RFC_SLR */ + 0x00000013, /* EMC_RAS */ + 0x00000007, /* EMC_RP */ + 0x00000007, /* EMC_R2W */ + 0x0000000b, /* EMC_W2R */ + 0x00000003, /* EMC_R2P */ + 0x00000010, /* EMC_W2P */ + 0x00000007, /* EMC_RD_RCD */ + 0x00000007, /* EMC_WR_RCD */ + 0x00000003, /* EMC_RRD */ + 0x00000002, /* EMC_REXT */ + 0x00000000, /* EMC_WEXT */ + 0x00000005, /* EMC_WDV */ + 0x00000005, /* EMC_WDV_MASK */ + 0x0000000a, /* EMC_QUSE */ + 0x00000002, /* EMC_QUSE_WIDTH */ + 0x00000000, /* EMC_IBDLY */ + 0x00000003, /* EMC_EINPUT */ + 0x0000000b, /* EMC_EINPUT_DURATION */ + 0x00070000, /* EMC_PUTERM_EXTRA */ + 0x00000003, /* EMC_PUTERM_WIDTH */ + 0x00000000, /* EMC_PUTERM_ADJ */ + 0x00000000, /* EMC_CDB_CNTL_1 */ + 0x00000000, /* EMC_CDB_CNTL_2 */ + 0x00000000, /* EMC_CDB_CNTL_3 */ + 0x00000002, /* EMC_QRST */ + 0x00000012, /* EMC_QSAFE */ + 0x00000016, /* EMC_RDV */ + 0x00000018, /* EMC_RDV_MASK */ + 0x00001208, /* EMC_REFRESH */ + 0x00000000, /* EMC_BURST_REFRESH_NUM */ + 0x00000482, /* EMC_PRE_REFRESH_REQ_CNT */ + 0x00000002, /* EMC_PDEX2WR */ + 0x0000000d, /* EMC_PDEX2RD */ + 0x00000001, /* EMC_PCHG2PDEN */ + 0x00000000, /* EMC_ACT2PDEN */ + 0x00000096, /* EMC_AR2PDEN */ + 0x00000015, /* EMC_RW2PDEN */ + 0x000000a2, /* EMC_TXSR */ + 0x00000200, /* EMC_TXSRDLL */ + 0x00000004, /* EMC_TCKE */ + 0x00000005, /* EMC_TCKESR */ + 0x00000004, /* EMC_TPD */ + 0x00000013, /* EMC_TFAW */ + 0x00000000, /* EMC_TRPAB */ + 0x00000006, /* EMC_TCLKSTABLE */ + 0x00000006, /* EMC_TCLKSTOP */ + 0x00001248, /* EMC_TREFBW */ + 0x00000000, /* EMC_FBIO_CFG6 */ + 0x00000000, /* EMC_ODT_WRITE */ + 0x00000000, /* EMC_ODT_READ */ + 0x104ab098, /* EMC_FBIO_CFG5 */ + 0xe00e00b1, /* EMC_CFG_DIG_DLL */ + 0x00008000, /* EMC_CFG_DIG_DLL_PERIOD */ + 0x0000000a, /* EMC_DLL_XFORM_DQS0 */ + 0x0000000a, /* EMC_DLL_XFORM_DQS1 */ + 0x0000000a, /* EMC_DLL_XFORM_DQS2 */ + 0x0000000a, /* EMC_DLL_XFORM_DQS3 */ + 0x0000000a, /* EMC_DLL_XFORM_DQS4 */ + 0x0000000a, /* EMC_DLL_XFORM_DQS5 */ + 0x0000000a, /* EMC_DLL_XFORM_DQS6 */ + 0x0000000a, /* EMC_DLL_XFORM_DQS7 */ + 0x0000000a, /* EMC_DLL_XFORM_DQS8 */ + 0x0000000a, /* EMC_DLL_XFORM_DQS9 */ + 0x0000000a, /* EMC_DLL_XFORM_DQS10 */ + 0x0000000a, /* EMC_DLL_XFORM_DQS11 */ + 0x0000000a, /* EMC_DLL_XFORM_DQS12 */ + 0x0000000a, /* EMC_DLL_XFORM_DQS13 */ + 0x0000000a, /* EMC_DLL_XFORM_DQS14 */ + 0x0000000a, /* EMC_DLL_XFORM_DQS15 */ + 0x00000000, /* EMC_DLL_XFORM_QUSE0 */ + 0x00000000, /* EMC_DLL_XFORM_QUSE1 */ + 0x00000000, /* EMC_DLL_XFORM_QUSE2 */ + 0x00000000, /* EMC_DLL_XFORM_QUSE3 */ + 0x00000000, /* EMC_DLL_XFORM_QUSE4 */ + 0x00000000, /* EMC_DLL_XFORM_QUSE5 */ + 0x00000000, /* EMC_DLL_XFORM_QUSE6 */ + 0x00000000, /* EMC_DLL_XFORM_QUSE7 */ + 0x00048000, /* EMC_DLL_XFORM_ADDR0 */ + 0x00048000, /* EMC_DLL_XFORM_ADDR1 */ + 0x00000000, /* EMC_DLL_XFORM_ADDR2 */ + 0x00048000, /* EMC_DLL_XFORM_ADDR3 */ + 0x00048000, /* EMC_DLL_XFORM_ADDR4 */ + 0x00000000, /* EMC_DLL_XFORM_ADDR5 */ + 0x00000000, /* EMC_DLL_XFORM_QUSE8 */ + 0x00000000, /* EMC_DLL_XFORM_QUSE9 */ + 0x00000000, /* EMC_DLL_XFORM_QUSE10 */ + 0x00000000, /* EMC_DLL_XFORM_QUSE11 */ + 0x00000000, /* EMC_DLL_XFORM_QUSE12 */ + 0x00000000, /* EMC_DLL_XFORM_QUSE13 */ + 0x00000000, /* EMC_DLL_XFORM_QUSE14 */ + 0x00000000, /* EMC_DLL_XFORM_QUSE15 */ + 0x00000000, /* EMC_DLI_TRIM_TXDQS0 */ + 0x00000000, /* EMC_DLI_TRIM_TXDQS1 */ + 0x00000000, /* EMC_DLI_TRIM_TXDQS2 */ + 0x00000000, /* EMC_DLI_TRIM_TXDQS3 */ + 0x00000000, /* EMC_DLI_TRIM_TXDQS4 */ + 0x00000000, /* EMC_DLI_TRIM_TXDQS5 */ + 0x00000000, /* EMC_DLI_TRIM_TXDQS6 */ + 0x00000000, /* EMC_DLI_TRIM_TXDQS7 */ + 0x00000000, /* EMC_DLI_TRIM_TXDQS8 */ + 0x00000000, /* EMC_DLI_TRIM_TXDQS9 */ + 0x00000000, /* EMC_DLI_TRIM_TXDQS10 */ + 0x00000000, /* EMC_DLI_TRIM_TXDQS11 */ + 0x00000000, /* EMC_DLI_TRIM_TXDQS12 */ + 0x00000000, /* EMC_DLI_TRIM_TXDQS13 */ + 0x00000000, /* EMC_DLI_TRIM_TXDQS14 */ + 0x00000000, /* EMC_DLI_TRIM_TXDQS15 */ + 0x0000000d, /* EMC_DLL_XFORM_DQ0 */ + 0x0000000d, /* EMC_DLL_XFORM_DQ1 */ + 0x0000000d, /* EMC_DLL_XFORM_DQ2 */ + 0x0000000d, /* EMC_DLL_XFORM_DQ3 */ + 0x0000000d, /* EMC_DLL_XFORM_DQ4 */ + 0x0000000d, /* EMC_DLL_XFORM_DQ5 */ + 0x0000000d, /* EMC_DLL_XFORM_DQ6 */ + 0x0000000d, /* EMC_DLL_XFORM_DQ7 */ + 0x100002a0, /* EMC_XM2CMDPADCTRL */ + 0x00000000, /* EMC_XM2CMDPADCTRL4 */ + 0x00111111, /* EMC_XM2CMDPADCTRL5 */ + 0x0121113d, /* EMC_XM2DQSPADCTRL2 */ + 0x00000000, /* EMC_XM2DQPADCTRL2 */ + 0x00000000, /* EMC_XM2DQPADCTRL3 */ + 0x77ffc085, /* EMC_XM2CLKPADCTRL */ + 0x00000505, /* EMC_XM2CLKPADCTRL2 */ + 0x81f1f108, /* EMC_XM2COMPPADCTRL */ + 0x07070004, /* EMC_XM2VTTGENPADCTRL */ + 0x00000000, /* EMC_XM2VTTGENPADCTRL2 */ + 0x016eeeee, /* EMC_XM2VTTGENPADCTRL3 */ + 0x51451420, /* EMC_XM2DQSPADCTRL3 */ + 0x00514514, /* EMC_XM2DQSPADCTRL4 */ + 0x00514514, /* EMC_XM2DQSPADCTRL5 */ + 0x51451400, /* EMC_XM2DQSPADCTRL6 */ + 0x0606003f, /* EMC_DSR_VTTGEN_DRV */ + 0x00000000, /* EMC_TXDSRVTTGEN */ + 0x00000000, /* EMC_FBIO_SPARE */ + 0x00020000, /* EMC_ZCAL_INTERVAL */ + 0x00000100, /* EMC_ZCAL_WAIT_CNT */ + 0x0128000e, /* EMC_MRS_WAIT_CNT */ + 0x0128000e, /* EMC_MRS_WAIT_CNT2 */ + 0x00000000, /* EMC_CTT */ + 0x00000003, /* EMC_CTT_DURATION */ + 0x000040a0, /* EMC_CFG_PIPE */ + 0x800024aa, /* EMC_DYN_SELF_REF_CONTROL */ + 0x0000000e, /* EMC_QPOP */ + 0x00000009, /* MC_EMEM_ARB_CFG */ + 0x80000040, /* MC_EMEM_ARB_OUTSTANDING_REQ */ + 0x00000003, /* MC_EMEM_ARB_TIMING_RCD */ + 0x00000004, /* MC_EMEM_ARB_TIMING_RP */ + 0x0000000e, /* MC_EMEM_ARB_TIMING_RC */ + 0x00000009, /* MC_EMEM_ARB_TIMING_RAS */ + 0x0000000a, /* MC_EMEM_ARB_TIMING_FAW */ + 0x00000002, /* MC_EMEM_ARB_TIMING_RRD */ + 0x00000003, /* MC_EMEM_ARB_TIMING_RAP2PRE */ + 0x0000000b, /* MC_EMEM_ARB_TIMING_WAP2PRE */ + 0x00000002, /* MC_EMEM_ARB_TIMING_R2R */ + 0x00000002, /* MC_EMEM_ARB_TIMING_W2W */ + 0x00000005, /* MC_EMEM_ARB_TIMING_R2W */ + 0x00000007, /* MC_EMEM_ARB_TIMING_W2R */ + 0x07050202, /* MC_EMEM_ARB_DA_TURNS */ + 0x00130b0e, /* MC_EMEM_ARB_DA_COVERS */ + 0x73a91b0f, /* MC_EMEM_ARB_MISC0 */ + 0x70000f03, /* MC_EMEM_ARB_MISC1 */ + 0x001f0000, /* MC_EMEM_ARB_RING1_THROTTLE */ + }, + { + 0x0000000f, /* MC_MLL_MPCORER_PTSA_RATE */ + 0x00000120, /* MC_PTSA_GRANT_DECREMENT */ + 0x00aa0038, /* MC_LATENCY_ALLOWANCE_XUSB_0 */ + 0x00aa0038, /* MC_LATENCY_ALLOWANCE_XUSB_1 */ + 0x00aa003c, /* MC_LATENCY_ALLOWANCE_TSEC_0 */ + 0x00aa0090, /* MC_LATENCY_ALLOWANCE_SDMMCA_0 */ + 0x00aa0041, /* MC_LATENCY_ALLOWANCE_SDMMCAA_0 */ + 0x00aa0090, /* MC_LATENCY_ALLOWANCE_SDMMC_0 */ + 0x00aa0041, /* MC_LATENCY_ALLOWANCE_SDMMCAB_0 */ + 0x00270049, /* MC_LATENCY_ALLOWANCE_PPCS_0 */ + 0x00aa0080, /* MC_LATENCY_ALLOWANCE_PPCS_1 */ + 0x00aa0004, /* MC_LATENCY_ALLOWANCE_MPCORE_0 */ + 0x00aa0004, /* MC_LATENCY_ALLOWANCE_MPCORELP_0 */ + 0x0008001d, /* MC_LATENCY_ALLOWANCE_HC_0 */ + 0x000000aa, /* MC_LATENCY_ALLOWANCE_HC_1 */ + 0x00aa0004, /* MC_LATENCY_ALLOWANCE_AVPC_0 */ + 0x00aa0022, /* MC_LATENCY_ALLOWANCE_GPU_0 */ + 0x00aa0018, /* MC_LATENCY_ALLOWANCE_MSENC_0 */ + 0x00aa0024, /* MC_LATENCY_ALLOWANCE_HDA_0 */ + 0x00aa0024, /* MC_LATENCY_ALLOWANCE_VIC_0 */ + 0x000000aa, /* MC_LATENCY_ALLOWANCE_VI2_0 */ + 0x00000036, /* MC_LATENCY_ALLOWANCE_ISP2_0 */ + 0x00aa00aa, /* MC_LATENCY_ALLOWANCE_ISP2_1 */ + 0x00000036, /* MC_LATENCY_ALLOWANCE_ISP2B_0 */ + 0x00aa00aa, /* MC_LATENCY_ALLOWANCE_ISP2B_1 */ + 0x00d400ff, /* MC_LATENCY_ALLOWANCE_VDE_0 */ + 0x00510029, /* MC_LATENCY_ALLOWANCE_VDE_1 */ + 0x00aa00aa, /* MC_LATENCY_ALLOWANCE_VDE_2 */ + 0x00aa00aa, /* MC_LATENCY_ALLOWANCE_VDE_3 */ + 0x00aa0065, /* MC_LATENCY_ALLOWANCE_SATA_0 */ + 0x00aa0025, /* MC_LATENCY_ALLOWANCE_AFI_0 */ + }, + 0x00000042, /* EMC_ZCAL_WAIT_CNT after clock change */ + 0x001fffff, /* EMC_AUTO_CAL_INTERVAL */ + 0x00000802, /* EMC_CTT_TERM_CTRL */ + 0x73300000, /* EMC_CFG */ + 0x0000089d, /* EMC_CFG_2 */ + 0x00040000, /* EMC_SEL_DPD_CTRL */ + 0xe00e0069, /* EMC_CFG_DIG_DLL */ + 0x00000000, /* EMC_BGBIAS_CTL0 */ + 0x00000000, /* EMC_AUTO_CAL_CONFIG2 */ + 0x00000000, /* EMC_AUTO_CAL_CONFIG3 */ + 0xa1430000, /* EMC_AUTO_CAL_CONFIG */ + 0x80000b61, /* Mode Register 0 */ + 0x80100002, /* Mode Register 1 */ + 0x80200010, /* Mode Register 2 */ + 0x00000000, /* Mode Register 4 */ + 1440, /* expected dvfs latency (ns) */ + }, + { + 0x19, /* V5.0.18 */ + "01_792000_01_V5.0.18_V1.1", /* DVFS table version */ + 792000, /* SDRAM frequency */ + 980, /* min voltage */ + 980, /* gpu min voltage */ + "pllm_ud", /* clock source id */ + 0x80000000, /* CLK_SOURCE_EMC */ + 165, /* number of burst_regs */ + 31, /* number of up_down_regs */ + { + 0x00000024, /* EMC_RC */ + 0x000000cc, /* EMC_RFC */ + 0x00000000, /* EMC_RFC_SLR */ + 0x00000019, /* EMC_RAS */ + 0x0000000a, /* EMC_RP */ + 0x00000008, /* EMC_R2W */ + 0x0000000d, /* EMC_W2R */ + 0x00000004, /* EMC_R2P */ + 0x00000013, /* EMC_W2P */ + 0x0000000a, /* EMC_RD_RCD */ + 0x0000000a, /* EMC_WR_RCD */ + 0x00000004, /* EMC_RRD */ + 0x00000002, /* EMC_REXT */ + 0x00000000, /* EMC_WEXT */ + 0x00000006, /* EMC_WDV */ + 0x00000006, /* EMC_WDV_MASK */ + 0x0000000b, /* EMC_QUSE */ + 0x00000002, /* EMC_QUSE_WIDTH */ + 0x00000000, /* EMC_IBDLY */ + 0x00000002, /* EMC_EINPUT */ + 0x0000000d, /* EMC_EINPUT_DURATION */ + 0x00080000, /* EMC_PUTERM_EXTRA */ + 0x00000004, /* EMC_PUTERM_WIDTH */ + 0x00000000, /* EMC_PUTERM_ADJ */ + 0x00000000, /* EMC_CDB_CNTL_1 */ + 0x00000000, /* EMC_CDB_CNTL_2 */ + 0x00000000, /* EMC_CDB_CNTL_3 */ + 0x00000001, /* EMC_QRST */ + 0x00000014, /* EMC_QSAFE */ + 0x00000018, /* EMC_RDV */ + 0x0000001a, /* EMC_RDV_MASK */ + 0x000017e2, /* EMC_REFRESH */ + 0x00000000, /* EMC_BURST_REFRESH_NUM */ + 0x000005f8, /* EMC_PRE_REFRESH_REQ_CNT */ + 0x00000003, /* EMC_PDEX2WR */ + 0x00000011, /* EMC_PDEX2RD */ + 0x00000001, /* EMC_PCHG2PDEN */ + 0x00000000, /* EMC_ACT2PDEN */ + 0x000000c6, /* EMC_AR2PDEN */ + 0x00000018, /* EMC_RW2PDEN */ + 0x000000d6, /* EMC_TXSR */ + 0x00000200, /* EMC_TXSRDLL */ + 0x00000005, /* EMC_TCKE */ + 0x00000006, /* EMC_TCKESR */ + 0x00000005, /* EMC_TPD */ + 0x00000019, /* EMC_TFAW */ + 0x00000000, /* EMC_TRPAB */ + 0x00000008, /* EMC_TCLKSTABLE */ + 0x00000008, /* EMC_TCLKSTOP */ + 0x00001822, /* EMC_TREFBW */ + 0x00000000, /* EMC_FBIO_CFG6 */ + 0x00000000, /* EMC_ODT_WRITE */ + 0x00000000, /* EMC_ODT_READ */ + 0x104ab098, /* EMC_FBIO_CFG5 */ + 0xe00700b1, /* EMC_CFG_DIG_DLL */ + 0x00008000, /* EMC_CFG_DIG_DLL_PERIOD */ + 0x007fc008, /* EMC_DLL_XFORM_DQS0 */ + 0x007fc008, /* EMC_DLL_XFORM_DQS1 */ + 0x007fc008, /* EMC_DLL_XFORM_DQS2 */ + 0x007fc008, /* EMC_DLL_XFORM_DQS3 */ + 0x007fc008, /* EMC_DLL_XFORM_DQS4 */ + 0x007fc008, /* EMC_DLL_XFORM_DQS5 */ + 0x007fc008, /* EMC_DLL_XFORM_DQS6 */ + 0x007fc008, /* EMC_DLL_XFORM_DQS7 */ + 0x007fc008, /* EMC_DLL_XFORM_DQS8 */ + 0x007fc008, /* EMC_DLL_XFORM_DQS9 */ + 0x007fc008, /* EMC_DLL_XFORM_DQS10 */ + 0x007fc008, /* EMC_DLL_XFORM_DQS11 */ + 0x007fc008, /* EMC_DLL_XFORM_DQS12 */ + 0x007fc008, /* EMC_DLL_XFORM_DQS13 */ + 0x007fc008, /* EMC_DLL_XFORM_DQS14 */ + 0x007fc008, /* EMC_DLL_XFORM_DQS15 */ + 0x00000000, /* EMC_DLL_XFORM_QUSE0 */ + 0x00000000, /* EMC_DLL_XFORM_QUSE1 */ + 0x00000000, /* EMC_DLL_XFORM_QUSE2 */ + 0x00000000, /* EMC_DLL_XFORM_QUSE3 */ + 0x00000000, /* EMC_DLL_XFORM_QUSE4 */ + 0x00000000, /* EMC_DLL_XFORM_QUSE5 */ + 0x00000000, /* EMC_DLL_XFORM_QUSE6 */ + 0x00000000, /* EMC_DLL_XFORM_QUSE7 */ + 0x00034000, /* EMC_DLL_XFORM_ADDR0 */ + 0x00034000, /* EMC_DLL_XFORM_ADDR1 */ + 0x00000000, /* EMC_DLL_XFORM_ADDR2 */ + 0x00034000, /* EMC_DLL_XFORM_ADDR3 */ + 0x00034000, /* EMC_DLL_XFORM_ADDR4 */ + 0x00000000, /* EMC_DLL_XFORM_ADDR5 */ + 0x00000000, /* EMC_DLL_XFORM_QUSE8 */ + 0x00000000, /* EMC_DLL_XFORM_QUSE9 */ + 0x00000000, /* EMC_DLL_XFORM_QUSE10 */ + 0x00000000, /* EMC_DLL_XFORM_QUSE11 */ + 0x00000000, /* EMC_DLL_XFORM_QUSE12 */ + 0x00000000, /* EMC_DLL_XFORM_QUSE13 */ + 0x00000000, /* EMC_DLL_XFORM_QUSE14 */ + 0x00000000, /* EMC_DLL_XFORM_QUSE15 */ + 0x00000005, /* EMC_DLI_TRIM_TXDQS0 */ + 0x00000005, /* EMC_DLI_TRIM_TXDQS1 */ + 0x00000005, /* EMC_DLI_TRIM_TXDQS2 */ + 0x00000005, /* EMC_DLI_TRIM_TXDQS3 */ + 0x00000005, /* EMC_DLI_TRIM_TXDQS4 */ + 0x00000005, /* EMC_DLI_TRIM_TXDQS5 */ + 0x00000005, /* EMC_DLI_TRIM_TXDQS6 */ + 0x00000005, /* EMC_DLI_TRIM_TXDQS7 */ + 0x00000005, /* EMC_DLI_TRIM_TXDQS8 */ + 0x00000005, /* EMC_DLI_TRIM_TXDQS9 */ + 0x00000005, /* EMC_DLI_TRIM_TXDQS10 */ + 0x00000005, /* EMC_DLI_TRIM_TXDQS11 */ + 0x00000005, /* EMC_DLI_TRIM_TXDQS12 */ + 0x00000005, /* EMC_DLI_TRIM_TXDQS13 */ + 0x00000005, /* EMC_DLI_TRIM_TXDQS14 */ + 0x00000005, /* EMC_DLI_TRIM_TXDQS15 */ + 0x0000000a, /* EMC_DLL_XFORM_DQ0 */ + 0x0000000a, /* EMC_DLL_XFORM_DQ1 */ + 0x0000000a, /* EMC_DLL_XFORM_DQ2 */ + 0x0000000a, /* EMC_DLL_XFORM_DQ3 */ + 0x0000000a, /* EMC_DLL_XFORM_DQ4 */ + 0x0000000a, /* EMC_DLL_XFORM_DQ5 */ + 0x0000000a, /* EMC_DLL_XFORM_DQ6 */ + 0x0000000a, /* EMC_DLL_XFORM_DQ7 */ + 0x100002a0, /* EMC_XM2CMDPADCTRL */ + 0x00000000, /* EMC_XM2CMDPADCTRL4 */ + 0x00111111, /* EMC_XM2CMDPADCTRL5 */ + 0x0120113d, /* EMC_XM2DQSPADCTRL2 */ + 0x00000000, /* EMC_XM2DQPADCTRL2 */ + 0x00000000, /* EMC_XM2DQPADCTRL3 */ + 0x77ffc085, /* EMC_XM2CLKPADCTRL */ + 0x00000000, /* EMC_XM2CLKPADCTRL2 */ + 0x81f1f108, /* EMC_XM2COMPPADCTRL */ + 0x07070004, /* EMC_XM2VTTGENPADCTRL */ + 0x00000000, /* EMC_XM2VTTGENPADCTRL2 */ + 0x016eeeee, /* EMC_XM2VTTGENPADCTRL3 */ + 0x61861820, /* EMC_XM2DQSPADCTRL3 */ + 0x00514514, /* EMC_XM2DQSPADCTRL4 */ + 0x00514514, /* EMC_XM2DQSPADCTRL5 */ + 0x61861800, /* EMC_XM2DQSPADCTRL6 */ + 0x0606003f, /* EMC_DSR_VTTGEN_DRV */ + 0x00000000, /* EMC_TXDSRVTTGEN */ + 0x00000000, /* EMC_FBIO_SPARE */ + 0x00020000, /* EMC_ZCAL_INTERVAL */ + 0x00000100, /* EMC_ZCAL_WAIT_CNT */ + 0x00f8000e, /* EMC_MRS_WAIT_CNT */ + 0x00f8000e, /* EMC_MRS_WAIT_CNT2 */ + 0x00000000, /* EMC_CTT */ + 0x00000004, /* EMC_CTT_DURATION */ + 0x00004080, /* EMC_CFG_PIPE */ + 0x80003012, /* EMC_DYN_SELF_REF_CONTROL */ + 0x0000000f, /* EMC_QPOP */ + 0x0e00000b, /* MC_EMEM_ARB_CFG */ + 0x80000040, /* MC_EMEM_ARB_OUTSTANDING_REQ */ + 0x00000004, /* MC_EMEM_ARB_TIMING_RCD */ + 0x00000005, /* MC_EMEM_ARB_TIMING_RP */ + 0x00000013, /* MC_EMEM_ARB_TIMING_RC */ + 0x0000000c, /* MC_EMEM_ARB_TIMING_RAS */ + 0x0000000d, /* MC_EMEM_ARB_TIMING_FAW */ + 0x00000002, /* MC_EMEM_ARB_TIMING_RRD */ + 0x00000003, /* MC_EMEM_ARB_TIMING_RAP2PRE */ + 0x0000000c, /* MC_EMEM_ARB_TIMING_WAP2PRE */ + 0x00000002, /* MC_EMEM_ARB_TIMING_R2R */ + 0x00000002, /* MC_EMEM_ARB_TIMING_W2W */ + 0x00000006, /* MC_EMEM_ARB_TIMING_R2W */ + 0x00000008, /* MC_EMEM_ARB_TIMING_W2R */ + 0x08060202, /* MC_EMEM_ARB_DA_TURNS */ + 0x00170e13, /* MC_EMEM_ARB_DA_COVERS */ + 0x734c2414, /* MC_EMEM_ARB_MISC0 */ + 0x70000f02, /* MC_EMEM_ARB_MISC1 */ + 0x001f0000, /* MC_EMEM_ARB_RING1_THROTTLE */ + }, + { + 0x00000013, /* MC_MLL_MPCORER_PTSA_RATE */ + 0x0000017c, /* MC_PTSA_GRANT_DECREMENT */ + 0x00810038, /* MC_LATENCY_ALLOWANCE_XUSB_0 */ + 0x00810038, /* MC_LATENCY_ALLOWANCE_XUSB_1 */ + 0x0081003c, /* MC_LATENCY_ALLOWANCE_TSEC_0 */ + 0x00810090, /* MC_LATENCY_ALLOWANCE_SDMMCA_0 */ + 0x00810041, /* MC_LATENCY_ALLOWANCE_SDMMCAA_0 */ + 0x00810090, /* MC_LATENCY_ALLOWANCE_SDMMC_0 */ + 0x00810041, /* MC_LATENCY_ALLOWANCE_SDMMCAB_0 */ + 0x00270049, /* MC_LATENCY_ALLOWANCE_PPCS_0 */ + 0x00810080, /* MC_LATENCY_ALLOWANCE_PPCS_1 */ + 0x00810004, /* MC_LATENCY_ALLOWANCE_MPCORE_0 */ + 0x00810004, /* MC_LATENCY_ALLOWANCE_MPCORELP_0 */ + 0x00080016, /* MC_LATENCY_ALLOWANCE_HC_0 */ + 0x00000081, /* MC_LATENCY_ALLOWANCE_HC_1 */ + 0x00810004, /* MC_LATENCY_ALLOWANCE_AVPC_0 */ + 0x00810019, /* MC_LATENCY_ALLOWANCE_GPU_0 */ + 0x00810018, /* MC_LATENCY_ALLOWANCE_MSENC_0 */ + 0x00810024, /* MC_LATENCY_ALLOWANCE_HDA_0 */ + 0x0081001c, /* MC_LATENCY_ALLOWANCE_VIC_0 */ + 0x00000081, /* MC_LATENCY_ALLOWANCE_VI2_0 */ + 0x00000036, /* MC_LATENCY_ALLOWANCE_ISP2_0 */ + 0x00810081, /* MC_LATENCY_ALLOWANCE_ISP2_1 */ + 0x00000036, /* MC_LATENCY_ALLOWANCE_ISP2B_0 */ + 0x00810081, /* MC_LATENCY_ALLOWANCE_ISP2B_1 */ + 0x00d400ff, /* MC_LATENCY_ALLOWANCE_VDE_0 */ + 0x00510029, /* MC_LATENCY_ALLOWANCE_VDE_1 */ + 0x00810081, /* MC_LATENCY_ALLOWANCE_VDE_2 */ + 0x00810081, /* MC_LATENCY_ALLOWANCE_VDE_3 */ + 0x00810065, /* MC_LATENCY_ALLOWANCE_SATA_0 */ + 0x0081001c, /* MC_LATENCY_ALLOWANCE_AFI_0 */ + }, + 0x00000042, /* EMC_ZCAL_WAIT_CNT after clock change */ + 0x001fffff, /* EMC_AUTO_CAL_INTERVAL */ + 0x00000802, /* EMC_CTT_TERM_CTRL */ + 0x73300000, /* EMC_CFG */ + 0x0000089d, /* EMC_CFG_2 */ + 0x00040000, /* EMC_SEL_DPD_CTRL */ + 0xe0070069, /* EMC_CFG_DIG_DLL */ + 0x00000000, /* EMC_BGBIAS_CTL0 */ + 0x00000000, /* EMC_AUTO_CAL_CONFIG2 */ + 0x00000000, /* EMC_AUTO_CAL_CONFIG3 */ + 0xa1430000, /* EMC_AUTO_CAL_CONFIG */ + 0x80000d71, /* Mode Register 0 */ + 0x80100002, /* Mode Register 1 */ + 0x80200018, /* Mode Register 2 */ + 0x00000000, /* Mode Register 4 */ + 1200, /* expected dvfs latency (ns) */ + }, + { + 0x19, /* V5.0.18 */ + "01_924000_01_V5.0.18_V1.1", /* DVFS table version */ + 924000, /* SDRAM frequency */ + 1010, /* min voltage */ + 1010, /* gpu min voltage */ + "pllm_ud", /* clock source id */ + 0x80000000, /* CLK_SOURCE_EMC */ + 165, /* number of burst_regs */ + 31, /* number of up_down_regs */ + { + 0x0000002b, /* EMC_RC */ + 0x000000ef, /* EMC_RFC */ + 0x00000000, /* EMC_RFC_SLR */ + 0x0000001e, /* EMC_RAS */ + 0x0000000b, /* EMC_RP */ + 0x00000009, /* EMC_R2W */ + 0x0000000f, /* EMC_W2R */ + 0x00000005, /* EMC_R2P */ + 0x00000016, /* EMC_W2P */ + 0x0000000b, /* EMC_RD_RCD */ + 0x0000000b, /* EMC_WR_RCD */ + 0x00000005, /* EMC_RRD */ + 0x00000002, /* EMC_REXT */ + 0x00000000, /* EMC_WEXT */ + 0x00000007, /* EMC_WDV */ + 0x00000007, /* EMC_WDV_MASK */ + 0x0000000d, /* EMC_QUSE */ + 0x00000002, /* EMC_QUSE_WIDTH */ + 0x00000000, /* EMC_IBDLY */ + 0x00000002, /* EMC_EINPUT */ + 0x0000000f, /* EMC_EINPUT_DURATION */ + 0x000a0000, /* EMC_PUTERM_EXTRA */ + 0x00000004, /* EMC_PUTERM_WIDTH */ + 0x00000000, /* EMC_PUTERM_ADJ */ + 0x00000000, /* EMC_CDB_CNTL_1 */ + 0x00000000, /* EMC_CDB_CNTL_2 */ + 0x00000000, /* EMC_CDB_CNTL_3 */ + 0x00000001, /* EMC_QRST */ + 0x00000016, /* EMC_QSAFE */ + 0x0000001a, /* EMC_RDV */ + 0x0000001c, /* EMC_RDV_MASK */ + 0x00001be7, /* EMC_REFRESH */ + 0x00000000, /* EMC_BURST_REFRESH_NUM */ + 0x000006f9, /* EMC_PRE_REFRESH_REQ_CNT */ + 0x00000004, /* EMC_PDEX2WR */ + 0x00000015, /* EMC_PDEX2RD */ + 0x00000001, /* EMC_PCHG2PDEN */ + 0x00000000, /* EMC_ACT2PDEN */ + 0x000000e6, /* EMC_AR2PDEN */ + 0x0000001b, /* EMC_RW2PDEN */ + 0x000000fa, /* EMC_TXSR */ + 0x00000200, /* EMC_TXSRDLL */ + 0x00000006, /* EMC_TCKE */ + 0x00000007, /* EMC_TCKESR */ + 0x00000006, /* EMC_TPD */ + 0x0000001e, /* EMC_TFAW */ + 0x00000000, /* EMC_TRPAB */ + 0x0000000a, /* EMC_TCLKSTABLE */ + 0x0000000a, /* EMC_TCLKSTOP */ + 0x00001c28, /* EMC_TREFBW */ + 0x00000000, /* EMC_FBIO_CFG6 */ + 0x00000000, /* EMC_ODT_WRITE */ + 0x00000000, /* EMC_ODT_READ */ + 0x104ab898, /* EMC_FBIO_CFG5 */ + 0xe00400b1, /* EMC_CFG_DIG_DLL */ + 0x00008000, /* EMC_CFG_DIG_DLL_PERIOD */ + 0x00000006, /* EMC_DLL_XFORM_DQS0 */ + 0x00000006, /* EMC_DLL_XFORM_DQS1 */ + 0x007fc00a, /* EMC_DLL_XFORM_DQS2 */ + 0x00000006, /* EMC_DLL_XFORM_DQS3 */ + 0x00000006, /* EMC_DLL_XFORM_DQS4 */ + 0x00000006, /* EMC_DLL_XFORM_DQS5 */ + 0x00000006, /* EMC_DLL_XFORM_DQS6 */ + 0x00000006, /* EMC_DLL_XFORM_DQS7 */ + 0x00000000, /* EMC_DLL_XFORM_DQS8 */ + 0x00000000, /* EMC_DLL_XFORM_DQS9 */ + 0x00000000, /* EMC_DLL_XFORM_DQS10 */ + 0x00000000, /* EMC_DLL_XFORM_DQS11 */ + 0x00000000, /* EMC_DLL_XFORM_DQS12 */ + 0x00000000, /* EMC_DLL_XFORM_DQS13 */ + 0x00000000, /* EMC_DLL_XFORM_DQS14 */ + 0x00000000, /* EMC_DLL_XFORM_DQS15 */ + 0x00000000, /* EMC_DLL_XFORM_QUSE0 */ + 0x00000000, /* EMC_DLL_XFORM_QUSE1 */ + 0x00000000, /* EMC_DLL_XFORM_QUSE2 */ + 0x00000000, /* EMC_DLL_XFORM_QUSE3 */ + 0x00000000, /* EMC_DLL_XFORM_QUSE4 */ + 0x00000000, /* EMC_DLL_XFORM_QUSE5 */ + 0x00000000, /* EMC_DLL_XFORM_QUSE6 */ + 0x00000000, /* EMC_DLL_XFORM_QUSE7 */ + 0x0002c000, /* EMC_DLL_XFORM_ADDR0 */ + 0x0002c000, /* EMC_DLL_XFORM_ADDR1 */ + 0x00000000, /* EMC_DLL_XFORM_ADDR2 */ + 0x0002c000, /* EMC_DLL_XFORM_ADDR3 */ + 0x0002c000, /* EMC_DLL_XFORM_ADDR4 */ + 0x00000000, /* EMC_DLL_XFORM_ADDR5 */ + 0x00000000, /* EMC_DLL_XFORM_QUSE8 */ + 0x00000000, /* EMC_DLL_XFORM_QUSE9 */ + 0x00000000, /* EMC_DLL_XFORM_QUSE10 */ + 0x00000000, /* EMC_DLL_XFORM_QUSE11 */ + 0x00000000, /* EMC_DLL_XFORM_QUSE12 */ + 0x00000000, /* EMC_DLL_XFORM_QUSE13 */ + 0x00000000, /* EMC_DLL_XFORM_QUSE14 */ + 0x00000000, /* EMC_DLL_XFORM_QUSE15 */ + 0x00000004, /* EMC_DLI_TRIM_TXDQS0 */ + 0x00000004, /* EMC_DLI_TRIM_TXDQS1 */ + 0x00000004, /* EMC_DLI_TRIM_TXDQS2 */ + 0x00000004, /* EMC_DLI_TRIM_TXDQS3 */ + 0x00000004, /* EMC_DLI_TRIM_TXDQS4 */ + 0x00000004, /* EMC_DLI_TRIM_TXDQS5 */ + 0x00000004, /* EMC_DLI_TRIM_TXDQS6 */ + 0x00000004, /* EMC_DLI_TRIM_TXDQS7 */ + 0x00000004, /* EMC_DLI_TRIM_TXDQS8 */ + 0x00000004, /* EMC_DLI_TRIM_TXDQS9 */ + 0x00000004, /* EMC_DLI_TRIM_TXDQS10 */ + 0x00000004, /* EMC_DLI_TRIM_TXDQS11 */ + 0x00000004, /* EMC_DLI_TRIM_TXDQS12 */ + 0x00000004, /* EMC_DLI_TRIM_TXDQS13 */ + 0x00000004, /* EMC_DLI_TRIM_TXDQS14 */ + 0x00000004, /* EMC_DLI_TRIM_TXDQS15 */ + 0x00000008, /* EMC_DLL_XFORM_DQ0 */ + 0x00000008, /* EMC_DLL_XFORM_DQ1 */ + 0x00000008, /* EMC_DLL_XFORM_DQ2 */ + 0x00000008, /* EMC_DLL_XFORM_DQ3 */ + 0x00000008, /* EMC_DLL_XFORM_DQ4 */ + 0x00000008, /* EMC_DLL_XFORM_DQ5 */ + 0x00000008, /* EMC_DLL_XFORM_DQ6 */ + 0x00000008, /* EMC_DLL_XFORM_DQ7 */ + 0x100002a0, /* EMC_XM2CMDPADCTRL */ + 0x00000000, /* EMC_XM2CMDPADCTRL4 */ + 0x00111111, /* EMC_XM2CMDPADCTRL5 */ + 0x0120113d, /* EMC_XM2DQSPADCTRL2 */ + 0x00000000, /* EMC_XM2DQPADCTRL2 */ + 0x00000000, /* EMC_XM2DQPADCTRL3 */ + 0x77ffc085, /* EMC_XM2CLKPADCTRL */ + 0x00000000, /* EMC_XM2CLKPADCTRL2 */ + 0x81f1f108, /* EMC_XM2COMPPADCTRL */ + 0x07070004, /* EMC_XM2VTTGENPADCTRL */ + 0x00000000, /* EMC_XM2VTTGENPADCTRL2 */ + 0x016eeeee, /* EMC_XM2VTTGENPADCTRL3 */ + 0x6db6db20, /* EMC_XM2DQSPADCTRL3 */ + 0x00596596, /* EMC_XM2DQSPADCTRL4 */ + 0x00596596, /* EMC_XM2DQSPADCTRL5 */ + 0x6db6db20, /* EMC_XM2DQSPADCTRL6 */ + 0x0606003f, /* EMC_DSR_VTTGEN_DRV */ + 0x00000000, /* EMC_TXDSRVTTGEN */ + 0x00000000, /* EMC_FBIO_SPARE */ + 0x00020000, /* EMC_ZCAL_INTERVAL */ + 0x00000128, /* EMC_ZCAL_WAIT_CNT */ + 0x00ce000e, /* EMC_MRS_WAIT_CNT */ + 0x00ce000e, /* EMC_MRS_WAIT_CNT2 */ + 0x00000000, /* EMC_CTT */ + 0x00000004, /* EMC_CTT_DURATION */ + 0x00004080, /* EMC_CFG_PIPE */ + 0x800037ea, /* EMC_DYN_SELF_REF_CONTROL */ + 0x00000011, /* EMC_QPOP */ + 0x0e00000d, /* MC_EMEM_ARB_CFG */ + 0x80000040, /* MC_EMEM_ARB_OUTSTANDING_REQ */ + 0x00000005, /* MC_EMEM_ARB_TIMING_RCD */ + 0x00000006, /* MC_EMEM_ARB_TIMING_RP */ + 0x00000016, /* MC_EMEM_ARB_TIMING_RC */ + 0x0000000e, /* MC_EMEM_ARB_TIMING_RAS */ + 0x0000000f, /* MC_EMEM_ARB_TIMING_FAW */ + 0x00000003, /* MC_EMEM_ARB_TIMING_RRD */ + 0x00000004, /* MC_EMEM_ARB_TIMING_RAP2PRE */ + 0x0000000e, /* MC_EMEM_ARB_TIMING_WAP2PRE */ + 0x00000002, /* MC_EMEM_ARB_TIMING_R2R */ + 0x00000002, /* MC_EMEM_ARB_TIMING_W2W */ + 0x00000006, /* MC_EMEM_ARB_TIMING_R2W */ + 0x00000009, /* MC_EMEM_ARB_TIMING_W2R */ + 0x09060202, /* MC_EMEM_ARB_DA_TURNS */ + 0x001a1016, /* MC_EMEM_ARB_DA_COVERS */ + 0x734e2a17, /* MC_EMEM_ARB_MISC0 */ + 0x70000f02, /* MC_EMEM_ARB_MISC1 */ + 0x001f0000, /* MC_EMEM_ARB_RING1_THROTTLE */ + }, + { + 0x00000017, /* MC_MLL_MPCORER_PTSA_RATE */ + 0x000001bb, /* MC_PTSA_GRANT_DECREMENT */ + 0x006e0038, /* MC_LATENCY_ALLOWANCE_XUSB_0 */ + 0x006e0038, /* MC_LATENCY_ALLOWANCE_XUSB_1 */ + 0x006e003c, /* MC_LATENCY_ALLOWANCE_TSEC_0 */ + 0x006e0090, /* MC_LATENCY_ALLOWANCE_SDMMCA_0 */ + 0x006e0041, /* MC_LATENCY_ALLOWANCE_SDMMCAA_0 */ + 0x006e0090, /* MC_LATENCY_ALLOWANCE_SDMMC_0 */ + 0x006e0041, /* MC_LATENCY_ALLOWANCE_SDMMCAB_0 */ + 0x00270049, /* MC_LATENCY_ALLOWANCE_PPCS_0 */ + 0x006e0080, /* MC_LATENCY_ALLOWANCE_PPCS_1 */ + 0x006e0004, /* MC_LATENCY_ALLOWANCE_MPCORE_0 */ + 0x006e0004, /* MC_LATENCY_ALLOWANCE_MPCORELP_0 */ + 0x00080016, /* MC_LATENCY_ALLOWANCE_HC_0 */ + 0x0000006e, /* MC_LATENCY_ALLOWANCE_HC_1 */ + 0x006e0004, /* MC_LATENCY_ALLOWANCE_AVPC_0 */ + 0x006e0019, /* MC_LATENCY_ALLOWANCE_GPU_0 */ + 0x006e0018, /* MC_LATENCY_ALLOWANCE_MSENC_0 */ + 0x006e0024, /* MC_LATENCY_ALLOWANCE_HDA_0 */ + 0x006e001b, /* MC_LATENCY_ALLOWANCE_VIC_0 */ + 0x0000006e, /* MC_LATENCY_ALLOWANCE_VI2_0 */ + 0x00000036, /* MC_LATENCY_ALLOWANCE_ISP2_0 */ + 0x006e006e, /* MC_LATENCY_ALLOWANCE_ISP2_1 */ + 0x00000036, /* MC_LATENCY_ALLOWANCE_ISP2B_0 */ + 0x006e006e, /* MC_LATENCY_ALLOWANCE_ISP2B_1 */ + 0x00d400ff, /* MC_LATENCY_ALLOWANCE_VDE_0 */ + 0x00510029, /* MC_LATENCY_ALLOWANCE_VDE_1 */ + 0x006e006e, /* MC_LATENCY_ALLOWANCE_VDE_2 */ + 0x006e006e, /* MC_LATENCY_ALLOWANCE_VDE_3 */ + 0x006e0065, /* MC_LATENCY_ALLOWANCE_SATA_0 */ + 0x006e001c, /* MC_LATENCY_ALLOWANCE_AFI_0 */ + }, + 0x0000004c, /* EMC_ZCAL_WAIT_CNT after clock change */ + 0x001fffff, /* EMC_AUTO_CAL_INTERVAL */ + 0x00000802, /* EMC_CTT_TERM_CTRL */ + 0x73300000, /* EMC_CFG */ + 0x0000089d, /* EMC_CFG_2 */ + 0x00040000, /* EMC_SEL_DPD_CTRL */ + 0xe0040069, /* EMC_CFG_DIG_DLL */ + 0x00000000, /* EMC_BGBIAS_CTL0 */ + 0x00000000, /* EMC_AUTO_CAL_CONFIG2 */ + 0x00000000, /* EMC_AUTO_CAL_CONFIG3 */ + 0xa1430303, /* EMC_AUTO_CAL_CONFIG */ + 0x80000f15, /* Mode Register 0 */ + 0x80100002, /* Mode Register 1 */ + 0x80200020, /* Mode Register 2 */ + 0x00000000, /* Mode Register 4 */ + 1180, /* expected dvfs latency (ns) */ + }, +}; +static struct tegra12_emc_table jetson_tk1_ddr3_K4B4G1646D_BFMA03_embedded_emc_table[] = { + { + 0x19, /* V5.0.18 */ + "01_204000_01_V5.0.18_V1.1", /* DVFS table version */ + 204000, /* SDRAM frequency */ + 800, /* min voltage */ + 800, /* gpu min voltage */ + "pllp_out0", /* clock source id */ + 0x40000002, /* CLK_SOURCE_EMC */ + 165, /* number of burst_regs */ + 31, /* number of up_down_regs */ + { + 0x00000009, /* EMC_RC */ + 0x00000035, /* EMC_RFC */ + 0x00000000, /* EMC_RFC_SLR */ + 0x00000006, /* EMC_RAS */ + 0x00000002, /* EMC_RP */ + 0x00000005, /* EMC_R2W */ + 0x0000000a, /* EMC_W2R */ + 0x00000005, /* EMC_R2P */ + 0x0000000b, /* EMC_W2P */ + 0x00000002, /* EMC_RD_RCD */ + 0x00000002, /* EMC_WR_RCD */ + 0x00000003, /* EMC_RRD */ + 0x00000003, /* EMC_REXT */ + 0x00000000, /* EMC_WEXT */ + 0x00000005, /* EMC_WDV */ + 0x00000005, /* EMC_WDV_MASK */ + 0x00000006, /* EMC_QUSE */ + 0x00000002, /* EMC_QUSE_WIDTH */ + 0x00000000, /* EMC_IBDLY */ + 0x00000004, /* EMC_EINPUT */ + 0x00000006, /* EMC_EINPUT_DURATION */ + 0x00010000, /* EMC_PUTERM_EXTRA */ + 0x00000003, /* EMC_PUTERM_WIDTH */ + 0x00000000, /* EMC_PUTERM_ADJ */ + 0x00000000, /* EMC_CDB_CNTL_1 */ + 0x00000000, /* EMC_CDB_CNTL_2 */ + 0x00000000, /* EMC_CDB_CNTL_3 */ + 0x00000003, /* EMC_QRST */ + 0x0000000d, /* EMC_QSAFE */ + 0x0000000f, /* EMC_RDV */ + 0x00000011, /* EMC_RDV_MASK */ + 0x00000607, /* EMC_REFRESH */ + 0x00000000, /* EMC_BURST_REFRESH_NUM */ + 0x00000181, /* EMC_PRE_REFRESH_REQ_CNT */ + 0x00000002, /* EMC_PDEX2WR */ + 0x00000002, /* EMC_PDEX2RD */ + 0x00000001, /* EMC_PCHG2PDEN */ + 0x00000000, /* EMC_ACT2PDEN */ + 0x00000032, /* EMC_AR2PDEN */ + 0x0000000f, /* EMC_RW2PDEN */ + 0x00000038, /* EMC_TXSR */ + 0x00000038, /* EMC_TXSRDLL */ + 0x00000004, /* EMC_TCKE */ + 0x00000005, /* EMC_TCKESR */ + 0x00000004, /* EMC_TPD */ + 0x00000006, /* EMC_TFAW */ + 0x00000000, /* EMC_TRPAB */ + 0x00000005, /* EMC_TCLKSTABLE */ + 0x00000005, /* EMC_TCLKSTOP */ + 0x00000638, /* EMC_TREFBW */ + 0x00000000, /* EMC_FBIO_CFG6 */ + 0x00000000, /* EMC_ODT_WRITE */ + 0x00000000, /* EMC_ODT_READ */ + 0x106aa298, /* EMC_FBIO_CFG5 */ + 0x002c00a0, /* EMC_CFG_DIG_DLL */ + 0x00008000, /* EMC_CFG_DIG_DLL_PERIOD */ + 0x00080000, /* EMC_DLL_XFORM_DQS0 */ + 0x00080000, /* EMC_DLL_XFORM_DQS1 */ + 0x00080000, /* EMC_DLL_XFORM_DQS2 */ + 0x00080000, /* EMC_DLL_XFORM_DQS3 */ + 0x00080000, /* EMC_DLL_XFORM_DQS4 */ + 0x00080000, /* EMC_DLL_XFORM_DQS5 */ + 0x00080000, /* EMC_DLL_XFORM_DQS6 */ + 0x00080000, /* EMC_DLL_XFORM_DQS7 */ + 0x00080000, /* EMC_DLL_XFORM_DQS8 */ + 0x00080000, /* EMC_DLL_XFORM_DQS9 */ + 0x00080000, /* EMC_DLL_XFORM_DQS10 */ + 0x00080000, /* EMC_DLL_XFORM_DQS11 */ + 0x00080000, /* EMC_DLL_XFORM_DQS12 */ + 0x00080000, /* EMC_DLL_XFORM_DQS13 */ + 0x00080000, /* EMC_DLL_XFORM_DQS14 */ + 0x00080000, /* EMC_DLL_XFORM_DQS15 */ + 0x00000000, /* EMC_DLL_XFORM_QUSE0 */ + 0x00000000, /* EMC_DLL_XFORM_QUSE1 */ + 0x00000000, /* EMC_DLL_XFORM_QUSE2 */ + 0x00000000, /* EMC_DLL_XFORM_QUSE3 */ + 0x00000000, /* EMC_DLL_XFORM_QUSE4 */ + 0x00000000, /* EMC_DLL_XFORM_QUSE5 */ + 0x00000000, /* EMC_DLL_XFORM_QUSE6 */ + 0x00000000, /* EMC_DLL_XFORM_QUSE7 */ + 0x00000000, /* EMC_DLL_XFORM_ADDR0 */ + 0x00000000, /* EMC_DLL_XFORM_ADDR1 */ + 0x00008000, /* EMC_DLL_XFORM_ADDR2 */ + 0x00000000, /* EMC_DLL_XFORM_ADDR3 */ + 0x00000000, /* EMC_DLL_XFORM_ADDR4 */ + 0x00008000, /* EMC_DLL_XFORM_ADDR5 */ + 0x00000000, /* EMC_DLL_XFORM_QUSE8 */ + 0x00000000, /* EMC_DLL_XFORM_QUSE9 */ + 0x00000000, /* EMC_DLL_XFORM_QUSE10 */ + 0x00000000, /* EMC_DLL_XFORM_QUSE11 */ + 0x00000000, /* EMC_DLL_XFORM_QUSE12 */ + 0x00000000, /* EMC_DLL_XFORM_QUSE13 */ + 0x00000000, /* EMC_DLL_XFORM_QUSE14 */ + 0x00000000, /* EMC_DLL_XFORM_QUSE15 */ + 0x00000000, /* EMC_DLI_TRIM_TXDQS0 */ + 0x00000000, /* EMC_DLI_TRIM_TXDQS1 */ + 0x00000000, /* EMC_DLI_TRIM_TXDQS2 */ + 0x00000000, /* EMC_DLI_TRIM_TXDQS3 */ + 0x00000000, /* EMC_DLI_TRIM_TXDQS4 */ + 0x00000000, /* EMC_DLI_TRIM_TXDQS5 */ + 0x00000000, /* EMC_DLI_TRIM_TXDQS6 */ + 0x00000000, /* EMC_DLI_TRIM_TXDQS7 */ + 0x00000000, /* EMC_DLI_TRIM_TXDQS8 */ + 0x00000000, /* EMC_DLI_TRIM_TXDQS9 */ + 0x00000000, /* EMC_DLI_TRIM_TXDQS10 */ + 0x00000000, /* EMC_DLI_TRIM_TXDQS11 */ + 0x00000000, /* EMC_DLI_TRIM_TXDQS12 */ + 0x00000000, /* EMC_DLI_TRIM_TXDQS13 */ + 0x00000000, /* EMC_DLI_TRIM_TXDQS14 */ + 0x00000000, /* EMC_DLI_TRIM_TXDQS15 */ + 0x00090000, /* EMC_DLL_XFORM_DQ0 */ + 0x00090000, /* EMC_DLL_XFORM_DQ1 */ + 0x00090000, /* EMC_DLL_XFORM_DQ2 */ + 0x00090000, /* EMC_DLL_XFORM_DQ3 */ + 0x00009000, /* EMC_DLL_XFORM_DQ4 */ + 0x00009000, /* EMC_DLL_XFORM_DQ5 */ + 0x00009000, /* EMC_DLL_XFORM_DQ6 */ + 0x00009000, /* EMC_DLL_XFORM_DQ7 */ + 0x10000280, /* EMC_XM2CMDPADCTRL */ + 0x00000000, /* EMC_XM2CMDPADCTRL4 */ + 0x00111111, /* EMC_XM2CMDPADCTRL5 */ + 0x0130b118, /* EMC_XM2DQSPADCTRL2 */ + 0x00000000, /* EMC_XM2DQPADCTRL2 */ + 0x00000000, /* EMC_XM2DQPADCTRL3 */ + 0x77ffc081, /* EMC_XM2CLKPADCTRL */ + 0x00000707, /* EMC_XM2CLKPADCTRL2 */ + 0x81f1f108, /* EMC_XM2COMPPADCTRL */ + 0x07070004, /* EMC_XM2VTTGENPADCTRL */ + 0x0000003f, /* EMC_XM2VTTGENPADCTRL2 */ + 0x016eeeee, /* EMC_XM2VTTGENPADCTRL3 */ + 0x51451400, /* EMC_XM2DQSPADCTRL3 */ + 0x00514514, /* EMC_XM2DQSPADCTRL4 */ + 0x00514514, /* EMC_XM2DQSPADCTRL5 */ + 0x51451400, /* EMC_XM2DQSPADCTRL6 */ + 0x0000003f, /* EMC_DSR_VTTGEN_DRV */ + 0x00000066, /* EMC_TXDSRVTTGEN */ + 0x00000000, /* EMC_FBIO_SPARE */ + 0x00020000, /* EMC_ZCAL_INTERVAL */ + 0x00000100, /* EMC_ZCAL_WAIT_CNT */ + 0x000e000e, /* EMC_MRS_WAIT_CNT */ + 0x000e000e, /* EMC_MRS_WAIT_CNT2 */ + 0x00000000, /* EMC_CTT */ + 0x00000003, /* EMC_CTT_DURATION */ + 0x0000d2b3, /* EMC_CFG_PIPE */ + 0x80000d22, /* EMC_DYN_SELF_REF_CONTROL */ + 0x0000000a, /* EMC_QPOP */ + 0x01000003, /* MC_EMEM_ARB_CFG */ + 0x80000040, /* MC_EMEM_ARB_OUTSTANDING_REQ */ + 0x00000001, /* MC_EMEM_ARB_TIMING_RCD */ + 0x00000001, /* MC_EMEM_ARB_TIMING_RP */ + 0x00000004, /* MC_EMEM_ARB_TIMING_RC */ + 0x00000002, /* MC_EMEM_ARB_TIMING_RAS */ + 0x00000003, /* MC_EMEM_ARB_TIMING_FAW */ + 0x00000001, /* MC_EMEM_ARB_TIMING_RRD */ + 0x00000003, /* MC_EMEM_ARB_TIMING_RAP2PRE */ + 0x00000008, /* MC_EMEM_ARB_TIMING_WAP2PRE */ + 0x00000003, /* MC_EMEM_ARB_TIMING_R2R */ + 0x00000002, /* MC_EMEM_ARB_TIMING_W2W */ + 0x00000004, /* MC_EMEM_ARB_TIMING_R2W */ + 0x00000006, /* MC_EMEM_ARB_TIMING_W2R */ + 0x06040203, /* MC_EMEM_ARB_DA_TURNS */ + 0x000a0504, /* MC_EMEM_ARB_DA_COVERS */ + 0x73840a05, /* MC_EMEM_ARB_MISC0 */ + 0x70000f03, /* MC_EMEM_ARB_MISC1 */ + 0x001f0000, /* MC_EMEM_ARB_RING1_THROTTLE */ + }, + { + 0x00000001, /* MC_MLL_MPCORER_PTSA_RATE */ + 0x00000062, /* MC_PTSA_GRANT_DECREMENT */ + 0x00ff006d, /* MC_LATENCY_ALLOWANCE_XUSB_0 */ + 0x00ff006d, /* MC_LATENCY_ALLOWANCE_XUSB_1 */ + 0x00ff003c, /* MC_LATENCY_ALLOWANCE_TSEC_0 */ + 0x00ff00af, /* MC_LATENCY_ALLOWANCE_SDMMCA_0 */ + 0x00ff004f, /* MC_LATENCY_ALLOWANCE_SDMMCAA_0 */ + 0x00ff00af, /* MC_LATENCY_ALLOWANCE_SDMMC_0 */ + 0x00ff004f, /* MC_LATENCY_ALLOWANCE_SDMMCAB_0 */ + 0x004e0049, /* MC_LATENCY_ALLOWANCE_PPCS_0 */ + 0x00ff0080, /* MC_LATENCY_ALLOWANCE_PPCS_1 */ + 0x00ff0004, /* MC_LATENCY_ALLOWANCE_MPCORE_0 */ + 0x00ff0004, /* MC_LATENCY_ALLOWANCE_MPCORELP_0 */ + 0x00080057, /* MC_LATENCY_ALLOWANCE_HC_0 */ + 0x000000ff, /* MC_LATENCY_ALLOWANCE_HC_1 */ + 0x00ff0004, /* MC_LATENCY_ALLOWANCE_AVPC_0 */ + 0x00ff0063, /* MC_LATENCY_ALLOWANCE_GPU_0 */ + 0x00ff0036, /* MC_LATENCY_ALLOWANCE_MSENC_0 */ + 0x00ff0024, /* MC_LATENCY_ALLOWANCE_HDA_0 */ + 0x00ff006b, /* MC_LATENCY_ALLOWANCE_VIC_0 */ + 0x000000ff, /* MC_LATENCY_ALLOWANCE_VI2_0 */ + 0x00000050, /* MC_LATENCY_ALLOWANCE_ISP2_0 */ + 0x00ff00ff, /* MC_LATENCY_ALLOWANCE_ISP2_1 */ + 0x00000050, /* MC_LATENCY_ALLOWANCE_ISP2B_0 */ + 0x00ff00ff, /* MC_LATENCY_ALLOWANCE_ISP2B_1 */ + 0x00d400ff, /* MC_LATENCY_ALLOWANCE_VDE_0 */ + 0x00510050, /* MC_LATENCY_ALLOWANCE_VDE_1 */ + 0x00ff00ff, /* MC_LATENCY_ALLOWANCE_VDE_2 */ + 0x00ff00ff, /* MC_LATENCY_ALLOWANCE_VDE_3 */ + 0x00ff00c6, /* MC_LATENCY_ALLOWANCE_SATA_0 */ + 0x00ff006d, /* MC_LATENCY_ALLOWANCE_AFI_0 */ + }, + 0x00000042, /* EMC_ZCAL_WAIT_CNT after clock change */ + 0x001fffff, /* EMC_AUTO_CAL_INTERVAL */ + 0x00000802, /* EMC_CTT_TERM_CTRL */ + 0x73240000, /* EMC_CFG */ + 0x0000088d, /* EMC_CFG_2 */ + 0x00040000, /* EMC_SEL_DPD_CTRL */ + 0x002c0068, /* EMC_CFG_DIG_DLL */ + 0x00000008, /* EMC_BGBIAS_CTL0 */ + 0x00000000, /* EMC_AUTO_CAL_CONFIG2 */ + 0x00000000, /* EMC_AUTO_CAL_CONFIG3 */ + 0xa1430000, /* EMC_AUTO_CAL_CONFIG */ + 0x80001221, /* Mode Register 0 */ + 0x80100003, /* Mode Register 1 */ + 0x80200008, /* Mode Register 2 */ + 0x00000000, /* Mode Register 4 */ + 3420, /* expected dvfs latency (ns) */ + }, + { + 0x19, /* V5.0.18 */ + "01_600000_01_V5.0.18_V1.1", /* DVFS table version */ + 600000, /* SDRAM frequency */ + 910, /* min voltage */ + 910, /* gpu min voltage */ + "pllc_ud", /* clock source id */ + 0xe0000000, /* CLK_SOURCE_EMC */ + 165, /* number of burst_regs */ + 31, /* number of up_down_regs */ + { + 0x0000001b, /* EMC_RC */ + 0x0000009a, /* EMC_RFC */ + 0x00000000, /* EMC_RFC_SLR */ + 0x00000013, /* EMC_RAS */ + 0x00000007, /* EMC_RP */ + 0x00000007, /* EMC_R2W */ + 0x0000000b, /* EMC_W2R */ + 0x00000003, /* EMC_R2P */ + 0x00000010, /* EMC_W2P */ + 0x00000007, /* EMC_RD_RCD */ + 0x00000007, /* EMC_WR_RCD */ + 0x00000003, /* EMC_RRD */ + 0x00000002, /* EMC_REXT */ + 0x00000000, /* EMC_WEXT */ + 0x00000005, /* EMC_WDV */ + 0x00000005, /* EMC_WDV_MASK */ + 0x0000000a, /* EMC_QUSE */ + 0x00000002, /* EMC_QUSE_WIDTH */ + 0x00000000, /* EMC_IBDLY */ + 0x00000003, /* EMC_EINPUT */ + 0x0000000b, /* EMC_EINPUT_DURATION */ + 0x00070000, /* EMC_PUTERM_EXTRA */ + 0x00000003, /* EMC_PUTERM_WIDTH */ + 0x00000000, /* EMC_PUTERM_ADJ */ + 0x00000000, /* EMC_CDB_CNTL_1 */ + 0x00000000, /* EMC_CDB_CNTL_2 */ + 0x00000000, /* EMC_CDB_CNTL_3 */ + 0x00000002, /* EMC_QRST */ + 0x00000012, /* EMC_QSAFE */ + 0x00000016, /* EMC_RDV */ + 0x00000018, /* EMC_RDV_MASK */ + 0x00001208, /* EMC_REFRESH */ + 0x00000000, /* EMC_BURST_REFRESH_NUM */ + 0x00000482, /* EMC_PRE_REFRESH_REQ_CNT */ + 0x00000002, /* EMC_PDEX2WR */ + 0x0000000d, /* EMC_PDEX2RD */ + 0x00000001, /* EMC_PCHG2PDEN */ + 0x00000000, /* EMC_ACT2PDEN */ + 0x00000096, /* EMC_AR2PDEN */ + 0x00000015, /* EMC_RW2PDEN */ + 0x000000a2, /* EMC_TXSR */ + 0x00000200, /* EMC_TXSRDLL */ + 0x00000004, /* EMC_TCKE */ + 0x00000005, /* EMC_TCKESR */ + 0x00000004, /* EMC_TPD */ + 0x00000013, /* EMC_TFAW */ + 0x00000000, /* EMC_TRPAB */ + 0x00000006, /* EMC_TCLKSTABLE */ + 0x00000006, /* EMC_TCLKSTOP */ + 0x00001248, /* EMC_TREFBW */ + 0x00000000, /* EMC_FBIO_CFG6 */ + 0x00000000, /* EMC_ODT_WRITE */ + 0x00000000, /* EMC_ODT_READ */ + 0x104ab098, /* EMC_FBIO_CFG5 */ + 0xe00e00b1, /* EMC_CFG_DIG_DLL */ + 0x00008000, /* EMC_CFG_DIG_DLL_PERIOD */ + 0x0000000a, /* EMC_DLL_XFORM_DQS0 */ + 0x0000000a, /* EMC_DLL_XFORM_DQS1 */ + 0x0000000a, /* EMC_DLL_XFORM_DQS2 */ + 0x0000000a, /* EMC_DLL_XFORM_DQS3 */ + 0x0000000a, /* EMC_DLL_XFORM_DQS4 */ + 0x0000000a, /* EMC_DLL_XFORM_DQS5 */ + 0x0000000a, /* EMC_DLL_XFORM_DQS6 */ + 0x0000000a, /* EMC_DLL_XFORM_DQS7 */ + 0x0000000a, /* EMC_DLL_XFORM_DQS8 */ + 0x0000000a, /* EMC_DLL_XFORM_DQS9 */ + 0x0000000a, /* EMC_DLL_XFORM_DQS10 */ + 0x0000000a, /* EMC_DLL_XFORM_DQS11 */ + 0x0000000a, /* EMC_DLL_XFORM_DQS12 */ + 0x0000000a, /* EMC_DLL_XFORM_DQS13 */ + 0x0000000a, /* EMC_DLL_XFORM_DQS14 */ + 0x0000000a, /* EMC_DLL_XFORM_DQS15 */ + 0x00000000, /* EMC_DLL_XFORM_QUSE0 */ + 0x00000000, /* EMC_DLL_XFORM_QUSE1 */ + 0x00000000, /* EMC_DLL_XFORM_QUSE2 */ + 0x00000000, /* EMC_DLL_XFORM_QUSE3 */ + 0x00000000, /* EMC_DLL_XFORM_QUSE4 */ + 0x00000000, /* EMC_DLL_XFORM_QUSE5 */ + 0x00000000, /* EMC_DLL_XFORM_QUSE6 */ + 0x00000000, /* EMC_DLL_XFORM_QUSE7 */ + 0x00048000, /* EMC_DLL_XFORM_ADDR0 */ + 0x00048000, /* EMC_DLL_XFORM_ADDR1 */ + 0x00000000, /* EMC_DLL_XFORM_ADDR2 */ + 0x00048000, /* EMC_DLL_XFORM_ADDR3 */ + 0x00048000, /* EMC_DLL_XFORM_ADDR4 */ + 0x00000000, /* EMC_DLL_XFORM_ADDR5 */ + 0x00000000, /* EMC_DLL_XFORM_QUSE8 */ + 0x00000000, /* EMC_DLL_XFORM_QUSE9 */ + 0x00000000, /* EMC_DLL_XFORM_QUSE10 */ + 0x00000000, /* EMC_DLL_XFORM_QUSE11 */ + 0x00000000, /* EMC_DLL_XFORM_QUSE12 */ + 0x00000000, /* EMC_DLL_XFORM_QUSE13 */ + 0x00000000, /* EMC_DLL_XFORM_QUSE14 */ + 0x00000000, /* EMC_DLL_XFORM_QUSE15 */ + 0x00000000, /* EMC_DLI_TRIM_TXDQS0 */ + 0x00000000, /* EMC_DLI_TRIM_TXDQS1 */ + 0x00000000, /* EMC_DLI_TRIM_TXDQS2 */ + 0x00000000, /* EMC_DLI_TRIM_TXDQS3 */ + 0x00000000, /* EMC_DLI_TRIM_TXDQS4 */ + 0x00000000, /* EMC_DLI_TRIM_TXDQS5 */ + 0x00000000, /* EMC_DLI_TRIM_TXDQS6 */ + 0x00000000, /* EMC_DLI_TRIM_TXDQS7 */ + 0x00000000, /* EMC_DLI_TRIM_TXDQS8 */ + 0x00000000, /* EMC_DLI_TRIM_TXDQS9 */ + 0x00000000, /* EMC_DLI_TRIM_TXDQS10 */ + 0x00000000, /* EMC_DLI_TRIM_TXDQS11 */ + 0x00000000, /* EMC_DLI_TRIM_TXDQS12 */ + 0x00000000, /* EMC_DLI_TRIM_TXDQS13 */ + 0x00000000, /* EMC_DLI_TRIM_TXDQS14 */ + 0x00000000, /* EMC_DLI_TRIM_TXDQS15 */ + 0x0000000d, /* EMC_DLL_XFORM_DQ0 */ + 0x0000000d, /* EMC_DLL_XFORM_DQ1 */ + 0x0000000d, /* EMC_DLL_XFORM_DQ2 */ + 0x0000000d, /* EMC_DLL_XFORM_DQ3 */ + 0x0000000d, /* EMC_DLL_XFORM_DQ4 */ + 0x0000000d, /* EMC_DLL_XFORM_DQ5 */ + 0x0000000d, /* EMC_DLL_XFORM_DQ6 */ + 0x0000000d, /* EMC_DLL_XFORM_DQ7 */ + 0x100002a0, /* EMC_XM2CMDPADCTRL */ + 0x00000000, /* EMC_XM2CMDPADCTRL4 */ + 0x00111111, /* EMC_XM2CMDPADCTRL5 */ + 0x0121113d, /* EMC_XM2DQSPADCTRL2 */ + 0x00000000, /* EMC_XM2DQPADCTRL2 */ + 0x00000000, /* EMC_XM2DQPADCTRL3 */ + 0x77ffc085, /* EMC_XM2CLKPADCTRL */ + 0x00000505, /* EMC_XM2CLKPADCTRL2 */ + 0x81f1f108, /* EMC_XM2COMPPADCTRL */ + 0x07070004, /* EMC_XM2VTTGENPADCTRL */ + 0x00000000, /* EMC_XM2VTTGENPADCTRL2 */ + 0x016eeeee, /* EMC_XM2VTTGENPADCTRL3 */ + 0x51451420, /* EMC_XM2DQSPADCTRL3 */ + 0x00514514, /* EMC_XM2DQSPADCTRL4 */ + 0x00514514, /* EMC_XM2DQSPADCTRL5 */ + 0x51451400, /* EMC_XM2DQSPADCTRL6 */ + 0x0606003f, /* EMC_DSR_VTTGEN_DRV */ + 0x00000000, /* EMC_TXDSRVTTGEN */ + 0x00000000, /* EMC_FBIO_SPARE */ + 0x00020000, /* EMC_ZCAL_INTERVAL */ + 0x00000100, /* EMC_ZCAL_WAIT_CNT */ + 0x0128000e, /* EMC_MRS_WAIT_CNT */ + 0x0128000e, /* EMC_MRS_WAIT_CNT2 */ + 0x00000000, /* EMC_CTT */ + 0x00000003, /* EMC_CTT_DURATION */ + 0x000040a0, /* EMC_CFG_PIPE */ + 0x800024aa, /* EMC_DYN_SELF_REF_CONTROL */ + 0x0000000e, /* EMC_QPOP */ + 0x00000009, /* MC_EMEM_ARB_CFG */ + 0x80000040, /* MC_EMEM_ARB_OUTSTANDING_REQ */ + 0x00000003, /* MC_EMEM_ARB_TIMING_RCD */ + 0x00000004, /* MC_EMEM_ARB_TIMING_RP */ + 0x0000000e, /* MC_EMEM_ARB_TIMING_RC */ + 0x00000009, /* MC_EMEM_ARB_TIMING_RAS */ + 0x0000000a, /* MC_EMEM_ARB_TIMING_FAW */ + 0x00000002, /* MC_EMEM_ARB_TIMING_RRD */ + 0x00000003, /* MC_EMEM_ARB_TIMING_RAP2PRE */ + 0x0000000b, /* MC_EMEM_ARB_TIMING_WAP2PRE */ + 0x00000002, /* MC_EMEM_ARB_TIMING_R2R */ + 0x00000002, /* MC_EMEM_ARB_TIMING_W2W */ + 0x00000005, /* MC_EMEM_ARB_TIMING_R2W */ + 0x00000007, /* MC_EMEM_ARB_TIMING_W2R */ + 0x07050202, /* MC_EMEM_ARB_DA_TURNS */ + 0x00130b0e, /* MC_EMEM_ARB_DA_COVERS */ + 0x73a91b0f, /* MC_EMEM_ARB_MISC0 */ + 0x70000f03, /* MC_EMEM_ARB_MISC1 */ + 0x001f0000, /* MC_EMEM_ARB_RING1_THROTTLE */ + }, + { + 0x0000000f, /* MC_MLL_MPCORER_PTSA_RATE */ + 0x00000120, /* MC_PTSA_GRANT_DECREMENT */ + 0x00aa0038, /* MC_LATENCY_ALLOWANCE_XUSB_0 */ + 0x00aa0038, /* MC_LATENCY_ALLOWANCE_XUSB_1 */ + 0x00aa003c, /* MC_LATENCY_ALLOWANCE_TSEC_0 */ + 0x00aa0090, /* MC_LATENCY_ALLOWANCE_SDMMCA_0 */ + 0x00aa0041, /* MC_LATENCY_ALLOWANCE_SDMMCAA_0 */ + 0x00aa0090, /* MC_LATENCY_ALLOWANCE_SDMMC_0 */ + 0x00aa0041, /* MC_LATENCY_ALLOWANCE_SDMMCAB_0 */ + 0x00270049, /* MC_LATENCY_ALLOWANCE_PPCS_0 */ + 0x00aa0080, /* MC_LATENCY_ALLOWANCE_PPCS_1 */ + 0x00aa0004, /* MC_LATENCY_ALLOWANCE_MPCORE_0 */ + 0x00aa0004, /* MC_LATENCY_ALLOWANCE_MPCORELP_0 */ + 0x0008001d, /* MC_LATENCY_ALLOWANCE_HC_0 */ + 0x000000aa, /* MC_LATENCY_ALLOWANCE_HC_1 */ + 0x00aa0004, /* MC_LATENCY_ALLOWANCE_AVPC_0 */ + 0x00aa0022, /* MC_LATENCY_ALLOWANCE_GPU_0 */ + 0x00aa0018, /* MC_LATENCY_ALLOWANCE_MSENC_0 */ + 0x00aa0024, /* MC_LATENCY_ALLOWANCE_HDA_0 */ + 0x00aa0024, /* MC_LATENCY_ALLOWANCE_VIC_0 */ + 0x000000aa, /* MC_LATENCY_ALLOWANCE_VI2_0 */ + 0x00000036, /* MC_LATENCY_ALLOWANCE_ISP2_0 */ + 0x00aa00aa, /* MC_LATENCY_ALLOWANCE_ISP2_1 */ + 0x00000036, /* MC_LATENCY_ALLOWANCE_ISP2B_0 */ + 0x00aa00aa, /* MC_LATENCY_ALLOWANCE_ISP2B_1 */ + 0x00d400ff, /* MC_LATENCY_ALLOWANCE_VDE_0 */ + 0x00510029, /* MC_LATENCY_ALLOWANCE_VDE_1 */ + 0x00aa00aa, /* MC_LATENCY_ALLOWANCE_VDE_2 */ + 0x00aa00aa, /* MC_LATENCY_ALLOWANCE_VDE_3 */ + 0x00aa0065, /* MC_LATENCY_ALLOWANCE_SATA_0 */ + 0x00aa0025, /* MC_LATENCY_ALLOWANCE_AFI_0 */ + }, + 0x00000042, /* EMC_ZCAL_WAIT_CNT after clock change */ + 0x001fffff, /* EMC_AUTO_CAL_INTERVAL */ + 0x00000802, /* EMC_CTT_TERM_CTRL */ + 0x73300000, /* EMC_CFG */ + 0x0000089d, /* EMC_CFG_2 */ + 0x00040000, /* EMC_SEL_DPD_CTRL */ + 0xe00e0069, /* EMC_CFG_DIG_DLL */ + 0x00000000, /* EMC_BGBIAS_CTL0 */ + 0x00000000, /* EMC_AUTO_CAL_CONFIG2 */ + 0x00000000, /* EMC_AUTO_CAL_CONFIG3 */ + 0xa1430000, /* EMC_AUTO_CAL_CONFIG */ + 0x80000b61, /* Mode Register 0 */ + 0x80100002, /* Mode Register 1 */ + 0x80200010, /* Mode Register 2 */ + 0x00000000, /* Mode Register 4 */ + 1440, /* expected dvfs latency (ns) */ + }, + { + 0x19, /* V5.0.18 */ + "01_792000_01_V5.0.18_V1.1", /* DVFS table version */ + 792000, /* SDRAM frequency */ + 980, /* min voltage */ + 980, /* gpu min voltage */ + "pllm_ud", /* clock source id */ + 0x80000000, /* CLK_SOURCE_EMC */ + 165, /* number of burst_regs */ + 31, /* number of up_down_regs */ + { + 0x00000024, /* EMC_RC */ + 0x000000cc, /* EMC_RFC */ + 0x00000000, /* EMC_RFC_SLR */ + 0x00000019, /* EMC_RAS */ + 0x0000000a, /* EMC_RP */ + 0x00000008, /* EMC_R2W */ + 0x0000000d, /* EMC_W2R */ + 0x00000004, /* EMC_R2P */ + 0x00000013, /* EMC_W2P */ + 0x0000000a, /* EMC_RD_RCD */ + 0x0000000a, /* EMC_WR_RCD */ + 0x00000004, /* EMC_RRD */ + 0x00000002, /* EMC_REXT */ + 0x00000000, /* EMC_WEXT */ + 0x00000006, /* EMC_WDV */ + 0x00000006, /* EMC_WDV_MASK */ + 0x0000000b, /* EMC_QUSE */ + 0x00000002, /* EMC_QUSE_WIDTH */ + 0x00000000, /* EMC_IBDLY */ + 0x00000002, /* EMC_EINPUT */ + 0x0000000d, /* EMC_EINPUT_DURATION */ + 0x00080000, /* EMC_PUTERM_EXTRA */ + 0x00000004, /* EMC_PUTERM_WIDTH */ + 0x00000000, /* EMC_PUTERM_ADJ */ + 0x00000000, /* EMC_CDB_CNTL_1 */ + 0x00000000, /* EMC_CDB_CNTL_2 */ + 0x00000000, /* EMC_CDB_CNTL_3 */ + 0x00000001, /* EMC_QRST */ + 0x00000014, /* EMC_QSAFE */ + 0x00000018, /* EMC_RDV */ + 0x0000001a, /* EMC_RDV_MASK */ + 0x000017e2, /* EMC_REFRESH */ + 0x00000000, /* EMC_BURST_REFRESH_NUM */ + 0x000005f8, /* EMC_PRE_REFRESH_REQ_CNT */ + 0x00000003, /* EMC_PDEX2WR */ + 0x00000011, /* EMC_PDEX2RD */ + 0x00000001, /* EMC_PCHG2PDEN */ + 0x00000000, /* EMC_ACT2PDEN */ + 0x000000c6, /* EMC_AR2PDEN */ + 0x00000018, /* EMC_RW2PDEN */ + 0x000000d6, /* EMC_TXSR */ + 0x00000200, /* EMC_TXSRDLL */ + 0x00000005, /* EMC_TCKE */ + 0x00000006, /* EMC_TCKESR */ + 0x00000005, /* EMC_TPD */ + 0x00000019, /* EMC_TFAW */ + 0x00000000, /* EMC_TRPAB */ + 0x00000008, /* EMC_TCLKSTABLE */ + 0x00000008, /* EMC_TCLKSTOP */ + 0x00001822, /* EMC_TREFBW */ + 0x00000000, /* EMC_FBIO_CFG6 */ + 0x00000000, /* EMC_ODT_WRITE */ + 0x00000000, /* EMC_ODT_READ */ + 0x104ab098, /* EMC_FBIO_CFG5 */ + 0xe00700b1, /* EMC_CFG_DIG_DLL */ + 0x00008000, /* EMC_CFG_DIG_DLL_PERIOD */ + 0x007fc008, /* EMC_DLL_XFORM_DQS0 */ + 0x007fc008, /* EMC_DLL_XFORM_DQS1 */ + 0x007fc008, /* EMC_DLL_XFORM_DQS2 */ + 0x007fc008, /* EMC_DLL_XFORM_DQS3 */ + 0x007fc008, /* EMC_DLL_XFORM_DQS4 */ + 0x007fc008, /* EMC_DLL_XFORM_DQS5 */ + 0x007fc008, /* EMC_DLL_XFORM_DQS6 */ + 0x007fc008, /* EMC_DLL_XFORM_DQS7 */ + 0x007fc008, /* EMC_DLL_XFORM_DQS8 */ + 0x007fc008, /* EMC_DLL_XFORM_DQS9 */ + 0x007fc008, /* EMC_DLL_XFORM_DQS10 */ + 0x007fc008, /* EMC_DLL_XFORM_DQS11 */ + 0x007fc008, /* EMC_DLL_XFORM_DQS12 */ + 0x007fc008, /* EMC_DLL_XFORM_DQS13 */ + 0x007fc008, /* EMC_DLL_XFORM_DQS14 */ + 0x007fc008, /* EMC_DLL_XFORM_DQS15 */ + 0x00000000, /* EMC_DLL_XFORM_QUSE0 */ + 0x00000000, /* EMC_DLL_XFORM_QUSE1 */ + 0x00000000, /* EMC_DLL_XFORM_QUSE2 */ + 0x00000000, /* EMC_DLL_XFORM_QUSE3 */ + 0x00000000, /* EMC_DLL_XFORM_QUSE4 */ + 0x00000000, /* EMC_DLL_XFORM_QUSE5 */ + 0x00000000, /* EMC_DLL_XFORM_QUSE6 */ + 0x00000000, /* EMC_DLL_XFORM_QUSE7 */ + 0x00034000, /* EMC_DLL_XFORM_ADDR0 */ + 0x00034000, /* EMC_DLL_XFORM_ADDR1 */ + 0x00000000, /* EMC_DLL_XFORM_ADDR2 */ + 0x00034000, /* EMC_DLL_XFORM_ADDR3 */ + 0x00034000, /* EMC_DLL_XFORM_ADDR4 */ + 0x00000000, /* EMC_DLL_XFORM_ADDR5 */ + 0x00000000, /* EMC_DLL_XFORM_QUSE8 */ + 0x00000000, /* EMC_DLL_XFORM_QUSE9 */ + 0x00000000, /* EMC_DLL_XFORM_QUSE10 */ + 0x00000000, /* EMC_DLL_XFORM_QUSE11 */ + 0x00000000, /* EMC_DLL_XFORM_QUSE12 */ + 0x00000000, /* EMC_DLL_XFORM_QUSE13 */ + 0x00000000, /* EMC_DLL_XFORM_QUSE14 */ + 0x00000000, /* EMC_DLL_XFORM_QUSE15 */ + 0x00000005, /* EMC_DLI_TRIM_TXDQS0 */ + 0x00000005, /* EMC_DLI_TRIM_TXDQS1 */ + 0x00000005, /* EMC_DLI_TRIM_TXDQS2 */ + 0x00000005, /* EMC_DLI_TRIM_TXDQS3 */ + 0x00000005, /* EMC_DLI_TRIM_TXDQS4 */ + 0x00000005, /* EMC_DLI_TRIM_TXDQS5 */ + 0x00000005, /* EMC_DLI_TRIM_TXDQS6 */ + 0x00000005, /* EMC_DLI_TRIM_TXDQS7 */ + 0x00000005, /* EMC_DLI_TRIM_TXDQS8 */ + 0x00000005, /* EMC_DLI_TRIM_TXDQS9 */ + 0x00000005, /* EMC_DLI_TRIM_TXDQS10 */ + 0x00000005, /* EMC_DLI_TRIM_TXDQS11 */ + 0x00000005, /* EMC_DLI_TRIM_TXDQS12 */ + 0x00000005, /* EMC_DLI_TRIM_TXDQS13 */ + 0x00000005, /* EMC_DLI_TRIM_TXDQS14 */ + 0x00000005, /* EMC_DLI_TRIM_TXDQS15 */ + 0x0000000a, /* EMC_DLL_XFORM_DQ0 */ + 0x0000000a, /* EMC_DLL_XFORM_DQ1 */ + 0x0000000a, /* EMC_DLL_XFORM_DQ2 */ + 0x0000000a, /* EMC_DLL_XFORM_DQ3 */ + 0x0000000a, /* EMC_DLL_XFORM_DQ4 */ + 0x0000000a, /* EMC_DLL_XFORM_DQ5 */ + 0x0000000a, /* EMC_DLL_XFORM_DQ6 */ + 0x0000000a, /* EMC_DLL_XFORM_DQ7 */ + 0x100002a0, /* EMC_XM2CMDPADCTRL */ + 0x00000000, /* EMC_XM2CMDPADCTRL4 */ + 0x00111111, /* EMC_XM2CMDPADCTRL5 */ + 0x0120113d, /* EMC_XM2DQSPADCTRL2 */ + 0x00000000, /* EMC_XM2DQPADCTRL2 */ + 0x00000000, /* EMC_XM2DQPADCTRL3 */ + 0x77ffc085, /* EMC_XM2CLKPADCTRL */ + 0x00000000, /* EMC_XM2CLKPADCTRL2 */ + 0x81f1f108, /* EMC_XM2COMPPADCTRL */ + 0x07070004, /* EMC_XM2VTTGENPADCTRL */ + 0x00000000, /* EMC_XM2VTTGENPADCTRL2 */ + 0x016eeeee, /* EMC_XM2VTTGENPADCTRL3 */ + 0x61861820, /* EMC_XM2DQSPADCTRL3 */ + 0x00514514, /* EMC_XM2DQSPADCTRL4 */ + 0x00514514, /* EMC_XM2DQSPADCTRL5 */ + 0x61861800, /* EMC_XM2DQSPADCTRL6 */ + 0x0606003f, /* EMC_DSR_VTTGEN_DRV */ + 0x00000000, /* EMC_TXDSRVTTGEN */ + 0x00000000, /* EMC_FBIO_SPARE */ + 0x00020000, /* EMC_ZCAL_INTERVAL */ + 0x00000100, /* EMC_ZCAL_WAIT_CNT */ + 0x00f8000e, /* EMC_MRS_WAIT_CNT */ + 0x00f8000e, /* EMC_MRS_WAIT_CNT2 */ + 0x00000000, /* EMC_CTT */ + 0x00000004, /* EMC_CTT_DURATION */ + 0x00004080, /* EMC_CFG_PIPE */ + 0x80003012, /* EMC_DYN_SELF_REF_CONTROL */ + 0x0000000f, /* EMC_QPOP */ + 0x0e00000b, /* MC_EMEM_ARB_CFG */ + 0x80000040, /* MC_EMEM_ARB_OUTSTANDING_REQ */ + 0x00000004, /* MC_EMEM_ARB_TIMING_RCD */ + 0x00000005, /* MC_EMEM_ARB_TIMING_RP */ + 0x00000013, /* MC_EMEM_ARB_TIMING_RC */ + 0x0000000c, /* MC_EMEM_ARB_TIMING_RAS */ + 0x0000000d, /* MC_EMEM_ARB_TIMING_FAW */ + 0x00000002, /* MC_EMEM_ARB_TIMING_RRD */ + 0x00000003, /* MC_EMEM_ARB_TIMING_RAP2PRE */ + 0x0000000c, /* MC_EMEM_ARB_TIMING_WAP2PRE */ + 0x00000002, /* MC_EMEM_ARB_TIMING_R2R */ + 0x00000002, /* MC_EMEM_ARB_TIMING_W2W */ + 0x00000006, /* MC_EMEM_ARB_TIMING_R2W */ + 0x00000008, /* MC_EMEM_ARB_TIMING_W2R */ + 0x08060202, /* MC_EMEM_ARB_DA_TURNS */ + 0x00170e13, /* MC_EMEM_ARB_DA_COVERS */ + 0x734c2414, /* MC_EMEM_ARB_MISC0 */ + 0x70000f02, /* MC_EMEM_ARB_MISC1 */ + 0x001f0000, /* MC_EMEM_ARB_RING1_THROTTLE */ + }, + { + 0x00000013, /* MC_MLL_MPCORER_PTSA_RATE */ + 0x0000017c, /* MC_PTSA_GRANT_DECREMENT */ + 0x00810038, /* MC_LATENCY_ALLOWANCE_XUSB_0 */ + 0x00810038, /* MC_LATENCY_ALLOWANCE_XUSB_1 */ + 0x0081003c, /* MC_LATENCY_ALLOWANCE_TSEC_0 */ + 0x00810090, /* MC_LATENCY_ALLOWANCE_SDMMCA_0 */ + 0x00810041, /* MC_LATENCY_ALLOWANCE_SDMMCAA_0 */ + 0x00810090, /* MC_LATENCY_ALLOWANCE_SDMMC_0 */ + 0x00810041, /* MC_LATENCY_ALLOWANCE_SDMMCAB_0 */ + 0x00270049, /* MC_LATENCY_ALLOWANCE_PPCS_0 */ + 0x00810080, /* MC_LATENCY_ALLOWANCE_PPCS_1 */ + 0x00810004, /* MC_LATENCY_ALLOWANCE_MPCORE_0 */ + 