Skip to content

power: supply: qcom_battmgr: add xiaomi taoyao battery#16

Open
zstas wants to merge 1 commit into
sc7280-mainline:sc7280-6.18.yfrom
zstas:taoyao_sc7280_btr
Open

power: supply: qcom_battmgr: add xiaomi taoyao battery#16
zstas wants to merge 1 commit into
sc7280-mainline:sc7280-6.18.yfrom
zstas:taoyao_sc7280_btr

Conversation

@zstas

@zstas zstas commented Dec 15, 2025

Copy link
Copy Markdown

intoduce taoyao battery that has an additional property between BATT_CHG_CTRL_LIM_MAX and BATT_TEMP and add a hack to adjust properties in runtime to match the battery's properties values

intoduce taoyao battery that has an additional property between
BATT_CHG_CTRL_LIM_MAX and BATT_TEMP and add a hack to adjust properties
in runtime to match the battery's properties values

Signed-off-by: Stanislav Zaikin <zstaseg@gmail.com>
@zstas

zstas commented Dec 15, 2025

Copy link
Copy Markdown
Author

Hello Luca,

this is a weird one. unfortunately, xiaomi likes to come up with non-standard things. and they introduces an additional property for a battery[0] in their downstream driver. I tried to apply a patch that is super minimal in terms of LOC.

right now this is just 1 patch not splitted into several different pieces because I wanted to hear your opinion on other potential ways to handle this particular quirk.

PS I also added you to my fork, so you should be able to force-push to branches in my repo
PPS w/o this patch the battery behaves super weird and gnome-mobile just freezes/stucks

[0] - https://github.com/MiCode/Xiaomi_Kernel_OpenSource/blob/taoyao-s-oss/drivers/power/supply/qti_battery_charger.c#L126

@z3ntu

z3ntu commented Dec 19, 2025

Copy link
Copy Markdown
Member

Hi, could you please send your patch upstream to the mailing lists? I would like to know what the maintainers will say about this approach or if they have an alternative proposal.

@zstas

zstas commented Dec 27, 2025

Copy link
Copy Markdown
Author

I guess I need to upstream the bare minimum for taoyao before doing that (otherwise what would be the point of upstreaming the battery change w/o an actual device).
I'll focus on that, thanks

wrenix pushed a commit to wrenix/linux that referenced this pull request May 7, 2026
commit a355eef upstream.

Currently, the initialization of loongarch_jump_ops does not contain an
assignment to its .free field. This causes disasm_line__free() to fall
through to ins_ops__delete() for LoongArch jump instructions.

ins_ops__delete() will free ins_operands.source.raw and
ins_operands.source.name, and these fields overlaps with
ins_operands.jump.raw_comment and ins_operands.jump.raw_func_start.
Since in loongarch_jump__parse(), these two fields are populated by
strchr()-ing the same buffer, trying to free them will lead to undefined
behavior.

This invalid free usually leads to crashes:

        Process 1712902 (perf) of user 1000 dumped core.
        Stack trace of thread 1712902:
        #0  0x00007fffef155c58 n/a (libc.so.6 + 0x95c58)
        sc7280-mainline#1  0x00007fffef0f7a94 raise (libc.so.6 + 0x37a94)
        sc7280-mainline#2  0x00007fffef0dd6a8 abort (libc.so.6 + 0x1d6a8)
        sc7280-mainline#3  0x00007fffef145490 n/a (libc.so.6 + 0x85490)
        sc7280-mainline#4  0x00007fffef1646f4 n/a (libc.so.6 + 0xa46f4)
        sc7280-mainline#5  0x00007fffef164718 n/a (libc.so.6 + 0xa4718)
        sc7280-mainline#6  0x00005555583a6764 __zfree (/home/csmantle/dist/linux-arch/tools/perf/perf + 0x106764)
        sc7280-mainline#7  0x000055555854fb70 disasm_line__free (/home/csmantle/dist/linux-arch/tools/perf/perf + 0x2afb70)
        sc7280-mainline#8  0x000055555853d618 annotated_source__purge (/home/csmantle/dist/linux-arch/tools/perf/perf + 0x29d618)
        sc7280-mainline#9  0x000055555852300c __hist_entry__tui_annotate (/home/csmantle/dist/linux-arch/tools/perf/perf + 0x28300c)
        sc7280-mainline#10 0x0000555558526718 do_annotate (/home/csmantle/dist/linux-arch/tools/perf/perf + 0x286718)
        sc7280-mainline#11 0x000055555852ed94 evsel__hists_browse (/home/csmantle/dist/linux-arch/tools/perf/perf + 0x28ed94)
        sc7280-mainline#12 0x000055555831fdd0 cmd_report (/home/csmantle/dist/linux-arch/tools/perf/perf + 0x7fdd0)
        sc7280-mainline#13 0x000055555839b644 handle_internal_command (/home/csmantle/dist/linux-arch/tools/perf/perf + 0xfb644)
        sc7280-mainline#14 0x00005555582fe6ac main (/home/csmantle/dist/linux-arch/tools/perf/perf + 0x5e6ac)
        sc7280-mainline#15 0x00007fffef0ddd90 n/a (libc.so.6 + 0x1dd90)
        sc7280-mainline#16 0x00007fffef0ddf0c __libc_start_main (libc.so.6 + 0x1df0c)
        sc7280-mainline#17 0x00005555582fed10 _start (/home/csmantle/dist/linux-arch/tools/perf/perf + 0x5ed10)
        ELF object binary architecture: LoongArch

