From 259c1de4bc39e46059d9dd81a696f0165159e54a Mon Sep 17 00:00:00 2001 From: Gaurav Kohli Date: Sat, 25 Mar 2017 17:36:30 +0530 Subject: [PATCH 01/41] soc: qcom: pil: Explicitly clear the subsystem loading address Explicitly clear the subsystem loading address in case of any memory failure. It will help to avoid any platform dependency. Change-Id: I3be8f6318d68f02c02e637fc34f4a868e9fafa45 Signed-off-by: Gaurav Kohli Signed-off-by: Srinivasarao P --- drivers/soc/qcom/peripheral-loader.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/drivers/soc/qcom/peripheral-loader.c b/drivers/soc/qcom/peripheral-loader.c index 300688a2b4663..f6d993f23e55b 100644 --- a/drivers/soc/qcom/peripheral-loader.c +++ b/drivers/soc/qcom/peripheral-loader.c @@ -381,6 +381,8 @@ static int pil_alloc_region(struct pil_priv *priv, phys_addr_t min_addr, if (region == NULL) { pil_err(priv->desc, "Failed to allocate relocatable region of size %zx\n", size); + priv->region_start = 0; + priv->region_end = 0; return -ENOMEM; } From 6bc05bd969c9380620bfd0b38445dfba1ae32dc2 Mon Sep 17 00:00:00 2001 From: Udaya Bhaskara Reddy Mallavarapu Date: Sat, 1 Apr 2017 05:17:06 +0530 Subject: [PATCH 02/41] media: dvb-core: Add feed state check before stop dvbdemux feed Add feed state check whether any filter is configured on dvbdemux feed before feed stop is called. If any filter is started the feed status should be set to DMX_STATE_GO. CRs-Fixed: 1090466 Change-Id: I8dfa9e5b656a1aa71f4bc1abdc05ff146869088d Signed-off-by: Udaya Bhaskara Reddy Mallavarapu --- drivers/media/dvb-core/dvb_demux.c | 5 +++++ .../platform/msm/dvb/demux/mpq_dmx_plugin_common.c | 12 ++++++++++-- 2 files changed, 15 insertions(+), 2 deletions(-) diff --git a/drivers/media/dvb-core/dvb_demux.c b/drivers/media/dvb-core/dvb_demux.c index 2d08cf21da22d..d77ed13b1327d 100644 --- a/drivers/media/dvb-core/dvb_demux.c +++ b/drivers/media/dvb-core/dvb_demux.c @@ -2839,6 +2839,11 @@ static int dmx_section_feed_stop_filtering(struct dmx_section_feed *feed) mutex_lock(&dvbdmx->mutex); + if (dvbdmxfeed->state < DMX_STATE_GO) { + mutex_unlock(&dvbdmx->mutex); + return -EINVAL; + } + if (!dvbdmx->stop_feed) { mutex_unlock(&dvbdmx->mutex); return -ENODEV; diff --git a/drivers/media/platform/msm/dvb/demux/mpq_dmx_plugin_common.c b/drivers/media/platform/msm/dvb/demux/mpq_dmx_plugin_common.c index 32498e7c6661c..2abc562d1656f 100644 --- a/drivers/media/platform/msm/dvb/demux/mpq_dmx_plugin_common.c +++ b/drivers/media/platform/msm/dvb/demux/mpq_dmx_plugin_common.c @@ -1806,7 +1806,11 @@ int mpq_dmx_terminate_feed(struct dvb_demux_feed *feed) } mpq_sdmx_close_session(mpq_demux); - mpq_demux->num_secure_feeds--; + if (mpq_demux->num_secure_feeds > 0) + mpq_demux->num_secure_feeds--; + else + MPQ_DVB_DBG_PRINT("%s: Invalid secure feed count= %u\n", + __func__, mpq_demux->num_secure_feeds); } if (dvb_dmx_is_video_feed(feed)) { @@ -1823,7 +1827,11 @@ int mpq_dmx_terminate_feed(struct dvb_demux_feed *feed) } mpq_sdmx_terminate_metadata_buffer(mpq_feed); - mpq_demux->num_active_feeds--; + if (mpq_demux->num_active_feeds > 0) + mpq_demux->num_active_feeds--; + else + MPQ_DVB_DBG_PRINT("%s: Invalid num_active_feeds count = %u\n", + __func__, mpq_demux->num_active_feeds); mutex_unlock(&mpq_demux->mutex); From e1dc14e48001eecb5e6c3589840f81abd09dc5ea Mon Sep 17 00:00:00 2001 From: Abdulla Anam Date: Wed, 22 Mar 2017 14:00:10 +0530 Subject: [PATCH 03/41] msm: vidc: Protect debug_buffer access in core_info_read with lock. Serialize core_info_read with lock so that multiple concurrent threads do not cause the write to overflow. Also have the bound check to avoid overflow in write_str function. CRs-Fixed: 2013361 Change-Id: Ia18a4b94cafd69af1d367861f2499fc202f18e9f Signed-off-by: Abdulla Anam Signed-off-by: Sanjay Singh --- .../media/platform/msm/vidc/msm_v4l2_vidc.c | 5 ++- .../media/platform/msm/vidc/msm_vidc_debug.c | 37 ++++++++++++++++--- .../media/platform/msm/vidc/msm_vidc_debug.h | 3 +- 3 files changed, 37 insertions(+), 8 deletions(-) diff --git a/drivers/media/platform/msm/vidc/msm_v4l2_vidc.c b/drivers/media/platform/msm/vidc/msm_v4l2_vidc.c index 2e06ce1d8d33c..d42356e8c45c6 100644 --- a/drivers/media/platform/msm/vidc/msm_v4l2_vidc.c +++ b/drivers/media/platform/msm/vidc/msm_v4l2_vidc.c @@ -1,4 +1,4 @@ -/* Copyright (c) 2012-2016, The Linux Foundation. All rights reserved. +/* Copyright (c) 2012-2017, The Linux Foundation. All rights reserved. * * This program is free software; you can redistribute it and/or modify * it under the terms of the GNU General Public License version 2 and @@ -734,6 +734,8 @@ static int __init msm_vidc_init(void) if (rc) { dprintk(VIDC_ERR, "Failed to register platform driver\n"); + msm_vidc_debugfs_deinit_drv(); + debugfs_remove_recursive(vidc_driver->debugfs_root); kfree(vidc_driver); vidc_driver = NULL; } @@ -744,6 +746,7 @@ static int __init msm_vidc_init(void) static void __exit msm_vidc_exit(void) { platform_driver_unregister(&msm_vidc_driver); + msm_vidc_debugfs_deinit_drv(); debugfs_remove_recursive(vidc_driver->debugfs_root); kfree(vidc_driver); vidc_driver = NULL; diff --git a/drivers/media/platform/msm/vidc/msm_vidc_debug.c b/drivers/media/platform/msm/vidc/msm_vidc_debug.c index d2b5d38d1edc6..47a380c2fd80c 100644 --- a/drivers/media/platform/msm/vidc/msm_vidc_debug.c +++ b/drivers/media/platform/msm/vidc/msm_vidc_debug.c @@ -1,4 +1,4 @@ -/* Copyright (c) 2012-2016, The Linux Foundation. All rights reserved. +/* Copyright (c) 2012-2017, The Linux Foundation. All rights reserved. * * This program is free software; you can redistribute it and/or modify * it under the terms of the GNU General Public License version 2 and @@ -31,6 +31,7 @@ u32 msm_vidc_firmware_unload_delay = 15000; int msm_vidc_thermal_mitigation_disabled = 0x0; struct debug_buffer { + struct mutex lock; char ptr[MAX_DBG_BUF_SIZE]; char *curr; u32 filled_size; @@ -57,8 +58,12 @@ static u32 write_str(struct debug_buffer *buffer, const char *fmt, ...) { va_list args; u32 size; + + char *curr = buffer->curr; + char *end = buffer->ptr + MAX_DBG_BUF_SIZE; + va_start(args, fmt); - size = vscnprintf(buffer->curr, MAX_DBG_BUF_SIZE - 1, fmt, args); + size = vscnprintf(curr, end - curr, fmt, args); va_end(args); buffer->curr += size; buffer->filled_size += size; @@ -72,12 +77,15 @@ static ssize_t core_info_read(struct file *file, char __user *buf, struct hfi_device *hdev; struct hal_fw_info fw_info; int i = 0, rc = 0; + ssize_t len = 0; if (!core || !core->device) { dprintk(VIDC_ERR, "Invalid params, core: %pK\n", core); return 0; } hdev = core->device; + + mutex_lock(&dbg_buf.lock); INIT_DBG_BUF(dbg_buf); write_str(&dbg_buf, "===============================\n"); write_str(&dbg_buf, "CORE %d: 0x%pK\n", core->id, core); @@ -101,8 +109,11 @@ static ssize_t core_info_read(struct file *file, char __user *buf, completion_done(&core->completions[SYS_MSG_INDEX(i)]) ? "pending" : "done"); } - return simple_read_from_buffer(buf, count, ppos, + len = simple_read_from_buffer(buf, count, ppos, dbg_buf.ptr, dbg_buf.filled_size); + + mutex_unlock(&dbg_buf.lock); + return len; } static const struct file_operations core_info_fops = { @@ -139,7 +150,10 @@ static const struct file_operations ssr_fops = { struct dentry *msm_vidc_debugfs_init_drv(void) { - struct dentry *dir = debugfs_create_dir("msm_vidc", NULL); + struct dentry *dir = NULL; + + mutex_init(&dbg_buf.lock); + dir = debugfs_create_dir("msm_vidc", NULL); if (IS_ERR_OR_NULL(dir)) { dir = NULL; goto failed_create_dir; @@ -238,6 +252,7 @@ struct dentry *msm_vidc_debugfs_init_core(struct msm_vidc_core *core, dprintk(VIDC_ERR, "Failed to create debugfs for msm_vidc\n"); goto failed_create_dir; } + if (!debugfs_create_file("info", S_IRUGO, dir, core, &core_info_fops)) { dprintk(VIDC_ERR, "debugfs_create_file: fail\n"); goto failed_create_dir; @@ -291,10 +306,14 @@ static ssize_t inst_info_read(struct file *file, char __user *buf, { struct msm_vidc_inst *inst = file->private_data; int i, j; + ssize_t len = 0; + if (!inst) { dprintk(VIDC_ERR, "Invalid params, core: %pK\n", inst); return 0; } + + mutex_lock(&dbg_buf.lock); INIT_DBG_BUF(dbg_buf); write_str(&dbg_buf, "===============================\n"); write_str(&dbg_buf, "INSTANCE: 0x%pK (%s)\n", inst, @@ -351,9 +370,10 @@ static ssize_t inst_info_read(struct file *file, char __user *buf, write_str(&dbg_buf, "FBD Count: %d\n", inst->count.fbd); publish_unreleased_reference(inst); - - return simple_read_from_buffer(buf, count, ppos, + len = simple_read_from_buffer(buf, count, ppos, dbg_buf.ptr, dbg_buf.filled_size); + mutex_unlock(&dbg_buf.lock); + return len; } static const struct file_operations inst_info_fops = { @@ -434,3 +454,8 @@ void msm_vidc_debugfs_update(struct msm_vidc_inst *inst, } } +void msm_vidc_debugfs_deinit_drv(void) +{ + mutex_destroy(&dbg_buf.lock); +} + diff --git a/drivers/media/platform/msm/vidc/msm_vidc_debug.h b/drivers/media/platform/msm/vidc/msm_vidc_debug.h index d0faae8941f20..4bda44bb7c255 100644 --- a/drivers/media/platform/msm/vidc/msm_vidc_debug.h +++ b/drivers/media/platform/msm/vidc/msm_vidc_debug.h @@ -1,4 +1,4 @@ -/* Copyright (c) 2012-2014, The Linux Foundation. All rights reserved. +/* Copyright (c) 2012-2014, 2017 The Linux Foundation. All rights reserved. * * This program is free software; you can redistribute it and/or modify * it under the terms of the