0x00810004, /* MC_LATENCY_ALLOWANCE_MPCORELP_0 */ + 0x00080016, /* MC_LATENCY_ALLOWANCE_HC_0 */ + 0x00000081, /* MC_LATENCY_ALLOWANCE_HC_1 */ + 0x00810004, /* MC_LATENCY_ALLOWANCE_AVPC_0 */ + 0x00810019, /* MC_LATENCY_ALLOWANCE_GPU_0 */ + 0x00810018, /* MC_LATENCY_ALLOWANCE_MSENC_0 */ + 0x00810024, /* MC_LATENCY_ALLOWANCE_HDA_0 */ + 0x0081001c, /* MC_LATENCY_ALLOWANCE_VIC_0 */ + 0x00000081, /* MC_LATENCY_ALLOWANCE_VI2_0 */ + 0x00000036, /* MC_LATENCY_ALLOWANCE_ISP2_0 */ + 0x00810081, /* MC_LATENCY_ALLOWANCE_ISP2_1 */ + 0x00000036, /* MC_LATENCY_ALLOWANCE_ISP2B_0 */ + 0x00810081, /* MC_LATENCY_ALLOWANCE_ISP2B_1 */ + 0x00d400ff, /* MC_LATENCY_ALLOWANCE_VDE_0 */ + 0x00510029, /* MC_LATENCY_ALLOWANCE_VDE_1 */ + 0x00810081, /* MC_LATENCY_ALLOWANCE_VDE_2 */ + 0x00810081, /* MC_LATENCY_ALLOWANCE_VDE_3 */ + 0x00810065, /* MC_LATENCY_ALLOWANCE_SATA_0 */ + 0x0081001c, /* MC_LATENCY_ALLOWANCE_AFI_0 */ + }, + 0x00000042, /* EMC_ZCAL_WAIT_CNT after clock change */ + 0x001fffff, /* EMC_AUTO_CAL_INTERVAL */ + 0x00000802, /* EMC_CTT_TERM_CTRL */ + 0x73300000, /* EMC_CFG */ + 0x0000089d, /* EMC_CFG_2 */ + 0x00040000, /* EMC_SEL_DPD_CTRL */ + 0xe0070069, /* EMC_CFG_DIG_DLL */ + 0x00000000, /* EMC_BGBIAS_CTL0 */ + 0x00000000, /* EMC_AUTO_CAL_CONFIG2 */ + 0x00000000, /* EMC_AUTO_CAL_CONFIG3 */ + 0xa1430000, /* EMC_AUTO_CAL_CONFIG */ + 0x80000d71, /* Mode Register 0 */ + 0x80100002, /* Mode Register 1 */ + 0x80200018, /* Mode Register 2 */ + 0x00000000, /* Mode Register 4 */ + 1200, /* expected dvfs latency (ns) */ + }, + { + 0x19, /* V5.0.18 */ + "01_924000_01_V5.0.18_V1.1", /* DVFS table version */ + 924000, /* SDRAM frequency */ + 1010, /* min voltage */ + 1010, /* gpu min voltage */ + "pllm_ud", /* clock source id */ + 0x80000000, /* CLK_SOURCE_EMC */ + 165, /* number of burst_regs */ + 31, /* number of up_down_regs */ + { + 0x0000002b, /* EMC_RC */ + 0x000000ef, /* EMC_RFC */ + 0x00000000, /* EMC_RFC_SLR */ + 0x0000001e, /* EMC_RAS */ + 0x0000000b, /* EMC_RP */ + 0x00000009, /* EMC_R2W */ + 0x0000000f, /* EMC_W2R */ + 0x00000005, /* EMC_R2P */ + 0x00000016, /* EMC_W2P */ + 0x0000000b, /* EMC_RD_RCD */ + 0x0000000b, /* EMC_WR_RCD */ + 0x00000005, /* EMC_RRD */ + 0x00000002, /* EMC_REXT */ + 0x00000000, /* EMC_WEXT */ + 0x00000007, /* EMC_WDV */ + 0x00000007, /* EMC_WDV_MASK */ + 0x0000000d, /* EMC_QUSE */ + 0x00000002, /* EMC_QUSE_WIDTH */ + 0x00000000, /* EMC_IBDLY */ + 0x00000002, /* EMC_EINPUT */ + 0x0000000f, /* EMC_EINPUT_DURATION */ + 0x000a0000, /* EMC_PUTERM_EXTRA */ + 0x00000004, /* EMC_PUTERM_WIDTH */ + 0x00000000, /* EMC_PUTERM_ADJ */ + 0x00000000, /* EMC_CDB_CNTL_1 */ + 0x00000000, /* EMC_CDB_CNTL_2 */ + 0x00000000, /* EMC_CDB_CNTL_3 */ + 0x00000001, /* EMC_QRST */ + 0x00000016, /* EMC_QSAFE */ + 0x0000001a, /* EMC_RDV */ + 0x0000001c, /* EMC_RDV_MASK */ + 0x00001be7, /* EMC_REFRESH */ + 0x00000000, /* EMC_BURST_REFRESH_NUM */ + 0x000006f9, /* EMC_PRE_REFRESH_REQ_CNT */ + 0x00000004, /* EMC_PDEX2WR */ + 0x00000015, /* EMC_PDEX2RD */ + 0x00000001, /* EMC_PCHG2PDEN */ + 0x00000000, /* EMC_ACT2PDEN */ + 0x000000e6, /* EMC_AR2PDEN */ + 0x0000001b, /* EMC_RW2PDEN */ + 0x000000fa, /* EMC_TXSR */ + 0x00000200, /* EMC_TXSRDLL */ + 0x00000006, /* EMC_TCKE */ + 0x00000007, /* EMC_TCKESR */ + 0x00000006, /* EMC_TPD */ + 0x0000001e, /* EMC_TFAW */ + 0x00000000, /* EMC_TRPAB */ + 0x0000000a, /* EMC_TCLKSTABLE */ + 0x0000000a, /* EMC_TCLKSTOP */ + 0x00001c28, /* EMC_TREFBW */ + 0x00000000, /* EMC_FBIO_CFG6 */ + 0x00000000, /* EMC_ODT_WRITE */ + 0x00000000, /* EMC_ODT_READ */ + 0x104ab898, /* EMC_FBIO_CFG5 */ + 0xe00400b1, /* EMC_CFG_DIG_DLL */ + 0x00008000, /* EMC_CFG_DIG_DLL_PERIOD */ + 0x00000006, /* EMC_DLL_XFORM_DQS0 */ + 0x00000006, /* EMC_DLL_XFORM_DQS1 */ + 0x007fc00a, /* EMC_DLL_XFORM_DQS2 */ + 0x00000006, /* EMC_DLL_XFORM_DQS3 */ + 0x00000006, /* EMC_DLL_XFORM_DQS4 */ + 0x00000006, /* EMC_DLL_XFORM_DQS5 */ + 0x00000006, /* EMC_DLL_XFORM_DQS6 */ + 0x00000006, /* EMC_DLL_XFORM_DQS7 */ + 0x00000000, /* EMC_DLL_XFORM_DQS8 */ + 0x00000000, /* EMC_DLL_XFORM_DQS9 */ + 0x00000000, /* EMC_DLL_XFORM_DQS10 */ + 0x00000000, /* EMC_DLL_XFORM_DQS11 */ + 0x00000000, /* EMC_DLL_XFORM_DQS12 */ + 0x00000000, /* EMC_DLL_XFORM_DQS13 */ + 0x00000000, /* EMC_DLL_XFORM_DQS14 */ + 0x00000000, /* EMC_DLL_XFORM_DQS15 */ + 0x00000000, /* EMC_DLL_XFORM_QUSE0 */ + 0x00000000, /* EMC_DLL_XFORM_QUSE1 */ + 0x00000000, /* EMC_DLL_XFORM_QUSE2 */ + 0x00000000, /* EMC_DLL_XFORM_QUSE3 */ + 0x00000000, /* EMC_DLL_XFORM_QUSE4 */ + 0x00000000, /* EMC_DLL_XFORM_QUSE5 */ + 0x00000000, /* EMC_DLL_XFORM_QUSE6 */ + 0x00000000, /* EMC_DLL_XFORM_QUSE7 */ + 0x0002c000, /* EMC_DLL_XFORM_ADDR0 */ + 0x0002c000, /* EMC_DLL_XFORM_ADDR1 */ + 0x00000000, /* EMC_DLL_XFORM_ADDR2 */ + 0x0002c000, /* EMC_DLL_XFORM_ADDR3 */ + 0x0002c000, /* EMC_DLL_XFORM_ADDR4 */ + 0x00000000, /* EMC_DLL_XFORM_ADDR5 */ + 0x00000000, /* EMC_DLL_XFORM_QUSE8 */ + 0x00000000, /* EMC_DLL_XFORM_QUSE9 */ + 0x00000000, /* EMC_DLL_XFORM_QUSE10 */ + 0x00000000, /* EMC_DLL_XFORM_QUSE11 */ + 0x00000000, /* EMC_DLL_XFORM_QUSE12 */ + 0x00000000, /* EMC_DLL_XFORM_QUSE13 */ + 0x00000000, /* EMC_DLL_XFORM_QUSE14 */ + 0x00000000, /* EMC_DLL_XFORM_QUSE15 */ + 0x00000004, /* EMC_DLI_TRIM_TXDQS0 */ + 0x00000004, /* EMC_DLI_TRIM_TXDQS1 */ + 0x00000004, /* EMC_DLI_TRIM_TXDQS2 */ + 0x00000004, /* EMC_DLI_TRIM_TXDQS3 */ + 0x00000004, /* EMC_DLI_TRIM_TXDQS4 */ + 0x00000004, /* EMC_DLI_TRIM_TXDQS5 */ + 0x00000004, /* EMC_DLI_TRIM_TXDQS6 */ + 0x00000004, /* EMC_DLI_TRIM_TXDQS7 */ + 0x00000004, /* EMC_DLI_TRIM_TXDQS8 */ + 0x00000004, /* EMC_DLI_TRIM_TXDQS9 */ + 0x00000004, /* EMC_DLI_TRIM_TXDQS10 */ + 0x00000004, /* EMC_DLI_TRIM_TXDQS11 */ + 0x00000004, /* EMC_DLI_TRIM_TXDQS12 */ + 0x00000004, /* EMC_DLI_TRIM_TXDQS13 */ + 0x00000004, /* EMC_DLI_TRIM_TXDQS14 */ + 0x00000004, /* EMC_DLI_TRIM_TXDQS15 */ + 0x00000008, /* EMC_DLL_XFORM_DQ0 */ + 0x00000008, /* EMC_DLL_XFORM_DQ1 */ + 0x00000008, /* EMC_DLL_XFORM_DQ2 */ + 0x00000008, /* EMC_DLL_XFORM_DQ3 */ + 0x00000008, /* EMC_DLL_XFORM_DQ4 */ + 0x00000008, /* EMC_DLL_XFORM_DQ5 */ + 0x00000008, /* EMC_DLL_XFORM_DQ6 */ + 0x00000008, /* EMC_DLL_XFORM_DQ7 */ + 0x100002a0, /* EMC_XM2CMDPADCTRL */ + 0x00000000, /* EMC_XM2CMDPADCTRL4 */ + 0x00111111, /* EMC_XM2CMDPADCTRL5 */ + 0x0120113d, /* EMC_XM2DQSPADCTRL2 */ + 0x00000000, /* EMC_XM2DQPADCTRL2 */ + 0x00000000, /* EMC_XM2DQPADCTRL3 */ + 0x77ffc085, /* EMC_XM2CLKPADCTRL */ + 0x00000000, /* EMC_XM2CLKPADCTRL2 */ + 0x81f1f108, /* EMC_XM2COMPPADCTRL */ + 0x07070004, /* EMC_XM2VTTGENPADCTRL */ + 0x00000000, /* EMC_XM2VTTGENPADCTRL2 */ + 0x016eeeee, /* EMC_XM2VTTGENPADCTRL3 */ + 0x6db6db20, /* EMC_XM2DQSPADCTRL3 */ + 0x00596596, /* EMC_XM2DQSPADCTRL4 */ + 0x00596596, /* EMC_XM2DQSPADCTRL5 */ + 0x6db6db20, /* EMC_XM2DQSPADCTRL6 */ + 0x0606003f, /* EMC_DSR_VTTGEN_DRV */ + 0x00000000, /* EMC_TXDSRVTTGEN */ + 0x00000000, /* EMC_FBIO_SPARE */ + 0x00020000, /* EMC_ZCAL_INTERVAL */ + 0x00000128, /* EMC_ZCAL_WAIT_CNT */ + 0x00ce000e, /* EMC_MRS_WAIT_CNT */ + 0x00ce000e, /* EMC_MRS_WAIT_CNT2 */ + 0x00000000, /* EMC_CTT */ + 0x00000004, /* EMC_CTT_DURATION */ + 0x00004080, /* EMC_CFG_PIPE */ + 0x800037ea, /* EMC_DYN_SELF_REF_CONTROL */ + 0x00000011, /* EMC_QPOP */ + 0x0e00000d, /* MC_EMEM_ARB_CFG */ + 0x80000040, /* MC_EMEM_ARB_OUTSTANDING_REQ */ + 0x00000005, /* MC_EMEM_ARB_TIMING_RCD */ + 0x00000006, /* MC_EMEM_ARB_TIMING_RP */ + 0x00000016, /* MC_EMEM_ARB_TIMING_RC */ + 0x0000000e, /* MC_EMEM_ARB_TIMING_RAS */ + 0x0000000f, /* MC_EMEM_ARB_TIMING_FAW */ + 0x00000003, /* MC_EMEM_ARB_TIMING_RRD */ + 0x00000004, /* MC_EMEM_ARB_TIMING_RAP2PRE */ + 0x0000000e, /* MC_EMEM_ARB_TIMING_WAP2PRE */ + 0x00000002, /* MC_EMEM_ARB_TIMING_R2R */ + 0x00000002, /* MC_EMEM_ARB_TIMING_W2W */ + 0x00000006, /* MC_EMEM_ARB_TIMING_R2W */ + 0x00000009, /* MC_EMEM_ARB_TIMING_W2R */ + 0x09060202, /* MC_EMEM_ARB_DA_TURNS */ + 0x001a1016, /* MC_EMEM_ARB_DA_COVERS */ + 0x734e2a17, /* MC_EMEM_ARB_MISC0 */ + 0x70000f02, /* MC_EMEM_ARB_MISC1 */ + 0x001f0000, /* MC_EMEM_ARB_RING1_THROTTLE */ + }, + { + 0x00000017, /* MC_MLL_MPCORER_PTSA_RATE */ + 0x000001bb, /* MC_PTSA_GRANT_DECREMENT */ + 0x006e0038, /* MC_LATENCY_ALLOWANCE_XUSB_0 */ + 0x006e0038, /* MC_LATENCY_ALLOWANCE_XUSB_1 */ + 0x006e003c, /* MC_LATENCY_ALLOWANCE_TSEC_0 */ + 0x006e0090, /* MC_LATENCY_ALLOWANCE_SDMMCA_0 */ + 0x006e0041, /* MC_LATENCY_ALLOWANCE_SDMMCAA_0 */ + 0x006e0090, /* MC_LATENCY_ALLOWANCE_SDMMC_0 */ + 0x006e0041, /* MC_LATENCY_ALLOWANCE_SDMMCAB_0 */ + 0x00270049, /* MC_LATENCY_ALLOWANCE_PPCS_0 */ + 0x006e0080, /* MC_LATENCY_ALLOWANCE_PPCS_1 */ + 0x006e0004, /* MC_LATENCY_ALLOWANCE_MPCORE_0 */ + 0x006e0004, /* MC_LATENCY_ALLOWANCE_MPCORELP_0 */ + 0x00080016, /* MC_LATENCY_ALLOWANCE_HC_0 */ + 0x0000006e, /* MC_LATENCY_ALLOWANCE_HC_1 */ + 0x006e0004, /* MC_LATENCY_ALLOWANCE_AVPC_0 */ + 0x006e0019, /* MC_LATENCY_ALLOWANCE_GPU_0 */ + 0x006e0018, /* MC_LATENCY_ALLOWANCE_MSENC_0 */ + 0x006e0024, /* MC_LATENCY_ALLOWANCE_HDA_0 */ + 0x006e001b, /* MC_LATENCY_ALLOWANCE_VIC_0 */ + 0x0000006e, /* MC_LATENCY_ALLOWANCE_VI2_0 */ + 0x00000036, /* MC_LATENCY_ALLOWANCE_ISP2_0 */ + 0x006e006e, /* MC_LATENCY_ALLOWANCE_ISP2_1 */ + 0x00000036, /* MC_LATENCY_ALLOWANCE_ISP2B_0 */ + 0x006e006e, /* MC_LATENCY_ALLOWANCE_ISP2B_1 */ + 0x00d400ff, /* MC_LATENCY_ALLOWANCE_VDE_0 */ + 0x00510029, /* MC_LATENCY_ALLOWANCE_VDE_1 */ + 0x006e006e, /* MC_LATENCY_ALLOWANCE_VDE_2 */ + 0x006e006e, /* MC_LATENCY_ALLOWANCE_VDE_3 */ + 0x006e0065, /* MC_LATENCY_ALLOWANCE_SATA_0 */ + 0x006e001c, /* MC_LATENCY_ALLOWANCE_AFI_0 */ + }, + 0x0000004c, /* EMC_ZCAL_WAIT_CNT after clock change */ + 0x001fffff, /* EMC_AUTO_CAL_INTERVAL */ + 0x00000802, /* EMC_CTT_TERM_CTRL */ + 0x73300000, /* EMC_CFG */ + 0x0000089d, /* EMC_CFG_2 */ + 0x00040000, /* EMC_SEL_DPD_CTRL */ + 0xe0040069, /* EMC_CFG_DIG_DLL */ + 0x00000000, /* EMC_BGBIAS_CTL0 */ + 0x00000000, /* EMC_AUTO_CAL_CONFIG2 */ + 0x00000000, /* EMC_AUTO_CAL_CONFIG3 */ + 0xa1430303, /* EMC_AUTO_CAL_CONFIG */ + 0x80000f15, /* Mode Register 0 */ + 0x80100002, /* Mode Register 1 */ + 0x80200020, /* Mode Register 2 */ + 0x00000000, /* Mode Register 4 */ + 1180, /* expected dvfs latency (ns) */ + }, +}; static struct tegra12_emc_table pm375_ddr3_emc_table[] = { { @@ -29257,10 +32893,20 @@ int __init ardbeg_emc_init(void) = jetson_tk1_ddr3_H5TC4G63CFR_emc_table; jetson_tk1_2GB_emc_pdata.num_tables = ARRAY_SIZE(jetson_tk1_ddr3_H5TC4G63CFR_emc_table); + } else if (tegra_bct_strapping == 1) { + jetson_tk1_2GB_embedded_emc_pdata.tables + = jetson_tk1_ddr3_K4B4G1646D_BFMA03_embedded_emc_table; + jetson_tk1_2GB_embedded_emc_pdata.num_tables + = ARRAY_SIZE(jetson_tk1_ddr3_K4B4G1646D_BFMA03_embedded_emc_table); + jetson_tk1_2GB_emc_pdata.tables + = jetson_tk1_ddr3_K4B4G1646D_BFMA03_emc_table; + jetson_tk1_2GB_emc_pdata.num_tables + = ARRAY_SIZE(jetson_tk1_ddr3_K4B4G1646D_BFMA03_emc_table); } else { pr_info("Wrong Strapping value\n"); return -EINVAL; } + if (soc_speedo_id == 4) { pr_info("Loading jetson TK1 EMC Embedded tables.\n"); tegra_emc_device.dev.platform_data = -- cgit v1.2.3 From 5cbb7a316b9c0d530f2d64f98946ce064d075857 Mon Sep 17 00:00:00 2001 From: Gagan Grover Date: Tue, 22 Nov 2016 15:01:11 +0530 Subject: video: tegra: nvmap: fix possible use after free Fix possible use after free issue. Bug 1814555 Bug 1884319 Change-Id: I826aa34f61d43fda5419a528697ce84ba2ce1eae Reviewed-on: http://git-master/r/1221643 Signed-off-by: Gagan Grover Signed-off-by: Debarshi Dutta Reviewed-on: http://git-master/r/1257999 (cherry picked from commit b1647da33cff0c498ca8439a722ea1962ecf6901 in rel-24) Reviewed-on: http://git-master/r/1461184 GVS: Gerrit_Virtual_Submit Reviewed-by: Bibek Basu Tested-by: Bibek Basu --- drivers/video/tegra/nvmap/nvmap_ioctl.c | 20 +------------------- 1 file changed, 1 insertion(+), 19 deletions(-) diff --git a/drivers/video/tegra/nvmap/nvmap_ioctl.c b/drivers/video/tegra/nvmap/nvmap_ioctl.c index 7e59d245069f..27db8f6799af 100644 --- a/drivers/video/tegra/nvmap/nvmap_ioctl.c +++ b/drivers/video/tegra/nvmap/nvmap_ioctl.c @@ -309,24 +309,6 @@ int nvmap_ioctl_alloc_kind(struct file *filp, void __user *arg) return err; } -int nvmap_create_fd(struct nvmap_client *client, struct nvmap_handle *h) -{ - int fd; - - fd = __nvmap_dmabuf_fd(client, h->dmabuf, O_CLOEXEC); - BUG_ON(fd == 0); - if (fd < 0) { - pr_err("Out of file descriptors"); - return fd; - } - /* __nvmap_dmabuf_fd() associates fd with dma_buf->file *. - * fd close drops one ref count on dmabuf->file *. - * to balance ref count, ref count dma_buf. - */ - get_dma_buf(h->dmabuf); - return fd; -} - int nvmap_ioctl_create(struct file *filp, unsigned int cmd, void __user *arg) { struct nvmap_create_handle op; @@ -354,7 +336,7 @@ int nvmap_ioctl_create(struct file *filp, unsigned int cmd, void __user *arg) if (IS_ERR(ref)) return PTR_ERR(ref); - fd = nvmap_create_fd(client, ref->handle); + fd = nvmap_get_dmabuf_fd(client, ref->handle); if (fd < 0) err = fd; -- cgit v1.2.3 From b05568ec3820faf539b307deb4ae8ac036994cf5 Mon Sep 17 00:00:00 2001 From: Arto Merilainen Date: Tue, 14 Oct 2014 10:12:26 +0300 Subject: video: tegra: host: Protect channel ioctl Channel ioctl interface is not multithreading safe and as the common case is that we have only a single active user for an open fd, add a mutex to force serialization of ioctl calls. Bug 1830021 Change-Id: Ifa6595a105b913345104f216f0541c371e89efe5 (cherry picked from commit 7b24caa9a8d2ab08fe0c7be112e805e44906d956) Signed-off-by: Gagan Grover Reviewed-on: http://git-master/r/1248801 Reviewed-by: Bibek Basu Reviewed-by: Automatic_Commit_Validation_User GVS: Gerrit_Virtual_Submit --- drivers/video/tegra/host/bus_client.c | 58 ++++++++++++++++++++++++++--------- 1 file changed, 43 insertions(+), 15 deletions(-) diff --git a/drivers/video/tegra/host/bus_client.c b/drivers/video/tegra/host/bus_client.c index ee21c80e6871..4a5e2f558451 100644 --- a/drivers/video/tegra/host/bus_client.c +++ b/drivers/video/tegra/host/bus_client.c @@ -173,6 +173,9 @@ struct nvhost_channel_userctx { u32 priority; int clientid; bool timeout_debug_dump; + + /* lock to protect this structure from concurrent ioctl usage */ + struct mutex ioctl_lock; }; static int nvhost_channelrelease(struct inode *inode, struct file *filp) @@ -276,6 +279,7 @@ static int __nvhost_channelopen(struct inode *inode, pdata = dev_get_drvdata(ch->dev->dev.parent); priv->timeout = pdata->nvhost_timeout_default; priv->timeout_debug_dump = true; + mutex_init(&priv->ioctl_lock); if (!tegra_platform_is_silicon()) priv->timeout = 0; mutex_unlock(&channel_lock); @@ -752,8 +756,12 @@ static long nvhost_channelctl(struct file *filp, return -EFAULT; } + /* serialize calls from this fd */ + mutex_lock(&priv->ioctl_lock); + if (!priv->ch->dev) { pr_warn("Channel already unmapped\n"); + mutex_unlock(&priv->ioctl_lock); return -EFAULT; } @@ -811,8 +819,12 @@ static long nvhost_channelctl(struct file *filp, platform_get_drvdata(priv->ch->dev); struct nvhost_get_param_arg *arg = (struct nvhost_get_param_arg *)buf; - if (arg->param >= NVHOST_MODULE_MAX_SYNCPTS) - return -EINVAL; + + if (arg->param >= NVHOST_MODULE_MAX_SYNCPTS) { + err = -EINVAL; + break; + } + /* if we already have required syncpt then return it ... */ if (pdata->syncpts[arg->param]) { arg->value = pdata->syncpts[arg->param]; @@ -821,8 +833,10 @@ static long nvhost_channelctl(struct file *filp, /* ... otherwise get a new syncpt dynamically */ arg->value = nvhost_get_syncpt_host_managed(pdata->pdev, arg->param); - if (!arg->value) - return -EAGAIN; + if (!arg->value) { + err = -EAGAIN; + break; + } /* ... and store it for further references */ pdata->syncpts[arg->param] = arg->value; break; @@ -840,8 +854,10 @@ static long nvhost_channelctl(struct file *filp, if (args_name) { if (strncpy_from_user(name, args_name, - sizeof(name)) < 0) - return -EFAULT; + sizeof(name)) < 0) { + err = -EFAULT; + break; + } name[sizeof(name) - 1] = '\0'; } else { name[0] = '\0'; @@ -855,8 +871,10 @@ static long nvhost_channelctl(struct file *filp, snprintf(set_name, sizeof(set_name), "%s_%s", dev_name(&pdata->pdev->dev), name); args->value = nvhost_get_syncpt_client_managed(set_name); - if (!args->value) - return -EAGAIN; + if (!args->value) { + err = -EAGAIN; + break; + } /* ... and store it for further references */ pdata->client_managed_syncpt = args->value; break; @@ -869,8 +887,10 @@ static long nvhost_channelctl(struct file *filp, platform_get_drvdata(priv->ch->dev); if (!args->value) break; - if (args->value != pdata->client_managed_syncpt) - return -EINVAL; + if (args->value != pdata->client_managed_syncpt) { + err = -EINVAL; + break; + } nvhost_free_syncpt(args->value); pdata->client_managed_syncpt = 0; break; @@ -891,8 +911,10 @@ static long nvhost_channelctl(struct file *filp, struct nvhost_get_param_arg *arg = (struct nvhost_get_param_arg *)buf; if (arg->param >= NVHOST_MODULE_MAX_WAITBASES - || !pdata->waitbases[arg->param]) - return -EINVAL; + || !pdata->waitbases[arg->param]) { + err = -EINVAL; + break; + } arg->value = pdata->waitbases[arg->param]; break; } @@ -911,9 +933,13 @@ static long nvhost_channelctl(struct file *filp, platform_get_drvdata(priv->ch->dev); struct nvhost_get_param_arg *arg = (struct nvhost_get_param_arg *)buf; - if (arg->param >= NVHOST_MODULE_MAX_MODMUTEXES - || !pdata->modulemutexes[arg->param]) - return -EINVAL; + + if (arg->param >= NVHOST_MODULE_MAX_MODMUTEXES || + !pdata->modulemutexes[arg->param]) { + err = -EINVAL; + break; + } + arg->value = pdata->modulemutexes[arg->param]; break; } @@ -1032,6 +1058,8 @@ static long nvhost_channelctl(struct file *filp, break; } + mutex_unlock(&priv->ioctl_lock); + if ((err == 0) && (_IOC_DIR(cmd) & _IOC_READ)) err = copy_to_user((void __user *)arg, buf, _IOC_SIZE(cmd)); -- cgit v1.2.3 From c9c824bfb712f5104bbbb2f32a771a6c92493581 Mon Sep 17 00:00:00 2001 From: Bibek Basu Date: Mon, 17 Apr 2017 22:14:53 +0530 Subject: arm: tegra: curtain pllx freq to its max value This patch fixes pllx max value to 1530 and 1836Mhz based on embedded clok settings considering aging factor for CD575MI 24x7 and CD575MI 4/4/16 config Bug 1900076 Change-Id: I9c6a769787fc04eac7ce4548e1a37a9a76972a6c Signed-off-by: Bibek Basu Reviewed-on: http://git-master/r/1464315 GVS: Gerrit_Virtual_Submit Reviewed-by: Peter Chiang --- arch/arm/mach-tegra/tegra12_dvfs.c | 22 +++++++++++----------- 1 file changed, 11 insertions(+), 11 deletions(-) diff --git a/arch/arm/mach-tegra/tegra12_dvfs.c b/arch/arm/mach-tegra/tegra12_dvfs.c index 08bcbc806e27..2fd347b08b1f 100755 --- a/arch/arm/mach-tegra/tegra12_dvfs.c +++ b/arch/arm/mach-tegra/tegra12_dvfs.c @@ -275,10 +275,10 @@ static struct cpu_cvb_dvfs cpu_cvb_dvfs_table[] = { {1326000, {1492657, -26655, 062}, {1100000, 0, 0}}, {1428000, {1532591, -27195, 062}, {1100000, 0, 0}}, {1530000, {1573433, -27735, 062}, {1100000, 0, 0}}, - {1632000, {1615182, -28285, 062}, {1100000, 0, 0}}, - {1734000, {1657839, -28825, 062}, {1100000, 0, 0}}, - {1810500, {1690214, -29225, 062}, {1150000, 0, 0}}, - {1912500, {2244137, -64355, 613}, {1150000, 0, 0}}, + {1632000, {1615182, -28285, 062}, {1250000, 0, 0}}, + {1734000, {1657839, -28825, 062}, {1250000, 0, 0}}, + {1810500, {1690214, -29225, 062}, {1250000, 0, 0}}, + {1912500, {2244137, -64355, 613}, {1250000, 0, 0}}, { 0 , { 0, 0, 0}, {}}, }, /* @@ -319,13 +319,13 @@ static struct cpu_cvb_dvfs cpu_cvb_dvfs_table[] = { {1326000, {1492657, -26655, 062}, {1100000, 0, 0}}, {1428000, {1532591, -27195, 062}, {1100000, 0, 0}}, {1530000, {1573433, -27735, 062}, {1100000, 0, 0}}, - {1632000, {1615182, -28285, 062}, {1100000, 0, 0}}, - {1734000, {1657839, -28825, 062}, {1100000, 0, 0}}, - {1836000, {1701404, -29365, 062}, {1100000, 0, 0}}, - {1861500, {1711220, -29495, 062}, {1180000, 0, 0}}, - {1887000, {1723527, -29635, 062}, {1180000, 0, 0}}, - {1938000, {1745877, -29900, 062}, {1220000, 0, 0}}, - {2014500, {2342215, -66500, 613}, {1220000, 0, 0}}, + {1632000, {1615182, -28285, 062}, {1130000, 0, 0}}, + {1734000, {1657839, -28825, 062}, {1130000, 0, 0}}, + {1836000, {1701404, -29365, 062}, {1210000, 0, 0}}, + {1861500, {1711220, -29495, 062}, {1300000, 0, 0}}, + {1887000, {1723527, -29635, 062}, {1300000, 0, 0}}, + {1938000, {1745877, -29900, 062}, {1300000, 0, 0}}, + {2014500, {2342215, -66500, 613}, {1300000, 0, 0}}, { 0 , { 0, 0, 0}, {}}, }, /* -- cgit v1.2.3 From 988a3d056cd599a4f3e18d3b589303efd33fb13a Mon Sep 17 00:00:00 2001 From: Xia Yang Date: Wed, 14 Sep 2016 11:13:57 -0700 Subject: gpu: nvgpu: add ptr validation for vm_map_buffer dma_buf_get() return value is now validated before passed down for further process. Bug 1812180 Bug 1883864 Change-Id: I443d676af2948c924f187988ab1c64c72b3e9232 Signed-off-by: Xia Yang Reviewed-on: http://git-master/r/1220869 (cherry picked from commit e6fe9437c609252cf28ac76d2e6b33e905eaa843 in rel-21) Signed-off-by: Debarshi Dutta Change-Id: I443d676af2948c924f187988ab1c64c72b3e9232 Reviewed-on: http://git-master/r/1469135 Reviewed-by: Automatic_Commit_Validation_User GVS: Gerrit_Virtual_Submit Reviewed-by: Bibek Basu --- drivers/gpu/nvgpu/gk20a/mm_gk20a.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/drivers/gpu/nvgpu/gk20a/mm_gk20a.c b/drivers/gpu/nvgpu/gk20a/mm_gk20a.c index f5e7767e7f11..12f3c092c0cb 100644 --- a/drivers/gpu/nvgpu/gk20a/mm_gk20a.c +++ b/drivers/gpu/nvgpu/gk20a/mm_gk20a.c @@ -3,7 +3,7 @@ * * GK20A memory management * - * Copyright (c) 2011-2014, NVIDIA CORPORATION. All rights reserved. + * Copyright (c) 2011-2017, NVIDIA CORPORATION. All rights reserved. * * This program is free software; you can redistribute it and/or modify it * under the terms and conditions of the GNU General Public License, @@ -2489,6 +2489,9 @@ int gk20a_vm_map_buffer(struct gk20a_as_share *as_share, /* get ref to the mem handle (released on unmap_locked) */ dmabuf = dma_buf_get(dmabuf_fd); + if (IS_ERR(dmabuf)) + return PTR_ERR(dmabuf); + if (!dmabuf) return 0; -- cgit v1.2.3 From 6a07aed9992e4e9f2008728209b83a38b5ae60c8 Mon Sep 17 00:00:00 2001 From: Shreshtha SAHU Date: Thu, 1 Dec 2016 00:08:01 +0530 Subject: BACKPORT: drm: crtc: integer overflow in drm_property_create_blob() The size here comes from the user via the ioctl, it is a number between 1-u32max so the addition here could overflow on 32 bit systems. This patch fixes a security vulnerability reported here: https://code.google.com/p/android/issues/detail?id=228947 Change-Id: I17ed8c6e30826074cfc6dd833deb423be9bd89c5 Fixes: f453ba046074 ('DRM: add mode setting support') Signed-off-by: Dan Carpenter Reviewed-by: Daniel Stone Cc: stable@kernel.org # v4.2 Signed-off-by: Dave Airlie Bug 1846814 Signed-off-by: Shreshtha SAHU Change-Id: I308e65797972a0a0650bd96bd130dfd2fbe9c993 Reviewed-on: http://git-master/r/1262503 GVS: Gerrit_Virtual_Submit Reviewed-by: Bibek Basu --- drivers/gpu/drm/drm_crtc.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/drivers/gpu/drm/drm_crtc.c b/drivers/gpu/drm/drm_crtc.c index 8759d699bd8e..d8fcc80ecee6 100644 --- a/drivers/gpu/drm/drm_crtc.c +++ b/drivers/gpu/drm/drm_crtc.c @@ -2956,8 +2956,8 @@ static struct drm_property_blob *drm_property_create_blob(struct drm_device *dev struct drm_property_blob *blob; int ret; - if (!length || !data) - return NULL; + if (!length || !data || length > ULONG_MAX - sizeof(struct drm_property_blob)) + return ERR_PTR(-EINVAL); blob = kzalloc(sizeof(struct drm_property_blob)+length, GFP_KERNEL); if (!blob) -- cgit v1.2.3 From 584a7d4adf7b5a03d340e54094ce90d0584d59b7 Mon Sep 17 00:00:00 2001 From: Mikko Perttunen Date: Tue, 25 Oct 2016 12:31:15 +0300 Subject: video: tegra: host: Add submit checks Currently nvhost performs minimal checking for submits it passes to hardware: The kernel does not check if job syncpoints are allocated and the gather classes are not verified currently. This patch adds checks for syncpoint ids and gather classes. Adapted from 0abcbd69c4cbd0093e223b6c248fdd53c2886951. Bug 1831406 Change-Id: Ifb9d2090009d16d0f56bc11546036167c7f72228 Signed-off-by: Mikko Perttunen Reviewed-on: http://git-master/r/1242190 Reviewed-by: Winnie Hsu Tested-by: Winnie Hsu --- drivers/video/tegra/host/bus_client.c | 24 +++++++++++++++++++++++- 1 file changed, 23 insertions(+), 1 deletion(-) diff --git a/drivers/video/tegra/host/bus_client.c b/drivers/video/tegra/host/bus_client.c index 4a5e2f558451..eabb09f1a683 100644 --- a/drivers/video/tegra/host/bus_client.c +++ b/drivers/video/tegra/host/bus_client.c @@ -398,6 +398,7 @@ static int nvhost_ioctl_channel_submit(struct nvhost_channel_userctx *ctx, u32 __user *waitbases = (u32 *)(uintptr_t)args->waitbases; u32 __user *fences = (u32 *)(uintptr_t)args->fences; u32 __user *class_ids = (u32 *)(uintptr_t)args->class_ids; + struct nvhost_device_data *pdata = platform_get_drvdata(ctx->ch->dev); struct nvhost_master *host = nvhost_get_host(ctx->ch->dev); u32 *local_waitbases = NULL, *local_class_ids = NULL; @@ -457,6 +458,13 @@ static int nvhost_ioctl_channel_submit(struct nvhost_channel_userctx *ctx, if (err) cmdbuf_ext.pre_fence = -1; + if (class_id && + class_id != pdata->class && + class_id != NV_HOST1X_CLASS_ID) { + err = -EINVAL; + goto fail; + } + nvhost_job_add_gather(job, cmdbuf.mem, cmdbuf.words, cmdbuf.offset, class_id, cmdbuf_ext.pre_fence); @@ -512,6 +520,8 @@ static int nvhost_ioctl_channel_submit(struct nvhost_channel_userctx *ctx, for (i = 0; i < num_syncpt_incrs; ++i) { u32 waitbase; struct nvhost_syncpt_incr sp; + bool found = false; + int j; /* Copy */ err = copy_from_user(&sp, syncpt_incrs + i, sizeof(sp)); @@ -519,7 +529,19 @@ static int nvhost_ioctl_channel_submit(struct nvhost_channel_userctx *ctx, goto fail; /* Validate */ - if (sp.syncpt_id >= host->info.nb_pts) { + if (sp.syncpt_id == 0) { + err = -EINVAL; + goto fail; + } + + for (j = 0; j < NVHOST_MODULE_MAX_SYNCPTS; ++j) { + if (pdata->syncpts[j] == sp.syncpt_id) { + found = true; + break; + } + } + + if (!found) { err = -EINVAL; goto fail; } -- cgit v1.2.3 From c15231b2c2b5799645d599310421d1d6c46b395b Mon Sep 17 00:00:00 2001 From: Konduri Praveen Date: Thu, 4 May 2017 01:18:50 +0530 Subject: tegra-cryptodev: type modifier change in plaintext_sz change the type modifier from signed to unsigned for plaintext_sz variable in tegra_sha_req structure to avoid occurence of negative values in plaintext_sz variable. Bug 1883640 Change-Id: I853f1916f7d4b6ea901cfe83419d624720a7e64f Signed-off-by: Konduri Praveen Reviewed-on: http://git-master/r/1474814 GVS: Gerrit_Virtual_Submit Reviewed-by: Mallikarjun Kasoju Reviewed-by: Bibek Basu --- drivers/misc/tegra-cryptodev.h | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/drivers/misc/tegra-cryptodev.h b/drivers/misc/tegra-cryptodev.h index e3ee4cacfb79..de89516fe6fc 100644 --- a/drivers/misc/tegra-cryptodev.h +++ b/drivers/misc/tegra-cryptodev.h @@ -146,7 +146,7 @@ struct tegra_sha_req { unsigned char *algo; unsigned char *plaintext; unsigned char *result; - int plaintext_sz; + unsigned int plaintext_sz; }; #define TEGRA_CRYPTO_IOCTL_GET_SHA \ _IOWR(0x98, 104, struct tegra_sha_req) @@ -154,11 +154,11 @@ struct tegra_sha_req { #ifdef CONFIG_COMPAT struct tegra_sha_req_32 { char key[TEGRA_CRYPTO_MAX_KEY_SIZE]; - unsigned int keylen; + __u32 keylen; __u32 algo; __u32 plaintext; __u32 result; - int plaintext_sz; + __u32 plaintext_sz; }; #define TEGRA_CRYPTO_IOCTL_GET_SHA_32 \ _IOWR(0x98, 104, struct tegra_sha_req_32) -- cgit v1.2.3 From 651cce8f33cff889007ca563cdcff98abe3a5e90 Mon Sep 17 00:00:00 2001 From: Greg Hackmann Date: Fri, 19 Feb 2016 13:33:31 -0800 Subject: media: tegra: camera: sanity-check ioctl parameter Several places in the camera stack can hit integer overflows or cause bad allocations if userspace passes in a bogus sizeofvalue parameter. Protect against this by using appropriately-sized integer types, adding range checks, replacing array-allocation calls with kcalloc(), and checking for allocations returning ZERO_SIZE_PTR. For one specific ioctl (PCLLK_IOCTL_UPDATE) sizeofvalue = 0 is fine, since when that happens the subdrivers won't actually touch the returned allocation. In fact the existing userspace camera driver makes calls like these and expects them to succeed! Handle this special case by adding a __camera_get_params variant that optionally treats zero-sized inputs as valid. (back ported from Nexus N9 project) Bug 1832830 Change-Id: Ie3250d8a4b814de5820fa0190b4cbd1af3ca4b3f Reported-by: Jianqiang Zhao Signed-off-by: Greg Hackmann Reviewed-on: http://git-master/r/1271367 Reviewed-by: Automatic_Commit_Validation_User GVS: Gerrit_Virtual_Submit Reviewed-by: Frank Chen Tested-by: Frank Chen Reviewed-by: Jihoon Bang Reviewed-by: Winnie Hsu --- drivers/media/platform/tegra/cam_dev/imx135.c | 6 +++--- drivers/media/platform/tegra/cam_dev/of_camera.c | 4 ++-- drivers/media/platform/tegra/cam_dev/virtual.c | 4 ++-- drivers/media/platform/tegra/camera.c | 22 ++++++++++++++-------- include/media/camera.h | 12 +++++++++--- 5 files changed, 30 insertions(+), 18 deletions(-) diff --git a/drivers/media/platform/tegra/cam_dev/imx135.c b/drivers/media/platform/tegra/cam_dev/imx135.c index eaa085637aa4..7dd3e9bd61be 100644 --- a/drivers/media/platform/tegra/cam_dev/imx135.c +++ b/drivers/media/platform/tegra/cam_dev/imx135.c @@ -4,7 +4,7 @@ * the virtual PCL driver to handle some special features (hardware resources, * sequences, etc.). * - * Copyright (c) 2013, NVIDIA CORPORATION. All rights reserved. + * Copyright (c) 2013-2016, NVIDIA CORPORATION. All rights reserved. * * This program is free software; you can redistribute it and/or modify it * under the terms and conditions of the GNU General Public License, @@ -42,11 +42,11 @@ struct imx135_info { }; static int imx135_update( - struct camera_device *cdev, struct cam_update *upd, int num) + struct camera_device *cdev, struct cam_update *upd, u32 num) { /* struct imx135_info *info = dev_get_drvdata(cdev->dev); */ int err = 0; - int idx; + u32 idx; dev_dbg(cdev->dev, "%s %d\n", __func__, num); mutex_lock(&cdev->mutex); diff --git a/drivers/media/platform/tegra/cam_dev/of_camera.c b/drivers/media/platform/tegra/cam_dev/of_camera.c index 460ca1a844e8..f293b9a27cd0 100644 --- a/drivers/media/platform/tegra/cam_dev/of_camera.c +++ b/drivers/media/platform/tegra/cam_dev/of_camera.c @@ -1,7 +1,7 @@ /* * debugfs.c * - * Copyright (c) 2013-2014, NVIDIA CORPORATION. All rights reserved. + * Copyright (c) 2013-2016, NVIDIA CORPORATION. All rights reserved. * This program is free software; you can redistribute it and/or modify it * under the terms and conditions of the GNU General Public License, @@ -222,7 +222,7 @@ int of_camera_get_property(struct camera_info *cam, unsigned long arg) } /* sanity check */ - if (!param.sizeofvalue) { + if (!param.sizeofvalue || param.sizeofvalue > INT_MAX) { dev_err(cam->dev, "%s invalid property name length %d\n", __func__, param.sizeofvalue); return -EBADF; diff --git a/drivers/media/platform/tegra/cam_dev/virtual.c b/drivers/media/platform/tegra/cam_dev/virtual.c index f08ad1563a73..d25becc1ec24 100644 --- a/drivers/media/platform/tegra/cam_dev/virtual.c +++ b/drivers/media/platform/tegra/cam_dev/virtual.c @@ -41,10 +41,10 @@ struct chip_config { }; static int virtual_update( - struct camera_device *cdev, struct cam_update *upd, int num) + struct camera_device *cdev, struct cam_update *upd, u32 num) { int err = 0; - int idx; + u32 idx; dev_dbg(cdev->dev, "%s %d\n", __func__, num); mutex_lock(&cdev->mutex); diff --git a/drivers/media/platform/tegra/camera.c b/drivers/media/platform/tegra/camera.c index 2542f4210de6..f54a3c01d38d 100644 --- a/drivers/media/platform/tegra/camera.c +++ b/drivers/media/platform/tegra/camera.c @@ -1,7 +1,7 @@ /* * camera.c - generic camera device driver * - * Copyright (c) 2013-2014, NVIDIA CORPORATION. All rights reserved. + * Copyright (c) 2013-2016, NVIDIA CORPORATION. All rights reserved. * * Contributors: * Charlie Huang @@ -131,12 +131,12 @@ int camera_copy_user_params(unsigned long arg, struct nvc_param *prm) } #endif -int camera_get_params( +int __camera_get_params( struct camera_info *cam, unsigned long arg, int u_size, - struct nvc_param *prm, void **data) + struct nvc_param *prm, void **data, bool zero_size_ok) { void *buf; - unsigned size; + size_t size; #ifdef CONFIG_COMPAT memset(prm, 0, sizeof(*prm)); @@ -156,9 +156,14 @@ int camera_get_params( if (!data) return 0; + if (zero_size_ok && prm->sizeofvalue == 0) { + *data = ZERO_SIZE_PTR; + return 0; + } + size = prm->sizeofvalue * u_size; - buf = kzalloc(size, GFP_KERNEL); - if (!buf) { + buf = kcalloc(prm->sizeofvalue, u_size, GFP_KERNEL); + if (ZERO_OR_NULL_PTR(buf)) { dev_err(cam->dev, "%s allocate memory failed!