... and it can be confirmed with Valgrind:

        ==1721834== Invalid free() / delete / delete[] / realloc()
        ==1721834==    at 0x4EA9014: free (in /usr/lib/valgrind/vgpreload_memcheck-loongarch64-linux.so)
        ==1721834==    by 0x4106287: __zfree (zalloc.c:13)
        ==1721834==    by 0x42ADC8F: disasm_line__free (in /home/csmantle/dist/linux-arch/tools/perf/perf)
        ==1721834==    by 0x429B737: annotated_source__purge (in /home/csmantle/dist/linux-arch/tools/perf/perf)
        ==1721834==    by 0x42811EB: __hist_entry__tui_annotate (in /home/csmantle/dist/linux-arch/tools/perf/perf)
        ==1721834==    by 0x42848D7: do_annotate (in /home/csmantle/dist/linux-arch/tools/perf/perf)
        ==1721834==    by 0x428CF33: evsel__hists_browse (in /home/csmantle/dist/linux-arch/tools/perf/perf)
        ==1721834==  Address 0x7d34303 is 35 bytes inside a block of size 62 alloc'd
        ==1721834==    at 0x4EA59B8: malloc (in /usr/lib/valgrind/vgpreload_memcheck-loongarch64-linux.so)
        ==1721834==    by 0x6B80B6F: strdup (strdup.c:42)
        ==1721834==    by 0x42AD917: disasm_line__new (in /home/csmantle/dist/linux-arch/tools/perf/perf)
        ==1721834==    by 0x42AE5A3: symbol__disassemble_objdump (in /home/csmantle/dist/linux-arch/tools/perf/perf)
        ==1721834==    by 0x42AF0A7: symbol__disassemble (in /home/csmantle/dist/linux-arch/tools/perf/perf)
        ==1721834==    by 0x429B3CF: symbol__annotate (in /home/csmantle/dist/linux-arch/tools/perf/perf)
        ==1721834==    by 0x429C233: symbol__annotate2 (in /home/csmantle/dist/linux-arch/tools/perf/perf)
        ==1721834==    by 0x42804D3: __hist_entry__tui_annotate (in /home/csmantle/dist/linux-arch/tools/perf/perf)
        ==1721834==    by 0x42848D7: do_annotate (in /home/csmantle/dist/linux-arch/tools/perf/perf)
        ==1721834==    by 0x428CF33: evsel__hists_browse (in /home/csmantle/dist/linux-arch/tools/perf/perf)

This patch adds the missing free() specialization in loongarch_jump_ops,
which prevents disasm_line__free() from invoking the default cleanup
function.

Fixes: fb7fd2a ("perf annotate: Move raw_comment and raw_func_start fields out of 'struct ins_operands'")
Cc: stable@vger.kernel.org
Cc: WANG Rui <wangrui@loongson.cn>
Cc: Huacai Chen <chenhuacai@kernel.org>
Cc: WANG Xuerui <kernel@xen0n.name>
Cc: loongarch@lists.linux.dev
Signed-off-by: Rong Bao <rong.bao@csmantle.top>
Tested-by: WANG Rui <wangrui@loongson.cn>
Signed-off-by: Namhyung Kim <namhyung@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants