5.10.261-rc1 review
Subsystems (4)
Greg Kroah-Hartman
maintainerPATCH 579/699 crypto: crypto4xx - Remove insecure and unused rng_alg
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eric Biggers <[email protected]>
commit 7811ec9e973d2c9e465083699f0c8240b98cb8c4 upstream.
Remove crypto4xx_rng, as it is insecure and unused:
- It has only a 64-bit security strength, which is highly inadequate. This can be seen by the fact that crypto4xx_hw_init() seeds it with only 64 bits of entropy, and the fact that the original commit mentions that it implements ANSI X9.17 Annex C.
Another issue was that this driver didn't implement the crypto_rng API correctly, as crypto4xx_prng_generate() didn't return 0 on success.
- No user of this code is known. It's usable only theoretically via the "rng" algorithm type of AF_ALG. But userspace actually just uses the actual Linux RNG (/dev/random etc) instead. And rng_algs don't contribute entropy to the actual Linux RNG either. (This may have been confused with hwrng, which does contribute entropy.)
--- drivers/crypto/amcc/crypto4xx_core.c | 87 -------------------------------- drivers/crypto/amcc/crypto4xx_core.h | 4 - drivers/crypto/amcc/crypto4xx_reg_def.h | 11 ---- 3 files changed, 102 deletions(-)
drivers/crypto/amcc/crypto4xx_core.c +0 -87
@@ -31,11 +31,9 @@#include <crypto/ctr.h> #include <crypto/gcm.h> #include <crypto/sha.h> -#include <crypto/rng.h> #include <crypto/scatterwalk.h> #include <crypto/skcipher.h> #include <crypto/internal/aead.h> -#include <crypto/internal/rng.h> #include <crypto/internal/skcipher.h> #include "crypto4xx_reg_def.h" #include "crypto4xx_core.h"
@@ -989,10 +987,6 @@ static int crypto4xx_register_alg(struct rc =crypto_register_aead (&alg->alg.u.aead);break ; -case CRYPTO_ALG_TYPE_RNG : - rc =crypto_register_rng (&alg->alg.u.rng); -break ; -default : rc =crypto_register_skcipher (&alg->alg.u.cipher);break ;
@@ -1018,10 +1012,6 @@ static void crypto4xx_unregister_alg(strcrypto_unregister_aead (&alg->alg.u.aead);break ; -case CRYPTO_ALG_TYPE_RNG : -crypto_unregister_rng (&alg->alg.u.rng); -break ; -default :crypto_unregister_skcipher (&alg->alg.u.cipher); }
@@ -1080,69 +1070,6 @@ static irqreturn_t crypto4xx_ce_interrup PPC4XX_TMO_ERR_INT); } -static int ppc4xx_prng_data_read (struct crypto4xx_device *dev, -u8 *data,unsigned int max) -{ -unsigned int i, curr =0 ; -u32 val[2 ]; - -do { -/* trigger PRN generation */ -writel (PPC4XX_PRNG_CTRL_AUTO_EN , - dev->ce_base +CRYPTO4XX_PRNG_CTRL ); - -for (i =0 ; i <1024 ; i++) { -/* usually 19 iterations are enough */ -if ((readl (dev->ce_base +CRYPTO4XX_PRNG_STAT ) & -CRYPTO4XX_PRNG_STAT_BUSY )) -continue ; - - val[0 ] =readl_be (dev->ce_base +CRYPTO4XX_PRNG_RES_0 ); - val[1 ] =readl_be (dev->ce_base +CRYPTO4XX_PRNG_RES_1 ); -break ; - } -if (i ==1024 ) -return -ETIMEDOUT ; - -if ((max - curr) >=8 ) { -memcpy (data, &val,8 ); - data +=8 ; - curr +=8 ; - }else { -/* copy only remaining bytes */ -memcpy (data, &val, max - curr); -break ; - } - }while (curr < max); - -return curr; -} - -static int crypto4xx_prng_generate (struct crypto_rng *tfm, -const u8 *src,unsigned int slen, -u8 *dstn,unsigned int dlen) -{ -struct rng_alg *alg =crypto_rng_alg (tfm); -struct crypto4xx_alg *amcc_alg; -struct crypto4xx_device *dev; -int ret; - - amcc_alg = container_of(alg, struct crypto4xx_alg, alg.u.rng); - dev = amcc_alg->dev; - -mutex_lock (&dev->core_dev->rng_lock); - ret =ppc4xx_prng_data_read (dev, dstn, dlen); -mutex_unlock (&dev->core_dev->rng_lock); -return ret; -} - - -static int crypto4xx_prng_seed (struct crypto_rng *tfm,const u8 *seed, -unsigned int slen) -{ -return 0 ; -} -/* * Supported Crypto Algorithms */
@@ -1312,18 +1239,6 @@ static struct crypto4xx_alg_common crypt .cra_module = THIS_MODULE, }, } }, - { .type = CRYPTO_ALG_TYPE_RNG, .u.rng = { - .base = { - .cra_name = "stdrng", - .cra_driver_name = "crypto4xx_rng", - .cra_priority = 300, - .cra_ctxsize = 0, - .cra_module = THIS_MODULE, - }, - .generate = crypto4xx_prng_generate, - .seed = crypto4xx_prng_seed, - .seedsize = 0, - } }, };/*
@@ -1393,7 +1308,6 @@ static int crypto4xx_probe(struct platfo core_dev->dev->core_dev = core_dev; core_dev->dev->is_revb = is_revb; core_dev->device = dev; -mutex_init (&core_dev->rng_lock);spin_lock_init (&core_dev->lock);INIT_LIST_HEAD (&core_dev->dev->alg_list);ratelimit_default_init (&core_dev->dev->aead_ratelimit);
@@ -1471,7 +1385,6 @@ static int crypto4xx_remove(struct platftasklet_kill (&core_dev->tasklet);/* Un-register with Linux CryptoAPI */ crypto4xx_unregister_alg (core_dev->dev); -mutex_destroy (&core_dev->rng_lock);/* Free all allocated memory */ crypto4xx_stop_all (core_dev);
drivers/crypto/amcc/crypto4xx_core.h +0 -4
@@ -14,10 +14,8 @@#define __CRYPTO4XX_CORE_H__#include <linux/ratelimit.h> -#include <linux/mutex.h> #include <linux/scatterlist.h> #include <crypto/internal/aead.h> -#include <crypto/internal/rng.h> #include <crypto/internal/skcipher.h> #include "crypto4xx_reg_def.h" #include "crypto4xx_sa.h"
@@ -111,7 +109,6 @@ struct crypto4xx_core_device {u32 irq;struct tasklet_struct tasklet;spinlock_t lock; -struct mutex rng_lock; };struct crypto4xx_ctx {
@@ -135,7 +132,6 @@ struct crypto4xx_alg_common {union {struct skcipher_alg cipher;struct aead_alg aead; -struct rng_alg rng; } u; };
drivers/crypto/amcc/crypto4xx_reg_def.h +0 -11
@@ -90,20 +90,9 @@#define CRYPTO4XX_BYTE_ORDER_CFG 0x000600d8#define CRYPTO4XX_ENDIAN_CFG 0x000600d8 -#define CRYPTO4XX_PRNG_STAT 0x00070000 -#define CRYPTO4XX_PRNG_STAT_BUSY 0x1#define CRYPTO4XX_PRNG_CTRL 0x00070004#define CRYPTO4XX_PRNG_SEED_L 0x00070008#define CRYPTO4XX_PRNG_SEED_H 0x0007000c - -#define CRYPTO4XX_PRNG_RES_0 0x00070020 -#define CRYPTO4XX_PRNG_RES_1 0x00070024 -#define CRYPTO4XX_PRNG_RES_2 0x00070028 -#define CRYPTO4XX_PRNG_RES_3 0x0007002C - -#define CRYPTO4XX_PRNG_LFSR_L 0x00070030 -#define CRYPTO4XX_PRNG_LFSR_H 0x00070034 -/* * Initialize CRYPTO ENGINE registers, and memory bases. */
Greg Kroah-Hartman
maintainerPATCH 580/699 batman-adv: clean untagged VLAN on netdev registration failure
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sven Eckelmann <[email protected]>
commit 8669a550c752d86baebc5fdc83b8ff35c4372c0e upstream.
When an mesh interface is registered, it creates an untagged struct batadv_meshif_vlan on top of it via the NETDEV_REGISTER notifier. But in this process, another receiver of this notification can veto the registration. The netdev registration will be aborted because of this veto.
The register_netdevice() call will try to clean up the net_device using unregister_netdevice_queue() - which only uses the .priv_destructor to free private resources. In this situation, .dellink will not be called.
The cleanup of the untagged batadv_meshif_vlan must thefore be done in the destructor to avoid a leak of this object.
[ switch to old "mesh_iface" name "soft_iface", Context, keep early
batadv_softif_destroy_netlink() cleanup in case sysfs support is active, only run destructor VLAN code on non-softif_destroy context ]
--- net/batman-adv/main.c | 17 +++++++++++++++++ net/batman-adv/soft-interface.c | 7 +++++-- net/batman-adv/soft-interface.h | 2 ++ net/batman-adv/types.h | 7 +++++++ 4 files changed, 31 insertions(+), 2 deletions(-)
net/batman-adv/main.c +17 -0
@@ -265,6 +265,7 @@ err_orig:void batadv_mesh_free (struct net_device *soft_iface) {struct batadv_priv *bat_priv =netdev_priv (soft_iface); +struct batadv_softif_vlan *vlan;atomic_set (&bat_priv->mesh_state,BATADV_MESH_DEACTIVATING );
@@ -280,6 +281,22 @@ void batadv_mesh_free(struct net_devicebatadv_mcast_free (bat_priv); +/* destroy the "untagged" VLAN in case of an register_netdevice() error. +* +* It will be handled normally by batadv_softif_destroy_netlink() and +* batadv_softif_destroy_sysfs() before they call batadv_sysfs_del_meshif(). +* +* But when a veto was received during the registration, the VLAN has to +* be cleaned up in the destructor. +*/ +if (!bat_priv->softif_destroy) { + vlan =batadv_softif_vlan_get (bat_priv,BATADV_NO_FLAGS ); +if (vlan) { +batadv_softif_destroy_vlan (bat_priv, vlan); +batadv_softif_vlan_put (vlan); + } + } +/* Free the TT and the originator tables only after having terminated * all the other depending components which may use these structures for * their purposes.
net/batman-adv/soft-interface.c +5 -2
@@ -629,8 +629,8 @@ int batadv_softif_create_vlan(struct bat* @bat_priv: the bat priv with all the soft interface information * @vlan: the object to remove */ -static void batadv_softif_destroy_vlan (struct batadv_priv *bat_priv, -struct batadv_softif_vlan *vlan) +void batadv_softif_destroy_vlan (struct batadv_priv *bat_priv, +struct batadv_softif_vlan *vlan) {/* explicitly remove the associated TT local entry because it is marked * with the NOPURGE flag
@@ -834,6 +834,7 @@ static int batadv_softif_init_late(struc bat_priv->tt.last_changeset_len =0 ; bat_priv->isolation_mark =0 ; bat_priv->isolation_mark_mask =0 ; + bat_priv->softif_destroy = false;/* randomize initial seqno to avoid collision */ get_random_bytes (&random_seqno,sizeof (random_seqno));
@@ -1121,6 +1122,7 @@ void batadv_softif_destroy_sysfs(structbatadv_softif_vlan_put (vlan); } + bat_priv->softif_destroy = true;batadv_sysfs_del_meshif (soft_iface);unregister_netdevice (soft_iface); }
@@ -1151,6 +1153,7 @@ static void batadv_softif_destroy_netlinbatadv_softif_vlan_put (vlan); } + bat_priv->softif_destroy = true;batadv_sysfs_del_meshif (soft_iface);unregister_netdevice_queue (soft_iface, head); }
net/batman-adv/soft-interface.h +2 -0
@@ -25,6 +25,8 @@ void batadv_softif_destroy_sysfs(structbool batadv_softif_is_valid (const struct net_device *net_dev);extern struct rtnl_link_ops batadv_link_ops;int batadv_softif_create_vlan (struct batadv_priv *bat_priv,unsigned short vid); +void batadv_softif_destroy_vlan (struct batadv_priv *bat_priv, +struct batadv_softif_vlan *vlan);void batadv_softif_vlan_release (struct kref *ref);struct batadv_softif_vlan *batadv_softif_vlan_get (struct batadv_priv *bat_priv,unsigned short vid);
net/batman-adv/types.h +7 -0
@@ -1791,6 +1791,13 @@ struct batadv_priv {/** @bat_v: B.A.T.M.A.N. V per soft-interface private data */ struct batadv_priv_bat_v bat_v;#endif + +/** +* @softif_destroy: whether the mesh_free() is called via the +* batadv_softif_destroy_sysfs() or batadv_softif_destroy_netlink() +* codepath and doesn't have to clean up the untagged VLAN (sysfs) +*/ + bool softif_destroy:1; };/**
Greg Kroah-Hartman
maintainerPATCH 581/699 ACPI: NFIT: core: Fix acpi_nfit_init() error cleanup
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: "Rafael J. Wysocki" <[email protected]>
[ Upstream commit 38bf27511ef41bffebd157ec3eba41fc89ba59cd ]
If acpi_nfit_init() fails after adding the acpi_desc object to the acpi_descs list, that object is never removed from that list because the acpi_nfit_shutdown() devm action is not added for the NFIT device in that case. Next, the acpi_nfit_init() failure causes acpi_nfit_probe() to fail, the acpi_desc object is freed, and a dangling pointer is left behind in the acpi_descs. Any subsequent ACPI Machine Check Exception will trigger nfit_handle_mce() which iterates over acpi_descs and so a use-after-free will occur.
Moreover, if acpi_nfit_probe() returns 0 after installing a notify handler for the NFIT device and without allocating the acpi_desc object and setting the NFIT device's driver data pointer, the acpi_desc object will be allocated by acpi_nfit_update_notify() and acpi_nfit_init() will be called to initialize it. Regardless of whether or not acpi_nfit_init() fails in that case, the acpi_nfit_shutdown() devm action is not added for the NFIT device and acpi_desc is never removed from the acpi_descs list. If the acpi_desc object is freed subsequently on driver removal, any subsequent ACPI MCE will lead to a use-after-free like in the previous case.
To address the first issue mentioned above, make acpi_nfit_probe() call acpi_nfit_shutdown() directly on acpi_nfit_init() failures and to address the other one, add a remove callback to the driver and make it call acpi_nfit_shutdown(). Also, since it is now possible to pass NULL to acpi_nfit_shutdown() or the acpi_desc object passed to it may not have been initialized, add checks against NULL for acpi_desc and its nvdimm_bus field to that function and make acpi_nfit_unregister() clear the latter after unregistering the NVDIMM bus.
--- drivers/acpi/nfit/core.c | 15 +++++++++++---- 1 file changed, 11 insertions(+), 4 deletions(-)
drivers/acpi/nfit/core.c +11 -4
@@ -3456,6 +3456,8 @@ static void acpi_nfit_unregister(void *dstruct acpi_nfit_desc *acpi_desc = data;nvdimm_bus_unregister (acpi_desc->nvdimm_bus); +/* The nvdimm_bus object may have been freed, so clear the pointer. */ + acpi_desc->nvdimm_bus =NULL ; }int acpi_nfit_init (struct acpi_nfit_desc *acpi_desc,void *data,acpi_size sz)
@@ -3680,7 +3682,10 @@ static void acpi_nfit_put_table(void *tavoid acpi_nfit_shutdown (void *data) {struct acpi_nfit_desc *acpi_desc = data; -struct device *bus_dev =to_nvdimm_bus_dev (acpi_desc->nvdimm_bus); +struct device *bus_dev; + +if (!acpi_desc || !acpi_desc->nvdimm_bus) +return ;/* * Destruct under acpi_desc_lock so that nfit_handle_mce does not
@@ -3695,6 +3700,7 @@ void acpi_nfit_shutdown(void *data)mutex_unlock (&acpi_desc->init_mutex);cancel_delayed_work_sync (&acpi_desc->dwork); + bus_dev =to_nvdimm_bus_dev (acpi_desc->nvdimm_bus);/* * Bounce the nvdimm bus lock to make sure any in-flight * acpi_nfit_ars_rescan() submissions have had a chance to
@@ -3762,13 +3768,14 @@ static int acpi_nfit_add(struct acpi_dev sz - sizeof(struct acpi_table_nfit));if (rc) -return rc; -return devm_add_action_or_reset (dev, acpi_nfit_shutdown, acpi_desc); +acpi_nfit_shutdown (acpi_desc); + +return rc; }static int acpi_nfit_remove (struct acpi_device *adev) { -/* see acpi_nfit_unregister */ +acpi_nfit_shutdown (dev_get_drvdata (&adev->dev));return 0 ; }
Greg Kroah-Hartman
maintainerPATCH 582/699 iio: imu: adis: add IRQF_NO_THREAD to non-FIFO trigger IRQ
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Runyu Xiao <[email protected]>
[ Upstream commit 6e1b9bff1202da55c464e36bd34a2b6863d7fe30 ]
devm_adis_probe_trigger() registers iio_trigger_generic_data_rdy_poll() through devm_request_irq() on the non-FIFO path, but it does not add IRQF_NO_THREAD to the IRQ flags.
When the kernel is booted with forced IRQ threading, the parent IRQ can otherwise be threaded by the IRQ core and the subsequent IIO trigger child IRQ is then dispatched from irq/... thread context instead of hardirq context. Because iio_trigger_generic_data_rdy_poll() immediately drives iio_trigger_poll(), this violates the hardirq-only IIO trigger helper contract and can push downstream trigger consumers through the wrong execution context.
Add IRQF_NO_THREAD on top of the existing adis->irq_flag value for the non-FIFO request_irq() path, while preserving the current trigger polarity and IRQF_NO_AUTOEN behavior.
--- drivers/iio/imu/adis_trigger.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/iio/imu/adis_trigger.c +1 -1
@@ -84,7 +84,7 @@ int devm_adis_probe_trigger(struct adis ret =devm_request_irq (&adis->spi->dev, adis->spi->irq, &iio_trigger_generic_data_rdy_poll, - adis->irq_flag, + adis->irq_flag |IRQF_NO_THREAD , indio_dev->name, adis->trig);if (ret)
Greg Kroah-Hartman
maintainerPATCH 583/699 iio: hid-sensor-rotation: Fix stale or zero output when reading raw values
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zhang Lixu <[email protected]>
[ Upstream commit 3ce8d099e0afc5a7da75a2007a67f67c4f5a4af1 ]
When reading the raw quaternion attribute (in_rot_quaternion_raw), the driver currently returns either all zeros (if the sensor was never enabled) or stale data (if the sensor was previously enabled) because it reads from the internal buffer without explicitly requesting a new sample from the sensor.
To fix this, power up the sensor, call sensor_hub_input_attr_read_values() to issue a synchronous GET_REPORT and receive the full quaternion data directly into a local buffer, then decode the four components.
--- drivers/iio/orientation/hid-sensor-rotation.c | 40 ++++++++++++++++++++++++-- 1 file changed, 38 insertions(+), 2 deletions(-)
drivers/iio/orientation/hid-sensor-rotation.c +38 -2
@@ -60,6 +60,13 @@ static int dev_rot_read_raw(struct iio_d long mask) {struct dev_rot_state *rot_state =iio_priv (indio_dev); +struct hid_sensor_hub_device *hsdev = rot_state->common_attributes.hsdev; +struct hid_sensor_hub_attribute_info *info = &rot_state->quaternion; +u32 usage_id =HID_USAGE_SENSOR_ORIENT_QUATERNION ; +union { +s16 val16[4 ]; +s32 val32[4 ]; + } raw_buf;int ret_type;int i;
@@ -69,8 +76,37 @@ static int dev_rot_read_raw(struct iio_dswitch (mask) {case IIO_CHAN_INFO_RAW :if (size >=4 ) { -for (i =0 ; i <4 ; ++i) - vals[i] = rot_state->sampled_vals[i]; +if (info->size <=0 || info->size >sizeof (raw_buf)) +return -EINVAL ; + +hid_sensor_power_state (&rot_state->common_attributes, true); + + ret_type =sensor_hub_input_attr_read_values (hsdev, + hsdev->usage, + usage_id, + info->report_id, +SENSOR_HUB_SYNC , + info->size, + (u8 *)&raw_buf); + +hid_sensor_power_state (&rot_state->common_attributes, false); + +if (ret_type <0 ) +return ret_type; + +switch (info->size) { +case sizeof (raw_buf.val16): +for (i =0 ; i <ARRAY_SIZE (raw_buf.val16); i++) + vals[i] = raw_buf.val16[i]; +break ; +case sizeof (raw_buf.val32): +for (i =0 ; i <ARRAY_SIZE (raw_buf.val32); i++) + vals[i] = raw_buf.val32[i]; +break ; +default : +return -EINVAL ; + } + ret_type =IIO_VAL_INT_MULTIPLE ; *val_len =4 ; }else
Greg Kroah-Hartman
maintainerPATCH 584/699 iio: imu: inv_icm42600: make timestamp module chip independent
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jean-Baptiste Maneyrol <[email protected]>
[ Upstream commit 6e9f2d8375cb24ba75e02e0272e9164d06a1522e ]
Move icm42600 dependent function inside the core module. Do some headers cleanup at the same time.
Stable-dep-of: affe3f077d7a ("iio: imu: inv_icm42600: fix timestamping by limiting FIFO reading")
--- drivers/iio/imu/inv_icm42600/inv_icm42600_core.c | 11 +++++++++++ drivers/iio/imu/inv_icm42600/inv_icm42600_timestamp.c | 14 +------------- drivers/iio/imu/inv_icm42600/inv_icm42600_timestamp.h | 6 ------ 3 files changed, 12 insertions(+), 19 deletions(-)
drivers/iio/imu/inv_icm42600/inv_icm42600_core.c +11 -0
@@ -522,6 +522,17 @@ static int inv_icm42600_irq_init(struct "inv_icm42600", st); } +static int inv_icm42600_timestamp_setup (struct inv_icm42600_state *st) +{ +unsigned int val; + +/* enable timestamp register */ + val =INV_ICM42600_TMST_CONFIG_TMST_TO_REGS_EN | +INV_ICM42600_TMST_CONFIG_TMST_EN ; +return regmap_update_bits (st->map,INV_ICM42600_REG_TMST_CONFIG , +INV_ICM42600_TMST_CONFIG_MASK , val); +} +static int inv_icm42600_enable_regulator_vddio (struct inv_icm42600_state *st) {int ret;
drivers/iio/imu/inv_icm42600/inv_icm42600_timestamp.c +1 -13
@@ -3,11 +3,10 @@* Copyright (C) 2020 Invensense, Inc. */ +#include <linux/errno.h> #include <linux/kernel.h> -#include <linux/regmap.h> #include <linux/math64.h> -#include "inv_icm42600.h" #include "inv_icm42600_timestamp.h" /* internal chip period is 32kHz, 31250ns */
@@ -56,17 +55,6 @@ void inv_icm42600_timestamp_init(structinv_update_acc (&ts->chip_period,INV_ICM42600_TIMESTAMP_PERIOD ); } -int inv_icm42600_timestamp_setup (struct inv_icm42600_state *st) -{ -unsigned int val; - -/* enable timestamp register */ - val =INV_ICM42600_TMST_CONFIG_TMST_TO_REGS_EN | -INV_ICM42600_TMST_CONFIG_TMST_EN ; -return regmap_update_bits (st->map,INV_ICM42600_REG_TMST_CONFIG , -INV_ICM42600_TMST_CONFIG_MASK , val); -} -int inv_icm42600_timestamp_update_odr (struct inv_icm42600_timestamp *ts,uint32_t period,bool fifo) {
drivers/iio/imu/inv_icm42600/inv_icm42600_timestamp.h +0 -6
@@ -6,10 +6,6 @@#ifndef INV_ICM42600_TIMESTAMP_H_ #define INV_ICM42600_TIMESTAMP_H_ -#include <linux/kernel.h> - -struct inv_icm42600_state ; -/** * struct inv_icm42600_timestamp_interval - timestamps interval * @lo: interval lower bound
@@ -53,8 +49,6 @@ struct inv_icm42600_timestamp {void inv_icm42600_timestamp_init (struct inv_icm42600_timestamp *ts,uint32_t period); -int inv_icm42600_timestamp_setup (struct inv_icm42600_state *st); -int inv_icm42600_timestamp_update_odr (struct inv_icm42600_timestamp *ts,uint32_t period,bool fifo);
Greg Kroah-Hartman
maintainerPATCH 585/699 iio: move inv_icm42600 timestamp module in common
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jean-Baptiste Maneyrol <[email protected]>
[ Upstream commit d99ff463ecf651437e9e4abe68f331dfb6b5bd9d ]
Create new inv_sensors common modules and move inv_icm42600 timestamp module inside. This module will be used by IMUs and also in the future by other chips.
Modify inv_icm42600 driver to use timestamp module and do some headers cleanup.
Stable-dep-of: affe3f077d7a ("iio: imu: inv_icm42600: fix timestamping by limiting FIFO reading")
---
drivers/iio/common/Kconfig | 1 +
drivers/iio/common/Makefile | 1 +
drivers/iio/common/inv_sensors/Kconfig | 7 +++++++
drivers/iio/common/inv_sensors/Makefile | 6 ++++++
.../inv_sensors}/inv_icm42600_timestamp.c | 11 ++++++++++-
drivers/iio/imu/inv_icm42600/Kconfig | 1 +
drivers/iio/imu/inv_icm42600/Makefile | 1 -
drivers/iio/imu/inv_icm42600/inv_icm42600_accel.c | 5 +++--
drivers/iio/imu/inv_icm42600/inv_icm42600_buffer.c | 5 +++--
drivers/iio/imu/inv_icm42600/inv_icm42600_core.c | 4 +++-
drivers/iio/imu/inv_icm42600/inv_icm42600_gyro.c | 5 +++--
.../linux/iio/common}/inv_icm42600_timestamp.h | 0
drivers/iio/common/Kconfig | 1
drivers/iio/common/Makefile | 1
drivers/iio/common/inv_sensors/Kconfig | 7
drivers/iio/common/inv_sensors/Makefile | 6
drivers/iio/common/inv_sensors/inv_icm42600_timestamp.c | 192 ++++++++++++++++
drivers/iio/imu/inv_icm42600/Kconfig | 1
drivers/iio/imu/inv_icm42600/Makefile | 1
drivers/iio/imu/inv_icm42600/inv_icm42600_accel.c | 5
drivers/iio/imu/inv_icm42600/inv_icm42600_buffer.c | 5
drivers/iio/imu/inv_icm42600/inv_icm42600_core.c | 4
drivers/iio/imu/inv_icm42600/inv_icm42600_gyro.c | 5
drivers/iio/imu/inv_icm42600/inv_icm42600_timestamp.c | 183 ---------------
drivers/iio/imu/inv_icm42600/inv_icm42600_timestamp.h | 79 ------
include/linux/iio/common/inv_icm42600_timestamp.h | 79 ++++++
14 files changed, 299 insertions(+), 270 deletions(-)
create mode 100644 drivers/iio/common/inv_sensors/Kconfig
create mode 100644 drivers/iio/common/inv_sensors/Makefile
rename drivers/iio/{imu/inv_icm42600 => common/inv_sensors}/inv_icm42600_timestamp.c (91%)
rename {drivers/iio/imu/inv_icm42600 => include/linux/iio/common}/inv_icm42600_timestamp.h (100%)drivers/iio/common/Kconfig +1 -0
@@ -5,6 +5,7 @@ source "drivers/iio/common/cros_ec_sensors/Kconfig" source "drivers/iio/common/hid-sensors/Kconfig" +source "drivers/iio/common/inv_sensors/Kconfig" source "drivers/iio/common/ms_sensors/Kconfig" source "drivers/iio/common/ssp_sensors/Kconfig" source "drivers/iio/common/st_sensors/Kconfig"
drivers/iio/common/Makefile +1 -0
@@ -10,6 +10,7 @@ # When adding new entries keep the list in alphabetical order obj-y += cros_ec_sensors/ obj-y += hid-sensors/ +obj-y += inv_sensors/ obj-y += ms_sensors/ obj-y += ssp_sensors/ obj-y += st_sensors/
drivers/iio/common/inv_sensors/Kconfig new file +7 -0
@@ -0,0 +1,7 @@ +# SPDX-License-Identifier: GPL-2.0-only +# +# TDK-InvenSense sensors common library +# + +config IIO_INV_SENSORS_TIMESTAMP + tristate
drivers/iio/common/inv_sensors/Makefile new file +6 -0
@@ -0,0 +1,6 @@ +# SPDX-License-Identifier: GPL-2.0 +# +# Makefile for TDK-InvenSense sensors module. +# + +obj-$(CONFIG_IIO_INV_SENSORS_TIMESTAMP) += inv_icm42600_timestamp.o
drivers/iio/common/inv_sensors/inv_icm42600_timestamp.c new file +192 -0
192 lines not on this page · raw message
drivers/iio/imu/inv_icm42600/Kconfig +1 -0
@@ -3,6 +3,7 @@ config INV_ICM42600 tristate select IIO_BUFFER + select IIO_INV_SENSORS_TIMESTAMP config INV_ICM42600_I2C tristate "InvenSense ICM-426xx I2C driver"
drivers/iio/imu/inv_icm42600/Makefile +0 -1
@@ -6,7 +6,6 @@ inv-icm42600-y += inv_icm42600_gyro.o inv-icm42600-y += inv_icm42600_accel.o inv-icm42600-y += inv_icm42600_temp.o inv-icm42600-y += inv_icm42600_buffer.o -inv-icm42600-y += inv_icm42600_timestamp.o obj-$(CONFIG_INV_ICM42600_I2C) += inv-icm42600-i2c.o inv-icm42600-i2c-y += inv_icm42600_i2c.o
drivers/iio/imu/inv_icm42600/inv_icm42600_accel.c +3 -2
@@ -10,14 +10,15 @@#include <linux/regmap.h> #include <linux/delay.h> #include <linux/math64.h> -#include <linux/iio/iio.h> +#include <linux/iio/buffer.h> +#include <linux/iio/common/inv_icm42600_timestamp.h> +#include <linux/iio/iio.h> #include <linux/iio/kfifo_buf.h> #include "inv_icm42600.h" #include "inv_icm42600_temp.h" #include "inv_icm42600_buffer.h" -#include "inv_icm42600_timestamp.h" #define INV_ICM42600_ACCEL_CHAN (_modifier, _index, _ext_info) \ { \
drivers/iio/imu/inv_icm42600/inv_icm42600_buffer.c +3 -2
@@ -9,11 +9,12 @@#include <linux/pm_runtime.h> #include <linux/regmap.h> #include <linux/delay.h> -#include <linux/iio/iio.h> +#include <linux/iio/buffer.h> +#include <linux/iio/common/inv_icm42600_timestamp.h> +#include <linux/iio/iio.h> #include "inv_icm42600.h" -#include "inv_icm42600_timestamp.h" #include "inv_icm42600_buffer.h" /* FIFO header: 1 byte */
drivers/iio/imu/inv_icm42600/inv_icm42600_core.c +3 -1
@@ -15,11 +15,12 @@#include <linux/pm_runtime.h> #include <linux/property.h> #include <linux/regmap.h> + +#include <linux/iio/common/inv_icm42600_timestamp.h> #include <linux/iio/iio.h> #include "inv_icm42600.h" #include "inv_icm42600_buffer.h" -#include "inv_icm42600_timestamp.h" static const struct regmap_range_cfg inv_icm42600_regmap_ranges[] = { {
@@ -798,3 +799,4 @@ EXPORT_SYMBOL_GPL(inv_icm42600_pm_ops);MODULE_AUTHOR ("InvenSense, Inc." );MODULE_DESCRIPTION ("InvenSense ICM-426xx device driver" );MODULE_LICENSE ("GPL" ); +MODULE_IMPORT_NS (IIO_INV_SENSORS_TIMESTAMP );
drivers/iio/imu/inv_icm42600/inv_icm42600_gyro.c +3 -2
@@ -10,14 +10,15 @@#include <linux/regmap.h> #include <linux/delay.h> #include <linux/math64.h> -#include <linux/iio/iio.h> +#include <linux/iio/buffer.h> +#include <linux/iio/common/inv_icm42600_timestamp.h> +#include <linux/iio/iio.h> #include <linux/iio/kfifo_buf.h> #include "inv_icm42600.h" #include "inv_icm42600_temp.h" #include "inv_icm42600_buffer.h" -#include "inv_icm42600_timestamp.h" #define INV_ICM42600_GYRO_CHAN (_modifier, _index, _ext_info) \ { \
drivers/iio/imu/inv_icm42600/inv_icm42600_timestamp.c deleted +0 -183
183 lines not on this page · raw message
drivers/iio/imu/inv_icm42600/inv_icm42600_timestamp.h deleted +0 -79
79 lines not on this page · raw message
include/linux/iio/common/inv_icm42600_timestamp.h new file +79 -0
79 lines not on this page · raw message
Greg Kroah-Hartman
maintainerPATCH 586/699 iio: make invensense timestamp module generic
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jean-Baptiste Maneyrol <[email protected]>
[ Upstream commit 0ecc363ccea71eda6a2cceade120489259bcdb33 ]
Rename common module to inv_sensors_timestamp, add configuration at init (chip internal clock, acceptable jitter, ...) and update inv_icm42600 driver integration.
Stable-dep-of: affe3f077d7a ("iio: imu: inv_icm42600: fix timestamping by limiting FIFO reading")
---
drivers/iio/common/inv_sensors/Makefile | 2
drivers/iio/common/inv_sensors/inv_icm42600_timestamp.c | 192 ----------------
drivers/iio/common/inv_sensors/inv_sensors_timestamp.c | 191 +++++++++++++++
drivers/iio/imu/inv_icm42600/inv_icm42600_accel.c | 32 +-
drivers/iio/imu/inv_icm42600/inv_icm42600_buffer.c | 34 +-
drivers/iio/imu/inv_icm42600/inv_icm42600_core.c | 10
drivers/iio/imu/inv_icm42600/inv_icm42600_gyro.c | 32 +-
include/linux/iio/common/inv_icm42600_timestamp.h | 79 ------
include/linux/iio/common/inv_sensors_timestamp.h | 95 +++++++
9 files changed, 349 insertions(+), 318 deletions(-)
rename drivers/iio/common/inv_sensors/{inv_icm42600_timestamp.c => inv_sensors_timestamp.c} (61%)
delete mode 100644 include/linux/iio/common/inv_icm42600_timestamp.h
create mode 100644 include/linux/iio/common/inv_sensors_timestamp.hdrivers/iio/common/inv_sensors/Makefile +1 -1
@@ -3,4 +3,4 @@ # Makefile for TDK-InvenSense sensors module. # -obj-$(CONFIG_IIO_INV_SENSORS_TIMESTAMP) += inv_icm42600_timestamp.o +obj-$(CONFIG_IIO_INV_SENSORS_TIMESTAMP) += inv_sensors_timestamp.o
drivers/iio/common/inv_sensors/inv_icm42600_timestamp.c deleted +0 -192
192 lines not on this page · raw message
drivers/iio/common/inv_sensors/inv_sensors_timestamp.c new file +191 -0
191 lines not on this page · raw message
drivers/iio/imu/inv_icm42600/inv_icm42600_accel.c +20 -12
@@ -12,7 +12,7 @@#include <linux/math64.h> #include <linux/iio/buffer.h> -#include <linux/iio/common/inv_icm42600_timestamp.h> +#include <linux/iio/common/inv_sensors_timestamp.h> #include <linux/iio/iio.h> #include <linux/iio/kfifo_buf.h>
@@ -99,7 +99,7 @@ static int inv_icm42600_accel_update_sca const unsigned long *scan_mask) {struct inv_icm42600_state *st =iio_device_get_drvdata (indio_dev); -struct inv_icm42600_timestamp *ts =iio_priv (indio_dev); +struct inv_sensors_timestamp *ts =iio_priv (indio_dev);struct inv_icm42600_sensor_conf conf =INV_ICM42600_SENSOR_CONF_INIT ;unsigned int fifo_en =0 ;unsigned int sleep_temp =0 ;
@@ -127,7 +127,7 @@ static int inv_icm42600_accel_update_sca }/* update data FIFO write */ -inv_icm42600_timestamp_apply_odr (ts,0 ,0 ,0 ); +inv_sensors_timestamp_apply_odr (ts,0 ,0 ,0 ); ret =inv_icm42600_buffer_set_fifo_en (st, fifo_en | st->fifo.en); out_unlock:
@@ -308,7 +308,7 @@ static int inv_icm42600_accel_write_odr( int val, int val2) {struct inv_icm42600_state *st =iio_device_get_drvdata (indio_dev); -struct inv_icm42600_timestamp *ts =iio_priv (indio_dev); +struct inv_sensors_timestamp *ts =iio_priv (indio_dev);struct device *dev =regmap_get_device (st->map);unsigned int idx;struct inv_icm42600_sensor_conf conf =INV_ICM42600_SENSOR_CONF_INIT ;
@@ -329,8 +329,8 @@ static int inv_icm42600_accel_write_odr(pm_runtime_get_sync (dev);mutex_lock (&st->lock); - ret =inv_icm42600_timestamp_update_odr (ts,inv_icm42600_odr_to_period (conf.odr), -iio_buffer_enabled (indio_dev)); + ret =inv_sensors_timestamp_update_odr (ts,inv_icm42600_odr_to_period (conf.odr), +iio_buffer_enabled (indio_dev));if (ret) goto out_unlock;
@@ -706,7 +706,8 @@ struct iio_dev *inv_icm42600_accel_init( {struct device *dev =regmap_get_device (st->map);const char *name; -struct inv_icm42600_timestamp *ts; +struct inv_sensors_timestamp_chip ts_chip; +struct inv_sensors_timestamp *ts;struct iio_dev *indio_dev;struct iio_buffer *buffer;int ret;
@@ -723,8 +724,15 @@ struct iio_dev *inv_icm42600_accel_init(if (!buffer)return ERR_PTR (-ENOMEM ); +/* +* clock period is 32kHz (31250ns) +* jitter is +/- 2% (20 per mille) +*/ + ts_chip.clock_period =31250 ; + ts_chip.jitter =20 ; + ts_chip.init_period =inv_icm42600_odr_to_period (st->conf.accel.odr); ts =iio_priv (indio_dev); -inv_icm42600_timestamp_init (ts,inv_icm42600_odr_to_period (st->conf.accel.odr)); +inv_sensors_timestamp_init (ts, &ts_chip);iio_device_set_drvdata (indio_dev, st); indio_dev->name = name;
@@ -747,7 +755,7 @@ struct iio_dev *inv_icm42600_accel_init(int inv_icm42600_accel_parse_fifo (struct iio_dev *indio_dev) {struct inv_icm42600_state *st =iio_device_get_drvdata (indio_dev); -struct inv_icm42600_timestamp *ts =iio_priv (indio_dev); +struct inv_sensors_timestamp *ts =iio_priv (indio_dev);ssize_t i, size;unsigned int no;const void *accel, *gyro, *timestamp;
@@ -771,13 +779,13 @@ int inv_icm42600_accel_parse_fifo(struct/* update odr */ if (odr &INV_ICM42600_SENSOR_ACCEL ) -inv_icm42600_timestamp_apply_odr (ts, st->fifo.period, - st->fifo.nb.total, no); +inv_sensors_timestamp_apply_odr (ts, st->fifo.period, + st->fifo.nb.total, no);memcpy (&buffer.accel, accel,sizeof (buffer.accel));/* convert 8 bits FIFO temperature in high resolution format */ buffer.temp = temp ? (*temp *64 ) :0 ; - ts_val =inv_icm42600_timestamp_pop (ts); + ts_val =inv_sensors_timestamp_pop (ts);iio_push_to_buffers_with_timestamp (indio_dev, &buffer, ts_val); }
drivers/iio/imu/inv_icm42600/inv_icm42600_buffer.c +17 -17
@@ -11,7 +11,7 @@#include <linux/delay.h> #include <linux/iio/buffer.h> -#include <linux/iio/common/inv_icm42600_timestamp.h> +#include <linux/iio/common/inv_sensors_timestamp.h> #include <linux/iio/iio.h> #include "inv_icm42600.h"
@@ -276,12 +276,12 @@ static int inv_icm42600_buffer_preenable {struct inv_icm42600_state *st =iio_device_get_drvdata (indio_dev);struct device *dev =regmap_get_device (st->map); -struct inv_icm42600_timestamp *ts =iio_priv (indio_dev); +struct inv_sensors_timestamp *ts =iio_priv (indio_dev);pm_runtime_get_sync (dev);mutex_lock (&st->lock); -inv_icm42600_timestamp_reset (ts); +inv_sensors_timestamp_reset (ts);mutex_unlock (&st->lock);return 0 ;
@@ -378,7 +378,7 @@ out_unlock:static int inv_icm42600_buffer_postdisable (struct iio_dev *indio_dev) {struct inv_icm42600_state *st =iio_device_get_drvdata (indio_dev); -struct inv_icm42600_timestamp *ts =iio_priv (indio_dev); +struct inv_sensors_timestamp *ts =iio_priv (indio_dev);struct device *dev =regmap_get_device (st->map);unsigned int sensor;unsigned int *watermark;
@@ -400,7 +400,7 @@ static int inv_icm42600_buffer_postdisabmutex_lock (&st->lock); -inv_icm42600_timestamp_apply_odr (ts,0 ,0 ,0 ); +inv_sensors_timestamp_apply_odr (ts,0 ,0 ,0 ); ret =inv_icm42600_buffer_set_fifo_en (st, st->fifo.en & ~sensor);if (ret)
@@ -508,7 +508,7 @@ int inv_icm42600_buffer_fifo_read(structint inv_icm42600_buffer_fifo_parse (struct inv_icm42600_state *st) { -struct inv_icm42600_timestamp *ts; +struct inv_sensors_timestamp *ts;int ret;if (st->fifo.nb.total ==0 )
@@ -516,8 +516,8 @@ int inv_icm42600_buffer_fifo_parse(struc/* handle gyroscope timestamp and FIFO data parsing */ ts =iio_priv (st->indio_gyro); -inv_icm42600_timestamp_interrupt (ts, st->fifo.period, st->fifo.nb.total, - st->fifo.nb.gyro, st->timestamp.gyro); +inv_sensors_timestamp_interrupt (ts, st->fifo.period, st->fifo.nb.total, + st->fifo.nb.gyro, st->timestamp.gyro);if (st->fifo.nb.gyro >0 ) { ret =inv_icm42600_gyro_parse_fifo (st->indio_gyro);if (ret)
@@ -526,8 +526,8 @@ int inv_icm42600_buffer_fifo_parse(struc/* handle accelerometer timestamp and FIFO data parsing */ ts =iio_priv (st->indio_accel); -inv_icm42600_timestamp_interrupt (ts, st->fifo.period, st->fifo.nb.total, - st->fifo.nb.accel, st->timestamp.accel); +inv_sensors_timestamp_interrupt (ts, st->fifo.period, st->fifo.nb.total, + st->fifo.nb.accel, st->timestamp.accel);if (st->fifo.nb.accel >0 ) { ret =inv_icm42600_accel_parse_fifo (st->indio_accel);if (ret)
@@ -540,7 +540,7 @@ int inv_icm42600_buffer_fifo_parse(strucint inv_icm42600_buffer_hwfifo_flush (struct inv_icm42600_state *st,unsigned int count) { -struct inv_icm42600_timestamp *ts; +struct inv_sensors_timestamp *ts;int64_t gyro_ts, accel_ts;int ret;
@@ -556,9 +556,9 @@ int inv_icm42600_buffer_hwfifo_flush(strif (st->fifo.nb.gyro >0 ) { ts =iio_priv (st->indio_gyro); -inv_icm42600_timestamp_interrupt (ts, st->fifo.period, - st->fifo.nb.total, st->fifo.nb.gyro, - gyro_ts); +inv_sensors_timestamp_interrupt (ts, st->fifo.period, + st->fifo.nb.total, st->fifo.nb.gyro, + gyro_ts); ret =inv_icm42600_gyro_parse_fifo (st->indio_gyro);if (ret)return ret;
@@ -566,9 +566,9 @@ int inv_icm42600_buffer_hwfifo_flush(strif (st->fifo.nb.accel >0 ) { ts =iio_priv (st->indio_accel); -inv_icm42600_timestamp_interrupt (ts, st->fifo.period, - st->fifo.nb.total, st->fifo.nb.accel, - accel_ts); +inv_sensors_timestamp_interrupt (ts, st->fifo.period, + st->fifo.nb.total, st->fifo.nb.accel, + accel_ts); ret =inv_icm42600_accel_parse_fifo (st->indio_accel);if (ret)return ret;
drivers/iio/imu/inv_icm42600/inv_icm42600_core.c +5 -5
@@ -16,7 +16,7 @@#include <linux/property.h> #include <linux/regmap.h> -#include <linux/iio/common/inv_icm42600_timestamp.h> +#include <linux/iio/common/inv_sensors_timestamp.h> #include <linux/iio/iio.h> #include "inv_icm42600.h"
@@ -720,8 +720,8 @@ out_unlock:static int __maybe_unused inv_icm42600_resume (struct device *dev) {struct inv_icm42600_state *st =dev_get_drvdata (dev); -struct inv_icm42600_timestamp *gyro_ts =iio_priv (st->indio_gyro); -struct inv_icm42600_timestamp *accel_ts =iio_priv (st->indio_accel); +struct inv_sensors_timestamp *gyro_ts =iio_priv (st->indio_gyro); +struct inv_sensors_timestamp *accel_ts =iio_priv (st->indio_accel);int ret =0 ;mutex_lock (&st->lock);
@@ -742,8 +742,8 @@ static int __maybe_unused inv_icm42600_r/* restore FIFO data streaming */ if (st->fifo.on) { -inv_icm42600_timestamp_reset (gyro_ts); -inv_icm42600_timestamp_reset (accel_ts); +inv_sensors_timestamp_reset (gyro_ts); +inv_sensors_timestamp_reset (accel_ts); ret =regmap_write (st->map,INV_ICM42600_REG_FIFO_CONFIG ,INV_ICM42600_FIFO_CONFIG_STREAM ); }
drivers/iio/imu/inv_icm42600/inv_icm42600_gyro.c +20 -12
@@ -12,7 +12,7 @@#include <linux/math64.h> #include <linux/iio/buffer.h> -#include <linux/iio/common/inv_icm42600_timestamp.h> +#include <linux/iio/common/inv_sensors_timestamp.h> #include <linux/iio/iio.h> #include <linux/iio/kfifo_buf.h>
@@ -99,7 +99,7 @@ static int inv_icm42600_gyro_update_scan const unsigned long *scan_mask) {struct inv_icm42600_state *st =iio_device_get_drvdata (indio_dev); -struct inv_icm42600_timestamp *ts =iio_priv (indio_dev); +struct inv_sensors_timestamp *ts =iio_priv (indio_dev);struct inv_icm42600_sensor_conf conf =INV_ICM42600_SENSOR_CONF_INIT ;unsigned int fifo_en =0 ;unsigned int sleep_gyro =0 ;
@@ -127,7 +127,7 @@ static int inv_icm42600_gyro_update_scan }/* update data FIFO write */ -inv_icm42600_timestamp_apply_odr (ts,0 ,0 ,0 ); +inv_sensors_timestamp_apply_odr (ts,0 ,0 ,0 ); ret =inv_icm42600_buffer_set_fifo_en (st, fifo_en | st->fifo.en); out_unlock:
@@ -320,7 +320,7 @@ static int inv_icm42600_gyro_write_odr(s int val, int val2) {struct inv_icm42600_state *st =iio_device_get_drvdata (indio_dev); -struct inv_icm42600_timestamp *ts =iio_priv (indio_dev); +struct inv_sensors_timestamp *ts =iio_priv (indio_dev);struct device *dev =regmap_get_device (st->map);unsigned int idx;struct inv_icm42600_sensor_conf conf =INV_ICM42600_SENSOR_CONF_INIT ;
@@ -341,8 +341,8 @@ static int inv_icm42600_gyro_write_odr(spm_runtime_get_sync (dev);mutex_lock (&st->lock); - ret =inv_icm42600_timestamp_update_odr (ts,inv_icm42600_odr_to_period (conf.odr), -iio_buffer_enabled (indio_dev)); + ret =inv_sensors_timestamp_update_odr (ts,inv_icm42600_odr_to_period (conf.odr), +iio_buffer_enabled (indio_dev));if (ret) goto out_unlock;
@@ -717,7 +717,8 @@ struct iio_dev *inv_icm42600_gyro_init(s {struct device *dev =regmap_get_device (st->map);const char *name; -struct inv_icm42600_timestamp *ts; +struct inv_sensors_timestamp_chip ts_chip; +struct inv_sensors_timestamp *ts;struct iio_dev *indio_dev;struct iio_buffer *buffer;int ret;
@@ -734,8 +735,15 @@ struct iio_dev *inv_icm42600_gyro_init(sif (!buffer)return ERR_PTR (-ENOMEM ); +/* +* clock period is 32kHz (31250ns) +* jitter is +/- 2% (20 per mille) +*/ + ts_chip.clock_period =31250 ; + ts_chip.jitter =20 ; + ts_chip.init_period =inv_icm42600_odr_to_period (st->conf.accel.odr); ts =iio_priv (indio_dev); -inv_icm42600_timestamp_init (ts,inv_icm42600_odr_to_period (st->conf.gyro.odr)); +inv_sensors_timestamp_init (ts, &ts_chip);iio_device_set_drvdata (indio_dev, st); indio_dev->name = name;
@@ -758,7 +766,7 @@ struct iio_dev *inv_icm42600_gyro_init(sint inv_icm42600_gyro_parse_fifo (struct iio_dev *indio_dev) {struct inv_icm42600_state *st =iio_device_get_drvdata (indio_dev); -struct inv_icm42600_timestamp *ts =iio_priv (indio_dev); +struct inv_sensors_timestamp *ts =iio_priv (indio_dev);ssize_t i, size;unsigned int no;const void *accel, *gyro, *timestamp;
@@ -782,13 +790,13 @@ int inv_icm42600_gyro_parse_fifo(struct/* update odr */ if (odr &INV_ICM42600_SENSOR_GYRO ) -inv_icm42600_timestamp_apply_odr (ts, st->fifo.period, - st->fifo.nb.total, no); +inv_sensors_timestamp_apply_odr (ts, st->fifo.period, + st->fifo.nb.total, no);memcpy (&buffer.gyro, gyro,sizeof (buffer.gyro));/* convert 8 bits FIFO temperature in high resolution format */ buffer.temp = temp ? (*temp *64 ) :0 ; - ts_val =inv_icm42600_timestamp_pop (ts); + ts_val =inv_sensors_timestamp_pop (ts);iio_push_to_buffers_with_timestamp (indio_dev, &buffer, ts_val); }
include/linux/iio/common/inv_icm42600_timestamp.h deleted +0 -79
79 lines not on this page · raw message
include/linux/iio/common/inv_sensors_timestamp.h new file +95 -0
95 lines not on this page · raw message
Greg Kroah-Hartman
maintainerPATCH 587/699 iio: imu: inv_mpu6050: use the common inv_sensors timestamp module
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jean-Baptiste Maneyrol <[email protected]>
[ Upstream commit 111e1abd00455971f6a568900f033cbddec9d4e5 ]
Replace timestamping by the new common inv_sensors timestamp module. The principle behind is the same but the implementation in the new module is far better providing less jitter and a better estimation.
Stable-dep-of: affe3f077d7a ("iio: imu: inv_icm42600: fix timestamping by limiting FIFO reading")
--- drivers/iio/imu/inv_mpu6050/Kconfig | 1 drivers/iio/imu/inv_mpu6050/inv_mpu_core.c | 30 +++++++-- drivers/iio/imu/inv_mpu6050/inv_mpu_iio.h | 18 ++--- drivers/iio/imu/inv_mpu6050/inv_mpu_ring.c | 83 ++------------------------ drivers/iio/imu/inv_mpu6050/inv_mpu_trigger.c | 6 + 5 files changed, 45 insertions(+), 93 deletions(-)
drivers/iio/imu/inv_mpu6050/Kconfig +1 -0
@@ -7,6 +7,7 @@ config INV_MPU6050_IIO tristate select IIO_BUFFER select IIO_TRIGGERED_BUFFER + select IIO_INV_SENSORS_TIMESTAMP config INV_MPU6050_I2C tristate "Invensense MPU6050 devices (I2C)"
drivers/iio/imu/inv_mpu6050/inv_mpu_core.c +23 -7
@@ -12,12 +12,15 @@#include <linux/jiffies.h> #include <linux/irq.h> #include <linux/interrupt.h> -#include <linux/iio/iio.h> #include <linux/acpi.h> #include <linux/platform_device.h> #include <linux/regulator/consumer.h> #include <linux/pm.h> #include <linux/pm_runtime.h> + +#include <linux/iio/common/inv_sensors_timestamp.h> +#include <linux/iio/iio.h> +#include "inv_mpu_iio.h" #include "inv_mpu_magn.h"
@@ -481,6 +484,7 @@ static int inv_mpu6050_init_config(strucint result;u8 d;struct inv_mpu6050_state *st =iio_priv (indio_dev); +struct inv_sensors_timestamp_chip timestamp; result =inv_mpu6050_set_gyro_fsr (st, st->chip_config.fsr);if (result)
@@ -504,12 +508,12 @@ static int inv_mpu6050_init_config(strucif (result)return result; -/* -* Internal chip period is 1ms (1kHz). -* Let's use at the beginning the theorical value before measuring -* with interrupt timestamps. -*/ - st->chip_period =NSEC_PER_MSEC ; +/* clock jitter is +/- 2% */ + timestamp.clock_period =NSEC_PER_SEC /INV_MPU6050_INTERNAL_FREQ_HZ ; + timestamp.jitter =20 ; + timestamp.init_period = +NSEC_PER_SEC /INV_MPU6050_DIVIDER_TO_FIFO_RATE (st->chip_config.divider); +inv_sensors_timestamp_init (&st->timestamp, ×tamp);/* magn chip init, noop if not present in the chip */ result =inv_mpu_magn_probe (st);
@@ -900,6 +904,8 @@ inv_mpu6050_fifo_rate_store(struct devic const char *buf, size_t count) { int fifo_rate; +u32 fifo_period; +bool fifo_on;u8 d;int result;struct iio_dev *indio_dev =dev_to_iio_dev (dev);
@@ -916,12 +922,21 @@ inv_mpu6050_fifo_rate_store(struct devic d =INV_MPU6050_FIFO_RATE_TO_DIVIDER (fifo_rate);/* compute back the fifo rate to handle truncation cases */ fifo_rate =INV_MPU6050_DIVIDER_TO_FIFO_RATE (d); + fifo_period =NSEC_PER_SEC / fifo_rate;mutex_lock (&st->lock);if (d == st->chip_config.divider) { result =0 ; goto fifo_rate_fail_unlock; } + + fifo_on = st->chip_config.accl_fifo_enable || + st->chip_config.gyro_fifo_enable || + st->chip_config.magn_fifo_enable; + result =inv_sensors_timestamp_update_odr (&st->timestamp, fifo_period, fifo_on); +if (result) + goto fifo_rate_fail_unlock; + result =pm_runtime_get_sync (pdev);if (result <0 ) {pm_runtime_put_noidle (pdev);
@@ -1741,3 +1756,4 @@ EXPORT_SYMBOL_GPL(inv_mpu_pmops);MODULE_AUTHOR ("Invensense Corporation" );MODULE_DESCRIPTION ("Invensense device MPU6050 driver" );MODULE_LICENSE ("GPL" ); +MODULE_IMPORT_NS (IIO_INV_SENSORS_TIMESTAMP );
drivers/iio/imu/inv_mpu6050/inv_mpu_iio.h +8 -10
@@ -9,15 +9,17 @@#include <linux/i2c.h> #include <linux/i2c-mux.h> #include <linux/mutex.h> -#include <linux/iio/iio.h> -#include <linux/iio/buffer.h> +#include <linux/platform_data/invensense_mpu6050.h> #include <linux/regmap.h> -#include <linux/iio/sysfs.h> + +#include <linux/iio/buffer.h> +#include <linux/iio/common/inv_sensors_timestamp.h> +#include <linux/iio/iio.h> #include <linux/iio/kfifo_buf.h> #include <linux/iio/trigger.h> #include <linux/iio/triggered_buffer.h> #include <linux/iio/trigger_consumer.h> -#include <linux/platform_data/invensense_mpu6050.h> +#include <linux/iio/sysfs.h> /** * struct inv_mpu6050_reg_map - Notable registers.
@@ -163,9 +165,7 @@ struct inv_mpu6050_hw {* @map regmap pointer. * @irq interrupt number. * @irq_mask the int_pin_cfg mask to configure interrupt type. -* @chip_period: chip internal period estimation (~1kHz). -* @it_timestamp: timestamp from previous interrupt. -* @data_timestamp: timestamp for next data sample. +* @timestamp: timestamping module * @vdd_supply: VDD voltage regulator for the chip. * @vddio_supply I/O voltage regulator for the chip. * @magn_disabled: magnetometer disabled for backward compatibility reason.
@@ -189,9 +189,7 @@ struct inv_mpu6050_state {int irq;u8 irq_mask;unsigned skip_samples; -s64 chip_period; -s64 it_timestamp; -s64 data_timestamp; +struct inv_sensors_timestamp timestamp;struct regulator *vdd_supply;struct regulator *vddio_supply;bool magn_disabled;
drivers/iio/imu/inv_mpu6050/inv_mpu_ring.c +8 -75
109 lines not on this page · raw message
drivers/iio/imu/inv_mpu6050/inv_mpu_trigger.c +5 -1
@@ -4,6 +4,9 @@*/ #include <linux/pm_runtime.h> + +#include <linux/iio/common/inv_sensors_timestamp.h> +#include "inv_mpu_iio.h" static unsigned int inv_scan_query_mpu6050 (struct iio_dev *indio_dev)
@@ -107,7 +110,8 @@ int inv_mpu6050_prepare_fifo(struct inv_int ret;if (enable) { - st->it_timestamp =0 ; +/* reset timestamping */ +inv_sensors_timestamp_reset (&st->timestamp);/* reset FIFO */ d = st->chip_config.user_ctrl |INV_MPU6050_BIT_FIFO_RST ; ret =regmap_write (st->map, st->reg->user_ctrl, d);
Greg Kroah-Hartman
maintainerPATCH 588/699 iio: invensense: remove redundant initialization of variable period
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Colin Ian King <[email protected]>
[ Upstream commit b58b13f156c00c2457035b7071eaaac105fe6836 ]
The variable period is being initialized with a value that is never read, it is being re-assigned a new value later on before it is read. The initialization is redundant and can be removed.
Cleans up clang scan build warning:
Value stored to 'period' during its initialization is never read [deadcode.DeadStores]
Stable-dep-of: affe3f077d7a ("iio: imu: inv_icm42600: fix timestamping by limiting FIFO reading")
--- drivers/iio/common/inv_sensors/inv_sensors_timestamp.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/iio/common/inv_sensors/inv_sensors_timestamp.c +1 -1
@@ -105,7 +105,7 @@ void inv_sensors_timestamp_interrupt(strstruct inv_sensors_timestamp_interval *it;int64_t delta, interval;const uint32_t fifo_mult = fifo_period / ts->chip.clock_period; -uint32_t period = ts->period; +uint32_t period;int32_t m;bool valid = false;
Greg Kroah-Hartman
maintainerPATCH 589/699 iio: invensense: fix timestamp glitches when switching frequency
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jean-Baptiste Maneyrol <[email protected]>
[ Upstream commit bf8367b00c33c64a9391c262bb2e11d274c9f2a4 ]
When a sensor is running and there is a FIFO frequency change due to another sensor turned on/off, there are glitches on timestamp. Fix that by using only interrupt timestamp when there is the corresponding sensor data in the FIFO.
Delete FIFO period handling and simplify internal functions.
Update integration inside inv_mpu6050 and inv_icm42600 drivers.
Stable-dep-of: affe3f077d7a ("iio: imu: inv_icm42600: fix timestamping by limiting FIFO reading")
--- drivers/iio/common/inv_sensors/inv_sensors_timestamp.c | 30 +++++++---------- drivers/iio/imu/inv_icm42600/inv_icm42600_buffer.c | 20 ++++------- drivers/iio/imu/inv_mpu6050/inv_mpu_ring.c | 2 - include/linux/iio/common/inv_sensors_timestamp.h | 3 - 4 files changed, 23 insertions(+), 32 deletions(-)
drivers/iio/common/inv_sensors/inv_sensors_timestamp.c +13 -17
@@ -70,13 +70,13 @@ int inv_sensors_timestamp_update_odr(str }EXPORT_SYMBOL_NS_GPL (inv_sensors_timestamp_update_odr,IIO_INV_SENSORS_TIMESTAMP ); -static bool inv_validate_period (struct inv_sensors_timestamp *ts,uint32_t period,uint32_t mult) +static bool inv_validate_period (struct inv_sensors_timestamp *ts,uint32_t period) {uint32_t period_min, period_max;/* check that period is acceptable */ - period_min = ts->min_period * mult; - period_max = ts->max_period * mult; + period_min = ts->min_period * ts->mult; + period_max = ts->max_period * ts->mult;if (period > period_min && period < period_max)return true;else
@@ -84,32 +84,30 @@ static bool inv_validate_period(struct i }static bool inv_compute_chip_period (struct inv_sensors_timestamp *ts, -uint32_t mult,uint32_t period) +uint32_t period) {uint32_t new_chip_period; -if (!inv_validate_period (ts, period, mult)) +if (!inv_validate_period (ts, period))return false;/* update chip internal period estimation */ - new_chip_period = period / mult; + new_chip_period = period / ts->mult;inv_update_acc (&ts->chip_period, new_chip_period);return true; }void inv_sensors_timestamp_interrupt (struct inv_sensors_timestamp *ts, -uint32_t fifo_period,size_t fifo_nb, -size_t sensor_nb,int64_t timestamp) +size_t sample_nb,int64_t timestamp) {struct inv_sensors_timestamp_interval *it;int64_t delta, interval; -const uint32_t fifo_mult = fifo_period / ts->chip.clock_period;uint32_t period;int32_t m;bool valid = false; -if (fifo_nb ==0 ) +if (sample_nb ==0 )return ;/* update interrupt timestamp and compute chip and sensor periods */
@@ -119,8 +117,8 @@ void inv_sensors_timestamp_interrupt(str delta = it->up - it->lo;if (it->lo !=0 ) {/* compute period: delta time divided by number of samples */ - period =div_s64 (delta, fifo_nb); - valid =inv_compute_chip_period (ts, fifo_mult, period); + period =div_s64 (delta, sample_nb); + valid =inv_compute_chip_period (ts, period);/* update sensor period if chip internal period is updated */ if (valid) ts->period = ts->mult * ts->chip_period.val;
@@ -129,20 +127,18 @@ void inv_sensors_timestamp_interrupt(str/* no previous data, compute theoritical value from interrupt */ if (ts->timestamp ==0 ) {/* elapsed time: sensor period * sensor samples number */ - interval = (int64_t )ts->period * (int64_t )sensor_nb; + interval = (int64_t )ts->period * (int64_t )sample_nb; ts->timestamp = it->up - interval;return ; }/* if interrupt interval is valid, sync with interrupt timestamp */ if (valid) { -/* compute measured fifo_period */ - fifo_period = fifo_mult * ts->chip_period.val;/* delta time between last sample and last interrupt */ delta = it->lo - ts->timestamp;/* if there are multiple samples, go back to first one */ -while (delta >= (fifo_period *3 /2 )) - delta -= fifo_period; +while (delta >= (ts->period *3 /2 )) + delta -= ts->period;/* compute maximal adjustment value */ m =INV_SENSORS_TIMESTAMP_JITTER ((int64_t )ts->period, ts->chip.jitter);if (delta > m)
drivers/iio/imu/inv_icm42600/inv_icm42600_buffer.c +8 -12
@@ -515,20 +515,20 @@ int inv_icm42600_buffer_fifo_parse(strucreturn 0 ;/* handle gyroscope timestamp and FIFO data parsing */ - ts =iio_priv (st->indio_gyro); -inv_sensors_timestamp_interrupt (ts, st->fifo.period, st->fifo.nb.total, - st->fifo.nb.gyro, st->timestamp.gyro);if (st->fifo.nb.gyro >0 ) { + ts =iio_priv (st->indio_gyro); +inv_sensors_timestamp_interrupt (ts, st->fifo.nb.gyro, + st->timestamp.gyro); ret =inv_icm42600_gyro_parse_fifo (st->indio_gyro);if (ret)return ret; }/* handle accelerometer timestamp and FIFO data parsing */ - ts =iio_priv (st->indio_accel); -inv_sensors_timestamp_interrupt (ts, st->fifo.period, st->fifo.nb.total, - st->fifo.nb.accel, st->timestamp.accel);if (st->fifo.nb.accel >0 ) { + ts =iio_priv (st->indio_accel); +inv_sensors_timestamp_interrupt (ts, st->fifo.nb.accel, + st->timestamp.accel); ret =inv_icm42600_accel_parse_fifo (st->indio_accel);if (ret)return ret;
@@ -556,9 +556,7 @@ int inv_icm42600_buffer_hwfifo_flush(strif (st->fifo.nb.gyro >0 ) { ts =iio_priv (st->indio_gyro); -inv_sensors_timestamp_interrupt (ts, st->fifo.period, - st->fifo.nb.total, st->fifo.nb.gyro, - gyro_ts); +inv_sensors_timestamp_interrupt (ts, st->fifo.nb.gyro, gyro_ts); ret =inv_icm42600_gyro_parse_fifo (st->indio_gyro);if (ret)return ret;
@@ -566,9 +564,7 @@ int inv_icm42600_buffer_hwfifo_flush(strif (st->fifo.nb.accel >0 ) { ts =iio_priv (st->indio_accel); -inv_sensors_timestamp_interrupt (ts, st->fifo.period, - st->fifo.nb.total, st->fifo.nb.accel, - accel_ts); +inv_sensors_timestamp_interrupt (ts, st->fifo.nb.accel, accel_ts); ret =inv_icm42600_accel_parse_fifo (st->indio_accel);if (ret)return ret;
drivers/iio/imu/inv_mpu6050/inv_mpu_ring.c +1 -1
@@ -109,7 +109,7 @@ irqreturn_t inv_mpu6050_read_fifo(int ir nb = fifo_count / bytes_per_datum;/* Each FIFO data contains all sensors, so same number for FIFO and sensor data */ fifo_period =NSEC_PER_SEC /INV_MPU6050_DIVIDER_TO_FIFO_RATE (st->chip_config.divider); -inv_sensors_timestamp_interrupt (&st->timestamp, fifo_period, nb, nb, pf->timestamp); +inv_sensors_timestamp_interrupt (&st->timestamp, nb, pf->timestamp);inv_sensors_timestamp_apply_odr (&st->timestamp, fifo_period, nb,0 );for (i =0 ; i < nb; ++i) { result = regmap_noinc_read(st->map, st->reg->fifo_r_w,
include/linux/iio/common/inv_sensors_timestamp.h +1 -2
@@ -71,8 +71,7 @@ int inv_sensors_timestamp_update_odr(str uint32_t period, bool fifo);void inv_sensors_timestamp_interrupt (struct inv_sensors_timestamp *ts, -uint32_t fifo_period,size_t fifo_nb, -size_t sensor_nb,int64_t timestamp); +size_t sample_nb,int64_t timestamp);static inline int64_t inv_sensors_timestamp_pop (struct inv_sensors_timestamp *ts) {
Greg Kroah-Hartman
maintainerPATCH 590/699 iio: imu: inv_icm42600: stabilized timestamp in interrupt
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jean-Baptiste Maneyrol <[email protected]>
[ Upstream commit d7bd473632d07f8a54655c270c0940cc3671c548 ]
Use IRQF_ONESHOT flag to ensure the timestamp is not updated in the hard handler during the thread handler. And compute and use the effective watermark value that correspond to this first timestamp.
This way we can ensure the timestamp is always corresponding to the value used by the timestamping mechanism. Otherwise, it is possible that between FIFO count read and FIFO processing the timestamp is overwritten in the hard handler.
Stable-dep-of: affe3f077d7a ("iio: imu: inv_icm42600: fix timestamping by limiting FIFO reading")
--- drivers/iio/imu/inv_icm42600/inv_icm42600_buffer.c | 19 +++++++++++++++++-- drivers/iio/imu/inv_icm42600/inv_icm42600_buffer.h | 2 ++ drivers/iio/imu/inv_icm42600/inv_icm42600_core.c | 1 + 3 files changed, 20 insertions(+), 2 deletions(-)
drivers/iio/imu/inv_icm42600/inv_icm42600_buffer.c +17 -2
@@ -222,10 +222,15 @@ int inv_icm42600_buffer_update_watermark latency_accel = period_accel * wm_accel;/* 0 value for watermark means that the sensor is turned off */ +if (wm_gyro ==0 && wm_accel ==0 ) +return 0 ; +if (latency_gyro ==0 ) { watermark = wm_accel; + st->fifo.watermark.eff_accel = wm_accel; }else if (latency_accel ==0 ) { watermark = wm_gyro; + st->fifo.watermark.eff_gyro = wm_gyro; }else {/* compute the smallest latency that is a multiple of both */ if (latency_gyro <= latency_accel)
@@ -241,6 +246,13 @@ int inv_icm42600_buffer_update_watermark watermark = latency / period;if (watermark <1 ) watermark =1 ; +/* update effective watermark */ + st->fifo.watermark.eff_gyro = latency / period_gyro; +if (st->fifo.watermark.eff_gyro <1 ) + st->fifo.watermark.eff_gyro =1 ; + st->fifo.watermark.eff_accel = latency / period_accel; +if (st->fifo.watermark.eff_accel <1 ) + st->fifo.watermark.eff_accel =1 ; }/* compute watermark value in bytes */
@@ -517,7 +529,7 @@ int inv_icm42600_buffer_fifo_parse(struc/* handle gyroscope timestamp and FIFO data parsing */ if (st->fifo.nb.gyro >0 ) { ts =iio_priv (st->indio_gyro); -inv_sensors_timestamp_interrupt (ts, st->fifo.nb.gyro, +inv_sensors_timestamp_interrupt (ts, st->fifo.watermark.eff_gyro, st->timestamp.gyro); ret =inv_icm42600_gyro_parse_fifo (st->indio_gyro);if (ret)
@@ -527,7 +539,7 @@ int inv_icm42600_buffer_fifo_parse(struc/* handle accelerometer timestamp and FIFO data parsing */ if (st->fifo.nb.accel >0 ) { ts =iio_priv (st->indio_accel); -inv_sensors_timestamp_interrupt (ts, st->fifo.nb.accel, +inv_sensors_timestamp_interrupt (ts, st->fifo.watermark.eff_accel, st->timestamp.accel); ret =inv_icm42600_accel_parse_fifo (st->indio_accel);if (ret)
@@ -578,6 +590,9 @@ int inv_icm42600_buffer_init(struct inv_unsigned int val;int ret; + st->fifo.watermark.eff_gyro =1 ; + st->fifo.watermark.eff_accel =1 ; +/* * Default FIFO configuration (bits 7 to 5) * - use invalid value
drivers/iio/imu/inv_icm42600/inv_icm42600_buffer.h +2 -0
@@ -32,6 +32,8 @@ struct inv_icm42600_fifo {struct {unsigned int gyro;unsigned int accel; +unsigned int eff_gyro; +unsigned int eff_accel; } watermark;size_t count;struct {
drivers/iio/imu/inv_icm42600/inv_icm42600_core.c +1 -0
@@ -518,6 +518,7 @@ static int inv_icm42600_irq_init(structif (ret)return ret; + irq_type |=IRQF_ONESHOT ;return devm_request_threaded_irq (dev, irq, inv_icm42600_irq_timestamp, inv_icm42600_irq_handler, irq_type,"inv_icm42600" , st);
Greg Kroah-Hartman
maintainerPATCH 591/699 iio: imu: inv_icm42600: fix timestamping by limiting FIFO reading
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jean-Baptiste Maneyrol <[email protected]>
[ Upstream commit affe3f077d7a4eeb25937f5323ff059a54b4712c ]
Timestamps are made by measuring the chip clock using the watermark interrupts. If we read more than watermark samples as done today, we are reducing the period between interrupts and distort the time measurement. Fix that by reading only watermark samples in the interrupt case.
--- drivers/iio/imu/inv_icm42600/inv_icm42600_buffer.c | 9 +++++---- drivers/iio/imu/inv_icm42600/inv_icm42600_buffer.h | 1 + 2 files changed, 6 insertions(+), 4 deletions(-)
drivers/iio/imu/inv_icm42600/inv_icm42600_buffer.c +5 -4
@@ -257,6 +257,7 @@ int inv_icm42600_buffer_update_watermark/* compute watermark value in bytes */ wm_size = watermark * packet_size; + st->fifo.watermark.value = watermark;/* changing FIFO watermark requires to turn off watermark interrupt */ ret = regmap_update_bits_check(st->map, INV_ICM42600_REG_INT_SOURCE0,
@@ -476,11 +477,10 @@ int inv_icm42600_buffer_fifo_read(struct st->fifo.nb.accel =0 ; st->fifo.nb.total =0 ; -/* compute maximum FIFO read size */ +/* compute maximum FIFO read size (watermark for max = 0 interrupt case) */ if (max ==0 ) - max_count =sizeof (st->fifo.data); -else - max_count = max *inv_icm42600_get_packet_size (st->fifo.en); + max = st->fifo.watermark.value; + max_count = max *inv_icm42600_get_packet_size (st->fifo.en);/* read FIFO count value */ raw_fifo_count = (__be16 *)st->buffer;
@@ -592,6 +592,7 @@ int inv_icm42600_buffer_init(struct inv_ st->fifo.watermark.eff_gyro =1 ; st->fifo.watermark.eff_accel =1 ; + st->fifo.watermark.value =1 ;/* * Default FIFO configuration (bits 7 to 5)
drivers/iio/imu/inv_icm42600/inv_icm42600_buffer.h +1 -0
@@ -34,6 +34,7 @@ struct inv_icm42600_fifo {unsigned int accel;unsigned int eff_gyro;unsigned int eff_accel; +unsigned int value; } watermark;size_t count;struct {
Greg Kroah-Hartman
maintainerPATCH 592/699 bitops: make BYTES_TO_BITS() treewide-available
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alexander Lobakin <[email protected]>
[ Upstream commit 7d8296b250f2eed73f1758607926d4d258dea5d4 ]
Avoid open-coding that simple expression each time by moving BYTES_TO_BITS() from the probes code to <linux/bitops.h> to export it to the rest of the kernel.
Simplify the macro while at it. BITS_PER_LONG / sizeof(long) always equals to %BITS_PER_BYTE, regardless of the target architecture. Do the same for the tools ecosystem as well (incl. its version of bitops.h). The previous implementation had its implicit type of long, while the new one is int, so adjust the format literal accordingly in the perf code.
Stable-dep-of: 55052184ac90 ("iio: common: st_sensors: honour channel endianness in read_axis_data")
--- include/linux/bitops.h | 2 ++ kernel/trace/trace_probe.c | 2 -- tools/include/linux/bitops.h | 2 ++ tools/perf/util/probe-finder.c | 4 +--- 4 files changed, 5 insertions(+), 5 deletions(-)
include/linux/bitops.h +2 -0
@@ -17,6 +17,8 @@#define BITS_TO_U32 (nr) DIV_ROUND_UP(nr, BITS_PER_TYPE(u32))#define BITS_TO_BYTES (nr) DIV_ROUND_UP(nr, BITS_PER_TYPE(char)) +#define BYTES_TO_BITS (nb) ((nb) * BITS_PER_BYTE) +extern unsigned int __sw_hweight8 (unsigned int w);extern unsigned int __sw_hweight16 (unsigned int w);extern unsigned int __sw_hweight32 (unsigned int w);
kernel/trace/trace_probe.c +0 -2
@@ -503,8 +503,6 @@ parse_probe_arg(char *arg, const structreturn ret; } -#define BYTES_TO_BITS (nb) ((BITS_PER_LONG * (nb)) / sizeof(long)) -/* Bitfield type needs to be parsed into a fetch function */ static int __parse_bitfield_probe_arg(const char *bf, const struct fetch_type *t,
tools/include/linux/bitops.h +2 -0
@@ -20,6 +20,8 @@#define BITS_TO_U32 (nr) DIV_ROUND_UP(nr, BITS_PER_TYPE(u32))#define BITS_TO_BYTES (nr) DIV_ROUND_UP(nr, BITS_PER_TYPE(char)) +#define BYTES_TO_BITS (nb) ((nb) * BITS_PER_BYTE) +extern unsigned int __sw_hweight8 (unsigned int w);extern unsigned int __sw_hweight16 (unsigned int w);extern unsigned int __sw_hweight32 (unsigned int w);
tools/perf/util/probe-finder.c +1 -3
@@ -299,8 +299,6 @@ static_var:return ret2; } -#define BYTES_TO_BITS (nb) ((nb) * BITS_PER_LONG / sizeof(long)) -static int convert_variable_type (Dwarf_Die *vr_die,struct probe_trace_arg *tvar,const char *cast,bool user_access)
@@ -330,7 +328,7 @@ static int convert_variable_type(Dwarf_D total =dwarf_bytesize (vr_die);if (boffs <0 || total <0 )return -ENOENT ; - ret =snprintf (buf,16 ,"b%d@%d/%zd" , bsize, boffs, + ret =snprintf (buf,16 ,"b%d@%d/%d" , bsize, boffs,BYTES_TO_BITS (total)); goto formatted; }
Greg Kroah-Hartman
maintainerPATCH 593/699 iio: common: st_sensors: honour channel endianness in read_axis_data
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Herman van Hazendonk <[email protected]>
[ Upstream commit 55052184ac9011db2ea983e54d6c21f0b1079a12 ]
st_sensors_read_axis_data() unconditionally decoded multi-byte results with get_unaligned_le16() / get_unaligned_le24() regardless of the channel's declared scan_type.endianness.
For every ST sensor that has used this helper since it was introduced this happened to be fine because the ST IMU/accel/gyro/pressure families publish their data registers as little-endian and the channel specs in those drivers declare IIO_LE accordingly.
The LSM303DLH magnetometer however publishes its X/Y/Z output as a pair of big-endian bytes (the H register sits at the lower address, 0x03/0x05/0x07, and the L register immediately after), and its channel specs in st_magn_core.c correctly declare IIO_BE -- but read_axis_data() ignored that and decoded as little-endian, swapping the high and low bytes of every magnetometer sample. The LSM303DLHC and LSM303DLM share the same st_magn_16bit_channels (IIO_BE) and were therefore byte-swapped by the same bug; users of those parts will see different in_magn_*_raw values after this fix lands.
The bug is most visible on a stationary chip: in earth's field the true X reading is small and the high byte sits at 0x00, so swapping the bytes pins sysfs X at exactly the low byte's pattern (e.g. 0x00F0 = 240). Y and Z still appear "to vary" because their magnitudes are larger and the noise in the low byte produces big swings in the swapped high byte:
before (LSM303DLH flat, sysfs in_magn_*_raw):
X=240 (stuck), Y= 12032..23296, Z=-16128..-9728
after (direct i2c-dev big-endian decode, same chip same orientation):
X≈-4096, Y≈210, Z≈80 (sensible values reflecting earth's
ambient field at low gauss range)
Fix read_axis_data() to dispatch on ch->scan_type.endianness and call get_unaligned_be16() / get_unaligned_be24() when the channel declares IIO_BE. Existing IIO_LE consumers (st_accel, st_gyro, st_pressure, st_lsm6dsx and others) are unaffected because their channel specs already declare IIO_LE and the LE path is unchanged.
While restructuring the branches, replace the previously implicit silent-success-with-uninitialised-*data fall-through for byte_for_channel outside 1..3 with an explicit return -EINVAL. No in-tree ST sensor publishes such a channel, but the new behaviour is strictly safer than handing userspace garbage.
--- drivers/iio/common/st_sensors/st_sensors_core.c | 23 +++++++++++++++++------ 1 file changed, 17 insertions(+), 6 deletions(-)
drivers/iio/common/st_sensors/st_sensors_core.c +17 -6
@@ -527,6 +527,7 @@ static int st_sensors_read_axis_data(stru8 *outdata;struct st_sensor_data *sdata =iio_priv (indio_dev);unsigned int byte_for_channel; +u32 tmp; byte_for_channel =DIV_ROUND_UP (ch->scan_type.realbits + ch->scan_type.shift,8 );
@@ -539,12 +540,22 @@ static int st_sensors_read_axis_data(strif (err <0 ) goto st_sensors_free_memory; -if (byte_for_channel ==1 ) - *data = (s8)*outdata; -else if (byte_for_channel ==2 ) - *data = (s16 )get_unaligned_le16 (outdata); -else if (byte_for_channel ==3 ) - *data = (s32 )sign_extend32 (get_unaligned_le24 (outdata),23 ); +if (byte_for_channel ==1 ) { + tmp = *outdata; + }else if (byte_for_channel ==2 ) { +if (ch->scan_type.endianness ==IIO_BE ) + tmp =get_unaligned_be16 (outdata); +else + tmp =get_unaligned_le16 (outdata); + }else if (byte_for_channel ==3 ) { +if (ch->scan_type.endianness ==IIO_BE ) + tmp =get_unaligned_be24 (outdata); +else + tmp =get_unaligned_le24 (outdata); + }else { +return -EINVAL ; + } + *data =sign_extend32 (tmp,BYTES_TO_BITS (byte_for_channel) -1 ); st_sensors_free_memory:kfree (outdata);
Greg Kroah-Hartman
maintainerPATCH 594/699 ALSA: aoa: check snd_ctl_new1() return value
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zhao Dongdong <[email protected]>
[ Upstream commit 8df560fefe6fed6a20b7e06720eeaeccec349ac0 ]
snd_ctl_new1() can return NULL when memory allocation fails. In layout.c, the function does not check the return value before dereferencing ctl->id.name or passing to aoa_snd_ctl_add(), which can lead to a NULL pointer dereference.
Add NULL checks after snd_ctl_new1() calls and return early if any fails.
--- sound/aoa/fabrics/layout.c | 6 ++++++ 1 file changed, 6 insertions(+)
sound/aoa/fabrics/layout.c +6 -0
@@ -947,6 +947,8 @@ static void layout_attached_codec(structif (lineout ==1 ) ldev->gpio.methods->set_lineout (codec->gpio,1 ); ctl =snd_ctl_new1 (&lineout_ctl, codec->gpio); +if (!ctl) +return ;if (cc->connected &CC_LINEOUT_LABELLED_HEADPHONE )strlcpy (ctl->id.name,"Headphone Switch" ,sizeof (ctl->id.name));
@@ -961,6 +963,8 @@ static void layout_attached_codec(structif (ldev->have_lineout_detect) { ctl =snd_ctl_new1 (&lineout_detect_choice, ldev); +if (!ctl) +return ;if (cc->connected &CC_LINEOUT_LABELLED_HEADPHONE ) strlcpy(ctl->id.name, "Headphone Detect Autoswitch",
@@ -968,6 +972,8 @@ static void layout_attached_codec(structaoa_snd_ctl_add (ctl); ctl =snd_ctl_new1 (&lineout_detected, ldev); +if (!ctl) +return ;if (cc->connected &CC_LINEOUT_LABELLED_HEADPHONE ) strlcpy(ctl->id.name, "Headphone Detected",
Greg Kroah-Hartman
maintainerPATCH 595/699 Bluetooth: btintel: Fix offset calculation boot address parameter
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kiran K <[email protected]>
[ Upstream commit d00745da644d42c2f97293eb3fe19cfd5c0b073c ]
Boot address parameter was not getting updated properly due to wrong offset
Stable-dep-of: c5b600a3c05b ("Bluetooth: btusb: fix use-after-free on marvell probe failure")
--- drivers/bluetooth/btintel.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
drivers/bluetooth/btintel.c +2 -1
@@ -863,7 +863,8 @@ static int btintel_download_firmware_pay/* The boot parameter is the first 32-bit value * and rest of 3 octets are reserved. */ - *boot_param =get_unaligned_le32 (fw_ptr +sizeof (*cmd)); + *boot_param =get_unaligned_le32 (fw_ptr + frag_len + +sizeof (*cmd));bt_dev_dbg (hdev,"boot_param=0x%x" , *boot_param); }
Greg Kroah-Hartman
maintainerPATCH 596/699 Bluetooth: btintel: Check firmware version before download
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Luiz Augusto von Dentz <[email protected]>
[ Upstream commit ac0565462e330a2b762ca5849a4140b29d725786 ]
This checks the firmware build number, week and year against the repective loaded version. If details are a match, skip the download process.
Stable-dep-of: c5b600a3c05b ("Bluetooth: btusb: fix use-after-free on marvell probe failure")
--- drivers/bluetooth/btintel.c | 106 +++++++++++++++++++++++++++++++++--------- drivers/bluetooth/btintel.h | 5 + drivers/bluetooth/btusb.c | 9 +++ drivers/bluetooth/hci_intel.c | 7 +- 4 files changed, 101 insertions(+), 26 deletions(-)
drivers/bluetooth/btintel.c +85 -21
@@ -24,6 +24,14 @@#define ECDSA_OFFSET 644#define ECDSA_HEADER_LEN 320 +#define CMD_WRITE_BOOT_PARAMS 0xfc0e +struct cmd_write_boot_params { +u32 boot_addr; +u8 fw_build_num; +u8 fw_build_ww; +u8 fw_build_yy; +} __packed; +int btintel_check_bdaddr (struct hci_dev *hdev) {struct hci_rp_read_bd_addr *bda;
@@ -841,7 +849,7 @@ static int btintel_sfi_ecdsa_header_secustatic int btintel_download_firmware_payload (struct hci_dev *hdev,const struct firmware *fw, -u32 *boot_param,size_t offset) +size_t offset) {int err;const u8 *fw_ptr;
@@ -854,21 +862,6 @@ static int btintel_download_firmware_paywhile (fw_ptr - fw->data < fw->size) {struct hci_command_hdr *cmd = (void *)(fw_ptr + frag_len); -/* Each SKU has a different reset parameter to use in the -* HCI_Intel_Reset command and it is embedded in the firmware -* data. So, instead of using static value per SKU, check -* the firmware data and save it for later use. -*/ -if (le16_to_cpu (cmd->opcode) ==0xfc0e ) { -/* The boot parameter is the first 32-bit value -* and rest of 3 octets are reserved. -*/ - *boot_param =get_unaligned_le32 (fw_ptr + frag_len + -sizeof (*cmd)); - -bt_dev_dbg (hdev,"boot_param=0x%x" , *boot_param); - } - frag_len +=sizeof (*cmd) + cmd->plen;/* The parameter length of the secure send command requires
@@ -897,28 +890,101 @@ done:return err; } +static bool btintel_firmware_version (struct hci_dev *hdev, +u8 num,u8 ww,u8 yy, +const struct firmware *fw, +u32 *boot_addr) +{ +const u8 *fw_ptr; + + fw_ptr = fw->data; + +while (fw_ptr - fw->data < fw->size) { +struct hci_command_hdr *cmd = (void *)(fw_ptr); + +/* Each SKU has a different reset parameter to use in the +* HCI_Intel_Reset command and it is embedded in the firmware +* data. So, instead of using static value per SKU, check +* the firmware data and save it for later use. +*/ +if (le16_to_cpu (cmd->opcode) ==CMD_WRITE_BOOT_PARAMS ) { +struct cmd_write_boot_params *params; + + params = (void *)(fw_ptr +sizeof (*cmd)); + +bt_dev_info (hdev,"Boot Address: 0x%x" , +le32_to_cpu (params->boot_addr)); + +bt_dev_info (hdev,"Firmware Version: %u-%u.%u" , + params->fw_build_num, params->fw_build_ww, + params->fw_build_yy); + +return (num == params->fw_build_num && + ww == params->fw_build_ww && + yy == params->fw_build_yy); + } + + fw_ptr +=sizeof (*cmd) + cmd->plen; + } + +return false; +} +int btintel_download_firmware (struct hci_dev *hdev, +struct intel_version *ver,const struct firmware *fw,u32 *boot_param) {int err; +/* SfP and WsP don't seem to update the firmware version on file +* so version checking is currently not possible. +*/ +switch (ver->hw_variant) { +case 0x0b :/* SfP */ +case 0x0c :/* WsP */ +/* Skip version checking */ +break ; +default : +/* Skip download if firmware has the same version */ +if (btintel_firmware_version (hdev, ver->fw_build_num, + ver->fw_build_ww, ver->fw_build_yy, + fw, boot_param)) { +bt_dev_info (hdev,"Firmware already loaded" ); +/* Return -EALREADY to indicate that the firmware has +* already been loaded. +*/ +return -EALREADY ; + } + } + err =btintel_sfi_rsa_header_secure_send (hdev, fw);if (err)return err; -return btintel_download_firmware_payload (hdev, fw, boot_param, -RSA_HEADER_LEN ); +return btintel_download_firmware_payload (hdev, fw,RSA_HEADER_LEN ); }EXPORT_SYMBOL_GPL (btintel_download_firmware);int btintel_download_firmware_newgen (struct hci_dev *hdev, +struct intel_version_tlv *ver,const struct firmware *fw,u32 *boot_param,u8 hw_variant,u8 sbe_type) {int err;u32 css_header_ver; +/* Skip download if firmware has the same version */ +if (btintel_firmware_version (hdev, ver->min_fw_build_nn, + ver->min_fw_build_cw, ver->min_fw_build_yy, + fw, boot_param)) { +bt_dev_info (hdev,"Firmware already loaded" ); +/* Return -EALREADY to indicate that firmware has already been +* loaded. +*/ +return -EALREADY ; + } +/* iBT hardware variants 0x0b, 0x0c, 0x11, 0x12, 0x13, 0x14 support * only RSA secure boot engine. Hence, the corresponding sfi file will * have RSA header of 644 bytes followed by Command Buffer.
@@ -948,7 +1014,7 @@ int btintel_download_firmware_newgen(strif (err)return err; - err =btintel_download_firmware_payload (hdev, fw, boot_param,RSA_HEADER_LEN ); + err =btintel_download_firmware_payload (hdev, fw,RSA_HEADER_LEN );if (err)return err; }else if (hw_variant >=0x17 ) {
@@ -969,7 +1035,6 @@ int btintel_download_firmware_newgen(strreturn err; err =btintel_download_firmware_payload (hdev, fw, - boot_param,RSA_HEADER_LEN +ECDSA_HEADER_LEN );if (err)return err;
@@ -979,7 +1044,6 @@ int btintel_download_firmware_newgen(strreturn err; err =btintel_download_firmware_payload (hdev, fw, - boot_param,RSA_HEADER_LEN +ECDSA_HEADER_LEN );if (err)return err;
drivers/bluetooth/btintel.h +3 -2
@@ -157,9 +157,10 @@ struct regmap *btintel_regmap_init(strucint btintel_send_intel_reset (struct hci_dev *hdev,u32 boot_param);int btintel_read_boot_params (struct hci_dev *hdev,struct intel_boot_params *params); -int btintel_download_firmware (struct hci_dev *dev,const struct firmware *fw, -u32 *boot_param); +int btintel_download_firmware (struct hci_dev *dev,struct intel_version *ver, +const struct firmware *fw,u32 *boot_param);int btintel_download_firmware_newgen (struct hci_dev *hdev, +struct intel_version_tlv *ver,const struct firmware *fw,u32 *boot_param,u8 hw_variant,u8 sbe_type);
drivers/bluetooth/btusb.c +8 -1
@@ -2602,8 +2602,15 @@ static int btusb_intel_download_firmwareset_bit (BTUSB_DOWNLOADING , &data->flags);/* Start firmware downloading and get boot parameter */ - err =btintel_download_firmware (hdev, fw, boot_param); + err =btintel_download_firmware (hdev, ver, fw, boot_param);if (err <0 ) { +if (err == -EALREADY ) { +/* Firmware has already been loaded */ +set_bit (BTUSB_FIRMWARE_LOADED , &data->flags); + err =0 ; + goto done; + } +/* When FW download fails, send Intel Reset to retry * FW download. */
drivers/bluetooth/hci_intel.c +5 -2
@@ -735,7 +735,7 @@ static int intel_setup(struct hci_uart *set_bit (STATE_DOWNLOADING , &intel->flags);/* Start firmware downloading and get boot parameter */ - err =btintel_download_firmware (hdev, fw, &boot_param); + err =btintel_download_firmware (hdev, &ver, fw, &boot_param);if (err <0 ) goto done;
@@ -784,7 +784,10 @@ static int intel_setup(struct hci_uart * done:release_firmware (fw); -if (err <0 ) +/* Check if there was an error and if is not -EALREADY which means the +* firmware has already been loaded. +*/ +if (err <0 && err != -EALREADY )return err;/* We need to restore the default speed before Intel reset */
Greg Kroah-Hartman
maintainerPATCH 597/699 Bluetooth: btusb: fix use-after-free on marvell probe failure
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Johan Hovold <[email protected]>
[ Upstream commit c5b600a3c05b1a7a110d558df935a8fc8a471c79 ]
Make sure to stop any TX URBs submitted during Marvell OOB wakeup configuration on later probe failures to avoid use-after-free in the completion callback.
This issue was reported by Sashiko while reviewing a fix for a wakeup source leak in the btusb probe errors paths.
--- drivers/bluetooth/btusb.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-)
drivers/bluetooth/btusb.c +4 -2
@@ -4352,7 +4352,7 @@ static int btusb_probe(struct usb_interf err =usb_set_interface (data->udev,0 ,0 );if (err <0 ) {BT_ERR ("failed to set interface 0, alt 0 %d" , err); - goto out_free_dev; + goto err_kill_tx_urbs; } }
@@ -4360,7 +4360,7 @@ static int btusb_probe(struct usb_interf err =usb_driver_claim_interface (&btusb_driver, data->isoc, data);if (err <0 ) - goto out_free_dev; + goto err_kill_tx_urbs; }if (IS_ENABLED (CONFIG_BT_HCIBTUSB_BCM ) && data->diag) {
@@ -4391,6 +4391,8 @@ err_release_siblings:usb_set_intfdata (data->isoc,NULL );usb_driver_release_interface (&btusb_driver, data->isoc); } +err_kill_tx_urbs: +usb_kill_anchored_urbs (&data->tx_anchor); out_free_dev:if (data->reset_gpio)gpiod_put (data->reset_gpio);
Greg Kroah-Hartman
maintainerPATCH 598/699 Bluetooth: btusb: fix wakeup source leak on probe failure
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Johan Hovold <[email protected]>
[ Upstream commit 3d93e1bb0fb881fe3ef961d1120556658e9cac4d ]
Make sure to disable wakeup on probe failure to avoid leaking the wakeup source.
--- drivers/bluetooth/btusb.c | 18 +++++++++++++++--- 1 file changed, 15 insertions(+), 3 deletions(-)
drivers/bluetooth/btusb.c +15 -3
@@ -3501,6 +3501,11 @@ static int marvell_config_oob_wake(strucreturn 0 ; } +#else +static inline int marvell_config_oob_wake (struct hci_dev *hdev) +{ +return 0 ; +}#endif static int btusb_set_bdaddr_marvell(struct hci_dev *hdev,
@@ -4011,6 +4016,11 @@ static int btusb_config_oob_wake(structbt_dev_info (hdev,"OOB Wake-on-BT configured at IRQ %u" , irq); return 0; } +#else +static inline int btusb_config_oob_wake (struct hci_dev *hdev) +{ +return 0 ; +}#endif static void btusb_check_needs_reset_resume (struct usb_interface *intf)
@@ -4164,7 +4174,6 @@ static int btusb_probe(struct usb_interf hdev->notify = btusb_notify; hdev->prevent_wake = btusb_prevent_wake; -#ifdef CONFIG_PM err =btusb_config_oob_wake (hdev);if (err) goto out_free_dev;
@@ -4173,9 +4182,9 @@ static int btusb_probe(struct usb_interfif (id->driver_info &BTUSB_MARVELL && data->oob_wake_irq) { err =marvell_config_oob_wake (hdev);if (err) - goto out_free_dev; + goto err_disable_wakeup; } -#endif +if (id->driver_info &BTUSB_CW6622 )set_bit (HCI_QUIRK_BROKEN_STORED_LINK_KEY , &hdev->quirks);
@@ -4393,6 +4402,9 @@ err_release_siblings: } err_kill_tx_urbs:usb_kill_anchored_urbs (&data->tx_anchor); +err_disable_wakeup: +if (data->oob_wake_irq) +device_init_wakeup (&data->udev->dev, false); out_free_dev:if (data->reset_gpio)gpiod_put (data->reset_gpio);
Greg Kroah-Hartman
maintainerPATCH 599/699 vfio/pci: Release the VGA arbiter client on register_device() failure
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alex Williamson <[email protected]>
[ Upstream commit daedde7f024ecf88bc8e832ed40cf2c795f0796a ]
The re-order in the Fixes commit below displaced vfio_pci_vga_init() as the last failure point of what is now vfio_pci_core_register_device() without introducing an unwind for the VGA arbiter registration.
In current kernels this is mostly benign because vfio_pci_set_decode() only uses pci_dev state, but the original failure path could leave a callback with a freed vdev cookie. The stale registration also becomes unsafe again once the callback follows drvdata to the vfio device.
Add the required VGA unwind callout.
--- drivers/vfio/pci/vfio_pci.c | 1 + 1 file changed, 1 insertion(+)
drivers/vfio/pci/vfio_pci.c +1 -0
@@ -2094,6 +2094,7 @@ static int vfio_pci_probe(struct pci_dev out_power:if (!disable_idle_d3)vfio_pci_set_power_state (vdev,PCI_D0 ); +vfio_pci_vga_uninit (vdev); out_vf:vfio_pci_vf_uninit (vdev); out_reflck:
Greg Kroah-Hartman
maintainerPATCH 600/699 binder: fix UAF in binder_free_transaction()
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Carlos Llamas <[email protected]>
[ Upstream commit f223d27a546c1e1f48d38fd67760e78f068fe8c4 ]
In binder_free_transaction(), the t->to_proc is read under the t->lock. However, once the t->lock is dropped, the to_proc can die in parallel. This leads to a use-after-free error when we attempt to acquire its inner lock right afterwards:
==================================================================
BUG: KASAN: slab-use-after-free in _raw_spin_lock+0xe4/0x1a0 Write of size 4 at addr ffff00001125da70 by task B/672 CPU: 20 UID: 0 PID: 672 Comm: B Not tainted 7.1.0-rc6-00284-g8e65320d91cd #4 PREEMPT Hardware name: linux,dummy-virt (DT) Call trace: _raw_spin_lock+0xe4/0x1a0 binder_free_transaction+0x8c/0x320 binder_send_failed_reply+0x21c/0x2f8 binder_thread_release+0x488/0x7e0 binder_ioctl+0x12c0/0x29a0 [...] Allocated by task 675: __kmalloc_cache_noprof+0x174/0x444 binder_open+0x118/0xb70 do_dentry_open+0x374/0x1040 vfs_open+0x58/0x3bc [...] Freed by task 212: __kasan_slab_free+0x58/0x80 kfree+0x1a0/0x4a4 binder_proc_dec_tmpref+0x32c/0x5e0 binder_deferred_func+0xc48/0x104c process_one_work+0x53c/0xbc0 [...] ==================================================================
To prevent this, pin the target thread (t->to_thread) to guarantee the target process remains alive. Undelivered transactions without a target thread are already safe, as the target process can only be the current context in those paths.
--- drivers/android/binder.c | 13 +++++++++++++ 1 file changed, 13 insertions(+)
drivers/android/binder.c +13 -0
@@ -1909,10 +1909,19 @@ static void binder_free_txn_fixups(strucstatic void binder_free_transaction (struct binder_transaction *t) { +struct binder_thread *target_thread;struct binder_proc *target_proc;spin_lock (&t->lock); target_proc = t->to_proc; + target_thread = t->to_thread; +/* +* Pin target_thread to keep target_proc alive. Undelivered +* transactions with !target_thread are safe, as target_proc +* can only be the current context there. +*/ +if (target_thread) +atomic_inc (&target_thread->tmp_ref);spin_unlock (&t->lock);if (target_proc) {
@@ -1921,6 +1930,10 @@ static void binder_free_transaction(stru t->buffer->transaction =NULL ;binder_inner_proc_unlock (target_proc); } + +if (target_thread) +binder_thread_dec_tmpref (target_thread); +/* * If the transaction has no target_proc, then * t->buffer->transaction has already been cleared.
Greg Kroah-Hartman
maintainerPATCH 601/699 PCI: altera: Fix resource leaks on probe failure
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mahesh Vaidya <[email protected]>
[ Upstream commit 7a94138caeb27f3c49c1dbd93bf422098925bb28 ]
The chained IRQ handler is set during probe, but is only removed during the driver remove(). If pci_host_probe() fails, the handler and INTx IRQ domain remain set even though the devm-managed host bridge storage containing struct altera_pcie will be released, leaving the handler with a stale data pointer.
Interrupts are also enabled before pci_host_probe() is called. If probe fails after that point, the controller interrupt source should be disabled before the chained handler and INTx domain are removed.
So set the chained handler only after the INTx domain has been created. Disable controller interrupts during IRQ teardown, and tear the IRQ setup down if pci_host_probe() fails.
--- drivers/pci/controller/pcie-altera.c | 28 ++++++++++++++++++++++++++-- 1 file changed, 26 insertions(+), 2 deletions(-)
drivers/pci/controller/pcie-altera.c +26 -2
@@ -685,8 +685,18 @@ static int altera_pcie_init_irq_domain(sreturn 0 ; } +static void altera_pcie_disable_irq (struct altera_pcie *pcie) +{ +if (pcie->pcie_data->version ==ALTERA_PCIE_V1 || + pcie->pcie_data->version ==ALTERA_PCIE_V2 ) { +/* Disable all P2A interrupts */ +cra_writel (pcie,0 ,P2A_INT_ENABLE ); + } +} +static void altera_pcie_irq_teardown (struct altera_pcie *pcie) { +altera_pcie_disable_irq (pcie);irq_set_chained_handler_and_data (pcie->irq,NULL ,NULL );irq_domain_remove (pcie->irq_domain); }
@@ -711,7 +721,6 @@ static int altera_pcie_parse_dt(struct aif (pcie->irq <0 )return pcie->irq; -irq_set_chained_handler_and_data (pcie->irq, altera_pcie_isr, pcie);return 0 ; }
@@ -796,6 +805,12 @@ static int altera_pcie_probe(struct platreturn ret; } +/* +* The chained handler uses pcie->irq_domain, so set it only after the +* INTx domain has been created. +*/ +irq_set_chained_handler_and_data (pcie->irq, altera_pcie_isr, pcie); +/* clear all interrupts */ cra_writel (pcie,P2A_INT_STS_ALL ,P2A_INT_STATUS );/* enable all interrupts */
@@ -806,7 +821,16 @@ static int altera_pcie_probe(struct plat bridge->busnr = pcie->root_bus_nr; bridge->ops = &altera_pcie_ops; -return pci_host_probe (bridge); + ret =pci_host_probe (bridge); +if (ret) + goto err_teardown_irq; + +return 0 ; + +err_teardown_irq: +altera_pcie_irq_teardown (pcie); + +return ret; }static int altera_pcie_remove (struct platform_device *pdev)
Greg Kroah-Hartman
maintainerPATCH 602/699 media: atomisp: replace boolean comparison of values with bool variables
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Aditya Srivastava <[email protected]>
[ Upstream commit c606970d4250dfb95869a563975c08bab148137a ]
There are certain expressions in a condition in atomisp, where a boolean variable is compared with true/false in forms such as (foo == true) or (false != bar), which does not comply with the coding style rule by checkpatch.pl (CHK: BOOL_COMPARISON), according to which the boolean variables should be themselves used in the condition, rather than comparing with true or false.
E.g. In drivers/staging/media/atomisp/pci/atomisp_compat_css20.c:
if (asd->stream_prepared == false) {
Can be replaced with:
if (!asd->stream_prepared) {
Replace such expressions with boolean variables appropriately.
Stable-dep-of: f4d51e55dd47 ("staging: media: atomisp: reduce load_primary_binaries() stack usage")
--- drivers/staging/media/atomisp/pci/atomisp_compat_css20.c | 2 - drivers/staging/media/atomisp/pci/runtime/isys/src/virtual_isys.c | 12 +++++----- drivers/staging/media/atomisp/pci/sh_css.c | 12 +++++----- 3 files changed, 13 insertions(+), 13 deletions(-)
drivers/staging/media/atomisp/pci/atomisp_compat_css20.c +1 -1
@@ -1142,7 +1142,7 @@ int atomisp_css_start(struct atomisp_sub* Thus the stream created in set_fmt get destroyed and need to be * recreated in the next stream on. */ -if (asd->stream_prepared == false) { +if (!asd->stream_prepared) {if (__create_pipes (asd)) {dev_err (isp->dev,"create pipe error.\n" );return -EINVAL ;
drivers/staging/media/atomisp/pci/runtime/isys/src/virtual_isys.c +6 -6
@@ -179,12 +179,12 @@ ia_css_isys_error_t ia_css_isys_stream_c isys_stream->linked_isys_stream_id = isys_stream_descr->linked_isys_stream_id; rc =create_input_system_input_port (isys_stream_descr, &isys_stream->input_port); -if (rc == false) +if (!rc)return false; rc =create_input_system_channel (isys_stream_descr, false, &isys_stream->channel); -if (rc == false) { +if (!rc) {destroy_input_system_input_port (&isys_stream->input_port);return false; }
@@ -204,7 +204,7 @@ ia_css_isys_error_t ia_css_isys_stream_cif (isys_stream_descr->metadata.enable) { rc =create_input_system_channel (isys_stream_descr, true, &isys_stream->md_channel); -if (rc == false) { +if (!rc) {destroy_input_system_input_port (&isys_stream->input_port);destroy_input_system_channel (&isys_stream->channel);return false;
@@ -248,7 +248,7 @@ ia_css_isys_error_t ia_css_isys_stream_c isys_stream_descr, &isys_stream_cfg->channel_cfg, false); -if (rc == false) +if (!rc)return false;/* configure metadata channel */
@@ -260,7 +260,7 @@ ia_css_isys_error_t ia_css_isys_stream_c isys_stream_descr, &isys_stream_cfg->md_channel_cfg, true); -if (rc == false) +if (!rc)return false; }
@@ -269,7 +269,7 @@ ia_css_isys_error_t ia_css_isys_stream_c &isys_stream->input_port, isys_stream_descr, &isys_stream_cfg->input_port_cfg); -if (rc == false) +if (!rc)return false; isys_stream->valid =1 ;
drivers/staging/media/atomisp/pci/sh_css.c +6 -6
@@ -1058,7 +1058,7 @@ sh_css_config_input_network(struct ia_csia_css_debug_dtrace (IA_CSS_DEBUG_TRACE_PRIVATE ,"sh_css_config_input_network() enter 0x%p:\n" , stream); -if (stream->config.continuous == true) +if (stream->config.continuous) {if (stream->last_pipe->config.mode ==IA_CSS_PIPE_MODE_CAPTURE ) { pipe = stream->last_pipe;
@@ -5622,7 +5622,7 @@ static int load_video_binaries(struct ia }else {/* output from main binary is not yuv line. currently this is * possible only when bci is enabled on vfpp output */ -assert (pipe->config.enable_vfpp_bci == true); +assert (pipe->config.enable_vfpp_bci);ia_css_pipe_get_yuvscaler_binarydesc (pipe, &vf_pp_descr, &mycs->video_binary.vf_frame_info, pipe_vf_out_info,NULL ,NULL );
@@ -8068,7 +8068,7 @@ create_host_regular_capture_pipeline(strstruct ia_css_frame *tmp_out_frame =NULL ;for (i =0 ; i < num_yuv_scaler; i++) { -if (is_output_stage[i] == true) +if (is_output_stage[i]) tmp_out_frame = out_frame;else tmp_out_frame =NULL ;
@@ -8460,7 +8460,7 @@ sh_css_pipeline_add_acc_stage(struct ia_/* In QoS case, load_extension already called, so skipping */ int err =0 ; -if (fw->loaded == false) +if (!fw->loaded) err =acc_load_extension (fw); ia_css_debug_dtrace(IA_CSS_DEBUG_TRACE,
@@ -9697,8 +9697,8 @@ ia_css_stream_destroy(struct ia_css_streassert (entry);if (entry) {/* get the SP thread id */ -if (ia_css_pipeline_get_sp_thread_id ( -ia_css_pipe_get_pipe_num (entry), &sp_thread_id) != true) +if (!ia_css_pipeline_get_sp_thread_id ( +ia_css_pipe_get_pipe_num (entry), &sp_thread_id))return -EINVAL ;/* get the target input terminal */ sp_pipeline_input_terminal =
Greg Kroah-Hartman
maintainerPATCH 603/699 media: staging: media: atomisp: Fix sh_css.c brace coding style issues
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Martiros Shakhzadyan <[email protected]>
[ Upstream commit 6ceb557604e85c55bce0585216623c21c7a00453 ]
Fix brace coding style issues.
Stable-dep-of: f4d51e55dd47 ("staging: media: atomisp: reduce load_primary_binaries() stack usage")
--- drivers/staging/media/atomisp/pci/sh_css.c | 224 +++++++++++------------------ 1 file changed, 90 insertions(+), 134 deletions(-)
drivers/staging/media/atomisp/pci/sh_css.c +90 -134
@@ -456,15 +456,15 @@ static enum ia_css_frame_format yuv422_c* by the copy binary given the stream format. * */ static int -verify_copy_out_frame_format (struct ia_css_pipe *pipe) { +verify_copy_out_frame_format (struct ia_css_pipe *pipe) +{enum ia_css_frame_format out_fmt = pipe->output_info[0 ].format;unsigned int i, found =0 ;assert (pipe);assert (pipe->stream); -switch (pipe->stream->config.input_config.format) - { +switch (pipe->stream->config.input_config.format) {case ATOMISP_INPUT_FORMAT_YUV420_8_LEGACY :case ATOMISP_INPUT_FORMAT_YUV420_8 :for (i =0 ; i <ARRAY_SIZE (yuv420_copy_formats) && !found; i++)
@@ -532,7 +532,8 @@ ia_css_stream_input_format_bits_per_pixe#if !defined(ISP2401 )static int -sh_css_config_input_network (struct ia_css_stream *stream) { +sh_css_config_input_network (struct ia_css_stream *stream) +{unsigned int fmt_type;struct ia_css_pipe *pipe = stream->last_pipe;struct ia_css_binary *binary =NULL ;
@@ -558,8 +559,7 @@ sh_css_config_input_network(struct ia_cs stream->config.mode);if ((binary && (binary->online || stream->config.continuous)) || - pipe->config.mode ==IA_CSS_PIPE_MODE_COPY ) - { + pipe->config.mode ==IA_CSS_PIPE_MODE_COPY ) { err =ia_css_ifmtr_configure (&stream->config, binary);if (err)
@@ -567,8 +567,7 @@ sh_css_config_input_network(struct ia_cs }if (stream->config.mode ==IA_CSS_INPUT_MODE_TPG || - stream->config.mode ==IA_CSS_INPUT_MODE_PRBS ) - { + stream->config.mode ==IA_CSS_INPUT_MODE_PRBS ) {unsigned int hblank_cycles =100 , vblank_lines =6 , width,
@@ -723,35 +722,32 @@ static bool sh_css_translate_stream_cfg_switch (stream_cfg->mode) {case IA_CSS_INPUT_MODE_TPG : -if (stream_cfg->source.tpg.id ==IA_CSS_TPG_ID0 ) { +if (stream_cfg->source.tpg.id ==IA_CSS_TPG_ID0 ) isys_stream_descr->input_port_id =INPUT_SYSTEM_PIXELGEN_PORT0_ID ; - }else if (stream_cfg->source.tpg.id ==IA_CSS_TPG_ID1 ) { +else if (stream_cfg->source.tpg.id ==IA_CSS_TPG_ID1 ) isys_stream_descr->input_port_id =INPUT_SYSTEM_PIXELGEN_PORT1_ID ; - }else if (stream_cfg->source.tpg.id ==IA_CSS_TPG_ID2 ) { +else if (stream_cfg->source.tpg.id ==IA_CSS_TPG_ID2 ) isys_stream_descr->input_port_id =INPUT_SYSTEM_PIXELGEN_PORT2_ID ; - }break ;case IA_CSS_INPUT_MODE_PRBS : -if (stream_cfg->source.prbs.id ==IA_CSS_PRBS_ID0 ) { +if (stream_cfg->source.prbs.id ==IA_CSS_PRBS_ID0 ) isys_stream_descr->input_port_id =INPUT_SYSTEM_PIXELGEN_PORT0_ID ; - }else if (stream_cfg->source.prbs.id ==IA_CSS_PRBS_ID1 ) { +else if (stream_cfg->source.prbs.id ==IA_CSS_PRBS_ID1 ) isys_stream_descr->input_port_id =INPUT_SYSTEM_PIXELGEN_PORT1_ID ; - }else if (stream_cfg->source.prbs.id ==IA_CSS_PRBS_ID2 ) { +else if (stream_cfg->source.prbs.id ==IA_CSS_PRBS_ID2 ) isys_stream_descr->input_port_id =INPUT_SYSTEM_PIXELGEN_PORT2_ID ; - }break ;case IA_CSS_INPUT_MODE_BUFFERED_SENSOR : -if (stream_cfg->source.port.port ==MIPI_PORT0_ID ) { +if (stream_cfg->source.port.port ==MIPI_PORT0_ID ) isys_stream_descr->input_port_id =INPUT_SYSTEM_CSI_PORT0_ID ; - }else if (stream_cfg->source.port.port ==MIPI_PORT1_ID ) { +else if (stream_cfg->source.port.port ==MIPI_PORT1_ID ) isys_stream_descr->input_port_id =INPUT_SYSTEM_CSI_PORT1_ID ; - }else if (stream_cfg->source.port.port ==MIPI_PORT2_ID ) { +else if (stream_cfg->source.port.port ==MIPI_PORT2_ID ) isys_stream_descr->input_port_id =INPUT_SYSTEM_CSI_PORT2_ID ; - }break ;default :
@@ -804,15 +800,14 @@ static bool sh_css_translate_stream_cfg_ rc = true;switch (stream_cfg->mode) {case IA_CSS_INPUT_MODE_TPG : -if (stream_cfg->source.tpg.mode ==IA_CSS_TPG_MODE_RAMP ) { +if (stream_cfg->source.tpg.mode ==IA_CSS_TPG_MODE_RAMP ) isys_stream_descr->tpg_port_attr.mode =PIXELGEN_TPG_MODE_RAMP ; - }else if (stream_cfg->source.tpg.mode ==IA_CSS_TPG_MODE_CHECKERBOARD ) { +else if (stream_cfg->source.tpg.mode ==IA_CSS_TPG_MODE_CHECKERBOARD ) isys_stream_descr->tpg_port_attr.mode =PIXELGEN_TPG_MODE_CHBO ; - }else if (stream_cfg->source.tpg.mode ==IA_CSS_TPG_MODE_MONO ) { +else if (stream_cfg->source.tpg.mode ==IA_CSS_TPG_MODE_MONO ) isys_stream_descr->tpg_port_attr.mode =PIXELGEN_TPG_MODE_MONO ; - }else { +else rc = false; - }/* * TODO
@@ -951,12 +946,12 @@ static bool sh_css_translate_stream_cfg_ stream_cfg->mode == IA_CSS_INPUT_MODE_BUFFERED_SENSOR) && stream_cfg->source.port.compression.type != IA_CSS_CSI2_COMPRESSION_TYPE_NONE) {if (stream_cfg->source.port.compression.uncompressed_bits_per_pixel == -UNCOMPRESSED_BITS_PER_PIXEL_10 ) { +UNCOMPRESSED_BITS_PER_PIXEL_10 ) fmt_type =ATOMISP_INPUT_FORMAT_RAW_10 ; - }else if (stream_cfg->source.port.compression.uncompressed_bits_per_pixel == -UNCOMPRESSED_BITS_PER_PIXEL_12 ) { +else if (stream_cfg->source.port.compression.uncompressed_bits_per_pixel == +UNCOMPRESSED_BITS_PER_PIXEL_12 ) fmt_type =ATOMISP_INPUT_FORMAT_RAW_12 ; - }else +else return false; }
@@ -1043,7 +1038,8 @@ static bool sh_css_translate_binary_info }static int -sh_css_config_input_network (struct ia_css_stream *stream) { +sh_css_config_input_network (struct ia_css_stream *stream) +{bool rc;ia_css_isys_descr_t isys_stream_descr;unsigned int sp_thread_id;
@@ -1058,19 +1054,16 @@ sh_css_config_input_network(struct ia_csia_css_debug_dtrace (IA_CSS_DEBUG_TRACE_PRIVATE ,"sh_css_config_input_network() enter 0x%p:\n" , stream); -if (stream->config.continuous) - { -if (stream->last_pipe->config.mode ==IA_CSS_PIPE_MODE_CAPTURE ) { +if (stream->config.continuous) { +if (stream->last_pipe->config.mode ==IA_CSS_PIPE_MODE_CAPTURE ) pipe = stream->last_pipe; - }else if (stream->last_pipe->config.mode ==IA_CSS_PIPE_MODE_YUVPP ) { +else if (stream->last_pipe->config.mode ==IA_CSS_PIPE_MODE_YUVPP ) pipe = stream->last_pipe; - }else if (stream->last_pipe->config.mode ==IA_CSS_PIPE_MODE_PREVIEW ) { +else if (stream->last_pipe->config.mode ==IA_CSS_PIPE_MODE_PREVIEW ) pipe = stream->last_pipe->pipe_settings.preview.copy_pipe; - }else if (stream->last_pipe->config.mode ==IA_CSS_PIPE_MODE_VIDEO ) { +else if (stream->last_pipe->config.mode ==IA_CSS_PIPE_MODE_VIDEO ) pipe = stream->last_pipe->pipe_settings.video.copy_pipe; - } - }else - { + }else { pipe = stream->last_pipe;if (stream->last_pipe->config.mode ==IA_CSS_PIPE_MODE_CAPTURE ) {/*
@@ -1093,8 +1086,7 @@ sh_css_config_input_network(struct ia_csif (pipe->pipeline.stages->binary) binary = pipe->pipeline.stages->binary; -if (binary) - { +if (binary) {/* this was being done in ifmtr in 2400. * online and cont bypass the init_in_frameinfo_memory_defaults * so need to do it here
@@ -1208,11 +1200,10 @@ static inline struct ia_css_pipe *streamstruct ia_css_pipe *target_pipe;/* get the pipe that consumes the stream */ -if (stream->config.continuous) { +if (stream->config.continuous) target_pipe =stream_get_copy_pipe (stream); - }else { +else target_pipe =stream_get_last_pipe (stream); - }return target_pipe; }
@@ -1386,7 +1377,8 @@ start_binary(struct ia_css_pipe *pipe,/* start the copy function on the SP */ static int start_copy_on_sp (struct ia_css_pipe *pipe, -struct ia_css_frame *out_frame) { +struct ia_css_frame *out_frame) +{ (void )out_frame;assert (pipe);assert (pipe->stream);
@@ -1404,8 +1396,7 @@ start_copy_on_sp(struct ia_css_pipe *pipsh_css_sp_start_binary_copy (ia_css_pipe_get_pipe_num (pipe), out_frame, pipe->stream->config.pixels_per_clock ==2 );#if !defined(ISP2401 ) -if (pipe->stream->reconfigure_css_rx) - { +if (pipe->stream->reconfigure_css_rx) {ia_css_isys_rx_configure (&pipe->stream->csi_rx_config, pipe->stream->config.mode); pipe->stream->reconfigure_css_rx = false;
@@ -1594,7 +1585,8 @@ ia_css_reset_defaults(struct sh_css *cssint ia_css_load_firmware (struct device *dev,const struct ia_css_env *env, -const struct ia_css_fw *fw) { +const struct ia_css_fw *fw) +{int err;if (!env)
@@ -1605,16 +1597,14 @@ ia_css_load_firmware(struct device *dev,ia_css_debug_dtrace (IA_CSS_DEBUG_TRACE ,"ia_css_load_firmware() enter\n" );/* make sure we initialize my_css */ -if (my_css.flush != env->cpu_mem_env.flush) - { +if (my_css.flush != env->cpu_mem_env.flush) {ia_css_reset_defaults (&my_css); my_css.flush = env->cpu_mem_env.flush; }ia_css_unload_firmware ();/* in case we are called twice */ err =sh_css_load_firmware (dev, fw->data, fw->bytes); -if (!err) - { +if (!err) { err =ia_css_binary_init_infos ();if (!err) fw_explicitly_loaded = true;
@@ -1628,7 +1618,8 @@ int ia_css_init(struct device *dev, const struct ia_css_env *env, const struct ia_css_fw *fw, u32 mmu_l1_base, - enum ia_css_irq_type irq_type) { + enum ia_css_irq_type irq_type) +{ int err;ia_css_spctrl_cfg spctrl_cfg;
@@ -1702,16 +1693,14 @@ ia_css_init(struct device *dev, const st my_css.flush = flush_func; err =ia_css_rmgr_init (); -if (err) - { +if (err) {IA_CSS_LEAVE_ERR (err);return err; }IA_CSS_LOG ("init: %d" , my_css_save_initialized); -if (!my_css_save_initialized) - { +if (!my_css_save_initialized) { my_css_save_initialized = true; my_css_save.mode = sh_css_mode_working; memset(my_css_save.stream_seeds, 0,
@@ -1739,19 +1728,16 @@ ia_css_init(struct device *dev, const stgpio_reg_store (GPIO0_ID , _gpio_block_reg_do_0,0 ); err =ia_css_refcount_init (REFCOUNT_SIZE ); -if (err) - { +if (err) {IA_CSS_LEAVE_ERR (err);return err; } err =sh_css_params_init (); -if (err) - { +if (err) {IA_CSS_LEAVE_ERR (err);return err; } -if (fw) - { +if (fw) {ia_css_unload_firmware ();/* in case we already had firmware loaded */ err =sh_css_load_firmware (dev, fw->data, fw->bytes);if (err) {
@@ -1772,23 +1758,20 @@ ia_css_init(struct device *dev, const streturn -EINVAL ; err =ia_css_spctrl_load_fw (SP0_ID , &spctrl_cfg); -if (err) - { +if (err) {IA_CSS_LEAVE_ERR (err);return err; }#if WITH_PC_MONITORING -if (!thread_alive) - { +if (!thread_alive) { thread_alive++;sh_css_print ("PC_MONITORING: %s() -- create thread DISABLED\n" , __func__);spying_thread_create (); }#endif -if (!sh_css_hrt_system_is_idle ()) - { +if (!sh_css_hrt_system_is_idle ()) {IA_CSS_LEAVE_ERR (-EBUSY );return -EBUSY ; }
@@ -1821,7 +1804,8 @@ ia_css_init(struct device *dev, const st }int -ia_css_enable_isys_event_queue (bool enable) { +ia_css_enable_isys_event_queue (bool enable) +{if (sh_css_sp_is_running ())return -EBUSY ;sh_css_sp_enable_isys_event_queue (enable);
@@ -1842,7 +1826,8 @@ sh_css_flush(struct ia_css_acc_fw *fw)* doing it from stream_create since we could run out of sp threads due to * allocation on inactive pipelines. */ static int -map_sp_threads (struct ia_css_stream *stream,bool map) { +map_sp_threads (struct ia_css_stream *stream,bool map) +{struct ia_css_pipe *main_pipe =NULL ;struct ia_css_pipe *copy_pipe =NULL ;struct ia_css_pipe *capture_pipe =NULL ;
@@ -1854,8 +1839,7 @@ map_sp_threads(struct ia_css_stream *strIA_CSS_ENTER_PRIVATE ("stream = %p, map = %s" , stream, map ?"true" :"false" ); -if (!stream) - { +if (!stream) {IA_CSS_LEAVE_ERR_PRIVATE (-EINVAL );return -EINVAL ; }
@@ -1865,8 +1849,7 @@ map_sp_threads(struct ia_css_stream *stria_css_pipeline_map (main_pipe->pipe_num, map); -switch (pipe_id) - { +switch (pipe_id) {case IA_CSS_PIPE_ID_PREVIEW : copy_pipe = main_pipe->pipe_settings.preview.copy_pipe; capture_pipe = main_pipe->pipe_settings.preview.capture_pipe;
@@ -1885,23 +1868,17 @@ map_sp_threads(struct ia_css_stream *str }if (acc_pipe) - {ia_css_pipeline_map (acc_pipe->pipe_num, map); - }if (capture_pipe) - {ia_css_pipeline_map (capture_pipe->pipe_num, map); - }/* Firmware expects copy pipe to be the last pipe mapped. (if needed) */ if (copy_pipe) - {ia_css_pipeline_map (copy_pipe->pipe_num, map); - } +/* DH regular multi pipe - not continuous mode: map the next pipes too */ -if (!stream->config.continuous) - { +if (!stream->config.continuous) {int i;for (i =1 ; i < stream->num_pipes; i++)
@@ -1915,7 +1892,8 @@ map_sp_threads(struct ia_css_stream *str/* creates a host pipeline skeleton for all pipes in a stream. Called during * stream_create. */ static int -create_host_pipeline_structure (struct ia_css_stream *stream) { +create_host_pipeline_structure (struct ia_css_stream *stream) +{struct ia_css_pipe *copy_pipe =NULL , *capture_pipe =NULL ;struct ia_css_pipe *acc_pipe =NULL ;enum ia_css_pipe_id pipe_id;
@@ -1927,24 +1905,21 @@ create_host_pipeline_structure(struct iaassert (stream);IA_CSS_ENTER_PRIVATE ("stream = %p" , stream); -if (!stream) - { +if (!stream) {IA_CSS_LEAVE_ERR_PRIVATE (-EINVAL );return -EINVAL ; } main_pipe = stream->last_pipe;assert (main_pipe); -if (!main_pipe) - { +if (!main_pipe) {IA_CSS_LEAVE_ERR_PRIVATE (-EINVAL );return -EINVAL ; } pipe_id = main_pipe->mode; -switch (pipe_id) - { +switch (pipe_id) {case IA_CSS_PIPE_ID_PREVIEW : copy_pipe = main_pipe->pipe_settings.preview.copy_pipe; copy_pipe_delay = main_pipe->dvs_frame_delay;
@@ -1984,30 +1959,23 @@ create_host_pipeline_structure(struct ia }if (!(err) && copy_pipe) - { err =ia_css_pipeline_create (©_pipe->pipeline, copy_pipe->mode, copy_pipe->pipe_num, copy_pipe_delay); - }if (!(err) && capture_pipe) - { err =ia_css_pipeline_create (&capture_pipe->pipeline, capture_pipe->mode, capture_pipe->pipe_num, capture_pipe_delay); - }if (!(err) && acc_pipe) - { err =ia_css_pipeline_create (&acc_pipe->pipeline, acc_pipe->mode, acc_pipe->pipe_num, main_pipe->dvs_frame_delay); - }/* DH regular multi pipe - not continuous mode: create the next pipelines too */ -if (!stream->config.continuous) - { +if (!stream->config.continuous) {int i;for (i =1 ; i < stream->num_pipes &&0 == err; i++) {
@@ -2026,7 +1994,8 @@ create_host_pipeline_structure(struct ia/* creates a host pipeline for all pipes in a stream. Called during * stream_start. */ static int -create_host_pipeline (struct ia_css_stream *stream) { +create_host_pipeline (struct ia_css_stream *stream) +{struct ia_css_pipe *copy_pipe =NULL , *capture_pipe =NULL ;struct ia_css_pipe *acc_pipe =NULL ;enum ia_css_pipe_id pipe_id;
@@ -2035,8 +2004,7 @@ create_host_pipeline(struct ia_css_streaunsigned int max_input_width =0 ;IA_CSS_ENTER_PRIVATE ("stream = %p" , stream); -if (!stream) - { +if (!stream) {IA_CSS_LEAVE_ERR_PRIVATE (-EINVAL );return -EINVAL ; }
@@ -2047,8 +2015,7 @@ create_host_pipeline(struct ia_css_strea/* No continuous frame allocation for capture pipe. It uses the * "main" pipe's frames. */ if ((pipe_id ==IA_CSS_PIPE_ID_PREVIEW ) || - (pipe_id ==IA_CSS_PIPE_ID_VIDEO )) - { + (pipe_id ==IA_CSS_PIPE_ID_VIDEO )) {/* About pipe_id == IA_CSS_PIPE_ID_PREVIEW && stream->config.mode != IA_CSS_INPUT_MODE_MEMORY: * The original condition pipe_id == IA_CSS_PIPE_ID_PREVIEW is too strong. E.g. in SkyCam (with memory * based input frames) there is no continuous mode and thus no need for allocated continuous frames
@@ -2066,24 +2033,21 @@ create_host_pipeline(struct ia_css_strea#if !defined(ISP2401 )/* old isys: need to allocate_mipi_frames() even in IA_CSS_PIPE_MODE_COPY */ -if (pipe_id !=IA_CSS_PIPE_ID_ACC ) - { +if (pipe_id !=IA_CSS_PIPE_ID_ACC ) { err =allocate_mipi_frames (main_pipe, &stream->info);if (err) goto ERR; }#elif defined(ISP2401 )if ((pipe_id !=IA_CSS_PIPE_ID_ACC ) && - (main_pipe->config.mode !=IA_CSS_PIPE_MODE_COPY )) - { + (main_pipe->config.mode !=IA_CSS_PIPE_MODE_COPY )) { err =allocate_mipi_frames (main_pipe, &stream->info);if (err) goto ERR; }#endif -switch (pipe_id) - { +switch (pipe_id) {case IA_CSS_PIPE_ID_PREVIEW : copy_pipe = main_pipe->pipe_settings.preview.copy_pipe; capture_pipe = main_pipe->pipe_settings.preview.capture_pipe;
@@ -2133,31 +2097,27 @@ create_host_pipeline(struct ia_css_streaif (err) goto ERR; -if (copy_pipe) - { +if (copy_pipe) { err =create_host_copy_pipeline (copy_pipe, max_input_width, main_pipe->continuous_frames[0 ]);if (err) goto ERR; } -if (capture_pipe) - { +if (capture_pipe) { err =create_host_capture_pipeline (capture_pipe);if (err) goto ERR; } -if (acc_pipe) - { +if (acc_pipe) { err =create_host_acc_pipeline (acc_pipe);if (err) goto ERR; }/* DH regular multi pipe - not continuous mode: create the next pipelines too */ -if (!stream->config.continuous) - { +if (!stream->config.continuous) {int i;for (i =1 ; i < stream->num_pipes &&0 == err; i++) {
@@ -2199,10 +2159,10 @@ static const struct ia_css_yuvpp_settingstatic int init_pipe_defaults (enum ia_css_pipe_mode mode,struct ia_css_pipe *pipe, -bool copy_pipe) { +bool copy_pipe) +{ -if (!pipe) - { +if (!pipe) {IA_CSS_ERROR ("NULL pipe parameter" );return -EINVAL ; }
@@ -2211,18 +2171,17 @@ init_pipe_defaults(enum ia_css_pipe_modememcpy (pipe, &default_pipe,sizeof (default_pipe));/* TODO: JB should not be needed, but temporary backward reference */ -switch (mode) - { +switch (mode) {case IA_CSS_PIPE_MODE_PREVIEW : pipe->mode =IA_CSS_PIPE_ID_PREVIEW ;memcpy (&pipe->pipe_settings.preview, &preview,sizeof (preview));break ;case IA_CSS_PIPE_MODE_CAPTURE : -if (copy_pipe) { +if (copy_pipe) pipe->mode =IA_CSS_PIPE_ID_COPY ; - }else { +else pipe->mode =IA_CSS_PIPE_ID_CAPTURE ; - } +memcpy (&pipe->pipe_settings.capture, &capture,sizeof (capture));break ;case IA_CSS_PIPE_MODE_VIDEO :
@@ -2252,27 +2211,25 @@ pipe_global_init(void)u8 i; my_css.pipe_counter =0 ; -for (i =0 ; i <IA_CSS_PIPELINE_NUM_MAX ; i++) { +for (i =0 ; i <IA_CSS_PIPELINE_NUM_MAX ; i++) my_css.all_pipes[i] =NULL ; - } }static int pipe_generate_pipe_num (const struct ia_css_pipe *pipe, -unsigned int *pipe_number) { +unsigned int *pipe_number) +{const u8 INVALID_PIPE_NUM = (uint8_t )~(0 );u8 pipe_num =INVALID_PIPE_NUM ;u8 i; -if (!pipe) - { +if (!pipe) {IA_CSS_ERROR ("NULL pipe parameter" );return -EINVAL ; }/* Assign a new pipe_num .... search for empty place */ -for (i =0 ; i <IA_CSS_PIPELINE_NUM_MAX ; i++) - { +for (i =0 ; i <IA_CSS_PIPELINE_NUM_MAX ; i++) {if (!my_css.all_pipes[i]) {/*position is reserved */ my_css.all_pipes[i] = (struct ia_css_pipe *)pipe;
@@ -2280,8 +2237,7 @@ pipe_generate_pipe_num(const struct ia_cbreak ; } } -if (pipe_num ==INVALID_PIPE_NUM ) - { +if (pipe_num ==INVALID_PIPE_NUM ) {/* Max number of pipes already allocated */ IA_CSS_ERROR ("Max number of pipes already created" );return -ENOSPC ;
Greg Kroah-Hartman
maintainerPATCH 604/699 media: staging: media: atomisp: Fix the rest of sh_css.c brace issues
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Martiros Shakhzadyan <[email protected]>
[ Upstream commit 7394bf6d3c1e8316484fcf3a9d71daaab489f211 ]
Fix the remainder of brace coding style issues.
Stable-dep-of: f4d51e55dd47 ("staging: media: atomisp: reduce load_primary_binaries() stack usage")
--- drivers/staging/media/atomisp/pci/sh_css.c | 1134 ++++++++++++----------------- 1 file changed, 498 insertions(+), 636 deletions(-)
drivers/staging/media/atomisp/pci/sh_css.c +498 -636
@@ -1101,8 +1101,7 @@ sh_css_config_input_network(struct ia_cs/* get the target input terminal */ sp_pipeline_input_terminal = &sh_css_sp_group.pipe_io[sp_thread_id].input; -for (i =0 ; i <IA_CSS_STREAM_MAX_ISYS_STREAM_PER_CH ; i++) - { +for (i =0 ; i <IA_CSS_STREAM_MAX_ISYS_STREAM_PER_CH ; i++) {/* initialization */ memset ((void *)(&isys_stream_descr),0 ,sizeof (ia_css_isys_descr_t)); sp_pipeline_input_terminal->context.virtual_input_system_stream[i].valid =0 ;
@@ -2161,7 +2160,6 @@ init_pipe_defaults(enum ia_css_pipe_mode struct ia_css_pipe *pipe, bool copy_pipe) { -if (!pipe) {IA_CSS_ERROR ("NULL pipe parameter" );return -EINVAL ;
@@ -2263,12 +2261,12 @@ pipe_release_pipe_num(unsigned int pipe_static int create_pipe (enum ia_css_pipe_mode mode,struct ia_css_pipe **pipe, -bool copy_pipe) { +bool copy_pipe) +{int err =0 ;struct ia_css_pipe *me; -if (!pipe) - { +if (!pipe) {IA_CSS_ERROR ("NULL pipe parameter" );return -EINVAL ; }
@@ -2278,15 +2276,13 @@ create_pipe(enum ia_css_pipe_mode mode,return -ENOMEM ; err =init_pipe_defaults (mode, me, copy_pipe); -if (err) - { +if (err) {kfree (me);return err; } err =pipe_generate_pipe_num (me, &me->pipe_num); -if (err) - { +if (err) {kfree (me);return err; }
@@ -2332,26 +2328,24 @@ static void sh_css_pipe_free_acc_binarie }int -ia_css_pipe_destroy (struct ia_css_pipe *pipe) { +ia_css_pipe_destroy (struct ia_css_pipe *pipe) +{int err =0 ;IA_CSS_ENTER ("pipe = %p" , pipe); -if (!pipe) - { +if (!pipe) {IA_CSS_LEAVE_ERR (-EINVAL );return -EINVAL ; } -if (pipe->stream) - { +if (pipe->stream) {IA_CSS_LOG ("ia_css_stream_destroy not called!" );IA_CSS_LEAVE_ERR (-EINVAL );return -EINVAL ; } -switch (pipe->config.mode) - { +switch (pipe->config.mode) {case IA_CSS_PIPE_MODE_PREVIEW :/* need to take into account that this function is also called on the internal copy pipe */
@@ -2415,9 +2409,8 @@ ia_css_pipe_destroy(struct ia_css_pipe */* Temporarily, not every sh_css_pipe has an acc_extension. */ if (pipe->config.acc_extension) - {ia_css_pipe_unload_extension (pipe, pipe->config.acc_extension); - } +kfree (pipe);IA_CSS_LEAVE ("err = %d" , err);return err;
@@ -2447,9 +2440,9 @@ ia_css_uninit(void) ifmtr_set_if_blocking_mode_reset = true;#endif -if (!fw_explicitly_loaded) { +if (!fw_explicitly_loaded)ia_css_unload_firmware (); - } +ia_css_spctrl_unload_fw (SP0_ID );sh_css_sp_set_sp_running (false);/* check and free any remaining mipi frames */
@@ -2636,7 +2629,8 @@ static int load_copy_binary(static int alloc_continuous_frames ( -struct ia_css_pipe *pipe,bool init_time) { +struct ia_css_pipe *pipe,bool init_time) +{int err =0 ;struct ia_css_frame_info ref_info;enum ia_css_pipe_id pipe_id;
@@ -2646,8 +2640,7 @@ alloc_continuous_frames(IA_CSS_ENTER_PRIVATE ("pipe = %p, init_time = %d" , pipe, init_time); -if ((!pipe) || (!pipe->stream)) - { +if ((!pipe) || (!pipe->stream)) {IA_CSS_LEAVE_ERR_PRIVATE (-EINVAL );return -EINVAL ; }
@@ -2655,26 +2648,22 @@ alloc_continuous_frames( pipe_id = pipe->mode; continuous = pipe->stream->config.continuous; -if (continuous) - { +if (continuous) {if (init_time) { num_frames = pipe->stream->config.init_num_cont_raw_buf; pipe->stream->continuous_pipe = pipe; - }else + }else { num_frames = pipe->stream->config.target_num_cont_raw_buf; - }else - { + } + }else { num_frames =NUM_ONLINE_INIT_CONTINUOUS_FRAMES ; } -if (pipe_id ==IA_CSS_PIPE_ID_PREVIEW ) - { +if (pipe_id ==IA_CSS_PIPE_ID_PREVIEW ) { ref_info = pipe->pipe_settings.preview.preview_binary.in_frame_info; - }else if (pipe_id ==IA_CSS_PIPE_ID_VIDEO ) - { + }else if (pipe_id ==IA_CSS_PIPE_ID_VIDEO ) { ref_info = pipe->pipe_settings.video.video_binary.in_frame_info; - }else - { + }else {/* should not happen */ IA_CSS_LEAVE_ERR_PRIVATE (-EINVAL );return -EINVAL ;
@@ -2690,8 +2679,7 @@ alloc_continuous_frames(#endif #if !defined(HAS_NO_PACKED_RAW_PIXELS ) -if (pipe->stream->config.pack_raw_pixels) - { +if (pipe->stream->config.pack_raw_pixels) {ia_css_debug_dtrace (IA_CSS_DEBUG_TRACE_PRIVATE ,"alloc_continuous_frames() IA_CSS_FRAME_FORMAT_RAW_PACKED\n" ); ref_info.format =IA_CSS_FRAME_FORMAT_RAW_PACKED ;
@@ -2720,8 +2708,7 @@ alloc_continuous_frames(else idx = pipe->stream->config.init_num_cont_raw_buf; -for (i = idx; i <NUM_CONTINUOUS_FRAMES ; i++) - { +for (i = idx; i <NUM_CONTINUOUS_FRAMES ; i++) {/* free previous frame */ if (pipe->continuous_frames[i]) {ia_css_frame_free (pipe->continuous_frames[i]);
@@ -2751,14 +2738,16 @@ alloc_continuous_frames( }int -ia_css_alloc_continuous_frame_remain (struct ia_css_stream *stream) { +ia_css_alloc_continuous_frame_remain (struct ia_css_stream *stream) +{if (!stream)return -EINVAL ;return alloc_continuous_frames (stream->continuous_pipe, false); }static int -load_preview_binaries (struct ia_css_pipe *pipe) { +load_preview_binaries (struct ia_css_pipe *pipe) +{struct ia_css_frame_info prev_in_info, prev_bds_out_info, prev_out_info,
@@ -2866,8 +2855,7 @@ load_preview_binaries(struct ia_css_pipe* then the preview binary selection is done again. */ if (need_vf_pp && - (mycs->preview_binary.out_frame_info[0 ].format !=IA_CSS_FRAME_FORMAT_YUV_LINE )) - { + (mycs->preview_binary.out_frame_info[0 ].format !=IA_CSS_FRAME_FORMAT_YUV_LINE )) {/* Preview step 2 */ if (pipe->vf_yuv_ds_input_info.res.width) prev_vf_info = pipe->vf_yuv_ds_input_info;
@@ -2892,8 +2880,7 @@ load_preview_binaries(struct ia_css_pipereturn err; } -if (need_vf_pp) - { +if (need_vf_pp) {struct ia_css_binary_descr vf_pp_descr;/* Viewfinder post-processing */
@@ -2924,8 +2911,7 @@ load_preview_binaries(struct ia_css_pipe#endif /* Copy */ -if (need_isp_copy_binary) - { +if (need_isp_copy_binary) { err =load_copy_binary (pipe, &mycs->copy_binary, &mycs->preview_binary);
@@ -2933,8 +2919,7 @@ load_preview_binaries(struct ia_css_pipereturn err; } -if (pipe->shading_table) - { +if (pipe->shading_table) {ia_css_shading_table_free (pipe->shading_table); pipe->shading_table =NULL ; }
@@ -2949,11 +2934,11 @@ ia_css_binary_unload(struct ia_css_binar }static int -unload_preview_binaries (struct ia_css_pipe *pipe) { +unload_preview_binaries (struct ia_css_pipe *pipe) +{IA_CSS_ENTER_PRIVATE ("pipe = %p" , pipe); -if ((!pipe) || (pipe->mode !=IA_CSS_PIPE_ID_PREVIEW )) - { +if ((!pipe) || (pipe->mode !=IA_CSS_PIPE_ID_PREVIEW )) {IA_CSS_LEAVE_ERR_PRIVATE (-EINVAL );return -EINVAL ; }
@@ -3006,15 +2991,15 @@ static int add_firmwares(struct ia_css_frame *in =NULL ;struct ia_css_frame *vf =NULL ; -if ((fw == last_fw) && (fw->info.isp.sp.enable.out_frame !=0 )) { +if ((fw == last_fw) && (fw->info.isp.sp.enable.out_frame !=0 )) out[0 ] = out_frame; - } -if (fw->info.isp.sp.enable.in_frame !=0 ) { + +if (fw->info.isp.sp.enable.in_frame !=0 ) in = in_frame; - } -if (fw->info.isp.sp.enable.out_frame !=0 ) { + +if (fw->info.isp.sp.enable.out_frame !=0 ) vf = vf_frame; - } +ia_css_pipe_get_firmwares_stage_desc (&stage_desc, binary, out, in, vf, fw, binary_mode); err = ia_css_pipeline_create_and_add_stage(me,
@@ -3228,7 +3213,8 @@ static void sh_css_setup_queues(void)static int init_vf_frameinfo_defaults (struct ia_css_pipe *pipe, -struct ia_css_frame *vf_frame,unsigned int idx) { +struct ia_css_frame *vf_frame,unsigned int idx) +{int err =0 ;unsigned int thread_id;enum sh_css_queue_id queue_id;
@@ -3393,7 +3379,8 @@ ia_css_get_crop_offsets(static int init_in_frameinfo_memory_defaults (struct ia_css_pipe *pipe, -struct ia_css_frame *frame,enum ia_css_frame_format format) { +struct ia_css_frame *frame,enum ia_css_frame_format format) +{struct ia_css_frame *in_frame;int err =0 ;unsigned int thread_id;
@@ -3434,7 +3421,8 @@ init_in_frameinfo_memory_defaults(structstatic int init_out_frameinfo_defaults (struct ia_css_pipe *pipe, -struct ia_css_frame *out_frame,unsigned int idx) { +struct ia_css_frame *out_frame,unsigned int idx) +{int err =0 ;unsigned int thread_id;enum sh_css_queue_id queue_id;
@@ -3665,14 +3653,14 @@ ERR: }static int -create_host_acc_pipeline (struct ia_css_pipe *pipe) { +create_host_acc_pipeline (struct ia_css_pipe *pipe) +{int err =0 ;const struct ia_css_fw_info *fw;unsigned int i;IA_CSS_ENTER_PRIVATE ("pipe = %p" , pipe); -if ((!pipe) || (!pipe->stream)) - { +if ((!pipe) || (!pipe->stream)) {IA_CSS_LEAVE_ERR_PRIVATE (-EINVAL );return -EINVAL ; }
@@ -3683,15 +3671,13 @@ create_host_acc_pipeline(struct ia_css_p pipe->pipeline.pipe_qos_config =0 ; fw = pipe->vf_stage; -for (i =0 ; fw; fw = fw->next) - { +for (i =0 ; fw; fw = fw->next) { err =sh_css_pipeline_add_acc_stage (&pipe->pipeline, fw);if (err) goto ERR; } -for (i =0 ; i < pipe->config.num_acc_stages; i++) - { +for (i =0 ; i < pipe->config.num_acc_stages; i++) {struct ia_css_fw_info *fw = pipe->config.acc_stages[i]; err =sh_css_pipeline_add_acc_stage (&pipe->pipeline, fw);
@@ -3708,7 +3694,8 @@ ERR:/* Create stages for preview */ static int -create_host_preview_pipeline (struct ia_css_pipe *pipe) { +create_host_preview_pipeline (struct ia_css_pipe *pipe) +{struct ia_css_pipeline_stage *copy_stage =NULL ;struct ia_css_pipeline_stage *preview_stage =NULL ;struct ia_css_pipeline_stage *vf_pp_stage =NULL ;
@@ -3728,8 +3715,7 @@ create_host_preview_pipeline(struct ia_c#endif IA_CSS_ENTER_PRIVATE ("pipe = %p" , pipe); -if ((!pipe) || (!pipe->stream) || (pipe->mode !=IA_CSS_PIPE_ID_PREVIEW )) - { +if ((!pipe) || (!pipe->stream) || (pipe->mode !=IA_CSS_PIPE_ID_PREVIEW )) {IA_CSS_LEAVE_ERR_PRIVATE (-EINVAL );return -EINVAL ; }
@@ -3757,16 +3743,14 @@ create_host_preview_pipeline(struct ia_c/* Construct in_frame info (only in case we have dynamic input */ need_in_frameinfo_memory = pipe->stream->config.mode ==IA_CSS_INPUT_MODE_MEMORY ;#endif -if (need_in_frameinfo_memory) - { +if (need_in_frameinfo_memory) { err =init_in_frameinfo_memory_defaults (pipe, &me->in_frame,IA_CSS_FRAME_FORMAT_RAW );if (err) goto ERR; in_frame = &me->in_frame; - }else - { + }else { in_frame =NULL ; }
@@ -3780,8 +3764,7 @@ create_host_preview_pipeline(struct ia_cif (pipe->pipe_settings.preview.vf_pp_binary.info) vf_pp_binary = &pipe->pipe_settings.preview.vf_pp_binary; -if (pipe->pipe_settings.preview.copy_binary.info) - { +if (pipe->pipe_settings.preview.copy_binary.info) {ia_css_pipe_util_set_output_frames (out_frames,0 ,NULL );ia_css_pipe_get_generic_stage_desc (&stage_desc, copy_binary, out_frames,NULL ,NULL );
@@ -3796,21 +3779,19 @@ create_host_preview_pipeline(struct ia_c/* When continuous is enabled, configure in_frame with the * last pipe, which is the copy pipe. */ -if (continuous || !online) { +if (continuous || !online) in_frame = pipe->stream->last_pipe->continuous_frames[0 ]; - } +#else in_frame = pipe->continuous_frames[0 ];#endif } -if (vf_pp_binary) - { +if (vf_pp_binary) {ia_css_pipe_util_set_output_frames (out_frames,0 ,NULL );ia_css_pipe_get_generic_stage_desc (&stage_desc, preview_binary, out_frames, in_frame,NULL ); - }else - { + }else {ia_css_pipe_util_set_output_frames (out_frames,0 , out_frame);ia_css_pipe_get_generic_stage_desc (&stage_desc, preview_binary, out_frames, in_frame,NULL );
@@ -3824,14 +3805,12 @@ create_host_preview_pipeline(struct ia_c preview_stage->args.copy_vf = preview_binary->info->sp.pipeline.mode ==IA_CSS_BINARY_MODE_COPY ; preview_stage->args.copy_output = !preview_stage->args.copy_vf; -if (preview_stage->args.copy_vf && !preview_stage->args.out_vf_frame) - { +if (preview_stage->args.copy_vf && !preview_stage->args.out_vf_frame) {/* in case of copy, use the vf frame as output frame */ preview_stage->args.out_vf_frame = preview_stage->args.out_frame[0 ]; } -if (vf_pp_binary) - { +if (vf_pp_binary) {if (preview_binary->info->sp.pipeline.mode ==IA_CSS_BINARY_MODE_COPY ) in_frame = preview_stage->args.out_vf_frame;else
@@ -3871,7 +3850,8 @@ static void send_raw_frames(struct ia_cs }static int -preview_start (struct ia_css_pipe *pipe) { +preview_start (struct ia_css_pipe *pipe) +{int err =0 ;struct ia_css_pipe *copy_pipe, *capture_pipe;struct ia_css_pipe *acc_pipe;
@@ -3881,8 +3861,7 @@ preview_start(struct ia_css_pipe *pipe)const struct ia_css_isp_parameters *params =NULL ;IA_CSS_ENTER_PRIVATE ("pipe = %p" , pipe); -if ((!pipe) || (!pipe->stream) || (pipe->mode !=IA_CSS_PIPE_ID_PREVIEW )) - { +if ((!pipe) || (!pipe->stream) || (pipe->mode !=IA_CSS_PIPE_ID_PREVIEW )) {IA_CSS_LEAVE_ERR_PRIVATE (-EINVAL );return -EINVAL ; }
@@ -3909,8 +3888,7 @@ preview_start(struct ia_css_pipe *pipe)ia_css_pipeline_get_sp_thread_id (ia_css_pipe_get_pipe_num (pipe), &thread_id); copy_ovrd =1 << thread_id; -if (pipe->stream->cont_capt) - { +if (pipe->stream->cont_capt) {ia_css_pipeline_get_sp_thread_id (ia_css_pipe_get_pipe_num (capture_pipe), &thread_id); copy_ovrd |=1 << thread_id;
@@ -3923,8 +3901,7 @@ preview_start(struct ia_css_pipe *pipe) }/* Construct and load the copy pipe */ -if (pipe->stream->config.continuous) - { +if (pipe->stream->config.continuous) { sh_css_sp_init_pipeline(©_pipe->pipeline, IA_CSS_PIPE_ID_COPY, (uint8_t)ia_css_pipe_get_pipe_num(copy_pipe),
@@ -3945,8 +3922,7 @@ preview_start(struct ia_css_pipe *pipe) }/* Construct and load the capture pipe */ -if (pipe->stream->cont_capt) - { +if (pipe->stream->cont_capt) { sh_css_sp_init_pipeline(&capture_pipe->pipeline, IA_CSS_PIPE_ID_CAPTURE, (uint8_t)ia_css_pipe_get_pipe_num(capture_pipe),
@@ -3964,8 +3940,7 @@ preview_start(struct ia_css_pipe *pipe) params); } -if (acc_pipe) - { +if (acc_pipe) { sh_css_sp_init_pipeline(&acc_pipe->pipeline, IA_CSS_PIPE_ID_ACC, (uint8_t)ia_css_pipe_get_pipe_num(acc_pipe),
@@ -3991,7 +3966,8 @@ preview_start(struct ia_css_pipe *pipe)int ia_css_pipe_enqueue_buffer (struct ia_css_pipe *pipe, -const struct ia_css_buffer *buffer) { +const struct ia_css_buffer *buffer) +{int return_err =0 ;unsigned int thread_id;enum sh_css_queue_id queue_id;
@@ -4006,8 +3982,7 @@ ia_css_pipe_enqueue_buffer(struct ia_cssIA_CSS_ENTER ("pipe=%p, buffer=%p" , pipe, buffer); -if ((!pipe) || (!buffer)) - { +if ((!pipe) || (!buffer)) {IA_CSS_LEAVE_ERR (-EINVAL );return -EINVAL ; }
@@ -4016,8 +3991,7 @@ ia_css_pipe_enqueue_buffer(struct ia_css/* following code will be enabled when IA_CSS_BUFFER_TYPE_SEC_OUTPUT_FRAME is removed */ #if 0 -if (buf_type ==IA_CSS_BUFFER_TYPE_OUTPUT_FRAME ) - { +if (buf_type ==IA_CSS_BUFFER_TYPE_OUTPUT_FRAME ) {bool found_pipe = false;for (i =0 ; i <IA_CSS_PIPE_MAX_OUTPUT_STAGE ; i++) {
@@ -4031,8 +4005,7 @@ ia_css_pipe_enqueue_buffer(struct ia_cssif (!found_pipe)return -EINVAL ; } -if (buf_type ==IA_CSS_BUFFER_TYPE_VF_OUTPUT_FRAME ) - { +if (buf_type ==IA_CSS_BUFFER_TYPE_VF_OUTPUT_FRAME ) {bool found_pipe = false;for (i =0 ; i <IA_CSS_PIPE_MAX_OUTPUT_STAGE ; i++) {
@@ -4055,34 +4028,29 @@ ia_css_pipe_enqueue_buffer(struct ia_cssassert (buf_type <IA_CSS_NUM_DYNAMIC_BUFFER_TYPE );if ((buf_type ==IA_CSS_BUFFER_TYPE_INVALID ) || (buf_type >=IA_CSS_NUM_DYNAMIC_BUFFER_TYPE ) || - (pipe_id >=IA_CSS_PIPE_ID_NUM )) - { + (pipe_id >=IA_CSS_PIPE_ID_NUM )) {IA_CSS_LEAVE_ERR (-EINVAL );return -EINVAL ; } ret_err =ia_css_pipeline_get_sp_thread_id (ia_css_pipe_get_pipe_num (pipe), &thread_id); -if (!ret_err) - { +if (!ret_err) {IA_CSS_LEAVE_ERR (-EINVAL );return -EINVAL ; } ret_err =ia_css_query_internal_queue_id (buf_type, thread_id, &queue_id); -if (!ret_err) - { +if (!ret_err) {IA_CSS_LEAVE_ERR (-EINVAL );return -EINVAL ; } -if ((queue_id <=SH_CSS_INVALID_QUEUE_ID ) || (queue_id >=SH_CSS_MAX_NUM_QUEUES )) - { +if ((queue_id <=SH_CSS_INVALID_QUEUE_ID ) || (queue_id >=SH_CSS_MAX_NUM_QUEUES )) {IA_CSS_LEAVE_ERR (-EINVAL );return -EINVAL ; } -if (!sh_css_sp_is_running ()) - { +if (!sh_css_sp_is_running ()) {IA_CSS_LOG ("SP is not running!" );IA_CSS_LEAVE_ERR (-EBUSY );/* SP is not running. The queues are not valid */
@@ -4100,24 +4068,21 @@ ia_css_pipe_enqueue_buffer(struct ia_css ddr_buffer.cookie_ptr = buffer->driver_cookie; ddr_buffer.timing_data = buffer->timing_data; -if (buf_type ==IA_CSS_BUFFER_TYPE_3A_STATISTICS ) - { +if (buf_type ==IA_CSS_BUFFER_TYPE_3A_STATISTICS ) {if (!buffer->data.stats_3a) {IA_CSS_LEAVE_ERR (-EINVAL );return -EINVAL ; } ddr_buffer.kernel_ptr =HOST_ADDRESS (buffer->data.stats_3a); ddr_buffer.payload.s3a = *buffer->data.stats_3a; - }else if (buf_type ==IA_CSS_BUFFER_TYPE_DIS_STATISTICS ) - { + }else if (buf_type ==IA_CSS_BUFFER_TYPE_DIS_STATISTICS ) {if (!buffer->data.stats_dvs) {IA_CSS_LEAVE_ERR (-EINVAL );return -EINVAL ; } ddr_buffer.kernel_ptr =HOST_ADDRESS (buffer->data.stats_dvs); ddr_buffer.payload.dis = *buffer->data.stats_dvs; - }else if (buf_type ==IA_CSS_BUFFER_TYPE_METADATA ) - { + }else if (buf_type ==IA_CSS_BUFFER_TYPE_METADATA ) {if (!buffer->data.metadata) {IA_CSS_LEAVE_ERR (-EINVAL );return -EINVAL ;
@@ -4128,8 +4093,7 @@ ia_css_pipe_enqueue_buffer(struct ia_css || (buf_type == IA_CSS_BUFFER_TYPE_OUTPUT_FRAME) || (buf_type == IA_CSS_BUFFER_TYPE_VF_OUTPUT_FRAME) || (buf_type == IA_CSS_BUFFER_TYPE_SEC_OUTPUT_FRAME) - || (buf_type == IA_CSS_BUFFER_TYPE_SEC_VF_OUTPUT_FRAME)) - { + || (buf_type == IA_CSS_BUFFER_TYPE_SEC_VF_OUTPUT_FRAME)) {if (!buffer->data.frame) {IA_CSS_LEAVE_ERR (-EINVAL );return -EINVAL ;
@@ -4164,8 +4128,7 @@ ia_css_pipe_enqueue_buffer(struct ia_cssassert (h_vbuf);assert (h_vbuf->vptr !=0x0 ); -if ((!h_vbuf) || (h_vbuf->vptr ==0x0 )) - { +if ((!h_vbuf) || (h_vbuf->vptr ==0x0 )) {IA_CSS_LEAVE_ERR (-EINVAL );return -EINVAL ; }
@@ -4175,8 +4138,7 @@ ia_css_pipe_enqueue_buffer(struct ia_css sizeof(struct sh_css_hmm_buffer));if ((buf_type ==IA_CSS_BUFFER_TYPE_3A_STATISTICS ) || (buf_type ==IA_CSS_BUFFER_TYPE_DIS_STATISTICS ) - || (buf_type ==IA_CSS_BUFFER_TYPE_LACE_STATISTICS )) - { + || (buf_type ==IA_CSS_BUFFER_TYPE_LACE_STATISTICS )) {if (!pipeline) {ia_css_rmgr_rel_vbuf (hmm_buffer_pool, &h_vbuf);IA_CSS_LOG ("pipeline is empty!" );
@@ -4199,8 +4161,7 @@ ia_css_pipe_enqueue_buffer(struct ia_css || (buf_type == IA_CSS_BUFFER_TYPE_VF_OUTPUT_FRAME) || (buf_type == IA_CSS_BUFFER_TYPE_SEC_OUTPUT_FRAME) || (buf_type == IA_CSS_BUFFER_TYPE_SEC_VF_OUTPUT_FRAME) - || (buf_type == IA_CSS_BUFFER_TYPE_METADATA)) - { + || (buf_type == IA_CSS_BUFFER_TYPE_METADATA)) { return_err =ia_css_bufq_enqueue_buffer (thread_id, queue_id, (uint32_t )h_vbuf->vptr);
@@ -4214,8 +4175,7 @@ ia_css_pipe_enqueue_buffer(struct ia_css#endif } -if (!return_err) - { +if (!return_err) {if (sh_css_hmm_buffer_record_acquire ( h_vbuf, buf_type,HOST_ADDRESS (ddr_buffer.kernel_ptr))) {
@@ -4230,8 +4190,7 @@ ia_css_pipe_enqueue_buffer(struct ia_css* Tell the SP which queues are not empty, * by sending the software event. */ -if (!return_err) - { +if (!return_err) {if (!sh_css_sp_is_running ()) {/* SP is not running. The queues are not valid */ IA_CSS_LOG ("SP is not running!" );
@@ -4243,8 +4202,7 @@ ia_css_pipe_enqueue_buffer(struct ia_css (uint8_t )thread_id, queue_id, 0); - }else - { + }else {ia_css_rmgr_rel_vbuf (hmm_buffer_pool, &h_vbuf);IA_CSS_ERROR ("buffer not enqueued" ); }
@@ -4259,7 +4217,8 @@ ia_css_pipe_enqueue_buffer(struct ia_css*/ int ia_css_pipe_dequeue_buffer (struct ia_css_pipe *pipe, -struct ia_css_buffer *buffer) { +struct ia_css_buffer *buffer) +{int return_err;enum sh_css_queue_id queue_id;ia_css_ptr ddr_buffer_addr = (ia_css_ptr )0 ;
@@ -4272,8 +4231,7 @@ ia_css_pipe_dequeue_buffer(struct ia_cssIA_CSS_ENTER ("pipe=%p, buffer=%p" , pipe, buffer); -if ((!pipe) || (!buffer)) - { +if ((!pipe) || (!buffer)) {IA_CSS_LEAVE_ERR (-EINVAL );return -EINVAL ; }
@@ -4287,27 +4245,23 @@ ia_css_pipe_dequeue_buffer(struct ia_css ddr_buffer.kernel_ptr =0 ; ret_err =ia_css_pipeline_get_sp_thread_id (ia_css_pipe_get_pipe_num (pipe), &thread_id); -if (!ret_err) - { +if (!ret_err) {IA_CSS_LEAVE_ERR (-EINVAL );return -EINVAL ; } ret_err =ia_css_query_internal_queue_id (buf_type, thread_id, &queue_id); -if (!ret_err) - { +if (!ret_err) {IA_CSS_LEAVE_ERR (-EINVAL );return -EINVAL ; } -if ((queue_id <=SH_CSS_INVALID_QUEUE_ID ) || (queue_id >=SH_CSS_MAX_NUM_QUEUES )) - { +if ((queue_id <=SH_CSS_INVALID_QUEUE_ID ) || (queue_id >=SH_CSS_MAX_NUM_QUEUES )) {IA_CSS_LEAVE_ERR (-EINVAL );return -EINVAL ; } -if (!sh_css_sp_is_running ()) - { +if (!sh_css_sp_is_running ()) {IA_CSS_LOG ("SP is not running!" );IA_CSS_LEAVE_ERR (-EBUSY );/* SP is not running. The queues are not valid */
@@ -4317,8 +4271,7 @@ ia_css_pipe_dequeue_buffer(struct ia_css return_err =ia_css_bufq_dequeue_buffer (queue_id, (uint32_t *)&ddr_buffer_addr); -if (!return_err) - { +if (!return_err) {struct ia_css_frame *frame;struct sh_css_hmm_buffer_record *hmm_buffer_record =NULL ;
@@ -4460,8 +4413,7 @@ ia_css_pipe_dequeue_buffer(struct ia_css* Tell the SP which queues are not full, * by sending the software event. */ -if (!return_err) - { +if (!return_err) {if (!sh_css_sp_is_running ()) {IA_CSS_LOG ("SP is not running!" );IA_CSS_LEAVE_ERR (-EBUSY );
@@ -4510,12 +4462,14 @@ static enum ia_css_event_type convert_ev };int -ia_css_dequeue_event (struct ia_css_event *event) { +ia_css_dequeue_event (struct ia_css_event *event) +{return ia_css_dequeue_psys_event (event); }int -ia_css_dequeue_psys_event (struct ia_css_event *event) { +ia_css_dequeue_psys_event (struct ia_css_event *event) +{enum ia_css_pipe_id pipe_id =0 ;u8 payload[4 ] = {0 ,0 ,0 ,0 };int ret_err;
@@ -4530,11 +4484,9 @@ ia_css_dequeue_psys_event(struct ia_css_if (!event)return -EINVAL ; +/* SP is not running. The queues are not valid */ if (!sh_css_sp_is_running ()) - { -/* SP is not running. The queues are not valid */ return -EBUSY ; - }/* dequeue the event (if any) from the psys event queue */ ret_err =ia_css_bufq_dequeue_psys_event (payload);
@@ -4561,8 +4513,7 @@ ia_css_dequeue_psys_event(struct ia_css_ event->timer_code =0 ; event->timer_subcode =0 ; -if (event->type ==IA_CSS_EVENT_TYPE_TIMER ) - { +if (event->type ==IA_CSS_EVENT_TYPE_TIMER ) {/* timer event ??? get the 2nd event and decode the data into the event struct */ u32 tmp_data;/* 1st event: LSB 16-bit timer data and code */
@@ -4586,37 +4537,32 @@ ia_css_dequeue_psys_event(struct ia_css_ tmp_data = ((payload[1 ] &0xFF ) | ((payload[3 ] &0xFF ) <<8 )); event->timer_data |= (tmp_data <<16 ); event->timer_subcode = payload[2 ]; - } + }else {/* It's a non timer event. So clear first half of the timer event data. * If the second part of the TIMER event is not received, we discard * the first half of the timer data and process the non timer event without * affecting the flow. So the non timer event falls through * the code. */ -else { event->timer_data =0 ; event->timer_code =0 ; event->timer_subcode =0 ;IA_CSS_ERROR ("Missing 2nd timer event. Timer event discarded" ); } } -if (event->type ==IA_CSS_EVENT_TYPE_PORT_EOF ) - { +if (event->type ==IA_CSS_EVENT_TYPE_PORT_EOF ) { event->port = (enum mipi_port_id )payload[1 ]; event->exp_id = payload[3 ]; - }else if (event->type ==IA_CSS_EVENT_TYPE_FW_WARNING ) - { + }else if (event->type ==IA_CSS_EVENT_TYPE_FW_WARNING ) { event->fw_warning = (enum ia_css_fw_warning )payload[1 ];/* exp_id is only available in these warning types */ if (event->fw_warning ==IA_CSS_FW_WARNING_EXP_ID_LOCKED || event->fw_warning ==IA_CSS_FW_WARNING_TAG_EXP_ID_FAILED ) event->exp_id = payload[3 ]; - }else if (event->type ==IA_CSS_EVENT_TYPE_FW_ASSERT ) - { + }else if (event->type ==IA_CSS_EVENT_TYPE_FW_ASSERT ) { event->fw_assert_module_id = payload[1 ];/* module */ event->fw_assert_line_no = (payload[2 ] <<8 ) + payload[3 ];/* payload[2] is line_no>>8, payload[3] is line_no&0xff */ - }else if (event->type !=IA_CSS_EVENT_TYPE_TIMER ) - { + }else if (event->type !=IA_CSS_EVENT_TYPE_TIMER ) {/* pipe related events. * payload[1] contains the pipe_num, * payload[2] contains the pipe_id. These are different. */
@@ -4666,7 +4612,8 @@ ia_css_dequeue_psys_event(struct ia_css_ }int -ia_css_dequeue_isys_event (struct ia_css_event *event) { +ia_css_dequeue_isys_event (struct ia_css_event *event) +{u8 payload[4 ] = {0 ,0 ,0 ,0 };int err =0 ;
@@ -4676,11 +4623,9 @@ ia_css_dequeue_isys_event(struct ia_css_if (!event)return -EINVAL ; +/* SP is not running. The queues are not valid */ if (!sh_css_sp_is_running ()) - { -/* SP is not running. The queues are not valid */ return -EBUSY ; - } err =ia_css_bufq_dequeue_isys_event (payload);if (err)
@@ -4713,7 +4658,8 @@ acc_start(struct ia_css_pipe *pipe) }static int -sh_css_pipe_start (struct ia_css_stream *stream) { +sh_css_pipe_start (struct ia_css_stream *stream) +{int err =0 ;struct ia_css_pipe *pipe;
@@ -4722,22 +4668,19 @@ sh_css_pipe_start(struct ia_css_stream *IA_CSS_ENTER_PRIVATE ("stream = %p" , stream); -if (!stream) - { +if (!stream) {IA_CSS_LEAVE_ERR (-EINVAL );return -EINVAL ; } pipe = stream->last_pipe; -if (!pipe) - { +if (!pipe) {IA_CSS_LEAVE_ERR (-EINVAL );return -EINVAL ; } pipe_id = pipe->mode; -if (stream->started) - { +if (stream->started) {IA_CSS_WARNING ("Cannot start stream that is already started" );IA_CSS_LEAVE_ERR (err);return err;
@@ -4745,8 +4688,7 @@ sh_css_pipe_start(struct ia_css_stream * pipe->stop_requested = false; -switch (pipe_id) - { +switch (pipe_id) {case IA_CSS_PIPE_ID_PREVIEW : err =preview_start (pipe);break ;
@@ -4766,8 +4708,7 @@ sh_css_pipe_start(struct ia_css_stream * err = -EINVAL ; }/* DH regular multi pipe - not continuous mode: start the next pipes too */ -if (!stream->config.continuous) - { +if (!stream->config.continuous) {int i;for (i =1 ; i < stream->num_pipes &&0 == err ; i++) {
@@ -4797,8 +4738,7 @@ sh_css_pipe_start(struct ia_css_stream * } } } -if (err) - { +if (err) {IA_CSS_LEAVE_ERR_PRIVATE (err);return err; }
@@ -4808,8 +4748,7 @@ sh_css_pipe_start(struct ia_css_stream ** don't use ISP parameters anyway. So this should be okay. * The SP binary (jpeg) copy does not use any parameters. */ -if (!copy_on_sp (pipe)) - { +if (!copy_on_sp (pipe)) {sh_css_invalidate_params (stream); err =sh_css_param_update_isp_params (pipe, stream->isp_params_configs, true,NULL );
@@ -4823,8 +4762,7 @@ sh_css_pipe_start(struct ia_css_stream *ia_css_pipeline_get_sp_thread_id (ia_css_pipe_get_pipe_num (pipe), &thread_id); -if (!sh_css_sp_is_running ()) - { +if (!sh_css_sp_is_running ()) {IA_CSS_LEAVE_ERR_PRIVATE (-EBUSY );/* SP is not running. The queues are not valid */ return -EBUSY ;
@@ -4833,8 +4771,7 @@ sh_css_pipe_start(struct ia_css_stream * (uint8_t)thread_id, 0, 0);/* DH regular multi pipe - not continuous mode: enqueue event to the next pipes too */ -if (!stream->config.continuous) - { +if (!stream->config.continuous) {int i;for (i =1 ; i < stream->num_pipes; i++) {
@@ -4848,8 +4785,7 @@ sh_css_pipe_start(struct ia_css_stream * }/* in case of continuous capture mode, we also start capture thread and copy thread*/ -if (pipe->stream->config.continuous) - { +if (pipe->stream->config.continuous) {struct ia_css_pipe *copy_pipe =NULL ;if (pipe_id ==IA_CSS_PIPE_ID_PREVIEW )
@@ -4868,8 +4804,7 @@ sh_css_pipe_start(struct ia_css_stream *IA_CSS_PSYS_SW_EVENT_START_STREAM , (uint8_t)thread_id, 0, 0); } -if (pipe->stream->cont_capt) - { +if (pipe->stream->cont_capt) {struct ia_css_pipe *capture_pipe =NULL ;if (pipe_id ==IA_CSS_PIPE_ID_PREVIEW )
@@ -4890,8 +4825,7 @@ sh_css_pipe_start(struct ia_css_stream * }/* in case of PREVIEW mode, check whether QOS acc_pipe is available, then start the qos pipe */ -if (pipe_id ==IA_CSS_PIPE_ID_PREVIEW ) - { +if (pipe_id ==IA_CSS_PIPE_ID_PREVIEW ) {struct ia_css_pipe *acc_pipe =NULL ; acc_pipe = pipe->pipe_settings.preview.acc_pipe;
@@ -4942,7 +4876,8 @@ sh_css_continuous_is_enabled(uint8_t pip/* ISP2400 */ int ia_css_stream_get_max_buffer_depth (struct ia_css_stream *stream, -int *buffer_depth) { +int *buffer_depth) +{if (!buffer_depth)return -EINVAL ;ia_css_debug_dtrace (IA_CSS_DEBUG_TRACE ,"ia_css_stream_get_max_buffer_depth() enter: void\n" );
@@ -4952,7 +4887,8 @@ ia_css_stream_get_max_buffer_depth(struc }int -ia_css_stream_set_buffer_depth (struct ia_css_stream *stream,int buffer_depth) { +ia_css_stream_set_buffer_depth (struct ia_css_stream *stream,int buffer_depth) +{ia_css_debug_dtrace (IA_CSS_DEBUG_TRACE ,"ia_css_stream_set_buffer_depth() enter: num_frames=%d\n" , buffer_depth); (void )stream;if (buffer_depth >NUM_CONTINUOUS_FRAMES || buffer_depth <1 )
@@ -4966,7 +4902,8 @@ ia_css_stream_set_buffer_depth(struct ia/* ISP2401 */ int ia_css_stream_get_buffer_depth (struct ia_css_stream *stream, -int *buffer_depth) { +int *buffer_depth) +{if (!buffer_depth)return -EINVAL ;ia_css_debug_dtrace (IA_CSS_DEBUG_TRACE ,"ia_css_stream_get_buffer_depth() enter: void\n" );
@@ -4991,8 +4928,7 @@ sh_css_pipes_stop(struct ia_css_stream *int i;assert (stream); -if (!stream) - { +if (!stream) {IA_CSS_LOG ("stream does NOT exist!" ); err = -EINVAL ; goto ERR;
@@ -5000,8 +4936,7 @@ sh_css_pipes_stop(struct ia_css_stream * main_pipe = stream->last_pipe;assert (main_pipe); -if (!main_pipe) - { +if (!main_pipe) {IA_CSS_LOG ("main_pipe does NOT exist!" ); err = -EINVAL ; goto ERR;
@@ -5014,8 +4949,7 @@ sh_css_pipes_stop(struct ia_css_stream ** Stop all "ia_css_pipe" instances in this target * "ia_css_stream" instance. */ -for (i =0 ; i < stream->num_pipes; i++) - { +for (i =0 ; i < stream->num_pipes; i++) {/* send the "stop" request to the "ia_css_pipe" instance */ IA_CSS_LOG ("Send the stop-request to the pipe: pipe_id=%d" , stream->pipes[i]->pipeline.pipe_id);
@@ -5049,8 +4983,7 @@ sh_css_pipes_stop(struct ia_css_stream ** * We need to stop this "Copy Pipe", as well. */ -if (main_pipe->stream->config.continuous) - { +if (main_pipe->stream->config.continuous) {struct ia_css_pipe *copy_pipe =NULL ;/* get the reference to "Copy Pipe" */
@@ -5226,8 +5159,7 @@ sh_css_pipe_get_shading_info(struct ia_c binary =ia_css_pipe_get_shading_correction_binary (pipe); -if (binary) - { +if (binary) { err = ia_css_binary_get_shading_info(binary, IA_CSS_SHADING_CORRECTION_TYPE_1, pipe->required_bds_factor,
@@ -5237,8 +5169,7 @@ sh_css_pipe_get_shading_info(struct ia_c/* Other function calls can be added here when other shading correction types will be added * in the future. */ - }else - { + }else {/* When the pipe does not have a binary which has the shading * correction, this function does not need to fill the shading * information. It is not a error case, and then
@@ -5251,7 +5182,8 @@ sh_css_pipe_get_shading_info(struct ia_cstatic int sh_css_pipe_get_grid_info (struct ia_css_pipe *pipe, -struct ia_css_grid_info *info) { +struct ia_css_grid_info *info) +{int err =0 ;struct ia_css_binary *binary =NULL ;
@@ -5262,30 +5194,27 @@ sh_css_pipe_get_grid_info(struct ia_css_ binary =ia_css_pipe_get_s3a_binary (pipe); -if (binary) - { +if (binary) { err =ia_css_binary_3a_grid_info (binary, info, pipe);if (err) goto ERR; - }else + }else {memset (&info->s3a_grid,0 ,sizeof (info->s3a_grid)); + } binary =ia_css_pipe_get_sdis_binary (pipe); -if (binary) - { +if (binary) {ia_css_binary_dvs_grid_info (binary, info, pipe);ia_css_binary_dvs_stat_grid_info (binary, info, pipe); - }else - { + }else {memset (&info->dvs_grid.dvs_grid_info,0 ,sizeof (info->dvs_grid.dvs_grid_info));memset (&info->dvs_grid.dvs_stat_grid_info,0 ,sizeof (info->dvs_grid.dvs_stat_grid_info)); } -if (binary) - { +if (binary) {/* copy pipe does not have ISP binary*/ info->isp_in_width = binary->internal_frame_info.res.width; info->isp_in_height = binary->internal_frame_info.res.height;
@@ -5305,7 +5234,8 @@ ERR :*/ static int ia_css_pipe_check_format (struct ia_css_pipe *pipe, -enum ia_css_frame_format format) { +enum ia_css_frame_format format) +{const enum ia_css_frame_format *supported_formats;int number_of_formats;int found =0 ;
@@ -5313,8 +5243,7 @@ ia_css_pipe_check_format(struct ia_css_pIA_CSS_ENTER_PRIVATE ("" ); -if (NULL == pipe ||NULL == pipe->pipe_settings.video.video_binary.info) - { +if (NULL == pipe ||NULL == pipe->pipe_settings.video.video_binary.info) {IA_CSS_ERROR ("Pipe or binary info is not set" );IA_CSS_LEAVE_ERR_PRIVATE (-EINVAL );return -EINVAL ;
@@ -5323,15 +5252,13 @@ ia_css_pipe_check_format(struct ia_css_p supported_formats = pipe->pipe_settings.video.video_binary.info->output_formats; number_of_formats =sizeof (pipe->pipe_settings.video.video_binary.info->output_formats) /sizeof (enum ia_css_frame_format ); -for (i =0 ; i < number_of_formats && !found; i++) - { +for (i =0 ; i < number_of_formats && !found; i++) {if (supported_formats[i] == format) { found =1 ;break ; } } -if (!found) - { +if (!found) {IA_CSS_ERROR ("Requested format is not supported by binary" );IA_CSS_LEAVE_ERR_PRIVATE (-EINVAL );return -EINVAL ;
@@ -5483,10 +5410,10 @@ static int load_video_binaries(struct ia &mycs->video_binary);if (err) { -if (video_vf_info) { -/* This will do another video binary lookup later for YUV_LINE format*/ +/* This will do another video binary lookup later for YUV_LINE format*/ +if (video_vf_info) need_vf_pp = true; - }else +else return err; }else if (video_vf_info) {/* The first video binary lookup is successful, but we may
@@ -5649,13 +5576,13 @@ static int load_video_binaries(struct ia }static int -unload_video_binaries (struct ia_css_pipe *pipe) { +unload_video_binaries (struct ia_css_pipe *pipe) +{unsigned int i;IA_CSS_ENTER_PRIVATE ("pipe = %p" , pipe); -if ((!pipe) || (pipe->mode !=IA_CSS_PIPE_ID_VIDEO )) - { +if ((!pipe) || (pipe->mode !=IA_CSS_PIPE_ID_VIDEO )) {IA_CSS_LEAVE_ERR_PRIVATE (-EINVAL );return -EINVAL ; }
@@ -5805,31 +5732,29 @@ static int sh_css_pipe_configure_viewfinder(struct ia_css_pipe *pipe, unsigned int width, unsigned int height, unsigned int min_width, enum ia_css_frame_format format, - unsigned int idx) { + unsigned int idx) +{ int err = 0;IA_CSS_ENTER_PRIVATE ("pipe = %p, width = %d, height = %d, min_width = %d, format = %d, idx = %d\n" , pipe, width, height, min_width, format, idx); -if (!pipe) - { +if (!pipe) {IA_CSS_LEAVE_ERR_PRIVATE (-EINVAL );return -EINVAL ; } err =ia_css_util_check_res (width, height); -if (err) - { +if (err) {IA_CSS_LEAVE_ERR_PRIVATE (err);return err; }if (pipe->vf_output_info[idx].res.width != width || pipe->vf_output_info[idx].res.height != height || pipe->vf_output_info[idx].format != format) - {ia_css_frame_info_init (&pipe->vf_output_info[idx], width, height, format, min_width); - } +IA_CSS_LEAVE_ERR_PRIVATE (0 );return 0 ; }
@@ -6209,7 +6134,8 @@ static int load_primary_binaries( }static int -allocate_delay_frames (struct ia_css_pipe *pipe) { +allocate_delay_frames (struct ia_css_pipe *pipe) +{unsigned int num_delay_frames =0 , i =0 ;unsigned int dvs_frame_delay =0 ;struct ia_css_frame_info ref_info;
@@ -6219,8 +6145,7 @@ allocate_delay_frames(struct ia_css_pipeIA_CSS_ENTER_PRIVATE ("" ); -if (!pipe) - { +if (!pipe) {IA_CSS_ERROR ("Invalid args - pipe %p" , pipe);return -EINVAL ; }
@@ -6231,8 +6156,7 @@ allocate_delay_frames(struct ia_css_pipeif (dvs_frame_delay >0 ) num_delay_frames = dvs_frame_delay +1 ; -switch (mode) - { +switch (mode) {case IA_CSS_PIPE_ID_CAPTURE : {struct ia_css_capture_settings *mycs_capture = &pipe->pipe_settings.capture; (void )mycs_capture;
@@ -6284,8 +6208,7 @@ allocate_delay_frames(struct ia_css_pipe ref_info.raw_bit_depth =SH_CSS_REF_BIT_DEPTH ;assert (num_delay_frames <=MAX_NUM_VIDEO_DELAY_FRAMES ); -for (i =0 ; i < num_delay_frames; i++) - { +for (i =0 ; i < num_delay_frames; i++) { err =ia_css_frame_allocate_from_info (&delay_frames[i], &ref_info);if (err)return err;
@@ -6295,7 +6218,8 @@ allocate_delay_frames(struct ia_css_pipe }static int load_advanced_binaries ( -struct ia_css_pipe *pipe) { +struct ia_css_pipe *pipe) +{struct ia_css_frame_info pre_in_info, gdc_in_info, post_in_info, post_out_info, vf_info, *vf_pp_in_info, *pipe_out_info,
@@ -6412,7 +6336,8 @@ static int load_advanced_binaries( }static int load_bayer_isp_binaries ( -struct ia_css_pipe *pipe) { +struct ia_css_pipe *pipe) +{struct ia_css_frame_info pre_isp_in_info, *pipe_out_info;int err =0 ;struct ia_css_binary_descr pre_de_descr;
@@ -6441,7 +6366,8 @@ static int load_bayer_isp_binaries( }static int load_low_light_binaries ( -struct ia_css_pipe *pipe) { +struct ia_css_pipe *pipe) +{struct ia_css_frame_info pre_in_info, anr_in_info, post_in_info, post_out_info, vf_info, *pipe_vf_out_info, *pipe_out_info,
@@ -6579,7 +6505,8 @@ static bool copy_on_sp(struct ia_css_pip }static int load_capture_binaries ( -struct ia_css_pipe *pipe) { +struct ia_css_pipe *pipe) +{int err =0 ;bool must_be_raw;
@@ -6647,13 +6574,13 @@ static int load_capture_binaries( }static int -unload_capture_binaries (struct ia_css_pipe *pipe) { +unload_capture_binaries (struct ia_css_pipe *pipe) +{unsigned int i;IA_CSS_ENTER_PRIVATE ("pipe = %p" , pipe); -if ((!pipe) || ((pipe->mode !=IA_CSS_PIPE_ID_CAPTURE ) && (pipe->mode !=IA_CSS_PIPE_ID_COPY ))) - { +if ((!pipe) || ((pipe->mode !=IA_CSS_PIPE_ID_CAPTURE ) && (pipe->mode !=IA_CSS_PIPE_ID_COPY ))) {IA_CSS_LEAVE_ERR_PRIVATE (-EINVAL );return -EINVAL ; }
@@ -6681,7 +6608,8 @@ unload_capture_binaries(struct ia_css_pistatic bool need_downscaling (const struct ia_css_resolution in_res, -const struct ia_css_resolution out_res) { +const struct ia_css_resolution out_res) +{if (in_res.width > out_res.width || in_res.height > out_res.height)return true;
@@ -6689,7 +6617,8 @@ need_downscaling(const struct ia_css_res }static bool -need_yuv_scaler_stage (const struct ia_css_pipe *pipe) { +need_yuv_scaler_stage (const struct ia_css_pipe *pipe) +{unsigned int i;struct ia_css_resolution in_res, out_res;
@@ -6731,7 +6660,8 @@ static int ia_css_pipe_create_cas_scalerstruct ia_css_frame_info *cas_scaler_in_info, struct ia_css_frame_info *cas_scaler_out_info, struct ia_css_frame_info *cas_scaler_vf_info, - struct ia_css_cas_binary_descr *descr) { + struct ia_css_cas_binary_descr *descr) +{ unsigned int i;unsigned int hor_ds_factor =0 , ver_ds_factor =0 ;int err =0 ;
@@ -6849,7 +6779,8 @@ ERR:/* FIXME: merge most of this and single output version */ static int ia_css_pipe_create_cas_scaler_desc (struct ia_css_pipe *pipe, -struct ia_css_cas_binary_descr *descr) { +struct ia_css_cas_binary_descr *descr) +{struct ia_css_frame_info in_info =IA_CSS_BINARY_DEFAULT_FRAME_INFO ;struct ia_css_frame_info *out_info[IA_CSS_PIPE_MAX_OUTPUT_STAGE ];struct ia_css_frame_info *vf_out_info[IA_CSS_PIPE_MAX_OUTPUT_STAGE ];
@@ -7005,7 +6936,8 @@ ERR: }static void ia_css_pipe_destroy_cas_scaler_desc (struct ia_css_cas_binary_descr - *descr) { + *descr) +{ia_css_debug_dtrace (IA_CSS_DEBUG_TRACE_PRIVATE ,"ia_css_pipe_destroy_cas_scaler_desc() enter:\n" );kfree (descr->in_info);
@@ -7023,7 +6955,8 @@ static void ia_css_pipe_destroy_cas_scal }static int -load_yuvpp_binaries (struct ia_css_pipe *pipe) { +load_yuvpp_binaries (struct ia_css_pipe *pipe) +{int err =0 ;bool need_scaler = false;struct ia_css_frame_info *vf_pp_in_info[IA_CSS_PIPE_MAX_OUTPUT_STAGE ];
@@ -7048,8 +6981,7 @@ load_yuvpp_binaries(struct ia_css_pipe * mycs = &pipe->pipe_settings.yuvpp; -for (i =0 ; i <IA_CSS_PIPE_MAX_OUTPUT_STAGE ; i++) - { +for (i =0 ; i <IA_CSS_PIPE_MAX_OUTPUT_STAGE ; i++) {if (pipe->vf_output_info[i].res.width !=0 ) { err =ia_css_util_check_vf_out_info (&pipe->output_info[i], &pipe->vf_output_info[i]);
@@ -7063,8 +6995,7 @@ load_yuvpp_binaries(struct ia_css_pipe */* we build up the pipeline starting at the end */ /* Capture post-processing */ -if (need_scaler) - { +if (need_scaler) {struct ia_css_binary_descr yuv_scaler_descr; err = ia_css_pipe_create_cas_scaler_desc(pipe,
@@ -7098,18 +7029,14 @@ load_yuvpp_binaries(struct ia_css_pipe * goto ERR; }ia_css_pipe_destroy_cas_scaler_desc (&cas_scaler_descr); - }else - { + }else { mycs->num_output =1 ; }if (need_scaler) - { next_binary = &mycs->yuv_scaler_binary[0 ]; - }else - { +else next_binary =NULL ; - }#if defined(ISP2401 )/*
@@ -7135,8 +7062,7 @@ load_yuvpp_binaries(struct ia_css_pipe * need_isp_copy_binary = true;#endif /* ISP2401 */ -if (need_isp_copy_binary) - { +if (need_isp_copy_binary) { err =load_copy_binary (pipe, &mycs->copy_binary, next_binary);
@@ -7166,8 +7092,7 @@ load_yuvpp_binaries(struct ia_css_pipe * }/* Viewfinder post-processing */ -if (need_scaler) - { +if (need_scaler) {for (i =0 , j =0 ; i < mycs->num_yuv_scaler; i++) {if (mycs->is_output_stage[i]) {assert (j <2 );
@@ -7177,19 +7102,17 @@ load_yuvpp_binaries(struct ia_css_pipe * } } mycs->num_vf_pp = j; - }else - { + }else { vf_pp_in_info[0 ] = &mycs->copy_binary.vf_frame_info; -for (i =1 ; i <IA_CSS_PIPE_MAX_OUTPUT_STAGE ; i++) { +for (i =1 ; i <IA_CSS_PIPE_MAX_OUTPUT_STAGE ; i++) vf_pp_in_info[i] =NULL ; - } + mycs->num_vf_pp =1 ; } mycs->vf_pp_binary =kzalloc (mycs->num_vf_pp *sizeof (struct ia_css_binary ),GFP_KERNEL ); -if (!mycs->vf_pp_binary) - { +if (!mycs->vf_pp_binary) { err = -ENOMEM ; goto ERR; }
@@ -7197,8 +7120,7 @@ load_yuvpp_binaries(struct ia_css_pipe * {struct ia_css_binary_descr vf_pp_descr; -for (i =0 ; i < mycs->num_vf_pp; i++) - { +for (i =0 ; i < mycs->num_vf_pp; i++) {if (pipe->vf_output_info[i].res.width !=0 ) {ia_css_pipe_get_vfpp_binarydesc (pipe, &vf_pp_descr, vf_pp_in_info[i], &pipe->vf_output_info[i]);
@@ -7214,34 +7136,31 @@ load_yuvpp_binaries(struct ia_css_pipe * ERR:if (need_scaler) - {ia_css_pipe_destroy_cas_scaler_desc (&cas_scaler_descr); - } +ia_css_debug_dtrace (IA_CSS_DEBUG_TRACE_PRIVATE ,"load_yuvpp_binaries() leave, err=%d\n" , err);return err; }static int -unload_yuvpp_binaries (struct ia_css_pipe *pipe) { +unload_yuvpp_binaries (struct ia_css_pipe *pipe) +{unsigned int i;IA_CSS_ENTER_PRIVATE ("pipe = %p" , pipe); -if ((!pipe) || (pipe->mode !=IA_CSS_PIPE_ID_YUVPP )) - { +if ((!pipe) || (pipe->mode !=IA_CSS_PIPE_ID_YUVPP )) {IA_CSS_LEAVE_ERR_PRIVATE (-EINVAL );return -EINVAL ; }ia_css_binary_unload (&pipe->pipe_settings.yuvpp.copy_binary);for (i =0 ; i < pipe->pipe_settings.yuvpp.num_yuv_scaler; i++) - {ia_css_binary_unload (&pipe->pipe_settings.yuvpp.yuv_scaler_binary[i]); - } +for (i =0 ; i < pipe->pipe_settings.yuvpp.num_vf_pp; i++) - {ia_css_binary_unload (&pipe->pipe_settings.yuvpp.vf_pp_binary[i]); - } +kfree (pipe->pipe_settings.yuvpp.is_output_stage); pipe->pipe_settings.yuvpp.is_output_stage =NULL ;kfree (pipe->pipe_settings.yuvpp.yuv_scaler_binary);
@@ -7291,25 +7210,23 @@ static int yuvpp_start(struct ia_css_pip }static int -sh_css_pipe_unload_binaries (struct ia_css_pipe *pipe) { +sh_css_pipe_unload_binaries (struct ia_css_pipe *pipe) +{int err =0 ;IA_CSS_ENTER_PRIVATE ("pipe = %p" , pipe); -if (!pipe) - { +if (!pipe) {IA_CSS_LEAVE_ERR_PRIVATE (-EINVAL );return -EINVAL ; }/* PIPE_MODE_COPY has no binaries, but has output frames to outside*/ -if (pipe->config.mode ==IA_CSS_PIPE_MODE_COPY ) - { +if (pipe->config.mode ==IA_CSS_PIPE_MODE_COPY ) {IA_CSS_LEAVE_ERR_PRIVATE (0 );return 0 ; } -switch (pipe->mode) - { +switch (pipe->mode) {case IA_CSS_PIPE_ID_PREVIEW : err =unload_preview_binaries (pipe);break ;
@@ -7330,7 +7247,8 @@ sh_css_pipe_unload_binaries(struct ia_cs }static int -sh_css_pipe_load_binaries (struct ia_css_pipe *pipe) { +sh_css_pipe_load_binaries (struct ia_css_pipe *pipe) +{int err =0 ;assert (pipe);
@@ -7340,8 +7258,7 @@ sh_css_pipe_load_binaries(struct ia_css_if (pipe->config.mode ==IA_CSS_PIPE_MODE_COPY )return err; -switch (pipe->mode) - { +switch (pipe->mode) {case IA_CSS_PIPE_ID_PREVIEW : err =load_preview_binaries (pipe);break ;
@@ -7360,8 +7277,7 @@ sh_css_pipe_load_binaries(struct ia_css_ err = -EINVAL ;break ; } -if (err) - { +if (err) {if (sh_css_pipe_unload_binaries (pipe)) {/* currently css does not support multiple error returns in a single function, * using -EINVAL in this case */
@@ -7372,7 +7288,8 @@ sh_css_pipe_load_binaries(struct ia_css_ }static int -create_host_yuvpp_pipeline (struct ia_css_pipe *pipe) { +create_host_yuvpp_pipeline (struct ia_css_pipe *pipe) +{struct ia_css_pipeline *me;int err =0 ; struct ia_css_pipeline_stage *vf_pp_stage = NULL,
@@ -7399,15 +7316,13 @@ create_host_yuvpp_pipeline(struct ia_css#endif IA_CSS_ENTER_PRIVATE ("pipe = %p" , pipe); -if ((!pipe) || (!pipe->stream) || (pipe->mode !=IA_CSS_PIPE_ID_YUVPP )) - { +if ((!pipe) || (!pipe->stream) || (pipe->mode !=IA_CSS_PIPE_ID_YUVPP )) {IA_CSS_LEAVE_ERR_PRIVATE (-EINVAL );return -EINVAL ; } me = &pipe->pipeline;ia_css_pipeline_clean (me); -for (i =0 ; i <IA_CSS_PIPE_MAX_OUTPUT_STAGE ; i++) - { +for (i =0 ; i <IA_CSS_PIPE_MAX_OUTPUT_STAGE ; i++) { out_frame[i] =NULL ; vf_frame[i] =NULL ; }
@@ -7435,8 +7350,7 @@ create_host_yuvpp_pipeline(struct ia_css/* the input frame can come from: * a) memory: connect yuvscaler to me->in_frame * b) sensor, via copy binary: connect yuvscaler to copy binary later on */ -if (need_in_frameinfo_memory) - { +if (need_in_frameinfo_memory) {/* TODO: improve for different input formats. */ /*
@@ -7485,13 +7399,11 @@ create_host_yuvpp_pipeline(struct ia_css } in_frame = &me->in_frame; - }else - { + }else { in_frame =NULL ; } -for (i =0 ; i < num_output_stage; i++) - { +for (i =0 ; i < num_output_stage; i++) {assert (i <IA_CSS_PIPE_MAX_OUTPUT_STAGE );if (pipe->output_info[i].res.width !=0 ) { err =init_out_frameinfo_defaults (pipe, &me->out_frame[i], i);
@@ -7518,8 +7430,7 @@ create_host_yuvpp_pipeline(struct ia_css yuv_scaler_binary = pipe->pipe_settings.yuvpp.yuv_scaler_binary; need_scaler =need_yuv_scaler_stage (pipe); -if (pipe->pipe_settings.yuvpp.copy_binary.info) - { +if (pipe->pipe_settings.yuvpp.copy_binary.info) {struct ia_css_frame *in_frame_local =NULL ;#ifdef ISP2401
@@ -7557,8 +7468,7 @@ create_host_yuvpp_pipeline(struct ia_css } } -if (need_scaler) - { +if (need_scaler) {struct ia_css_frame *tmp_out_frame =NULL ;struct ia_css_frame *tmp_vf_frame =NULL ;struct ia_css_frame *tmp_in_frame = in_frame;
@@ -7598,8 +7508,7 @@ create_host_yuvpp_pipeline(struct ia_css j++; } } - }else if (copy_stage) - { + }else if (copy_stage) {if (vf_frame[0 ] && vf_frame[0 ]->info.res.width !=0 ) { in_frame = copy_stage->args.out_vf_frame; err = add_vf_pp_stage(pipe, in_frame, vf_frame[0], &vf_pp_binary[0],
@@ -7621,7 +7530,8 @@ create_host_yuvpp_pipeline(struct ia_cssstatic int create_host_copy_pipeline (struct ia_css_pipe *pipe,unsigned int max_input_width, -struct ia_css_frame *out_frame) { +struct ia_css_frame *out_frame) +{struct ia_css_pipeline *me;int err =0 ;struct ia_css_pipeline_stage_desc stage_desc;
@@ -7638,16 +7548,14 @@ create_host_copy_pipeline(struct ia_css_ out_frame->flash_state =IA_CSS_FRAME_FLASH_STATE_NONE ;if (copy_on_sp (pipe) && - pipe->stream->config.input_config.format ==ATOMISP_INPUT_FORMAT_BINARY_8 ) - { + pipe->stream->config.input_config.format ==ATOMISP_INPUT_FORMAT_BINARY_8 ) {ia_css_frame_info_init ( &out_frame->info,JPEG_BYTES ,1 ,IA_CSS_FRAME_FORMAT_BINARY_8 ,0 ); - }else if (out_frame->info.format ==IA_CSS_FRAME_FORMAT_RAW ) - { + }else if (out_frame->info.format ==IA_CSS_FRAME_FORMAT_RAW ) { out_frame->info.raw_bit_depth =ia_css_pipe_util_pipe_input_format_bpp (pipe); }
@@ -7671,7 +7579,8 @@ create_host_copy_pipeline(struct ia_css_ }static int -create_host_isyscopy_capture_pipeline (struct ia_css_pipe *pipe) { +create_host_isyscopy_capture_pipeline (struct ia_css_pipe *pipe) +{struct ia_css_pipeline *me = &pipe->pipeline;int err =0 ;struct ia_css_pipeline_stage_desc stage_desc;
@@ -7715,7 +7624,8 @@ create_host_isyscopy_capture_pipeline(st }static int -create_host_regular_capture_pipeline (struct ia_css_pipe *pipe) { +create_host_regular_capture_pipeline (struct ia_css_pipe *pipe) +{struct ia_css_pipeline *me;int err =0 ;enum ia_css_capture_mode mode;
@@ -7779,8 +7689,7 @@ create_host_regular_capture_pipeline(str/* Construct in_frame info (only in case we have dynamic input */ need_in_frameinfo_memory = pipe->stream->config.mode ==IA_CSS_INPUT_MODE_MEMORY ;#endif -if (need_in_frameinfo_memory) - { +if (need_in_frameinfo_memory) { err =init_in_frameinfo_memory_defaults (pipe, &me->in_frame,IA_CSS_FRAME_FORMAT_RAW );if (err) {
@@ -7789,22 +7698,19 @@ create_host_regular_capture_pipeline(str } in_frame = &me->in_frame; - }else - { + }else { in_frame =NULL ; } err =init_out_frameinfo_defaults (pipe, &me->out_frame[0 ],0 ); -if (err) - { +if (err) {IA_CSS_LEAVE_ERR_PRIVATE (err);return err; } out_frame = &me->out_frame[0 ];/* Construct vf_frame info (only in case we have VF) */ -if (pipe->enable_viewfinder[IA_CSS_PIPE_OUTPUT_STAGE_0 ]) - { +if (pipe->enable_viewfinder[IA_CSS_PIPE_OUTPUT_STAGE_0 ]) {if (mode ==IA_CSS_CAPTURE_MODE_RAW || mode ==IA_CSS_CAPTURE_MODE_BAYER ) {/* These modes don't support viewfinder output */ vf_frame =NULL ;
@@ -7812,22 +7718,20 @@ create_host_regular_capture_pipeline(strinit_vf_frameinfo_defaults (pipe, &me->vf_frame[0 ],0 ); vf_frame = &me->vf_frame[0 ]; } - }else - { + }else { vf_frame =NULL ; } copy_binary = &pipe->pipe_settings.capture.copy_binary; num_primary_stage = pipe->pipe_settings.capture.num_primary_stage; -if ((num_primary_stage ==0 ) && (mode ==IA_CSS_CAPTURE_MODE_PRIMARY )) - { +if ((num_primary_stage ==0 ) && (mode ==IA_CSS_CAPTURE_MODE_PRIMARY )) {IA_CSS_LEAVE_ERR_PRIVATE (-EINVAL );return -EINVAL ; } +for (i =0 ; i < num_primary_stage; i++) - { primary_binary[i] = &pipe->pipe_settings.capture.primary_binary[i]; - } + vf_pp_binary = &pipe->pipe_settings.capture.vf_pp_binary; pre_isp_binary = &pipe->pipe_settings.capture.pre_isp_binary; anr_gdc_binary = &pipe->pipe_settings.capture.anr_gdc_binary;
@@ -7844,8 +7748,7 @@ create_host_regular_capture_pipeline(str need_yuv_pp = (yuv_scaler_binary && yuv_scaler_binary->info); need_ldc = (capture_ldc_binary && capture_ldc_binary->info); -if (pipe->pipe_settings.capture.copy_binary.info) - { +if (pipe->pipe_settings.capture.copy_binary.info) {if (raw) {ia_css_pipe_util_set_output_frames (out_frames,0 , out_frame);#if defined(ISP2401 )
@@ -7874,13 +7777,11 @@ create_host_regular_capture_pipeline(strIA_CSS_LEAVE_ERR_PRIVATE (err);return err; } - }else if (pipe->stream->config.continuous) - { + }else if (pipe->stream->config.continuous) { in_frame = pipe->stream->last_pipe->continuous_frames[0 ]; } -if (mode ==IA_CSS_CAPTURE_MODE_PRIMARY ) - { +if (mode ==IA_CSS_CAPTURE_MODE_PRIMARY ) {struct ia_css_frame *local_in_frame =NULL ;struct ia_css_frame *local_out_frame =NULL ;
@@ -7925,8 +7826,7 @@ create_host_regular_capture_pipeline(strIA_CSS_BINARY_MODE_COPY ; current_stage->args.copy_output = current_stage->args.copy_vf; }else if (mode ==IA_CSS_CAPTURE_MODE_ADVANCED || - mode ==IA_CSS_CAPTURE_MODE_LOW_LIGHT ) - { + mode ==IA_CSS_CAPTURE_MODE_LOW_LIGHT ) {ia_css_pipe_util_set_output_frames (out_frames,0 ,NULL );ia_css_pipe_get_generic_stage_desc (&stage_desc, pre_isp_binary, out_frames, in_frame,NULL );
@@ -7962,8 +7862,7 @@ create_host_regular_capture_pipeline(strIA_CSS_LEAVE_ERR_PRIVATE (err);return err; } - }else if (mode ==IA_CSS_CAPTURE_MODE_BAYER ) - { + }else if (mode ==IA_CSS_CAPTURE_MODE_BAYER ) {ia_css_pipe_util_set_output_frames (out_frames,0 , out_frame);ia_css_pipe_get_generic_stage_desc (&stage_desc, pre_isp_binary, out_frames, in_frame,NULL );
@@ -7977,8 +7876,7 @@ create_host_regular_capture_pipeline(str }#ifndef ISP2401 -if (need_pp && current_stage) - { +if (need_pp && current_stage) {struct ia_css_frame *local_in_frame =NULL ; local_in_frame = current_stage->args.out_frame[0 ];
@@ -7996,8 +7894,7 @@ create_host_regular_capture_pipeline(str need_yuv_pp ? NULL : out_frame,#else /* ldc and capture_pp not supported in same pipeline */ -if (need_ldc && current_stage) - { +if (need_ldc && current_stage) { in_frame = current_stage->args.out_frame[0 ];ia_css_pipe_util_set_output_frames (out_frames,0 , out_frame); ia_css_pipe_get_generic_stage_desc(&stage_desc, capture_ldc_binary,
@@ -8005,8 +7902,7 @@ create_host_regular_capture_pipeline(str err =ia_css_pipeline_create_and_add_stage (me, &stage_desc, NULL); - }else if (need_pp && current_stage) - { + }else if (need_pp && current_stage) { in_frame = current_stage->args.out_frame[0 ]; err = add_capture_pp_stage(pipe, me, in_frame, need_yuv_pp ? NULL : out_frame, #endif
@@ -8018,8 +7914,7 @@ create_host_regular_capture_pipeline(str } } -if (need_yuv_pp && current_stage) - { +if (need_yuv_pp && current_stage) {struct ia_css_frame *tmp_in_frame = current_stage->args.out_frame[0 ];struct ia_css_frame *tmp_out_frame =NULL ;
@@ -8051,8 +7946,7 @@ create_host_regular_capture_pipeline(str* should not be considered as a clean solution. Proper * investigation should be done to come up with the clean solution. * */ -if (mode !=IA_CSS_CAPTURE_MODE_RAW && mode !=IA_CSS_CAPTURE_MODE_BAYER && current_stage && vf_frame) - { +if (mode !=IA_CSS_CAPTURE_MODE_RAW && mode !=IA_CSS_CAPTURE_MODE_BAYER && current_stage && vf_frame) { in_frame = current_stage->args.out_vf_frame; err =add_vf_pp_stage (pipe, in_frame, vf_frame, vf_pp_binary, ¤t_stage);
@@ -8070,7 +7964,8 @@ create_host_regular_capture_pipeline(str }static int -create_host_capture_pipeline (struct ia_css_pipe *pipe) { +create_host_capture_pipeline (struct ia_css_pipe *pipe) +{int err =0 ;IA_CSS_ENTER_PRIVATE ("pipe = %p" , pipe);
@@ -8079,8 +7974,7 @@ create_host_capture_pipeline(struct ia_c err =create_host_isyscopy_capture_pipeline (pipe); else err =create_host_regular_capture_pipeline (pipe); -if (err) - { +if (err) {IA_CSS_LEAVE_ERR_PRIVATE (err);return err; }
@@ -8091,7 +7985,8 @@ create_host_capture_pipeline(struct ia_c }static int capture_start ( -struct ia_css_pipe *pipe) { +struct ia_css_pipe *pipe) +{struct ia_css_pipeline *me;int err =0 ;
@@ -8162,7 +8057,8 @@ static int capture_start(static int sh_css_pipe_get_output_frame_info (struct ia_css_pipe *pipe,struct ia_css_frame_info *info, -unsigned int idx) { +unsigned int idx) +{assert (pipe);assert (info);
@@ -8171,8 +8067,7 @@ sh_css_pipe_get_output_frame_info(struct *info = pipe->output_info[idx];if (copy_on_sp (pipe) && - pipe->stream->config.input_config.format ==ATOMISP_INPUT_FORMAT_BINARY_8 ) - { + pipe->stream->config.input_config.format ==ATOMISP_INPUT_FORMAT_BINARY_8 ) { ia_css_frame_info_init( info, JPEG_BYTES,
@@ -8180,8 +8075,7 @@ sh_css_pipe_get_output_frame_info(structIA_CSS_FRAME_FORMAT_BINARY_8 , 0); }else if (info->format ==IA_CSS_FRAME_FORMAT_RAW || - info->format ==IA_CSS_FRAME_FORMAT_RAW_PACKED ) - { + info->format ==IA_CSS_FRAME_FORMAT_RAW_PACKED ) { info->raw_bit_depth =ia_css_pipe_util_pipe_input_format_bpp (pipe); }
@@ -8195,7 +8089,8 @@ void ia_css_stream_send_input_frame(const struct ia_css_stream *stream, const unsigned short *data, unsigned int width, - unsigned int height) { + unsigned int height) +{assert (stream); ia_css_inputfifo_send_input_frame(
@@ -8206,7 +8101,8 @@ ia_css_stream_send_input_frame(const str }void -ia_css_stream_start_input_frame (const struct ia_css_stream *stream) { +ia_css_stream_start_input_frame (const struct ia_css_stream *stream) +{assert (stream); ia_css_inputfifo_start_frame(
@@ -8220,7 +8116,8 @@ ia_css_stream_send_input_line(const struconst unsigned short *data, unsigned int width, const unsigned short *data2, - unsigned int width2) { + unsigned int width2) +{assert (stream ); ia_css_inputfifo_send_line(stream->config.channel_id,
@@ -8231,7 +8128,8 @@ void ia_css_stream_send_input_embedded_line(const struct ia_css_stream *stream, enum atomisp_input_format format, const unsigned short *data, - unsigned int width) { + unsigned int width) +{assert (stream);if (!data || width ==0 )return ;
@@ -8240,14 +8138,16 @@ ia_css_stream_send_input_embedded_line(c }void -ia_css_stream_end_input_frame (const struct ia_css_stream *stream) { +ia_css_stream_end_input_frame (const struct ia_css_stream *stream) +{assert (stream);ia_css_inputfifo_end_frame (stream->config.channel_id); }static void -append_firmware (struct ia_css_fw_info **l,struct ia_css_fw_info *firmware) { +append_firmware (struct ia_css_fw_info **l,struct ia_css_fw_info *firmware) +{IA_CSS_ENTER_PRIVATE ("l = %p, firmware = %p" , l, firmware);if (!l) {IA_CSS_ERROR ("NULL fw_info" );
@@ -8262,7 +8162,8 @@ append_firmware(struct ia_css_fw_info ** }static void -remove_firmware (struct ia_css_fw_info **l,struct ia_css_fw_info *firmware) { +remove_firmware (struct ia_css_fw_info **l,struct ia_css_fw_info *firmware) +{assert (*l);assert (firmware); (void )l;
@@ -8304,12 +8205,12 @@ static int upload_isp_code(struct ia_css }static int -acc_load_extension (struct ia_css_fw_info *firmware) { +acc_load_extension (struct ia_css_fw_info *firmware) +{int err;struct ia_css_fw_info *hd = firmware; -while (hd) - { +while (hd) { err =upload_isp_code (hd);if (err)return err;
@@ -8323,7 +8224,8 @@ acc_load_extension(struct ia_css_fw_info }static void -acc_unload_extension (struct ia_css_fw_info *firmware) { +acc_unload_extension (struct ia_css_fw_info *firmware) +{struct ia_css_fw_info *hd = firmware;struct ia_css_fw_info *hdn =NULL ;
@@ -8347,13 +8249,13 @@ acc_unload_extension(struct ia_css_fw_in/* Load firmware for extension */ static int ia_css_pipe_load_extension (struct ia_css_pipe *pipe, -struct ia_css_fw_info *firmware) { +struct ia_css_fw_info *firmware) +{int err =0 ;IA_CSS_ENTER_PRIVATE ("fw = %p pipe = %p" , firmware, pipe); -if ((!firmware) || (!pipe)) - { +if ((!firmware) || (!pipe)) {IA_CSS_LEAVE_ERR_PRIVATE (-EINVAL );return -EINVAL ; }
@@ -8371,7 +8273,8 @@ ia_css_pipe_load_extension(struct ia_css/* Unload firmware for extension */ static void ia_css_pipe_unload_extension (struct ia_css_pipe *pipe, -struct ia_css_fw_info *firmware) { +struct ia_css_fw_info *firmware) +{IA_CSS_ENTER_PRIVATE ("fw = %p pipe = %p" , firmware, pipe);if ((!firmware) || (!pipe)) {
@@ -8390,7 +8293,8 @@ ia_css_pipe_unload_extension(struct ia_c }bool -ia_css_pipeline_uses_params (struct ia_css_pipeline *me) { +ia_css_pipeline_uses_params (struct ia_css_pipeline *me) +{struct ia_css_pipeline_stage *stage;assert (me);
@@ -8411,7 +8315,8 @@ ia_css_pipeline_uses_params(struct ia_csstatic int sh_css_pipeline_add_acc_stage (struct ia_css_pipeline *pipeline, -const void *acc_fw) { +const void *acc_fw) +{struct ia_css_fw_info *fw = (struct ia_css_fw_info *)acc_fw;/* In QoS case, load_extension already called, so skipping */ int err =0 ;
@@ -8423,8 +8328,7 @@ sh_css_pipeline_add_acc_stage(struct ia_"sh_css_pipeline_add_acc_stage() enter: pipeline=%p, acc_fw=%p\n" , pipeline, acc_fw); -if (!err) - { +if (!err) {struct ia_css_pipeline_stage_desc stage_desc;ia_css_pipe_get_acc_stage_desc (&stage_desc,NULL , fw);
@@ -8443,7 +8347,8 @@ sh_css_pipeline_add_acc_stage(struct ia_* Refer to "sh_css_internal.h" for details. */ int ia_css_stream_capture_frame (struct ia_css_stream *stream, -unsigned int exp_id) { +unsigned int exp_id) +{struct sh_css_tag_descr tag_descr;u32 encoded_tag_descr;int err;
@@ -8485,7 +8390,8 @@ int ia_css_stream_capture(struct ia_css_stream *stream, int num_captures, unsigned int skip, - int offset) { + int offset) +{ struct sh_css_tag_descr tag_descr;unsigned int encoded_tag_descr;int return_err;
@@ -8548,8 +8454,9 @@ void ia_css_stream_request_flash(structia_css_debug_dump_sp_sw_debug_info (); ia_css_debug_dump_debug_info(NULL); } - }else + }else {IA_CSS_LOG ("SP is not running!" ); + }#endif ia_css_debug_dtrace(IA_CSS_DEBUG_TRACE,
@@ -8557,7 +8464,8 @@ void ia_css_stream_request_flash(struct }static void -sh_css_init_host_sp_control_vars (void ) { +sh_css_init_host_sp_control_vars (void ) +{const struct ia_css_fw_info *fw;unsigned int HIVE_ADDR_ia_css_ispctrl_sp_isp_started;
@@ -8641,7 +8549,8 @@ void ia_css_pipe_config_defaults(structvoid ia_css_pipe_extra_config_defaults (struct ia_css_pipe_extra_config - *extra_config) { + *extra_config) +{if (!extra_config) {IA_CSS_ERROR ("NULL input parameter" );return ;
@@ -8671,11 +8580,11 @@ void ia_css_stream_config_defaults(struc }static int -ia_css_acc_pipe_create (struct ia_css_pipe *pipe) { +ia_css_acc_pipe_create (struct ia_css_pipe *pipe) +{int err =0 ; -if (!pipe) - { +if (!pipe) {IA_CSS_ERROR ("NULL input parameter" );return -EINVAL ; }
@@ -8685,9 +8594,7 @@ ia_css_acc_pipe_create(struct ia_css_pip pipe->config.acc_num_execs =1 ;if (pipe->config.acc_extension) - { err =ia_css_pipe_load_extension (pipe, pipe->config.acc_extension); - }return err; }
@@ -8706,9 +8613,8 @@ int ia_css_pipe_create(const struct ia_c err =ia_css_pipe_create_extra (config,NULL , pipe); -if (err ==0 ) { +if (err ==0 )IA_CSS_LOG ("pipe created successfully = %p" , *pipe); - }IA_CSS_LEAVE_ERR_PRIVATE (err);
@@ -8718,7 +8624,8 @@ int ia_css_pipe_create(const struct ia_cint ia_css_pipe_create_extra (const struct ia_css_pipe_config *config,const struct ia_css_pipe_extra_config *extra_config, -struct ia_css_pipe **pipe) { +struct ia_css_pipe **pipe) +{int err = -EINVAL ;struct ia_css_pipe *internal_pipe =NULL ;unsigned int i;
@@ -8726,14 +8633,12 @@ ia_css_pipe_create_extra(const struct iaIA_CSS_ENTER_PRIVATE ("config = %p, extra_config = %p and pipe = %p" , config, extra_config, pipe);/* do not allow to create more than the maximum limit */ -if (my_css.pipe_counter >=IA_CSS_PIPELINE_NUM_MAX ) - { +if (my_css.pipe_counter >=IA_CSS_PIPELINE_NUM_MAX ) {IA_CSS_LEAVE_ERR_PRIVATE (-ENOSPC );return -EINVAL ; } -if ((!pipe) || (!config)) - { +if ((!pipe) || (!config)) {IA_CSS_LEAVE_ERR_PRIVATE (-EINVAL );return -EINVAL ; }
@@ -8742,8 +8647,7 @@ ia_css_pipe_create_extra(const struct iaia_css_debug_dump_pipe_extra_config (extra_config); err =create_pipe (config->mode, &internal_pipe, false); -if (err) - { +if (err) {IA_CSS_LEAVE_ERR_PRIVATE (err);return err; }
@@ -8755,8 +8659,7 @@ ia_css_pipe_create_extra(const struct iaelse ia_css_pipe_extra_config_defaults (&internal_pipe->extra_config); -if (config->mode ==IA_CSS_PIPE_MODE_ACC ) - { +if (config->mode ==IA_CSS_PIPE_MODE_ACC ) {/* Temporary hack to migrate acceleration to CSS 2.0. * In the future the code for all pipe types should be * unified. */
@@ -8783,15 +8686,13 @@ ia_css_pipe_create_extra(const struct iaset bayer_ds_out_res equal to IF output resolution(IF may do cropping on sensor output) or use default decimation factor 1. */ if (internal_pipe->extra_config.enable_raw_binning && - internal_pipe->config.bayer_ds_out_res.width) - { + internal_pipe->config.bayer_ds_out_res.width) {/* fill some code here, if no code is needed, please remove it during integration */ }/* YUV downscaling */ if ((internal_pipe->config.vf_pp_in_res.width || - internal_pipe->config.capt_pp_in_res.width)) - { + internal_pipe->config.capt_pp_in_res.width)) {enum ia_css_frame_format format;if (internal_pipe->config.vf_pp_in_res.width) {
@@ -8812,8 +8713,7 @@ ia_css_pipe_create_extra(const struct ia } }if (internal_pipe->config.vf_pp_in_res.width && - internal_pipe->config.mode ==IA_CSS_PIPE_MODE_PREVIEW ) - { + internal_pipe->config.mode ==IA_CSS_PIPE_MODE_PREVIEW ) { ia_css_frame_info_init( &internal_pipe->vf_yuv_ds_input_info, internal_pipe->config.vf_pp_in_res.width,
@@ -8821,8 +8721,7 @@ ia_css_pipe_create_extra(const struct ia IA_CSS_FRAME_FORMAT_YUV_LINE, 0); }/* handle bayer downscaling output info */ -if (internal_pipe->config.bayer_ds_out_res.width) - { +if (internal_pipe->config.bayer_ds_out_res.width) { ia_css_frame_info_init( &internal_pipe->bds_output_info, internal_pipe->config.bayer_ds_out_res.width,
@@ -8831,8 +8730,7 @@ ia_css_pipe_create_extra(const struct ia }/* handle output info, assume always needed */ -for (i =0 ; i <IA_CSS_PIPE_MAX_OUTPUT_STAGE ; i++) - { +for (i =0 ; i <IA_CSS_PIPE_MAX_OUTPUT_STAGE ; i++) {if (internal_pipe->config.output_info[i].res.width) { err = sh_css_pipe_configure_output( internal_pipe,
@@ -8868,8 +8766,7 @@ ia_css_pipe_create_extra(const struct ia } } } -if (internal_pipe->config.acc_extension) - { +if (internal_pipe->config.acc_extension) { err =ia_css_pipe_load_extension (internal_pipe, internal_pipe->config.acc_extension);if (err) {
@@ -8889,18 +8786,18 @@ ia_css_pipe_create_extra(const struct iaint ia_css_pipe_get_info (const struct ia_css_pipe *pipe, -struct ia_css_pipe_info *pipe_info) { +struct ia_css_pipe_info *pipe_info) +{ia_css_debug_dtrace (IA_CSS_DEBUG_TRACE ,"ia_css_pipe_get_info()\n" ); +assert (pipe_info); -if (!pipe_info) - { +if (!pipe_info) {ia_css_debug_dtrace (IA_CSS_DEBUG_ERROR ,"ia_css_pipe_get_info: pipe_info cannot be NULL\n" );return -EINVAL ; } -if (!pipe || !pipe->stream) - { +if (!pipe || !pipe->stream) {ia_css_debug_dtrace (IA_CSS_DEBUG_ERROR ,"ia_css_pipe_get_info: ia_css_stream_create needs to be called before ia_css_[stream/pipe]_get_info\n" );return -EINVAL ;
@@ -8928,40 +8825,36 @@ bool ia_css_pipe_has_dvs_stats(struct iaint ia_css_pipe_override_frame_format (struct ia_css_pipe *pipe,int pin_index, -enum ia_css_frame_format new_format) { +enum ia_css_frame_format new_format) +{int err =0 ;IA_CSS_ENTER_PRIVATE ("pipe = %p, pin_index = %d, new_formats = %d" , pipe, pin_index, new_format); -if (!pipe) - { +if (!pipe) {IA_CSS_ERROR ("pipe is not set" ); err = -EINVAL ;IA_CSS_LEAVE_ERR_PRIVATE (err);return err; } -if (0 != pin_index &&1 != pin_index) - { +if (0 != pin_index &&1 != pin_index) {IA_CSS_ERROR ("pin index is not valid" ); err = -EINVAL ;IA_CSS_LEAVE_ERR_PRIVATE (err);return err; } -if (new_format !=IA_CSS_FRAME_FORMAT_NV12_TILEY ) - { +if (new_format !=IA_CSS_FRAME_FORMAT_NV12_TILEY ) {IA_CSS_ERROR ("new format is not valid" ); err = -EINVAL ;IA_CSS_LEAVE_ERR_PRIVATE (err);return err; - }else - { + }else { err =ia_css_pipe_check_format (pipe, new_format);if (!err) { -if (pin_index ==0 ) { +if (pin_index ==0 ) pipe->output_info[0 ].format = new_format; - }else { +else pipe->vf_output_info[0 ].format = new_format; - } } }IA_CSS_LEAVE_ERR_PRIVATE (err);
@@ -8971,7 +8864,8 @@ ia_css_pipe_override_frame_format(struct#if !defined(ISP2401 )/* Configuration of INPUT_SYSTEM_VERSION_2401 is done on SP */ static int -ia_css_stream_configure_rx (struct ia_css_stream *stream) { +ia_css_stream_configure_rx (struct ia_css_stream *stream) +{struct ia_css_input_port *config;assert (stream);
@@ -9000,11 +8894,10 @@ ia_css_stream_configure_rx(struct ia_cssif (config->compression.type ==IA_CSS_CSI2_COMPRESSION_TYPE_NONE ) stream->csi_rx_config.comp =MIPI_PREDICTOR_NONE ;else - {/* not implemented yet, requires extension of the rx_cfg_t * struct */ return -EINVAL ; - } + stream->csi_rx_config.is_two_ppc = (stream->config.pixels_per_clock ==2 ); stream->reconfigure_css_rx = true;return 0 ;
@@ -9015,7 +8908,8 @@ static struct ia_css_pipe * find_pipe(struct ia_css_pipe *pipes[], unsigned int num_pipes, enum ia_css_pipe_mode mode, - bool copy_pipe) { + bool copy_pipe) +{ unsigned int i;assert (pipes);
@@ -9031,21 +8925,20 @@ find_pipe(struct ia_css_pipe *pipes[], }static int -ia_css_acc_stream_create (struct ia_css_stream *stream) { +ia_css_acc_stream_create (struct ia_css_stream *stream) +{int i;int err =0 ;assert (stream);IA_CSS_ENTER_PRIVATE ("stream = %p" , stream); -if (!stream) - { +if (!stream) {IA_CSS_LEAVE_ERR_PRIVATE (-EINVAL );return -EINVAL ; } -for (i =0 ; i < stream->num_pipes; i++) - { +for (i =0 ; i < stream->num_pipes; i++) {struct ia_css_pipe *pipe = stream->pipes[i];assert (pipe);
@@ -9059,14 +8952,12 @@ ia_css_acc_stream_create(struct ia_css_s/* Map SP threads before doing anything. */ err =map_sp_threads (stream, true); -if (err) - { +if (err) {IA_CSS_LEAVE_ERR_PRIVATE (err);return err; } -for (i =0 ; i < stream->num_pipes; i++) - { +for (i =0 ; i < stream->num_pipes; i++) {struct ia_css_pipe *pipe = stream->pipes[i];assert (pipe);
@@ -9074,8 +8965,7 @@ ia_css_acc_stream_create(struct ia_css_s } err =create_host_pipeline_structure (stream); -if (err) - { +if (err) {IA_CSS_LEAVE_ERR_PRIVATE (err);return err; }
@@ -9089,7 +8979,8 @@ ia_css_acc_stream_create(struct ia_css_sstatic int metadata_info_init (const struct ia_css_metadata_config *mdc, -struct ia_css_metadata_info *md) { +struct ia_css_metadata_info *md) +{/* Either both width and height should be set or neither */ if ((mdc->resolution.height >0 ) ^ (mdc->resolution.width >0 ))return -EINVAL ;
@@ -9149,7 +9040,8 @@ int ia_css_stream_create(const struct ia_css_stream_config *stream_config, int num_pipes, struct ia_css_pipe *pipes[], - struct ia_css_stream **stream) { + struct ia_css_stream **stream) +{ struct ia_css_pipe *curr_pipe;struct ia_css_stream *curr_stream =NULL ;bool spcopyonly;
@@ -9168,8 +9060,7 @@ ia_css_stream_create(const struct ia_css/* some checks */ if (num_pipes ==0 || !stream || - !pipes) - { + !pipes) { err = -EINVAL ;IA_CSS_LEAVE_ERR (err);return err;
@@ -9178,8 +9069,7 @@ ia_css_stream_create(const struct ia_css#if !defined(ISP2401 )/* We don't support metadata for JPEG stream, since they both use str2mem */ if (stream_config->input_config.format ==ATOMISP_INPUT_FORMAT_BINARY_8 && - stream_config->metadata_config.resolution.height >0 ) - { + stream_config->metadata_config.resolution.height >0 ) { err = -EINVAL ;IA_CSS_LEAVE_ERR (err);return err;
@@ -9187,8 +9077,7 @@ ia_css_stream_create(const struct ia_css#endif #ifdef ISP2401 -if (stream_config->online && stream_config->pack_raw_pixels) - { +if (stream_config->online && stream_config->pack_raw_pixels) {IA_CSS_LOG ("online and pack raw is invalid on input system 2401" ); err = -EINVAL ;IA_CSS_LEAVE_ERR (err);
@@ -9243,16 +9132,14 @@ ia_css_stream_create(const struct ia_css/* Currently we only supported metadata up to a certain size. */ err =metadata_info_init (&stream_config->metadata_config, &md_info); -if (err) - { +if (err) {IA_CSS_LEAVE_ERR (err);return err; }/* allocate the stream instance */ curr_stream =kzalloc (sizeof (struct ia_css_stream ),GFP_KERNEL ); -if (!curr_stream) - { +if (!curr_stream) { err = -ENOMEM ;IA_CSS_LEAVE_ERR (err);return err;
@@ -9263,8 +9150,7 @@ ia_css_stream_create(const struct ia_css/* allocate pipes */ curr_stream->num_pipes = num_pipes; curr_stream->pipes =kcalloc (num_pipes,sizeof (struct ia_css_pipe *),GFP_KERNEL ); -if (!curr_stream->pipes) - { +if (!curr_stream->pipes) { curr_stream->num_pipes =0 ;kfree (curr_stream); curr_stream =NULL ;
@@ -9287,8 +9173,7 @@ ia_css_stream_create(const struct ia_css#endif #ifdef ISP2401 -if (curr_stream->config.online) - { +if (curr_stream->config.online) { curr_stream->config.source.port.num_lanes = stream_config->source.port.num_lanes; curr_stream->config.mode =IA_CSS_INPUT_MODE_BUFFERED_SENSOR ;
@@ -9306,8 +9191,7 @@ ia_css_stream_create(const struct ia_css curr_stream->config.lock_all);/* copy mode specific stuff */ -switch (curr_stream->config.mode) - { +switch (curr_stream->config.mode) {case IA_CSS_INPUT_MODE_SENSOR :case IA_CSS_INPUT_MODE_BUFFERED_SENSOR :#if !defined(ISP2401 )
@@ -9349,14 +9233,12 @@ ia_css_stream_create(const struct ia_css err =aspect_ratio_crop_init (curr_stream, pipes, &aspect_ratio_crop_enabled); -if (err) - { +if (err) {IA_CSS_LEAVE_ERR (err); goto ERR; }#endif -for (i =0 ; i < num_pipes; i++) - { +for (i =0 ; i < num_pipes; i++) {struct ia_css_resolution effective_res; curr_pipe = pipes[i];
@@ -9396,9 +9278,8 @@ ia_css_stream_create(const struct ia_cssif (pipes[i]->config.mode !=IA_CSS_PIPE_MODE_ACC && pipes[i]->config.mode !=IA_CSS_PIPE_MODE_COPY ) { err =check_pipe_resolutions (pipes[i]); -if (err) { +if (err) goto ERR; - } } } }
@@ -9408,20 +9289,17 @@ ia_css_stream_create(const struct ia_css goto ERR;IA_CSS_LOG ("isp_params_configs: %p" , curr_stream->isp_params_configs); -if (num_pipes ==1 && pipes[0 ]->config.mode ==IA_CSS_PIPE_MODE_ACC ) - { +if (num_pipes ==1 && pipes[0 ]->config.mode ==IA_CSS_PIPE_MODE_ACC ) { *stream = curr_stream; err =ia_css_acc_stream_create (curr_stream); goto ERR; }/* sensor binning */ -if (!spcopyonly) - { +if (!spcopyonly) { sensor_binning_changed =sh_css_params_set_binning_factor (curr_stream, curr_stream->config.sensor_binning_factor); - }else - { + }else { sensor_binning_changed = false; }
@@ -9432,8 +9310,7 @@ ia_css_stream_create(const struct ia_css curr_stream->cont_capt = false;/* Temporary hack: we give the preview pipe a reference to the capture * pipe in continuous capture mode. */ -if (curr_stream->config.continuous) - { +if (curr_stream->config.continuous) {/* Search for the preview pipe and create the copy pipe */ struct ia_css_pipe *preview_pipe;struct ia_css_pipe *video_pipe;
@@ -9481,9 +9358,9 @@ ia_css_stream_create(const struct ia_css preview_pipe->pipe_settings.preview.copy_pipe = copy_pipe; copy_pipe->stream = curr_stream; } -if (preview_pipe && curr_stream->cont_capt) { +if (preview_pipe && curr_stream->cont_capt) preview_pipe->pipe_settings.preview.capture_pipe = capture_pipe; - } +if (video_pipe && !video_pipe->pipe_settings.video.copy_pipe) { err =create_pipe (IA_CSS_PIPE_MODE_CAPTURE , ©_pipe, true);if (err)
@@ -9492,15 +9369,13 @@ ia_css_stream_create(const struct ia_css video_pipe->pipe_settings.video.copy_pipe = copy_pipe; copy_pipe->stream = curr_stream; } -if (video_pipe && curr_stream->cont_capt) { +if (video_pipe && curr_stream->cont_capt) video_pipe->pipe_settings.video.capture_pipe = capture_pipe; - } -if (preview_pipe && acc_pipe) { + +if (preview_pipe && acc_pipe) preview_pipe->pipe_settings.preview.acc_pipe = acc_pipe; - } } -for (i =0 ; i < num_pipes; i++) - { +for (i =0 ; i < num_pipes; i++) { curr_pipe = pipes[i];/* set current stream */ curr_pipe->stream = curr_stream;
@@ -9521,8 +9396,7 @@ ia_css_stream_create(const struct ia_css }/* now pipes have been configured, info should be available */ -for (i =0 ; i < num_pipes; i++) - { +for (i =0 ; i < num_pipes; i++) {struct ia_css_pipe_info *pipe_info =NULL ; curr_pipe = pipes[i];
@@ -9572,22 +9446,19 @@ ia_css_stream_create(const struct ia_css/* Map SP threads before doing anything. */ err =map_sp_threads (curr_stream, true); -if (err) - { +if (err) {IA_CSS_LOG ("map_sp_threads: return_err=%d" , err); goto ERR; } -for (i =0 ; i < num_pipes; i++) - { +for (i =0 ; i < num_pipes; i++) { curr_pipe = pipes[i];ia_css_pipe_map_queue (curr_pipe, true); }/* Create host side pipeline objects without stages */ err =create_host_pipeline_structure (curr_stream); -if (err) - { +if (err) {IA_CSS_LOG ("create_host_pipeline_structure: return_err=%d" , err); goto ERR; }
@@ -9625,13 +9496,13 @@ ERR: }int -ia_css_stream_destroy (struct ia_css_stream *stream) { +ia_css_stream_destroy (struct ia_css_stream *stream) +{int i;int err =0 ;IA_CSS_ENTER_PRIVATE ("stream = %p" , stream); -if (!stream) - { +if (!stream) { err = -EINVAL ;IA_CSS_LEAVE_ERR_PRIVATE (err);return err;
@@ -9640,8 +9511,7 @@ ia_css_stream_destroy(struct ia_css_streia_css_stream_isp_parameters_uninit (stream);if ((stream->last_pipe) && -ia_css_pipeline_is_mapped (stream->last_pipe->pipe_num)) - { +ia_css_pipeline_is_mapped (stream->last_pipe->pipe_num)) {#if defined(ISP2401 )bool free_mpi;
@@ -9703,8 +9573,7 @@ ia_css_stream_destroy(struct ia_css_stre }/* remove references from pipes to stream */ -for (i =0 ; i < stream->num_pipes; i++) - { +for (i =0 ; i < stream->num_pipes; i++) {struct ia_css_pipe *entry = stream->pipes[i];assert (entry);
@@ -9733,8 +9602,7 @@ ia_css_stream_destroy(struct ia_css_stre/* working mode: take out of the seed list */ if (my_css_save.mode == sh_css_mode_working) {for (i =0 ; i <MAX_ACTIVE_STREAMS ; i++) { -if (my_css_save.stream_seeds[i].stream == stream) - { +if (my_css_save.stream_seeds[i].stream == stream) {IA_CSS_LOG ("took out stream %d" , i); my_css_save.stream_seeds[i].stream =NULL ;break ;
@@ -9750,7 +9618,8 @@ ia_css_stream_destroy(struct ia_css_streint ia_css_stream_get_info (const struct ia_css_stream *stream, -struct ia_css_stream_info *stream_info) { +struct ia_css_stream_info *stream_info) +{ia_css_debug_dtrace (IA_CSS_DEBUG_TRACE ,"ia_css_stream_get_info: enter/exit\n" );assert (stream);assert (stream_info);
@@ -9766,15 +9635,15 @@ ia_css_stream_get_info(const struct ia_c* The stream handle is used to identify the correct entry in the css_save struct */ int -ia_css_stream_load (struct ia_css_stream *stream) { +ia_css_stream_load (struct ia_css_stream *stream) +{if (!IS_ISP2401 ) {int i;int err;assert (stream);ia_css_debug_dtrace (IA_CSS_DEBUG_TRACE ,"ia_css_stream_load() enter,\n" ); -for (i =0 ; i <MAX_ACTIVE_STREAMS ; i++) - { +for (i =0 ; i <MAX_ACTIVE_STREAMS ; i++) {if (my_css_save.stream_seeds[i].stream == stream) {int j;
@@ -9813,12 +9682,12 @@ ia_css_stream_load(struct ia_css_stream }int -ia_css_stream_start (struct ia_css_stream *stream) { +ia_css_stream_start (struct ia_css_stream *stream) +{int err =0 ;IA_CSS_ENTER ("stream = %p" , stream); -if ((!stream) || (!stream->last_pipe)) - { +if ((!stream) || (!stream->last_pipe)) {IA_CSS_LEAVE_ERR (-EINVAL );return -EINVAL ; }
@@ -9828,8 +9697,7 @@ ia_css_stream_start(struct ia_css_stream/* Create host side pipeline. */ err =create_host_pipeline (stream); -if (err) - { +if (err) {IA_CSS_LEAVE_ERR (err);return err; }
@@ -9842,8 +9710,7 @@ ia_css_stream_start(struct ia_css_stream#if !defined(ISP2401 )/* Initialize mipi size checks */ -if (stream->config.mode ==IA_CSS_INPUT_MODE_BUFFERED_SENSOR ) - { +if (stream->config.mode ==IA_CSS_INPUT_MODE_BUFFERED_SENSOR ) {unsigned int idx;unsigned int port = (unsigned int )(stream->config.source.port.port);
@@ -9854,8 +9721,7 @@ ia_css_stream_start(struct ia_css_stream }#endif -if (stream->config.mode !=IA_CSS_INPUT_MODE_MEMORY ) - { +if (stream->config.mode !=IA_CSS_INPUT_MODE_MEMORY ) { err =sh_css_config_input_network (stream);if (err)return err;
@@ -9867,7 +9733,8 @@ ia_css_stream_start(struct ia_css_stream }int -ia_css_stream_stop (struct ia_css_stream *stream) { +ia_css_stream_stop (struct ia_css_stream *stream) +{int err =0 ;ia_css_debug_dtrace (IA_CSS_DEBUG_TRACE ,"ia_css_stream_stop() enter/exit\n" );
@@ -9878,22 +9745,19 @@ ia_css_stream_stop(struct ia_css_stream#if !defined(ISP2401 )/* De-initialize mipi size checks */ -if (stream->config.mode ==IA_CSS_INPUT_MODE_BUFFERED_SENSOR ) - { +if (stream->config.mode ==IA_CSS_INPUT_MODE_BUFFERED_SENSOR ) {unsigned int idx;unsigned int port = (unsigned int )(stream->config.source.port.port); -for (idx =0 ; idx <IA_CSS_MIPI_SIZE_CHECK_MAX_NOF_ENTRIES_PER_PORT ; idx++) { +for (idx =0 ; idx <IA_CSS_MIPI_SIZE_CHECK_MAX_NOF_ENTRIES_PER_PORT ; idx++) sh_css_sp_group.config.mipi_sizes_for_check[port][idx] =0 ; - } }#endif -if (!IS_ISP2401 ) { +if (!IS_ISP2401 ) err =ia_css_pipeline_request_stop (&stream->last_pipe->pipeline); - }else { +else err =sh_css_pipes_stop (stream); - }if (err)return err;
@@ -9906,16 +9770,16 @@ ia_css_stream_stop(struct ia_css_stream }bool -ia_css_stream_has_stopped (struct ia_css_stream *stream) { +ia_css_stream_has_stopped (struct ia_css_stream *stream) +{bool stopped;assert (stream); -if (!IS_ISP2401 ) { +if (!IS_ISP2401 ) stopped =ia_css_pipeline_has_stopped (&stream->last_pipe->pipeline); - }else { +else stopped =sh_css_pipes_have_stopped (stream); - }return stopped; }
@@ -9926,7 +9790,8 @@ ia_css_stream_has_stopped(struct ia_css_* The stream handle is used to identify the correct entry in the css_save struct */ int -ia_css_stream_unload (struct ia_css_stream *stream) { +ia_css_stream_unload (struct ia_css_stream *stream) +{int i;assert (stream);
@@ -9934,8 +9799,7 @@ ia_css_stream_unload(struct ia_css_strea/* some checks */ assert (stream);for (i =0 ; i <MAX_ACTIVE_STREAMS ; i++) -if (my_css_save.stream_seeds[i].stream == stream) - { +if (my_css_save.stream_seeds[i].stream == stream) {int j; ia_css_debug_dtrace(IA_CSS_DEBUG_TRACE,
@@ -9955,7 +9819,8 @@ ia_css_stream_unload(struct ia_css_streaint ia_css_temp_pipe_to_pipe_id (const struct ia_css_pipe *pipe, -enum ia_css_pipe_id *pipe_id) { +enum ia_css_pipe_id *pipe_id) +{ia_css_debug_dtrace (IA_CSS_DEBUG_TRACE ,"ia_css_temp_pipe_to_pipe_id() enter/exit\n" );if (pipe) *pipe_id = pipe->mode;
@@ -9966,18 +9831,21 @@ ia_css_temp_pipe_to_pipe_id(const struct }enum atomisp_input_format -ia_css_stream_get_format (const struct ia_css_stream *stream) { +ia_css_stream_get_format (const struct ia_css_stream *stream) +{return stream->config.input_config.format; }bool -ia_css_stream_get_two_pixels_per_clock (const struct ia_css_stream *stream) { +ia_css_stream_get_two_pixels_per_clock (const struct ia_css_stream *stream) +{return (stream->config.pixels_per_clock ==2 ); }struct ia_css_binary *ia_css_stream_get_shading_correction_binary (const struct ia_css_stream - *stream) { + *stream) +{struct ia_css_pipe *pipe;assert (stream);
@@ -9995,7 +9863,8 @@ ia_css_stream_get_shading_correction_bin }struct ia_css_binary * -ia_css_stream_get_dvs_binary (const struct ia_css_stream *stream) { +ia_css_stream_get_dvs_binary (const struct ia_css_stream *stream) +{int i;struct ia_css_pipe *video_pipe =NULL ;
@@ -10014,7 +9883,8 @@ ia_css_stream_get_dvs_binary(const struc }struct ia_css_binary * -ia_css_stream_get_3a_binary (const struct ia_css_stream *stream) { +ia_css_stream_get_3a_binary (const struct ia_css_stream *stream) +{struct ia_css_pipe *pipe;struct ia_css_binary *s3a_binary =NULL ;
@@ -10036,7 +9906,8 @@ ia_css_stream_get_3a_binary(const structint ia_css_stream_set_output_padded_width (struct ia_css_stream *stream, -unsigned int output_padded_width) { +unsigned int output_padded_width) +{struct ia_css_pipe *pipe;assert (stream);
@@ -10053,7 +9924,8 @@ ia_css_stream_set_output_padded_width(st }static struct ia_css_binary * -ia_css_pipe_get_shading_correction_binary (const struct ia_css_pipe *pipe) { +ia_css_pipe_get_shading_correction_binary (const struct ia_css_pipe *pipe) +{struct ia_css_binary *binary =NULL ;assert (pipe);
@@ -10098,7 +9970,8 @@ ia_css_pipe_get_shading_correction_binar }static struct ia_css_binary * -ia_css_pipe_get_s3a_binary (const struct ia_css_pipe *pipe) { +ia_css_pipe_get_s3a_binary (const struct ia_css_pipe *pipe) +{struct ia_css_binary *binary =NULL ;assert (pipe);
@@ -10121,9 +9994,9 @@ ia_css_pipe_get_s3a_binary(const struct } } }else if (pipe->config.default_capture_config.mode == -IA_CSS_CAPTURE_MODE_BAYER ) +IA_CSS_CAPTURE_MODE_BAYER ) { binary = (struct ia_css_binary *)&pipe->pipe_settings.capture.pre_isp_binary; -else if (pipe->config.default_capture_config.mode == + }else if (pipe->config.default_capture_config.mode ==IA_CSS_CAPTURE_MODE_ADVANCED || pipe->config.default_capture_config.mode ==IA_CSS_CAPTURE_MODE_LOW_LIGHT ) {if (pipe->config.isp_pipe_version ==IA_CSS_PIPE_VERSION_1 )
@@ -10145,7 +10018,8 @@ ia_css_pipe_get_s3a_binary(const struct }static struct ia_css_binary * -ia_css_pipe_get_sdis_binary (const struct ia_css_pipe *pipe) { +ia_css_pipe_get_sdis_binary (const struct ia_css_pipe *pipe) +{struct ia_css_binary *binary =NULL ;assert (pipe);
@@ -10165,14 +10039,16 @@ ia_css_pipe_get_sdis_binary(const struct }struct ia_css_pipeline * -ia_css_pipe_get_pipeline (const struct ia_css_pipe *pipe) { +ia_css_pipe_get_pipeline (const struct ia_css_pipe *pipe) +{assert (pipe);return (struct ia_css_pipeline *)&pipe->pipeline; }unsigned int -ia_css_pipe_get_pipe_num (const struct ia_css_pipe *pipe) { +ia_css_pipe_get_pipe_num (const struct ia_css_pipe *pipe) +{assert (pipe);/* KW was not sure this function was not returning a value
@@ -10189,7 +10065,8 @@ ia_css_pipe_get_pipe_num(const struct ia }unsigned int -ia_css_pipe_get_isp_pipe_version (const struct ia_css_pipe *pipe) { +ia_css_pipe_get_isp_pipe_version (const struct ia_css_pipe *pipe) +{assert (pipe);return (unsigned int )pipe->config.isp_pipe_version;
@@ -10198,7 +10075,8 @@ ia_css_pipe_get_isp_pipe_version(const s#define SP_START_TIMEOUT_US 30000000int -ia_css_start_sp (void ) { +ia_css_start_sp (void ) +{unsigned long timeout;int err =0 ;
@@ -10207,13 +10085,11 @@ ia_css_start_sp(void) {/* waiting for the SP is completely started */ timeout =SP_START_TIMEOUT_US ; -while ((ia_css_spctrl_get_state (SP0_ID ) !=IA_CSS_SP_SW_INITIALIZED ) && timeout) - { +while ((ia_css_spctrl_get_state (SP0_ID ) !=IA_CSS_SP_SW_INITIALIZED ) && timeout) { timeout--;udelay (1 ); } -if (timeout ==0 ) - { +if (timeout ==0 ) {IA_CSS_ERROR ("timeout during SP initialization" );return -EINVAL ; }
@@ -10241,14 +10117,14 @@ ia_css_start_sp(void) {#define SP_SHUTDOWN_TIMEOUT_US 200000int -ia_css_stop_sp (void ) { +ia_css_stop_sp (void ) +{unsigned long timeout;int err =0 ;IA_CSS_ENTER ("void" ); -if (!sh_css_sp_is_running ()) - { +if (!sh_css_sp_is_running ()) { err = -EINVAL ;IA_CSS_LEAVE ("SP already stopped : return_err=%d" , err);
@@ -10260,8 +10136,7 @@ ia_css_stop_sp(void) {if (!IS_ISP2401 ) {sh_css_write_host2sp_command (host2sp_cmd_terminate); }else { -if (!sh_css_write_host2sp_command (host2sp_cmd_terminate)) - { +if (!sh_css_write_host2sp_command (host2sp_cmd_terminate)) {IA_CSS_ERROR ("Call to 'sh-css_write_host2sp_command()' failed" );ia_css_debug_dump_sp_sw_debug_info ();ia_css_debug_dump_debug_info (NULL );
@@ -10271,27 +10146,23 @@ ia_css_stop_sp(void) {sh_css_sp_set_sp_running (false); timeout =SP_SHUTDOWN_TIMEOUT_US ; -while (!ia_css_spctrl_is_idle (SP0_ID ) && timeout) - { +while (!ia_css_spctrl_is_idle (SP0_ID ) && timeout) { timeout--;udelay (1 ); }if ((ia_css_spctrl_get_state (SP0_ID ) !=IA_CSS_SP_SW_TERMINATED ))IA_CSS_WARNING ("SP has not terminated (SW)" ); -if (timeout ==0 ) - { +if (timeout ==0 ) {IA_CSS_WARNING ("SP is not idle" );ia_css_debug_dump_sp_sw_debug_info (); } timeout =SP_SHUTDOWN_TIMEOUT_US ; -while (!isp_ctrl_getbit (ISP0_ID ,ISP_SC_REG ,ISP_IDLE_BIT ) && timeout) - { +while (!isp_ctrl_getbit (ISP0_ID ,ISP_SC_REG ,ISP_IDLE_BIT ) && timeout) { timeout--;udelay (1 ); } -if (timeout ==0 ) - { +if (timeout ==0 ) {IA_CSS_WARNING ("ISP is not idle" );ia_css_debug_dump_sp_sw_debug_info (); }
@@ -10306,7 +10177,8 @@ ia_css_stop_sp(void) { }int -ia_css_update_continuous_frames (struct ia_css_stream *stream) { +ia_css_update_continuous_frames (struct ia_css_stream *stream) +{struct ia_css_pipe *pipe;unsigned int i;
@@ -10314,8 +10186,7 @@ ia_css_update_continuous_frames(struct iIA_CSS_DEBUG_TRACE , "sh_css_update_continuous_frames() enter:\n"); -if (!stream) - { +if (!stream) {ia_css_debug_dtrace (IA_CSS_DEBUG_TRACE ,"sh_css_update_continuous_frames() leave: invalid stream, return_void\n" );
@@ -10326,10 +10197,9 @@ ia_css_update_continuous_frames(struct ifor (i = stream->config.init_num_cont_raw_buf; i < stream->config.target_num_cont_raw_buf; i++) - {sh_css_update_host2sp_offline_frame (i, pipe->continuous_frames[i], pipe->cont_md_buffers[i]); - } +sh_css_update_host2sp_cont_num_raw_frames (stream->config.target_num_cont_raw_buf, true); ia_css_debug_dtrace(
@@ -10455,7 +10325,8 @@ void ia_css_pipe_map_queue(struct ia_css#if CONFIG_ON_FRAME_ENQUEUE ()static int set_config_on_frame_enqueue (struct ia_css_frame_info - *info,struct frame_data_wrapper *frame) { + *info,struct frame_data_wrapper *frame) +{ frame->config_on_frame_enqueue.padded_width =0 ;/* currently we support configuration on frame enqueue only on YUV formats */
@@ -10463,11 +10334,11 @@ static int set_config_on_frame_enqueue(sswitch (info->format) {case IA_CSS_FRAME_FORMAT_YUV420 :case IA_CSS_FRAME_FORMAT_NV12 : -if (info->padded_width > info->res.width) { +if (info->padded_width > info->res.width) frame->config_on_frame_enqueue.padded_width = info->padded_width; - }else if ((info->padded_width < info->res.width) && (info->padded_width >0 )) { +else if ((info->padded_width < info->res.width) && (info->padded_width >0 ))return -EINVAL ; - } +/* nothing to do if width == padded width or padded width is zeroed (the same) */ break ;default :
@@ -10479,22 +10350,21 @@ static int set_config_on_frame_enqueue(s#endif int -ia_css_unlock_raw_frame (struct ia_css_stream *stream,uint32_t exp_id) { +ia_css_unlock_raw_frame (struct ia_css_stream *stream,uint32_t exp_id) +{int ret;IA_CSS_ENTER ("" );/* Only continuous streams have a tagger to which we can send the * unlock message. */ -if (!stream || !stream->config.continuous) - { +if (!stream || !stream->config.continuous) {IA_CSS_ERROR ("invalid stream pointer" );return -EINVAL ; }if (exp_id >IA_CSS_ISYS_MAX_EXPOSURE_ID || - exp_id <IA_CSS_ISYS_MIN_EXPOSURE_ID ) - { + exp_id <IA_CSS_ISYS_MIN_EXPOSURE_ID ) {IA_CSS_ERROR ("invalid exposure ID: %d\n" , exp_id);return -EINVAL ; }
@@ -10513,7 +10383,8 @@ ia_css_unlock_raw_frame(struct ia_css_st*/ int ia_css_pipe_set_qos_ext_state (struct ia_css_pipe *pipe,uint32_t fw_handle, -bool enable) { +bool enable) +{unsigned int thread_id;struct ia_css_pipeline_stage *stage;int err =0 ;
@@ -10521,20 +10392,16 @@ ia_css_pipe_set_qos_ext_state(struct ia_IA_CSS_ENTER ("" );/* Parameter Check */ -if (!pipe || !pipe->stream) - { +if (!pipe || !pipe->stream) {IA_CSS_ERROR ("Invalid Pipe." ); err = -EINVAL ; - }else if (!(pipe->config.acc_extension)) - { + }else if (!(pipe->config.acc_extension)) {IA_CSS_ERROR ("Invalid Pipe(No Extension Firmware)" ); err = -EINVAL ; - }else if (!sh_css_sp_is_running ()) - { + }else if (!sh_css_sp_is_running ()) {IA_CSS_ERROR ("Leaving: queue unavailable." ); err = -EBUSY ; - }else - { + }else {/* Query the threadid and stage_num for the Extension firmware*/ ia_css_pipeline_get_sp_thread_id (ia_css_pipe_get_pipe_num (pipe), &thread_id); err =ia_css_pipeline_get_stage_from_fw (&pipe->pipeline, fw_handle, &stage);
@@ -10562,7 +10429,8 @@ ia_css_pipe_set_qos_ext_state(struct ia_*/ int ia_css_pipe_get_qos_ext_state (struct ia_css_pipe *pipe,uint32_t fw_handle, -bool *enable) { +bool *enable) +{struct ia_css_pipeline_stage *stage;unsigned int thread_id;int err =0 ;
@@ -10570,20 +10438,16 @@ ia_css_pipe_get_qos_ext_state(struct ia_IA_CSS_ENTER ("" );/* Parameter Check */ -if (!pipe || !pipe->stream) - { +if (!pipe || !pipe->stream) {IA_CSS_ERROR ("Invalid Pipe." ); err = -EINVAL ; - }else if (!(pipe->config.acc_extension)) - { + }else if (!(pipe->config.acc_extension)) {IA_CSS_ERROR ("Invalid Pipe (No Extension Firmware)." ); err = -EINVAL ; - }else if (!sh_css_sp_is_running ()) - { + }else if (!sh_css_sp_is_running ()) {IA_CSS_ERROR ("Leaving: queue unavailable." ); err = -EBUSY ; - }else - { + }else {/* Query the threadid and stage_num corresponding to the Extension firmware*/ ia_css_pipeline_get_sp_thread_id (ia_css_pipe_get_pipe_num (pipe), &thread_id); err =ia_css_pipeline_get_stage_from_fw (&pipe->pipeline, fw_handle, &stage);
@@ -10603,7 +10467,8 @@ int ia_css_pipe_update_qos_ext_mapped_arg(struct ia_css_pipe *pipe, u32 fw_handle, struct ia_css_isp_param_css_segments *css_seg, - struct ia_css_isp_param_isp_segments *isp_seg) { + struct ia_css_isp_param_isp_segments *isp_seg) +{
Lines of this file are not shown. View the raw message.
The rest of this diff is not shown. View the raw message.
Part of the diff is not shown here. View the raw message.
Greg Kroah-Hartman
maintainerPATCH 605/699 media: staging: media: atomisp: Replace if else clause with a ternary
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Martiros Shakhzadyan <[email protected]>
[ Upstream commit d4bc34d18201120b247506b4a6ed17af694dfcf7 ]
Use the ternary operator for conditional variable assignment in create_host_video_pipeline().
Stable-dep-of: f4d51e55dd47 ("staging: media: atomisp: reduce load_primary_binaries() stack usage")
--- drivers/staging/media/atomisp/pci/sh_css.c | 7 ++----- 1 file changed, 2 insertions(+), 5 deletions(-)
drivers/staging/media/atomisp/pci/sh_css.c +2 -5
@@ -3623,11 +3623,8 @@ static int create_host_video_pipeline(ststruct ia_css_frame *tmp_out_frame =NULL ;for (i =0 ; i < num_yuv_scaler; i++) { -if (is_output_stage[i]) { - tmp_out_frame = out_frame; - }else { - tmp_out_frame =NULL ; - } + tmp_out_frame = is_output_stage[i] ? out_frame :NULL ; + err = add_yuv_scaler_stage(pipe, me, tmp_in_frame, tmp_out_frame, NULL, &yuv_scaler_binary[i],
Greg Kroah-Hartman
maintainerPATCH 606/699 media: staging: media: atomisp: Fix alignment and line length issues
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Martiros Shakhzadyan <[email protected]>
[ Upstream commit 7796e455170efa1823457b17a292b1c65bb8c1e0 ]
Fix alignment style issues and adjacent line length issues in sh_css.c
Stable-dep-of: f4d51e55dd47 ("staging: media: atomisp: reduce load_primary_binaries() stack usage")
--- drivers/staging/media/atomisp/pci/sh_css.c | 619 +++++++++++++++-------------- 1 file changed, 333 insertions(+), 286 deletions(-)
drivers/staging/media/atomisp/pci/sh_css.c +333 -286
@@ -242,8 +242,8 @@ ia_css_reset_defaults(struct sh_css *cssstatic void sh_css_init_host_sp_control_vars (void ); -static int set_num_primary_stages (unsigned int *num, -enum ia_css_pipe_version version); +static int +set_num_primary_stages (unsigned int *num,enum ia_css_pipe_version version);static bool need_capture_pp (const struct ia_css_pipe *pipe);
@@ -3002,9 +3002,8 @@ static int add_firmwares(ia_css_pipe_get_firmwares_stage_desc (&stage_desc, binary, out, in, vf, fw, binary_mode); - err =ia_css_pipeline_create_and_add_stage (me, - &stage_desc, - &extra_stage); + err =ia_css_pipeline_create_and_add_stage (me, &stage_desc, + &extra_stage);if (err)return err;if (fw->info.isp.sp.enable.output !=0 )
@@ -3112,9 +3111,8 @@ static int add_yuv_scaler_stage(ia_css_pipe_get_generic_stage_desc (&stage_desc, yuv_scaler_binary, out_frames, in_frame, vf_frame); } - err =ia_css_pipeline_create_and_add_stage (me, - &stage_desc, - pre_vf_pp_stage); + err =ia_css_pipeline_create_and_add_stage (me, &stage_desc, + pre_vf_pp_stage);if (err)return err; in_frame = (*pre_vf_pp_stage)->args.out_frame[0 ];
@@ -3172,9 +3170,8 @@ static int add_capture_pp_stage(ia_css_pipe_get_generic_stage_desc (&stage_desc, capture_pp_binary, out_frames,NULL , vf_frame); } - err =ia_css_pipeline_create_and_add_stage (me, - &stage_desc, - capture_pp_stage); + err =ia_css_pipeline_create_and_add_stage (me, &stage_desc, + capture_pp_stage);if (err)return err; err = add_firmwares(me, capture_pp_binary, pipe->output_stage, last_fw,
@@ -3529,9 +3526,8 @@ static int create_host_video_pipeline(stia_css_pipe_util_set_output_frames (out_frames,0 ,NULL );ia_css_pipe_get_generic_stage_desc (&stage_desc, copy_binary, out_frames,NULL ,NULL ); - err =ia_css_pipeline_create_and_add_stage (me, - &stage_desc, - ©_stage); + err =ia_css_pipeline_create_and_add_stage (me, &stage_desc, + ©_stage);if (err) goto ERR; in_frame = me->stages->args.out_frame[0 ];
@@ -3558,9 +3554,8 @@ static int create_host_video_pipeline(stia_css_pipe_get_generic_stage_desc (&stage_desc, video_binary, out_frames, in_frame, vf_frame); } - err =ia_css_pipeline_create_and_add_stage (me, - &stage_desc, - &video_stage); + err =ia_css_pipeline_create_and_add_stage (me, &stage_desc, + &video_stage);if (err) goto ERR;
@@ -3625,8 +3620,8 @@ static int create_host_video_pipeline(stfor (i =0 ; i < num_yuv_scaler; i++) { tmp_out_frame = is_output_stage[i] ? out_frame :NULL ; - err =add_yuv_scaler_stage (pipe, me, tmp_in_frame, tmp_out_frame, -NULL , + err =add_yuv_scaler_stage (pipe, me, tmp_in_frame, + tmp_out_frame,NULL , &yuv_scaler_binary[i], &yuv_scaler_stage);
@@ -3765,9 +3760,8 @@ create_host_preview_pipeline(struct ia_cia_css_pipe_util_set_output_frames (out_frames,0 ,NULL );ia_css_pipe_get_generic_stage_desc (&stage_desc, copy_binary, out_frames,NULL ,NULL ); - err =ia_css_pipeline_create_and_add_stage (me, - &stage_desc, - ©_stage); + err =ia_css_pipeline_create_and_add_stage (me, &stage_desc, + ©_stage);if (err) goto ERR; in_frame = me->stages->args.out_frame[0 ];
@@ -3793,9 +3787,8 @@ create_host_preview_pipeline(struct ia_cia_css_pipe_get_generic_stage_desc (&stage_desc, preview_binary, out_frames, in_frame,NULL ); } - err =ia_css_pipeline_create_and_add_stage (me, - &stage_desc, - &preview_stage); + err =ia_css_pipeline_create_and_add_stage (me, &stage_desc, + &preview_stage);if (err) goto ERR;/* If we use copy iso preview, the input must be yuv iso raw */
@@ -4131,8 +4124,8 @@ ia_css_pipe_enqueue_buffer(struct ia_css }hmm_store (h_vbuf->vptr, - (void *)(&ddr_buffer), -sizeof (struct sh_css_hmm_buffer )); + (void *)(&ddr_buffer), +sizeof (struct sh_css_hmm_buffer ));if ((buf_type ==IA_CSS_BUFFER_TYPE_3A_STATISTICS ) || (buf_type ==IA_CSS_BUFFER_TYPE_DIS_STATISTICS ) || (buf_type ==IA_CSS_BUFFER_TYPE_LACE_STATISTICS )) {
@@ -4293,8 +4286,8 @@ ia_css_pipe_dequeue_buffer(struct ia_css }hmm_load (ddr_buffer_addr, - &ddr_buffer, -sizeof (struct sh_css_hmm_buffer )); + &ddr_buffer, +sizeof (struct sh_css_hmm_buffer ));/* if the kernel_ptr is 0 or an invalid, return an error. * do not access the buffer via the kernal_ptr.
@@ -4949,7 +4942,7 @@ sh_css_pipes_stop(struct ia_css_stream *for (i =0 ; i < stream->num_pipes; i++) {/* send the "stop" request to the "ia_css_pipe" instance */ IA_CSS_LOG ("Send the stop-request to the pipe: pipe_id=%d" , - stream->pipes[i]->pipeline.pipe_id); + stream->pipes[i]->pipeline.pipe_id); err =ia_css_pipeline_request_stop (&stream->pipes[i]->pipeline);/*
@@ -4999,7 +4992,7 @@ sh_css_pipes_stop(struct ia_css_stream */* send the "stop" request to "Copy Pipe" */ IA_CSS_LOG ("Send the stop-request to the pipe: pipe_id=%d" , - copy_pipe->pipeline.pipe_id); + copy_pipe->pipeline.pipe_id); err =ia_css_pipeline_request_stop (©_pipe->pipeline); }
@@ -5832,7 +5825,7 @@ static bool need_capt_ldc( }static int set_num_primary_stages (unsigned int *num, -enum ia_css_pipe_version version) +enum ia_css_pipe_version version) {int err =0 ;
@@ -6032,10 +6025,13 @@ static int load_primary_binaries( capt_pp_in_info = &prim_out_info;ia_css_pipe_get_capturepp_binarydesc (pipe, - &capture_pp_descr, capt_pp_in_info, - &capt_pp_out_info, &vf_info); + &capture_pp_descr, + capt_pp_in_info, + &capt_pp_out_info, + &vf_info); + err =ia_css_binary_find (&capture_pp_descr, - &mycs->capture_pp_binary); + &mycs->capture_pp_binary);if (err) {IA_CSS_LEAVE_ERR_PRIVATE (err);return err;
@@ -6045,11 +6041,12 @@ static int load_primary_binaries(struct ia_css_binary_descr capt_ldc_descr;ia_css_pipe_get_ldc_binarydesc (pipe, - &capt_ldc_descr, &prim_out_info, - &capt_ldc_out_info); + &capt_ldc_descr, + &prim_out_info, + &capt_ldc_out_info); err =ia_css_binary_find (&capt_ldc_descr, - &mycs->capture_ldc_binary); + &mycs->capture_ldc_binary);if (err) {IA_CSS_LEAVE_ERR_PRIVATE (err);return err;
@@ -6066,8 +6063,9 @@ static int load_primary_binaries(if (pipe->enable_viewfinder[IA_CSS_PIPE_OUTPUT_STAGE_0 ] && (i == mycs->num_primary_stage -1 )) local_vf_info = &vf_info; -ia_css_pipe_get_primary_binarydesc (pipe, &prim_descr[i], &prim_in_info, - &prim_out_info, local_vf_info, i); +ia_css_pipe_get_primary_binarydesc (pipe, &prim_descr[i], + &prim_in_info, &prim_out_info, + local_vf_info, i); err =ia_css_binary_find (&prim_descr[i], &mycs->primary_binary[i]);if (err) {IA_CSS_LEAVE_ERR_PRIVATE (err);
@@ -6119,8 +6117,8 @@ static int load_primary_binaries(/* ISP Copy */ if (need_isp_copy_binary) { err =load_copy_binary (pipe, - &mycs->copy_binary, - &mycs->primary_binary[0 ]); + &mycs->copy_binary, + &mycs->primary_binary[0 ]);if (err) {IA_CSS_LEAVE_ERR_PRIVATE (err);return err;
@@ -6229,7 +6227,7 @@ static int load_advanced_binaries(assert (pipe);assert (pipe->mode ==IA_CSS_PIPE_ID_CAPTURE || - pipe->mode ==IA_CSS_PIPE_ID_COPY ); + pipe->mode ==IA_CSS_PIPE_ID_COPY );if (pipe->pipe_settings.capture.pre_isp_binary.info)return 0 ; pipe_out_info = &pipe->output_info[0 ];
@@ -6242,17 +6240,18 @@ static int load_advanced_binaries( need_pp =need_capture_pp (pipe);ia_css_frame_info_set_format (&vf_info, -IA_CSS_FRAME_FORMAT_YUV_LINE ); +IA_CSS_FRAME_FORMAT_YUV_LINE );/* we build up the pipeline starting at the end */ /* Capture post-processing */ if (need_pp) {struct ia_css_binary_descr capture_pp_descr; -ia_css_pipe_get_capturepp_binarydesc (pipe, - &capture_pp_descr, &post_out_info, pipe_out_info, &vf_info); +ia_css_pipe_get_capturepp_binarydesc (pipe, &capture_pp_descr, + &post_out_info, + pipe_out_info, &vf_info); err =ia_css_binary_find (&capture_pp_descr, - &pipe->pipe_settings.capture.capture_pp_binary); + &pipe->pipe_settings.capture.capture_pp_binary);if (err)return err; }else {
@@ -6263,10 +6262,11 @@ static int load_advanced_binaries( {struct ia_css_binary_descr post_gdc_descr; -ia_css_pipe_get_post_gdc_binarydesc (pipe, - &post_gdc_descr, &post_in_info, &post_out_info, &vf_info); +ia_css_pipe_get_post_gdc_binarydesc (pipe, &post_gdc_descr, + &post_in_info, + &post_out_info, &vf_info); err =ia_css_binary_find (&post_gdc_descr, - &pipe->pipe_settings.capture.post_isp_binary); + &pipe->pipe_settings.capture.post_isp_binary);if (err)return err; }
@@ -6276,9 +6276,9 @@ static int load_advanced_binaries(struct ia_css_binary_descr gdc_descr;ia_css_pipe_get_gdc_binarydesc (pipe, &gdc_descr, &gdc_in_info, - &pipe->pipe_settings.capture.post_isp_binary.in_frame_info); + &pipe->pipe_settings.capture.post_isp_binary.in_frame_info); err =ia_css_binary_find (&gdc_descr, - &pipe->pipe_settings.capture.anr_gdc_binary); + &pipe->pipe_settings.capture.anr_gdc_binary);if (err)return err; }
@@ -6290,9 +6290,9 @@ static int load_advanced_binaries(struct ia_css_binary_descr pre_gdc_descr;ia_css_pipe_get_pre_gdc_binarydesc (pipe, &pre_gdc_descr, &pre_in_info, - &pipe->pipe_settings.capture.anr_gdc_binary.in_frame_info); + &pipe->pipe_settings.capture.anr_gdc_binary.in_frame_info); err =ia_css_binary_find (&pre_gdc_descr, - &pipe->pipe_settings.capture.pre_isp_binary); + &pipe->pipe_settings.capture.pre_isp_binary);if (err)return err; }
@@ -6314,7 +6314,7 @@ static int load_advanced_binaries(ia_css_pipe_get_vfpp_binarydesc (pipe, &vf_pp_descr, vf_pp_in_info, pipe_vf_out_info); err =ia_css_binary_find (&vf_pp_descr, - &pipe->pipe_settings.capture.vf_pp_binary); + &pipe->pipe_settings.capture.vf_pp_binary);if (err)return err; }
@@ -6326,8 +6326,8 @@ static int load_advanced_binaries(#endif if (need_isp_copy)load_copy_binary (pipe, - &pipe->pipe_settings.capture.copy_binary, - &pipe->pipe_settings.capture.pre_isp_binary); + &pipe->pipe_settings.capture.copy_binary, + &pipe->pipe_settings.capture.pre_isp_binary);return err; }
@@ -6342,7 +6342,7 @@ static int load_bayer_isp_binaries(IA_CSS_ENTER_PRIVATE ("" );assert (pipe);assert (pipe->mode ==IA_CSS_PIPE_ID_CAPTURE || - pipe->mode ==IA_CSS_PIPE_ID_COPY ); + pipe->mode ==IA_CSS_PIPE_ID_COPY ); pipe_out_info = &pipe->output_info[0 ];if (pipe->pipe_settings.capture.pre_isp_binary.info)
@@ -6353,11 +6353,11 @@ static int load_bayer_isp_binaries(return err;ia_css_pipe_get_pre_de_binarydesc (pipe, &pre_de_descr, - &pre_isp_in_info, - pipe_out_info); + &pre_isp_in_info, + pipe_out_info); err =ia_css_binary_find (&pre_de_descr, - &pipe->pipe_settings.capture.pre_isp_binary); + &pipe->pipe_settings.capture.pre_isp_binary);return err; }
@@ -6376,7 +6376,7 @@ static int load_low_light_binaries(IA_CSS_ENTER_PRIVATE ("" );assert (pipe);assert (pipe->mode ==IA_CSS_PIPE_ID_CAPTURE || - pipe->mode ==IA_CSS_PIPE_ID_COPY ); + pipe->mode ==IA_CSS_PIPE_ID_COPY );if (pipe->pipe_settings.capture.pre_isp_binary.info)return 0 ;
@@ -6391,17 +6391,18 @@ static int load_low_light_binaries( need_pp =need_capture_pp (pipe);ia_css_frame_info_set_format (&vf_info, -IA_CSS_FRAME_FORMAT_YUV_LINE ); +IA_CSS_FRAME_FORMAT_YUV_LINE );/* we build up the pipeline starting at the end */ /* Capture post-processing */ if (need_pp) {struct ia_css_binary_descr capture_pp_descr; -ia_css_pipe_get_capturepp_binarydesc (pipe, - &capture_pp_descr, &post_out_info, pipe_out_info, &vf_info); +ia_css_pipe_get_capturepp_binarydesc (pipe, &capture_pp_descr, + &post_out_info, + pipe_out_info, &vf_info); err =ia_css_binary_find (&capture_pp_descr, - &pipe->pipe_settings.capture.capture_pp_binary); + &pipe->pipe_settings.capture.capture_pp_binary);if (err)return err; }else {
@@ -6415,7 +6416,7 @@ static int load_low_light_binaries(ia_css_pipe_get_post_anr_binarydesc (pipe, &post_anr_descr, &post_in_info, &post_out_info, &vf_info); err =ia_css_binary_find (&post_anr_descr, - &pipe->pipe_settings.capture.post_isp_binary); + &pipe->pipe_settings.capture.post_isp_binary);if (err)return err; }
@@ -6425,9 +6426,9 @@ static int load_low_light_binaries(struct ia_css_binary_descr anr_descr;ia_css_pipe_get_anr_binarydesc (pipe, &anr_descr, &anr_in_info, - &pipe->pipe_settings.capture.post_isp_binary.in_frame_info); + &pipe->pipe_settings.capture.post_isp_binary.in_frame_info); err =ia_css_binary_find (&anr_descr, - &pipe->pipe_settings.capture.anr_gdc_binary); + &pipe->pipe_settings.capture.anr_gdc_binary);if (err)return err; }
@@ -6439,9 +6440,9 @@ static int load_low_light_binaries(struct ia_css_binary_descr pre_anr_descr;ia_css_pipe_get_pre_anr_binarydesc (pipe, &pre_anr_descr, &pre_in_info, - &pipe->pipe_settings.capture.anr_gdc_binary.in_frame_info); + &pipe->pipe_settings.capture.anr_gdc_binary.in_frame_info); err =ia_css_binary_find (&pre_anr_descr, - &pipe->pipe_settings.capture.pre_isp_binary); + &pipe->pipe_settings.capture.pre_isp_binary);if (err)return err; }
@@ -6460,10 +6461,10 @@ static int load_low_light_binaries( {struct ia_css_binary_descr vf_pp_descr; -ia_css_pipe_get_vfpp_binarydesc (pipe, - &vf_pp_descr, vf_pp_in_info, pipe_vf_out_info); +ia_css_pipe_get_vfpp_binarydesc (pipe, &vf_pp_descr, + vf_pp_in_info, pipe_vf_out_info); err =ia_css_binary_find (&vf_pp_descr, - &pipe->pipe_settings.capture.vf_pp_binary); + &pipe->pipe_settings.capture.vf_pp_binary);if (err)return err; }
@@ -6475,8 +6476,8 @@ static int load_low_light_binaries(#endif if (need_isp_copy) err =load_copy_binary (pipe, - &pipe->pipe_settings.capture.copy_binary, - &pipe->pipe_settings.capture.pre_isp_binary); + &pipe->pipe_settings.capture.copy_binary, + &pipe->pipe_settings.capture.pre_isp_binary);return err; }
@@ -6510,7 +6511,7 @@ static int load_capture_binaries(IA_CSS_ENTER_PRIVATE ("" );assert (pipe);assert (pipe->mode ==IA_CSS_PIPE_ID_CAPTURE || - pipe->mode ==IA_CSS_PIPE_ID_COPY ); + pipe->mode ==IA_CSS_PIPE_ID_COPY );if (pipe->pipe_settings.capture.primary_binary[0 ].info) {IA_CSS_LEAVE_ERR_PRIVATE (0 );
@@ -6605,7 +6606,7 @@ unload_capture_binaries(struct ia_css_pistatic bool need_downscaling (const struct ia_css_resolution in_res, -const struct ia_css_resolution out_res) +const struct ia_css_resolution out_res) {if (in_res.width > out_res.width || in_res.height > out_res.height)return true;
@@ -6676,9 +6677,9 @@ static int ia_css_pipe_create_cas_scaler descr->num_output_stage =1 ; hor_ds_factor =CEIL_DIV (cas_scaler_in_info->res.width, - cas_scaler_out_info->res.width); + cas_scaler_out_info->res.width); ver_ds_factor =CEIL_DIV (cas_scaler_in_info->res.height, - cas_scaler_out_info->res.height); + cas_scaler_out_info->res.height);/* use the same horizontal and vertical downscaling factor for simplicity */ assert (hor_ds_factor == ver_ds_factor);
@@ -6688,31 +6689,36 @@ static int ia_css_pipe_create_cas_scaler i *= max_scale_factor_per_stage; } - descr->in_info =kmalloc (descr->num_stage *sizeof (struct ia_css_frame_info ), -GFP_KERNEL ); + descr->in_info =kmalloc (descr->num_stage * +sizeof (struct ia_css_frame_info ), +GFP_KERNEL );if (!descr->in_info) { err = -ENOMEM ; goto ERR; } - descr->internal_out_info =kmalloc (descr->num_stage *sizeof ( -struct ia_css_frame_info ),GFP_KERNEL ); + descr->internal_out_info =kmalloc (descr->num_stage * +sizeof (struct ia_css_frame_info ), +GFP_KERNEL );if (!descr->internal_out_info) { err = -ENOMEM ; goto ERR; } - descr->out_info =kmalloc (descr->num_stage *sizeof (struct ia_css_frame_info ), -GFP_KERNEL ); + descr->out_info =kmalloc (descr->num_stage * +sizeof (struct ia_css_frame_info ), +GFP_KERNEL );if (!descr->out_info) { err = -ENOMEM ; goto ERR; } - descr->vf_info =kmalloc (descr->num_stage *sizeof (struct ia_css_frame_info ), -GFP_KERNEL ); + descr->vf_info =kmalloc (descr->num_stage * +sizeof (struct ia_css_frame_info ), +GFP_KERNEL );if (!descr->vf_info) { err = -ENOMEM ; goto ERR; } - descr->is_output_stage =kmalloc (descr->num_stage *sizeof (bool ),GFP_KERNEL ); + descr->is_output_stage =kmalloc (descr->num_stage *sizeof (bool ), +GFP_KERNEL );if (!descr->is_output_stage) { err = -ENOMEM ; goto ERR;
@@ -6756,9 +6762,9 @@ static int ia_css_pipe_create_cas_scaler max_scale_factor_per_stage; descr->internal_out_info[i].format =IA_CSS_FRAME_FORMAT_YUV420 ;ia_css_frame_info_init (&descr->internal_out_info[i], - tmp_in_info.res.width / max_scale_factor_per_stage, - tmp_in_info.res.height / max_scale_factor_per_stage, -IA_CSS_FRAME_FORMAT_YUV420 ,0 ); + tmp_in_info.res.width / max_scale_factor_per_stage, + tmp_in_info.res.height / max_scale_factor_per_stage, +IA_CSS_FRAME_FORMAT_YUV420 ,0 ); descr->out_info[i].res.width =0 ; descr->out_info[i].res.height =0 ; descr->vf_info[i].res.width =0 ;
@@ -6834,30 +6840,35 @@ static int ia_css_pipe_create_cas_scaler descr->num_stage = num_stages; descr->in_info =kmalloc_array (descr->num_stage, -sizeof (struct ia_css_frame_info ),GFP_KERNEL ); +sizeof (struct ia_css_frame_info ), +GFP_KERNEL );if (!descr->in_info) { err = -ENOMEM ; goto ERR; } - descr->internal_out_info =kmalloc (descr->num_stage *sizeof ( -struct ia_css_frame_info ),GFP_KERNEL ); + descr->internal_out_info =kmalloc (descr->num_stage * +sizeof (struct ia_css_frame_info ), +GFP_KERNEL );if (!descr->internal_out_info) { err = -ENOMEM ; goto ERR; } - descr->out_info =kmalloc (descr->num_stage *sizeof (struct ia_css_frame_info ), -GFP_KERNEL ); + descr->out_info =kmalloc (descr->num_stage * +sizeof (struct ia_css_frame_info ), +GFP_KERNEL );if (!descr->out_info) { err = -ENOMEM ; goto ERR; } - descr->vf_info =kmalloc (descr->num_stage *sizeof (struct ia_css_frame_info ), -GFP_KERNEL ); + descr->vf_info =kmalloc (descr->num_stage * +sizeof (struct ia_css_frame_info ), +GFP_KERNEL );if (!descr->vf_info) { err = -ENOMEM ; goto ERR; } - descr->is_output_stage =kmalloc (descr->num_stage *sizeof (bool ),GFP_KERNEL ); + descr->is_output_stage =kmalloc (descr->num_stage *sizeof (bool ), +GFP_KERNEL );if (!descr->is_output_stage) { err = -ENOMEM ; goto ERR;
@@ -6867,7 +6878,7 @@ static int ia_css_pipe_create_cas_scalerif (out_info[i]) {if (i >0 ) {assert ((out_info[i -1 ]->res.width >= out_info[i]->res.width) && - (out_info[i -1 ]->res.height >= out_info[i]->res.height)); + (out_info[i -1 ]->res.height >= out_info[i]->res.height)); } } }
@@ -6915,9 +6926,9 @@ static int ia_css_pipe_create_cas_scaler max_scale_factor_per_stage; descr->internal_out_info[i].format =IA_CSS_FRAME_FORMAT_YUV420 ;ia_css_frame_info_init (&descr->internal_out_info[i], - tmp_in_info.res.width / max_scale_factor_per_stage, - tmp_in_info.res.height / max_scale_factor_per_stage, -IA_CSS_FRAME_FORMAT_YUV420 ,0 ); + tmp_in_info.res.width / max_scale_factor_per_stage, + tmp_in_info.res.height / max_scale_factor_per_stage, +IA_CSS_FRAME_FORMAT_YUV420 ,0 ); descr->out_info[i].res.width =0 ; descr->out_info[i].res.height =0 ; descr->vf_info[i].res.width =0 ;
@@ -6996,13 +7007,14 @@ load_yuvpp_binaries(struct ia_css_pipe *struct ia_css_binary_descr yuv_scaler_descr; err =ia_css_pipe_create_cas_scaler_desc (pipe, - &cas_scaler_descr); + &cas_scaler_descr);if (err) goto ERR; mycs->num_output = cas_scaler_descr.num_output_stage; mycs->num_yuv_scaler = cas_scaler_descr.num_stage; mycs->yuv_scaler_binary =kzalloc (cas_scaler_descr.num_stage * -sizeof (struct ia_css_binary ),GFP_KERNEL ); +sizeof (struct ia_css_binary ), +GFP_KERNEL );if (!mycs->yuv_scaler_binary) { err = -ENOMEM ; goto ERR;
@@ -7016,12 +7028,13 @@ load_yuvpp_binaries(struct ia_css_pipe *for (i =0 ; i < cas_scaler_descr.num_stage; i++) { mycs->is_output_stage[i] = cas_scaler_descr.is_output_stage[i];ia_css_pipe_get_yuvscaler_binarydesc (pipe, - &yuv_scaler_descr, &cas_scaler_descr.in_info[i], - &cas_scaler_descr.out_info[i], - &cas_scaler_descr.internal_out_info[i], - &cas_scaler_descr.vf_info[i]); + &yuv_scaler_descr, + &cas_scaler_descr.in_info[i], + &cas_scaler_descr.out_info[i], + &cas_scaler_descr.internal_out_info[i], + &cas_scaler_descr.vf_info[i]); err =ia_css_binary_find (&yuv_scaler_descr, - &mycs->yuv_scaler_binary[i]); + &mycs->yuv_scaler_binary[i]);if (err) goto ERR; }
@@ -7061,8 +7074,8 @@ load_yuvpp_binaries(struct ia_css_pipe *if (need_isp_copy_binary) { err =load_copy_binary (pipe, - &mycs->copy_binary, - next_binary); + &mycs->copy_binary, + next_binary);if (err) goto ERR;
@@ -7107,8 +7120,9 @@ load_yuvpp_binaries(struct ia_css_pipe * mycs->num_vf_pp =1 ; } - mycs->vf_pp_binary =kzalloc (mycs->num_vf_pp *sizeof (struct ia_css_binary ), -GFP_KERNEL ); + mycs->vf_pp_binary =kzalloc (mycs->num_vf_pp * +sizeof (struct ia_css_binary ), +GFP_KERNEL );if (!mycs->vf_pp_binary) { err = -ENOMEM ; goto ERR;
@@ -7437,18 +7451,26 @@ create_host_yuvpp_pipeline(struct ia_css#endif if (need_scaler) { -ia_css_pipe_util_set_output_frames (bin_out_frame,0 ,NULL ); -ia_css_pipe_get_generic_stage_desc (&stage_desc, copy_binary, - bin_out_frame, in_frame_local,NULL ); +ia_css_pipe_util_set_output_frames (bin_out_frame, +0 ,NULL ); +ia_css_pipe_get_generic_stage_desc (&stage_desc, + copy_binary, + bin_out_frame, + in_frame_local, +NULL ); }else { -ia_css_pipe_util_set_output_frames (bin_out_frame,0 , out_frame[0 ]); -ia_css_pipe_get_generic_stage_desc (&stage_desc, copy_binary, - bin_out_frame, in_frame_local,NULL ); +ia_css_pipe_util_set_output_frames (bin_out_frame, +0 , out_frame[0 ]); +ia_css_pipe_get_generic_stage_desc (&stage_desc, + copy_binary, + bin_out_frame, + in_frame_local, +NULL ); } err =ia_css_pipeline_create_and_add_stage (me, - &stage_desc, - ©_stage); + &stage_desc, + ©_stage);if (err) {IA_CSS_LEAVE_ERR_PRIVATE (err);
@@ -7480,10 +7502,11 @@ create_host_yuvpp_pipeline(struct ia_css tmp_vf_frame =NULL ; } - err =add_yuv_scaler_stage (pipe, me, tmp_in_frame, tmp_out_frame, -NULL , - &yuv_scaler_binary[i], - &yuv_scaler_stage); + err =add_yuv_scaler_stage (pipe, me, tmp_in_frame, + tmp_out_frame, +NULL , + &yuv_scaler_binary[i], + &yuv_scaler_stage);if (err) {IA_CSS_LEAVE_ERR_PRIVATE (err);
@@ -7494,8 +7517,10 @@ create_host_yuvpp_pipeline(struct ia_cssif (pipe->pipe_settings.yuvpp.is_output_stage[i]) {if (tmp_vf_frame && (tmp_vf_frame->info.res.width !=0 )) { in_frame = yuv_scaler_stage->args.out_vf_frame; - err =add_vf_pp_stage (pipe, in_frame, tmp_vf_frame, &vf_pp_binary[j], - &vf_pp_stage); + err =add_vf_pp_stage (pipe, in_frame, + tmp_vf_frame, + &vf_pp_binary[j], + &vf_pp_stage);if (err) {IA_CSS_LEAVE_ERR_PRIVATE (err);
@@ -7508,8 +7533,8 @@ create_host_yuvpp_pipeline(struct ia_css }else if (copy_stage) {if (vf_frame[0 ] && vf_frame[0 ]->info.res.width !=0 ) { in_frame = copy_stage->args.out_vf_frame; - err =add_vf_pp_stage (pipe, in_frame, vf_frame[0 ], &vf_pp_binary[0 ], - &vf_pp_stage); + err =add_vf_pp_stage (pipe, in_frame, vf_frame[0 ], + &vf_pp_binary[0 ], &vf_pp_stage); }if (err) {IA_CSS_LEAVE_ERR_PRIVATE (err);
@@ -7517,7 +7542,8 @@ create_host_yuvpp_pipeline(struct ia_css } } -ia_css_pipeline_finalize_stages (&pipe->pipeline, pipe->stream->config.continuous); +ia_css_pipeline_finalize_stages (&pipe->pipeline, + pipe->stream->config.continuous);IA_CSS_LEAVE_ERR_PRIVATE (0 );
@@ -7526,8 +7552,8 @@ create_host_yuvpp_pipeline(struct ia_cssstatic int create_host_copy_pipeline (struct ia_css_pipe *pipe, -unsigned int max_input_width, -struct ia_css_frame *out_frame) +unsigned int max_input_width, +struct ia_css_frame *out_frame) {struct ia_css_pipeline *me;int err =0 ;
@@ -7546,12 +7572,8 @@ create_host_copy_pipeline(struct ia_css_if (copy_on_sp (pipe) && pipe->stream->config.input_config.format ==ATOMISP_INPUT_FORMAT_BINARY_8 ) { -ia_css_frame_info_init ( - &out_frame->info, -JPEG_BYTES , -1 , -IA_CSS_FRAME_FORMAT_BINARY_8 , -0 ); +ia_css_frame_info_init (&out_frame->info,JPEG_BYTES ,1 , +IA_CSS_FRAME_FORMAT_BINARY_8 ,0 ); }else if (out_frame->info.format ==IA_CSS_FRAME_FORMAT_RAW ) { out_frame->info.raw_bit_depth =ia_css_pipe_util_pipe_input_format_bpp (pipe);
@@ -7562,12 +7584,12 @@ create_host_copy_pipeline(struct ia_css_ pipe->mode =IA_CSS_PIPE_ID_COPY ;ia_css_pipe_get_sp_func_stage_desc (&stage_desc, out_frame, -IA_CSS_PIPELINE_RAW_COPY , max_input_width); - err =ia_css_pipeline_create_and_add_stage (me, - &stage_desc, -NULL ); +IA_CSS_PIPELINE_RAW_COPY , + max_input_width); + err =ia_css_pipeline_create_and_add_stage (me, &stage_desc,NULL ); -ia_css_pipeline_finalize_stages (&pipe->pipeline, pipe->stream->config.continuous); +ia_css_pipeline_finalize_stages (&pipe->pipeline, + pipe->stream->config.continuous);ia_css_debug_dtrace (IA_CSS_DEBUG_TRACE_PRIVATE ,"create_host_copy_pipeline() leave:\n" );
@@ -7606,9 +7628,10 @@ create_host_isyscopy_capture_pipeline(st me->pipe_id =IA_CSS_PIPE_ID_CAPTURE ; pipe->mode =IA_CSS_PIPE_ID_CAPTURE ;ia_css_pipe_get_sp_func_stage_desc (&stage_desc, out_frame, -IA_CSS_PIPELINE_ISYS_COPY , max_input_width); +IA_CSS_PIPELINE_ISYS_COPY , + max_input_width); err =ia_css_pipeline_create_and_add_stage (me, - &stage_desc, &out_stage); + &stage_desc, &out_stage);if (err)return err;
@@ -7660,7 +7683,8 @@ create_host_regular_capture_pipeline(strIA_CSS_ENTER_PRIVATE ("" );assert (pipe);assert (pipe->stream); -assert (pipe->mode ==IA_CSS_PIPE_ID_CAPTURE || pipe->mode ==IA_CSS_PIPE_ID_COPY ); +assert (pipe->mode ==IA_CSS_PIPE_ID_CAPTURE || + pipe->mode ==IA_CSS_PIPE_ID_COPY ); me = &pipe->pipeline; mode = pipe->config.default_capture_config.mode;
@@ -7750,26 +7774,37 @@ create_host_regular_capture_pipeline(stria_css_pipe_util_set_output_frames (out_frames,0 , out_frame);#if defined(ISP2401 )if (!continuous) { -ia_css_pipe_get_generic_stage_desc (&stage_desc, copy_binary, - out_frames, in_frame,NULL ); +ia_css_pipe_get_generic_stage_desc (&stage_desc, + copy_binary, + out_frames, + in_frame, +NULL ); }else { in_frame = pipe->stream->last_pipe->continuous_frames[0 ]; -ia_css_pipe_get_generic_stage_desc (&stage_desc, copy_binary, - out_frames, in_frame,NULL ); +ia_css_pipe_get_generic_stage_desc (&stage_desc, + copy_binary, + out_frames, + in_frame, +NULL ); }#else -ia_css_pipe_get_generic_stage_desc (&stage_desc, copy_binary, - out_frames,NULL ,NULL ); +ia_css_pipe_get_generic_stage_desc (&stage_desc, + copy_binary, + out_frames, +NULL ,NULL );#endif }else { -ia_css_pipe_util_set_output_frames (out_frames,0 , in_frame); -ia_css_pipe_get_generic_stage_desc (&stage_desc, copy_binary, - out_frames,NULL ,NULL ); +ia_css_pipe_util_set_output_frames (out_frames,0 , + in_frame); +ia_css_pipe_get_generic_stage_desc (&stage_desc, + copy_binary, + out_frames, +NULL ,NULL ); } err =ia_css_pipeline_create_and_add_stage (me, - &stage_desc, - ¤t_stage); + &stage_desc, + ¤t_stage);if (err) {IA_CSS_LEAVE_ERR_PRIVATE (err);return err;
@@ -7806,11 +7841,14 @@ create_host_regular_capture_pipeline(str* Proper investigation should be done to come up with the clean * solution. * */ -ia_css_pipe_get_generic_stage_desc (&stage_desc, primary_binary[i], - out_frames, local_in_frame,NULL ); +ia_css_pipe_get_generic_stage_desc (&stage_desc, + primary_binary[i], + out_frames, + local_in_frame, +NULL ); err =ia_css_pipeline_create_and_add_stage (me, - &stage_desc, - ¤t_stage); + &stage_desc, + ¤t_stage);if (err) {IA_CSS_LEAVE_ERR_PRIVATE (err);return err;
@@ -7826,18 +7864,18 @@ create_host_regular_capture_pipeline(str mode == IA_CSS_CAPTURE_MODE_LOW_LIGHT) {ia_css_pipe_util_set_output_frames (out_frames,0 ,NULL );ia_css_pipe_get_generic_stage_desc (&stage_desc, pre_isp_binary, - out_frames, in_frame,NULL ); - err =ia_css_pipeline_create_and_add_stage (me, - &stage_desc,NULL ); + out_frames, in_frame,NULL ); + err =ia_css_pipeline_create_and_add_stage (me, &stage_desc, +NULL );if (err) {IA_CSS_LEAVE_ERR_PRIVATE (err);return err; }ia_css_pipe_util_set_output_frames (out_frames,0 ,NULL );ia_css_pipe_get_generic_stage_desc (&stage_desc, anr_gdc_binary, - out_frames,NULL ,NULL ); - err =ia_css_pipeline_create_and_add_stage (me, - &stage_desc,NULL ); + out_frames,NULL ,NULL ); + err =ia_css_pipeline_create_and_add_stage (me, &stage_desc, +NULL );if (err) {IA_CSS_LEAVE_ERR_PRIVATE (err);return err;
@@ -7845,16 +7883,21 @@ create_host_regular_capture_pipeline(strif (need_pp) {ia_css_pipe_util_set_output_frames (out_frames,0 ,NULL ); -ia_css_pipe_get_generic_stage_desc (&stage_desc, post_isp_binary, - out_frames,NULL ,NULL ); +ia_css_pipe_get_generic_stage_desc (&stage_desc, + post_isp_binary, + out_frames, +NULL ,NULL ); }else { -ia_css_pipe_util_set_output_frames (out_frames,0 , out_frame); -ia_css_pipe_get_generic_stage_desc (&stage_desc, post_isp_binary, - out_frames,NULL ,NULL ); +ia_css_pipe_util_set_output_frames (out_frames,0 , + out_frame); +ia_css_pipe_get_generic_stage_desc (&stage_desc, + post_isp_binary, + out_frames, +NULL ,NULL ); } - err =ia_css_pipeline_create_and_add_stage (me, - &stage_desc, ¤t_stage); + err =ia_css_pipeline_create_and_add_stage (me, &stage_desc, + ¤t_stage);if (err) {IA_CSS_LEAVE_ERR_PRIVATE (err);return err;
@@ -7862,10 +7905,9 @@ create_host_regular_capture_pipeline(str }else if (mode ==IA_CSS_CAPTURE_MODE_BAYER ) {ia_css_pipe_util_set_output_frames (out_frames,0 , out_frame);ia_css_pipe_get_generic_stage_desc (&stage_desc, pre_isp_binary, - out_frames, in_frame,NULL ); - err =ia_css_pipeline_create_and_add_stage (me, - &stage_desc, -NULL ); + out_frames, in_frame,NULL ); + err =ia_css_pipeline_create_and_add_stage (me, &stage_desc, +NULL );if (err) {IA_CSS_LEAVE_ERR_PRIVATE (err);return err;
@@ -7880,31 +7922,34 @@ create_host_regular_capture_pipeline(strif (need_ldc) {ia_css_pipe_util_set_output_frames (out_frames,0 ,NULL ); -ia_css_pipe_get_generic_stage_desc (&stage_desc, capture_ldc_binary, - out_frames, local_in_frame,NULL ); +ia_css_pipe_get_generic_stage_desc (&stage_desc, + capture_ldc_binary, + out_frames, + local_in_frame, +NULL ); err =ia_css_pipeline_create_and_add_stage (me, - &stage_desc, - ¤t_stage); + &stage_desc, + ¤t_stage); local_in_frame = current_stage->args.out_frame[0 ]; } err =add_capture_pp_stage (pipe, me, local_in_frame, - need_yuv_pp ?NULL : out_frame, + need_yuv_pp ?NULL : out_frame, #else /* ldc and capture_pp not supported in same pipeline */ if (need_ldc && current_stage) { in_frame = current_stage->args.out_frame[0 ];ia_css_pipe_util_set_output_frames (out_frames,0 , out_frame);ia_css_pipe_get_generic_stage_desc (&stage_desc, capture_ldc_binary, - out_frames, in_frame,NULL ); - err =ia_css_pipeline_create_and_add_stage (me, - &stage_desc, -NULL ); + out_frames, in_frame,NULL ); + err =ia_css_pipeline_create_and_add_stage (me, &stage_desc, +NULL ); } else if (need_pp && current_stage) { in_frame = current_stage->args.out_frame[0 ]; - err =add_capture_pp_stage (pipe, me, in_frame, need_yuv_pp ?NULL : out_frame, + err =add_capture_pp_stage (pipe, me, in_frame, + need_yuv_pp ?NULL : out_frame, #endif - capture_pp_binary, - ¤t_stage); + capture_pp_binary, + ¤t_stage);if (err) {IA_CSS_LEAVE_ERR_PRIVATE (err);return err;
@@ -7921,10 +7966,10 @@ create_host_regular_capture_pipeline(strelse tmp_out_frame =NULL ; - err =add_yuv_scaler_stage (pipe, me, tmp_in_frame, tmp_out_frame, -NULL , - &yuv_scaler_binary[i], - &yuv_scaler_stage); + err =add_yuv_scaler_stage (pipe, me, tmp_in_frame, + tmp_out_frame,NULL , + &yuv_scaler_binary[i], + &yuv_scaler_stage);if (err) {IA_CSS_LEAVE_ERR_PRIVATE (err);return err;
@@ -7946,7 +7991,7 @@ create_host_regular_capture_pipeline(strif (mode !=IA_CSS_CAPTURE_MODE_RAW && mode !=IA_CSS_CAPTURE_MODE_BAYER && current_stage && vf_frame) { in_frame = current_stage->args.out_vf_frame; err =add_vf_pp_stage (pipe, in_frame, vf_frame, vf_pp_binary, - ¤t_stage); + ¤t_stage);if (err) {IA_CSS_LEAVE_ERR_PRIVATE (err);return err;
@@ -7998,7 +8043,7 @@ static int capture_start( me = &pipe->pipeline;if ((pipe->config.default_capture_config.mode ==IA_CSS_CAPTURE_MODE_RAW || - pipe->config.default_capture_config.mode ==IA_CSS_CAPTURE_MODE_BAYER ) && + pipe->config.default_capture_config.mode ==IA_CSS_CAPTURE_MODE_BAYER ) && (pipe->config.mode !=IA_CSS_PIPE_MODE_COPY )) {if (copy_on_sp (pipe)) { err =start_copy_on_sp (pipe, &me->out_frame[0 ]);
@@ -8042,7 +8087,7 @@ static int capture_start(if (pipe->config.mode ==IA_CSS_PIPE_MODE_COPY && pipe->stream->reconfigure_css_rx) {ia_css_isys_rx_configure (&pipe->stream->csi_rx_config, - pipe->stream->config.mode); + pipe->stream->config.mode); pipe->stream->reconfigure_css_rx = false; }#endif
@@ -8053,8 +8098,8 @@ static int capture_start(static int sh_css_pipe_get_output_frame_info (struct ia_css_pipe *pipe, -struct ia_css_frame_info *info, -unsigned int idx) +struct ia_css_frame_info *info, +unsigned int idx) {assert (pipe);assert (info);
@@ -8072,7 +8117,7 @@ sh_css_pipe_get_output_frame_info(structIA_CSS_FRAME_FORMAT_BINARY_8 , 0); }else if (info->format ==IA_CSS_FRAME_FORMAT_RAW || - info->format ==IA_CSS_FRAME_FORMAT_RAW_PACKED ) { + info->format ==IA_CSS_FRAME_FORMAT_RAW_PACKED ) { info->raw_bit_depth =ia_css_pipe_util_pipe_input_format_bpp (pipe); }
@@ -8084,9 +8129,9 @@ sh_css_pipe_get_output_frame_info(structvoid ia_css_stream_send_input_frame (const struct ia_css_stream *stream, -const unsigned short *data, -unsigned int width, -unsigned int height) +const unsigned short *data, +unsigned int width, +unsigned int height) {assert (stream);
@@ -8110,22 +8155,22 @@ ia_css_stream_start_input_frame(const stvoid ia_css_stream_send_input_line (const struct ia_css_stream *stream, -const unsigned short *data, -unsigned int width, -const unsigned short *data2, -unsigned int width2) +const unsigned short *data, +unsigned int width, +const unsigned short *data2, +unsigned int width2) {assert (stream);ia_css_inputfifo_send_line (stream->config.channel_id, - data, width, data2, width2); + data, width, data2, width2); }void ia_css_stream_send_input_embedded_line (const struct ia_css_stream *stream, -enum atomisp_input_format format, -const unsigned short *data, -unsigned int width) +enum atomisp_input_format format, +const unsigned short *data, +unsigned int width) {assert (stream);if (!data || width ==0 )
@@ -8246,7 +8291,7 @@ acc_unload_extension(struct ia_css_fw_in/* Load firmware for extension */ static int ia_css_pipe_load_extension (struct ia_css_pipe *pipe, -struct ia_css_fw_info *firmware) +struct ia_css_fw_info *firmware) {int err =0 ;
@@ -8270,7 +8315,7 @@ ia_css_pipe_load_extension(struct ia_css/* Unload firmware for extension */ static void ia_css_pipe_unload_extension (struct ia_css_pipe *pipe, -struct ia_css_fw_info *firmware) +struct ia_css_fw_info *firmware) {IA_CSS_ENTER_PRIVATE ("fw = %p pipe = %p" , firmware, pipe);
@@ -8312,7 +8357,7 @@ ia_css_pipeline_uses_params(struct ia_csstatic int sh_css_pipeline_add_acc_stage (struct ia_css_pipeline *pipeline, -const void *acc_fw) +const void *acc_fw) {struct ia_css_fw_info *fw = (struct ia_css_fw_info *)acc_fw;/* In QoS case, load_extension already called, so skipping */
@@ -8330,8 +8375,8 @@ sh_css_pipeline_add_acc_stage(struct ia_ia_css_pipe_get_acc_stage_desc (&stage_desc,NULL , fw); err =ia_css_pipeline_create_and_add_stage (pipeline, - &stage_desc, -NULL ); + &stage_desc, +NULL ); } ia_css_debug_dtrace(IA_CSS_DEBUG_TRACE,
@@ -8344,7 +8389,7 @@ sh_css_pipeline_add_acc_stage(struct ia_* Refer to "sh_css_internal.h" for details. */ int ia_css_stream_capture_frame (struct ia_css_stream *stream, -unsigned int exp_id) +unsigned int exp_id) {struct sh_css_tag_descr tag_descr;u32 encoded_tag_descr;
@@ -8503,22 +8548,22 @@ sh_css_init_host_sp_control_vars(void) (void )HIVE_ADDR_host_sp_com;sp_dmem_store_uint32 (SP0_ID , - (unsigned int )sp_address_of (ia_css_ispctrl_sp_isp_started), - (uint32_t )(0 )); + (unsigned int )sp_address_of (ia_css_ispctrl_sp_isp_started), + (uint32_t )(0 ));sp_dmem_store_uint32 (SP0_ID , - (unsigned int )sp_address_of (host_sp_queues_initialized), - (uint32_t )(0 )); + (unsigned int )sp_address_of (host_sp_queues_initialized), + (uint32_t )(0 ));sp_dmem_store_uint32 (SP0_ID , - (unsigned int )sp_address_of (sp_sleep_mode), - (uint32_t )(0 )); + (unsigned int )sp_address_of (sp_sleep_mode), + (uint32_t )(0 ));sp_dmem_store_uint32 (SP0_ID , - (unsigned int )sp_address_of (ia_css_dmaproxy_sp_invalidate_tlb), - (uint32_t )(false)); + (unsigned int )sp_address_of (ia_css_dmaproxy_sp_invalidate_tlb), + (uint32_t )(false));#ifndef ISP2401 sp_dmem_store_uint32 (SP0_ID , - (unsigned int )sp_address_of (sp_stop_copy_preview), - my_css.stop_copy_preview ? (uint32_t )(1 ) : (uint32_t )(0 )); + (unsigned int )sp_address_of (sp_stop_copy_preview), + my_css.stop_copy_preview ? (uint32_t )(1 ) : (uint32_t )(0 ));#endif store_sp_array_uint (host_sp_com, o, host2sp_cmd_ready);
@@ -8545,8 +8590,7 @@ void ia_css_pipe_config_defaults(struct }void -ia_css_pipe_extra_config_defaults (struct ia_css_pipe_extra_config - *extra_config) +ia_css_pipe_extra_config_defaults (struct ia_css_pipe_extra_config *extra_config) {if (!extra_config) {IA_CSS_ERROR ("NULL input parameter" );
@@ -8620,8 +8664,8 @@ int ia_css_pipe_create(const struct ia_cint ia_css_pipe_create_extra (const struct ia_css_pipe_config *config, -const struct ia_css_pipe_extra_config *extra_config, -struct ia_css_pipe **pipe) +const struct ia_css_pipe_extra_config *extra_config, +struct ia_css_pipe **pipe) {int err = -EINVAL ;struct ia_css_pipe *internal_pipe =NULL ;
@@ -8689,7 +8733,7 @@ ia_css_pipe_create_extra(const struct ia/* YUV downscaling */ if ((internal_pipe->config.vf_pp_in_res.width || - internal_pipe->config.capt_pp_in_res.width)) { + internal_pipe->config.capt_pp_in_res.width)) {enum ia_css_frame_format format;if (internal_pipe->config.vf_pp_in_res.width) {
@@ -8765,7 +8809,7 @@ ia_css_pipe_create_extra(const struct ia }if (internal_pipe->config.acc_extension) { err =ia_css_pipe_load_extension (internal_pipe, - internal_pipe->config.acc_extension); + internal_pipe->config.acc_extension);if (err) {IA_CSS_LEAVE_ERR_PRIVATE (err);kvfree (internal_pipe);
@@ -8783,7 +8827,7 @@ ia_css_pipe_create_extra(const struct iaint ia_css_pipe_get_info (const struct ia_css_pipe *pipe, -struct ia_css_pipe_info *pipe_info) +struct ia_css_pipe_info *pipe_info) {ia_css_debug_dtrace (IA_CSS_DEBUG_TRACE ,"ia_css_pipe_get_info()\n" );
@@ -8821,8 +8865,8 @@ bool ia_css_pipe_has_dvs_stats(struct iaint ia_css_pipe_override_frame_format (struct ia_css_pipe *pipe, -int pin_index, -enum ia_css_frame_format new_format) +int pin_index, +enum ia_css_frame_format new_format) {int err =0 ;
@@ -8902,10 +8946,8 @@ ia_css_stream_configure_rx(struct ia_css#endif static struct ia_css_pipe * -find_pipe (struct ia_css_pipe *pipes[], -unsigned int num_pipes, -enum ia_css_pipe_mode mode, -bool copy_pipe) +find_pipe (struct ia_css_pipe *pipes[],unsigned int num_pipes, +enum ia_css_pipe_mode mode,bool copy_pipe) {unsigned int i;
@@ -8976,7 +9018,7 @@ ia_css_acc_stream_create(struct ia_css_sstatic int metadata_info_init (const struct ia_css_metadata_config *mdc, -struct ia_css_metadata_info *md) +struct ia_css_metadata_info *md) {/* Either both width and height should be set or neither */ if ((mdc->resolution.height >0 ) ^ (mdc->resolution.width >0 ))
@@ -9004,7 +9046,7 @@ static int check_pipe_resolutions(const }if (ia_css_util_check_res (pipe->config.input_effective_res.width, - pipe->config.input_effective_res.height) !=0 ) { + pipe->config.input_effective_res.height) !=0 ) {IA_CSS_ERROR ("effective resolution not supported" ); err = -EINVAL ; goto EXIT;
@@ -9012,7 +9054,7 @@ static int check_pipe_resolutions(constif (!ia_css_util_resolution_is_zero ( pipe->stream->config.input_config.input_res)) {if (!ia_css_util_res_leq (pipe->config.input_effective_res, - pipe->stream->config.input_config.input_res)) { + pipe->stream->config.input_config.input_res)) {IA_CSS_ERROR ("effective resolution is larger than input resolution" ); err = -EINVAL ; goto EXIT;
@@ -9035,9 +9077,9 @@ EXIT:int ia_css_stream_create (const struct ia_css_stream_config *stream_config, -int num_pipes, -struct ia_css_pipe *pipes[], -struct ia_css_stream **stream) +int num_pipes, +struct ia_css_pipe *pipes[], +struct ia_css_stream **stream) {struct ia_css_pipe *curr_pipe;struct ia_css_stream *curr_stream =NULL ;
@@ -9198,11 +9240,11 @@ ia_css_stream_create(const struct ia_csscase IA_CSS_INPUT_MODE_TPG :#if !defined(ISP2401 )IA_CSS_LOG ("tpg_configuration: x_mask=%d, y_mask=%d, x_delta=%d, y_delta=%d, xy_mask=%d" , - curr_stream->config.source.tpg.x_mask, - curr_stream->config.source.tpg.y_mask, - curr_stream->config.source.tpg.x_delta, - curr_stream->config.source.tpg.y_delta, - curr_stream->config.source.tpg.xy_mask); + curr_stream->config.source.tpg.x_mask, + curr_stream->config.source.tpg.y_mask, + curr_stream->config.source.tpg.x_delta, + curr_stream->config.source.tpg.y_delta, + curr_stream->config.source.tpg.xy_mask); sh_css_sp_configure_tpg( curr_stream->config.source.tpg.x_mask,
@@ -9227,9 +9269,8 @@ ia_css_stream_create(const struct ia_css }#ifdef ISP2401 - err =aspect_ratio_crop_init (curr_stream, - pipes, - &aspect_ratio_crop_enabled); + err =aspect_ratio_crop_init (curr_stream, pipes, + &aspect_ratio_crop_enabled);if (err) {IA_CSS_LEAVE_ERR (err); goto ERR;
@@ -9266,8 +9307,8 @@ ia_css_stream_create(const struct ia_css curr_pipe->config.input_effective_res = effective_res; }IA_CSS_LOG ("effective_res=%dx%d" , - effective_res.width, - effective_res.height); + effective_res.width, + effective_res.height); }if (IS_ISP2401 ) {
@@ -9295,13 +9336,13 @@ ia_css_stream_create(const struct ia_cssif (!spcopyonly) { sensor_binning_changed =sh_css_params_set_binning_factor (curr_stream, - curr_stream->config.sensor_binning_factor); + curr_stream->config.sensor_binning_factor); }else { sensor_binning_changed = false; }IA_CSS_LOG ("sensor_binning=%d, changed=%d" , - curr_stream->config.sensor_binning_factor, sensor_binning_changed); + curr_stream->config.sensor_binning_factor, sensor_binning_changed);/* loop over pipes */ IA_CSS_LOG ("num_pipes=%d" , num_pipes); curr_stream->cont_capt = false;
@@ -9325,17 +9366,18 @@ ia_css_stream_create(const struct ia_css/* Create copy pipe here, since it may not be exposed to the driver */ preview_pipe =find_pipe (pipes, num_pipes, -IA_CSS_PIPE_MODE_PREVIEW , false); +IA_CSS_PIPE_MODE_PREVIEW , false); video_pipe =find_pipe (pipes, num_pipes, -IA_CSS_PIPE_MODE_VIDEO , false); - acc_pipe =find_pipe (pipes, num_pipes, -IA_CSS_PIPE_MODE_ACC , false); +IA_CSS_PIPE_MODE_VIDEO , false); + acc_pipe =find_pipe (pipes, num_pipes,IA_CSS_PIPE_MODE_ACC , + false);if (acc_pipe && num_pipes ==2 && curr_stream->cont_capt) curr_stream->cont_capt = false;/* preview + QoS case will not need cont_capt switch */ if (curr_stream->cont_capt) { capture_pipe =find_pipe (pipes, num_pipes, -IA_CSS_PIPE_MODE_CAPTURE , false); +IA_CSS_PIPE_MODE_CAPTURE , + false);if (!capture_pipe) { err = -EINVAL ; goto ERR;
@@ -9417,10 +9459,12 @@ ia_css_stream_create(const struct ia_cssif (!spcopyonly) {if (!IS_ISP2401 ) err =sh_css_pipe_get_shading_info (curr_pipe, - &pipe_info->shading_info,NULL ); + &pipe_info->shading_info, +NULL );else err =sh_css_pipe_get_shading_info (curr_pipe, - &pipe_info->shading_info, &curr_pipe->config); + &pipe_info->shading_info, + &curr_pipe->config);if (err) goto ERR;
@@ -9430,7 +9474,8 @@ ia_css_stream_create(const struct ia_css goto ERR;for (j =0 ; j <IA_CSS_PIPE_MAX_OUTPUT_STAGE ; j++) {sh_css_pipe_get_viewfinder_frame_info (curr_pipe, - &pipe_info->vf_output_info[j], j); + &pipe_info->vf_output_info[j], + j);if (err) goto ERR; }
@@ -9615,7 +9660,7 @@ ia_css_stream_destroy(struct ia_css_streint ia_css_stream_get_info (const struct ia_css_stream *stream, -struct ia_css_stream_info *stream_info) +struct ia_css_stream_info *stream_info) {ia_css_debug_dtrace (IA_CSS_DEBUG_TRACE ,"ia_css_stream_get_info: enter/exit\n" );assert (stream);
@@ -9903,7 +9948,7 @@ ia_css_stream_get_3a_binary(const structint ia_css_stream_set_output_padded_width (struct ia_css_stream *stream, -unsigned int output_padded_width) +unsigned int output_padded_width) {struct ia_css_pipe *pipe;
@@ -10380,7 +10425,7 @@ ia_css_unlock_raw_frame(struct ia_css_st*/ int ia_css_pipe_set_qos_ext_state (struct ia_css_pipe *pipe,uint32_t fw_handle, -bool enable) +bool enable) {unsigned int thread_id;struct ia_css_pipeline_stage *stage;
@@ -10426,7 +10471,7 @@ ia_css_pipe_set_qos_ext_state(struct ia_*/ int ia_css_pipe_get_qos_ext_state (struct ia_css_pipe *pipe,uint32_t fw_handle, -bool *enable) +bool *enable) {struct ia_css_pipeline_stage *stage;unsigned int thread_id;
@@ -10462,9 +10507,9 @@ ia_css_pipe_get_qos_ext_state(struct ia_/* ISP2401 */ int ia_css_pipe_update_qos_ext_mapped_arg (struct ia_css_pipe *pipe, -u32 fw_handle, -struct ia_css_isp_param_css_segments *css_seg, -struct ia_css_isp_param_isp_segments *isp_seg) +u32 fw_handle, +struct ia_css_isp_param_css_segments *css_seg, +struct ia_css_isp_param_isp_segments *isp_seg) {unsigned int HIVE_ADDR_sp_group;static struct sh_css_sp_group sp_group;
@@ -10499,7 +10544,7 @@ ia_css_pipe_update_qos_ext_mapped_arg(stif (!err) {/* Get the Extension State */ enabled = (SH_CSS_QOS_STAGE_IS_ENABLED (&sh_css_sp_group.pipe[thread_id], - stage->stage_num)) ? true : false; + stage->stage_num)) ? true : false;/* Update mapped arg only when extension stage is not enabled */ if (enabled) {IA_CSS_ERROR ("Leaving: cannot update when stage is enabled." );
@@ -10509,13 +10554,14 @@ ia_css_pipe_update_qos_ext_mapped_arg(st HIVE_ADDR_sp_group = fw->info.sp.group;sp_dmem_load (SP0_ID , - (unsigned int )sp_address_of (sp_group), - &sp_group,sizeof (struct sh_css_sp_group )); + (unsigned int )sp_address_of (sp_group), + &sp_group, +sizeof (struct sh_css_sp_group ));hmm_load (sp_group.pipe[thread_id].sp_stage_addr[stage_num], - &sp_stage,sizeof (struct sh_css_sp_stage )); + &sp_stage,sizeof (struct sh_css_sp_stage ));hmm_load (sp_stage.isp_stage_addr, - &isp_stage,sizeof (struct sh_css_isp_stage )); + &isp_stage,sizeof (struct sh_css_isp_stage ));for (mem =0 ; mem <N_IA_CSS_ISP_MEMORIES ; mem++) { isp_stage.mem_initializers.params[IA_CSS_PARAM_CLASS_PARAM][mem].address =
@@ -10531,7 +10577,8 @@ ia_css_pipe_update_qos_ext_mapped_arg(st }hmm_store (sp_stage.isp_stage_addr, - &isp_stage,sizeof (struct sh_css_isp_stage )); + &isp_stage, +sizeof (struct sh_css_isp_stage )); } } }
@@ -10542,8 +10589,8 @@ ia_css_pipe_update_qos_ext_mapped_arg(st#ifdef ISP2401 static int aspect_ratio_crop_init (struct ia_css_stream *curr_stream, -struct ia_css_pipe *pipes[], -bool *do_crop_status) +struct ia_css_pipe *pipes[], +bool *do_crop_status) {int err =0 ;int i;
@@ -10589,7 +10636,7 @@ aspect_ratio_crop_check(bool enabled, ststatic int aspect_ratio_crop (struct ia_css_pipe *curr_pipe, -struct ia_css_resolution *effective_res) +struct ia_css_resolution *effective_res) {int err =0 ;struct ia_css_resolution crop_res;
@@ -10649,7 +10696,7 @@ aspect_ratio_crop(struct ia_css_pipe *cucase IA_CSS_PIPE_MODE_YUVPP :default :IA_CSS_ERROR ("aspect ratio cropping invalid args: mode[%d]\n" , - curr_pipe->config.mode); + curr_pipe->config.mode);assert (0 );break ; }
@@ -10713,7 +10760,7 @@ static struct sh_css_hmm_buffer_recordassert (h_vbuf);assert ((type >IA_CSS_BUFFER_TYPE_INVALID ) && - (type <IA_CSS_NUM_DYNAMIC_BUFFER_TYPE )); + (type <IA_CSS_NUM_DYNAMIC_BUFFER_TYPE ));assert (kernel_ptr !=0 ); buffer_record = &hmm_buffer_record[0 ];
Greg Kroah-Hartman
maintainerPATCH 607/699 staging: media: atomisp: reduce load_primary_binaries() stack usage
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Arnd Bergmann <[email protected]>
[ Upstream commit f4d51e55dd47ef467fbe37d8575e20eee41b092d ]
The load_primary_binaries() function is overly complex and has som large variables on the stack, which can cause warnings depending on CONFIG_FRAME_WARN setting:
drivers/staging/media/atomisp/pci/sh_css.c: In function 'load_primary_binaries':drivers/staging/media/atomisp/pci/sh_css.c:5260:1: error: the frame size of 1560 bytes is larger than 1536 bytes [-Werror=frame-larger-than=]
Half of the stack usage is for the prim_descr[] array, but only one member of the array is used at any given time.