GNU General Public License version 2 and @@ -123,6 +123,7 @@ struct dentry *msm_vidc_debugfs_init_inst(struct msm_vidc_inst *inst, struct dentry *parent); void msm_vidc_debugfs_update(struct msm_vidc_inst *inst, enum msm_vidc_debugfs_event e); +void msm_vidc_debugfs_deinit_drv(void); static inline void tic(struct msm_vidc_inst *i, enum profiling_points p, char *b) From 6be07a899809c55f93f30eebe7a83a9e246d17f5 Mon Sep 17 00:00:00 2001 From: Alexy Joseph Date: Fri, 3 Mar 2017 18:50:21 -0800 Subject: [PATCH 04/41] ASoC: qdsp6v2: Remove Eagle code Eagle driver is not in use any more. Remove the code and associated calls to it. CRs-Fixed: 1103106 Change-Id: Ice5333861beda9538f0783b70b3267523d16fd2b Signed-off-by: Alexy Joseph --- .../misc/qcom/qdsp6v2/audio_hwacc_effects.c | 65 +- include/sound/msm-dts-eagle.h | 148 -- include/sound/q6adm-v2.h | 3 +- sound/soc/msm/qdsp6v2/Makefile | 1 - sound/soc/msm/qdsp6v2/audio_cal_utils.c | 6 +- .../soc/msm/qdsp6v2/msm-audio-effects-q6-v2.c | 31 +- sound/soc/msm/qdsp6v2/msm-compress-q6-v2.c | 78 +- sound/soc/msm/qdsp6v2/msm-dts-eagle.c | 1611 ----------------- sound/soc/msm/qdsp6v2/msm-dts-srs-tm-config.c | 3 +- .../soc/msm/qdsp6v2/msm-pcm-routing-devdep.c | 41 +- sound/soc/msm/qdsp6v2/msm-pcm-routing-v2.c | 11 - sound/soc/msm/qdsp6v2/q6adm.c | 234 +-- sound/soc/msm/qdsp6v2/q6asm.c | 227 +-- sound/soc/msm/qdsp6v2/q6core.c | 113 +- 14 files changed, 24 insertions(+), 2548 deletions(-) delete mode 100644 include/sound/msm-dts-eagle.h delete mode 100644 sound/soc/msm/qdsp6v2/msm-dts-eagle.c diff --git a/drivers/misc/qcom/qdsp6v2/audio_hwacc_effects.c b/drivers/misc/qcom/qdsp6v2/audio_hwacc_effects.c index 7a8e6f8de8853..6afd06f0946c2 100644 --- a/drivers/misc/qcom/qdsp6v2/audio_hwacc_effects.c +++ b/drivers/misc/qcom/qdsp6v2/audio_hwacc_effects.c @@ -17,7 +17,6 @@ #include "q6audio_common.h" #include "audio_utils_aio.h" #include -#include #define MAX_CHANNELS_SUPPORTED 8 #define WAIT_TIMEDOUT_DURATION_SECS 1 @@ -53,31 +52,11 @@ static void audio_effects_init_pp(struct audio_client *ac) pr_err("%s: audio client null to init pp\n", __func__); return; } - switch (ac->topology) { - case ASM_STREAM_POSTPROC_TOPO_ID_HPX_MASTER: - - ret = q6asm_set_softvolume_v2(ac, &softvol, - SOFT_VOLUME_INSTANCE_1); - if (ret < 0) - pr_err("%s: Send SoftVolume1 Param failed ret=%d\n", - __func__, ret); - ret = q6asm_set_softvolume_v2(ac, &softvol, - SOFT_VOLUME_INSTANCE_2); - if (ret < 0) - pr_err("%s: Send SoftVolume2 Param failed ret=%d\n", - __func__, ret); - - msm_dts_eagle_init_master_module(ac); - - break; - default: - ret = q6asm_set_softvolume_v2(ac, &softvol, - SOFT_VOLUME_INSTANCE_1); - if (ret < 0) - pr_err("%s: Send SoftVolume Param failed ret=%d\n", - __func__, ret); - break; - } + ret = q6asm_set_softvolume_v2(ac, &softvol, + SOFT_VOLUME_INSTANCE_1); + if (ret < 0) + pr_err("%s: Send SoftVolume Param failed ret=%d\n", + __func__, ret); } static void audio_effects_deinit_pp(struct audio_client *ac) @@ -86,13 +65,6 @@ static void audio_effects_deinit_pp(struct audio_client *ac) pr_err("%s: audio client null to deinit pp\n", __func__); return; } - switch (ac->topology) { - case ASM_STREAM_POSTPROC_TOPO_ID_HPX_MASTER: - msm_dts_eagle_deinit_master_module(ac); - break; - default: - break; - } } static void audio_effects_event_handler(uint32_t opcode, uint32_t token, @@ -404,33 +376,6 @@ static long audio_effects_set_pp_param(struct q6audio_effects *effects, &(effects->audio_effects.topo_switch_vol), (long *)&values[1], SOFT_VOLUME_INSTANCE_2); break; - case DTS_EAGLE_MODULE_ENABLE: - pr_debug("%s: DTS_EAGLE_MODULE_ENABLE\n", __func__); - if (msm_audio_effects_is_effmodule_supp_in_top( - effects_module, effects->ac->topology)) { - /* - * HPX->OFF: first disable HPX and then - * enable SA+ - * HPX->ON: first disable SA+ and then - * enable HPX - */ - bool hpx_state = (bool)values[1]; - if (hpx_state) - msm_audio_effects_enable_extn(effects->ac, - &(effects->audio_effects), - false); - msm_dts_eagle_enable_asm(effects->ac, - hpx_state, - AUDPROC_MODULE_ID_DTS_HPX_PREMIX); - msm_dts_eagle_enable_asm(effects->ac, - hpx_state, - AUDPROC_MODULE_ID_DTS_HPX_POSTMIX); - if (!hpx_state) - msm_audio_effects_enable_extn(effects->ac, - &(effects->audio_effects), - true); - } - break; default: pr_err("%s: Invalid effects config module\n", __func__); rc = -EINVAL; diff --git a/include/sound/msm-dts-eagle.h b/include/sound/msm-dts-eagle.h deleted file mode 100644 index 2ef01136b7ced..0000000000000 --- a/include/sound/msm-dts-eagle.h +++ /dev/null @@ -1,148 +0,0 @@ -/* Copyright (c) 2014, The Linux Foundation. All rights reserved. - * - * This program is free software; you can redistribute it and/or modify - * it under the terms of the GNU General Public License version 2 and - * only version 2 as published by the Free Software Foundation. - * - * This program is distributed in the hope that it will be useful, - * but WITHOUT ANY WARRANTY; without even the implied warranty of - * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the - * GNU General Public License for more details. - */ - -#ifndef __MSM_DTS_EAGLE_H__ -#define __MSM_DTS_EAGLE_H__ - -#include -#include -#include -#include - -#ifdef CONFIG_COMPAT -enum { - DTS_EAGLE_IOCTL_GET_CACHE_SIZE32 = _IOR(0xF2, 0, __s32), - DTS_EAGLE_IOCTL_SET_CACHE_SIZE32 = _IOW(0xF2, 1, __s32), - DTS_EAGLE_IOCTL_GET_PARAM32 = _IOR(0xF2, 2, compat_uptr_t), - DTS_EAGLE_IOCTL_SET_PARAM32 = _IOW(0xF2, 3, compat_uptr_t), - DTS_EAGLE_IOCTL_SET_CACHE_BLOCK32 = - _IOW(0xF2, 4, compat_uptr_t), - DTS_EAGLE_IOCTL_SET_ACTIVE_DEVICE32 = - _IOW(0xF2, 5, compat_uptr_t), - DTS_EAGLE_IOCTL_GET_LICENSE32 = - _IOR(0xF2, 6, compat_uptr_t), - DTS_EAGLE_IOCTL_SET_LICENSE32 = - _IOW(0xF2, 7, compat_uptr_t), - DTS_EAGLE_IOCTL_SEND_LICENSE32 = _IOW(0xF2, 8, __s32), - DTS_EAGLE_IOCTL_SET_VOLUME_COMMANDS32 = _IOW(0xF2, 9, - compat_uptr_t), -}; -#endif - -#ifdef CONFIG_DTS_EAGLE -void msm_dts_ion_memmap(struct param_outband *po_); -int msm_dts_eagle_enable_asm(struct audio_client *ac, u32 enable, int module); -int msm_dts_eagle_enable_adm(int port_id, int copp_idx, u32 enable); -void msm_dts_eagle_add_controls(struct snd_soc_platform *platform); -int msm_dts_eagle_set_stream_gain(struct audio_client *ac, - int lgain, int rgain); -int msm_dts_eagle_handle_asm(struct dts_eagle_param_desc *depd, char *buf, - bool for_pre, bool get, struct audio_client *ac, - struct param_outband *po); -int msm_dts_eagle_handle_adm(struct dts_eagle_param_desc *depd, char *buf, - bool for_pre, bool get); -int msm_dts_eagle_ioctl(unsigned int cmd, unsigned long arg); -int msm_dts_eagle_is_hpx_on(void); -int msm_dts_eagle_init_pre(struct audio_client *ac); -int msm_dts_eagle_deinit_pre(struct audio_client *ac); -int msm_dts_eagle_init_post(int port_id, int copp_id); -int msm_dts_eagle_deinit_post(int port_id, int topology); -int msm_dts_eagle_init_master_module(struct audio_client *ac); -int msm_dts_eagle_deinit_master_module(struct audio_client *ac); -int msm_dts_eagle_pcm_new(struct snd_soc_pcm_runtime *runtime); -void msm_dts_eagle_pcm_free(struct snd_pcm *pcm); -int msm_dts_eagle_compat_ioctl(unsigned int cmd, unsigned long arg); -#else -static inline void msm_dts_ion_memmap(struct param_outband *po_) -{ - pr_debug("%s\n", __func__); -} -static inline int msm_dts_eagle_enable_asm(struct audio_client *ac, - u32 enable, int module) -{ - return 0; -} -static inline int msm_dts_eagle_enable_adm(int port_id, int copp_idx, - u32 enable) -{ - return 0; -} -static inline void msm_dts_eagle_add_controls(struct snd_soc_platform *platform) -{ -} -static inline int msm_dts_eagle_set_stream_gain(struct audio_client *ac, - int lgain, int rgain) -{ - pr_debug("%s\n", __func__); - return 0; -} -static inline int msm_dts_eagle_handle_asm(struct dts_eagle_param_desc *depd, - char *buf, bool for_pre, bool get, - struct audio_client *ac, - struct param_outband *po) -{ - return 0; -} -static inline int msm_dts_eagle_handle_adm(struct dts_eagle_param_desc *depd, - char *buf, bool for_pre, bool get) -{ - return 0; -} -static inline int msm_dts_eagle_ioctl(unsigned int cmd, unsigned long arg) -{ - return -EPERM; -} -static inline int msm_dts_eagle_is_hpx_on(void) -{ - return 0; -} -static inline int msm_dts_eagle_init_pre(struct audio_client *ac) -{ - return 0; -} -static inline int msm_dts_eagle_deinit_pre(struct audio_client *ac) -{ - return 0; -} -static inline int msm_dts_eagle_init_post(int port_id, int coppid) -{ - return 0; -} -static inline int msm_dts_eagle_deinit_post(int port_id, int topology) -{ - return 0; -} -static inline int msm_dts_eagle_init_master_module(struct audio_client *ac) -{ - return 0; -} -static inline int msm_dts_eagle_deinit_master_module(struct audio_client *ac) -{ - return 0; -} -static inline int msm_dts_eagle_pcm_new(struct snd_soc_pcm_runtime *runtime) -{ - pr_debug("%s\n", __func__); - return 0; -} -static inline void msm_dts_eagle_pcm_free(struct snd_pcm *pcm) -{ - pr_debug("%s\n", __func__); -} -static inline int msm_dts_eagle_compat_ioctl(unsigned int cmd, - unsigned long arg) -{ - return 0; -} -#endif - -#endif diff --git a/include/sound/q6adm-v2.h b/include/sound/q6adm-v2.h index 2949f136c2ba5..5938f03241885 100644 --- a/include/sound/q6adm-v2.h +++ b/include/sound/q6adm-v2.h @@ -1,4 +1,4 @@ -/* Copyright (c) 2012-2015, The Linux Foundation. All rights reserved. +/* Copyright (c) 2012-2017, The Linux Foundation. All rights reserved. * * This program is free software; you can redistribute it and/or modify * it under the terms of the GNU General Public License version 2 and @@ -34,7 +34,6 @@ enum { ADM_AUDVOL_CAL, ADM_RTAC_INFO_CAL, ADM_RTAC_APR_CAL, - ADM_DTS_EAGLE, ADM_SRS_TRUMEDIA, ADM_MAX_CAL_TYPES }; diff --git a/sound/soc/msm/qdsp6v2/Makefile b/sound/soc/msm/qdsp6v2/Makefile index 53e5202168435..facf765bc31b9 100644 --- a/sound/soc/msm/qdsp6v2/Makefile +++ b/sound/soc/msm/qdsp6v2/Makefile @@ -9,7 +9,6 @@ snd-soc-qdsp6v2-objs += msm-dai-q6-v2.o msm-pcm-q6-v2.o msm-pcm-routing-v2.o \ obj-$(CONFIG_SND_SOC_QDSP6V2) += snd-soc-qdsp6v2.o msm-pcm-dtmf-v2.o \ msm-dai-stub-v2.o obj-$(CONFIG_SND_HWDEP) += msm-pcm-routing-devdep.o -obj-$(CONFIG_DTS_EAGLE) += msm-dts-eagle.o obj-$(CONFIG_DOLBY_DAP) += msm-dolby-dap-config.o obj-$(CONFIG_DOLBY_DS2) += msm-ds2-dap-config.o obj-$(CONFIG_DTS_SRS_TM) += msm-dts-srs-tm-config.o diff --git a/sound/soc/msm/qdsp6v2/audio_cal_utils.c b/sound/soc/msm/qdsp6v2/audio_cal_utils.c index 3ac81b2bc6858..279636eef02ca 100644 --- a/sound/soc/msm/qdsp6v2/audio_cal_utils.c +++ b/sound/soc/msm/qdsp6v2/audio_cal_utils.c @@ -1,4 +1,4 @@ -/* Copyright (c) 2014-2015, The Linux Foundation. All rights reserved. +/* Copyright (c) 2014-2015, 2017 The Linux Foundation. All rights reserved. * * This program is free software; you can redistribute it and/or modify * it under the terms of the GNU General Public License version 2 and @@ -120,8 +120,6 @@ size_t get_cal_info_size(int32_t cal_type) case ULP_LSM_CAL_TYPE: size = sizeof(struct audio_cal_info_lsm); break; - case DTS_EAGLE_CAL_TYPE: - size = 0; case AUDIO_CORE_METAINFO_CAL_TYPE: size = sizeof(struct audio_cal_info_metainfo); break; @@ -232,8 +230,6 @@ size_t get_user_cal_type_size(int32_t cal_type) case ULP_LSM_CAL_TYPE: size = sizeof(struct audio_cal_type_lsm); break; - case DTS_EAGLE_CAL_TYPE: - size = 0; case AUDIO_CORE_METAINFO_CAL_TYPE: size = sizeof(struct audio_cal_type_metainfo); break; diff --git a/sound/soc/msm/qdsp6v2/msm-audio-effects-q6-v2.c b/sound/soc/msm/qdsp6v2/msm-audio-effects-q6-v2.c index 2bcd339f1ff59..1e238ab8934e2 100644 --- a/sound/soc/msm/qdsp6v2/msm-audio-effects-q6-v2.c +++ b/sound/soc/msm/qdsp6v2/msm-audio-effects-q6-v2.c @@ -1,4 +1,4 @@ -/* Copyright (c) 2013-2016, The Linux Foundation. All rights reserved. +/* Copyright (c) 2013-2017, The Linux Foundation. All rights reserved. * * This program is free software; you can redistribute it and/or modify * it under the terms of the GNU General Public License version 2 and @@ -15,7 +15,6 @@ #include #include #include -#include #include #define MAX_ENABLE_CMD_SIZE 32 @@ -48,26 +47,6 @@ bool msm_audio_effects_is_effmodule_supp_in_top(int effect_module, case EQ_MODULE: switch (topology) { case ASM_STREAM_POSTPROC_TOPO_ID_SA_PLUS: - case ASM_STREAM_POSTPROC_TOPO_ID_HPX_PLUS: - case ASM_STREAM_POSTPROC_TOPO_ID_HPX_MASTER: - return true; - default: - return false; - } - case DTS_EAGLE_MODULE: - switch (topology) { - case ASM_STREAM_POSTPROC_TOPO_ID_DTS_HPX: - case ASM_STREAM_POSTPROC_TOPO_ID_HPX_PLUS: - case ASM_STREAM_POSTPROC_TOPO_ID_HPX_MASTER: - return true; - default: - return false; - } - case SOFT_VOLUME2_MODULE: - case DTS_EAGLE_MODULE_ENABLE: - switch (topology) { - case ASM_STREAM_POSTPROC_TOPO_ID_HPX_PLUS: - case ASM_STREAM_POSTPROC_TOPO_ID_HPX_MASTER: return true; default: return false; @@ -275,7 +254,7 @@ int msm_audio_effects_virtualizer_handler(struct audio_client *ac, break; } } - if (params_length && !msm_dts_eagle_is_hpx_on() && (rc == 0)) + if (params_length && (rc == 0)) q6asm_send_audio_effects_params(ac, params, params_length); else @@ -746,7 +725,7 @@ int msm_audio_effects_reverb_handler(struct audio_client *ac, break; } } - if (params_length && !msm_dts_eagle_is_hpx_on() && (rc == 0)) + if (params_length && (rc == 0)) q6asm_send_audio_effects_params(ac, params, params_length); else @@ -882,7 +861,7 @@ int msm_audio_effects_bass_boost_handler(struct audio_client *ac, break; } } - if (params_length && !msm_dts_eagle_is_hpx_on() && (rc == 0)) + if (params_length && (rc == 0)) q6asm_send_audio_effects_params(ac, params, params_length); else @@ -1114,7 +1093,7 @@ int msm_audio_effects_popless_eq_handler(struct audio_client *ac, break; } } - if (params_length && !msm_dts_eagle_is_hpx_on() && (rc == 0)) + if (params_length && (rc == 0)) q6asm_send_audio_effects_params(ac, params, params_length); else diff --git a/sound/soc/msm/qdsp6v2/msm-compress-q6-v2.c b/sound/soc/msm/qdsp6v2/msm-compress-q6-v2.c index 0cd60c8b60646..c54e5acd3291e 100644 --- a/sound/soc/msm/qdsp6v2/msm-compress-q6-v2.c +++ b/sound/soc/msm/qdsp6v2/msm-compress-q6-v2.c @@ -1,4 +1,4 @@ -/* Copyright (c) 2012-2016, The Linux Foundation. All rights reserved. +/* Copyright (c) 2012-2017, The Linux Foundation. All rights reserved. * * This program is free software; you can redistribute it and/or modify * it under the terms of the GNU General Public License version 2 and @@ -42,8 +42,6 @@ #include #include #include -#include - #include "msm-pcm-routing-v2.h" #include "audio_ocmem.h" @@ -82,15 +80,6 @@ const DECLARE_TLV_DB_LINEAR(msm_compr_vol_gain, 0, #define MAX_NUMBER_OF_STREAMS 2 -/* - * Max size for getting DTS EAGLE Param through kcontrol - * Safe for both 32 and 64 bit platforms - * 64 = size of kcontrol value array on 64 bit platform - * 4 = size of parameters Eagle expects before cast to 64 bits - * 40 = size of dts_eagle_param_desc + module_id cast to 64 bits - */ -#define DTS_EAGLE_MAX_PARAM_SIZE_FOR_ALSA ((64 * 4) - 40) - struct msm_compr_gapless_state { bool set_next_stream_id; int32_t stream_opened[MAX_NUMBER_OF_STREAMS]; @@ -258,11 +247,6 @@ static int msm_compr_set_volume(struct snd_compr_stream *cstream, if (rc < 0) pr_err("%s: Send vol gain command failed rc=%d\n", __func__, rc); - else - if (msm_dts_eagle_set_stream_gain(prtd->audio_client, - volume_l, volume_r)) - pr_debug("%s: DTS_EAGLE send stream gain failed\n", - __func__); return rc; } @@ -780,26 +764,6 @@ static int msm_compr_init_pp_params(struct snd_compr_stream *cstream, }; switch (ac->topology) { - case ASM_STREAM_POSTPROC_TOPO_ID_HPX_PLUS: /* HPX + SA+ topology */ - - ret = q6asm_set_softvolume_v2(ac, &softvol, - SOFT_VOLUME_INSTANCE_1); - if (ret < 0) - pr_err("%s: Send SoftVolume Param failed ret=%d\n", - __func__, ret); - - ret = q6asm_set_softvolume_v2(ac, &softvol, - SOFT_VOLUME_INSTANCE_2); - if (ret < 0) - pr_err("%s: Send SoftVolume2 Param failed ret=%d\n", - __func__, ret); - /* - * HPX module init is trigerred from HAL using ioctl - * DTS_EAGLE_MODULE_ENABLE when stream starts - */ - break; - case ASM_STREAM_POSTPROC_TOPO_ID_DTS_HPX: /* HPX topology */ - break; default: ret = q6asm_set_softvolume_v2(ac, &softvol, SOFT_VOLUME_INSTANCE_1); @@ -2210,23 +2174,6 @@ static int msm_compr_audio_effects_config_put(struct snd_kcontrol *kcontrol, &(audio_effects->equalizer), values); break; - case DTS_EAGLE_MODULE: - pr_debug("%s: DTS_EAGLE_MODULE\n", __func__); - if (!msm_audio_effects_is_effmodule_supp_in_top(effects_module, - prtd->audio_client->topology)) - return 0; - msm_dts_eagle_handle_asm(NULL, (void *)values, true, - false, prtd->audio_client, NULL); - break; - case DTS_EAGLE_MODULE_ENABLE: - pr_debug("%s: DTS_EAGLE_MODULE_ENABLE\n", __func__); - if (msm_audio_effects_is_effmodule_supp_in_top(effects_module, - prtd->audio_client->topology)) - msm_dts_eagle_enable_asm(prtd->audio_client, - (bool)values[0], - AUDPROC_MODULE_ID_DTS_HPX_PREMIX); - - break; case SOFT_VOLUME_MODULE: pr_debug("%s: SOFT_VOLUME_MODULE\n", __func__); break; @@ -2255,7 +2202,6 @@ static int msm_compr_audio_effects_config_get(struct snd_kcontrol *kcontrol, struct msm_compr_audio_effects *audio_effects = NULL; struct snd_compr_stream *cstream = NULL; struct msm_compr_audio *prtd = NULL; - long *values = &(ucontrol->value.integer.value[0]); pr_debug("%s\n", __func__); if (fe_id >= MSM_FRONTEND_DAI_MAX) { @@ -2275,28 +2221,6 @@ static int msm_compr_audio_effects_config_get(struct snd_kcontrol *kcontrol, return -EINVAL; } - switch (audio_effects->query.mod_id) { - case DTS_EAGLE_MODULE: - pr_debug("%s: DTS_EAGLE_MODULE handling queued get\n", - __func__); - values[0] = (long)audio_effects->query.mod_id; - values[1] = (long)audio_effects->query.parm_id; - values[2] = (long)audio_effects->query.size; - values[3] = (long)audio_effects->query.offset; - values[4] = (long)audio_effects->query.device; - if (values[2] > DTS_EAGLE_MAX_PARAM_SIZE_FOR_ALSA) { - pr_err("%s: DTS_EAGLE_MODULE parameter's requested size (%li) too large (max size is %i)\n", - __func__, values[2], - DTS_EAGLE_MAX_PARAM_SIZE_FOR_ALSA); - return -EINVAL; - } - msm_dts_eagle_handle_asm(NULL, (void *)&values[1], - true, true, prtd->audio_client, NULL); - break; - default: - pr_err("%s: Invalid effects config module\n", __func__); - return -EINVAL; - } return 0; } diff --git a/sound/soc/msm/qdsp6v2/msm-dts-eagle.c b/sound/soc/msm/qdsp6v2/msm-dts-eagle.c deleted file mode 100644 index d691712257631..0000000000000 --- a/sound/soc/msm/qdsp6v2/msm-dts-eagle.c +++ /dev/null @@ -1,1611 +0,0 @@ -/* Copyright (c) 2014-2015, The Linux Foundation. All rights reserved. - * - * This program is free software; you can redistribute it and/or modify - * it under the terms of the GNU General Public License version 2 and - * only version 2 