\n", __func__); return -ENOMEM; } @@ -231,7 +236,7 @@ static int camera_seq_wr(struct camera_info *cam, unsigned long arg) } p_i2c_table = devm_kzalloc(cdev->dev, params.sizeofvalue, GFP_KERNEL); - if (p_i2c_table == NULL) { + if (ZERO_OR_NULL_PTR(p_i2c_table)) { dev_err(cam->dev, "%s devm_kzalloc err line %d\n", __func__, __LINE__); return -ENOMEM; @@ -586,7 +591,8 @@ static int camera_update(struct camera_info *cam, unsigned long arg) return err; } - err = camera_get_params(cam, arg, sizeof(*upd), ¶m, (void **)&upd); + err = __camera_get_params(cam, arg, sizeof(*upd), ¶m, (void **)&upd, + true); if (err) return err; diff --git a/include/media/camera.h b/include/media/camera.h index 5cbac56de269..7528b9acede8 100644 --- a/include/media/camera.h +++ b/include/media/camera.h @@ -337,7 +337,7 @@ struct camera_chip { int (*power_off)(struct camera_device *cdev); int (*shutdown)(struct camera_device *cdev); int (*update)(struct camera_device *cdev, - struct cam_update *upd, int num); + struct cam_update *upd, u32 num); }; struct camera_sync_dev { @@ -386,8 +386,14 @@ struct camera_platform_info { }; /* common functions */ -int camera_get_params( - struct camera_info *, unsigned long, int, struct nvc_param *, void **); +int __camera_get_params( + struct camera_info *, unsigned long, int, struct nvc_param *, void **, + bool); +static inline int camera_get_params(struct camera_info *cam, unsigned long arg, + int u_size, struct nvc_param *prm, void **data) +{ + return __camera_get_params(cam, arg, u_size, prm, data, false); +} int camera_copy_user_params(unsigned long, struct nvc_param *); int virtual_device_add(struct device *, unsigned long); -- cgit v1.2.3 From 36d071c93e79a3b340aa76c83079cdf441b5d381 Mon Sep 17 00:00:00 2001 From: Greg Hackmann Date: Fri, 19 Feb 2016 15:04:23 -0800 Subject: tegra: camera: validate PCLLK_IOCTL_SEQ_XX params The driver expects the userspace-provided table to be terminated with addr == CAMERA_TABLE_END. Reject tables that aren't. (back ported from Nexus N9 project) Bug 1832830 Change-Id: Id1e168e02fbf323d094fe8c36c6e4bd90cceee4f Signed-off-by: Greg Hackmann Reviewed-on: http://git-master/r/1271368 Reviewed-by: Automatic_Commit_Validation_User GVS: Gerrit_Virtual_Submit Reviewed-by: Frank Chen Tested-by: Frank Chen Reviewed-by: Jihoon Bang Reviewed-by: Winnie Hsu --- drivers/media/platform/tegra/camera.c | 23 +++++++++++++++++++++++ 1 file changed, 23 insertions(+) diff --git a/drivers/media/platform/tegra/camera.c b/drivers/media/platform/tegra/camera.c index f54a3c01d38d..a8bba03708f1 100644 --- a/drivers/media/platform/tegra/camera.c +++ b/drivers/media/platform/tegra/camera.c @@ -178,6 +178,20 @@ int __camera_get_params( return 0; } +static int camera_validate_p_i2c_table(struct camera_info *cam, + const struct nvc_param *params, + const struct camera_reg *p_i2c_table, const char *caller) +{ + u32 idx, last_idx = params->sizeofvalue / sizeof(p_i2c_table[0]); + + for (idx = 0; idx < last_idx; idx++) + if (p_i2c_table[idx].addr == CAMERA_TABLE_END) + return 0; + + dev_err(cam->dev, "%s: table is not properly terminated\n", caller); + return -EINVAL; +} + static int camera_seq_rd(struct camera_info *cam, unsigned long arg) { struct nvc_param params; @@ -189,6 +203,10 @@ static int camera_seq_rd(struct camera_info *cam, unsigned long arg) if (err) return err; + err = camera_validate_p_i2c_table(cam, ¶ms, p_i2c_table, __func__); + if (err) + goto seq_rd_end; + err = camera_dev_rd_table(cam->cdev, p_i2c_table); if (!err && copy_to_user(MAKE_USER_PTR(params.p_value), p_i2c_table, params.sizeofvalue)) { @@ -197,6 +215,7 @@ static int camera_seq_rd(struct camera_info *cam, unsigned long arg) err = -EINVAL; } +seq_rd_end: kfree(p_i2c_table); return err; } @@ -251,6 +270,10 @@ static int camera_seq_wr(struct camera_info *cam, unsigned long arg) goto seq_wr_end; } + err = camera_validate_p_i2c_table(cam, ¶ms, p_i2c_table, __func__); + if (err) + goto seq_wr_end; + switch (params.param) { case CAMERA_SEQ_REGISTER_EXEC: case CAMERA_SEQ_REGISTER_ONLY: -- cgit v1.2.3 From 47f46d91bdd0ec42cf688dda09dcd187afdadffd Mon Sep 17 00:00:00 2001 From: Amey Asgaonkar Date: Thu, 28 Apr 2016 18:01:42 -0700 Subject: camera: tegra: Fix security vulnerability Check a few input params to make sure there is no potential for a heap overflow in the driver. (Back ported from Nexus N9 project) Bug 1757475 (nvidia) Bug 1832830 (nvidia) Bug 28193342 (google) Change-Id: I979fa38c5f453cfad7070f0340ec04adde5bac13 Signed-off-by: Amey Asgaonkar Reviewed-on: http://git-master/r/1271369 Reviewed-by: Automatic_Commit_Validation_User GVS: Gerrit_Virtual_Submit Reviewed-by: Frank Chen Tested-by: Frank Chen Reviewed-by: Jihoon Bang Reviewed-by: Winnie Hsu --- drivers/media/platform/tegra/camera.c | 13 ++++++++++++- include/media/camera.h | 3 +++ 2 files changed, 15 insertions(+), 1 deletion(-) diff --git a/drivers/media/platform/tegra/camera.c b/drivers/media/platform/tegra/camera.c index a8bba03708f1..be541b921ec5 100644 --- a/drivers/media/platform/tegra/camera.c +++ b/drivers/media/platform/tegra/camera.c @@ -686,9 +686,20 @@ static int camera_layout_get(struct camera_info *cam, unsigned long arg) if (err) return err; + if (param.variant > MAX_PARAM_VARIANT) { + dev_err(cam->dev, "%s param variant is too large: %u\n", + __func__, param.variant); + return -EINVAL; + } + if (param.sizeofvalue > MAX_PARAM_SIZE_OF_VALUE) { + dev_err(cam->dev, "%s size of param value is too large: %u\n", + __func__, param.sizeofvalue); + return -EINVAL; + } + len = (int)cam_desc.size_layout - param.variant; if (len <= 0) { - dev_err(cam->dev, "%s invalid offset %d\n", + dev_err(cam->dev, "%s invalid offset %u\n", __func__, param.variant); err = -EINVAL; goto getlayout_end; diff --git a/include/media/camera.h b/include/media/camera.h index 7528b9acede8..22f097ee3db2 100644 --- a/include/media/camera.h +++ b/include/media/camera.h @@ -117,6 +117,9 @@ #define CAMERA_DT_ARRAY_U16 22 #define CAMERA_DT_ARRAY_U32 23 +#define MAX_PARAM_SIZE_OF_VALUE 1024 +#define MAX_PARAM_VARIANT 4096 + enum { CAMERA_SEQ_EXEC, CAMERA_SEQ_REGISTER_EXEC, -- cgit v1.2.3 From 44a90765971303f210e2f3017f723b59ab66e67a Mon Sep 17 00:00:00 2001 From: Mark Salyzyn Date: Tue, 17 May 2016 13:23:32 -0700 Subject: tegra: camera race condition vulnerability - Add mutex_lock(cam_desc.d_mutex) around ioctl access functions. - Check cam->cdev in PCLLK_IOCTL_DEV_DEL ioctl. (Back ported from Nexus N9 project) Bug 1832830 Signed-off-by: Signed-off-by: Xiaya Hu Signed-off-by: Mark Salyzyn Bug: 28026625 Change-Id: I81fbab628fb6516afa2cf5d3e0adf333aa2eb003 Reviewed-on: http://git-master/r/1271370 Reviewed-by: Automatic_Commit_Validation_User GVS: Gerrit_Virtual_Submit Reviewed-by: Frank Chen Tested-by: Frank Chen Reviewed-by: Jihoon Bang Reviewed-by: Winnie Hsu --- drivers/media/platform/tegra/camera.c | 23 ++++++++++++++++++++++- 1 file changed, 22 insertions(+), 1 deletion(-) diff --git a/drivers/media/platform/tegra/camera.c b/drivers/media/platform/tegra/camera.c index be541b921ec5..041c830501ef 100644 --- a/drivers/media/platform/tegra/camera.c +++ b/drivers/media/platform/tegra/camera.c @@ -878,31 +878,46 @@ static long camera_ioctl(struct file *file, break; case PCLLK_IOCTL_DEV_DEL: mutex_lock(cam_desc.d_mutex); + if (!cam->cdev) { + err = -ENODEV; + mutex_unlock(cam_desc.d_mutex); + break; + } list_del(&cam->cdev->list); - mutex_unlock(cam_desc.d_mutex); camera_remove_device(cam->cdev, true); + mutex_unlock(cam_desc.d_mutex); break; case PCLLK_IOCTL_DEV_FREE: err = camera_free_device(cam, arg); break; case PCLLK_IOCTL_SEQ_WR: + mutex_lock(cam_desc.d_mutex); err = camera_seq_wr(cam, arg); + mutex_unlock(cam_desc.d_mutex); break; case PCLLK_IOCTL_SEQ_RD: + mutex_lock(cam_desc.d_mutex); err = camera_seq_rd(cam, arg); + mutex_unlock(cam_desc.d_mutex); break; case PCLLK_IOCTL_PARAM_RD: /* err = camera_param_rd(cam, arg); */ break; case PCLLK_IOCTL_PWR_WR: /* This is a Guaranteed Level of Service (GLOS) call */ + mutex_lock(cam_desc.d_mutex); err = camera_dev_pwr_set(cam, arg); + mutex_unlock(cam_desc.d_mutex); break; case PCLLK_IOCTL_PWR_RD: + mutex_lock(cam_desc.d_mutex); err = camera_dev_pwr_get(cam, arg); + mutex_unlock(cam_desc.d_mutex); break; case PCLLK_IOCTL_UPDATE: + mutex_lock(cam_desc.d_mutex); err = camera_update(cam, arg); + mutex_unlock(cam_desc.d_mutex); break; case PCLLK_IOCTL_LAYOUT_WR: err = camera_layout_update(cam, arg); @@ -924,16 +939,22 @@ static long camera_ioctl(struct file *file, err = virtual_device_add(cam_desc.dev, arg); break; case PCLLK_IOCTL_32_SEQ_WR: + mutex_lock(cam_desc.d_mutex); err = camera_seq_wr(cam, arg); + mutex_unlock(cam_desc.d_mutex); break; case PCLLK_IOCTL_32_SEQ_RD: + mutex_lock(cam_desc.d_mutex); err = camera_seq_rd(cam, arg); + mutex_unlock(cam_desc.d_mutex); break; case PCLLK_IOCTL_32_PARAM_RD: /* err = camera_param_rd(cam, arg); */ break; case PCLLK_IOCTL_32_UPDATE: + mutex_lock(cam_desc.d_mutex); err = camera_update(cam, arg); + mutex_unlock(cam_desc.d_mutex); break; case PCLLK_IOCTL_32_LAYOUT_WR: err = camera_layout_update(cam, arg); -- cgit v1.2.3 From e163dc1d86b26357fdc05757457ef58fc567f990 Mon Sep 17 00:00:00 2001 From: Frank Chen Date: Wed, 14 Dec 2016 11:36:41 -0800 Subject: tegra: camera: Fix UAF security issue Fix UAF (use-after-free) security issue in camera.pcl driver Bug 1832830 Change-Id: Ie0f8a58a7bb9d1b4949e0f68d25d6da108f06e76 Signed-off-by: Frank Chen Reviewed-on: http://git-master/r/1271371 Reviewed-by: Automatic_Commit_Validation_User GVS: Gerrit_Virtual_Submit Reviewed-by: Jihoon Bang Reviewed-by: Winnie Hsu --- drivers/media/platform/tegra/camera.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/drivers/media/platform/tegra/camera.c b/drivers/media/platform/tegra/camera.c index 041c830501ef..9017e7fcd2cc 100644 --- a/drivers/media/platform/tegra/camera.c +++ b/drivers/media/platform/tegra/camera.c @@ -526,13 +526,13 @@ static int camera_new_device(struct camera_info *cam, unsigned long arg) next_dev->client->addr == dev_info.addr) { dev_dbg(cam_desc.dev, "%s: device already exists.\n", __func__); - camera_remove_device(new_dev, false); if (atomic_xchg(&next_dev->in_use, 1)) { dev_err(cam_desc.dev, "%s device %s BUSY\n", __func__, next_dev->name); err = -EBUSY; goto new_device_err; - } + } else + camera_remove_device(new_dev, false); new_dev = next_dev; goto new_device_done; } -- cgit v1.2.3 From 98114fbc47ae84c1cd7f67ef6a0fed818adff2e6 Mon Sep 17 00:00:00 2001 From: Aingara Paramakuru Date: Fri, 5 Sep 2014 11:38:21 -0700 Subject: gpu: nvgpu: fix crash in gk20a_channel_release gk20a_channel_release() should bail if filp->private_data is NULL. This can happen as a result of gk20a_channel_release() being called when __gk20a_channel_open() fails in NVHOST_IOCTL_CHANNEL_OPEN. Bug 200014898 Change-Id: I32cc957aca46fcd4265a8052ac5be355b644b9f7 Signed-off-by: Aingara Paramakuru Reviewed-on: http://git-master/r/496138 (cherry picked from commit cb0db6618c42ab4c33574f09f212ab1ee9a0438a) Reviewed-on: http://git-master/r/1258588 Reviewed-by: Winnie Hsu Tested-by: Winnie Hsu --- drivers/gpu/nvgpu/gk20a/channel_gk20a.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/drivers/gpu/nvgpu/gk20a/channel_gk20a.c b/drivers/gpu/nvgpu/gk20a/channel_gk20a.c index 19156d6921d1..947b1dc668bf 100644 --- a/drivers/gpu/nvgpu/gk20a/channel_gk20a.c +++ b/drivers/gpu/nvgpu/gk20a/channel_gk20a.c @@ -719,9 +719,12 @@ unbind: int gk20a_channel_release(struct inode *inode, struct file *filp) { struct channel_gk20a *ch = (struct channel_gk20a *)filp->private_data; - struct gk20a *g = ch->g; + struct gk20a *g = ch ? ch->g : NULL; int err; + if (!ch) + return 0; + trace_gk20a_channel_release(dev_name(&g->dev->dev)); err = gk20a_busy(ch->g->dev); -- cgit v1.2.3 From ea316a2ba8c8504069b73b8782a5ca3e34283a9e Mon Sep 17 00:00:00 2001 From: Sagar Kadamati Date: Tue, 6 Dec 2016 11:38:01 +0530 Subject: video: tegra: nvmap: Fix OOB vulnerability Check all pages' parameters before reserve pages. Bug 1883463 Bug 1831426 Bug 200247013 Manual port: http://git-psac/r/9287 (cherry picked from commit 61a05b52b8a17593e2817076b9bf59efdd9268ad) Change-Id: I2f47c385ff8f4a9ca6bf37ee41749bd684ca1a20 Signed-off-by: Xia Yang Signed-off-by: Sagar Kadamati Reviewed-on: http://git-master/r/1273326 Reviewed-on: http://git-master/r/1488769 GVS: Gerrit_Virtual_Submit Tested-by: Sumit Gupta Reviewed-by: Bibek Basu --- drivers/video/tegra/nvmap/nvmap_mm.c | 9 +++++++++ 1 file changed, 9 insertions(+) diff --git a/drivers/video/tegra/nvmap/nvmap_mm.c b/drivers/video/tegra/nvmap/nvmap_mm.c index 30994e681121..fbf510081be7 100644 --- a/drivers/video/tegra/nvmap/nvmap_mm.c +++ b/drivers/video/tegra/nvmap/nvmap_mm.c @@ -235,6 +235,15 @@ int nvmap_reserve_pages(struct nvmap_handle **handles, u32 *offsets, u32 *sizes, { int i; + /* validates all page params first */ + for (i = 0; i < nr; i++) { + u32 size = sizes[i] ? sizes[i] : handles[i]->size; + u32 offset = sizes[i] ? offsets[i] : 0; + + if ((offset != 0) || (size != handles[i]->size)) + return -EINVAL; + } + for (i = 0; i < nr; i++) { u32 size = sizes[i] ? sizes[i] : handles[i]->size; u32 offset = sizes[i] ? offsets[i] : 0; -- cgit v1.2.3 From 642ec539ddab846143db87673ace653d09c75e05 Mon Sep 17 00:00:00 2001 From: Gagan Grover Date: Thu, 24 Nov 2016 16:58:49 +0530 Subject: video: tegra: nvmap: Fix security issue in NVMAP_IOC_PARAM Initialized the uninitialized variables and handled return status from nvmap_get_handle_param. Bug 1884311 Bug 1820242 Change-Id: I2390c859d2b2af39eaff44749ca64e60920fe944 Signed-off-by: Gagan Grover Reviewed-on: http://git-master/r/1259560 Reviewed-on: http://git-master/r/1489707 GVS: Gerrit_Virtual_Submit Tested-by: Sumit Gupta Reviewed-by: Bibek Basu --- drivers/video/tegra/nvmap/nvmap_ioctl.c | 9 ++++++--- 1 file changed, 6 insertions(+), 3 deletions(-) diff --git a/drivers/video/tegra/nvmap/nvmap_ioctl.c b/drivers/video/tegra/nvmap/nvmap_ioctl.c index 27db8f6799af..98b9c78f278b 100644 --- a/drivers/video/tegra/nvmap/nvmap_ioctl.c +++ b/drivers/video/tegra/nvmap/nvmap_ioctl.c @@ -454,9 +454,9 @@ int nvmap_ioctl_get_param(struct file *filp, void __user *arg, bool is32) struct nvmap_handle_param __user *uarg = arg; struct nvmap_handle_param op; struct nvmap_client *client = filp->private_data; - struct nvmap_handle_ref *ref; - struct nvmap_handle *h; - u64 result; + struct nvmap_handle_ref *ref = NULL; + struct nvmap_handle *h = NULL; + u64 result = 0; int err = 0; #ifdef CONFIG_COMPAT @@ -482,6 +482,9 @@ int nvmap_ioctl_get_param(struct file *filp, void __user *arg, bool is32) } err = nvmap_get_handle_param(client, ref, op.param, &result); + if (err) { + goto ref_fail; + } #ifdef CONFIG_COMPAT if (is32) -- cgit v1.2.3 From b4328544835de3fc8215f37668dc97fc21013136 Mon Sep 17 00:00:00 2001 From: Sri Krishna chowdary Date: Wed, 14 Dec 2016 11:58:30 +0530 Subject: video: tegra: nvmap: Fix NULL pointer dereference Consider the following case: 1. NVMAP_IOC_CREATE on IOVMM gives a valid fd to user space 2. user space does not call NVMAP_IOC_ALLOC. 