Reduce the stack usage by turning the array into a single structure.
--- drivers/staging/media/atomisp/pci/sh_css.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-)
drivers/staging/media/atomisp/pci/sh_css.c +3 -3
@@ -5870,7 +5870,6 @@ static int load_primary_binaries(struct ia_css_capture_settings *mycs;unsigned int i;bool need_extra_yuv_scaler = false; -struct ia_css_binary_descr prim_descr[MAX_NUM_PRIMARY_STAGES ];IA_CSS_ENTER_PRIVATE ("" );assert (pipe);
@@ -6058,15 +6057,16 @@ static int load_primary_binaries(/* Primary */ for (i =0 ; i < mycs->num_primary_stage; i++) { +struct ia_css_binary_descr prim_descr;struct ia_css_frame_info *local_vf_info =NULL ;if (pipe->enable_viewfinder[IA_CSS_PIPE_OUTPUT_STAGE_0 ] && (i == mycs->num_primary_stage -1 )) local_vf_info = &vf_info; -ia_css_pipe_get_primary_binarydesc (pipe, &prim_descr[i], +ia_css_pipe_get_primary_binarydesc (pipe, &prim_descr, &prim_in_info, &prim_out_info, local_vf_info, i); - err =ia_css_binary_find (&prim_descr[i], &mycs->primary_binary[i]); + err =ia_css_binary_find (&prim_descr, &mycs->primary_binary[i]);if (err) {IA_CSS_LEAVE_ERR_PRIVATE (err);return err;
Greg Kroah-Hartman
maintainerPATCH 608/699 cifs: Create a new shared file holding smb2 pdu definitions
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ronnie Sahlberg <[email protected]>
[ Upstream commit 0d35e382e4e96a4fd97a1438bc1b11a91d2d85a6 ]
This file will contain all the definitions we need for SMB2 packets and will follow the naming convention of MS-SMB2.PDF as closely as possible to make it easier to cross-reference beween the definitions and the standard.
The content of this file will mostly consist of migration of existing definitions in the cifs/smb2.pdu.h and ksmbd/smb2pdu.h files with some additional tweaks as the two files have diverged.
This patch introduces the new smbfs_common/smb2pdu.h file and migrates the SMB2 header as well as TREE_CONNECT and TREE_DISCONNECT to the shared file.
Stable-dep-of: 53b7c271f06b ("smb: client: restrict implied bcc[0] exemption to responses without data area")
--- fs/cifs/cifsfs.c | 1 fs/cifs/cifsglob.h | 3 fs/cifs/connect.c | 4 fs/cifs/misc.c | 2 fs/cifs/smb2maperror.c | 16 +- fs/cifs/smb2misc.c | 43 ++--- fs/cifs/smb2ops.c | 61 +++---- fs/cifs/smb2pdu.c | 106 ++++++------- fs/cifs/smb2pdu.h | 365 ++++------------------------------------------ fs/cifs/smb2proto.h | 2 fs/cifs/smb2transport.c | 36 ++-- fs/smbfs_common/smb2pdu.h | 318 ++++++++++++++++++++++++++++++++++++++++ 12 files changed, 491 insertions(+), 466 deletions(-) create mode 100644 fs/smbfs_common/smb2pdu.h
fs/cifs/cifsfs.c +0 -1
@@ -51,7 +51,6 @@#include <linux/key-type.h> #include "cifs_spnego.h" #include "fscache.h" -#include "smb2pdu.h" #ifdef CONFIG_CIFS_DFS_UPCALL #include "dfs_cache.h" #endif
fs/cifs/cifsglob.h +2 -1
@@ -32,6 +32,7 @@#include <crypto/internal/hash.h> #include <linux/scatterlist.h> #include <uapi/linux/cifs/cifs_mount.h> +#include "../smbfs_common/smb2pdu.h" #include "smb2pdu.h" #include "smb2glob.h"
@@ -866,7 +867,7 @@ revert_current_mid(struct TCP_Server_Infstatic inline void revert_current_mid_from_hdr (struct TCP_Server_Info *server, -const struct smb2_sync_hdr *shdr) +const struct smb2_hdr *shdr) {unsigned int num =le16_to_cpu (shdr->CreditCharge);
fs/cifs/connect.c +2 -2
@@ -848,7 +848,7 @@ dequeue_mid(struct mid_q_entry *mid, boostatic unsigned int smb2_get_credits_from_hdr (char *buffer,struct TCP_Server_Info *server) { -struct smb2_sync_hdr *shdr = (struct smb2_sync_hdr *)buffer; +struct smb2_hdr *shdr = (struct smb2_hdr *)buffer;/* * SMB1 does not use credits.
@@ -1048,7 +1048,7 @@ cifs_handle_standard(struct TCP_Server_Istatic void smb2_add_credits_from_hdr (char *buffer,struct TCP_Server_Info *server) { -struct smb2_sync_hdr *shdr = (struct smb2_sync_hdr *)buffer; +struct smb2_hdr *shdr = (struct smb2_hdr *)buffer;/* * SMB1 does not use credits.
fs/cifs/misc.c +1 -1
@@ -164,7 +164,7 @@ cifs_buf_get(void)* SMB2 header is bigger than CIFS one - no problems to clean some * more bytes for CIFS. */ -size_t buf_size =sizeof (struct smb2_sync_hdr ); +size_t buf_size =sizeof (struct smb2_hdr );/* * We could use negotiated size instead of max_msgsize -
fs/cifs/smb2maperror.c +10 -6
@@ -2452,14 +2452,16 @@ smb2_print_status(__le32 status)int map_smb2_to_linux_error (char *buf,bool log_err) { -struct smb2_sync_hdr *shdr = (struct smb2_sync_hdr *)buf; +struct smb2_hdr *shdr = (struct smb2_hdr *)buf;unsigned int i;int rc = -EIO ;__le32 smb2err = shdr->Status;if (smb2err ==0 ) { -trace_smb3_cmd_done (shdr->TreeId, shdr->SessionId, -le16_to_cpu (shdr->Command),le64_to_cpu (shdr->MessageId)); +trace_smb3_cmd_done (le32_to_cpu (shdr->Id.SyncId.TreeId), +le64_to_cpu (shdr->SessionId), +le16_to_cpu (shdr->Command), +le64_to_cpu (shdr->MessageId));return 0 ; }
@@ -2483,8 +2485,10 @@ map_smb2_to_linux_error(char *buf, boolcifs_dbg (FYI ,"Mapping SMB2 status code 0x%08x to POSIX err %d\n" ,__le32_to_cpu (smb2err), rc); -trace_smb3_cmd_err (shdr->TreeId, shdr->SessionId, -le16_to_cpu (shdr->Command), -le64_to_cpu (shdr->MessageId),le32_to_cpu (smb2err), rc); +trace_smb3_cmd_err (le32_to_cpu (shdr->Id.SyncId.TreeId), +le64_to_cpu (shdr->SessionId), +le16_to_cpu (shdr->Command), +le64_to_cpu (shdr->MessageId), +le32_to_cpu (smb2err), rc);return rc; }
fs/cifs/smb2misc.c +21 -22
119 lines not on this page · raw message
fs/cifs/smb2ops.c +31 -30
225 lines not on this page · raw message
fs/cifs/smb2pdu.c +52 -54
383 lines not on this page · raw message
fs/cifs/smb2pdu.h +35 -330
581 lines not on this page · raw message
fs/cifs/smb2proto.h +1 -1
@@ -38,7 +38,7 @@ extern int smb2_check_message(char *buf, struct TCP_Server_Info *server);extern unsigned int smb2_calc_size (void *buf,struct TCP_Server_Info *server);extern char *smb2_get_data_area_len (int *off,int *len, -struct smb2_sync_hdr *shdr); +struct smb2_hdr *shdr);extern __le16 *cifs_convert_path_to_utf16 (const char *from,struct cifs_sb_info *cifs_sb);
fs/cifs/smb2transport.c +18 -18
@@ -33,7 +33,6 @@#include <linux/highmem.h> #include <crypto/algapi.h> #include <crypto/aead.h> -#include "smb2pdu.h" #include "cifsglob.h" #include "cifsproto.h" #include "smb2proto.h"
@@ -227,14 +226,14 @@ smb2_calc_signature(struct smb_rqst *rqsunsigned char smb2_signature[SMB2_HMACSHA256_SIZE ];unsigned char *sigptr = smb2_signature;struct kvec *iov = rqst->rq_iov; -struct smb2_sync_hdr *shdr = (struct smb2_sync_hdr *)iov[0 ].iov_base; +struct smb2_hdr *shdr = (struct smb2_hdr *)iov[0 ].iov_base;struct cifs_ses *ses;struct shash_desc *shash;struct crypto_shash *hash;struct sdesc *sdesc =NULL ;struct smb_rqst drqst; - ses =smb2_find_smb_ses (server, shdr->SessionId); + ses =smb2_find_smb_ses (server,le64_to_cpu (shdr->SessionId));if (!ses) {cifs_server_dbg (VFS ,"%s: Could not find session\n" , __func__);return 0 ;
@@ -563,14 +562,14 @@ smb3_calc_signature(struct smb_rqst *rqsunsigned char smb3_signature[SMB2_CMACAES_SIZE ];unsigned char *sigptr = smb3_signature;struct kvec *iov = rqst->rq_iov; -struct smb2_sync_hdr *shdr = (struct smb2_sync_hdr *)iov[0 ].iov_base; +struct smb2_hdr *shdr = (struct smb2_hdr *)iov[0 ].iov_base;struct shash_desc *shash;struct crypto_shash *hash;struct sdesc *sdesc =NULL ;struct smb_rqst drqst;u8 key[SMB3_SIGN_KEY_SIZE ]; - rc =smb2_get_sign_key (shdr->SessionId, server, key); + rc =smb2_get_sign_key (le64_to_cpu (shdr->SessionId), server, key);if (rc)return 0 ;
@@ -640,12 +639,12 @@ static int smb2_sign_rqst(struct smb_rqst *rqst, struct TCP_Server_Info *server) { int rc = 0; -struct smb2_sync_hdr *shdr; +struct smb2_hdr *shdr;struct smb2_sess_setup_req *ssr;bool is_binding;bool is_signed; - shdr = (struct smb2_sync_hdr *)rqst->rq_iov[0 ].iov_base; + shdr = (struct smb2_hdr *)rqst->rq_iov[0 ].iov_base; ssr = (struct smb2_sess_setup_req *)shdr; is_binding = shdr->Command == SMB2_SESSION_SETUP &&
@@ -671,8 +670,8 @@ smb2_verify_signature(struct smb_rqst *r {unsigned int rc;char server_response_sig[SMB2_SIGNATURE_SIZE ]; -struct smb2_sync_hdr *shdr = - (struct smb2_sync_hdr *)rqst->rq_iov[0 ].iov_base; +struct smb2_hdr *shdr = + (struct smb2_hdr *)rqst->rq_iov[0 ].iov_base; if ((shdr->Command == SMB2_NEGOTIATE) || (shdr->Command == SMB2_SESSION_SETUP) ||
@@ -719,7 +718,7 @@ smb2_verify_signature(struct smb_rqst *r*/ static inline void smb2_seq_num_into_buf (struct TCP_Server_Info *server, -struct smb2_sync_hdr *shdr) +struct smb2_hdr *shdr) {unsigned int i, num =le16_to_cpu (shdr->CreditCharge);
@@ -730,7 +729,7 @@ smb2_seq_num_into_buf(struct TCP_Server_ }static struct mid_q_entry * -smb2_mid_entry_alloc (const struct smb2_sync_hdr *shdr, +smb2_mid_entry_alloc (const struct smb2_hdr *shdr,struct TCP_Server_Info *server) {struct mid_q_entry *temp;
@@ -762,14 +761,15 @@ smb2_mid_entry_alloc(const struct smb2_satomic_inc (&midCount); temp->mid_state =MID_REQUEST_ALLOCATED ; -trace_smb3_cmd_enter (shdr->TreeId, shdr->SessionId, -le16_to_cpu (shdr->Command), temp->mid); +trace_smb3_cmd_enter (le32_to_cpu (shdr->Id.SyncId.TreeId), +le64_to_cpu (shdr->SessionId), +le16_to_cpu (shdr->Command), temp->mid);return temp; }static int smb2_get_mid_entry (struct cifs_ses *ses,struct TCP_Server_Info *server, -struct smb2_sync_hdr *shdr,struct mid_q_entry **mid) +struct smb2_hdr *shdr,struct mid_q_entry **mid) {if (server->tcpStatus == CifsExiting)return -ENOENT ;
@@ -837,8 +837,8 @@ smb2_setup_request(struct cifs_ses *ses, struct smb_rqst *rqst) {int rc; -struct smb2_sync_hdr *shdr = - (struct smb2_sync_hdr *)rqst->rq_iov[0 ].iov_base; +struct smb2_hdr *shdr = + (struct smb2_hdr *)rqst->rq_iov[0 ].iov_base;struct mid_q_entry *mid;smb2_seq_num_into_buf (server, shdr);
@@ -863,8 +863,8 @@ struct mid_q_entry * smb2_setup_async_request(struct TCP_Server_Info *server, struct smb_rqst *rqst) { int rc; -struct smb2_sync_hdr *shdr = - (struct smb2_sync_hdr *)rqst->rq_iov[0 ].iov_base; +struct smb2_hdr *shdr = + (struct smb2_hdr *)rqst->rq_iov[0 ].iov_base;struct mid_q_entry *mid; if (server->tcpStatus == CifsNeedNegotiate &&
fs/smbfs_common/smb2pdu.h new file +318 -0
318 lines not on this page · raw message
Greg Kroah-Hartman
maintainerPATCH 609/699 cifs: remove check of list iterator against head past the loop body
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jakob Koschel <[email protected]>
[ Upstream commit 00c796eecba4898194ea549679797ee28f89a92f ]
When list_for_each_entry() completes the iteration over the whole list without breaking the loop, the iterator value will be a bogus pointer computed based on the head element.
While it is safe to use the pointer to determine if it was computed based on the head element, either with list_entry_is_head() or &pos->member == head, using the iterator variable after the loop should be avoided.
In preparation to limit the scope of a list iterator to the list traversal loop, use a dedicated pointer to point to the found element [1].
Stable-dep-of: 53b7c271f06b ("smb: client: restrict implied bcc[0] exemption to responses without data area")
--- fs/cifs/smb2misc.c | 13 ++++++------- 1 file changed, 6 insertions(+), 7 deletions(-)
fs/cifs/smb2misc.c +6 -7
@@ -154,19 +154,18 @@ smb2_check_message(char *buf, unsigned istruct smb2_transform_hdr *thdr = (struct smb2_transform_hdr *)buf;struct cifs_ses *ses =NULL ; -struct list_head *tmp; +struct cifs_ses *iter;/* decrypt frame now that it is completely read in */ spin_lock (&cifs_tcp_ses_lock); -list_for_each (tmp, &srvr->smb_ses_list) { - ses = list_entry(tmp, struct cifs_ses, smb_ses_list); -if (ses->Suid ==le64_to_cpu (thdr->SessionId)) +list_for_each_entry (iter, &srvr->smb_ses_list, smb_ses_list) { +if (iter->Suid ==le64_to_cpu (thdr->SessionId)) { + ses = iter;break ; - - ses =NULL ; + } }spin_unlock (&cifs_tcp_ses_lock); -if (ses ==NULL ) { +if (!ses) {cifs_dbg (VFS ,"no decryption - session id not found\n" );return 1 ; }
Greg Kroah-Hartman
maintainerPATCH 610/699 smb2: small refactor in smb2_check_message()
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Enzo Matsumiya <[email protected]>
[ Upstream commit da3847894fddc27ca95d5ac0012f444a77a5e0c3 ]
If the command is SMB2_IOCTL, OutputLength and OutputContext are optional and can be zero, so return early and skip calculated length check.
Move the mismatched length message to the end of the check, to avoid unnecessary logs when the check was not a real miscalculation.
Also change the pr_warn_once() to a pr_warn() so we're sure to get a log for the real mismatches.
Stable-dep-of: 53b7c271f06b ("smb: client: restrict implied bcc[0] exemption to responses without data area")
--- fs/cifs/connect.c | 13 ++++++------- fs/cifs/smb2misc.c | 47 ++++++++++++++++++++++++++++------------------- 2 files changed, 34 insertions(+), 26 deletions(-)
fs/cifs/connect.c +6 -7
@@ -1012,19 +1012,18 @@ int cifs_handle_standard(struct TCP_Server_Info *server, struct mid_q_entry *mid) { char *buf = server->large_buf ? server->bigbuf : server->smallbuf; -int length; +int rc;/* * We know that we received enough to get to the MID as we * checked the pdu_length earlier. Now check to see -* if the rest of the header is OK. We borrow the length -* var for the rest of the loop to avoid a new stack var. +* if the rest of the header is OK. * * 48 bytes is enough to display the header and a little bit * into the payload for debugging purposes. */ - length = server->ops->check_message (buf, server->total_read, server); -if (length !=0 ) + rc = server->ops->check_message (buf, server->total_read, server); +if (rc)cifs_dump_mem ("Bad SMB: " , buf, min_t(unsigned int, server->total_read, 48));
@@ -1039,9 +1038,9 @@ cifs_handle_standard(struct TCP_Server_Ireturn -1 ;if (!mid) -return length; +return rc; -handle_mid (mid, server, buf, length); +handle_mid (mid, server, buf, rc);return 0 ; }
fs/cifs/smb2misc.c +28 -19
92 lines not on this page · raw message
Greg Kroah-Hartman
maintainerPATCH 611/699 cifs: remove unused server parameter from calc_smb_size()
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Enzo Matsumiya <[email protected]>
[ Upstream commit 68ed14496b032b0c9ef21b38ee45c6c8f3a18ff1 ]
This parameter is unused by the called function
Stable-dep-of: 53b7c271f06b ("smb: client: restrict implied bcc[0] exemption to responses without data area")
--- fs/cifs/cifs_debug.c | 2 +- fs/cifs/cifsglob.h | 2 +- fs/cifs/cifsproto.h | 2 +- fs/cifs/misc.c | 2 +- fs/cifs/netmisc.c | 2 +- fs/cifs/readdir.c | 6 ++---- fs/cifs/smb2misc.c | 4 ++-- fs/cifs/smb2ops.c | 2 +- fs/cifs/smb2proto.h | 2 +- 9 files changed, 11 insertions(+), 13 deletions(-)
fs/cifs/cifs_debug.c +1 -1
@@ -41,7 +41,7 @@ void cifs_dump_detail(void *buf, struct smb->Command, smb->Status.CifsError, smb->Flags, smb->Flags2, smb->Mid, smb->Pid);cifs_dbg (VFS ,"smb buf %p len %u\n" , smb, - server->ops->calc_smb_size (smb, server)); + server->ops->calc_smb_size (smb));#endif /* CONFIG_CIFS_DEBUG2 */ }
fs/cifs/cifsglob.h +1 -1
@@ -397,7 +397,7 @@ struct smb_version_operations {int (*close_dir)(const unsigned int ,struct cifs_tcon *,struct cifs_fid *);/* calculate a size of SMB message */ -unsigned int (*calc_smb_size)(void *buf,struct TCP_Server_Info *ptcpi); +unsigned int (*calc_smb_size)(void *buf);/* check for STATUS_PENDING and process the response if yes */ bool (*is_status_pending)(char *buf,struct TCP_Server_Info *server);/* check for STATUS_NETWORK_SESSION_EXPIRED */
fs/cifs/cifsproto.h +1 -1
@@ -148,7 +148,7 @@ extern int cifs_get_writable_path(structextern struct cifsFileInfo *find_readable_file (struct cifsInodeInfo *,bool );extern int cifs_get_readable_path (struct cifs_tcon *tcon,const char *name,struct cifsFileInfo **ret_file); -extern unsigned int smbCalcSize (void *buf,struct TCP_Server_Info *server); +extern unsigned int smbCalcSize (void *buf);extern int decode_negTokenInit (unsigned char *security_blob,int length,struct TCP_Server_Info *server);extern int cifs_convert_address (struct sockaddr *dst,const char *src,int len);
fs/cifs/misc.c +1 -1
@@ -370,7 +370,7 @@ checkSMB(char *buf, unsigned int total_r/* otherwise, there is enough to get to the BCC */ if (check_smb_hdr (smb))return -EIO ; - clc_len =smbCalcSize (smb, server); + clc_len =smbCalcSize (smb);if (4 + rfclen != total_read) { cifs_dbg(VFS, "Length read does not match RFC1001 length %d\n",
fs/cifs/netmisc.c +1 -1
@@ -913,7 +913,7 @@ map_and_check_smb_error(struct mid_q_ent* portion, the number of word parameters and the data portion of the message */ unsigned int -smbCalcSize (void *buf,struct TCP_Server_Info *server) +smbCalcSize (void *buf) {struct smb_hdr *ptr = (struct smb_hdr *)buf; return (sizeof(struct smb_hdr) + (2 * ptr->WordCount) +
fs/cifs/readdir.c +2 -4
@@ -801,8 +801,7 @@ find_cifs_entry(const unsigned int xid, end_of_smb = cfile->srch_inf.ntwrk_buf_start + server->ops->calc_smb_size ( - cfile->srch_inf.ntwrk_buf_start, - server); + cfile->srch_inf.ntwrk_buf_start); cur_ent = cfile->srch_inf.srch_entries_start; first_entry_in_buffer = cfile->srch_inf.index_of_last_entry
@@ -1000,8 +999,7 @@ int cifs_readdir(struct file *file, strucifs_dbg (FYI ,"loop through %d times filling dir for net buf %p\n" , num_to_fill, cifsFile->srch_inf.ntwrk_buf_start); max_len = tcon->ses->server->ops->calc_smb_size ( - cifsFile->srch_inf.ntwrk_buf_start, - tcon->ses->server); + cifsFile->srch_inf.ntwrk_buf_start); end_of_smb = cifsFile->srch_inf.ntwrk_buf_start + max_len; tmp_buf =kmalloc (UNICODE_NAME_MAX ,GFP_KERNEL );
fs/cifs/smb2misc.c +2 -2
@@ -225,7 +225,7 @@ smb2_check_message(char *buf, unsigned i } } - calc_len =smb2_calc_size (buf, server); + calc_len =smb2_calc_size (buf);/* For SMB2_IOCTL, OutputOffset and OutputLength are optional, so might * be 0, and not a real miscalculation */
@@ -407,7 +407,7 @@ smb2_get_data_area_len(int *off, int *le* portion, the number of word parameters and the data portion of the message. */ unsigned int -smb2_calc_size (void *buf,struct TCP_Server_Info *srvr) +smb2_calc_size (void *buf) {struct smb2_pdu *pdu = (struct smb2_pdu *)buf;struct smb2_hdr *shdr = &pdu->hdr;
fs/cifs/smb2ops.c +1 -1
@@ -316,7 +316,7 @@ smb2_dump_detail(void *buf, struct TCP_S shdr->Command, shdr->Status, shdr->Flags, shdr->MessageId, shdr->Id.SyncId.ProcessId);cifs_server_dbg (VFS ,"smb buf %p len %u\n" , buf, - server->ops->calc_smb_size (buf, server)); + server->ops->calc_smb_size (buf));#endif }
fs/cifs/smb2proto.h +1 -1
@@ -36,7 +36,7 @@ struct smb_rqst;extern int map_smb2_to_linux_error (char *buf,bool log_err);extern int smb2_check_message (char *buf,unsigned int length,struct TCP_Server_Info *server); -extern unsigned int smb2_calc_size (void *buf,struct TCP_Server_Info *server); +extern unsigned int smb2_calc_size (void *buf);extern char *smb2_get_data_area_len (int *off,int *len,struct smb2_hdr *shdr); extern __le16 *cifs_convert_path_to_utf16(const char *from,
Greg Kroah-Hartman
maintainerPATCH 612/699 smb: client: restrict implied bcc[0] exemption to responses without data area
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Shoichiro Miyamoto <[email protected]>
[ Upstream commit 53b7c271f06be4dd5cfc8c6ef552a8355c891a7f ]
smb2_check_message() has a long-standing quirk that accepts a response whose calculated length is one byte larger than the bytes actually received ("server can return one byte more due to implied bcc[0]"). This was introduced to accommodate servers that omit the trailing bcc[0] overlap byte when no data area is present.
However, the exemption is applied unconditionally, regardless of whether the command actually carries a data area (has_smb2_data_area[]). When a response with a data area is subject to the +1 exemption, the reported data can extend one byte beyond the bytes actually received, yet smb2_check_message() still accepts it. The subsequent decoder then reads past the end of the receive buffer. This is reachable during NEGOTIATE and SESSION_SETUP, before the session is established.
The resulting out-of-bounds reads are visible under KASAN when mounting against a non-conforming server; both the SPNEGO/negTokenInit and the NTLMSSP challenge decoders are affected:
BUG: KASAN: slab-out-of-bounds in asn1_ber_decoder+0x16a7/0x1b00 Read of size 1 at addr ffff8880084d67c0 by task mount.cifs/81 CPU: 1 UID: 0 PID: 81 Comm: mount.cifs Not tainted 7.1.0-rc6 #1 Call Trace: <TASK> dump_stack_lvl+0x4e/0x70 print_report+0x157/0x4c9 kasan_report+0xce/0x100 asn1_ber_decoder+0x16a7/0x1b00 decode_negTokenInit+0x19/0x30 SMB2_negotiate+0x31d9/0x4c90 cifs_negotiate_protocol+0x1f2/0x3f0 cifs_get_smb_ses+0x93f/0x17e0 cifs_mount_get_session+0x7f/0x3a0 cifs_mount+0xb4/0xcf0 cifs_smb3_do_mount+0x23a/0x1500 smb3_get_tree+0x3b0/0x630 vfs_get_tree+0x82/0x2d0 fc_mount+0x10/0x1b0 path_mount+0x50d/0x1de0 __x64_sys_mount+0x20b/0x270 do_syscall_64+0xee/0x590 entry_SYSCALL_64_after_hwframe+0x77/0x7f </TASK> Allocated by task 85: kmem_cache_alloc_noprof+0x106/0x380 mempool_alloc_noprof+0x116/0x1e0 cifs_small_buf_get+0x31/0x80 allocate_buffers+0x10d/0x2b0 cifs_demultiplex_thread+0x1d5/0x1d50 kthread+0x2c6/0x390 ret_from_fork+0x36e/0x5a0 ret_from_fork_asm+0x1a/0x30 The buggy address is located 0 bytes to the right of allocated 448-byte region [ffff8880084d6600, ffff8880084d67c0) which belongs to the cache cifs_small_rq of size 448 BUG: KASAN: slab-out-of-bounds in kmemdup_noprof+0x36/0x50 Read of size 329 at addr ffff88800726c678 by task mount.cifs/89 CPU: 0 UID: 0 PID: 89 Comm: mount.cifs Tainted: G B 7.1.0-rc6 #1 Call Trace: <TASK> dump_stack_lvl+0x4e/0x70 print_report+0x157/0x4c9 kasan_report+0xce/0x100 kasan_check_range+0x10f/0x1e0 __asan_memcpy+0x23/0x60 kmemdup_noprof+0x36/0x50 decode_ntlmssp_challenge+0x457/0x680 SMB2_sess_auth_rawntlmssp_negotiate+0x6f0/0xcb0 SMB2_sess_setup+0x219/0x4f0 cifs_setup_session+0x248/0xaf0 cifs_get_smb_ses+0xf79/0x17e0 cifs_mount_get_session+0x7f/0x3a0 cifs_mount+0xb4/0xcf0 cifs_smb3_do_mount+0x23a/0x1500 smb3_get_tree+0x3b0/0x630 vfs_get_tree+0x82/0x2d0 fc_mount+0x10/0x1b0 path_mount+0x50d/0x1de0 __x64_sys_mount+0x20b/0x270 do_syscall_64+0xee/0x590 entry_SYSCALL_64_after_hwframe+0x77/0x7f </TASK> Allocated by task 93: kmem_cache_alloc_noprof+0x106/0x380 mempool_alloc_noprof+0x116/0x1e0 cifs_small_buf_get+0x31/0x80 allocate_buffers+0x10d/0x2b0 cifs_demultiplex_thread+0x1d5/0x1d50 kthread+0x2c6/0x390 ret_from_fork+0x36e/0x5a0 ret_from_fork_asm+0x1a/0x30 The buggy address is located 120 bytes inside of allocated 448-byte region [ffff88800726c600, ffff88800726c7c0) which belongs to the cache cifs_small_rq of size 448
Restrict the +1 exemption to responses that have no data area, so that it still covers the bcc[0] omission it was meant for. When a data area is present, the +1 discrepancy instead means the reported data length overruns the received buffer, so the response must be rejected.
--- fs/cifs/smb2misc.c | 32 ++++++++++++++++++++++++++------ 1 file changed, 26 insertions(+), 6 deletions(-)
fs/cifs/smb2misc.c +26 -6
@@ -30,6 +30,8 @@#include "smb2glob.h" #include "nterr.h" +static unsigned int __smb2_calc_size (void *buf,bool *have_data); +static int check_smb2_hdr (struct smb2_hdr *shdr,__u64 mid) {
@@ -145,6 +147,7 @@ smb2_check_message(char *buf, unsigned iint command;__u32 calc_len;/* calculated length */ __u64 mid; +bool have_data;/* * Add function to do table lookup of StructureSize by command
@@ -225,7 +228,8 @@ smb2_check_message(char *buf, unsigned i } } - calc_len =smb2_calc_size (buf); + have_data = false; + calc_len =__smb2_calc_size (buf, &have_data);/* For SMB2_IOCTL, OutputOffset and OutputLength are optional, so might * be 0, and not a real miscalculation */
@@ -243,8 +247,13 @@ smb2_check_message(char *buf, unsigned i/* Windows 7 server returns 24 bytes more */ if (calc_len +24 == len && command ==SMB2_OPLOCK_BREAK_HE )return 0 ; -/* server can return one byte more due to implied bcc[0] */ -if (calc_len == len +1 ) +/* +* Server can return one byte more due to implied bcc[0]. +* Allow it only when there is no data area; if data_length > 0 +* the +1 gap indicates an overreported data length rather than +* the bcc[0] omission. +*/ +if (calc_len == len +1 && !have_data)return 0 ;/*
@@ -405,14 +414,17 @@ smb2_get_data_area_len(int *off, int *le/* * Calculate the size of the SMB message based on the fixed header * portion, the number of word parameters and the data portion of the message. +* If have_data is non-NULL, it is set to true when a non-empty data area was +* found (data_length > 0), allowing callers to distinguish the implied bcc[0] +* case (no data area) from an overreported data length. */ -unsigned int -smb2_calc_size (void *buf) +static unsigned int +__smb2_calc_size (void *buf,bool *have_data) {struct smb2_pdu *pdu = (struct smb2_pdu *)buf;struct smb2_hdr *shdr = &pdu->hdr;int offset;/* the offset from the beginning of SMB to data area */ -int data_length;/* the length of the variable length data area */ +int data_length =0 ;/* the length of the variable length data area */ /* Structure Size has already been checked to make sure it is 64 */ int len =le16_to_cpu (shdr->StructureSize);
@@ -445,9 +457,17 @@ smb2_calc_size(void *buf) } calc_size_exit:cifs_dbg (FYI ,"SMB2 len %d\n" , len); +if (have_data) + *have_data = (data_length >0 );return len; } +unsigned int +smb2_calc_size (void *buf) +{ +return __smb2_calc_size (buf,NULL ); +} +/* Note: caller must free return buffer */ __le16 *cifs_convert_path_to_utf16 (const char *from,struct cifs_sb_info *cifs_sb)
Greg Kroah-Hartman
maintainerPATCH 613/699 PCI: imx6: Fix IMX6SX_GPR12_PCIE_TEST_POWERDOWN handling
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Richard Zhu <[email protected]>
[ Upstream commit aad953fb4eed0df5486cd54ccad80ac197678e01 ]
The IMX6SX_GPR12_PCIE_TEST_POWERDOWN bit does not control the PCIe reference clock on i.MX6SX. Instead, it is part of i.MX6SX PCIe core reset sequence.
Move the IMX6SX_GPR12_PCIE_TEST_POWERDOWN assertion/deassertion into the core reset functions to properly reflect its purpose. Remove the .enable_ref_clk() callback for i.MX6SX since it was incorrectly manipulating this bit.
--- drivers/pci/controller/dwc/pci-imx6.c | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-)
drivers/pci/controller/dwc/pci-imx6.c +2 -3
@@ -428,9 +428,6 @@ static int imx6_pcie_enable_ref_clk(strudev_err (dev,"unable to enable pcie_axi clock\n" );break ; } - -regmap_update_bits (imx6_pcie->iomuxc_gpr,IOMUXC_GPR12 , -IMX6SX_GPR12_PCIE_TEST_POWERDOWN ,0 );break ;case IMX6QP :case IMX6Q :
@@ -557,6 +554,8 @@ static void imx6_pcie_deassert_core_reseimx7d_pcie_wait_for_phy_pll_lock (imx6_pcie);break ;case IMX6SX : +regmap_clear_bits (imx6_pcie->iomuxc_gpr,IOMUXC_GPR12 , +IMX6SX_GPR12_PCIE_TEST_POWERDOWN );regmap_update_bits (imx6_pcie->iomuxc_gpr,IOMUXC_GPR5 ,IMX6SX_GPR5_PCIE_BTNRST_RESET ,0 );break ;
Greg Kroah-Hartman
maintainerPATCH 614/699 staging: rtl8723bs: split too long line
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Fabio Aiuto <[email protected]>
[ Upstream commit 98dc120895a9a669e35155ee03b98452723aba95 ]
fix the following post-commit hook checkpatch issue.
WARNING: line length of 103 exceeds 100 columns
30: FILE: drivers/staging/rtl8723bs/core/rtw_mlme_ext.c:711:
+receive_disconnect(padapter, pmlmeinfo->network.MacAddress, 0);
Stable-dep-of: a1fc19d61f66 ("staging: rtl8723bs: fix WEP length underflow and OOB read in OnAuth()")
--- drivers/staging/rtl8723bs/core/rtw_mlme_ext.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
drivers/staging/rtl8723bs/core/rtw_mlme_ext.c +2 -1
@@ -835,7 +835,8 @@ unsigned int OnBeacon(struct adapter *pa ret =rtw_check_bcn_info (padapter, pframe, len);if (!ret) {DBG_871X_LEVEL (_drv_always_,"ap has changed, disconnect now\n " ); -receive_disconnect (padapter, pmlmeinfo->network.MacAddress,0 ); +receive_disconnect (padapter, + pmlmeinfo->network.MacAddress,0 );return _SUCCESS; }/* update WMM, ERP in the beacon */
Greg Kroah-Hartman
maintainerPATCH 615/699 staging: rtl8723bs: remove commented out RT_ASSERT occurrences
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Fabio Aiuto <[email protected]>
[ Upstream commit 2172a6576388e63958f47923e435c46af8d006ba ]
remove commented out obsoete RT_ASSERT macro occurences.
Stable-dep-of: a1fc19d61f66 ("staging: rtl8723bs: fix WEP length underflow and OOB read in OnAuth()")
--- drivers/staging/rtl8723bs/core/rtw_recv.c | 2 -- drivers/staging/rtl8723bs/hal/rtl8723b_hal_init.c | 1 - drivers/staging/rtl8723bs/hal/sdio_halinit.c | 5 ----- 3 files changed, 8 deletions(-)
drivers/staging/rtl8723bs/core/rtw_recv.c +0 -2
@@ -2165,8 +2165,6 @@ int recv_indicatepkts_in_order(struct ad/* pTS->RxIndicateState = RXTS_INDICATE_PROCESSING; */ /* Indicate packets */ -/* RT_ASSERT((index<=REORDER_WIN_SIZE), ("RxReorderIndicatePacket(): Rx Reorder buffer full!!\n")); */ -/* indicate this recv_frame */ /* DbgPrint("recv_indicatepkts_in_order, indicate_seq =%d, seq_num =%d\n", precvpriv->indicate_seq, pattrib->seq_num); */
drivers/staging/rtl8723bs/hal/rtl8723b_hal_init.c +0 -1
@@ -158,7 +158,6 @@ static int _WriteFW(struct adapter *padau8 *bufferPtr = buffer; pageNums = size /MAX_DLFW_PAGE_SIZE ; -/* RT_ASSERT((pageNums <= 4), ("Page numbers should not greater then 4\n")); */ remainSize = size %MAX_DLFW_PAGE_SIZE ;for (page =0 ; page < pageNums; page++) {
drivers/staging/rtl8723bs/hal/sdio_halinit.c +0 -5
@@ -313,7 +313,6 @@ static void _InitNormalChipOneOutEpPrior value =QUEUE_NORMAL ;break ;default : -/* RT_ASSERT(false, ("Shall not reach here!\n")); */ break ; }
@@ -347,7 +346,6 @@ static void _InitNormalChipTwoOutEpPrior valueLow =QUEUE_NORMAL ;break ;default : -/* RT_ASSERT(false, ("Shall not reach here!\n")); */ break ; }
@@ -412,7 +410,6 @@ static void _InitQueuePriority(struct ad_InitNormalChipThreeOutEpPriority (Adapter);break ;default : -/* RT_ASSERT(false, ("Shall not reach here!\n")); */ break ; }
@@ -603,7 +600,6 @@ static void _InitOperationMode(struct ad regBwOpMode =BW_OPMODE_20MHZ ;break ;case WIRELESS_MODE_A : -/* RT_ASSERT(false, ("Error wireless a mode\n")); */ break ;case WIRELESS_MODE_G : regBwOpMode =BW_OPMODE_20MHZ ;
@@ -617,7 +613,6 @@ static void _InitOperationMode(struct ad regBwOpMode =BW_OPMODE_20MHZ ;break ;case WIRELESS_MODE_N_5G : -/* RT_ASSERT(false, ("Error wireless mode")); */ regBwOpMode =BW_OPMODE_5G ;break ;
Greg Kroah-Hartman
maintainerPATCH 616/699 staging: rtl8723bs: remove all 5Ghz network types
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Fabio Aiuto <[email protected]>
[ Upstream commit 708180a92cd8bff18b3d2ac05172815bcc0b6b9a ]
remove all 5Ghz network types. rtl8723bs works on
802.11bgn standards and on 2.4Ghz band.
So remove all code related to 802.11a and 802.11ac standards, which the device doesn't support.
Stable-dep-of: a1fc19d61f66 ("staging: rtl8723bs: fix WEP length underflow and OOB read in OnAuth()")
--- drivers/staging/rtl8723bs/core/rtw_ap.c | 11 ---- drivers/staging/rtl8723bs/core/rtw_ieee80211.c | 22 +------- drivers/staging/rtl8723bs/core/rtw_mlme.c | 10 --- drivers/staging/rtl8723bs/core/rtw_mlme_ext.c | 55 --------------------- drivers/staging/rtl8723bs/core/rtw_wlan_util.c | 14 +---- drivers/staging/rtl8723bs/hal/odm.c | 30 ----------- drivers/staging/rtl8723bs/hal/odm.h | 3 - drivers/staging/rtl8723bs/hal/odm_EdcaTurboCheck.c | 4 - drivers/staging/rtl8723bs/hal/sdio_halinit.c | 5 - drivers/staging/rtl8723bs/include/hal_phy.h | 3 - drivers/staging/rtl8723bs/include/ieee80211.h | 22 +------- drivers/staging/rtl8723bs/include/wifi.h | 1 drivers/staging/rtl8723bs/os_dep/os_intfs.c | 2 13 files changed, 14 insertions(+), 168 deletions(-)
drivers/staging/rtl8723bs/core/rtw_ap.c +2 -9
@@ -427,11 +427,7 @@ void add_RATid(struct adapter *padapter, shortGIrate =query_ra_short_GI (psta);if (pcur_network->Configuration.DSConfig >14 ) { -if (tx_ra_bitmap &0xffff000 ) - sta_band |=WIRELESS_11_5N ; - -if (tx_ra_bitmap &0xff0 ) - sta_band |=WIRELESS_11A ; + sta_band |=WIRELESS_INVALID ; }else {if (tx_ra_bitmap &0xffff000 ) sta_band |=WIRELESS_11_24N ;
@@ -503,7 +499,7 @@ void update_bmc_sta(struct adapter *pada }else if (network_type ==WIRELESS_INVALID ) {/* error handling */ if (pcur_network->Configuration.DSConfig >14 ) - network_type =WIRELESS_11A ; + network_type =WIRELESS_INVALID ;else network_type =WIRELESS_11B ; }
@@ -1254,9 +1250,6 @@ int rtw_check_beacon_data(struct adaptercase WIRELESS_11BG_24N : pbss_network->NetworkTypeInUse = Ndis802_11OFDM24;break ; -case WIRELESS_11A : - pbss_network->NetworkTypeInUse = Ndis802_11OFDM5; -break ;default : pbss_network->NetworkTypeInUse = Ndis802_11OFDM24;break ;
drivers/staging/rtl8723bs/core/rtw_ieee80211.c +4 -18
@@ -96,10 +96,7 @@ bool rtw_is_cckratesonly_included(u8 *raint rtw_check_network_type (unsigned char *rate,int ratelen,int channel) {if (channel >14 ) { -if (rtw_is_cckrates_included (rate)) -return WIRELESS_INVALID ; -else -return WIRELESS_11A ; +return WIRELESS_INVALID ; }else {/* could be pure B, pure G, or B/G */ if (rtw_is_cckratesonly_included (rate))return WIRELESS_11B ;
@@ -275,10 +272,6 @@ void rtw_set_supported_rate(u8 *Supportebreak ;case WIRELESS_11G : -case WIRELESS_11A : -case WIRELESS_11_5N : -case WIRELESS_11A_5N :/* Todo: no basic rate for ofdm ? */ -case WIRELESS_11_5AC :memcpy (SupportedRates,WIFI_OFDMRATES ,IEEE80211_NUM_OFDM_RATESLEN );break ;
@@ -336,14 +329,7 @@ int rtw_generate_ie(struct registry_priv ie =rtw_set_ie (ie, _SSID_IE_, pdev_network->Ssid.SsidLength, pdev_network->Ssid.Ssid, &sz);/* supported rates */ -if (pregistrypriv->wireless_mode ==WIRELESS_11ABGN ) { -if (pdev_network->Configuration.DSConfig >14 ) - wireless_mode =WIRELESS_11A_5N ; -else - wireless_mode =WIRELESS_11BG_24N ; - }else { - wireless_mode = pregistrypriv->wireless_mode; - } + wireless_mode = pregistrypriv->wireless_mode;rtw_set_supported_rate (pdev_network->SupportedRates, wireless_mode);
@@ -368,8 +354,8 @@ int rtw_generate_ie(struct registry_priv }/* HT Cap. */ -if (((pregistrypriv->wireless_mode&WIRELESS_11_5N ) || (pregistrypriv->wireless_mode&WIRELESS_11_24N )) - && (pregistrypriv->ht_enable == true)) { +if ((pregistrypriv->wireless_mode &WIRELESS_11_24N ) && + (pregistrypriv->ht_enable == true)) {/* todo: */ }
drivers/staging/rtl8723bs/core/rtw_mlme.c +0 -10
@@ -2438,16 +2438,6 @@ void rtw_update_registrypriv_dev_networkcase WIRELESS_11BG_24N : pdev_network->NetworkTypeInUse = (Ndis802_11OFDM24);break ; -case WIRELESS_11A : -case WIRELESS_11A_5N : - pdev_network->NetworkTypeInUse = (Ndis802_11OFDM5); -break ; -case WIRELESS_11ABGN : -if (pregistrypriv->channel >14 ) - pdev_network->NetworkTypeInUse = (Ndis802_11OFDM5); -else - pdev_network->NetworkTypeInUse = (Ndis802_11OFDM24); -break ;default :/* TODO */ break ;
drivers/staging/rtl8723bs/core/rtw_mlme_ext.c +0 -55
61 lines not on this page · raw message
drivers/staging/rtl8723bs/core/rtw_wlan_util.c +3 -11
@@ -62,9 +62,6 @@ u8 networktype_to_raid_ex(struct adapterif (cur_rf_type ==RF_1T1R ) { rf_type =RF_1T1R ; - }else if (IsSupportedVHT (psta->wireless_mode)) { -if (psta->ra_mask &0xffc00000 ) - rf_type =RF_2T2R ; }else if (IsSupportedHT (psta->wireless_mode)) {if (psta->ra_mask &0xfff00000 ) rf_type =RF_2T2R ;
@@ -74,7 +71,6 @@ u8 networktype_to_raid_ex(struct adaptercase WIRELESS_11B : raid =RATEID_IDX_B ;break ; -case WIRELESS_11A :case WIRELESS_11G : raid =RATEID_IDX_G ;break ;
@@ -82,8 +78,6 @@ u8 networktype_to_raid_ex(struct adapter raid =RATEID_IDX_BG ;break ;case WIRELESS_11_24N : -case WIRELESS_11_5N : -case WIRELESS_11A_5N :case WIRELESS_11G_24N :if (rf_type ==RF_2T2R ) raid =RATEID_IDX_GN_N2SS ;
@@ -810,7 +804,7 @@ void WMMOnAssocRsp(struct adapter *padapAIFS = aSifsTime + (2 * pmlmeinfo->slotTime); -if (pmlmeext->cur_wireless_mode & (WIRELESS_11G |WIRELESS_11A )) { +if (pmlmeext->cur_wireless_mode &WIRELESS_11G ) { ECWMin =4 ; ECWMax =10 ; }else if (pmlmeext->cur_wireless_mode &WIRELESS_11B ) {
@@ -1695,7 +1689,7 @@ void update_capinfo(struct adapter *Adap pmlmeinfo->slotTime =NON_SHORT_SLOT_TIME ; else {/* Filen: See 802.11-2007 p.90 */ -if (pmlmeext->cur_wireless_mode & (WIRELESS_11_24N |WIRELESS_11A |WIRELESS_11_5N |WIRELESS_11AC )) +if (pmlmeext->cur_wireless_mode & (WIRELESS_11_24N )) pmlmeinfo->slotTime =SHORT_SLOT_TIME ;else if (pmlmeext->cur_wireless_mode & (WIRELESS_11G )) {if ((updateCap & cShortSlotTime)/* && (!(pMgntInfo->pHTInfo->RT2RT_HT_Mode & RT_HT_CAP_USE_LONG_PREAMBLE)) */ )
@@ -1724,9 +1718,7 @@ void update_wireless_mode(struct adapterif ((pmlmeinfo->HT_info_enable) && (pmlmeinfo->HT_caps_enable)) pmlmeinfo->HT_enable =1 ; -if (pmlmeinfo->VHT_enable) - network_type =WIRELESS_11AC ; -else if (pmlmeinfo->HT_enable) +if (pmlmeinfo->HT_enable) network_type =WIRELESS_11_24N ;if (rtw_is_cckratesonly_included (rate))
drivers/staging/rtl8723bs/hal/odm.c +0 -30
@@ -975,7 +975,6 @@ u32 ODM_Get_Rate_Bitmap(break ;case (ODM_WM_G ): -case (ODM_WM_A ):if (rssi_level ==DM_RATR_STA_HIGH ) rate_bitmap =0x00000f00 ;else
@@ -994,7 +993,6 @@ u32 ODM_Get_Rate_Bitmap(case (ODM_WM_B |ODM_WM_G |ODM_WM_N24G ):case (ODM_WM_B |ODM_WM_N24G ):case (ODM_WM_G |ODM_WM_N24G ): -case (ODM_WM_A |ODM_WM_N5G ):if (pDM_Odm->RFType ==ODM_1T2R || pDM_Odm->RFType ==ODM_1T1R ) {if (rssi_level ==DM_RATR_STA_HIGH ) rate_bitmap =0x000f0000 ;
@@ -1020,34 +1018,6 @@ u32 ODM_Get_Rate_Bitmap( }break ; -case (ODM_WM_AC |ODM_WM_G ): -if (rssi_level ==1 ) - rate_bitmap =0xfc3f0000 ; -else if (rssi_level ==2 ) - rate_bitmap =0xfffff000 ; -else - rate_bitmap =0xffffffff ; -break ; - -case (ODM_WM_AC |ODM_WM_A ): - -if (pDM_Odm->RFType ==RF_1T1R ) { -if (rssi_level ==1 )/* add by Gary for ac-series */ - rate_bitmap =0x003f8000 ; -else if (rssi_level ==2 ) - rate_bitmap =0x003ff000 ; -else - rate_bitmap =0x003ff010 ; - }else { -if (rssi_level ==1 )/* add by Gary for ac-series */ - rate_bitmap =0xfe3f8000 ;/* VHT 2SS MCS3~9 */ -else if (rssi_level ==2 ) - rate_bitmap =0xfffff000 ;/* VHT 2SS MCS0~9 */ -else - rate_bitmap =0xfffff010 ;/* All */ - } -break ; -default :if (pDM_Odm->RFType ==RF_1T2R ) rate_bitmap =0x000fffff ;
drivers/staging/rtl8723bs/hal/odm.h +0 -3
@@ -541,11 +541,8 @@ typedef enum tag_Wireless_Mode_DefinitioODM_WM_UNKNOWN =0x0 ,ODM_WM_B =BIT0 ,ODM_WM_G =BIT1 , -ODM_WM_A =BIT2 ,ODM_WM_N24G =BIT3 , -ODM_WM_N5G =BIT4 ,ODM_WM_AUTO =BIT5 , -ODM_WM_AC =BIT6 , } ODM_WIRELESS_MODE_E;/* ODM_CMNINFO_BAND */
drivers/staging/rtl8723bs/hal/odm_EdcaTurboCheck.c +1 -3
@@ -142,12 +142,10 @@ void odm_EdcaTurboCheckCE(void *pDM_VOID }else if ((iot_peer ==HT_IOT_PEER_CISCO ) && ((wirelessmode ==ODM_WM_G ) || (wirelessmode == (ODM_WM_B |ODM_WM_G )) || - (wirelessmode ==ODM_WM_A ) || (wirelessmode ==ODM_WM_B ))) {EDCA_BE_DL = edca_setting_DL_GMode[iot_peer]; }else if ((iot_peer ==HT_IOT_PEER_AIRGO ) && - ((wirelessmode ==ODM_WM_G ) || - (wirelessmode ==ODM_WM_A ))) { + (wirelessmode ==ODM_WM_G )) {EDCA_BE_DL =0xa630 ; }else if (iot_peer ==HT_IOT_PEER_MARVELL ) {EDCA_BE_DL = edca_setting_DL[iot_peer];
drivers/staging/rtl8723bs/hal/sdio_halinit.c +0 -5
@@ -599,8 +599,6 @@ static void _InitOperationMode(struct adcase WIRELESS_MODE_B : regBwOpMode =BW_OPMODE_20MHZ ;break ; -case WIRELESS_MODE_A : -break ;case WIRELESS_MODE_G : regBwOpMode =BW_OPMODE_20MHZ ;break ;
@@ -612,9 +610,6 @@ static void _InitOperationMode(struct ad/* CCK rate will be filtered out only when associated AP does not support it. */ regBwOpMode =BW_OPMODE_20MHZ ;break ; -case WIRELESS_MODE_N_5G : - regBwOpMode =BW_OPMODE_5G ; -break ;default :/* for MacOSX compiler warning. */ break ;
drivers/staging/rtl8723bs/include/hal_phy.h +0 -3
@@ -118,13 +118,10 @@ enum HW_BLOCK {enum WIRELESS_MODE {WIRELESS_MODE_UNKNOWN =0x00 , -WIRELESS_MODE_A =0x01 ,WIRELESS_MODE_B =0x02 ,WIRELESS_MODE_G =0x04 ,WIRELESS_MODE_AUTO =0x08 ,WIRELESS_MODE_N_24G =0x10 , -WIRELESS_MODE_N_5G =0x20 , -WIRELESS_MODE_AC_5G =0x40 ,WIRELESS_MODE_AC_24G =0x80 ,WIRELESS_MODE_AC_ONLY =0x100 , };
drivers/staging/rtl8723bs/include/ieee80211.h +3 -19
@@ -157,33 +157,20 @@ enum NETWORK_TYPE {/* Sub-Element */ WIRELESS_11B =BIT (0 ),/* tx: cck only , rx: cck only, hw: cck */ WIRELESS_11G =BIT (1 ),/* tx: ofdm only, rx: ofdm & cck, hw: cck & ofdm */ -WIRELESS_11A =BIT (2 ),/* tx: ofdm only, rx: ofdm only, hw: ofdm only */ WIRELESS_11_24N =BIT (3 ),/* tx: MCS only, rx: MCS & cck, hw: MCS & cck */ -WIRELESS_11_5N =BIT (4 ),/* tx: MCS only, rx: MCS & ofdm, hw: ofdm only */ WIRELESS_AUTO =BIT (5 ), -WIRELESS_11AC =BIT (6 ),/* Combination */ /* Type for current wireless mode */ WIRELESS_11BG = (WIRELESS_11B |WIRELESS_11G ),/* tx: cck & ofdm, rx: cck & ofdm & MCS, hw: cck & ofdm */ WIRELESS_11G_24N = (WIRELESS_11G |WIRELESS_11_24N ),/* tx: ofdm & MCS, rx: ofdm & cck & MCS, hw: cck & ofdm */ -WIRELESS_11A_5N = (WIRELESS_11A |WIRELESS_11_5N ),/* tx: ofdm & MCS, rx: ofdm & MCS, hw: ofdm only */ WIRELESS_11B_24N = (WIRELESS_11B |WIRELESS_11_24N ),/* tx: ofdm & cck & MCS, rx: ofdm & cck & MCS, hw: ofdm & cck */ WIRELESS_11BG_24N = (WIRELESS_11B|WIRELESS_11G|WIRELESS_11_24N), /* tx: ofdm & cck & MCS, rx: ofdm & cck & MCS, hw: ofdm & cck */ -WIRELESS_11_24AC = (WIRELESS_11G |WIRELESS_11AC ), -WIRELESS_11_5AC = (WIRELESS_11A |WIRELESS_11AC ), - - -/* Type for registry default wireless mode */ -WIRELESS_11AGN = (WIRELESS_11A |WIRELESS_11G |WIRELESS_11_24N |WIRELESS_11_5N ),/* tx: ofdm & MCS, rx: ofdm & MCS, hw: ofdm only */ -WIRELESS_11ABGN = (WIRELESS_11A |WIRELESS_11B |WIRELESS_11G |WIRELESS_11_24N |WIRELESS_11_5N ), -WIRELESS_MODE_24G = (WIRELESS_11B |WIRELESS_11G |WIRELESS_11_24N |WIRELESS_11AC ), - WIRELESS_MODE_MAX = (WIRELESS_11A|WIRELESS_11B|WIRELESS_11G|WIRELESS_11_24N|WIRELESS_11_5N|WIRELESS_11AC), };#define SUPPORTED_24G_NETTYPE_MSK (WIRELESS_11B | WIRELESS_11G | WIRELESS_11_24N) -#define IsLegacyOnly (NetType) ((NetType) == ((NetType) & (WIRELESS_11BG|WIRELESS_11A))) +#define IsLegacyOnly (NetType) ((NetType) == ((NetType) & (WIRELESS_11BG)))#define IsSupported24G (NetType) ((NetType) & SUPPORTED_24G_NETTYPE_MSK ? true : false)
@@ -195,11 +182,8 @@ enum NETWORK_TYPE {#define IsSupportedRxHT (NetType) IsEnableHWOFDM(NetType)#define IsSupportedTxCCK (NetType) (((NetType) & (WIRELESS_11B)) ? true : false) -#define IsSupportedTxOFDM (NetType) (((NetType) & (WIRELESS_11G|WIRELESS_11A)) ? true : false) -#define IsSupportedHT (NetType) (((NetType) & (WIRELESS_11_24N|WIRELESS_11_5N)) ? true : false) - -#define IsSupportedVHT (NetType) (((NetType) & (WIRELESS_11AC)) ? true : false) - +#define IsSupportedTxOFDM (NetType) (((NetType) & (WIRELESS_11G) ? true : false) +#define IsSupportedHT (NetType) (((NetType) & (WIRELESS_11_24N)) ? true : false)struct ieee_param {u32 cmd;
drivers/staging/rtl8723bs/include/wifi.h +0 -1
@@ -457,7 +457,6 @@ static inline int IsFrameTypeCtrl(unsign#define _PRE_ALLOCICVHDR_ 5#define _PRE_ALLOCMICHDR_ 6 -#define _SIFSTIME_ ((priv->pmib->dot11BssType.net_work_type&WIRELESS_11A)?16:10)#define _ACKCTSLNG_ 14/* 14 bytes long, including crclng */ #define _CRCLNG_ 4
drivers/staging/rtl8723bs/os_dep/os_intfs.c +1 -1
@@ -24,7 +24,7 @@ static int rtw_lbkmode;/* RTL8712_AIR_TRstatic int rtw_network_mode = Ndis802_11IBSS;/* Ndis802_11Infrastructure;infra, ad-hoc, auto */ /* struct ndis_802_11_ssid ssid; */ static int rtw_channel =1 ;/* ad-hoc support requirement */ -static int rtw_wireless_mode =WIRELESS_MODE_MAX ; +static int rtw_wireless_mode =WIRELESS_11BG_24N ;static int rtw_vrtl_carrier_sense =AUTO_VCS ;static int rtw_vcs_type =RTS_CTS ;/* */ static int rtw_rts_thresh =2347 ;/* */
Greg Kroah-Hartman
maintainerPATCH 617/699 staging: rtl8723bs: remove 5Ghz code related to channel plan definition
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Fabio Aiuto <[email protected]>
[ Upstream commit ec84d0ae54a6774091b3b7d1e9da32589f48b2f9 ]
remove 5Ghz code related to channel plan definition.