as published by the Free Software Foundation. - * - * This program is distributed in the hope that it will be useful, - * but WITHOUT ANY WARRANTY; without even the implied warranty of - * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the - * GNU General Public License for more details. - */ - -#include -#include -#include -#include -#include -#include -#include -#include -#include -#include -#include -#include -#include -#include -#include -#include -#include -#include -#include -#include -#include - -#include "msm-pcm-routing-v2.h" - -#define ION_MEM_SIZE 131072 -#define DEPC_MAX_SIZE 524288 - -#define MPST AUDPROC_MODULE_ID_DTS_HPX_POSTMIX -#define MPRE AUDPROC_MODULE_ID_DTS_HPX_PREMIX - -#define eagle_vol_dbg(fmt, ...) \ - pr_debug("DTS_EAGLE_DRIVER_VOLUME: " fmt "\n", ##__VA_ARGS__) -#define eagle_vol_err(fmt, ...) \ - pr_err("DTS_EAGLE_DRIVER_VOLUME: " fmt "\n", ##__VA_ARGS__) -#define eagle_drv_dbg(fmt, ...) \ - pr_debug("DTS_EAGLE_DRIVER: " fmt "\n", ##__VA_ARGS__) -#define eagle_drv_err(fmt, ...) \ - pr_err("DTS_EAGLE_DRIVER: " fmt "\n", ##__VA_ARGS__) -#define eagle_precache_dbg(fmt, ...) \ - pr_debug("DTS_EAGLE_DRIVER_SENDCACHE_PRE: " fmt "\n", ##__VA_ARGS__) -#define eagle_precache_err(fmt, ...) \ - pr_err("DTS_EAGLE_DRIVER_SENDCACHE_PRE: " fmt "\n", ##__VA_ARGS__) -#define eagle_postcache_dbg(fmt, ...) \ - pr_debug("DTS_EAGLE_DRIVER_SENDCACHE_POST: " fmt "\n", ##__VA_ARGS__) -#define eagle_postcache_err(fmt, ...) \ - pr_err("DTS_EAGLE_DRIVER_SENDCACHE_POST: " fmt "\n", ##__VA_ARGS__) -#define eagle_ioctl_dbg(fmt, ...) \ - pr_debug("DTS_EAGLE_DRIVER_IOCTL: " fmt "\n", ##__VA_ARGS__) -#define eagle_ioctl_err(fmt, ...) \ - pr_err("DTS_EAGLE_DRIVER_IOCTL: " fmt "\n", ##__VA_ARGS__) -#define eagle_asm_dbg(fmt, ...) \ - pr_debug("DTS_EAGLE_DRIVER_ASM: " fmt "\n", ##__VA_ARGS__) -#define eagle_asm_err(fmt, ...) \ - pr_err("DTS_EAGLE_DRIVER_ASM: " fmt "\n", ##__VA_ARGS__) -#define eagle_adm_dbg(fmt, ...) \ - pr_debug("DTS_EAGLE_DRIVER_ADM: " fmt "\n", ##__VA_ARGS__) -#define eagle_adm_err(fmt, ...) \ - pr_err("DTS_EAGLE_DRIVER_ADM: " fmt "\n", ##__VA_ARGS__) -#define eagle_enable_dbg(fmt, ...) \ - pr_debug("DTS_EAGLE_ENABLE: " fmt "\n", ##__VA_ARGS__) -#define eagle_enable_err(fmt, ...) \ - pr_err("DTS_EAGLE_ENABLE: " fmt "\n", ##__VA_ARGS__) -#define eagle_ioctl_info(fmt, ...) \ - pr_err("DTS_EAGLE_IOCTL: " fmt "\n", ##__VA_ARGS__) - -enum { - AUDIO_DEVICE_OUT_EARPIECE = 0, - AUDIO_DEVICE_OUT_SPEAKER, - AUDIO_DEVICE_OUT_WIRED_HEADSET, - AUDIO_DEVICE_OUT_WIRED_HEADPHONE, - AUDIO_DEVICE_OUT_BLUETOOTH_SCO, - AUDIO_DEVICE_OUT_BLUETOOTH_SCO_HEADSET, - AUDIO_DEVICE_OUT_BLUETOOTH_SCO_CARKIT, - AUDIO_DEVICE_OUT_BLUETOOTH_A2DP, - AUDIO_DEVICE_OUT_BLUETOOTH_A2DP_HEADPHONES, - AUDIO_DEVICE_OUT_BLUETOOTH_A2DP_SPEAKER, - AUDIO_DEVICE_OUT_AUX_DIGITAL, - AUDIO_DEVICE_OUT_ANLG_DOCK_HEADSET, - AUDIO_DEVICE_OUT_DGTL_DOCK_HEADSET, - AUDIO_DEVICE_OUT_USB_ACCESSORY, - AUDIO_DEVICE_OUT_USB_DEVICE, - AUDIO_DEVICE_OUT_REMOTE_SUBMIX, - AUDIO_DEVICE_OUT_ANC_HEADSET, - AUDIO_DEVICE_OUT_ANC_HEADPHONE, - AUDIO_DEVICE_OUT_PROXY, - AUDIO_DEVICE_OUT_FM, - AUDIO_DEVICE_OUT_FM_TX, - - AUDIO_DEVICE_OUT_COUNT -}; - -#define AUDIO_DEVICE_COMBO 0x400000 /* bit 23 */ - -enum { /* cache block */ - CB_0 = 0, - CB_1, - CB_2, - CB_3, - CB_4, - CB_5, - CB_6, - CB_7, - - CB_COUNT -}; - -enum { /* cache block description */ - CBD_DEV_MASK = 0, - CBD_OFFSG, - CBD_CMD0, - CBD_SZ0, - CBD_OFFS1, - CBD_CMD1, - CBD_SZ1, - CBD_OFFS2, - CBD_CMD2, - CBD_SZ2, - CBD_OFFS3, - CBD_CMD3, - CBD_SZ3, - - CBD_COUNT, -}; - -static s32 _fx_logN(s32 x) -{ - s32 t, y = 0xa65af; - if (x < 0x00008000) { - x <<= 16; y -= 0xb1721; } - if (x < 0x00800000) { - x <<= 8; y -= 0x58b91; } - if (x < 0x08000000) { - x <<= 4; y -= 0x2c5c8; } - if (x < 0x20000000) { - x <<= 2; y -= 0x162e4; } - if (x < 0x40000000) { - x <<= 1; y -= 0x0b172; } - t = x + (x >> 1); - if ((t & 0x80000000) == 0) { - x = t; y -= 0x067cd; } - t = x + (x >> 2); - if ((t & 0x80000000) == 0) { - x = t; y -= 0x03920; } - t = x + (x >> 3); - if ((t & 0x80000000) == 0) { - x = t; y -= 0x01e27; } - t = x + (x >> 4); - if ((t & 0x80000000) == 0) { - x = t; y -= 0x00f85; } - t = x + (x >> 5); - if ((t & 0x80000000) == 0) { - x = t; y -= 0x007e1; } - t = x + (x >> 6); - if ((t & 0x80000000) == 0) { - x = t; y -= 0x003f8; } - t = x + (x >> 7); - if ((t & 0x80000000) == 0) { - x = t; y -= 0x001fe; } - x = 0x80000000 - x; - y -= x >> 15; - return y; -} - -static inline void *_getd(struct dts_eagle_param_desc *depd) -{ - return (void *)(((char *)depd) + sizeof(struct dts_eagle_param_desc)); -} - -static int _ref_cnt; -/* dts eagle parameter cache */ -static char *_depc; -static u32 _depc_size; -static s32 _c_bl[CB_COUNT][CBD_COUNT]; -static u32 _device_primary; -static u32 _device_all; -/* ION states */ -static struct ion_client *_ion_client; -static struct ion_handle *_ion_handle; -static struct param_outband _po; -static struct audio_client *_ac_NT; -static struct ion_client *_ion_client_NT; -static struct ion_handle *_ion_handle_NT; -static struct param_outband _po_NT; - -#define SEC_BLOB_MAX_CNT 10 -#define SEC_BLOB_MAX_SIZE 0x4004 /*extra 4 for size*/ -static char *_sec_blob[SEC_BLOB_MAX_CNT]; - -/* multi-copp support */ -static int _cidx[AFE_MAX_PORTS] = {-1}; - -/* volume controls */ -#define VOL_CMD_CNT_MAX 10 -static u32 _vol_cmd_cnt; -static s32 **_vol_cmds; -struct vol_cmds_d { - s32 d[4]; -}; -static struct vol_cmds_d *_vol_cmds_d; -static const s32 _log10_10_inv_x20 = 0x0008af84; - -/* hpx master control */ -static u32 _is_hpx_enabled; - -static void _volume_cmds_free(void) -{ - int i; - for (i = 0; i < _vol_cmd_cnt; i++) - kfree(_vol_cmds[i]); - _vol_cmd_cnt = 0; - kfree(_vol_cmds); - kfree(_vol_cmds_d); - _vol_cmds = NULL; - _vol_cmds_d = NULL; -} - -static s32 _volume_cmds_alloc1(s32 size) -{ - _volume_cmds_free(); - _vol_cmd_cnt = size; - _vol_cmds = kzalloc(_vol_cmd_cnt * sizeof(int *), GFP_KERNEL); - if (_vol_cmds) { - _vol_cmds_d = kzalloc(_vol_cmd_cnt * sizeof(struct vol_cmds_d), - GFP_KERNEL); - } else - _vol_cmd_cnt = 0; - if (_vol_cmds_d) - return 0; - _volume_cmds_free(); - return -ENOMEM; -} - -/* assumes size is equal or less than 0xFFF */ -static s32 _volume_cmds_alloc2(s32 idx, s32 size) -{ - kfree(_vol_cmds[idx]); - _vol_cmds[idx] = kzalloc(size, GFP_KERNEL); - if (_vol_cmds[idx]) - return 0; - _vol_cmds_d[idx].d[0] = 0; - return -ENOMEM; -} - -static void _init_cb_descs(void) -{ - int i; - for (i = 0; i < CB_COUNT; i++) { - _c_bl[i][CBD_DEV_MASK] = 0; - _c_bl[i][CBD_OFFSG] = _c_bl[i][CBD_OFFS1] = - _c_bl[i][CBD_OFFS2] = _c_bl[i][CBD_OFFS3] = - 0xFFFFFFFF; - _c_bl[i][CBD_CMD0] = _c_bl[i][CBD_SZ0] = - _c_bl[i][CBD_CMD1] = _c_bl[i][CBD_SZ1] = - _c_bl[i][CBD_CMD2] = _c_bl[i][CBD_SZ2] = - _c_bl[i][CBD_CMD3] = _c_bl[i][CBD_SZ3] = 0; - } -} - -static u32 _get_dev_mask_for_pid(int pid) -{ - switch (pid) { - case SLIMBUS_0_RX: - return (1 << AUDIO_DEVICE_OUT_EARPIECE) | - (1 << AUDIO_DEVICE_OUT_SPEAKER) | - (1 << AUDIO_DEVICE_OUT_WIRED_HEADSET) | - (1 << AUDIO_DEVICE_OUT_WIRED_HEADPHONE) | - (1 << AUDIO_DEVICE_OUT_ANC_HEADSET) | - (1 << AUDIO_DEVICE_OUT_ANC_HEADPHONE); - case INT_BT_SCO_RX: - return (1 << AUDIO_DEVICE_OUT_BLUETOOTH_SCO) | - (1 << AUDIO_DEVICE_OUT_BLUETOOTH_SCO_HEADSET) | - (1 << AUDIO_DEVICE_OUT_BLUETOOTH_SCO_CARKIT); - case RT_PROXY_PORT_001_RX: - return (1 << AUDIO_DEVICE_OUT_BLUETOOTH_A2DP) | - (1 << AUDIO_DEVICE_OUT_BLUETOOTH_A2DP_HEADPHONES) | - (1 << AUDIO_DEVICE_OUT_BLUETOOTH_A2DP_SPEAKER) | - (1 << AUDIO_DEVICE_OUT_ANLG_DOCK_HEADSET) | - (1 << AUDIO_DEVICE_OUT_DGTL_DOCK_HEADSET) | - (1 << AUDIO_DEVICE_OUT_USB_ACCESSORY) | - (1 << AUDIO_DEVICE_OUT_USB_DEVICE) | - (1 << AUDIO_DEVICE_OUT_PROXY); - case HDMI_RX: - return 1 << AUDIO_DEVICE_OUT_AUX_DIGITAL; - case INT_FM_RX: - return 1 << AUDIO_DEVICE_OUT_FM; - case INT_FM_TX: - return 1 << AUDIO_DEVICE_OUT_FM_TX; - default: - return 0; - } -} - -static int _get_pid_from_dev(u32 device) -{ - if (device & (1 << AUDIO_DEVICE_OUT_EARPIECE) || - device & (1 << AUDIO_DEVICE_OUT_SPEAKER) || - device & (1 << AUDIO_DEVICE_OUT_WIRED_HEADSET) || - device & (1 << AUDIO_DEVICE_OUT_WIRED_HEADPHONE) || - device & (1 << AUDIO_DEVICE_OUT_ANC_HEADSET) || - device & (1 << AUDIO_DEVICE_OUT_ANC_HEADPHONE)) { - return SLIMBUS_0_RX; - } else if (device & (1 << AUDIO_DEVICE_OUT_BLUETOOTH_SCO) || - device & (1 << AUDIO_DEVICE_OUT_BLUETOOTH_SCO_HEADSET) || - device & (1 << AUDIO_DEVICE_OUT_BLUETOOTH_SCO_CARKIT)) { - return INT_BT_SCO_RX; - } else if (device & (1 << AUDIO_DEVICE_OUT_BLUETOOTH_A2DP) || - device & (1 << AUDIO_DEVICE_OUT_BLUETOOTH_A2DP_HEADPHONES) || - device & (1 << AUDIO_DEVICE_OUT_BLUETOOTH_A2DP_SPEAKER) || - device & (1 << AUDIO_DEVICE_OUT_ANLG_DOCK_HEADSET) || - device & (1 << AUDIO_DEVICE_OUT_DGTL_DOCK_HEADSET) || - device & (1 << AUDIO_DEVICE_OUT_USB_ACCESSORY) || - device & (1 << AUDIO_DEVICE_OUT_USB_DEVICE) || - device & (1 << AUDIO_DEVICE_OUT_PROXY)) { - return RT_PROXY_PORT_001_RX; - } else if (device & (1 << AUDIO_DEVICE_OUT_AUX_DIGITAL)) { - return HDMI_RX; - } else if (device & (1 << AUDIO_DEVICE_OUT_FM)) { - return INT_FM_RX; - } else if (device & (1 << AUDIO_DEVICE_OUT_FM_TX)) { - return INT_FM_TX; - } - return 0; -} - -static s32 _get_cb_for_dev(int device) -{ - s32 i; - if (device & AUDIO_DEVICE_COMBO) { - for (i = 0; i < CB_COUNT; i++) { - if ((_c_bl[i][CBD_DEV_MASK] & device) == device) - return i; - } - } else { - for (i = 0; i < CB_COUNT; i++) { - if ((_c_bl[i][CBD_DEV_MASK] & device) && - !