3. user space calls a client driver IOCTL which calls dma_buf_map_attachment 4. call to dma_buf_map_attachment propagates till__nvmap_sg_table which has heap_pgalloc as true and tries to access pages[] which has all NULL. 5. Similarly, a dma_buf_kmap() can result in __nvmap_kmap() being called which again results in NULL dereference if pages[] is accessed. A valid __nvmap_sg_table should occur only when h->alloc is true. So, add check for it. bug 1838597 bug 1883708 Change-Id: I400d9d8a94ff1003db207fc9c252b9256d796f60 Signed-off-by: Sri Krishna chowdary Signed-off-by: Debarshi Dutta (cherry picked from commit 8244d104b7635cb0b26b651b6851498b9a84d7d6) Reviewed-on: http://git-master/r/1489579 Reviewed-by: Automatic_Commit_Validation_User GVS: Gerrit_Virtual_Submit Reviewed-by: Bibek Basu Tested-by: Bibek Basu --- drivers/video/tegra/nvmap/nvmap.c | 28 +++++++++++++++++++--------- 1 file changed, 19 insertions(+), 9 deletions(-) diff --git a/drivers/video/tegra/nvmap/nvmap.c b/drivers/video/tegra/nvmap/nvmap.c index 09f436102c6b..662646a2d6c6 100644 --- a/drivers/video/tegra/nvmap/nvmap.c +++ b/drivers/video/tegra/nvmap/nvmap.c @@ -3,7 +3,7 @@ * * Memory manager for Tegra GPU * - * Copyright (c) 2009-2014, NVIDIA CORPORATION. All rights reserved. + * Copyright (c) 2009-2017, NVIDIA CORPORATION. All rights reserved. * * This program is free software; you can redistribute it and/or modify * it under the terms of the GNU General Public License as published by @@ -196,6 +196,9 @@ void *__nvmap_kmap(struct nvmap_handle *h, unsigned int pagenum) if (!h) return NULL; + if (!h->alloc) + goto out; + if (pagenum >= h->size >> PAGE_SHIFT) goto out; prot = nvmap_pgprot(h, PG_PROT_KERNEL); @@ -222,7 +225,7 @@ void __nvmap_kunmap(struct nvmap_handle *h, unsigned int pagenum, phys_addr_t paddr; struct vm_struct *area = NULL; - if (!h || + if (!h || !h->alloc || WARN_ON(!virt_addr_valid(h)) || WARN_ON(!addr)) return; @@ -266,7 +269,7 @@ void *__nvmap_mmap(struct nvmap_handle *h) return NULL; if (!h->alloc) - return NULL; + goto put_handle; prot = nvmap_pgprot(h, PG_PROT_KERNEL); @@ -276,7 +279,7 @@ void *__nvmap_mmap(struct nvmap_handle *h) pages = nvmap_pages(h->pgalloc.pages, h->size >> PAGE_SHIFT); if (!pages) - return NULL; + goto put_handle; vaddr = vm_map_ram(pages, h->size >> PAGE_SHIFT, -1, prot); nvmap_altfree(pages, @@ -296,10 +299,8 @@ void *__nvmap_mmap(struct nvmap_handle *h) adj_size = PAGE_ALIGN(adj_size); v = alloc_vm_area(adj_size, 0); - if (!v) { - nvmap_handle_put(h); - return NULL; - } + if (!v) + goto put_handle; p = v->addr + (h->carveout->base & ~PAGE_MASK); ioremap_page_range((ulong)v->addr, (ulong)v->addr + adj_size, @@ -309,11 +310,14 @@ void *__nvmap_mmap(struct nvmap_handle *h) * the handle will not be freed while the kernel mapping exists. * nvmap_handle_put will be called by unmapping this address */ return p; +put_handle: + nvmap_handle_put(h); + return NULL; } void __nvmap_munmap(struct nvmap_handle *h, void *addr) { - if (!h || + if (!h || !h->alloc || WARN_ON(!virt_addr_valid(h)) || WARN_ON(!addr)) return; @@ -447,6 +451,11 @@ struct sg_table *__nvmap_sg_table(struct nvmap_client *client, if (!h) return ERR_PTR(-EINVAL); + if (!h->alloc) { + err = -EINVAL; + goto put_handle; + } + npages = PAGE_ALIGN(h->size) >> PAGE_SHIFT; sgt = kzalloc(sizeof(*sgt), GFP_KERNEL); if (!sgt) { @@ -476,6 +485,7 @@ struct sg_table *__nvmap_sg_table(struct nvmap_client *client, err: kfree(sgt); +put_handle: nvmap_handle_put(h); return ERR_PTR(err); } -- cgit v1.2.3 From ec9ac25833e9e5972b1dcbfc2f9140259dc71393 Mon Sep 17 00:00:00 2001 From: Alex Waterman Date: Wed, 30 Nov 2016 14:12:25 -0800 Subject: gpu: nvgpu: Fix pgsz_idx used in gk20a_vm_alloc_space() Use the correct page size index for pgsz_idx in gk20a_vm_alloc_space(). Previously the page size itself was used, not the page size index. Bug 1837624 Change-Id: I652f5af5321c1c49dc8eb170d3f92f00c23d2b6f Signed-off-by: Alex Waterman (cherry picked from commit fd13e0e1c4e397335c24497a0f92c85934d6185f) Reviewed-on: http://git-master/r/1503371 Reviewed-by: Terje Bergstrom Reviewed-by: Winnie Hsu --- drivers/gpu/nvgpu/gk20a/mm_gk20a.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/gpu/nvgpu/gk20a/mm_gk20a.c b/drivers/gpu/nvgpu/gk20a/mm_gk20a.c index 12f3c092c0cb..2a5bd760f82d 100644 --- a/drivers/gpu/nvgpu/gk20a/mm_gk20a.c +++ b/drivers/gpu/nvgpu/gk20a/mm_gk20a.c @@ -2319,7 +2319,7 @@ int gk20a_vm_alloc_space(struct gk20a_as_share *as_share, va_node->vaddr_start = vaddr_start; va_node->size = (u64)args->page_size * (u64)args->pages; - va_node->pgsz_idx = args->page_size; + va_node->pgsz_idx = pgsz_idx; INIT_LIST_HEAD(&va_node->va_buffers_list); INIT_LIST_HEAD(&va_node->reserved_va_list); -- cgit v1.2.3 From 707cd5f568f3521090d31dec663f54d7fca08347 Mon Sep 17 00:00:00 2001 From: Jitendra Kumar Date: Thu, 27 Oct 2016 14:05:00 +0530 Subject: media: tegra: nvavp: Fix UAF issue. Use locking to protect generated fd, so that it can't be freed before channel open completes. Also add null value checks in release call. CVE-2016-8449 (A-31798848) Bug 1830023 Bug 1849492 Change-Id: Ie6e2b29c7132fdfdff6b0bfa75440bd43afffd5f Signed-off-by: Gagan Grover Reviewed-on: http://git-master/r/1285817 (cherry picked from commit 2ff0fdedfd65f269359d6540df4662e958681aa7) Reviewed-on: http://git-master/r/1299505 (cherry picked from commit ea1af2ce5a746bda36205357c9e0adaf527026bb) Reviewed-on: http://git-master/r/1489467 (cherry picked from commit 89559abb25f82dc333eafa26391be0a50d6e9e0a) Reviewed-on: http://git-master/r/1504674 Reviewed-by: Automatic_Commit_Validation_User GVS: Gerrit_Virtual_Submit Tested-by: Bibek Basu Reviewed-by: Bibek Basu Reviewed-by: Winnie Hsu --- drivers/media/platform/tegra/nvavp/nvavp_dev.c | 42 ++++++++++++++++++++------ 1 file changed, 32 insertions(+), 10 deletions(-) diff --git a/drivers/media/platform/tegra/nvavp/nvavp_dev.c b/drivers/media/platform/tegra/nvavp/nvavp_dev.c index f2cb6a593dd2..25dee33ea9aa 100644 --- a/drivers/media/platform/tegra/nvavp/nvavp_dev.c +++ b/drivers/media/platform/tegra/nvavp/nvavp_dev.c @@ -1,7 +1,7 @@ /* * drivers/media/video/tegra/nvavp/nvavp_dev.c * - * Copyright (c) 2011-2016, NVIDIA CORPORATION. All rights reserved. + * Copyright (c) 2011-2017, NVIDIA CORPORATION. All rights reserved. * * This file is licensed under the terms of the GNU General Public License * version 2. This program is licensed "as is" without any warranty of any @@ -2037,10 +2037,17 @@ out: static int tegra_nvavp_video_release(struct inode *inode, struct file *filp) { - struct nvavp_clientctx *clientctx = filp->private_data; - struct nvavp_info *nvavp = clientctx->nvavp; + struct nvavp_clientctx *clientctx; + struct nvavp_info *nvavp; int ret = 0; + clientctx = filp->private_data; + if (!clientctx) + return ret; + nvavp = clientctx->nvavp; + if (!nvavp) + return ret; + mutex_lock(&nvavp->open_lock); filp->private_data = NULL; ret = tegra_nvavp_release(clientctx, NVAVP_VIDEO_CHANNEL); @@ -2053,10 +2060,17 @@ static int tegra_nvavp_video_release(struct inode *inode, struct file *filp) static int tegra_nvavp_audio_release(struct inode *inode, struct file *filp) { - struct nvavp_clientctx *clientctx = filp->private_data; - struct nvavp_info *nvavp = clientctx->nvavp; + struct nvavp_clientctx *clientctx; + struct nvavp_info *nvavp; int ret = 0; + clientctx = filp->private_data; + if (!clientctx) + return ret; + nvavp = clientctx->nvavp; + if (!nvavp) + return ret; + mutex_lock(&nvavp->open_lock); filp->private_data = NULL; ret = tegra_nvavp_release(clientctx, NVAVP_AUDIO_CHANNEL); @@ -2068,9 +2082,15 @@ static int tegra_nvavp_audio_release(struct inode *inode, int tegra_nvavp_audio_client_release(nvavp_clientctx_t client) { struct nvavp_clientctx *clientctx = client; - struct nvavp_info *nvavp = clientctx->nvavp; + struct nvavp_info *nvavp; int ret = 0; + if (!clientctx) + return ret; + nvavp = clientctx->nvavp; + if (!nvavp) + return ret; + mutex_lock(&nvavp->open_lock); ret = tegra_nvavp_release(clientctx, NVAVP_AUDIO_CHANNEL); mutex_unlock(&nvavp->open_lock); @@ -2112,10 +2132,8 @@ nvavp_channel_open(struct file *filp, struct nvavp_channel_open_args *arg) return err; } - fd_install(fd, file); - - nonseekable_open(file->f_inode, filp); mutex_lock(&nvavp->open_lock); + err = tegra_nvavp_open(nvavp, (struct nvavp_clientctx **)&file->private_data, clientctx->channel_id); @@ -2125,9 +2143,13 @@ nvavp_channel_open(struct file *filp, struct nvavp_channel_open_args *arg) mutex_unlock(&nvavp->open_lock); return err; } - mutex_unlock(&nvavp->open_lock); arg->channel_fd = fd; + + nonseekable_open(file->f_inode, filp); + fd_install(fd, file); + + mutex_unlock(&nvavp->open_lock); return err; } -- cgit v1.2.3 From d45c4c5cae287106a349c4f85d12c45920147fb0 Mon Sep 17 00:00:00 2001 From: Sri Krishna chowdary Date: Fri, 3 Mar 2017 10:44:08 +0530 Subject: video: tegra: nvmap: fix information leak in pin/unpin When the NVMAP_IOC_PIN_MULT_32 and NVMAP_IOC_UNPIN_MULT_32 are called it is possible that the op.addr is not initialized. This can cause write to some random address thus causing corruption. This patch fixes Google Bug 31668540 bug 1832092 Change-Id: I4d12d1a6c777131ba1fa2a753ea640861f8e82a6 Signed-off-by: Sri Krishna chowdary Reviewed-on: http://git-master/r/1314406 (cherry picked from commit da0c43534bb61e2e0849e297d389517d5e4ed168) Reviewed-on: http://git-master/r/1504673 GVS: Gerrit_Virtual_Submit Reviewed-by: Bibek Basu Tested-by: Bibek Basu Reviewed-by: Winnie Hsu --- drivers/video/tegra/nvmap/nvmap_ioctl.c | 1 + 1 file changed, 1 insertion(+) diff --git a/drivers/video/tegra/nvmap/nvmap_ioctl.c b/drivers/video/tegra/nvmap/nvmap_ioctl.c index 98b9c78f278b..a52dbab922b4 100644 --- a/drivers/video/tegra/nvmap/nvmap_ioctl.c +++ b/drivers/video/tegra/nvmap/nvmap_ioctl.c @@ -88,6 +88,7 @@ int nvmap_ioctl_pinop(struct file *filp, bool is_pin, void __user *arg, return -EFAULT; op.handles = (__u32 *)(uintptr_t)op32.handles; op.count = op32.count; + op.addr = (unsigned long *)(uintptr_t)op32.addr; } else #endif if (copy_from_user(&op, arg, sizeof(op))) -- cgit v1.2.3 From 54c1cc0aa58a97e18563c6d996d5dde741055ddd Mon Sep 17 00:00:00 2001 From: Pavan Kunapuli Date: Thu, 16 Mar 2017 19:32:06 +0530 Subject: video: tegra: dsi: Set max limit for reading panel In the debugfs support for reading panel registers, max payload needs to be limited to the buff array size to avoid stack corruption. Bug 1873360 Change-Id: Ibee7bd81027d2669297942c09b905f1dd3bb09ee Signed-off-by: Pavan Kunapuli Signed-off-by: sakets Reviewed-on: https://git-master/r/1507653 Reviewed-by: Automatic_Commit_Validation_User GVS: Gerrit_Virtual_Submit Reviewed-by: Bibek Basu --- drivers/video/tegra/dc/dsi_debug.c | 47 +++++++++++++++++++++++--------------- 1 file changed, 28 insertions(+), 19 deletions(-) diff --git a/drivers/video/tegra/dc/dsi_debug.c b/drivers/video/tegra/dc/dsi_debug.c index 9e3288be4cce..a29acca7491b 100644 --- a/drivers/video/tegra/dc/dsi_debug.c +++ b/drivers/video/tegra/dc/dsi_debug.c @@ -1,7 +1,7 @@ /* * drivers/video/tegra/dc/dsi_debug.c * - * Copyright (c) 2013-2014 NVIDIA CORPORATION, All rights reserved. + * Copyright (c) 2013-2017 NVIDIA CORPORATION, All rights reserved. * * This software is licensed under the terms of the GNU General Public * License version 2, as published by the Free Software Foundation, and @@ -31,6 +31,8 @@ #ifdef CONFIG_DEBUG_FS +#define MAX_PANEL_REG_READ_SIZE 300 + static int dbg_dsi_show(struct seq_file *s, void *unused) { struct tegra_dc_dsi_data *dsi = s->private; @@ -152,36 +154,43 @@ static int read_panel_get(struct seq_file *s, void *unused) struct tegra_dc_dsi_data *dsi = s->private; struct tegra_dc *dc = dsi->dc; int err = 0; - u8 buf[300] = {0}; + u8 buf[MAX_PANEL_REG_READ_SIZE] = {0}; int j = 0 , b = 0 , k; u32 payload_size = 0; if (!dsi->enabled) { dev_info(&dc->ndev->dev, " controller suspended\n"); - return -EINVAL; -} + return -EINVAL; + } seq_printf(s, "max ret payload size:0x%x\npanel reg addr:0x%x\n", max_ret_payload_size, panel_reg_addr); - if (max_ret_payload_size == 0) { - seq_puts(s, "echo was not successful\n"); - return err; -} + + if ((max_ret_payload_size > MAX_PANEL_REG_READ_SIZE) || + (max_ret_payload_size == 0)) { + seq_printf(s, "payload size should be positive value < 0x%x\n", + MAX_PANEL_REG_READ_SIZE); + return err; + } + + if (panel_reg_addr >= MAX_PANEL_REG_READ_SIZE) { + seq_puts(s, "panel reg addr is outside the range\n"); + return err; + } + + if (max_ret_payload_size > + (MAX_PANEL_REG_READ_SIZE - panel_reg_addr)) + max_ret_payload_size = + MAX_PANEL_REG_READ_SIZE - panel_reg_addr; + err = tegra_dsi_read_data(dsi->dc, dsi, max_ret_payload_size, panel_reg_addr, buf); - seq_printf(s, " Read data[%d] ", b); - - for (b = 1; b < (max_ret_payload_size+1); b++) { - j = (b*4)-1; - for (k = j; k > (j-4); k--) - if ((k%4) == 0 && b != max_ret_payload_size) { - seq_printf(s, " %x ", buf[k]); - seq_printf(s, "\n Read data[%d] ", b); - } - else - seq_printf(s, " %x ", buf[k]); + for (b = 0; b < max_ret_payload_size; b += 4) { + seq_printf(s, "\n Read data[%d] ", j++); + for (k = b+4; k > b; k--) + seq_printf(s, " %x ", buf[k-1]); } seq_puts(s, "\n"); -- cgit v1.2.3 From 481eb890d4c989e61a998dca11797a3035f1b1de Mon Sep 17 00:00:00 2001 From: Krishna Reddy Date: Fri, 4 Nov 2016 12:45:53 -0700 Subject: video: tegra: nvmap: fix nvmap create handle vulnerability Handle the race condition between malicious fd close and copy_to_user error, which can create use after free condition. This is fixed by deferring the fd install, which eliminates the race that leads to use after free condition. Fixing Google Bug 32160775. Bug 1835857 Change-Id: I337807e4360661beced8f9e1155c47b66607b8df Signed-off-by: Krishna Reddy Reviewed-on: http://git-master/r/1248391 Reviewed-on: https://git-master.nvidia.com/r/1512958 GVS: Gerrit_Virtual_Submit Reviewed-by: Bibek Basu Tested-by: Bibek Basu --- drivers/video/tegra/nvmap/nvmap_dmabuf.c | 19 +++--------- drivers/video/tegra/nvmap/nvmap_ioctl.c | 51 +++++++++++++++++++------------- 2 files changed, 35 insertions(+), 35 deletions(-) diff --git a/drivers/video/tegra/nvmap/nvmap_dmabuf.c b/drivers/video/tegra/nvmap/nvmap_dmabuf.c index e0ade759a340..d5b0c8805766 100644 --- a/drivers/video/tegra/nvmap/nvmap_dmabuf.c +++ b/drivers/video/tegra/nvmap/nvmap_dmabuf.c @@ -599,7 +599,6 @@ err_nomem: int __nvmap_dmabuf_fd(struct nvmap_client *client, struct dma_buf *dmabuf, int flags) { - int fd; int start_fd = CONFIG_NVMAP_FD_START; #ifdef CONFIG_NVMAP_DEFER_FD_RECYCLE @@ -615,14 +614,8 @@ int __nvmap_dmabuf_fd(struct nvmap_client *client, * __FD_SETSIZE limitation issue for select(), * pselect() syscalls. */ - fd = __alloc_fd(current->files, start_fd, - sysctl_nr_open, flags); - if (fd < 0) - return fd; - - fd_install(fd, dmabuf->file); - - return fd; + return __alloc_fd(current->files, start_fd, + sysctl_nr_open, flags); } int nvmap_get_dmabuf_fd(struct nvmap_client *client, struct nvmap_handle *h) @@ -634,12 +627,8 @@ int nvmap_get_dmabuf_fd(struct nvmap_client *client, struct nvmap_handle *h) if (IS_ERR(dmabuf)) return PTR_ERR(dmabuf); fd = __nvmap_dmabuf_fd(client, dmabuf, O_CLOEXEC); - if (fd < 0) - goto err_out; - return fd; - -err_out: - dma_buf_put(dmabuf); + if (IS_ERR_VALUE(fd)) + dma_buf_put(dmabuf); return fd; } diff --git a/drivers/video/tegra/nvmap/nvmap_ioctl.c b/drivers/video/tegra/nvmap/nvmap_ioctl.c index a52dbab922b4..3f7573a9ffcc 100644 --- a/drivers/video/tegra/nvmap/nvmap_ioctl.c +++ b/drivers/video/tegra/nvmap/nvmap_ioctl.c @@ -227,6 +227,33 @@ const struct file_operations nvmap_fd_fops = { .mmap = nvmap_share_mmap, }; +static int nvmap_install_fd(struct nvmap_client *client, + struct nvmap_handle *handle, int fd, void __user *arg, + void *op, size_t op_size, bool free) +{ + int err = 0; + + if (IS_ERR_VALUE(fd)) { + err = fd; + goto fd_fail; + } + + if (copy_to_user(arg, op, op_size)) { + err = -EFAULT; + goto copy_fail; + } + + fd_install(fd, handle->dmabuf->file); + return err; + +copy_fail: + put_unused_fd(fd); +fd_fail: + if (free) + nvmap_free_handle(client, handle); + return err; +} + int nvmap_ioctl_getfd(struct file *filp, void __user *arg) { struct nvmap_handle *handle; @@ -242,14 +269,9 @@ int nvmap_ioctl_getfd(struct file *filp, void __user *arg) op.fd = nvmap_get_dmabuf_fd(client, handle); nvmap_handle_put(handle); - if (op.fd < 0) - return op.fd; - if (copy_to_user(arg, &op, sizeof(op))) { - sys_close(op.fd); - return -EFAULT; - } - return 0; + return nvmap_install_fd(client, handle, + op.fd, arg, &op, sizeof(op), 0); } int nvmap_ioctl_alloc(struct file *filp, void __user *arg) @@ -315,7 +337,6 @@ int nvmap_ioctl_create(struct file *filp, unsigned int cmd, void __user *arg) struct nvmap_create_handle op; struct nvmap_handle_ref *ref = NULL; struct nvmap_client *client = filp->private_data; - int err = 0; int fd = 0; if (copy_from_user(&op, arg, sizeof(op))) @@ -338,19 +359,9 @@ int nvmap_ioctl_create(struct file *filp, unsigned int cmd, void __user *arg) return PTR_ERR(ref); fd = nvmap_get_dmabuf_fd(client, ref->handle); - if (fd < 0) - err = fd; - op.handle = fd; - - if (copy_to_user(arg, &op, sizeof(op))) { - err = -EFAULT; - nvmap_free_handle(client, __nvmap_ref_to_id(ref)); - } - - if (err && fd > 0) - sys_close(fd); - return err; + return nvmap_install_fd(client, ref->handle, fd, + arg, &op, sizeof(op), 1); } int nvmap_map_into_caller_ptr(struct file *filp, void __user *arg, bool is32) -- cgit v1.2.3 From 2db040946ff8340485b2b33fe5a46f3166fa96f6 Mon Sep 17 00:00:00 2001 From: Debarshi Dutta Date: Wed, 21 Jun 2017 16:15:09 +0530 Subject: gpu: nvgpu: Remove IOCTL FREE_OBJ_CTX We have never used the IOCTL FREE_OBJ_CTX. Using it leads to context being only partially available, and can lead to use-after-free. Bug 1885775 Change-Id: I9d2b632ab79760f8186d02e0f35861b3a6aae649 Signed-off-by: Debarshi Dutta Reviewed-on: https://git-master.nvidia.com/r/1506479 Reviewed-by: Automatic_Commit_Validation_User GVS: Gerrit_Virtual_Submit Reviewed-by: Bibek Basu --- drivers/gpu/nvgpu/gk20a/channel_gk20a.c | 14 +------------- drivers/gpu/nvgpu/gk20a/channel_gk20a.h | 3 +-- drivers/gpu/nvgpu/gk20a/gr_gk20a.c | 28 +--------------------------- drivers/gpu/nvgpu/gk20a/gr_gk20a.h | 5 +---- include/linux/nvhost_ioctl.h | 8 +------- 5 files changed, 5 insertions(+), 53 deletions(-) diff --git a/drivers/gpu/nvgpu/gk20a/channel_gk20a.c b/drivers/gpu/nvgpu/gk20a/channel_gk20a.c index 947b1dc668bf..3065e8403559 100644 --- a/drivers/gpu/nvgpu/gk20a/channel_gk20a.c +++ b/drivers/gpu/nvgpu/gk20a/channel_gk20a.c @@ -3,7 +3,7 @@ * * GK20A Graphics channel * - * Copyright (c) 2011-2015, NVIDIA CORPORATION. All rights reserved. + * Copyright (c) 2011-2017, NVIDIA CORPORATION. All rights reserved. * * This program is free software; you can redistribute it and/or modify it * under the terms and conditions of the GNU General Public License, @@ -2066,18 +2066,6 @@ long gk20a_channel_ioctl(struct file *filp, (struct nvhost_alloc_obj_ctx_args *)buf); gk20a_idle(dev); break; - case NVHOST_IOCTL_CHANNEL_FREE_OBJ_CTX: - err = gk20a_busy(dev); - if (err) { - dev_err(&dev->dev, - "%s: failed to host gk20a for ioctl cmd: 0x%x", - __func__, cmd); - return err; - } - err = gk20a_free_obj_ctx(ch, - (struct nvhost_free_obj_ctx_args *)buf); - gk20a_idle(dev); - break; case NVHOST_IOCTL_CHANNEL_ALLOC_GPFIFO: err = gk20a_busy(dev); if (err) { diff --git a/drivers/gpu/nvgpu/gk20a/channel_gk20a.h b/drivers/gpu/nvgpu/gk20a/channel_gk20a.h index 547bb064fd63..831db0f4986a 100644 --- a/drivers/gpu/nvgpu/gk20a/channel_gk20a.h +++ b/drivers/gpu/nvgpu/gk20a/channel_gk20a.h @@ -3,7 +3,7 @@ * * GK20A graphics channel * - * Copyright (c) 2011-2014, NVIDIA CORPORATION. All rights reserved. + * Copyright (c) 2011-2017, NVIDIA CORPORATION. All rights reserved. * * This program is free software; you can redistribute it and/or modify it * under the terms and conditions of the GNU General Public License, @@ -98,7 +98,6 @@ struct channel_gk20a { u64 userd_iova; u64 userd_gpu_va; - s32 num_objects; u32 obj_class; /* we support only one obj per channel */ struct priv_cmd_queue priv_cmd_q; diff --git a/drivers/gpu/nvgpu/gk20a/gr_gk20a.c b/drivers/gpu/nvgpu/gk20a/gr_gk20a.c index 9e032e03a153..d5a3bbd34a78 100644 --- a/drivers/gpu/nvgpu/gk20a/gr_gk20a.c +++ b/drivers/gpu/nvgpu/gk20a/gr_gk20a.c @@ -1,7 +1,7 @@ /* * GK20A Graphics * - * Copyright (c) 2011-2015, NVIDIA CORPORATION. All rights reserved. + * Copyright (c) 2011-2017, NVIDIA CORPORATION. All rights reserved. * * This program is free software; you can redistribute it and/or modify it * under the terms and conditions of the GNU General Public License, @@ -2697,7 +2697,6 @@ void gk20a_free_channel_ctx(struct channel_gk20a *c) memset(&c->ch_ctx, 0, sizeof(struct channel_ctx_gk20a)); - c->num_objects = 0; c->first_init = false; } @@ -2848,8 +2847,6 @@ int gk20a_alloc_obj_ctx(struct channel_gk20a *c, c->first_init = true; } - c->num_objects++; - gk20a_dbg_fn("done"); return 0; out: @@ -2861,29 +2858,6 @@ out: return err; } -int gk20a_free_obj_ctx(struct channel_gk20a *c, - struct nvhost_free_obj_ctx_args *args) -{ - unsigned long timeout = gk20a_get_gr_idle_timeout(c->g); - - gk20a_dbg_fn(""); - - if (c->num_objects == 0) - return 0; - - c->num_objects--; - - if (c->num_objects == 0) { - c->first_init = false; - gk20a_disable_channel(c, - !c->has_timedout, - timeout); - gr_gk20a_unmap_channel_patch_ctx(c); - } - - return 0; -} - static void gk20a_remove_gr_support(struct gr_gk20a *gr) { struct gk20a *g = gr->g; diff --git a/drivers/gpu/nvgpu/gk20a/gr_gk20a.h b/drivers/gpu/nvgpu/gk20a/gr_gk20a.h index 2a31aa0b830f..526eefb46b6f 100644 --- a/drivers/gpu/nvgpu/gk20a/gr_gk20a.h +++ b/drivers/gpu/nvgpu/gk20a/gr_gk20a.h @@ -1,7 +1,7 @@ /* * GK20A Graphics Engine * - * Copyright (c) 2011-2014, NVIDIA CORPORATION. All rights reserved. + * Copyright (c) 2011-2017, NVIDIA CORPORATION. All rights reserved. * * This program is free software; you can redistribute it and/or modify it * under the terms and conditions of the GNU General Public License, @@ -324,12 +324,9 @@ int gk20a_init_gr_channel(struct channel_gk20a *ch_gk20a); int gr_gk20a_init_ctx_vars(struct gk20a *g, struct gr_gk20a *gr); struct nvhost_alloc_obj_ctx_args; -struct nvhost_free_obj_ctx_args; int gk20a_alloc_obj_ctx(struct channel_gk20a *c, struct nvhost_alloc_obj_ctx_args *args); -int gk20a_free_obj_ctx(struct channel_gk20a *c, - struct nvhost_free_obj_ctx_args *args); void gk20a_free_channel_ctx(struct channel_gk20a *c); int gk20a_gr_isr(struct gk20a *g); diff --git a/include/linux/nvhost_ioctl.h b/include/linux/nvhost_ioctl.h index b060864ff1d1..a1011e5a1daf 100644 --- a/include/linux/nvhost_ioctl.h +++ b/include/linux/nvhost_ioctl.h @@ -3,7 +3,7 @@ * * Tegra graphics host driver * - * Copyright (c) 2009-2014, NVIDIA Corporation. All rights reserved. + * Copyright (c) 2009-2017, NVIDIA Corporation. All rights reserved. * * This program is free software; you can redistribute it and/or modify * it under the terms of the GNU General Public License as published by @@ -118,10 +118,6 @@ struct nvhost_alloc_obj_ctx_args { __u64 obj_id; /* output, used to free later */ }; -struct nvhost_free_obj_ctx_args { - __u64 obj_id; /* obj ctx to free */ -}; - struct nvhost_alloc_gpfifo_args { __u32 num_entries; #define NVHOST_ALLOC_GPFIFO_FLAGS_VPR_ENABLED (1 << 0) /* set owner channel of this gpfifo as a vpr channel */ @@ -390,8 +386,6 @@ struct nvhost_set_ctxswitch_args { _IOWR(NVHOST_IOCTL_MAGIC, 107, struct nvhost_submit_gpfifo_args) #define NVHOST_IOCTL_CHANNEL_ALLOC_OBJ_CTX \ _IOWR(NVHOST_IOCTL_MAGIC, 108, struct nvhost_alloc_obj_ctx_args) -#define NVHOST_IOCTL_CHANNEL_FREE_OBJ_CTX \ - _IOR(NVHOST_IOCTL_MAGIC, 109, struct nvhost_free_obj_ctx_args) #define NVHOST_IOCTL_CHANNEL_ZCULL_BIND \ _IOWR(NVHOST_IOCTL_MAGIC, 110, struct nvhost_zcull_bind_args) #define NVHOST_IOCTL_CHANNEL_SET_ERROR_NOTIFIER \ -- cgit v1.2.3 From b271e8fa67a6d9c4600274a25636cfe00fdd1b68 Mon Sep 17 00:00:00 2001 From: Ben Seri Date: Wed, 13 Sep 2017 14:04:32 +0530 Subject: Bluetooth: Properly check L2CAP config option output buffer length Validate the output buffer length for L2CAP config requests and responses to avoid overflowing the stack buffer used for building the option blocks. Bug 1989825 Change-Id: Id158ece2176c4ac339a7232dfde8c47ce2241122 Cc: stable@vger.kernel.org Signed-off-by: Ben Seri Signed-off-by: Marcel Holtmann Signed-off-by: Linus Torvalds Signed-off-by: Bibek Basu Reviewed-on: https://git-master.nvidia.com/r/1558952 (cherry picked from commit c005032a3ffe77437f6ebc704af377fc9bc46279) Reviewed-on: https://git-master.nvidia.com/r/1570529 Reviewed-by: Matthew Pedro Reviewed-by: Winnie Hsu Tested-by: Winnie Hsu --- net/bluetooth/l2cap_core.c | 80 +++++++++++++++++++++++++--------------------- 1 file changed, 43 insertions(+), 37 deletions(-) diff --git a/net/bluetooth/l2cap_core.c b/net/bluetooth/l2cap_core.c index c11a28bae844..10d4bee2d8bc 100644 --- a/net/bluetooth/l2cap_core.c +++ b/net/bluetooth/l2cap_core.c @@ -52,7 +52,7 @@ static struct sk_buff *l2cap_build_cmd(struct l2cap_conn *conn, u8 code, u8 ident, u16 dlen, void *data); static void l2cap_send_cmd(struct l2cap_conn *conn, u8 ident, u8 code, u16 len, void *data); -static int l2cap_build_conf_req(struct l2cap_chan *chan, void *data); +static int l2cap_build_conf_req(struct l2cap_chan *chan, void *data, size_t data_size); static void l2cap_send_disconn_req(struct l2cap_chan *chan, int err); static void l2cap_tx(struct l2cap_chan *chan, struct l2cap_ctrl *control, @@ -1283,7 +1283,7 @@ static void l2cap_conn_start(struct l2cap_conn *conn) set_bit(CONF_REQ_SENT, &chan->conf_state); l2cap_send_cmd(conn, l2cap_get_ident(conn), L2CAP_CONF_REQ, - l2cap_build_conf_req(chan, buf), buf); + l2cap_build_conf_req(chan, buf, sizeof(buf)), buf); chan->num_conf_req++; } @@ -2941,12 +2941,15 @@ static inline int l2cap_get_conf_opt(void **ptr, int *type, int *olen, return len; } -static void l2cap_add_conf_opt(void **ptr, u8 type, u8 len, unsigned long val) +static void l2cap_add_conf_opt(void **ptr, u8 type, u8 len, unsigned long val, size_t size) { struct l2cap_conf_opt *opt = *ptr; BT_DBG("type 0x%2.2x len %u val 0x%lx", type, len, val); + if (size < L2CAP_CONF_OPT_SIZE + len) + return; + opt->type = type; opt->len = len; @@ -2971,7 +2974,7 @@ static void l2cap_add_conf_opt(void **ptr, u8 type, u8 len, unsigned long val) *ptr += L2CAP_CONF_OPT_SIZE + len; } -static void l2cap_add_opt_efs(void **ptr, struct l2cap_chan *chan) +static void l2cap_add_opt_efs(void **ptr, struct l2cap_chan *chan, size_t size) { struct l2cap_conf_efs efs; @@ -2999,7 +3002,7 @@ static void l2cap_add_opt_efs(void **ptr, struct l2cap_chan *chan) } l2cap_add_conf_opt(ptr, L2CAP_CONF_EFS, sizeof(efs), - (unsigned long) &efs); + (unsigned long) &efs, size); } static void l2cap_ack_timeout(struct work_struct *work) @@ -3143,11 +3146,12 @@ static inline void l2cap_txwin_setup(struct l2cap_chan *chan) chan->ack_win = chan->tx_win; } -static int l2cap_build_conf_req(struct l2cap_chan *chan, void *data) +static int l2cap_build_conf_req(struct l2cap_chan *chan, void *data, size_t data_size) { struct l2cap_conf_req *req = data; struct l2cap_conf_rfc rfc = { .mode = chan->mode }; void *ptr = req->data; + void *endptr = data + data_size; u16 size; BT_DBG("chan %p", chan); @@ -3172,7 +3176,7 @@ static int l2cap_build_conf_req(struct l2cap_chan *chan, void *data) done: if (chan->imtu != L2CAP_DEFAULT_MTU) - l2cap_add_conf_opt(&ptr, L2CAP_CONF_MTU, 2, chan->imtu); + l2cap_add_conf_opt(&ptr, L2CAP_CONF_MTU, 2, chan->imtu, endptr - ptr); switch (chan->mode) { case L2CAP_MODE_BASIC: @@ -3188,7 +3192,7 @@ done: rfc.max_pdu_size = 0; l2cap_add_conf_opt(&ptr, L2CAP_CONF_RFC, sizeof(rfc), - (unsigned long) &rfc); + (unsigned long) &rfc, endptr - ptr); break; case L2CAP_MODE_ERTM: @@ -3208,21 +3212,21 @@ done: L2CAP_DEFAULT_TX_WINDOW); l2cap_add_conf_opt(&ptr, L2CAP_CONF_RFC, sizeof(rfc), - (unsigned long) &rfc); + (unsigned long) &rfc, endptr - ptr); if (test_bit(FLAG_EFS_ENABLE, &chan->flags)) - l2cap_add_opt_efs(&ptr, chan); + l2cap_add_opt_efs(&ptr, chan, endptr - ptr); if (test_bit(FLAG_EXT_CTRL, &chan->flags)) l2cap_add_conf_opt(&ptr, L2CAP_CONF_EWS, 2, - chan->tx_win); + chan->tx_win, endptr - ptr); if (chan->conn->feat_mask & L2CAP_FEAT_FCS) if (chan->fcs == L2CAP_FCS_NONE || test_bit(CONF_RECV_NO_FCS, &chan->conf_state)) { chan->fcs = L2CAP_FCS_NONE; l2cap_add_conf_opt(&ptr, L2CAP_CONF_FCS, 1, - chan->fcs); + chan->fcs, endptr - ptr); } break; @@ -3240,17 +3244,17 @@ done: rfc.max_pdu_size = cpu_to_le16(size); l2cap_add_conf_opt(&ptr, L2CAP_CONF_RFC, sizeof(rfc), - (unsigned long) &rfc); + (unsigned long) &rfc, endptr - ptr); if (test_bit(FLAG_EFS_ENABLE, &chan->flags)) - l2cap_add_opt_efs(&ptr, chan); + l2cap_add_opt_efs(&ptr, chan, endptr - ptr); if (chan->conn->feat_mask & L2CAP_FEAT_FCS) if (chan->fcs == L2CAP_FCS_NONE || test_bit(CONF_RECV_NO_FCS, &chan->conf_state)) { chan->fcs = L2CAP_FCS_NONE; l2cap_add_conf_opt(&ptr, L2CAP_CONF_FCS, 1, - chan->fcs); + chan->fcs, endptr - ptr); } break; } @@ -3261,10 +3265,11 @@ done: return ptr - data; } -static int l2cap_parse_conf_req(struct l2cap_chan *chan, void *data) +static int l2cap_parse_conf_req(struct l2cap_chan *chan, void *data, size_t data_size) { struct l2cap_conf_rsp *rsp = data; void *ptr = rsp->data; + void *endptr = data + data_size; void *req = chan->conf_req; int len = chan->conf_len; int type, hint, olen; @@ -3366,7 +3371,7 @@ done: return -ECONNREFUSED; l2cap_add_conf_opt(&ptr, L2CAP_CONF_RFC, sizeof(rfc), - (unsigned long) &rfc); + (unsigned long) &rfc, endptr - ptr); } if (result == L2CAP_CONF_SUCCESS) { @@ -3379,7 +3384,7 @@ done: chan->omtu = mtu; set_bit(CONF_MTU_DONE, &chan->conf_state); } - l2cap_add_conf_opt(&ptr, L2CAP_CONF_MTU, 2, chan->omtu); + l2cap_add_conf_opt(&ptr, L2CAP_CONF_MTU, 2, chan->omtu, endptr - ptr); if (remote_efs) { if (chan->local_stype != L2CAP_SERV_NOTRAFIC && @@ -3393,7 +3398,7 @@ done: l2cap_add_conf_opt(&ptr, L2CAP_CONF_EFS, sizeof(efs), - (unsigned long) &efs); + (unsigned long) &efs, endptr - ptr); } else { /* Send PENDING Conf Rsp */ result = L2CAP_CONF_PENDING; @@ -3426,7 +3431,7 @@ done: set_bit(CONF_MODE_DONE, &chan->conf_state); l2cap_add_conf_opt(&ptr, L2CAP_CONF_RFC, - sizeof(rfc), (unsigned long) &rfc); + sizeof(rfc), (unsigned long) &rfc, endptr - ptr); if (test_bit(FLAG_EFS_ENABLE, &chan->flags)) { chan->remote_id = efs.id; @@ -3440,7 +3445,7 @@ done: le32_to_cpu(efs.sdu_itime); l2cap_add_conf_opt(&ptr, L2CAP_CONF_EFS, sizeof(efs), - (unsigned long) &efs); + (unsigned long) &efs, endptr - ptr); } break; @@ -3454,7 +3459,7 @@ done: set_bit(CONF_MODE_DONE, &chan->conf_state); l2cap_add_conf_opt(&ptr, L2CAP_CONF_RFC, sizeof(rfc), - (unsigned long) &rfc); + (unsigned long) &rfc, endptr - ptr); break; @@ -3476,10 +3481,11 @@ done: } static int l2cap_parse_conf_rsp(struct l2cap_chan *chan, void *rsp, int len, - void *data, u16 *result) + void *data, size_t size, u16 *result) { struct l2cap_conf_req *req = data; void *ptr = req->data; + void *endptr = data + size; int type, olen; unsigned long val; struct l2cap_conf_rfc rfc = { .mode = L2CAP_MODE_BASIC }; @@ -3497,13 +3503,13 @@ static int l2cap_parse_conf_rsp(struct l2cap_chan *chan, void *rsp, int len, chan->imtu = L2CAP_DEFAULT_MIN_MTU; } else chan->imtu = val; - l2cap_add_conf_opt(&ptr, L2CAP_CONF_MTU, 2, chan->imtu); + l2cap_add_conf_opt(&ptr, L2CAP_CONF_MTU, 2, chan->imtu, endptr - ptr); break; case L2CAP_CONF_FLUSH_TO: chan->flush_to = val; l2cap_add_conf_opt(&ptr, L2CAP_CONF_FLUSH_TO, - 2, chan->flush_to); + 2, chan->flush_to, endptr - ptr); break; case L2CAP_CONF_RFC: @@ -3517,13 +3523,13 @@ static int l2cap_parse_conf_rsp(struct l2cap_chan *chan, void *rsp, int len, chan->fcs = 0; l2cap_add_conf_opt(&ptr, L2CAP_CONF_RFC, - sizeof(rfc), (unsigned long) &rfc); + sizeof(rfc), (unsigned long) &rfc, endptr - ptr); break; case L2CAP_CONF_EWS: chan->ack_win = min_t(u16, val, chan->ack_win); l2cap_add_conf_opt(&ptr, L2CAP_CONF_EWS, 2, - chan->tx_win); + chan->tx_win, endptr - ptr); break; case L2CAP_CONF_EFS: @@ -3536,7 +3542,7 @@ static int l2cap_parse_conf_rsp(struct l2cap_chan *chan, void *rsp, int len, return -ECONNREFUSED; l2cap_add_conf_opt(&ptr, L2CAP_CONF_EFS, sizeof(efs), - (unsigned long) &efs); + (unsigned long) &efs, endptr - ptr); break; case L2CAP_CONF_FCS: @@ -3624,7 +3630,7 @@ void __l2cap_connect_rsp_defer(struct l2cap_chan *chan) return; l2cap_send_cmd(conn, l2cap_get_ident(conn), L2CAP_CONF_REQ, - l2cap_build_conf_req(chan, buf), buf); + l2cap_build_conf_req(chan, buf, sizeof(buf)), buf); chan->num_conf_req++; } @@ -3828,7 +3834,7 @@ sendresp: u8 buf[128]; set_bit(CONF_REQ_SENT, &chan->conf_state); l2cap_send_cmd(conn, l2cap_get_ident(conn), L2CAP_CONF_REQ, - l2cap_build_conf_req(chan, buf), buf); + l2cap_build_conf_req(chan, buf, sizeof(buf)), buf); chan->num_conf_req++; } @@ -3908,7 +3914,7 @@ static int l2cap_connect_create_rsp(struct l2cap_conn *conn, break; l2cap_send_cmd(conn, l2cap_get_ident(conn), L2CAP_CONF_REQ, - l2cap_build_conf_req(chan, req), req); + l2cap_build_conf_req(chan, req, sizeof(req)), req); chan->num_conf_req++; break; @@ -4012,7 +4018,7 @@ static inline int l2cap_config_req(struct l2cap_conn *conn, } /* Complete config. */ - len = l2cap_parse_conf_req(chan, rsp); + len = l2cap_parse_conf_req(chan, rsp, sizeof(rsp)); if (len < 0) { l2cap_send_disconn_req(chan, ECONNRESET); goto unlock; @@ -4046,7 +4052,7 @@ static inline int l2cap_config_req(struct l2cap_conn *conn, if (!test_and_set_bit(CONF_REQ_SENT, &chan->conf_state)) { u8 buf[64]; l2cap_send_cmd(conn, l2cap_get_ident(conn), L2CAP_CONF_REQ, - l2cap_build_conf_req(chan, buf), buf); + l2cap_build_conf_req(chan, buf, sizeof(buf)), buf); chan->num_conf_req++; } @@ -4106,7 +4112,7 @@ static inline int l2cap_config_rsp(struct l2cap_conn *conn, char buf[64]; len = l2cap_parse_conf_rsp(chan, rsp->data, len, - buf, &result); + buf, sizeof(buf), &result); if (len < 0) { l2cap_send_disconn_req(chan, ECONNRESET); goto done; @@ -4136,7 +4142,7 @@ static inline int l2cap_config_rsp(struct l2cap_conn *conn, /* throw out any old stored conf requests */ result = L2CAP_CONF_SUCCESS; len = l2cap_parse_conf_rsp(chan, rsp->data, len, - req, &result); + req, sizeof(req), &result); if (len < 0) { l2cap_send_disconn_req(chan, ECONNRESET); goto done; @@ -4718,7 +4724,7 @@ static void l2cap_do_create(struct l2cap_chan *chan, int result, set_bit(CONF_REQ_SENT, &chan->conf_state); l2cap_send_cmd(chan->conn, l2cap_get_ident(chan->conn), L2CAP_CONF_REQ, - l2cap_build_conf_req(chan, buf), buf); + l2cap_build_conf_req(chan, buf, sizeof(buf)), buf); chan->num_conf_req++; } } @@ -6604,7 +6610,7 @@ int l2cap_security_cfm(struct hci_conn *hcon, u8 status, u8 encrypt) set_bit(CONF_REQ_SENT, &chan->conf_state); l2cap_send_cmd(conn, l2cap_get_ident(conn), L2CAP_CONF_REQ, - l2cap_build_conf_req(chan, buf), + l2cap_build_conf_req(chan, buf, sizeof(buf)), buf); chan->num_conf_req++; } -- cgit v1.2.3