Stable-dep-of: a1fc19d61f66 ("staging: rtl8723bs: fix WEP length underflow and OOB read in OnAuth()")
--- drivers/staging/rtl8723bs/core/rtw_mlme_ext.c | 210 +++++++++------------- drivers/staging/rtl8723bs/hal/hal_com_phycfg.c | 34 --- drivers/staging/rtl8723bs/include/rtw_mlme_ext.h | 6 drivers/staging/rtl8723bs/os_dep/ioctl_cfg80211.c | 2 drivers/staging/rtl8723bs/os_dep/ioctl_linux.c | 1 5 files changed, 94 insertions(+), 159 deletions(-)
drivers/staging/rtl8723bs/core/rtw_mlme_ext.c +92 -118
@@ -123,93 +123,93 @@ static RT_CHANNEL_PLAN_5G RTW_ChannelPlastatic RT_CHANNEL_PLAN_MAP RTW_ChannelPlanMap[RT_CHANNEL_DOMAIN_MAX ] = {/* 0x00 ~ 0x1F , Old Define ===== */ - {0x02 ,0x20 },/* 0x00, RT_CHANNEL_DOMAIN_FCC */ - {0x02 ,0x0A },/* 0x01, RT_CHANNEL_DOMAIN_IC */ - {0x01 ,0x01 },/* 0x02, RT_CHANNEL_DOMAIN_ETSI */ - {0x01 ,0x00 },/* 0x03, RT_CHANNEL_DOMAIN_SPAIN */ - {0x01 ,0x00 },/* 0x04, RT_CHANNEL_DOMAIN_FRANCE */ - {0x03 ,0x00 },/* 0x05, RT_CHANNEL_DOMAIN_MKK */ - {0x03 ,0x00 },/* 0x06, RT_CHANNEL_DOMAIN_MKK1 */ - {0x01 ,0x09 },/* 0x07, RT_CHANNEL_DOMAIN_ISRAEL */ - {0x03 ,0x09 },/* 0x08, RT_CHANNEL_DOMAIN_TELEC */ - {0x03 ,0x00 },/* 0x09, RT_CHANNEL_DOMAIN_GLOBAL_DOAMIN */ - {0x00 ,0x00 },/* 0x0A, RT_CHANNEL_DOMAIN_WORLD_WIDE_13 */ - {0x02 ,0x0F },/* 0x0B, RT_CHANNEL_DOMAIN_TAIWAN */ - {0x01 ,0x08 },/* 0x0C, RT_CHANNEL_DOMAIN_CHINA */ - {0x02 ,0x06 },/* 0x0D, RT_CHANNEL_DOMAIN_SINGAPORE_INDIA_MEXICO */ - {0x02 ,0x0B },/* 0x0E, RT_CHANNEL_DOMAIN_KOREA */ - {0x02 ,0x09 },/* 0x0F, RT_CHANNEL_DOMAIN_TURKEY */ - {0x01 ,0x01 },/* 0x10, RT_CHANNEL_DOMAIN_JAPAN */ - {0x02 ,0x05 },/* 0x11, RT_CHANNEL_DOMAIN_FCC_NO_DFS */ - {0x01 ,0x21 },/* 0x12, RT_CHANNEL_DOMAIN_JAPAN_NO_DFS */ - {0x00 ,0x04 },/* 0x13, RT_CHANNEL_DOMAIN_WORLD_WIDE_5G */ - {0x02 ,0x10 },/* 0x14, RT_CHANNEL_DOMAIN_TAIWAN_NO_DFS */ - {0x00 ,0x21 },/* 0x15, RT_CHANNEL_DOMAIN_ETSI_NO_DFS */ - {0x00 ,0x22 },/* 0x16, RT_CHANNEL_DOMAIN_KOREA_NO_DFS */ - {0x03 ,0x21 },/* 0x17, RT_CHANNEL_DOMAIN_JAPAN_NO_DFS */ - {0x06 ,0x08 },/* 0x18, RT_CHANNEL_DOMAIN_PAKISTAN_NO_DFS */ - {0x02 ,0x08 },/* 0x19, RT_CHANNEL_DOMAIN_TAIWAN2_NO_DFS */ - {0x00 ,0x00 },/* 0x1A, */ - {0x00 ,0x00 },/* 0x1B, */ - {0x00 ,0x00 },/* 0x1C, */ - {0x00 ,0x00 },/* 0x1D, */ - {0x00 ,0x00 },/* 0x1E, */ - {0x06 ,0x04 },/* 0x1F, RT_CHANNEL_DOMAIN_WORLD_WIDE_ONLY_5G */ + {0x02 },/* 0x00, RT_CHANNEL_DOMAIN_FCC */ + {0x02 },/* 0x01, RT_CHANNEL_DOMAIN_IC */ + {0x01 },/* 0x02, RT_CHANNEL_DOMAIN_ETSI */ + {0x01 },/* 0x03, RT_CHANNEL_DOMAIN_SPAIN */ + {0x01 },/* 0x04, RT_CHANNEL_DOMAIN_FRANCE */ + {0x03 },/* 0x05, RT_CHANNEL_DOMAIN_MKK */ + {0x03 },/* 0x06, RT_CHANNEL_DOMAIN_MKK1 */ + {0x01 },/* 0x07, RT_CHANNEL_DOMAIN_ISRAEL */ + {0x03 },/* 0x08, RT_CHANNEL_DOMAIN_TELEC */ + {0x03 },/* 0x09, RT_CHANNEL_DOMAIN_GLOBAL_DOAMIN */ + {0x00 },/* 0x0A, RT_CHANNEL_DOMAIN_WORLD_WIDE_13 */ + {0x02 },/* 0x0B, RT_CHANNEL_DOMAIN_TAIWAN */ + {0x01 },/* 0x0C, RT_CHANNEL_DOMAIN_CHINA */ + {0x02 },/* 0x0D, RT_CHANNEL_DOMAIN_SINGAPORE_INDIA_MEXICO */ + {0x02 },/* 0x0E, RT_CHANNEL_DOMAIN_KOREA */ + {0x02 },/* 0x0F, RT_CHANNEL_DOMAIN_TURKEY */ + {0x01 },/* 0x10, RT_CHANNEL_DOMAIN_JAPAN */ + {0x02 },/* 0x11, RT_CHANNEL_DOMAIN_FCC_NO_DFS */ + {0x01 },/* 0x12, RT_CHANNEL_DOMAIN_JAPAN_NO_DFS */ + {0x00 },/* 0x13, RT_CHANNEL_DOMAIN_WORLD_WIDE_5G */ + {0x02 },/* 0x14, RT_CHANNEL_DOMAIN_TAIWAN_NO_DFS */ + {0x00 },/* 0x15, RT_CHANNEL_DOMAIN_ETSI_NO_DFS */ + {0x00 },/* 0x16, RT_CHANNEL_DOMAIN_KOREA_NO_DFS */ + {0x03 },/* 0x17, RT_CHANNEL_DOMAIN_JAPAN_NO_DFS */ + {0x06 },/* 0x18, RT_CHANNEL_DOMAIN_PAKISTAN_NO_DFS */ + {0x02 },/* 0x19, RT_CHANNEL_DOMAIN_TAIWAN2_NO_DFS */ + {0x00 },/* 0x1A, */ + {0x00 },/* 0x1B, */ + {0x00 },/* 0x1C, */ + {0x00 },/* 0x1D, */ + {0x00 },/* 0x1E, */ + {0x06 },/* 0x1F, RT_CHANNEL_DOMAIN_WORLD_WIDE_ONLY_5G */ /* 0x20 ~ 0x7F , New Define ===== */ - {0x00 ,0x00 },/* 0x20, RT_CHANNEL_DOMAIN_WORLD_NULL */ - {0x01 ,0x00 },/* 0x21, RT_CHANNEL_DOMAIN_ETSI1_NULL */ - {0x02 ,0x00 },/* 0x22, RT_CHANNEL_DOMAIN_FCC1_NULL */ - {0x03 ,0x00 },/* 0x23, RT_CHANNEL_DOMAIN_MKK1_NULL */ - {0x04 ,0x00 },/* 0x24, RT_CHANNEL_DOMAIN_ETSI2_NULL */ - {0x02 ,0x04 },/* 0x25, RT_CHANNEL_DOMAIN_FCC1_FCC1 */ - {0x00 ,0x01 },/* 0x26, RT_CHANNEL_DOMAIN_WORLD_ETSI1 */ - {0x03 ,0x0C },/* 0x27, RT_CHANNEL_DOMAIN_MKK1_MKK1 */ - {0x00 ,0x0B },/* 0x28, RT_CHANNEL_DOMAIN_WORLD_KCC1 */ - {0x00 ,0x05 },/* 0x29, RT_CHANNEL_DOMAIN_WORLD_FCC2 */ - {0x00 ,0x00 },/* 0x2A, */ - {0x00 ,0x00 },/* 0x2B, */ - {0x00 ,0x00 },/* 0x2C, */ - {0x00 ,0x00 },/* 0x2D, */ - {0x00 ,0x00 },/* 0x2E, */ - {0x00 ,0x00 },/* 0x2F, */ - {0x00 ,0x06 },/* 0x30, RT_CHANNEL_DOMAIN_WORLD_FCC3 */ - {0x00 ,0x07 },/* 0x31, RT_CHANNEL_DOMAIN_WORLD_FCC4 */ - {0x00 ,0x08 },/* 0x32, RT_CHANNEL_DOMAIN_WORLD_FCC5 */ - {0x00 ,0x09 },/* 0x33, RT_CHANNEL_DOMAIN_WORLD_FCC6 */ - {0x02 ,0x0A },/* 0x34, RT_CHANNEL_DOMAIN_FCC1_FCC7 */ - {0x00 ,0x02 },/* 0x35, RT_CHANNEL_DOMAIN_WORLD_ETSI2 */ - {0x00 ,0x03 },/* 0x36, RT_CHANNEL_DOMAIN_WORLD_ETSI3 */ - {0x03 ,0x0D },/* 0x37, RT_CHANNEL_DOMAIN_MKK1_MKK2 */ - {0x03 ,0x0E },/* 0x38, RT_CHANNEL_DOMAIN_MKK1_MKK3 */ - {0x02 ,0x0F },/* 0x39, RT_CHANNEL_DOMAIN_FCC1_NCC1 */ - {0x00 ,0x00 },/* 0x3A, */ - {0x00 ,0x00 },/* 0x3B, */ - {0x00 ,0x00 },/* 0x3C, */ - {0x00 ,0x00 },/* 0x3D, */ - {0x00 ,0x00 },/* 0x3E, */ - {0x00 ,0x00 },/* 0x3F, */ - {0x02 ,0x10 },/* 0x40, RT_CHANNEL_DOMAIN_FCC1_NCC2 */ - {0x05 ,0x00 },/* 0x41, RT_CHANNEL_DOMAIN_GLOBAL_NULL */ - {0x01 ,0x12 },/* 0x42, RT_CHANNEL_DOMAIN_ETSI1_ETSI4 */ - {0x02 ,0x05 },/* 0x43, RT_CHANNEL_DOMAIN_FCC1_FCC2 */ - {0x02 ,0x11 },/* 0x44, RT_CHANNEL_DOMAIN_FCC1_NCC3 */ - {0x00 ,0x13 },/* 0x45, RT_CHANNEL_DOMAIN_WORLD_ETSI5 */ - {0x02 ,0x14 },/* 0x46, RT_CHANNEL_DOMAIN_FCC1_FCC8 */ - {0x00 ,0x15 },/* 0x47, RT_CHANNEL_DOMAIN_WORLD_ETSI6 */ - {0x00 ,0x16 },/* 0x48, RT_CHANNEL_DOMAIN_WORLD_ETSI7 */ - {0x00 ,0x17 },/* 0x49, RT_CHANNEL_DOMAIN_WORLD_ETSI8 */ - {0x00 ,0x18 },/* 0x50, RT_CHANNEL_DOMAIN_WORLD_ETSI9 */ - {0x00 ,0x19 },/* 0x51, RT_CHANNEL_DOMAIN_WORLD_ETSI10 */ - {0x00 ,0x1A },/* 0x52, RT_CHANNEL_DOMAIN_WORLD_ETSI11 */ - {0x02 ,0x1B },/* 0x53, RT_CHANNEL_DOMAIN_FCC1_NCC4 */ - {0x00 ,0x1C },/* 0x54, RT_CHANNEL_DOMAIN_WORLD_ETSI12 */ - {0x02 ,0x1D },/* 0x55, RT_CHANNEL_DOMAIN_FCC1_FCC9 */ - {0x00 ,0x1E },/* 0x56, RT_CHANNEL_DOMAIN_WORLD_ETSI13 */ - {0x02 ,0x1F },/* 0x57, RT_CHANNEL_DOMAIN_FCC1_FCC10 */ + {0x00 },/* 0x20, RT_CHANNEL_DOMAIN_WORLD_NULL */ + {0x01 },/* 0x21, RT_CHANNEL_DOMAIN_ETSI1_NULL */ + {0x02 },/* 0x22, RT_CHANNEL_DOMAIN_FCC1_NULL */ + {0x03 },/* 0x23, RT_CHANNEL_DOMAIN_MKK1_NULL */ + {0x04 },/* 0x24, RT_CHANNEL_DOMAIN_ETSI2_NULL */ + {0x02 },/* 0x25, RT_CHANNEL_DOMAIN_FCC1_FCC1 */ + {0x00 },/* 0x26, RT_CHANNEL_DOMAIN_WORLD_ETSI1 */ + {0x03 },/* 0x27, RT_CHANNEL_DOMAIN_MKK1_MKK1 */ + {0x00 },/* 0x28, RT_CHANNEL_DOMAIN_WORLD_KCC1 */ + {0x00 },/* 0x29, RT_CHANNEL_DOMAIN_WORLD_FCC2 */ + {0x00 },/* 0x2A, */ + {0x00 },/* 0x2B, */ + {0x00 },/* 0x2C, */ + {0x00 },/* 0x2D, */ + {0x00 },/* 0x2E, */ + {0x00 },/* 0x2F, */ + {0x00 },/* 0x30, RT_CHANNEL_DOMAIN_WORLD_FCC3 */ + {0x00 },/* 0x31, RT_CHANNEL_DOMAIN_WORLD_FCC4 */ + {0x00 },/* 0x32, RT_CHANNEL_DOMAIN_WORLD_FCC5 */ + {0x00 },/* 0x33, RT_CHANNEL_DOMAIN_WORLD_FCC6 */ + {0x02 },/* 0x34, RT_CHANNEL_DOMAIN_FCC1_FCC7 */ + {0x00 },/* 0x35, RT_CHANNEL_DOMAIN_WORLD_ETSI2 */ + {0x00 },/* 0x36, RT_CHANNEL_DOMAIN_WORLD_ETSI3 */ + {0x03 },/* 0x37, RT_CHANNEL_DOMAIN_MKK1_MKK2 */ + {0x03 },/* 0x38, RT_CHANNEL_DOMAIN_MKK1_MKK3 */ + {0x02 },/* 0x39, RT_CHANNEL_DOMAIN_FCC1_NCC1 */ + {0x00 },/* 0x3A, */ + {0x00 },/* 0x3B, */ + {0x00 },/* 0x3C, */ + {0x00 },/* 0x3D, */ + {0x00 },/* 0x3E, */ + {0x00 },/* 0x3F, */ + {0x02 },/* 0x40, RT_CHANNEL_DOMAIN_FCC1_NCC2 */ + {0x05 },/* 0x41, RT_CHANNEL_DOMAIN_GLOBAL_NULL */ + {0x01 },/* 0x42, RT_CHANNEL_DOMAIN_ETSI1_ETSI4 */ + {0x02 },/* 0x43, RT_CHANNEL_DOMAIN_FCC1_FCC2 */ + {0x02 },/* 0x44, RT_CHANNEL_DOMAIN_FCC1_NCC3 */ + {0x00 },/* 0x45, RT_CHANNEL_DOMAIN_WORLD_ETSI5 */ + {0x02 },/* 0x46, RT_CHANNEL_DOMAIN_FCC1_FCC8 */ + {0x00 },/* 0x47, RT_CHANNEL_DOMAIN_WORLD_ETSI6 */ + {0x00 },/* 0x48, RT_CHANNEL_DOMAIN_WORLD_ETSI7 */ + {0x00 },/* 0x49, RT_CHANNEL_DOMAIN_WORLD_ETSI8 */ + {0x00 },/* 0x50, RT_CHANNEL_DOMAIN_WORLD_ETSI9 */ + {0x00 },/* 0x51, RT_CHANNEL_DOMAIN_WORLD_ETSI10 */ + {0x00 },/* 0x52, RT_CHANNEL_DOMAIN_WORLD_ETSI11 */ + {0x02 },/* 0x53, RT_CHANNEL_DOMAIN_FCC1_NCC4 */ + {0x00 },/* 0x54, RT_CHANNEL_DOMAIN_WORLD_ETSI12 */ + {0x02 },/* 0x55, RT_CHANNEL_DOMAIN_FCC1_FCC9 */ + {0x00 },/* 0x56, RT_CHANNEL_DOMAIN_WORLD_ETSI13 */ + {0x02 },/* 0x57, RT_CHANNEL_DOMAIN_FCC1_FCC10 */ };/* use the combination for max channel numbers */ -static RT_CHANNEL_PLAN_MAP RTW_CHANNEL_PLAN_MAP_REALTEK_DEFINE = {0x03 ,0x02 }; +static RT_CHANNEL_PLAN_MAP RTW_CHANNEL_PLAN_MAP_REALTEK_DEFINE = {0x03 };/* Search the @param ch in given @param ch_set * @ch_set: the given channel set
@@ -231,23 +231,6 @@ int rtw_ch_set_search_ch(RT_CHANNEL_INFOreturn i; } -/* Check the @param ch is fit with setband setting of @param adapter -* @adapter: the given adapter -* @ch: the given channel number -* -* return true when check valid, false not valid -*/ -bool rtw_mlme_band_check (struct adapter *adapter,const u32 ch) -{ -if (adapter->setband ==GHZ24_50 /* 2.4G and 5G */ - || (adapter->setband ==GHZ_24 && ch <35 )/* 2.4G only */ - || (adapter->setband ==GHZ_50 && ch >35 )/* 5G only */ - ) { -return true; - } -return false; -} -/**************************************************************************** Following are the initialization functions for WiFi MLME
@@ -424,7 +407,6 @@ static u8 init_channel_set(struct adapteelse if ((channel_set[chanset_size].ChannelNum >=12 && channel_set[chanset_size].ChannelNum <=14 )) channel_set[chanset_size].ScanType =SCAN_PASSIVE ; }else if (RT_CHANNEL_DOMAIN_WORLD_WIDE_13 == ChannelPlan || -RT_CHANNEL_DOMAIN_WORLD_WIDE_5G == ChannelPlan ||RT_CHANNEL_DOMAIN_2G_WORLD == Index2G) {/* channel 12~13, passive scan */ if (channel_set[chanset_size].ChannelNum <=11 ) channel_set[chanset_size].ScanType =SCAN_ACTIVE ;
@@ -4938,10 +4920,6 @@ static void process_80211d(struct adaptewhile ((i <MAX_CHANNEL_NUM ) && (chplan_new[i].ChannelNum !=0 )) {if (chplan_new[i].ChannelNum == channel) {if (chplan_new[i].ScanType ==SCAN_PASSIVE ) { -/* 5G Bnad 2, 3 (DFS) doesn't change to active scan */ -if (channel >=52 && channel <=144 ) -break ; - chplan_new[i].ScanType =SCAN_ACTIVE ; RT_TRACE(_module_rtl871x_mlme_c_, _drv_notice_, ("%s: change channel %d scan type from passive to active\n",
@@ -6250,7 +6228,6 @@ static int rtw_scan_ch_decision(struct a set_idx =rtw_ch_set_search_ch (pmlmeext->channel_set, in[i].hw_value);if (in[i].hw_value && !(in[i].flags &RTW_IEEE80211_CHAN_DISABLED ) && set_idx >=0 - &&rtw_mlme_band_check (padapter, in[i].hw_value) ) {if (j >= out_num) { DBG_871X_LEVEL(_drv_always_, FUNC_ADPT_FMT" out_num:%u not enough\n",
@@ -6275,21 +6252,18 @@ static int rtw_scan_ch_decision(struct aDBG_871X (FUNC_ADPT_FMT " ch:%u\n" ,FUNC_ADPT_ARG (padapter), pmlmeext->channel_set[i].ChannelNum); -if (rtw_mlme_band_check (padapter, pmlmeext->channel_set[i].ChannelNum)) { - -if (j >= out_num) { -DBG_871X_LEVEL (_drv_always_,FUNC_ADPT_FMT " out_num:%u not enough\n" , -FUNC_ADPT_ARG (padapter), out_num); -break ; - } +if (j >= out_num) { +DBG_871X_LEVEL (_drv_always_,FUNC_ADPT_FMT " out_num:%u not enough\n" , +FUNC_ADPT_ARG (padapter), out_num); +break ; + } - out[j].hw_value = pmlmeext->channel_set[i].ChannelNum; + out[j].hw_value = pmlmeext->channel_set[i].ChannelNum; -if (pmlmeext->channel_set[i].ScanType ==SCAN_PASSIVE ) - out[j].flags |=RTW_IEEE80211_CHAN_PASSIVE_SCAN ; +if (pmlmeext->channel_set[i].ScanType ==SCAN_PASSIVE ) + out[j].flags |=RTW_IEEE80211_CHAN_PASSIVE_SCAN ; - j++; - } + j++; } }
drivers/staging/rtl8723bs/hal/hal_com_phycfg.c +0 -34
@@ -2062,139 +2062,105 @@ void Hal_ChannelPlanToRegulation(structbreak ;case RT_CHANNEL_DOMAIN_FCC1_FCC1 : pHalData->Regulation2_4G =TXPWR_LMT_FCC ; - pHalData->Regulation5G =TXPWR_LMT_FCC ;break ;case RT_CHANNEL_DOMAIN_WORLD_ETSI1 : pHalData->Regulation2_4G =TXPWR_LMT_FCC ; - pHalData->Regulation5G =TXPWR_LMT_ETSI ;break ;case RT_CHANNEL_DOMAIN_MKK1_MKK1 : pHalData->Regulation2_4G =TXPWR_LMT_MKK ; - pHalData->Regulation5G =TXPWR_LMT_MKK ;break ;case RT_CHANNEL_DOMAIN_WORLD_KCC1 : pHalData->Regulation2_4G =TXPWR_LMT_FCC ; - pHalData->Regulation5G =TXPWR_LMT_MKK ;break ;case RT_CHANNEL_DOMAIN_WORLD_FCC2 : pHalData->Regulation2_4G =TXPWR_LMT_FCC ; - pHalData->Regulation5G =TXPWR_LMT_FCC ;break ;case RT_CHANNEL_DOMAIN_WORLD_FCC3 : pHalData->Regulation2_4G =TXPWR_LMT_FCC ; - pHalData->Regulation5G =TXPWR_LMT_FCC ;break ;case RT_CHANNEL_DOMAIN_WORLD_FCC4 : pHalData->Regulation2_4G =TXPWR_LMT_FCC ; - pHalData->Regulation5G =TXPWR_LMT_FCC ;break ;case RT_CHANNEL_DOMAIN_WORLD_FCC5 : pHalData->Regulation2_4G =TXPWR_LMT_FCC ; - pHalData->Regulation5G =TXPWR_LMT_FCC ;break ;case RT_CHANNEL_DOMAIN_WORLD_FCC6 : pHalData->Regulation2_4G =TXPWR_LMT_FCC ; - pHalData->Regulation5G =TXPWR_LMT_FCC ;break ;case RT_CHANNEL_DOMAIN_FCC1_FCC7 : pHalData->Regulation2_4G =TXPWR_LMT_FCC ; - pHalData->Regulation5G =TXPWR_LMT_FCC ;break ;case RT_CHANNEL_DOMAIN_WORLD_ETSI2 : pHalData->Regulation2_4G =TXPWR_LMT_FCC ; - pHalData->Regulation5G =TXPWR_LMT_FCC ;break ;case RT_CHANNEL_DOMAIN_WORLD_ETSI3 : pHalData->Regulation2_4G =TXPWR_LMT_FCC ; - pHalData->Regulation5G =TXPWR_LMT_FCC ;break ;case RT_CHANNEL_DOMAIN_MKK1_MKK2 : pHalData->Regulation2_4G =TXPWR_LMT_MKK ; - pHalData->Regulation5G =TXPWR_LMT_FCC ;break ;case RT_CHANNEL_DOMAIN_MKK1_MKK3 : pHalData->Regulation2_4G =TXPWR_LMT_MKK ; - pHalData->Regulation5G =TXPWR_LMT_FCC ;break ;case RT_CHANNEL_DOMAIN_FCC1_NCC1 : pHalData->Regulation2_4G =TXPWR_LMT_FCC ; - pHalData->Regulation5G =TXPWR_LMT_FCC ;break ;case RT_CHANNEL_DOMAIN_FCC1_NCC2 : pHalData->Regulation2_4G =TXPWR_LMT_FCC ; - pHalData->Regulation5G =TXPWR_LMT_FCC ;break ;case RT_CHANNEL_DOMAIN_GLOBAL_NULL : pHalData->Regulation2_4G =TXPWR_LMT_WW ; - pHalData->Regulation5G =TXPWR_LMT_WW ;break ;case RT_CHANNEL_DOMAIN_ETSI1_ETSI4 : pHalData->Regulation2_4G =TXPWR_LMT_ETSI ; - pHalData->Regulation5G =TXPWR_LMT_ETSI ;break ;case RT_CHANNEL_DOMAIN_FCC1_FCC2 : pHalData->Regulation2_4G =TXPWR_LMT_FCC ; - pHalData->Regulation5G =TXPWR_LMT_FCC ;break ;case RT_CHANNEL_DOMAIN_FCC1_NCC3 : pHalData->Regulation2_4G =TXPWR_LMT_FCC ; - pHalData->Regulation5G =TXPWR_LMT_FCC ;break ;case RT_CHANNEL_DOMAIN_WORLD_ETSI5 : pHalData->Regulation2_4G =TXPWR_LMT_ETSI ; - pHalData->Regulation5G =TXPWR_LMT_ETSI ;break ;case RT_CHANNEL_DOMAIN_FCC1_FCC8 : pHalData->Regulation2_4G =TXPWR_LMT_FCC ; - pHalData->Regulation5G =TXPWR_LMT_FCC ;break ;case RT_CHANNEL_DOMAIN_WORLD_ETSI6 : pHalData->Regulation2_4G =TXPWR_LMT_ETSI ; - pHalData->Regulation5G =TXPWR_LMT_ETSI ;break ;case RT_CHANNEL_DOMAIN_WORLD_ETSI7 : pHalData->Regulation2_4G =TXPWR_LMT_ETSI ; - pHalData->Regulation5G =TXPWR_LMT_ETSI ;break ;case RT_CHANNEL_DOMAIN_WORLD_ETSI8 : pHalData->Regulation2_4G =TXPWR_LMT_ETSI ; - pHalData->Regulation5G =TXPWR_LMT_ETSI ;break ;case RT_CHANNEL_DOMAIN_WORLD_ETSI9 : pHalData->Regulation2_4G =TXPWR_LMT_ETSI ; - pHalData->Regulation5G =TXPWR_LMT_ETSI ;break ;case RT_CHANNEL_DOMAIN_WORLD_ETSI10 : pHalData->Regulation2_4G =TXPWR_LMT_ETSI ; - pHalData->Regulation5G =TXPWR_LMT_ETSI ;break ;case RT_CHANNEL_DOMAIN_WORLD_ETSI11 : pHalData->Regulation2_4G =TXPWR_LMT_ETSI ; - pHalData->Regulation5G =TXPWR_LMT_ETSI ;break ;case RT_CHANNEL_DOMAIN_FCC1_NCC4 : pHalData->Regulation2_4G =TXPWR_LMT_FCC ; - pHalData->Regulation5G =TXPWR_LMT_FCC ;break ;case RT_CHANNEL_DOMAIN_WORLD_ETSI12 : pHalData->Regulation2_4G =TXPWR_LMT_ETSI ; - pHalData->Regulation5G =TXPWR_LMT_ETSI ;break ;case RT_CHANNEL_DOMAIN_FCC1_FCC9 : pHalData->Regulation2_4G =TXPWR_LMT_FCC ; - pHalData->Regulation5G =TXPWR_LMT_FCC ;break ;case RT_CHANNEL_DOMAIN_WORLD_ETSI13 : pHalData->Regulation2_4G =TXPWR_LMT_ETSI ; - pHalData->Regulation5G =TXPWR_LMT_ETSI ;break ;case RT_CHANNEL_DOMAIN_FCC1_FCC10 : pHalData->Regulation2_4G =TXPWR_LMT_FCC ; - pHalData->Regulation5G =TXPWR_LMT_FCC ;break ;case RT_CHANNEL_DOMAIN_REALTEK_DEFINE :/* Realtek Reserve */ pHalData->Regulation2_4G =TXPWR_LMT_WW ; - pHalData->Regulation5G =TXPWR_LMT_WW ;break ;default :break ;
drivers/staging/rtl8723bs/include/rtw_mlme_ext.h +2 -4
@@ -255,7 +255,6 @@ typedef struct _RT_CHANNEL_PLAN_5G {typedef struct _RT_CHANNEL_PLAN_MAP {unsigned char Index2G; -unsigned char Index5G; }RT_CHANNEL_PLAN_MAP , *PRT_CHANNEL_PLAN_MAP ;enum Associated_AP {
@@ -360,13 +359,13 @@ struct FW_Sta_Info {* When the driver scanned RTW_SCAN_NUM_OF_CH channels, it would switch back to AP's operating channel for * RTW_STAY_AP_CH_MILLISECOND * SURVEY_TO milliseconds. * Example: -* For chip supports 2.4G + 5GHz and AP mode is operating in channel 1, +* For chip supports 2.4G and AP mode is operating in channel 1, * RTW_SCAN_NUM_OF_CH is 8, RTW_STAY_AP_CH_MILLISECOND is 3 and SURVEY_TO is 100. * When it's STA mode gets set_scan command, * it would * 1. Doing the scan on channel 1.2.3.4.5.6.7.8 * 2. Back to channel 1 for 300 milliseconds -* 3. Go through doing site survey on channel 9.10.11.36.40.44.48.52 +* 3. Go through doing site survey on channel 9.10.11 * 4. Back to channel 1 for 300 milliseconds * 5. ... and so on, till survey done. */
@@ -423,7 +422,6 @@ typedef struct _RT_CHANNEL_INFO { }RT_CHANNEL_INFO , *PRT_CHANNEL_INFO ;int rtw_ch_set_search_ch (RT_CHANNEL_INFO *ch_set,const u32 ch); -bool rtw_mlme_band_check (struct adapter *adapter,const u32 ch);/* P2P_MAX_REG_CLASSES - Maximum number of regulatory classes */ #define P2P_MAX_REG_CLASSES 10
drivers/staging/rtl8723bs/os_dep/ioctl_cfg80211.c +0 -2
@@ -77,7 +77,6 @@ static struct ieee80211_rate rtw_rates[]#define RTW_G_RATES_NUM 12#define RTW_2G_CHANNELS_NUM 14 -#define RTW_5G_CHANNELS_NUM 37static struct ieee80211_channel rtw_2ghz_channels[] = {CHAN2G (1 ,2412 ,0 ),
@@ -1422,7 +1421,6 @@ void rtw_cfg80211_surveydone_event_callb/* report network only if the current channel set contains the channel to which this network belongs */ if (rtw_ch_set_search_ch (padapter->mlmeextpriv.channel_set, pnetwork->network.Configuration.DSConfig) >=0 - &&rtw_mlme_band_check (padapter, pnetwork->network.Configuration.DSConfig) == true && true ==rtw_validate_ssid (&(pnetwork->network.Ssid)) ) {
drivers/staging/rtl8723bs/os_dep/ioctl_linux.c +0 -1
@@ -1462,7 +1462,6 @@ static int rtw_wx_get_scan(struct net_de/* report network only if the current channel set contains the channel to which this network belongs */ if (rtw_ch_set_search_ch (padapter->mlmeextpriv.channel_set, pnetwork->network.Configuration.DSConfig) >=0 - &&rtw_mlme_band_check (padapter, pnetwork->network.Configuration.DSConfig) == true && true ==rtw_validate_ssid (&(pnetwork->network.Ssid))) { ev =translate_scan (padapter, a, pnetwork, ev, stop);
Greg Kroah-Hartman
maintainerPATCH 618/699 staging: rtl8723bs: remove 5Ghz code blocks
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Fabio Aiuto <[email protected]>
[ Upstream commit ddd7c8b0033ba01a0ee605697f12a33fd31e6fca ]
remove 5 Ghz code blocks, related to networks
working over channel numbers above 14.
Stable-dep-of: a1fc19d61f66 ("staging: rtl8723bs: fix WEP length underflow and OOB read in OnAuth()")
--- drivers/staging/rtl8723bs/core/rtw_mlme_ext.c | 7 ++----- drivers/staging/rtl8723bs/os_dep/ioctl_linux.c | 20 +++----------------- 2 files changed, 5 insertions(+), 22 deletions(-)
drivers/staging/rtl8723bs/core/rtw_mlme_ext.c +2 -5
@@ -4116,7 +4116,7 @@ static void issue_action_BSSCoexistPacke p =rtw_get_ie (pbss_network->IEs + _FIXED_IE_LENGTH_, _HT_CAPABILITY_IE_, &len, pbss_network->IELength - _FIXED_IE_LENGTH_);if ((p ==NULL ) || (len ==0 )) {/* non-HT */ -if ((pbss_network->Configuration.DSConfig <=0 ) || (pbss_network->Configuration.DSConfig >14 )) +if (pbss_network->Configuration.DSConfig <=0 )continue ;ICS [0 ][pbss_network->Configuration.DSConfig] =1 ;
@@ -6118,10 +6118,7 @@ u8 join_cmd_hdl(struct adapter *padapter {struct HT_info_element *pht_info = (struct HT_info_element *)(pIE->data); -if (pnetwork->Configuration.DSConfig >14 ) { -if ((pregpriv->bw_mode >>4 ) >CHANNEL_WIDTH_20 ) - cbw40_enable =1 ; - }else { +if (pnetwork->Configuration.DSConfig <=14 ) {if ((pregpriv->bw_mode &0x0f ) >CHANNEL_WIDTH_20 ) cbw40_enable =1 ; }
drivers/staging/rtl8723bs/os_dep/ioctl_linux.c +3 -17
@@ -135,14 +135,7 @@ static char *translate_scan(struct adaptelse snprintf (iwe.u.name,IFNAMSIZ ,"IEEE 802.11bg" ); }else { -if (pnetwork->network.Configuration.DSConfig >14 ) { -if (vht_cap) -snprintf (iwe.u.name,IFNAMSIZ ,"IEEE 802.11AC" ); -else if (ht_cap) -snprintf (iwe.u.name,IFNAMSIZ ,"IEEE 802.11an" ); -else -snprintf (iwe.u.name,IFNAMSIZ ,"IEEE 802.11a" ); - }else { +if (pnetwork->network.Configuration.DSConfig <=14 ) {if (ht_cap)snprintf (iwe.u.name,IFNAMSIZ ,"IEEE 802.11gn" );else
@@ -762,7 +755,7 @@ static int rtw_wx_get_name(struct net_destruct adapter *padapter = (struct adapter *)rtw_netdev_priv (dev);u32 ht_ielen =0 ;char *p; -u8 ht_cap = false, vht_cap = false; +u8 ht_cap = false;struct mlme_priv *pmlmepriv = &(padapter->mlmepriv);struct wlan_bssid_ex *pcur_bss = &pmlmepriv->cur_network.network;NDIS_802_11_RATES_EX * prates =NULL ;
@@ -788,14 +781,7 @@ static int rtw_wx_get_name(struct net_deelse snprintf (wrqu->name,IFNAMSIZ ,"IEEE 802.11bg" ); }else { -if (pcur_bss->Configuration.DSConfig >14 ) { -if (vht_cap) -snprintf (wrqu->name,IFNAMSIZ ,"IEEE 802.11AC" ); -else if (ht_cap) -snprintf (wrqu->name,IFNAMSIZ ,"IEEE 802.11an" ); -else -snprintf (wrqu->name,IFNAMSIZ ,"IEEE 802.11a" ); - }else { +if (pcur_bss->Configuration.DSConfig <=14 ) {if (ht_cap)snprintf (wrqu->name,IFNAMSIZ ,"IEEE 802.11gn" );else
Greg Kroah-Hartman
maintainerPATCH 619/699 staging: rtl8723bs: remove commented out condition
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Fabio Aiuto <[email protected]>
[ Upstream commit 2a62ff13132a22a754d042b2230117bbea0af477 ]
remove commented out condition checking channel > 14.
Stable-dep-of: a1fc19d61f66 ("staging: rtl8723bs: fix WEP length underflow and OOB read in OnAuth()")
--- drivers/staging/rtl8723bs/os_dep/ioctl_linux.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/staging/rtl8723bs/os_dep/ioctl_linux.c +1 -1
@@ -165,7 +165,7 @@ static char *translate_scan(struct adapt start =iwe_stream_add_event (info, start, stop, &iwe,IW_EV_UINT_LEN ); } -if (pnetwork->network.Configuration.DSConfig <1 /*|| pnetwork->network.Configuration.DSConfig > 14*/ ) +if (pnetwork->network.Configuration.DSConfig <1 ) pnetwork->network.Configuration.DSConfig =1 ;/* Add frequency/channel */
Greg Kroah-Hartman
maintainerPATCH 620/699 staging: rtl8723bs: clean up comparsions to NULL
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Michael Straube <[email protected]>
[ Upstream commit cd1f1450092216b3e39516f8db58869b6fc20575 ]
Clean up comparsions to NULL reported by checkpatch.
x == NULL -> !x
x != NULL -> x
Stable-dep-of: a1fc19d61f66 ("staging: rtl8723bs: fix WEP length underflow and OOB read in OnAuth()")
--- drivers/staging/rtl8723bs/core/rtw_ap.c | 20 ++-- drivers/staging/rtl8723bs/core/rtw_cmd.c | 96 +++++++++++----------- drivers/staging/rtl8723bs/core/rtw_ioctl_set.c | 4 drivers/staging/rtl8723bs/core/rtw_mlme.c | 6 - drivers/staging/rtl8723bs/core/rtw_mlme_ext.c | 56 ++++++------ drivers/staging/rtl8723bs/core/rtw_security.c | 6 - drivers/staging/rtl8723bs/os_dep/ioctl_cfg80211.c | 24 ++--- drivers/staging/rtl8723bs/os_dep/ioctl_linux.c | 18 ++-- drivers/staging/rtl8723bs/os_dep/os_intfs.c | 4 9 files changed, 117 insertions(+), 117 deletions(-)
drivers/staging/rtl8723bs/core/rtw_ap.c +10 -10
@@ -1033,7 +1033,7 @@ int rtw_check_beacon_data(struct adapter &ie_len, (pbss_network->IELength - _BEACON_IE_OFFSET_) ); -if (p !=NULL ) { +if (p) {memcpy (supportRate, p +2 , ie_len); supportRateNum = ie_len; }
@@ -1045,7 +1045,7 @@ int rtw_check_beacon_data(struct adapter &ie_len, pbss_network->IELength - _BEACON_IE_OFFSET_ ); -if (p !=NULL ) { +if (p) {memcpy (supportRate + supportRateNum, p +2 , ie_len); supportRateNum += ie_len; }
@@ -1133,7 +1133,7 @@ int rtw_check_beacon_data(struct adapterbreak ; } -if ((p ==NULL ) || (ie_len ==0 )) +if (!p || ie_len ==0 )break ; }
@@ -1162,7 +1162,7 @@ int rtw_check_beacon_data(struct adapterbreak ; } -if ((p ==NULL ) || (ie_len ==0 )) +if (!p || ie_len ==0 )break ; } }
@@ -1290,7 +1290,7 @@ int rtw_check_beacon_data(struct adapter psta =rtw_get_stainfo (&padapter->stapriv, pbss_network->MacAddress);if (!psta) { psta =rtw_alloc_stainfo (&padapter->stapriv, pbss_network->MacAddress); -if (psta ==NULL ) +if (!psta)return _FAIL; }
@@ -1447,7 +1447,7 @@ u8 rtw_ap_set_pairwise_key(struct adapte } psetstakey_para =rtw_zmalloc (sizeof (struct set_stakey_parm )); -if (psetstakey_para ==NULL ) { +if (!psetstakey_para) {kfree (ph2c); res = _FAIL; goto exit;
@@ -1485,12 +1485,12 @@ static int rtw_ap_set_key(/* DBG_871X("%s\n", __func__); */ pcmd =rtw_zmalloc (sizeof (struct cmd_obj )); -if (pcmd ==NULL ) { +if (!pcmd) { res = _FAIL; goto exit; } psetkeyparm =rtw_zmalloc (sizeof (struct setkey_parm )); -if (psetkeyparm ==NULL ) { +if (!psetkeyparm) {kfree (pcmd); res = _FAIL; goto exit;
@@ -1662,11 +1662,11 @@ static void update_bcn_wps_ie(struct ada &wps_ielen ); -if (pwps_ie ==NULL || wps_ielen ==0 ) +if (!pwps_ie || wps_ielen ==0 )return ; pwps_ie_src = pmlmepriv->wps_beacon_ie; -if (pwps_ie_src ==NULL ) +if (!pwps_ie_src)return ; wps_offset = (uint)(pwps_ie - ie);
drivers/staging/rtl8723bs/core/rtw_cmd.c +48 -48
363 lines not on this page · raw message
drivers/staging/rtl8723bs/core/rtw_ioctl_set.c +2 -2
@@ -508,7 +508,7 @@ u8 rtw_set_802_11_bssid_list_scan(structRT_TRACE (_module_rtl871x_ioctl_set_c_, _drv_err_, ("+rtw_set_802_11_bssid_list_scan(), fw_state =%x\n" ,get_fwstate (pmlmepriv))); -if (padapter ==NULL ) { +if (!padapter) { res = false; goto exit; }
@@ -649,7 +649,7 @@ u16 rtw_get_cur_max_rate(struct adapterreturn 0 ; psta =rtw_get_stainfo (&adapter->stapriv,get_bssid (pmlmepriv)); -if (psta ==NULL ) +if (!psta)return 0 ; short_GI =query_ra_short_GI (psta);
drivers/staging/rtl8723bs/core/rtw_mlme.c +3 -3
@@ -472,7 +472,7 @@ struct wlan_network *rtw_get_oldest_wlan pwlan = LIST_CONTAINOR(plist, struct wlan_network, list);if (!pwlan->fixed) { -if (oldest ==NULL ||time_after (oldest->last_scanned, pwlan->last_scanned)) +if (!oldest ||time_after (oldest->last_scanned, pwlan->last_scanned)) oldest = pwlan; }
@@ -603,7 +603,7 @@ void rtw_update_scanned_network(struct a/* TODO: don't select netowrk in the same ess as oldest if it's new enough*/ } -if (oldest ==NULL ||time_after (oldest->last_scanned, pnetwork->last_scanned)) +if (!oldest ||time_after (oldest->last_scanned, pnetwork->last_scanned)) oldest = pnetwork; plist =get_next (plist);
@@ -2023,7 +2023,7 @@ static int rtw_check_join_candidate(stru goto exit; } -if (*candidate ==NULL || (*candidate)->network.Rssi < competitor->network.Rssi) { +if (!*candidate || (*candidate)->network.Rssi < competitor->network.Rssi) { *candidate = competitor; updated = true; }
drivers/staging/rtl8723bs/core/rtw_mlme_ext.c +28 -28
216 lines not on this page · raw message
drivers/staging/rtl8723bs/core/rtw_security.c +3 -3
@@ -226,7 +226,7 @@ void rtw_wep_encrypt(struct adapter *padstruct security_priv *psecuritypriv = &padapter->securitypriv;struct xmit_priv *pxmitpriv = &padapter->xmitpriv; -if (((struct xmit_frame *)pxmitframe)->buf_addr ==NULL ) +if (!((struct xmit_frame *)pxmitframe)->buf_addr)return ; hw_hdr_offset =TXDESC_OFFSET ;
@@ -669,7 +669,7 @@ u32 rtw_tkip_encrypt(struct adapter *padstruct xmit_priv *pxmitpriv = &padapter->xmitpriv;u32 res = _SUCCESS; -if (((struct xmit_frame *)pxmitframe)->buf_addr ==NULL ) +if (!((struct xmit_frame *)pxmitframe)->buf_addr)return _FAIL; hw_hdr_offset =TXDESC_OFFSET ;
@@ -1489,7 +1489,7 @@ u32 rtw_aes_encrypt(struct adapter *padau32 res = _SUCCESS; -if (((struct xmit_frame *)pxmitframe)->buf_addr ==NULL ) +if (!((struct xmit_frame *)pxmitframe)->buf_addr)return _FAIL; hw_hdr_offset =TXDESC_OFFSET ;
drivers/staging/rtl8723bs/os_dep/ioctl_cfg80211.c +12 -12
@@ -418,7 +418,7 @@ void rtw_cfg80211_ibss_indicate_connect( }else { -if (scanned ==NULL ) { +if (!scanned) {rtw_warn_on (1 );return ; }
@@ -466,7 +466,7 @@ void rtw_cfg80211_indicate_connect(struc/* DBG_871X(FUNC_ADPT_FMT" BSS not found\n", FUNC_ADPT_ARG(padapter)); */ -if (scanned ==NULL ) { +if (!scanned) {rtw_warn_on (1 ); goto check_bss; }
@@ -597,7 +597,7 @@ static int rtw_cfg80211_ap_set_encryptio } } -if (strcmp (param->u.crypt.alg,"none" ) ==0 && (psta ==NULL )) +if (strcmp (param->u.crypt.alg,"none" ) ==0 && !psta) {/* todo:clear default encryption keys */
@@ -607,7 +607,7 @@ static int rtw_cfg80211_ap_set_encryptio } -if (strcmp (param->u.crypt.alg,"WEP" ) ==0 && (psta ==NULL )) +if (strcmp (param->u.crypt.alg,"WEP" ) ==0 && !psta) {DBG_8192C ("r871x_set_encryption, crypt.alg = WEP\n" );
@@ -1001,7 +1001,7 @@ static int rtw_cfg80211_set_encryption(s } pbcmc_sta =rtw_get_bcmc_stainfo (padapter); -if (pbcmc_sta ==NULL ) +if (!pbcmc_sta) {/* DEBUG_ERR(("Set OID_802_11_ADD_KEY: bcmc stainfo is null\n")); */ }
@@ -1050,7 +1050,7 @@ static int cfg80211_rtw_add_key(struct w param_len =sizeof (struct ieee_param ) + params->key_len; param =rtw_malloc (param_len); -if (param ==NULL ) +if (!param)return -1 ;memset (param,0 , param_len);
@@ -1214,7 +1214,7 @@ static int cfg80211_rtw_get_station(stru } psta =rtw_get_stainfo (pstapriv, (u8 *)mac); -if (psta ==NULL ) { +if (!psta) {DBG_8192C ("%s, sta_info is null\n" , __func__); ret = -ENOENT ; goto exit;
@@ -1495,7 +1495,7 @@ static int cfg80211_rtw_scan(struct wiphstruct rtw_wdev_priv *pwdev_priv;struct mlme_priv *pmlmepriv; -if (ndev ==NULL ) { +if (!ndev) { ret = -EINVAL ; goto exit; }
@@ -1783,7 +1783,7 @@ static int rtw_cfg80211_set_wpa_ie(strucu8 *pwpa, *pwpa2;u8 null_addr[] = {0 ,0 ,0 ,0 ,0 ,0 }; -if (pie ==NULL || !ielen) { +if (!pie || !ielen) {/* Treat this as normal case, but need to clear WIFI_UNDER_WPS */ _clr_fwstate_ (&padapter->mlmepriv,WIFI_UNDER_WPS ); goto exit;
@@ -1795,7 +1795,7 @@ static int rtw_cfg80211_set_wpa_ie(struc } buf =rtw_zmalloc (ielen); -if (buf ==NULL ) { +if (!buf) { ret = -ENOMEM ; goto exit; }
@@ -2138,7 +2138,7 @@ static int cfg80211_rtw_connect(struct w wep_key_len = wep_key_len <=5 ?5 :13 ; wep_total_len = wep_key_len + FIELD_OFFSET(struct ndis_802_11_wep, KeyMaterial); pwep =rtw_malloc (wep_total_len); -if (pwep ==NULL ) { +if (!pwep) {DBG_871X (" wpa_set_encryption: pwep allocate fail !!!\n" ); ret = -ENOMEM ; goto exit;
@@ -3073,7 +3073,7 @@ static int cfg80211_rtw_mgmt_tx(struct wstruct adapter *padapter;struct rtw_wdev_priv *pwdev_priv; -if (ndev ==NULL ) { +if (!ndev) { ret = -EINVAL ; goto exit; }
drivers/staging/rtl8723bs/os_dep/ioctl_linux.c +9 -9
@@ -519,7 +519,7 @@ static int wpa_set_encryption(struct netif (check_fwstate (pmlmepriv,WIFI_STATION_STATE |WIFI_MP_STATE ) == true) {/* sta mode */ psta =rtw_get_stainfo (pstapriv,get_bssid (pmlmepriv)); -if (psta ==NULL ) { +if (!psta) {/* DEBUG_ERR(("Set wpa_set_encryption: Obtain Sta_info fail\n")); */ }else {/* Jeff: don't disable ieee8021x_blocked while clearing key */
@@ -578,7 +578,7 @@ static int wpa_set_encryption(struct net } pbcmc_sta =rtw_get_bcmc_stainfo (padapter); -if (pbcmc_sta ==NULL ) { +if (!pbcmc_sta) {/* DEBUG_ERR(("Set OID_802_11_ADD_KEY: bcmc stainfo is null\n")); */ }else {/* Jeff: don't disable ieee8021x_blocked while clearing key */
@@ -608,9 +608,9 @@ static int rtw_set_wpa_ie(struct adapterint ret =0 ;u8 null_addr[] = {0 ,0 ,0 ,0 ,0 ,0 }; -if ((ielen >MAX_WPA_IE_LEN ) || (pie ==NULL )) { +if (ielen >MAX_WPA_IE_LEN || !pie) {_clr_fwstate_ (&padapter->mlmepriv,WIFI_UNDER_WPS ); -if (pie ==NULL ) +if (!pie)return ret;else return -EINVAL ;
@@ -618,7 +618,7 @@ static int rtw_set_wpa_ie(struct adapterif (ielen) { buf =rtw_zmalloc (ielen); -if (buf ==NULL ) { +if (!buf) { ret = -ENOMEM ; goto exit; }
@@ -3366,7 +3366,7 @@ static int wpa_supplicant_ioctl(struct nreturn -EINVAL ; param =rtw_malloc (p->length); -if (param ==NULL ) +if (!param)return -ENOMEM ;if (copy_from_user (param, p->pointer, p->length)) {
@@ -3448,7 +3448,7 @@ static int rtw_set_encryption(struct net } } -if (strcmp (param->u.crypt.alg,"none" ) ==0 && (psta ==NULL )) { +if (strcmp (param->u.crypt.alg,"none" ) ==0 && !psta) {/* todo:clear default encryption keys */ psecuritypriv->dot11AuthAlgrthm = dot11AuthAlgrthm_Open;
@@ -3462,7 +3462,7 @@ static int rtw_set_encryption(struct net } -if (strcmp (param->u.crypt.alg,"WEP" ) ==0 && (psta ==NULL )) { +if (strcmp (param->u.crypt.alg,"WEP" ) ==0 && !psta) {DBG_871X ("r871x_set_encryption, crypt.alg = WEP\n" ); wep_key_idx = param->u.crypt.idx;
@@ -4187,7 +4187,7 @@ static int rtw_hostapd_ioctl(struct net_return -EINVAL ; param =rtw_malloc (p->length); -if (param ==NULL ) +if (!param)return -ENOMEM ;if (copy_from_user (param, p->pointer, p->length)) {
drivers/staging/rtl8723bs/os_dep/os_intfs.c +2 -2
@@ -525,7 +525,7 @@ void rtw_unregister_netdevs(struct dvobj padapter = dvobj->padapters; -if (padapter ==NULL ) +if (!padapter)return ; pnetdev = padapter->pnetdev;
@@ -638,7 +638,7 @@ struct dvobj_priv *devobj_init(void)struct dvobj_priv *pdvobj =NULL ; pdvobj =rtw_zmalloc (sizeof (*pdvobj)); -if (pdvobj ==NULL ) +if (!pdvobj)return NULL ;mutex_init (&pdvobj->hw_init_mutex);
Greg Kroah-Hartman
maintainerPATCH 621/699 staging: rtl8723bs: fix WEP length underflow and OOB read in OnAuth()
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alexandru Hossu <[email protected]>
[ Upstream commit a1fc19d61f661d47204f095b593de507884849f7 ]
OnAuth() has two bugs in the shared-key authentication path.
When the Privacy bit is set, rtw_wep_decrypt() is called without verifying that the frame is long enough to contain a valid WEP IV and ICV. Inside rtw_wep_decrypt(), length is computed as:
length = len - WLAN_HDR_A3_LEN - iv_len
and then passed as (length - 4) to crc32_le(). If len is less than WLAN_HDR_A3_LEN + iv_len + icv_len (32 bytes), length - 4 is negative and, after the implicit cast to size_t, causes crc32_le() to read far beyond the frame buffer. Add a minimum length check before accessing the IV field and calling the decryption path.
When processing a seq=3 response, rtw_get_ie() stores the Challenge Text IE length in ie_len, but the subsequent memcmp() always reads 128 bytes regardless of ie_len. IEEE 802.11 mandates a challenge text of exactly 128 bytes; reject any IE whose length field differs, matching the check already applied to OnAuthClient().