(_c_bl[i][CBD_DEV_MASK] & AUDIO_DEVICE_COMBO)) - return i; - } - } - eagle_drv_err("%s: device %i not found", __func__, device); - return -EINVAL; -} - -static int _is_port_open_and_eagle(int pid) -{ - if (msm_routing_check_backend_enabled(pid)) - return 1; - return 1; -} - -static int _isNTDevice(u32 device) -{ - if (device & - ((1 << AUDIO_DEVICE_OUT_BLUETOOTH_SCO) | - (1 << AUDIO_DEVICE_OUT_BLUETOOTH_SCO_HEADSET) | - (1 << AUDIO_DEVICE_OUT_BLUETOOTH_SCO_CARKIT) | - (1 << AUDIO_DEVICE_OUT_BLUETOOTH_A2DP) | - (1 << AUDIO_DEVICE_OUT_BLUETOOTH_A2DP_HEADPHONES) | - (1 << AUDIO_DEVICE_OUT_BLUETOOTH_A2DP_SPEAKER) | - (1 << AUDIO_DEVICE_OUT_AUX_DIGITAL))) - return 1; - return 0; -} - -static void _reg_ion_mem(void) -{ - int rc; - rc = msm_audio_ion_alloc("DTS_EAGLE", &_ion_client, &_ion_handle, - ION_MEM_SIZE, &_po.paddr, &_po.size, &_po.kvaddr); - if (rc) - eagle_drv_err("%s: msm audio ion alloc failed with %i", - __func__, rc); -} - -static void _unreg_ion_mem(void) -{ - int rc; - rc = msm_audio_ion_free(_ion_client, _ion_handle); - if (rc) - eagle_drv_err("%s: msm audio ion alloc failed with %i", - __func__, rc); -} - -static void _reg_ion_mem_NT(void) -{ - int rc; - eagle_drv_dbg("%s: NT ion mem", __func__); - rc = msm_audio_ion_alloc("DTS_EAGLE", &_ion_client_NT, - &_ion_handle_NT, ION_MEM_SIZE, - &_po_NT.paddr, &_po_NT.size, &_po_NT.kvaddr); - if (rc) { - eagle_drv_err("%s: msm audio ion alloc failed", __func__); - return; - } - rc = q6asm_memory_map(_ac_NT, _po_NT.paddr, - IN, _po_NT.size, 1); - if (rc < 0) { - eagle_drv_err("%s: memory map failed", __func__); - msm_audio_ion_free(_ion_client_NT, _ion_handle_NT); - } -} - -static void _unreg_ion_mem_NT(void) -{ - int rc; - rc = q6asm_memory_unmap(_ac_NT, _po_NT.paddr, IN); - if (rc < 0) - eagle_drv_err("%s: mem unmap failed", __func__); - rc = msm_audio_ion_free(_ion_client_NT, _ion_handle_NT); - if (rc < 0) - eagle_drv_err("%s: mem free failed", __func__); -} - -static struct audio_client *_getNTDeviceAC(void) -{ - return _ac_NT; -} - -static void _set_audioclient(struct audio_client *ac) -{ - _ac_NT = ac; - _reg_ion_mem_NT(); -} - -static void _clear_audioclient(void) -{ - _unreg_ion_mem_NT(); - _ac_NT = NULL; -} - - -static int _sendcache_pre(struct audio_client *ac) -{ - uint32_t offset, size; - int32_t cidx, cmd, err = 0; - cidx = _get_cb_for_dev(_device_primary); - if (cidx < 0) { - eagle_precache_err("%s: no cache for primary device %i found", - __func__, _device_primary); - return -EINVAL; - } - offset = _c_bl[cidx][CBD_OFFSG]; - cmd = _c_bl[cidx][CBD_CMD0]; - size = _c_bl[cidx][CBD_SZ0]; - /* check for integer overflow */ - if (offset > (UINT_MAX - size)) - err = -EINVAL; - if ((_depc_size == 0) || !_depc || (size == 0) || - cmd == 0 || ((offset + size) > _depc_size) || (err != 0)) { - eagle_precache_err("%s: primary device %i cache index %i general error - cache size = %u, cache ptr = %p, offset = %u, size = %u, cmd = %i", - __func__, _device_primary, cidx, _depc_size, _depc, - offset, size, cmd); - return -EINVAL; - } - - eagle_precache_dbg("%s: first 6 integers %i %i %i %i %i %i (30th %i)", - __func__, - *((int *)&_depc[offset]), *((int *)&_depc[offset+4]), - *((int *)&_depc[offset+8]), *((int *)&_depc[offset+12]), - *((int *)&_depc[offset+16]), *((int *)&_depc[offset+20]), - *((int *)&_depc[offset+120])); - eagle_precache_dbg("%s: sending full data block to port, with cache index = %d device mask 0x%X, param = 0x%X, offset = %u, and size = %u", - __func__, cidx, _c_bl[cidx][CBD_DEV_MASK], cmd, offset, size); - - if (q6asm_dts_eagle_set(ac, cmd, size, (void *)&_depc[offset], - NULL, MPRE)) - eagle_precache_err("%s: q6asm_dts_eagle_set failed with id = %d and size = %u", - __func__, cmd, size); - else - eagle_precache_dbg("%s: q6asm_dts_eagle_set succeeded with id = %d and size = %u", - __func__, cmd, size); - return 0; -} - -static int _sendcache_post(int port_id, int copp_idx, int topology) -{ - int cidx = -1, cmd, mask, index, err = 0; - uint32_t offset, size; - - if (port_id == -1) { - cidx = _get_cb_for_dev(_device_primary); - if (cidx < 0) { - eagle_postcache_err("%s: no cache for primary device %i found. Port id was 0x%X", - __func__, _device_primary, port_id); - return -EINVAL; - } - goto NT_MODE_GOTO; - } - - index = adm_validate_and_get_port_index(port_id); - if (index < 0) - eagle_postcache_err("%s: Invalid port idx %d port_id %#x", - __func__, index, port_id); - else - eagle_postcache_dbg("%s: valid port idx %d for port_id %#x set to %i", - __func__, index, port_id, copp_idx); - _cidx[index] = copp_idx; - - mask = _get_dev_mask_for_pid(port_id); - if (mask & _device_primary) { - cidx = _get_cb_for_dev(_device_primary); - if (cidx < 0) { - eagle_postcache_err("%s: no cache for primary device %i found. Port id was 0x%X", - __func__, _device_primary, port_id); - return -EINVAL; - } - } else if (mask & _device_all) { - cidx = _get_cb_for_dev(_device_all); - if (cidx < 0) { - eagle_postcache_err("%s: no cache for combo device %i found. Port id was 0x%X", - __func__, _device_all, port_id); - return -EINVAL; - } - } else { - eagle_postcache_err("%s: port id 0x%X not for primary or combo device %i", - __func__, port_id, _device_primary); - return -EINVAL; - } - -NT_MODE_GOTO: - offset = _c_bl[cidx][CBD_OFFSG] + _c_bl[cidx][CBD_OFFS2]; - cmd = _c_bl[cidx][CBD_CMD2]; - size = _c_bl[cidx][CBD_SZ2]; - - /* check for integer overflow */ - if (offset > (UINT_MAX - size)) - err = -EINVAL; - if ((_depc_size == 0) || !_depc || (err != 0) || (size == 0) || - (cmd == 0) || (offset + size) > _depc_size) { - eagle_postcache_err("%s: primary device %i cache index %i port_id 0x%X general error - cache size = %u, cache ptr = %p, offset = %u, size = %u, cmd = %i", - __func__, _device_primary, cidx, port_id, - _depc_size, _depc, offset, size, cmd); - return -EINVAL; - } - - eagle_postcache_dbg("%s: first 6 integers %i %i %i %i %i %i", __func__, - *((int *)&_depc[offset]), *((int *)&_depc[offset+4]), - *((int *)&_depc[offset+8]), *((int *)&_depc[offset+12]), - *((int *)&_depc[offset+16]), *((int *)&_depc[offset+20])); - eagle_postcache_dbg("%s: sending full data block to port, with cache index = %d device mask 0x%X, port_id = 0x%X, param = 0x%X, offset = %u, and size = %u", - __func__, cidx, _c_bl[cidx][CBD_DEV_MASK], port_id, cmd, - offset, size); - - if (_ac_NT) { - eagle_postcache_dbg("%s: NT Route detected", __func__); - if (q6asm_dts_eagle_set(_getNTDeviceAC(), cmd, size, - (void *)&_depc[offset], - &_po_NT, MPST)) - eagle_postcache_err("%s: q6asm_dts_eagle_set failed with id = 0x%X and size = %u", - __func__, cmd, size); - } else if (adm_dts_eagle_set(port_id, copp_idx, cmd, - (void *)&_depc[offset], size) < 0) - eagle_postcache_err("%s: adm_dts_eagle_set failed with id = 0x%X and size = %u", - __func__, cmd, size); - else - eagle_postcache_dbg("%s: adm_dts_eagle_set succeeded with id = 0x%X and size = %u", - __func__, cmd, size); - return 0; -} - -static int _enable_post_get_control(struct snd_kcontrol *kcontrol, - struct snd_ctl_elem_value *ucontrol) -{ - ucontrol->value.integer.value[0] = _is_hpx_enabled; - return 0; -} - -static int _enable_post_put_control(struct snd_kcontrol *kcontrol, - struct snd_ctl_elem_value *ucontrol) -{ - int idx = 0, be_index = 0, port_id, topology; - int flag = ucontrol->value.integer.value[0]; - struct msm_pcm_routing_bdai_data msm_bedai; - eagle_drv_dbg("%s: flag %d", __func__, flag); - - _is_hpx_enabled = flag ? true : false; - msm_pcm_routing_acquire_lock(); - /* send cache postmix params when hpx is set On */ - for (be_index = 0; be_index < MSM_BACKEND_DAI_MAX; be_index++) { - msm_pcm_routing_get_bedai_info(be_index, &msm_bedai); - port_id = msm_bedai.port_id; - if (!(((port_id == SLIMBUS_0_RX) || - (port_id == RT_PROXY_PORT_001_RX)) && - msm_bedai.active)) - continue; - for (idx = 0; idx < MAX_COPPS_PER_PORT; idx++) { - topology = adm_get_topology_for_port_copp_idx( - port_id, idx); - if (topology == - ADM_CMD_COPP_OPEN_TOPOLOGY_ID_DTS_HPX) { - msm_dts_eagle_enable_adm(port_id, idx, - _is_hpx_enabled); - } - } - } - msm_pcm_routing_release_lock(); - return 0; -} - -static const struct snd_kcontrol_new _hpx_enabled_controls[] = { - SOC_SINGLE_EXT("Set HPX OnOff", SND_SOC_NOPM, 0, 1, 0, - _enable_post_get_control, _enable_post_put_control) -}; - -/** - * msm_dts_ion_memmap() - helper function to map ION memory - * @po_: Out of band memory structure used as memory. - * - * Assign already allocated ION memory for mapping it to dsp. - * - * Return: No return value. - */ -void msm_dts_ion_memmap(struct param_outband *po_) -{ - po_->size = ION_MEM_SIZE; - po_->kvaddr = _po.kvaddr; - po_->paddr = _po.paddr; -} - -/** - * msm_dts_eagle_enable_asm() - Enable/disable dts module - * @ac: Enable/disable module in ASM session associated with this audio client. - * @enable: Enable/disable the dts module. - * @module: module id. - * - * Enable/disable specified dts module id in asm. - * - * Return: Return failure if any. - */ -int msm_dts_eagle_enable_asm(struct audio_client *ac, u32 enable, int module) -{ - int ret = 0; - eagle_enable_dbg("%s: enable = %i on module %i", - __func__, enable, module); - _is_hpx_enabled = enable; - ret = q6asm_dts_eagle_set(ac, AUDPROC_PARAM_ID_ENABLE, - sizeof(enable), &enable, - NULL, module); - if (_is_hpx_enabled) { - if (module == MPRE) - _sendcache_pre(ac); - else if (module == MPST) - _sendcache_post(-1, 0, 0); - } - return ret; -} - -/** - * msm_dts_eagle_enable_adm() - Enable/disable dts module in adm - * @port_id: Send enable/disable param to this port id. - * @copp_idx: Send enable/disable param to the relevant copp. - * @enable: Enable/disable the dts module. - * - * Enable/disable dts module in adm. - * - * Return: Return failure if any. - */ -int msm_dts_eagle_enable_adm(int port_id, int copp_idx, u32 enable) -{ - int ret = 0; - eagle_enable_dbg("%s: enable = %i", __func__, enable); - _is_hpx_enabled = enable; - ret = adm_dts_eagle_set(port_id, copp_idx, AUDPROC_PARAM_ID_ENABLE, - (char *)&enable, sizeof(enable)); - if (_is_hpx_enabled) - _sendcache_post(port_id, copp_idx, MPST); - return ret; -} - -/** - * msm_dts_eagle_add_controls() - Add mixer control to Enable/Disable DTS HPX - * @platform: Add mixer controls to this platform. - * - * Add mixer control to Enable/Disable DTS HPX module in ADM. - * - * Return: No return value. - */ -void msm_dts_eagle_add_controls(struct snd_soc_platform *platform) -{ - snd_soc_add_platform_controls(platform, _hpx_enabled_controls, - ARRAY_SIZE(_hpx_enabled_controls)); -} - -/** - * msm_dts_eagle_set_stream_gain() - Set stream gain to DTS Premix module - * @ac: Set stream gain to ASM session associated with this audio client. - * @lgain: Left gain value. - * @rgain: Right gain value. - * - * Set stream gain to DTS Premix module in ASM. - * - * Return: failure or success. - */ -int msm_dts_eagle_set_stream_gain(struct audio_client *ac, int lgain, int rgain) -{ - u32 i, val; - s32 idx, err = 0; - - eagle_vol_dbg("%s: - entry: vol_cmd_cnt = %u, lgain = %i, rgain = %i", - __func__, _vol_cmd_cnt, lgain, rgain); - - if (_depc_size == 0) { - eagle_vol_dbg("%s: driver cache not initialized", __func__); - return -EINVAL; - } - - for (i = 0; i < _vol_cmd_cnt; i++) { - if (_vol_cmds_d[i].d[0] & 0x8000) { - idx = (sizeof(struct dts_eagle_param_desc)/sizeof(int)) - + (_vol_cmds_d[i].d[0] & 0x3FF); - val = _fx_logN(((s32)(lgain+rgain)) << 2); - val = ((long long)val * _log10_10_inv_x20) >> 16; - _vol_cmds[i][idx] = (s32)clamp((int)(((long long)val * - _vol_cmds_d[i].d[1]) >> 16), - _vol_cmds_d[i].d[2], - _vol_cmds_d[i].d[3]); - eagle_vol_dbg("%s: loop %u cmd desc found %i, idx = %i. volume info: lgain = %i, rgain = %i, volume = %i (scale %i, min %i, max %i)", - __func__, i, _vol_cmds_d[i].d[0], idx, lgain, - rgain, _vol_cmds[i][idx], _vol_cmds_d[i].d[1], - _vol_cmds_d[i].d[2], _vol_cmds_d[i].d[3]); - } - idx = _get_cb_for_dev(_device_primary); - if (idx < 0) { - eagle_vol_err("%s: no cache for primary device %i found", - __func__, _device_primary); - return -EINVAL; - } - val = _c_bl[idx][CBD_OFFSG] + _vol_cmds[i][2]; - /* check for integer overflow */ - if (val > (UINT_MAX - _vol_cmds[i][1])) - err = -EINVAL; - if ((err != 0) || ((val + _vol_cmds[i][1]) > _depc_size)) { - eagle_vol_err("%s: volume size (%u) + offset (%i) out of bounds %i", - __func__, val, _vol_cmds[i][1], _depc_size); - return -EINVAL; - } - memcpy((void *)&_depc[val], &_vol_cmds[i][4], _vol_cmds[i][1]); - if (q6asm_dts_eagle_set(ac, _vol_cmds[i][0], - _vol_cmds[i][1], (void *)&_depc[val], NULL, MPRE)) - eagle_vol_err("%s: loop %u - volume set failed with id 0x%X, size %i, offset %i, cmd_desc %i, scale %i, min %i, max %i, data(...) %i", - __func__, i, _vol_cmds[i][0], _vol_cmds[i][1], - _vol_cmds[i][2], _vol_cmds_d[i].d[0], - _vol_cmds_d[i].d[1], _vol_cmds_d[i].d[2], - _vol_cmds_d[i].d[3], _vol_cmds[i][4]); - else - eagle_vol_dbg("%s: loop %u - volume set succeeded with id 0x%X, size %i, offset %i, cmd_desc %i, scale %i, min %i, max %i, data(...) %i", - __func__, i, _vol_cmds[i][0], _vol_cmds[i][1], - _vol_cmds[i][2], _vol_cmds_d[i].d[0], - _vol_cmds_d[i].d[1], _vol_cmds_d[i].d[2], - _vol_cmds_d[i].d[3], _vol_cmds[i][4]); - } - return 0; -} - -/** - * msm_dts_eagle_handle_asm() - Set or Get params from ASM - * @depd: DTS Eagle Params structure. - * @buf: Buffer to get queried param value. - * @for_pre: For premix module or postmix module. - * @get: Getting param from DSP or setting param. - * @ac: Set/Get from ASM session associated with this audio client. - * @po: Out of band memory to set or get postmix params. - * - * Set or Get params from modules in ASM session. - * - * Return: Return failure if any. - */ -int msm_dts_eagle_handle_asm(struct dts_eagle_param_desc *depd, char *buf, - bool for_pre, bool get, struct audio_client *ac, - struct param_outband *po) -{ - struct dts_eagle_param_desc depd_ = {0}; - s32 ret = 0, isALSA = 0, err = 0, i, mod = for_pre ? MPRE : MPST; - u32 offset; - - eagle_asm_dbg("%s: set/get asm", __func__); - - /* special handling for ALSA route, to accommodate 64 bit platforms */ - if (depd == NULL) { - long *arg_ = (long *)buf; - depd = &depd_; - depd->id = (u32)*arg_++; - depd->size = (u32)*arg_++; - depd->offset = (s32)*arg_++; - depd->device = (u32)*arg_++; - buf = (char *)arg_; - isALSA = 1; - } - - if (depd->size & 1) { - eagle_asm_err("%s: parameter size %u is not a multiple of 2", - __func__, depd->size); - return -EINVAL; - } - - if (get) { - void *buf_, *buf_m = NULL; - eagle_asm_dbg("%s: get requested", __func__); - if (depd->offset == -1) { - eagle_asm_dbg("%s: get from dsp requested", __func__); - if (depd->size > 0 && depd->size <= DEPC_MAX_SIZE) { - buf_ = buf_m = vzalloc(depd->size); - } else { - eagle_asm_err("%s: get size %u invalid", - __func__, depd->size); - return -EINVAL; - } - if (!buf_m) { - eagle_asm_err("%s: out of memory", __func__); - return -ENOMEM; - } else if (q6asm_dts_eagle_get(ac, depd->id, - depd->size, buf_m, - po, mod) < 0) { - eagle_asm_err("%s: asm get failed", __func__); - ret = -EFAULT; - goto DTS_EAGLE_IOCTL_GET_PARAM_PRE_EXIT; - } - eagle_asm_dbg("%s: get result: param id 0x%x value %d size %u", - __func__, depd->id, *(int *)buf_m, depd->size); - } else { - s32 tgt = _get_cb_for_dev(depd->device); - if (tgt < 0) { - eagle_asm_err("%s: no cache for device %u found", - __func__, depd->device); - return -EINVAL; - } - offset = _c_bl[tgt][CBD_OFFSG] + depd->offset; - /* check for integer overflow */ - if (offset > (UINT_MAX - depd->size)) - err = -EINVAL; - if ((err != 0) || (offset + depd->size) > _depc_size) { - eagle_asm_err("%s: invalid size %u and/or offset %u", - __func__, depd->size, offset); - return -EINVAL; - } - buf_ = (u32 *)&_depc[offset]; - } - if (isALSA) { - if (depd->size == 2) { - *(long *)buf = (long)*(__u16 *)buf_; - eagle_asm_dbg("%s: asm out 16 bit value %li", - __func__, *(long *)buf); - } else { - s32 *pbuf = (s32 *)buf_; - long *bufl = (long *)buf; - for (i = 0; i < (depd->size >> 2); i++) { - *bufl++ = (long)*pbuf++; - eagle_asm_dbg("%s: asm out value %li", - __func__, *(bufl-1)); - } - } - } else { - memcpy(buf, buf_, depd->size); - } -DTS_EAGLE_IOCTL_GET_PARAM_PRE_EXIT: - vfree(buf_m); - return (int)ret; - } else { - s32 tgt = _get_cb_for_dev(depd->device); - if (tgt < 0) { - eagle_asm_err("%s: no cache for device %u found", - __func__, depd->device); - return -EINVAL; - } - offset = _c_bl[tgt][CBD_OFFSG] + depd->offset; - /* check for integer overflow */ - if (offset > (UINT_MAX - depd->size)) - err = -EINVAL; - if ((err != 0) || ((offset + depd->size) > _depc_size)) { - eagle_asm_err("%s: invalid size %u and/or offset %u for parameter (cache is size %u)", - __func__, depd->size, offset, _depc_size); - return -EINVAL; - } - if (isALSA) { - if (depd->size == 2) { - *(__u16 *)&_depc[offset] = (__u16)*(long *)buf; - eagle_asm_dbg("%s: asm in 16 bit value %li", - __func__, *(long *)buf); - } else { - s32 *pbuf = (s32 *)&_depc[offset]; - long *bufl = (long *)buf; - for (i = 0; i < (depd->size >> 2); i++) { - *pbuf++ = (s32)*bufl++; - eagle_asm_dbg("%s: asm in value %i", - __func__, *(pbuf-1)); - } - } - } else { - memcpy(&_depc[offset], buf, depd->size); - } - eagle_asm_dbg("%s: param info: param = 0x%X, size = %u, offset = %i, device = %u, cache block %i, global offset = %u, first bytes as integer = %i", - __func__, depd->id, depd->size, depd->offset, - depd->device, - tgt, offset, *(int *)&_depc[offset]); - if (q6asm_dts_eagle_set(ac, depd->id, depd->size, - (void *)&_depc[offset], po, mod)) - eagle_asm_err("%s: q6asm_dts_eagle_set failed with id = 0x%X, size = %u, offset = %d", - __func__, depd->id, depd->size, depd->offset); - else - eagle_asm_dbg("%s: q6asm_dts_eagle_set succeeded with id = 0x%X, size = %u, offset = %d", - __func__, depd->id, depd->size, depd->offset); - } - return (int)ret; -} - -/** - * msm_dts_eagle_handle_adm() - Set or Get params from ADM - * @depd: DTS Eagle Params structure used to set or get. - * @buf: Buffer to get queried param value in NT mode. - * @for_pre: For premix module or postmix module. - * @get: Getting param from DSP or setting param. - * - * Set or Get params from modules in ADM session. - * - * Return: Return failure if any. - */ -int msm_dts_eagle_handle_adm(struct dts_eagle_param_desc *depd, char *buf, - bool for_pre, bool get) -{ - u32 pid = _get_pid_from_dev(depd->device), cidx; - s32 ret = 0; - - eagle_adm_dbg("%s: set/get adm", __func__); - - if (_isNTDevice(depd->device)) { - eagle_adm_dbg("%s: NT Route detected", __func__); - ret = msm_dts_eagle_handle_asm(depd, buf, for_pre, get, - _getNTDeviceAC(), &_po_NT); - if (ret < 0) - eagle_adm_err("%s: NT Route set failed with id = 0x%X, size = %u, offset = %i, device = %u", - __func__, depd->id, depd->size, depd->offset, - depd->device); - } else if (get) { - cidx = adm_validate_and_get_port_index(pid); - eagle_adm_dbg("%s: get from qdsp requested (port id 0x%X)", - __func__, pid); - if (adm_dts_eagle_get(pid, _cidx[cidx], depd->id, - buf, depd->size) < 0) { - eagle_adm_err("%s: get from qdsp via adm with port id 0x%X failed", - __func__, pid); - return -EFAULT; - } - } else if (_is_port_open_and_eagle(pid)) { - cidx = adm_validate_and_get_port_index(pid); - eagle_adm_dbg("%s: adm_dts_eagle_set called with id = 0x%X, size = %u, offset = %i, device = %u, port id = %u, copp index = %u", - __func__, depd->id, depd->size, depd->offset, - depd->device, pid, cidx); - ret = adm_dts_eagle_set(pid, _cidx[cidx], depd->id, - (void *)buf, depd->size); - if (ret < 0) - eagle_adm_err("%s: adm_dts_eagle_set failed", __func__); - else - eagle_adm_dbg("%s: adm_dts_eagle_set succeeded", - __func__); - } else { - ret = -EINVAL; - eagle_adm_dbg("%s: port id 0x%X not active or not Eagle", - __func__, pid); - } - return (int)ret; -} - -/** - * msm_dts_eagle_ioctl() - ioctl handler function - * @cmd: cmd to handle. - * @arg: argument to the cmd. - * - * Handle DTS Eagle ioctl cmds. - * - * Return: Return failure if any. - */ -int msm_dts_eagle_ioctl(unsigned int cmd, unsigned long arg) -{ - s32 ret = 0; - switch (cmd) { - case DTS_EAGLE_IOCTL_GET_CACHE_SIZE: { - eagle_ioctl_info("%s: called with control 0x%X (get param cache size)", - __func__, cmd); - if (copy_to_user((void *)arg, &_depc_size, - sizeof(_depc_size))) { - eagle_ioctl_err("%s: error writing size", __func__); - return -EFAULT; - } - break; - } - case DTS_EAGLE_IOCTL_SET_CACHE_SIZE: { - u32 size = 0; - eagle_ioctl_info("%s: called with control 0x%X (allocate param cache)", - __func__, cmd); - if (copy_from_user((void *)&size, (void *)arg, sizeof(size))) { - eagle_ioctl_err("%s: error copying size (src:%p, tgt:%p, size:%zu)", - __func__, (void *)arg, &size, sizeof(size)); - return -EFAULT; - } else if (size > DEPC_MAX_SIZE) { - eagle_ioctl_err("%s: cache size %u not allowed (min 0, max %u)", - __func__, size, DEPC_MAX_SIZE); - return -EINVAL; - } - if (_depc) { - eagle_ioctl_dbg("%s: previous param cache of size %u freed", - __func__, _depc_size); - _depc_size = 0; - vfree(_depc); - _depc = NULL; - } - if (size) - _depc = vzalloc(size); - else - eagle_ioctl_dbg("%s: %u bytes requested for param cache, nothing allocated", - __func__, size); - if (_depc) { - eagle_ioctl_dbg("%s: %u bytes allocated for param cache", - __func__, size); - _depc_size = size; - } else { - eagle_ioctl_err("%s: error allocating param cache (vzalloc failed on %u bytes)", - __func__, size); - _depc_size = 0; - return -ENOMEM; - } - break; - } - case DTS_EAGLE_IOCTL_GET_PARAM: { - struct dts_eagle_param_desc depd; - s32 for_pre = 0, get_from_core = 0, err = 0; - u32 offset; - void *buf, *buf_m = NULL; - eagle_ioctl_info("%s: control 0x%X (get param)", - __func__, cmd); - if (copy_from_user((void *)&depd, (void *)arg, sizeof(depd))) { - eagle_ioctl_err("%s: error copying dts_eagle_param_desc (src:%p, tgt:%p, size:%zu)", - __func__, (void *)arg, &depd, sizeof(depd)); - return -EFAULT; - } - if (depd.device & DTS_EAGLE_FLAG_IOCTL_PRE) { - eagle_ioctl_dbg("%s: using for premix", __func__); - for_pre = 1; - } - if (depd.device & DTS_EAGLE_FLAG_IOCTL_GETFROMCORE) { - eagle_ioctl_dbg("%s: 'get from core' requested", - __func__); - get_from_core = 1; - depd.offset = -1; - } - depd.device &= DTS_EAGLE_FLAG_IOCTL_MASK; - if (depd.offset == -1) { - if (depd.size > 0 && depd.size <= DEPC_MAX_SIZE) { - buf = buf_m = vzalloc(depd.size); - } else { - eagle_ioctl_err("%s: get size %u invalid", - __func__, depd.size); - return -EINVAL; - } - if (!buf_m) { - eagle_ioctl_err("%s: out of memory", __func__); - return -ENOMEM; - } - if (get_from_core) - ret = core_dts_eagle_get(depd.id, depd.size, - buf); - else - ret = msm_dts_eagle_handle_adm(&depd, buf, - for_pre, true); - } else { - s32 cb = _get_cb_for_dev(depd.device); - if (cb < 0) { - eagle_ioctl_err("%s: no cache for device %u found", - __func__, depd.device); - return -EINVAL; - } - offset = _c_bl[cb][CBD_OFFSG] + depd.offset; - /* check for integer overflow */ - if (offset > (UINT_MAX - depd.size)) - err = -EINVAL; - if ((err != 0) || - ((offset + depd.size) > _depc_size)) { - eagle_ioctl_err("%s: invalid size %u and/or offset %u", - __func__, depd.size, offset); - return -EINVAL; - } - buf = (void *)&_depc[offset]; - } - if (ret < 0) - eagle_ioctl_err("%s: error %i getting data", __func__, - ret); - else if (copy_to_user((void *)(((char *)arg)+sizeof(depd)), - buf, depd.size)) { - eagle_ioctl_err("%s: error copying get data", __func__); - ret = -EFAULT; - } - vfree(buf_m); - break; - } - case DTS_EAGLE_IOCTL_SET_PARAM: { - struct dts_eagle_param_desc depd; - s32 just_set_cache = 0, for_pre = 0, err = 0; - u32 offset; - s32 tgt; - eagle_ioctl_info("%s: control 0x%X (set param)", - __func__, cmd); - if (copy_from_user((void *)&depd, (void *)arg, sizeof(depd))) { - eagle_ioctl_err("%s: error copying dts_eagle_param_desc (src:%p, tgt:%p, size:%zu)", - __func__, (void *)arg, &depd, sizeof(depd)); - return -EFAULT; - } - if (depd.device & DTS_EAGLE_FLAG_IOCTL_PRE) { - eagle_ioctl_dbg("%s: using for premix", __func__); - for_pre = 1; - } - if (depd.device & DTS_EAGLE_FLAG_IOCTL_JUSTSETCACHE) { - eagle_ioctl_dbg("%s: 'just set cache' requested", - __func__); - just_set_cache = 1; - } - depd.device &= DTS_EAGLE_FLAG_IOCTL_MASK; - tgt = _get_cb_for_dev(depd.device); - if (tgt < 0) { - eagle_ioctl_err("%s: no cache for device %u found", - __func__, depd.device); - return -EINVAL; - } - offset = _c_bl[tgt][CBD_OFFSG] + depd.offset; - /* check for integer overflow */ - if (offset > (UINT_MAX - depd.size)) - err = -EINVAL; - if ((err != 0) || ((offset + depd.size) > _depc_size)) { - eagle_ioctl_err("%s: invalid size %u and/or offset %u for parameter (target cache block %i with offset %i, global cache is size %u)", - __func__, depd.size, offset, tgt, - _c_bl[tgt][CBD_OFFSG], _depc_size); - return -EINVAL; - } - if (copy_from_user((void *)&_depc[offset], - (void *)(((char *)arg)+sizeof(depd)), - depd.size)) { - eagle_ioctl_err("%s: error copying param to cache (src:%p, tgt:%p, size:%u)", - __func__, ((char *)arg)+sizeof(depd), - &_depc[offset], depd.size); - return -EFAULT; - } - eagle_ioctl_dbg("%s: param info: param = 0x%X, size = %u, offset = %i, device = %u, cache block %i, global offset = %u, first bytes as integer = %i", - __func__, depd.id, depd.size, depd.offset, - depd.device, tgt, offset, *(int *)&_depc[offset]); - if (!just_set_cache) { - ret = msm_dts_eagle_handle_adm(&depd, &_depc[offset], - for_pre, false); - } - break; - } - case DTS_EAGLE_IOCTL_SET_CACHE_BLOCK: { - u32 b_[CBD_COUNT+1], *b = &b_[1], cb; - eagle_ioctl_info("%s: with control 0x%X (set param cache block)", - __func__, cmd); - if (copy_from_user((void *)b_, (void *)arg, sizeof(b_))) { - eagle_ioctl_err("%s: error copying cache block data (src:%p, tgt:%p, size:%zu)", - __func__, (void *)arg, b_, sizeof(b_)); - return -EFAULT; - } - cb = b_[0]; - if (cb >= CB_COUNT) { - eagle_ioctl_err("%s: cache block %u out of range (max %u)", - __func__, cb, CB_COUNT-1); - return -EINVAL; - } - eagle_ioctl_dbg("%s: cache block %i set: devices 0x%X, global offset %i, offsets 1:%u 2:%u 3:%u, cmds/sizes 0:0x%X %u 1:0x%X %u 2:0x%X %u 3:0x%X %u", - __func__, cb, _c_bl[cb][CBD_DEV_MASK], _c_bl[cb][CBD_OFFSG], - _c_bl[cb][CBD_OFFS1], _c_bl[cb][CBD_OFFS2], - _c_bl[cb][CBD_OFFS3], _c_bl[cb][CBD_CMD0], _c_bl[cb][CBD_SZ0], - _c_bl[cb][CBD_CMD1], _c_bl[cb][CBD_SZ1], _c_bl[cb][CBD_CMD2], - _c_bl[cb][CBD_SZ2], _c_bl[cb][CBD_CMD3], _c_bl[cb][CBD_SZ3]); - if ((b[CBD_OFFSG]+b[CBD_OFFS1]+b[CBD_SZ1]) > _depc_size || - (b[CBD_OFFSG]+b[CBD_OFFS2]+b[CBD_SZ2]) > _depc_size || - (b[CBD_OFFSG]+b[CBD_OFFS3]+b[CBD_SZ3]) > _depc_size) { - eagle_ioctl_err("%s: cache block bounds out of range", - __func__); - return -EINVAL; - } - memcpy(_c_bl[cb], b, sizeof(_c_bl[cb])); - break; - } - case DTS_EAGLE_IOCTL_SET_ACTIVE_DEVICE: { - u32 data[2]; - eagle_ioctl_dbg("%s: with control 0x%X (set active device)", - __func__, cmd); - if (copy_from_user((void *)data, (void *)arg, sizeof(data))) { - eagle_ioctl_err("%s: error copying active device data (src:%p, tgt:%p, size:%zu)", - __func__, (void *)arg, data, sizeof(data)); - return -EFAULT; - } - if (data[1] != 0) { - _device_primary = data[0]; - eagle_ioctl_dbg("%s: primary device %i", __func__, - data[0]); - } else { - _device_all = data[0]; - eagle_ioctl_dbg("%s: all devices 0x%X", __func__, - data[0]); - } - break; - } - case DTS_EAGLE_IOCTL_GET_LICENSE: { - u32 target = 0, size = 0; - s32 size_only; - eagle_ioctl_dbg("%s: with control 0x%X (get license)", - __func__, cmd); - if (copy_from_user((void *)&target, (void *)arg, - sizeof(target))) { - eagle_ioctl_err("%s: error reading license index. (src:%p, tgt:%p, size:%zu)", - __func__, (void *)arg, &target, sizeof(target)); - return -EFAULT; - } - size_only = target & (1<<31) ? 