--- drivers/staging/rtl8723bs/core/rtw_mlme_ext.c | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-)
drivers/staging/rtl8723bs/core/rtw_mlme_ext.c +7 -1
@@ -886,6 +886,9 @@ unsigned int OnAuth(struct adapter *padaDBG_871X ("+OnAuth\n" ); +if (len <WLAN_HDR_A3_LEN ) +return _FAIL; + sa =GetAddr2Ptr (pframe); auth_mode = psecuritypriv->dot11AuthAlgrthm;
@@ -897,6 +900,9 @@ unsigned int OnAuth(struct adapter *pada prxattrib->hdrlen =WLAN_HDR_A3_LEN ; prxattrib->encrypt = _WEP40_; +if (len <WLAN_HDR_A3_LEN +8 ) +return _FAIL; + iv = pframe+prxattrib->hdrlen; prxattrib->key_index = ((iv[3 ]>>6 )&0x3 );
@@ -1014,7 +1020,7 @@ unsigned int OnAuth(struct adapter *pada p =rtw_get_ie (pframe +WLAN_HDR_A3_LEN +4 + _AUTH_IE_OFFSET_, _CHLGETXT_IE_, (int *)&ie_len, len -WLAN_HDR_A3_LEN - _AUTH_IE_OFFSET_ -4 ); -if (!p || ie_len <=0 ) { +if (!p || ie_len !=128 ) {DBG_871X ("auth rejected because challenge failure!(1)\n" ); status = _STATS_CHALLENGE_FAIL_; goto auth_fail;
Greg Kroah-Hartman
maintainerPATCH 622/699 staging: rtl8723bs: Fix space issues
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Franziska Naepelt <[email protected]>
[ Upstream commit c4b811b9361b0d7ea167a79587f5ec0a13fd8863 ]
Fix the following checkpatch space issues:
- CHECK: spaces preferred around that '*' (ctx:VxV)
- CHECK: spaces preferred around that '+' (ctx:VxV)
- CHECK: spaces preferred around that '-' (ctx:VxV)
- CHECK: spaces preferred around that '|' (ctx:VxV)
- CHECK: No space is necessary after a cast
- WARNING: please, no spaces at the start of a line
Stable-dep-of: 5a752a616e75 ("staging: rtl8723bs: fix heap buffer overflow in rtw_cfg80211_set_wpa_ie()")
--- drivers/staging/rtl8723bs/os_dep/ioctl_cfg80211.c | 84 ++++++++++------------ 1 file changed, 40 insertions(+), 44 deletions(-)
drivers/staging/rtl8723bs/os_dep/ioctl_cfg80211.c +40 -44
@@ -98,14 +98,14 @@ static struct ieee80211_channel rtw_2ghzstatic void rtw_2g_channels_init (struct ieee80211_channel *channels) {memcpy ((void *)channels, (void *)rtw_2ghz_channels, -sizeof (struct ieee80211_channel )*RTW_2G_CHANNELS_NUM +sizeof (struct ieee80211_channel ) *RTW_2G_CHANNELS_NUM ); }static void rtw_2g_rates_init (struct ieee80211_rate *rates) {memcpy (rates, rtw_g_rates, -sizeof (struct ieee80211_rate )*RTW_G_RATES_NUM +sizeof (struct ieee80211_rate ) *RTW_G_RATES_NUM ); }
@@ -132,8 +132,8 @@ static struct ieee80211_supported_band *if (!spt_band) goto exit; - spt_band->channels = (struct ieee80211_channel *)(((u8 *)spt_band)+sizeof (struct ieee80211_supported_band )); - spt_band->bitrates = (struct ieee80211_rate *)(((u8 *)spt_band->channels)+sizeof (struct ieee80211_channel )*n_channels); + spt_band->channels = (struct ieee80211_channel *)(((u8 *)spt_band) +sizeof (struct ieee80211_supported_band )); + spt_band->bitrates = (struct ieee80211_rate *)(((u8 *)spt_band->channels) +sizeof (struct ieee80211_channel ) * n_channels); spt_band->band = band; spt_band->n_channels = n_channels; spt_band->n_bitrates = n_bitrates;
@@ -267,10 +267,10 @@ struct cfg80211_bss *rtw_cfg80211_informu32 wpsielen =0 ;u8 *wpsie =NULL ; - wpsie =rtw_get_wps_ie (pnetwork->network.IEs+_FIXED_IE_LENGTH_, pnetwork->network.IELength-_FIXED_IE_LENGTH_,NULL , &wpsielen); + wpsie =rtw_get_wps_ie (pnetwork->network.IEs + _FIXED_IE_LENGTH_, pnetwork->network.IELength - _FIXED_IE_LENGTH_,NULL , &wpsielen);if (wpsie && wpsielen >0 ) - psr =rtw_get_wps_attr_content (wpsie, wpsielen,WPS_ATTR_SELECTED_REGISTRAR , (u8 *)(&sr),NULL ); + psr =rtw_get_wps_attr_content (wpsie, wpsielen,WPS_ATTR_SELECTED_REGISTRAR , (u8 *)(&sr),NULL );if (sr !=0 ) {
@@ -306,9 +306,9 @@ struct cfg80211_bss *rtw_cfg80211_inform/* We've set wiphy's signal_type as CFG80211_SIGNAL_TYPE_MBM: signal strength in mBm (100*dBm) */ if (check_fwstate (pmlmepriv, _FW_LINKED) == true &&is_same_network (&pmlmepriv->cur_network.network, &pnetwork->network,0 )) { - notify_signal =100 *translate_percentage_to_dbm (padapter->recvpriv.signal_strength);/* dbm */ + notify_signal =100 *translate_percentage_to_dbm (padapter->recvpriv.signal_strength);/* dbm */ }else { - notify_signal =100 *translate_percentage_to_dbm (pnetwork->network.PhyInfo.SignalStrength);/* dbm */ + notify_signal =100 *translate_percentage_to_dbm (pnetwork->network.PhyInfo.SignalStrength);/* dbm */ } buf =kzalloc (MAX_BSSINFO_LEN ,GFP_ATOMIC );
@@ -507,22 +507,22 @@ check_bss: roam_info.channel = notify_channel; roam_info.bssid = cur_network->network.MacAddress; roam_info.req_ie = - pmlmepriv->assoc_req+sizeof (struct ieee80211_hdr_3addr )+2 ; + pmlmepriv->assoc_req +sizeof (struct ieee80211_hdr_3addr ) +2 ; roam_info.req_ie_len = - pmlmepriv->assoc_req_len-sizeof (struct ieee80211_hdr_3addr )-2 ; + pmlmepriv->assoc_req_len -sizeof (struct ieee80211_hdr_3addr ) -2 ; roam_info.resp_ie = - pmlmepriv->assoc_rsp+sizeof (struct ieee80211_hdr_3addr )+6 ; + pmlmepriv->assoc_rsp +sizeof (struct ieee80211_hdr_3addr ) +6 ; roam_info.resp_ie_len = - pmlmepriv->assoc_rsp_len-sizeof (struct ieee80211_hdr_3addr )-6 ; + pmlmepriv->assoc_rsp_len -sizeof (struct ieee80211_hdr_3addr ) -6 ;cfg80211_roamed (padapter->pnetdev, &roam_info,GFP_ATOMIC ); }else {cfg80211_connect_result (padapter->pnetdev, cur_network->network.MacAddress - , pmlmepriv->assoc_req+sizeof (struct ieee80211_hdr_3addr )+2 - , pmlmepriv->assoc_req_len-sizeof (struct ieee80211_hdr_3addr )-2 - , pmlmepriv->assoc_rsp+sizeof (struct ieee80211_hdr_3addr )+6 - , pmlmepriv->assoc_rsp_len-sizeof (struct ieee80211_hdr_3addr )-6 + , pmlmepriv->assoc_req +sizeof (struct ieee80211_hdr_3addr ) +2 + , pmlmepriv->assoc_req_len -sizeof (struct ieee80211_hdr_3addr ) -2 + , pmlmepriv->assoc_rsp +sizeof (struct ieee80211_hdr_3addr ) +6 + , pmlmepriv->assoc_rsp_len -sizeof (struct ieee80211_hdr_3addr ) -6 ,WLAN_STATUS_SUCCESS ,GFP_ATOMIC ); } }
@@ -855,7 +855,7 @@ static int rtw_cfg80211_set_encryption(s param->u.crypt.err =0 ; param->u.crypt.alg[IEEE_CRYPT_ALG_NAME_LEN -1 ] ='\0' ; -if (param_len < (u32) ((u8 *) param->u.crypt.key - (u8 *) param) + param->u.crypt.key_len) +if (param_len < (u32)((u8 *)param->u.crypt.key - (u8 *)param) + param->u.crypt.key_len) { ret = -EINVAL ; goto exit;
@@ -1252,10 +1252,10 @@ static int cfg80211_rtw_get_station(stru }/* for Ad-Hoc/AP mode */ -if ((check_fwstate (pmlmepriv,WIFI_ADHOC_STATE ) - ||check_fwstate (pmlmepriv,WIFI_ADHOC_MASTER_STATE ) - ||check_fwstate (pmlmepriv,WIFI_AP_STATE )) - &&check_fwstate (pmlmepriv, _FW_LINKED) +if ((check_fwstate (pmlmepriv,WIFI_ADHOC_STATE ) || +check_fwstate (pmlmepriv,WIFI_ADHOC_MASTER_STATE ) || +check_fwstate (pmlmepriv,WIFI_AP_STATE )) && +check_fwstate (pmlmepriv, _FW_LINKED) ) {/* TODO: should acquire station info... */
@@ -1518,7 +1518,7 @@ static int cfg80211_rtw_scan(struct wiphDBG_871X ("%s under WIFI_AP_STATE\n" , __func__);#endif -if (check_fwstate (pmlmepriv,WIFI_UNDER_WPS |_FW_UNDER_SURVEY|_FW_UNDER_LINKING) == true) +if (check_fwstate (pmlmepriv,WIFI_UNDER_WPS | _FW_UNDER_SURVEY | _FW_UNDER_LINKING) == true) {DBG_8192C ("%s, fwstate = 0x%x\n" , __func__, pmlmepriv->fw_state);
@@ -1591,7 +1591,7 @@ static int cfg80211_rtw_scan(struct wiph }/* parsing channels, n_channels */ -memset (ch,0 ,sizeof (struct rtw_ieee80211_channel )*RTW_CHANNEL_SCAN_AMOUNT ); +memset (ch,0 ,sizeof (struct rtw_ieee80211_channel ) *RTW_CHANNEL_SCAN_AMOUNT );for (i =0 ; i < request->n_channels && i <RTW_CHANNEL_SCAN_AMOUNT ; i++) {#ifdef DEBUG_CFG80211 DBG_871X(FUNC_ADPT_FMT CHAN_FMT"\n", FUNC_ADPT_ARG(padapter), CHAN_ARG(request->channels[i]));
@@ -1609,7 +1609,7 @@ static int cfg80211_rtw_scan(struct wiphfor (j = request->n_channels -1 ; j >=0 ; j--)for (i =0 ; i < survey_times; i++) { -memcpy (&ch[j*survey_times+i], &ch[j],sizeof (struct rtw_ieee80211_channel )); +memcpy (&ch[j * survey_times + i], &ch[j],sizeof (struct rtw_ieee80211_channel )); } _status =rtw_sitesurvey_cmd (padapter, ssid,RTW_SSID_SCAN_AMOUNT , ch, survey_times * request->n_channels); }else {
@@ -1789,7 +1789,7 @@ static int rtw_cfg80211_set_wpa_ie(struc goto exit; } -if (ielen >MAX_WPA_IE_LEN +MAX_WPS_IE_LEN +MAX_P2P_IE_LEN ) { +if (ielen >MAX_WPA_IE_LEN +MAX_WPS_IE_LEN +MAX_P2P_IE_LEN ) { ret = -EINVAL ; goto exit; }
@@ -1817,26 +1817,22 @@ static int rtw_cfg80211_set_wpa_ie(struc } pwpa =rtw_get_wpa_ie (buf, &wpa_ielen, ielen); -if (pwpa && wpa_ielen >0 ) - { -if (rtw_parse_wpa_ie (pwpa, wpa_ielen+2 , &group_cipher, &pairwise_cipher,NULL ) == _SUCCESS) - { +if (pwpa && wpa_ielen >0 ) { +if (rtw_parse_wpa_ie (pwpa, wpa_ielen +2 , &group_cipher, &pairwise_cipher,NULL ) == _SUCCESS) { padapter->securitypriv.dot11AuthAlgrthm = dot11AuthAlgrthm_8021X; padapter->securitypriv.ndisauthtype = Ndis802_11AuthModeWPAPSK; -memcpy (padapter->securitypriv.supplicant_ie, &pwpa[0 ], wpa_ielen+2 ); +memcpy (padapter->securitypriv.supplicant_ie, &pwpa[0 ], wpa_ielen +2 );DBG_8192C ("got wpa_ie, wpa_ielen:%u\n" , wpa_ielen); } } pwpa2 =rtw_get_wpa2_ie (buf, &wpa2_ielen, ielen); -if (pwpa2 && wpa2_ielen >0 ) - { -if (rtw_parse_wpa2_ie (pwpa2, wpa2_ielen+2 , &group_cipher, &pairwise_cipher,NULL ) == _SUCCESS) - { +if (pwpa2 && wpa2_ielen >0 ) { +if (rtw_parse_wpa2_ie (pwpa2, wpa2_ielen +2 , &group_cipher, &pairwise_cipher,NULL ) == _SUCCESS) { padapter->securitypriv.dot11AuthAlgrthm = dot11AuthAlgrthm_8021X; padapter->securitypriv.ndisauthtype = Ndis802_11AuthModeWPA2PSK; -memcpy (padapter->securitypriv.supplicant_ie, &pwpa2[0 ], wpa2_ielen+2 ); +memcpy (padapter->securitypriv.supplicant_ie, &pwpa2[0 ], wpa2_ielen +2 );DBG_8192C ("got wpa2_ie, wpa2_ielen:%u\n" , wpa2_ielen); }
@@ -2303,7 +2299,7 @@ static int cfg80211_rtw_set_pmksa(structmemcpy (psecuritypriv->PMKIDList[index].PMKID, (u8 *)pmksa->pmkid,WLAN_PMKID_LEN ); psecuritypriv->PMKIDList[index].bUsed = true; - psecuritypriv->PMKIDIndex = index+1 ; + psecuritypriv->PMKIDIndex = index +1 ; blInserted = true;break ; }
@@ -2477,8 +2473,8 @@ static netdev_tx_t rtw_cfg80211_monitor_return _rtw_xmit_entry (skb, padapter->pnetdev); } -else if ((frame_control & (IEEE80211_FCTL_FTYPE |IEEE80211_FCTL_STYPE )) - == (IEEE80211_FTYPE_MGMT |IEEE80211_STYPE_ACTION ) +else if ((frame_control & (IEEE80211_FCTL_FTYPE |IEEE80211_FCTL_STYPE )) + == (IEEE80211_FTYPE_MGMT |IEEE80211_STYPE_ACTION ) ) {/* only for action frames */
@@ -2616,7 +2612,7 @@ static int rtw_cfg80211_add_monitor_if(s } *ndev = pwdev_priv->pmon_ndev = mon_ndev; -memcpy (pwdev_priv->ifname_mon, name,IFNAMSIZ +1 ); +memcpy (pwdev_priv->ifname_mon, name,IFNAMSIZ +1 ); out:if (ret && mon_wdev) {
@@ -2719,14 +2715,14 @@ static int rtw_add_beacon(struct adapterif (head_len <24 )return -EINVAL ; - pbuf =rtw_zmalloc (head_len+tail_len); + pbuf =rtw_zmalloc (head_len + tail_len);if (!pbuf)return -ENOMEM ; -memcpy (pbuf, (void *)head+24 , head_len-24 );/* 24 =beacon header len. */ -memcpy (pbuf+head_len-24 , (void *)tail, tail_len); +memcpy (pbuf, (void *)head +24 , head_len -24 );/* 24 =beacon header len. */ +memcpy (pbuf + head_len -24 , (void *)tail, tail_len); - len = head_len+tail_len-24 ; + len = head_len + tail_len -24 ;/* check wps ie if inclued */ if (rtw_get_wps_ie (pbuf+_FIXED_IE_LENGTH_, len-_FIXED_IE_LENGTH_,NULL , &wps_ielen))
@@ -3082,7 +3078,7 @@ static int cfg80211_rtw_mgmt_tx(struct w pwdev_priv =adapter_wdev_data (padapter);/* cookie generation */ - *cookie = (unsigned long ) buf; + *cookie = (unsigned long )buf;#ifdef DEBUG_CFG80211 DBG_871X(FUNC_ADPT_FMT" len =%zu, ch =%d"
Greg Kroah-Hartman
maintainerPATCH 623/699 staging: rtl8723bs: fix heap buffer overflow in rtw_cfg80211_set_wpa_ie()
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alexandru Hossu <[email protected]>
[ Upstream commit 5a752a616e756844388a1a45404db9fc29fec655 ]
supplicant_ie is a 256-byte array in struct security_priv. The WPA and WPA2 IE copy paths use:
memcpy(padapter->securitypriv.supplicant_ie, &pwpa[0], wpa_ielen + 2);
where wpa_ielen is the raw IE length field (u8, 0-255). When a local user supplies a connect request via nl80211 with a crafted WPA IE of length 255, wpa_ielen + 2 equals 257, overflowing the 256-byte buffer by one byte into the adjacent last_mic_err_time field.
rtw_parse_wpa_ie() does not prevent this: its length consistency check compares *(wpa_ie+1) against (u8)(wpa_ie_len-2), which is (u8)(255) == 255 when wpa_ie_len = 257, so the check passes silently.
Add explicit bounds checks for both the WPA and WPA2 paths before the memcpy, rejecting any IE whose total size (wpa_ielen + 2) exceeds the supplicant_ie buffer.
--- drivers/staging/rtl8723bs/os_dep/ioctl_cfg80211.c | 8 ++++++++ 1 file changed, 8 insertions(+)
drivers/staging/rtl8723bs/os_dep/ioctl_cfg80211.c +8 -0
@@ -1818,6 +1818,10 @@ static int rtw_cfg80211_set_wpa_ie(struc pwpa =rtw_get_wpa_ie (buf, &wpa_ielen, ielen);if (pwpa && wpa_ielen >0 ) { +if (wpa_ielen +2 >sizeof (padapter->securitypriv.supplicant_ie)) { + ret = -EINVAL ; + goto exit; + }if (rtw_parse_wpa_ie (pwpa, wpa_ielen +2 , &group_cipher, &pairwise_cipher,NULL ) == _SUCCESS) { padapter->securitypriv.dot11AuthAlgrthm = dot11AuthAlgrthm_8021X; padapter->securitypriv.ndisauthtype = Ndis802_11AuthModeWPAPSK;
@@ -1829,6 +1833,10 @@ static int rtw_cfg80211_set_wpa_ie(struc pwpa2 =rtw_get_wpa2_ie (buf, &wpa2_ielen, ielen);if (pwpa2 && wpa2_ielen >0 ) { +if (wpa2_ielen +2 >sizeof (padapter->securitypriv.supplicant_ie)) { + ret = -EINVAL ; + goto exit; + }if (rtw_parse_wpa2_ie (pwpa2, wpa2_ielen +2 , &group_cipher, &pairwise_cipher,NULL ) == _SUCCESS) { padapter->securitypriv.dot11AuthAlgrthm = dot11AuthAlgrthm_8021X; padapter->securitypriv.ndisauthtype = Ndis802_11AuthModeWPA2PSK;
Greg Kroah-Hartman
maintainerPATCH 624/699 staging: rtl8723bs: fix OOB reads in IE loops in issue_assocreq() and join_cmd_hdl()
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alexandru Hossu <[email protected]>
[ Upstream commit ef61d628dfad38fead1fd2e08979ae9126d011d5 ]
Two IE parsing loops are missing the header bounds checks before they dereference pIE->length:
- issue_assocreq() walks pmlmeinfo->network.ies to build the association request. If the stored IE data ends with only an element_id byte and no length byte, pIE->length is read one byte past the end of the buffer.
- join_cmd_hdl() walks pnetwork->ies during station join and has the same problem under the same conditions.
Both buffers are filled from AP beacon and probe-response frames, so a malicious AP that sends a truncated final IE can trigger the issue.
Apply the two-guard pattern established in update_beacon_info():
1. Break if fewer than sizeof(*pIE) bytes remain.
2. Break if the IE's declared data extends past the buffer end.
--- drivers/staging/rtl8723bs/core/rtw_mlme_ext.c | 8 ++++++++ 1 file changed, 8 insertions(+)
drivers/staging/rtl8723bs/core/rtw_mlme_ext.c +8 -0
@@ -3341,7 +3341,11 @@ void issue_assocreq(struct adapter *pada/* vendor specific IE, such as WPA, WMM, WPS */ for (i =sizeof (struct ndis_802_11_fix_ie ); i < pmlmeinfo->network.IELength;) { +if (i +2 > pmlmeinfo->network.IELength) +break ; pIE = (struct ndis_80211_var_ie *)(pmlmeinfo->network.IEs + i); +if (i +2 + pIE->Length > pmlmeinfo->network.IELength) +break ;switch (pIE->ElementID) {case _VENDOR_SPECIFIC_IE_:
@@ -6105,7 +6109,11 @@ u8 join_cmd_hdl(struct adapter *padapter/* sizeof(struct ndis_802_11_fix_ie) */ for (i = _FIXED_IE_LENGTH_; i < pnetwork->IELength;) { +if (i +2 > pnetwork->IELength) +break ; pIE = (struct ndis_80211_var_ie *)(pnetwork->IEs + i); +if (i +2 + pIE->Length > pnetwork->IELength) +break ;switch (pIE->ElementID) {case _VENDOR_SPECIFIC_IE_:/* Get WMM IE. */
Greg Kroah-Hartman
maintainerPATCH 625/699 PCI: controller: Use dev_fwnode() instead of of_fwnode_handle()
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: "Jiri Slaby (SUSE)" <[email protected]>
[ Upstream commit a103d2dede5683dabbac2c3374bc24b6a9434478 ]
All irq_domain functions now accept fwnode instead of of_node. But many PCI controllers still extract dev to of_node and then of_node to fwnode.
Instead, clean this up and simply use the dev_fwnode() helper to extract fwnode directly from dev. Internally, it still does dev => of_node => fwnode steps, but it's now hidden from the users.
In the case of altera, this also removes an unused 'node' variable that is only used when CONFIG_OF is enabled:
drivers/pci/controller/pcie-altera.c: In function 'altera_pcie_init_irq_domain':
drivers/pci/controller/pcie-altera.c:855:29: error: unused variable 'node' [-Werror=unused-variable]
855 | struct device_node *node = dev->of_node;
Stable-dep-of: f865a57896bd ("PCI: mediatek: Fix IRQ domain leak when port fails to enable")
--- drivers/pci/controller/dwc/pcie-designware-host.c | 2 +- drivers/pci/controller/mobiveil/pcie-mobiveil-host.c | 8 +++----- drivers/pci/controller/pcie-altera-msi.c | 2 +- drivers/pci/controller/pcie-altera.c | 3 +-- drivers/pci/controller/pcie-mediatek.c | 2 +- drivers/pci/controller/pcie-xilinx-nwl.c | 2 +- 6 files changed, 8 insertions(+), 11 deletions(-)
drivers/pci/controller/dwc/pcie-designware-host.c +1 -1
@@ -233,7 +233,7 @@ static const struct irq_domain_ops dw_pcint dw_pcie_allocate_domains (struct pcie_port *pp) {struct dw_pcie *pci =to_dw_pcie_from_pp (pp); -struct fwnode_handle *fwnode =of_node_to_fwnode (pci->dev->of_node); +struct fwnode_handle *fwnode =dev_fwnode (pci->dev); pp->irq_domain =irq_domain_create_linear (fwnode, pp->num_vectors, &dw_pcie_msi_domain_ops, pp);
drivers/pci/controller/mobiveil/pcie-mobiveil-host.c +3 -5
@@ -452,7 +452,7 @@ static const struct irq_domain_ops msi_dstatic int mobiveil_allocate_msi_domains (struct mobiveil_pcie *pcie) {struct device *dev = &pcie->pdev->dev; -struct fwnode_handle *fwnode =of_node_to_fwnode (dev->of_node); +struct fwnode_handle *fwnode =dev_fwnode (dev);struct mobiveil_msi *msi = &pcie->rp.msi;mutex_init (&msi->lock);
@@ -478,13 +478,11 @@ static int mobiveil_allocate_msi_domainsstatic int mobiveil_pcie_init_irq_domain (struct mobiveil_pcie *pcie) {struct device *dev = &pcie->pdev->dev; -struct device_node *node = dev->of_node;struct mobiveil_root_port *rp = &pcie->rp;/* setup INTx */ - rp->intx_domain =irq_domain_add_linear (node,PCI_NUM_INTX , - &intx_domain_ops, pcie); - + rp->intx_domain =irq_domain_create_linear (dev_fwnode (dev),PCI_NUM_INTX , &intx_domain_ops, + pcie);if (!rp->intx_domain) {dev_err (dev,"Failed to get a INTx IRQ domain\n" );return -ENOMEM ;
drivers/pci/controller/pcie-altera-msi.c +1 -1
@@ -173,7 +173,7 @@ static const struct irq_domain_ops msi_dstatic int altera_allocate_domains (struct altera_msi *msi) { -struct fwnode_handle *fwnode =of_node_to_fwnode (msi->pdev->dev.of_node); +struct fwnode_handle *fwnode =dev_fwnode (&msi->pdev->dev); msi->inner_domain =irq_domain_add_linear (NULL , msi->num_of_vectors, &msi_domain_ops, msi);
drivers/pci/controller/pcie-altera.c +1 -2
@@ -672,10 +672,9 @@ static void altera_pcie_isr(struct irq_dstatic int altera_pcie_init_irq_domain (struct altera_pcie *pcie) {struct device *dev = &pcie->pdev->dev; -struct device_node *node = dev->of_node;/* Setup INTx */ - pcie->irq_domain =irq_domain_add_linear (node,PCI_NUM_INTX , + pcie->irq_domain =irq_domain_create_linear (dev_fwnode (dev),PCI_NUM_INTX , &intx_domain_ops, pcie);if (!pcie->irq_domain) {dev_err (dev,"Failed to get a INTx IRQ domain\n" );
drivers/pci/controller/pcie-mediatek.c +1 -1
@@ -497,7 +497,7 @@ static struct msi_domain_info mtk_msi_dostatic int mtk_pcie_allocate_msi_domains (struct mtk_pcie_port *port) { -struct fwnode_handle *fwnode =of_node_to_fwnode (port->pcie->dev->of_node); +struct fwnode_handle *fwnode =dev_fwnode (port->pcie->dev);mutex_init (&port->lock);
drivers/pci/controller/pcie-xilinx-nwl.c +1 -1
@@ -515,7 +515,7 @@ static int nwl_pcie_init_msi_irq_domain( {#ifdef CONFIG_PCI_MSI struct device *dev = pcie->dev; -struct fwnode_handle *fwnode =of_node_to_fwnode (dev->of_node); +struct fwnode_handle *fwnode =dev_fwnode (dev);struct nwl_msi *msi = &pcie->msi; msi->dev_domain = irq_domain_add_linear(NULL, INT_PCI_MSI_NR,
Greg Kroah-Hartman
maintainerPATCH 626/699 PCI: mediatek: Convert bool to single quirks entry and bitmap
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Christian Marangi <[email protected]>
[ Upstream commit 04305367fab7ec9c98eeba315ad09c8b20abce93 ]
To clean Mediatek SoC PCIe struct, convert all the bool to a bitmap and use a single quirks to reference all the values. This permits cleaner addition of new quirk without having to define a new bool in the struct.
Stable-dep-of: f865a57896bd ("PCI: mediatek: Fix IRQ domain leak when port fails to enable")
--- drivers/pci/controller/pcie-mediatek.c | 25 ++++++++++++++++--------- 1 file changed, 16 insertions(+), 9 deletions(-)
drivers/pci/controller/pcie-mediatek.c +16 -9
@@ -141,21 +141,29 @@struct mtk_pcie_port ;/** +* enum mtk_pcie_quirks - MTK PCIe quirks +* @MTK_PCIE_FIX_CLASS_ID: host's class ID needed to be fixed +* @MTK_PCIE_FIX_DEVICE_ID: host's device ID needed to be fixed +*/ +enum mtk_pcie_quirks { +MTK_PCIE_FIX_CLASS_ID =BIT (0 ), +MTK_PCIE_FIX_DEVICE_ID =BIT (1 ), +}; + +/** * struct mtk_pcie_soc - differentiate between host generations -* @need_fix_class_id: whether this host's class ID needed to be fixed or not -* @need_fix_device_id: whether this host's device ID needed to be fixed or not * @device_id: device ID which this host need to be fixed * @ops: pointer to configuration access functions * @startup: pointer to controller setting functions * @setup_irq: pointer to initialize IRQ functions +* @quirks: PCIe device quirks. */ struct mtk_pcie_soc { -bool need_fix_class_id; -bool need_fix_device_id;unsigned int device_id;struct pci_ops *ops;int (*startup)(struct mtk_pcie_port *port);int (*setup_irq)(struct mtk_pcie_port *port,struct device_node *node); +enum mtk_pcie_quirks quirks; };/**
@@ -710,7 +718,7 @@ static int mtk_pcie_startup_port_v2(struwritel (val, port->base +PCIE_RST_CTRL );/* Set up vendor ID and class code */ -if (soc->need_fix_class_id) { +if (soc->quirks &MTK_PCIE_FIX_CLASS_ID ) { val =PCI_VENDOR_ID_MEDIATEK ;writew (val, port->base +PCIE_CONF_VEND_ID );
@@ -718,7 +726,7 @@ static int mtk_pcie_startup_port_v2(struwritew (val, port->base +PCIE_CONF_CLASS_ID ); } -if (soc->need_fix_device_id) +if (soc->quirks &MTK_PCIE_FIX_DEVICE_ID )writew (soc->device_id, port->base +PCIE_CONF_DEVICE_ID );/* 100ms timeout value should be enough for Gen1/2 training */
@@ -1206,19 +1214,18 @@ static const struct mtk_pcie_soc mtk_pci };static const struct mtk_pcie_soc mtk_pcie_soc_mt7622 = { - .need_fix_class_id = true, .ops = &mtk_pcie_ops_v2, .startup = mtk_pcie_startup_port_v2, .setup_irq = mtk_pcie_setup_irq, + .quirks =MTK_PCIE_FIX_CLASS_ID , };static const struct mtk_pcie_soc mtk_pcie_soc_mt7629 = { - .need_fix_class_id = true, - .need_fix_device_id = true, .device_id =PCI_DEVICE_ID_MEDIATEK_7629 , .ops = &mtk_pcie_ops_v2, .startup = mtk_pcie_startup_port_v2, .setup_irq = mtk_pcie_setup_irq, + .quirks =MTK_PCIE_FIX_CLASS_ID |MTK_PCIE_FIX_DEVICE_ID , };static const struct of_device_id mtk_pcie_ids[] = {
Greg Kroah-Hartman
maintainerPATCH 627/699 PCI: mediatek: Fix IRQ domain leak when port fails to enable
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Manivannan Sadhasivam <[email protected]>
[ Upstream commit f865a57896bd92d7662eb2818d8f48872e2cbbc7 ]
When mtk_pcie_enable_port() fails, mtk_pcie_port_free() removes the port from pcie->ports and frees the port structure. However, the IRQ domains set up earlier by mtk_pcie_init_irq_domain() are never freed.
Fix this by refactoring mtk_pcie_irq_teardown() into a per-port helper, mtk_pcie_irq_teardown_port(), and calling it from mtk_pcie_setup() when mtk_pcie_enable_port() fails. Since the IRQ teardown must only happen in the probe error path (during resume, child devices may have active MSI mappings and the NOIRQ context prohibits sleeping locks), mtk_pcie_enable_port() is changed to return an error code so callers can distinguish the two paths and act accordingly.
This issue was reported by Sashiko while reviewing the EcoNet EN7528 SoC support series.
--- drivers/pci/controller/pcie-mediatek.c | 67 ++++++++++++++++++++------------- 1 file changed, 42 insertions(+), 25 deletions(-)
drivers/pci/controller/pcie-mediatek.c +42 -25
@@ -541,25 +541,29 @@ static void mtk_pcie_enable_msi(struct mwritel (val, port->base +PCIE_INT_MASK ); } -static void mtk_pcie_irq_teardown (struct mtk_pcie *pcie) +static void mtk_pcie_irq_teardown_port (struct mtk_pcie_port *port) { -struct mtk_pcie_port *port, *tmp; +irq_set_chained_handler_and_data (port->irq,NULL ,NULL ); -list_for_each_entry_safe (port, tmp, &pcie->ports, list) { -irq_set_chained_handler_and_data (port->irq,NULL ,NULL ); +if (port->irq_domain) +irq_domain_remove (port->irq_domain); -if (port->irq_domain) -irq_domain_remove (port->irq_domain); +if (IS_ENABLED (CONFIG_PCI_MSI )) { +if (port->msi_domain) +irq_domain_remove (port->msi_domain); +if (port->inner_domain) +irq_domain_remove (port->inner_domain); + } -if (IS_ENABLED (CONFIG_PCI_MSI )) { -if (port->msi_domain) -irq_domain_remove (port->msi_domain); -if (port->inner_domain) -irq_domain_remove (port->inner_domain); - } +irq_dispose_mapping (port->irq); +} -irq_dispose_mapping (port->irq); - } +static void mtk_pcie_irq_teardown (struct mtk_pcie *pcie) +{ +struct mtk_pcie_port *port, *tmp; + +list_for_each_entry_safe (port, tmp, &pcie->ports, list) +mtk_pcie_irq_teardown_port (port); } static int mtk_pcie_intx_map(struct irq_domain *domain, unsigned int irq,
@@ -836,7 +840,7 @@ static int mtk_pcie_startup_port(structreturn 0 ; } -static void mtk_pcie_enable_port (struct mtk_pcie_port *port) +static int mtk_pcie_enable_port (struct mtk_pcie_port *port) {struct mtk_pcie *pcie = port->pcie;struct device *dev = pcie->dev;
@@ -845,7 +849,7 @@ static void mtk_pcie_enable_port(struct err =clk_prepare_enable (port->sys_ck);if (err) {dev_err (dev,"failed to enable sys_ck%d clock\n" , port->slot); - goto err_sys_clk; +return err; } err =clk_prepare_enable (port->ahb_ck);
@@ -893,11 +897,15 @@ static void mtk_pcie_enable_port(struct goto err_phy_on; } -if (!pcie->soc->startup (port)) -return ; + err = pcie->soc->startup (port); +if (err) { +dev_info (dev,"Port%d link down\n" , port->slot); + goto err_soc_startup; + } -dev_info (dev,"Port%d link down\n" , port->slot); +return 0 ; +err_soc_startup:phy_power_off (port->phy); err_phy_on:phy_exit (port->phy);
@@ -913,8 +921,8 @@ err_aux_clk:clk_disable_unprepare (port->ahb_ck); err_ahb_clk:clk_disable_unprepare (port->sys_ck); -err_sys_clk: -mtk_pcie_port_free (port); + +return err; } static int mtk_pcie_parse_port(struct mtk_pcie *pcie,
@@ -1077,8 +1085,13 @@ static int mtk_pcie_setup(struct mtk_pcireturn err;/* enable each port, and then check link status */ -list_for_each_entry_safe (port, tmp, &pcie->ports, list) -mtk_pcie_enable_port (port); +list_for_each_entry_safe (port, tmp, &pcie->ports, list) { + err =mtk_pcie_enable_port (port); +if (err) { +mtk_pcie_irq_teardown_port (port); +mtk_pcie_port_free (port); + } + }/* power down PCIe subsys if slots are all empty (link down) */ if (list_empty (&pcie->ports))
@@ -1181,14 +1194,18 @@ static int __maybe_unused mtk_pcie_resum {struct mtk_pcie *pcie =dev_get_drvdata (dev);struct mtk_pcie_port *port, *tmp; +int err;if (list_empty (&pcie->ports))return 0 ;clk_prepare_enable (pcie->free_ck); -list_for_each_entry_safe (port, tmp, &pcie->ports, list) -mtk_pcie_enable_port (port); +list_for_each_entry_safe (port, tmp, &pcie->ports, list) { + err =mtk_pcie_enable_port (port); +if (err) +mtk_pcie_port_free (port); + }/* In case of EP was removed while system suspend. */ if (list_empty (&pcie->ports))
Greg Kroah-Hartman
maintainerPATCH 628/699 staging: rtl8723bs: remove DBG_871X log argument
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Fabio Aiuto <[email protected]>
[ Upstream commit 42c3243ff23d119331a8ace011e0c18b222a1138 ]
This patch prepares the application of the semantic patch aimed to remove all DBG_871X logs.
One occurrence of the DBG_871X macro has one repeated argument, that's not even comma separated value with the previous one nor a format string parameter associated.
In normal conditions this worked, for the macro is usually not expanded (the do nothing behaviour), but if I try to apply the sempantic patch to remove all macro occurrences, all macros call after that abnormal declaration are left untouched (not removed).
Remove all of the DBG_871X logs as they currently
do nothing as they require the code to be modified by hand in order to be turned on. This obviously has not happened since the code was merged, so just remove them as they are unused.
Stable-dep-of: ed51de4a86e1 ("staging: rtl8723bs: fix OOB read in update_beacon_info() IE loop")
--- drivers/staging/rtl8723bs/core/rtw_recv.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/staging/rtl8723bs/core/rtw_recv.c +1 -1
@@ -923,7 +923,7 @@ sint ap2sta_data_frame(#ifdef DBG_RX_DROP_FRAME DBG_871X ("DBG_RX_DROP_FRAME %s BSSID =" MAC_FMT ", mybssid =" MAC_FMT "\n" , __func__,MAC_ARG (pattrib->bssid),MAC_ARG (mybssid)); - DBG_871X("this adapter = %d, buddy adapter = %d\n", adapter->adapter_type, adapter->pbuddystruct adapter->adapter_type); +DBG_871X ("this adapter = %d, buddy adapter = %d\n" , adapter->adapter_type, adapter->pbuddystruct);#endif if (!bmcast) {
Greg Kroah-Hartman
maintainerPATCH 629/699 crypto: qat - fix VF2PF work teardown race in adf_disable_sriov()
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Giovanni Cabiddu <[email protected]>
[ Upstream commit 277281c10c63791067d24d421f7c43a15faa9096 ]
The VF2PF interrupt handler queues PF-side response work that stores a raw pointer to per-VF state (struct adf_accel_vf_info). Currently, adf_disable_sriov() destroys per-VF mutexes and frees vf_info without stopping new VF2PF work or waiting for in-flight workers to complete. A concurrently scheduled or already queued worker can then dereference freed memory.
This manifests as a use-after-free when KASAN is enabled:
BUG: KASAN: null-ptr-deref in mutex_lock+0x76/0xe0
Write of size 8 at addr 0000000000000260 by task kworker/24:2/...
Workqueue: qat_pf2vf_resp_wq adf_iov_send_resp [intel_qat]
Call Trace:
kasan_report+0x119/0x140
mutex_lock+0x76/0xe0
adf_gen4_pfvf_send+0xd4/0x1f0 [intel_qat]
adf_recv_and_handle_vf2pf_msg+0x290/0x360 [intel_qat]
adf_iov_send_resp+0x8c/0xe0 [intel_qat]
process_one_work+0x6ac/0xfd0
worker_thread+0x4dd/0xd30
kthread+0x326/0x410
ret_from_fork+0x33b/0x670Add a PF-local flag, vf2pf_disabled, that gates work queueing, worker processing, and interrupt re-enabling during teardown. Set this flag atomically with the hardware interrupt mask inside adf_disable_all_vf2pf_interrupts(). After masking, synchronize the AE cluster MSI-X interrupt and flush the PF response workqueue before tearing down per-VF locks and state so all in-flight work completes before vf_info is destroyed.
Introduce adf_enable_all_vf2pf_interrupts() to clear the flag and unmask all VF2PF interrupts under the same lock when SR-IOV is re-enabled. This ensures the software flag and hardware state transition atomically on both the enable and disable paths.
--- drivers/crypto/qat/qat_common/adf_accel_devices.h | 2 + drivers/crypto/qat/qat_common/adf_common_drv.h | 4 ++ drivers/crypto/qat/qat_common/adf_isr.c | 18 ++++++++++ drivers/crypto/qat/qat_common/adf_pf2vf_msg.c | 22 ++++++++++++ drivers/crypto/qat/qat_common/adf_sriov.c | 38 +++++++++++++++++----- 5 files changed, 76 insertions(+), 8 deletions(-)
drivers/crypto/qat/qat_common/adf_accel_devices.h +2 -0
@@ -191,6 +191,8 @@ struct adf_accel_dev {struct adf_accel_pci accel_pci_dev;union {struct { +/* prevents VF2PF handling from racing with VF state teardown */ +bool vf2pf_disabled;/* vf_info is non-zero when SR-IOV is init'ed */ struct adf_accel_vf_info *vf_info; } pf;
drivers/crypto/qat/qat_common/adf_common_drv.h +4 -0
@@ -125,6 +125,7 @@ void qat_asym_algs_unregister(void);int adf_isr_resource_alloc (struct adf_accel_dev *accel_dev);void adf_isr_resource_free (struct adf_accel_dev *accel_dev); +void adf_isr_sync_ae_cluster (struct adf_accel_dev *accel_dev);int adf_vf_isr_resource_alloc (struct adf_accel_dev *accel_dev);void adf_vf_isr_resource_free (struct adf_accel_dev *accel_dev);
@@ -189,6 +190,9 @@ void adf_disable_vf2pf_interrupts(struct u32 vf_mask);void adf_enable_vf2pf_interrupts (struct adf_accel_dev *accel_dev,u32 vf_mask); +void adf_enable_all_vf2pf_interrupts (struct adf_accel_dev *accel_dev, +u32 num_vfs); +void adf_disable_all_vf2pf_interrupts (struct adf_accel_dev *accel_dev);void adf_enable_pf2vf_interrupts (struct adf_accel_dev *accel_dev);void adf_disable_pf2vf_interrupts (struct adf_accel_dev *accel_dev);
drivers/crypto/qat/qat_common/adf_isr.c +18 -0
@@ -117,6 +117,24 @@ static irqreturn_t adf_msix_isr_ae(int ireturn IRQ_NONE ; } +void adf_isr_sync_ae_cluster (struct adf_accel_dev *accel_dev) +{ +struct adf_accel_pci *pci_dev_info = &accel_dev->accel_pci_dev; +struct adf_hw_device_data *hw_data = accel_dev->hw_device; +struct msix_entry *msixe = pci_dev_info->msix_entries.entries; +u32 num_entries = pci_dev_info->msix_entries.num_entries; +u32 irq_idx; + +if (!test_bit (ADF_STATUS_IRQ_ALLOCATED , &accel_dev->status) || !msixe) +return ; + + irq_idx = num_entries >1 ? hw_data->num_banks :0 ; +if (irq_idx >= num_entries) +return ; + +synchronize_irq (msixe[irq_idx].vector); +} +static int adf_request_irqs (struct adf_accel_dev *accel_dev) {struct adf_accel_pci *pci_dev_info = &accel_dev->accel_pci_dev;
drivers/crypto/qat/qat_common/adf_pf2vf_msg.c +22 -0
@@ -40,6 +40,9 @@ void adf_enable_vf2pf_interrupts(structvoid __iomem *pmisc_addr = pmisc->virt_addr;u32 reg; +if (READ_ONCE (accel_dev->pf.vf2pf_disabled)) +return ; +/* Enable VF2PF Messaging Ints - VFs 1 through 16 per vf_mask[15:0] */ if (vf_mask &0xFFFF ) { reg =ADF_CSR_RD (pmisc_addr,ADF_DH895XCC_ERRMSK3 );
@@ -55,6 +58,19 @@ void adf_enable_vf2pf_interrupts(struct } } +void adf_enable_all_vf2pf_interrupts (struct adf_accel_dev *accel_dev, +u32 num_vfs) +{ +u32 vf_mask; + + vf_mask =BIT_ULL (num_vfs) -1 ; +if (!vf_mask) +return ; + +WRITE_ONCE (accel_dev->pf.vf2pf_disabled, false); +adf_enable_vf2pf_interrupts (accel_dev, vf_mask); +} +void adf_disable_vf2pf_interrupts (struct adf_accel_dev *accel_dev,u32 vf_mask) {struct adf_hw_device_data *hw_data = accel_dev->hw_device;
@@ -78,6 +94,12 @@ void adf_disable_vf2pf_interrupts(struct } } +void adf_disable_all_vf2pf_interrupts (struct adf_accel_dev *accel_dev) +{ +WRITE_ONCE (accel_dev->pf.vf2pf_disabled, true); +adf_disable_vf2pf_interrupts (accel_dev,GENMASK (31 ,0 )); +} +static int __adf_iov_putmsg (struct adf_accel_dev *accel_dev,u32 msg,u8 vf_nr) {struct adf_accel_pci *pci_info = &accel_dev->accel_pci_dev;
drivers/crypto/qat/qat_common/adf_sriov.c +30 -8
@@ -44,16 +44,27 @@ static void adf_iov_send_resp(struct wor {struct adf_pf2vf_resp *pf2vf_resp = container_of(work, struct adf_pf2vf_resp, pf2vf_resp_work); +struct adf_accel_vf_info *vf_info = pf2vf_resp->vf_info; +struct adf_accel_dev *accel_dev = vf_info->accel_dev; -adf_vf2pf_req_hndl (pf2vf_resp->vf_info); +if (READ_ONCE (accel_dev->pf.vf2pf_disabled)) + goto out; + +adf_vf2pf_req_hndl (vf_info); + +out:kfree (pf2vf_resp); }static void adf_vf2pf_bh_handler (void *data) {struct adf_accel_vf_info *vf_info = (struct adf_accel_vf_info *)data; +struct adf_accel_dev *accel_dev = vf_info->accel_dev;struct adf_pf2vf_resp *pf2vf_resp; +if (READ_ONCE (accel_dev->pf.vf2pf_disabled)) +return ; + pf2vf_resp =kzalloc (sizeof (*pf2vf_resp),GFP_ATOMIC );if (!pf2vf_resp)return ;
@@ -63,6 +74,12 @@ static void adf_vf2pf_bh_handler(void *dqueue_work (pf2vf_resp_wq, &pf2vf_resp->pf2vf_resp_work); } +static void adf_flush_pf2vf_resp_wq (void ) +{ +if (pf2vf_resp_wq) +flush_workqueue (pf2vf_resp_wq); +} +static int adf_enable_sriov (struct adf_accel_dev *accel_dev) {struct pci_dev *pdev =accel_to_pci_dev (accel_dev);
@@ -105,7 +122,7 @@ static int adf_enable_sriov(struct adf_a }/* Enable VF to PF interrupts for all VFs */ -adf_enable_vf2pf_interrupts (accel_dev,GENMASK_ULL (totalvfs -1 ,0 )); +adf_enable_all_vf2pf_interrupts (accel_dev, totalvfs);/* * Due to the hardware design, when SR-IOV and the ring arbiter
@@ -142,8 +159,16 @@ void adf_disable_sriov(struct adf_accel_pci_disable_sriov (accel_to_pci_dev (accel_dev)); -/* Disable VF to PF interrupts */ -adf_disable_vf2pf_interrupts (accel_dev,0xFFFFFFFF ); +/* Block VF2PF work and disable VF to PF interrupts */ +adf_disable_all_vf2pf_interrupts (accel_dev); +adf_isr_sync_ae_cluster (accel_dev); + +for (i =0 , vf = accel_dev->pf.vf_info; i < totalvfs; i++, vf++) { +tasklet_disable (&vf->vf2pf_bh_tasklet); +tasklet_kill (&vf->vf2pf_bh_tasklet); + } + +adf_flush_pf2vf_resp_wq ();/* Clear Valid bits in ME Thread to PCIe Function Mapping Group A */ for (i =0 ; i <ME2FUNCTION_MAP_A_NUM_REGS ; i++) {
@@ -159,11 +184,8 @@ void adf_disable_sriov(struct adf_accel_WRITE_CSR_ME2FUNCTION_MAP_B (pmisc_addr, i, reg); } -for (i =0 , vf = accel_dev->pf.vf_info; i < totalvfs; i++, vf++) { -tasklet_disable (&vf->vf2pf_bh_tasklet); -tasklet_kill (&vf->vf2pf_bh_tasklet); +for (i =0 , vf = accel_dev->pf.vf_info; i < totalvfs; i++, vf++)mutex_destroy (&vf->pf2vf_lock); - }kfree (accel_dev->pf.vf_info); accel_dev->pf.vf_info =NULL ;
Greg Kroah-Hartman
maintainerPATCH 630/699 PCI: Prevent resource tree corruption when BAR resize fails
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ilpo Järvinen <[email protected]>
[ Upstream commit 91c4c89db41499eea1b29c56655f79c3bae66e93 ]
pbus_reassign_bridge_resources() saves bridge windows into the saved list before attempting to adjust resource assignments to perform a BAR resize operation. If resource adjustments cannot be completed fully, rollback is attempted by restoring the resource from the saved list.
The rollback, however, does not check whether the resources it restores were assigned by the partial resize attempt. If restore changes addresses of the resource, it can result in corrupting the resource tree.
An example of a corrupted resource tree with overlapping addresses:
6200000000000-6203fbfffffff : pciex@620c3c0000000
6200000000000-6203fbff0ffff : PCI Bus 0030:01
6200020000000-62000207fffff : 0030:01:00.0
6200000000000-6203fbff0ffff : PCI Bus 0030:02A resource that are assigned into the resource tree must remain unchanged. Thus, release such a resource before attempting to restore and claim it back.
For simplicity, always do the release and claim back for the resource even in the cases where it is restored to the same address range.
Note: this fix may "break" some cases where devices "worked" because the resource tree corruption allowed address space double counting to fit more resource than what can now be assigned without double counting. The upcoming changes to BAR resizing should address those scenarios (to the extent possible).
Stable-dep-of: ee7471fe968d ("PCI: Skip Resizable BAR restore on read error")
--- drivers/pci/setup-bus.c | 5 +++++ 1 file changed, 5 insertions(+)
drivers/pci/setup-bus.c +5 -0
@@ -2257,6 +2257,11 @@ cleanup: bridge = dev_res->dev; i = res - bridge->resource; +if (res->parent) { +release_child_resources (res); +pci_release_resource (bridge, i); + } + res->start = dev_res->start; res->end = dev_res->end; res->flags = dev_res->flags;
Greg Kroah-Hartman
maintainerPATCH 631/699 PCI: Free saved list without holding pci_bus_sem
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ilpo Järvinen <[email protected]>
[ Upstream commit 1d8a0506f69895b7cfd9d5c4546761c508231a8a ]
Freeing the saved list does not require holding pci_bus_sem, so the critical section can be made shorter.
Stable-dep-of: ee7471fe968d ("PCI: Skip Resizable BAR restore on read error")
--- drivers/pci/setup-bus.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/pci/setup-bus.c +1 -1
@@ -2269,8 +2269,8 @@ cleanup:pci_claim_resource (bridge, i);pci_setup_bridge (bridge->subordinate); } -free_list (&saved);up_read (&pci_bus_sem); +free_list (&saved);return ret; }
Greg Kroah-Hartman
maintainerPATCH 632/699 PCI: Fix restoring BARs on BAR resize rollback path
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ilpo Järvinen <[email protected]>
[ Upstream commit 337b1b566db087347194e4543ddfdfa5645275cc ]
BAR resize operation is implemented in the pci_resize_resource() and pbus_reassign_bridge_resources() functions. pci_resize_resource() can be called either from __resource_resize_store() from sysfs or directly by the driver for the Endpoint Device.
The pci_resize_resource() requires that caller has released the device resources that share the bridge window with the BAR to be resized as otherwise the bridge window is pinned in place and cannot be changed.
pbus_reassign_bridge_resources() rolls back resources if the resize operation fails, but rollback is performed only for the bridge windows. Because releasing the device resources are done by the caller of the BAR resize interface, these functions performing the BAR resize do not have access to the device resources as they were before the resize.
pbus_reassign_bridge_resources() could try __pci_bridge_assign_resources() after rolling back the bridge windows as they were, however, it will not guarantee the resource are assigned due to differences in how FW and the kernel assign the resources (alignment of the start address and tail).
To perform rollback robustly, the BAR resize interface has to be altered to also release the device resources that share the bridge window with the BAR to be resized.
Also, remove restoring from the entries failed list as saved list should now contain both the bridge windows and device resources so the extra restore is duplicated work.
Some drivers (currently only amdgpu) want to prevent releasing some resources. Add exclude_bars param to pci_resize_resource() and make amdgpu pass its register BAR (BAR 2 or 5), which should never be released during resize operation. Normally 64-bit prefetchable resources do not share a bridge window with the 32-bit only register BAR, but there are various fallbacks in the resource assignment logic which may make the resources share the bridge window in rare cases.
This change (together with the driver side changes) is to counter the resource releases that had to be done to prevent resource tree corruption in the ("PCI: Release assigned resource before restoring them") change. As such, it likely restores functionality in cases where device resources were released to avoid resource tree conflicts which appeared to be "working" when such conflicts were not correctly detected by the kernel.
[bhelgaas: squash amdgpu BAR selection from
https: //lore.kernel.org/r/[email protected]]
Stable-dep-of: ee7471fe968d ("PCI: Skip Resizable BAR restore on read error")
--- drivers/gpu/drm/amd/amdgpu/amdgpu_device.c | 4 - drivers/pci/pci.h | 3 drivers/pci/setup-bus.c | 97 +++++++++++++++++++---------- drivers/pci/setup-res.c | 19 +---- include/linux/pci.h | 4 - 5 files changed, 79 insertions(+), 48 deletions(-)
drivers/gpu/drm/amd/amdgpu/amdgpu_device.c +3 -1
@@ -1141,7 +1141,9 @@ int amdgpu_device_resize_fb_bar(struct apci_release_resource (adev->pdev,0 ); - r =pci_resize_resource (adev->pdev,0 , rbar_size); + r =pci_resize_resource (adev->pdev,0 , rbar_size, + (adev->asic_type >=CHIP_BONAIRE ) ?1 <<5 + :1 <<2 );if (r == -ENOSPC )DRM_INFO ("Not enough PCI address space for a large BAR." );else if (r && r != -ENOTSUPP )
drivers/pci/pci.h +3 -0
@@ -284,6 +284,9 @@ enum pci_bar_type {struct device *pci_get_host_bridge_device (struct pci_dev *dev);void pci_put_host_bridge_device (struct device *dev); +int pci_do_resource_release_and_resize (struct pci_dev *dev,int resno,int size, +int exclude_bars); +int pci_configure_extended_tags (struct pci_dev *dev,void *ign);bool pci_bus_read_dev_vendor_id (struct pci_bus *bus,int devfn,u32 *pl,int crs_timeout);
drivers/pci/setup-bus.c +66 -31
160 lines not on this page · raw message
drivers/pci/setup-res.c +5 -14
@@ -422,9 +422,9 @@ void pci_release_resource(struct pci_dev }EXPORT_SYMBOL (pci_release_resource); -int pci_resize_resource (struct pci_dev *dev,int resno,int size) +int pci_resize_resource (struct pci_dev *dev,int resno,int size, +int exclude_bars) { -struct resource *res = dev->resource + resno;struct pci_host_bridge *host;int old, ret;u32 sizes;
@@ -435,10 +435,6 @@ int pci_resize_resource(struct pci_dev *if (host->preserve_config)return -ENOTSUPP ; -/* Make sure the resource isn't assigned before resizing it. */ -if (!(res->flags &IORESOURCE_UNSET )) -return -EBUSY ; -pci_read_config_word (dev,PCI_COMMAND , &cmd);if (cmd &PCI_COMMAND_MEMORY )return -EBUSY ;
@@ -458,19 +454,14 @@ int pci_resize_resource(struct pci_dev *if (ret)return ret; - res->end = res->start +pci_rebar_size_to_bytes (size) -1 ; + ret =pci_do_resource_release_and_resize (dev, resno, size, exclude_bars); +if (ret) + goto error_resize; -/* Check if the new config works by trying to assign everything. */ -if (dev->bus->self) { - ret =pci_reassign_bridge_resources (dev->bus->self, res->flags); -if (ret) - goto error_resize; - }return 0 ; error_resize:pci_rebar_set_size (dev, resno, old); - res->end = res->start +pci_rebar_size_to_bytes (old) -1 ;return ret; }EXPORT_SYMBOL (pci_resize_resource);
include/linux/pci.h +2 -2
@@ -1257,7 +1257,8 @@ void pci_update_resource(struct pci_devint __must_check pci_assign_resource (struct pci_dev *dev,int i);int __must_check pci_reassign_resource (struct pci_dev *dev,int i,resource_size_t add_size,resource_size_t align);void pci_release_resource (struct pci_dev *dev,int resno); -int __must_check pci_resize_resource (struct pci_dev *dev,int i,int size); +int __must_check pci_resize_resource (struct pci_dev *dev,int i,int size, +int exclude_bars);int pci_select_bars (struct pci_dev *dev,unsigned long flags);bool pci_device_is_present (struct pci_dev *pdev);void pci_ignore_hotplug (struct pci_dev *dev);
@@ -1332,7 +1333,6 @@ void pci_assign_unassigned_resources(voivoid pci_assign_unassigned_bridge_resources (struct pci_dev *bridge);void pci_assign_unassigned_bus_resources (struct pci_bus *bus);void pci_assign_unassigned_root_bus_resources (struct pci_bus *bus); -int pci_reassign_bridge_resources (struct pci_dev *bridge,unsigned long type);void pdev_enable_device (struct pci_dev *);int pci_enable_resources (struct pci_dev *,int mask);void pci_assign_irq (struct pci_dev *dev);
Greg Kroah-Hartman
maintainerPATCH 633/699 PCI: Add kerneldoc for pci_resize_resource()
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ilpo Järvinen <[email protected]>
[ Upstream commit d787018e2dfdc4c1331538e7a8717690d1b7c9b3 ]
As pci_resize_resource() is meant to be used also outside of PCI core, document the interface with kerneldoc.
Stable-dep-of: ee7471fe968d ("PCI: Skip Resizable BAR restore on read error")
--- drivers/pci/setup-res.c | 20 ++++++++++++++++++++ 1 file changed, 20 insertions(+)
drivers/pci/setup-res.c +20 -0
@@ -422,6 +422,26 @@ void pci_release_resource(struct pci_dev }EXPORT_SYMBOL (pci_release_resource); +/** +* pci_resize_resource - reconfigure a Resizable BAR and resources +* @dev: the PCI device +* @resno: index of the BAR to be resized +* @size: new size as defined in the spec (0=1MB, 31=128TB) +* @exclude_bars: a mask of BARs that should not be released +* +* Reconfigure @resno to @size and re-run resource assignment algorithm +* with the new size. +* +* Prior to resize, release @dev resources that share a bridge window with +* @resno. This unpins the bridge window resource to allow changing it. +* +* The caller may prevent releasing a particular BAR by providing +* @exclude_bars mask, but this may result in the resize operation failing +* due to insufficient space. +* +* Return: 0 on success, or negative on error. In case of an error, the +* resources are restored to their original places. +*/ int pci_resize_resource (struct pci_dev *dev,int resno,int size,int exclude_bars) {
Greg Kroah-Hartman
maintainerPATCH 634/699 PCI: Move Resizable BAR code to rebar.c
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ilpo Järvinen <[email protected]>
[ Upstream commit 9f71938cd77f32a448f40a288e409eca60e55486 ]
For lack of a better place to put it, Resizable BAR code has been placed inside pci.c and setup-res.c that do not use it for anything. Upcoming changes are going to add more Resizable BAR related functions, increasing the code size.
As pci.c is huge as is, move the Resizable BAR related code and the BAR resize code from setup-res.c to rebar.c.
Stable-dep-of: ee7471fe968d ("PCI: Skip Resizable BAR restore on read error")
--- Documentation/driver-api/pci/pci.rst | 3 drivers/pci/Makefile | 2 drivers/pci/pci.c | 135 ---------------------- drivers/pci/pci.h | 1 drivers/pci/rebar.c | 211 +++++++++++++++++++++++++++++++++++ drivers/pci/setup-res.c | 64 ---------- 6 files changed, 216 insertions(+), 200 deletions(-) create mode 100644 drivers/pci/rebar.c
Documentation/driver-api/pci/pci.rst +3 -0
@@ -31,6 +31,9 @@ PCI Support Library .. kernel-doc:: drivers/pci/slot.c :export: +.. kernel-doc:: drivers/pci/rebar.c + :export: + .. kernel-doc:: drivers/pci/rom.c :export:
drivers/pci/Makefile +1 -1
@@ -4,7 +4,7 @@ obj-$(CONFIG_PCI) += access.o bus.o probe.o host-bridge.o \ remove.o pci.o pci-driver.o search.o \ - pci-sysfs.o rom.o setup-res.o irq.o vpd.o \ + pci-sysfs.o rebar.o rom.o setup-res.o irq.o vpd.o \ setup-bus.o vc.o mmap.o setup-irq.o obj-$(CONFIG_PCI) += pcie/
drivers/pci/pci.c +0 -135
147 lines not on this page · raw message
drivers/pci/pci.h +1 -0
@@ -629,6 +629,7 @@ static inline int acpi_get_rc_resources(#endif u32 pci_rebar_get_possible_sizes (struct pci_dev *pdev,int bar); +void pci_restore_rebar_state (struct pci_dev *pdev);int pci_rebar_get_current_size (struct pci_dev *pdev,int bar);int pci_rebar_set_size (struct pci_dev *pdev,int bar,int size);static inline u64 pci_rebar_size_to_bytes (int size)
drivers/pci/rebar.c new file +211 -0
211 lines not on this page · raw message
drivers/pci/setup-res.c +0 -64
70 lines not on this page · raw message
Greg Kroah-Hartman
maintainerPATCH 635/699 PCI: Skip Resizable BAR restore on read error
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Marco Nenciarini <[email protected]>
[ Upstream commit ee7471fe968d210939be9046089a924cd23c8c3b ]
pci_restore_rebar_state() uses the Resizable BAR Control register to decide how many BARs to restore (nbars) and which BAR each iteration addresses (bar_idx).
When a device does not respond, config reads typically return PCI_ERROR_RESPONSE (~0). Both fields are 3 bits wide, so nbars and bar_idx both evaluate to 7, past the spec's valid ranges for both fields. pci_resource_n() then returns an unrelated resource slot, whose size is used to derive a nonsensical value written back to the Resizable BAR Control register.
Bail out if any Resizable BAR Control read returns PCI_ERROR_RESPONSE. No further BARs are touched, which is safe because a config read that returns PCI_ERROR_RESPONSE indicates the device is unreachable and restoration is pointless.
--- drivers/pci/rebar.c | 6 ++++++ 1 file changed, 6 insertions(+)
drivers/pci/rebar.c +6 -0
@@ -130,6 +130,9 @@ void pci_restore_rebar_state(struct pci_return ;pci_read_config_dword (pdev, pos +PCI_REBAR_CTRL , &ctrl); +if (PCI_POSSIBLE_ERROR (ctrl)) +return ; + nbars =FIELD_GET (PCI_REBAR_CTRL_NBAR_MASK , ctrl);for (i =0 ; i < nbars; i++, pos +=8 ) {
@@ -137,6 +140,9 @@ void pci_restore_rebar_state(struct pci_int bar_idx, size;pci_read_config_dword (pdev, pos +PCI_REBAR_CTRL , &ctrl); +if (PCI_POSSIBLE_ERROR (ctrl)) +return ; + bar_idx = ctrl &PCI_REBAR_CTRL_BAR_IDX ; res = pdev->resource + bar_idx; size =ilog2 (resource_size (res)) -20 ;
Greg Kroah-Hartman
maintainerPATCH 636/699 coresight: etb10: restore atomic_t for shared reading state
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Runyu Xiao <[email protected]>
[ Upstream commit fa09f08ede3db3050ae16ae1ed92c902d0cada23 ]
The etb10 miscdevice uses drvdata->reading as a shared exclusivity gate for userspace buffer access. etb_open() claims that gate with local_cmpxchg(), and etb_release() clears it with local_set().
That gate is shared per-device state rather than CPU-local state. A running system can reach it whenever /dev/<etb> is opened, closed, and reopened by different tasks while the device remains registered, so the same drvdata->reading variable may be claimed on one CPU and later cleared on another.
This code used to use atomic_t for the same gate, but commit 27b10da8fff2 ("coresight: etb10: moving to local atomic operations") changed it to local_t even though the access pattern remained cross-task and cross-CPU. Restore atomic_t together with atomic_cmpxchg() and atomic_set() so the exclusivity gate again uses a primitive intended for shared state.
The issue was found on Linux v6.18.21 by our static analysis tool while scanning surviving local_t-on-shared-state sites, and then manually reviewed against the live etb10 file-op path.
It was runtime-validated with a reproducible QEMU no-device KCSAN PoC that kept the same report-local contract:
1. use one shared struct etb_drvdata carrier and its
drvdata->reading gate;
2. call etb_open() and etb_release() sequentially on that gate to
confirm the original claim/clear path;
3. bind the open side to CPU0 and the release side to CPU1 for the
same gate to show cross-CPU ownership; 4. run bound workers that repeatedly race etb_open() and etb_release() on the same gate until KCSAN reports a target hit.
The harness recorded:
L1 passed open=1 release=1
reading_after_open=1 reading_after_release=0
L2 passed open_cpu=0 release_cpu=1
cross_cpu_release=1 reading_after=0 open_ret=0
Representative KCSAN excerpt from the no-device validation run:
BUG: KCSAN: data-race in etb_open.constprop.0.isra.0 [vuln_msv]
write to 0xffffffffc0003810 of 4 bytes by task 216 on cpu 1:
etb_open.constprop.0.isra.0+0x38/0x80 [vuln_msv] l3_worker_thread_fn+0x4f/0xf0 [vuln_msv] kthread+0x17e/0x1c0 ret_from_fork+0x22/0x30
read to 0xffffffffc0003810 of 4 bytes by task 215 on cpu 0:
etb_open.constprop.0.isra.0+0x18/0x80 [vuln_msv] l3_worker_thread_fn+0x4f/0xf0 [vuln_msv] kthread+0x17e/0x1c0 ret_from_fork+0x22/0x30
value changed: 0x00000000 -> 0x00000001
Reported by Kernel Concurrency Sanitizer on:
CPU: 0 PID: 215 Comm: etb10_l3_a Tainted: G O 6.1.66 #2
This no-device harness is not a real ETB10 hardware end-to-end run, but it preserves the same shared drvdata->reading gate and the same etb_open()/etb_release() claim/clear contract. No real ETB10 hardware was available for runtime testing.
Build-tested with:
make olddefconfig
make -j"$(nproc)" drivers/hwtracing/coresight/coresight-etb10.o
--- drivers/hwtracing/coresight/coresight-etb10.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-)
drivers/hwtracing/coresight/coresight-etb10.c +3 -3
@@ -86,7 +86,7 @@ struct etb_drvdata {struct coresight_device *csdev;struct miscdevice miscdev;spinlock_t spinlock; -local_t reading; +atomic_t reading;pid_t pid;u8 *buf;u32 mode;
@@ -603,7 +603,7 @@ static int etb_open(struct inode *inode,struct etb_drvdata *drvdata =container_of (file->private_data, struct etb_drvdata, miscdev); -if (local_cmpxchg (&drvdata->reading,0 ,1 )) +if (atomic_cmpxchg (&drvdata->reading,0 ,1 ))return -EBUSY ;dev_dbg (&drvdata->csdev->dev,"%s: successfully opened\n" , __func__);
@@ -641,7 +641,7 @@ static int etb_release(struct inode *ino {struct etb_drvdata *drvdata =container_of (file->private_data, struct etb_drvdata, miscdev); -local_set (&drvdata->reading,0 ); +atomic_set (&drvdata->reading,0 );dev_dbg (&drvdata->csdev->dev,"%s: released\n" , __func__);return 0 ;
Greg Kroah-Hartman
maintainerPATCH 637/699 netfilter: ebtables: Use vmalloc_array() to improve code
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Qianfeng Rong <[email protected]>
[ Upstream commit 46015e6b3ea75297b28d4806564f3f692cf11861 ]
Remove array_size() calls and replace vmalloc() with vmalloc_array() to simplify the code. vmalloc_array() is also optimized better, uses fewer instructions, and handles overflow more concisely[1].
[1]: https://lore.kernel.org/lkml/[email protected]/
Stable-dep-of: cbfe53599eeb ("netfilter: ebtables: zero chainstack array")
--- net/bridge/netfilter/ebtables.c | 14 +++++++------- 1 file changed, 7 insertions(+), 7 deletions(-)
net/bridge/netfilter/ebtables.c +7 -7
@@ -884,8 +884,8 @@ static int translate_table(struct net *n* if an error occurs */ newinfo->chainstack = -vmalloc (array_size (nr_cpu_ids, -sizeof (*(newinfo->chainstack)))); +vmalloc_array (nr_cpu_ids, +sizeof (*(newinfo->chainstack)));if (!newinfo->chainstack)return -ENOMEM ;for_each_possible_cpu (i) {
@@ -900,7 +900,7 @@ static int translate_table(struct net *n } } - cl_s =vmalloc (array_size (udc_cnt,sizeof (*cl_s))); + cl_s =vmalloc_array (udc_cnt,sizeof (*cl_s));if (!cl_s)return -ENOMEM ; i =0 ;/* the i'th udc */
@@ -980,8 +980,8 @@ static int do_replace_finish(struct net* the check on the size is done later, when we have the lock */ if (repl->num_counters) { -unsigned long size = repl->num_counters *sizeof (*counterstmp); - counterstmp =vmalloc (size); + counterstmp =vmalloc_array (repl->num_counters, +sizeof (*counterstmp));if (!counterstmp)return -ENOMEM ; }
@@ -1276,7 +1276,7 @@ static int do_update_counters(struct netif (num_counters ==0 )return -EINVAL ; - tmp =vmalloc (array_size (num_counters,sizeof (*tmp))); + tmp =vmalloc_array (num_counters,sizeof (*tmp));if (!tmp)return -ENOMEM ;
@@ -1417,7 +1417,7 @@ static int copy_counters_to_user(structif (num_counters != nentries)return -EINVAL ; - counterstmp =vmalloc (array_size (nentries,sizeof (*counterstmp))); + counterstmp =vmalloc_array (nentries,sizeof (*counterstmp));if (!counterstmp)return -ENOMEM ;