1 : 0; - target &= 0x7FFFFFFF; - if (target >= SEC_BLOB_MAX_CNT) { - eagle_ioctl_err("%s: license index %u out of bounds (max index is %i)", - __func__, target, SEC_BLOB_MAX_CNT); - return -EINVAL; - } - if (_sec_blob[target] == NULL) { - eagle_ioctl_err("%s: license index %u never initialized", - __func__, target); - return -EINVAL; - } - size = ((u32 *)_sec_blob[target])[0]; - if ((size == 0) || (size > SEC_BLOB_MAX_SIZE)) { - eagle_ioctl_err("%s: license size %u for index %u invalid (min size is 1, max size is %u)", - __func__, size, target, SEC_BLOB_MAX_SIZE); - return -EINVAL; - } - if (size_only) { - eagle_ioctl_dbg("%s: reporting size of license data only", - __func__); - if (copy_to_user((void *)(((char *)arg)+sizeof(target)), - (void *)&size, sizeof(size))) { - eagle_ioctl_err("%s: error copying license size", - __func__); - return -EFAULT; - } - } else if (copy_to_user((void *)(((char *)arg)+sizeof(target)), - (void *)&(((s32 *)_sec_blob[target])[1]), size)) { - eagle_ioctl_err("%s: error copying license data", - __func__); - return -EFAULT; - } else - eagle_ioctl_info("%s: license file %u bytes long from license index %u returned to user", - __func__, size, target); - break; - } - case DTS_EAGLE_IOCTL_SET_LICENSE: { - u32 target[2] = {0, 0}; - eagle_ioctl_dbg("%s: control 0x%X (set license)", __func__, - cmd); - if (copy_from_user((void *)target, (void *)arg, - sizeof(target))) { - eagle_ioctl_err("%s: error reading license index (src:%p, tgt:%p, size:%zu)", - __func__, (void *)arg, target, sizeof(target)); - return -EFAULT; - } - if (target[0] >= SEC_BLOB_MAX_CNT) { - eagle_ioctl_err("%s: license index %u out of bounds (max index is %u)", - __func__, target[0], SEC_BLOB_MAX_CNT-1); - return -EINVAL; - } - if (target[1] == 0) { - eagle_ioctl_dbg("%s: request to free license index %u", - __func__, target[0]); - kfree(_sec_blob[target[0]]); - _sec_blob[target[0]] = NULL; - break; - } - if ((target[1] == 0) || (target[1] >= SEC_BLOB_MAX_SIZE)) { - eagle_ioctl_err("%s: license size %u for index %u invalid (min size is 1, max size is %u)", - __func__, target[1], target[0], - SEC_BLOB_MAX_SIZE); - return -EINVAL; - } - if (_sec_blob[target[0]] != NULL) { - if (((u32 *)_sec_blob[target[0]])[1] != target[1]) { - eagle_ioctl_dbg("%s: request new size for already allocated license index %u", - __func__, target[0]); - kfree(_sec_blob[target[0]]); - _sec_blob[target[0]] = NULL; - } - } - eagle_ioctl_dbg("%s: allocating %u bytes for license index %u", - __func__, target[1], target[0]); - _sec_blob[target[0]] = kzalloc(target[1] + 4, GFP_KERNEL); - if (!_sec_blob[target[0]]) { - eagle_ioctl_err("%s: error allocating license index %u (kzalloc failed on %u bytes)", - __func__, target[0], target[1]); - return -ENOMEM; - } - ((u32 *)_sec_blob[target[0]])[0] = target[1]; - if (copy_from_user( - (void *)&(((u32 *)_sec_blob[target[0]])[1]), - (void *)(((char *)arg)+sizeof(target)), - target[1])) { - eagle_ioctl_err("%s: error copying license to index %u, size %u (src:%p, tgt:%p, size:%u)", - __func__, target[0], target[1], - ((char *)arg)+sizeof(target), - &(((u32 *)_sec_blob[target[0]])[1]), - target[1]); - return -EFAULT; - } else - eagle_ioctl_info("%s: license file %u bytes long copied to index license index %u", - __func__, target[1], target[0]); - break; - } - case DTS_EAGLE_IOCTL_SEND_LICENSE: { - u32 target = 0; - eagle_ioctl_dbg("%s: control 0x%X (send license)", __func__, - cmd); - if (copy_from_user((void *)&target, (void *)arg, - sizeof(target))) { - eagle_ioctl_err("%s: error reading license index (src:%p, tgt:%p, size:%zu)", - __func__, (void *)arg, &target, sizeof(target)); - return -EFAULT; - } - if (target >= SEC_BLOB_MAX_CNT) { - eagle_ioctl_err("%s: license index %u out of bounds (max index is %i)", - __func__, target, SEC_BLOB_MAX_CNT-1); - return -EINVAL; - } - if (!_sec_blob[target] || - ((u32 *)_sec_blob[target])[0] == 0) { - eagle_ioctl_err("%s: license index %u is invalid", - __func__, target); - return -EINVAL; - } - if (core_dts_eagle_set(((s32 *)_sec_blob[target])[0], - (char *)&((s32 *)_sec_blob[target])[1]) < 0) - eagle_ioctl_err("%s: core_dts_eagle_set failed with id = %u", - __func__, target); - else - eagle_ioctl_info("%s: core_dts_eagle_set succeeded with id = %u", - __func__, target); - break; - } - case DTS_EAGLE_IOCTL_SET_VOLUME_COMMANDS: { - s32 spec = 0; - eagle_ioctl_info("%s: control 0x%X (set volume commands)", - __func__, cmd); - if (copy_from_user((void *)&spec, (void *)arg, - sizeof(spec))) { - eagle_ioctl_err("%s: error reading volume command specifier (src:%p, tgt:%p, size:%zu)", - __func__, (void *)arg, &spec, sizeof(spec)); - return -EFAULT; - } - if (spec & 0x80000000) { - u32 idx = (spec & 0x0000F000) >> 12; - s32 size = spec & 0x00000FFF; - eagle_ioctl_dbg("%s: setting volume command %i size: %i", - __func__, idx, size); - if (idx >= _vol_cmd_cnt) { - eagle_ioctl_err("%s: volume command index %u out of bounds (only %u allocated)", - __func__, idx, _vol_cmd_cnt); - return -EINVAL; - } - if (_volume_cmds_alloc2(idx, size) < 0) { - eagle_ioctl_err("%s: error allocating memory for volume controls", - __func__); - return -ENOMEM; - } - if (copy_from_user((void *)&_vol_cmds_d[idx], - (void *)(((char *)arg) + sizeof(int)), - sizeof(struct vol_cmds_d))) { - eagle_ioctl_err("%s: error reading volume command descriptor (src:%p, tgt:%p, size:%zu)", - __func__, ((char *)arg) + sizeof(int), - &_vol_cmds_d[idx], - sizeof(struct vol_cmds_d)); - return -EFAULT; - } - eagle_ioctl_dbg("%s: setting volume command %i spec (size %zu): %i %i %i %i", - __func__, idx, sizeof(struct vol_cmds_d), - _vol_cmds_d[idx].d[0], _vol_cmds_d[idx].d[1], - _vol_cmds_d[idx].d[2], _vol_cmds_d[idx].d[3]); - if (copy_from_user((void *)_vol_cmds[idx], - (void *)(((char *)arg) + (sizeof(int) + - sizeof(struct vol_cmds_d))), size)) { - eagle_ioctl_err("%s: error reading volume command string (src:%p, tgt:%p, size:%i)", - __func__, ((char *)arg) + (sizeof(int) + - sizeof(struct vol_cmds_d)), - _vol_cmds[idx], size); - return -EFAULT; - } - } else { - eagle_ioctl_dbg("%s: setting volume command size", - __func__); - if (spec < 0 || spec > VOL_CMD_CNT_MAX) { - eagle_ioctl_err("%s: volume command count %i out of bounds (min 0, max %i)", - __func__, spec, VOL_CMD_CNT_MAX); - return -EINVAL; - } else if (spec == 0) { - eagle_ioctl_dbg("%s: request to free volume commands", - __func__); - _volume_cmds_free(); - break; - } - eagle_ioctl_dbg("%s: setting volume command size requested = %i", - __func__, spec); - if (_volume_cmds_alloc1(spec) < 0) { - eagle_ioctl_err("%s: error allocating memory for volume controls", - __func__); - return -ENOMEM; - } - } - break; - } - default: { - eagle_ioctl_err("%s: control 0x%X (invalid control)", - __func__, cmd); - ret = -EINVAL; - } - } - return (int)ret; -} - -/** - * msm_dts_eagle_compat_ioctl() - To handle 32bit to 64bit ioctl compatibility - * @cmd: cmd to handle. - * @arg: argument to the cmd. - * - * Handle DTS Eagle ioctl cmds from 32bit userspace. - * - * Return: Return failure if any. - */ -int msm_dts_eagle_compat_ioctl(unsigned int cmd, unsigned long arg) -{ - switch (cmd) { - case DTS_EAGLE_IOCTL_GET_CACHE_SIZE32: - cmd = DTS_EAGLE_IOCTL_GET_CACHE_SIZE; - break; - case DTS_EAGLE_IOCTL_SET_CACHE_SIZE32: - cmd = DTS_EAGLE_IOCTL_SET_CACHE_SIZE; - break; - case DTS_EAGLE_IOCTL_GET_PARAM32: - cmd = DTS_EAGLE_IOCTL_GET_PARAM; - break; - case DTS_EAGLE_IOCTL_SET_PARAM32: - cmd = DTS_EAGLE_IOCTL_SET_PARAM; - break; - case DTS_EAGLE_IOCTL_SET_CACHE_BLOCK32: - cmd = DTS_EAGLE_IOCTL_SET_CACHE_BLOCK; - break; - case DTS_EAGLE_IOCTL_SET_ACTIVE_DEVICE32: - cmd = DTS_EAGLE_IOCTL_SET_ACTIVE_DEVICE; - break; - case DTS_EAGLE_IOCTL_GET_LICENSE32: - cmd = DTS_EAGLE_IOCTL_GET_LICENSE; - break; - case DTS_EAGLE_IOCTL_SET_LICENSE32: - cmd = DTS_EAGLE_IOCTL_SET_LICENSE; - break; - case DTS_EAGLE_IOCTL_SEND_LICENSE32: - cmd = DTS_EAGLE_IOCTL_SEND_LICENSE; - break; - case DTS_EAGLE_IOCTL_SET_VOLUME_COMMANDS32: - cmd = DTS_EAGLE_IOCTL_SET_VOLUME_COMMANDS; - break; - default: - break; - } - return msm_dts_eagle_ioctl(cmd, arg); -} - -/** - * msm_dts_eagle_init_pre() - Initialize DTS premix module - * @ac: Initialize premix module in the ASM session. - * - * Initialize DTS premix module on provided ASM session - * - * Return: Return failure if any. - */ -int msm_dts_eagle_init_pre(struct audio_client *ac) -{ - return msm_dts_eagle_enable_asm(ac, _is_hpx_enabled, - AUDPROC_MODULE_ID_DTS_HPX_PREMIX); -} - -/** - * msm_dts_eagle_deinit_pre() - Deinitialize DTS premix module - * @ac: Deinitialize premix module in the ASM session. - * - * Deinitialize DTS premix module on provided ASM session - * - * Return: Currently does nothing so 0. - */ -int msm_dts_eagle_deinit_pre(struct audio_client *ac) -{ - return 0; -} - -/** - * msm_dts_eagle_init_post() - Initialize DTS postmix module - * @port_id: Port id for the ADM session. - * @copp_idx: Copp idx for the ADM session. - * - * Initialize DTS postmix module on ADM session - * - * Return: Return failure if any. - */ -int msm_dts_eagle_init_post(int port_id, int copp_idx) -{ - return msm_dts_eagle_enable_adm(port_id, copp_idx, _is_hpx_enabled); -} - -/** - * msm_dts_eagle_deinit_post() - Deinitialize DTS postmix module - * @port_id: Port id for the ADM session. - * @topology: Topology in use. - * - * Deinitialize DTS postmix module on ADM session - * - * Return: Currently does nothing so 0. - */ -int msm_dts_eagle_deinit_post(int port_id, int topology) -{ - return 0; -} - -/** - * msm_dts_eagle_init_master_module() - Initialize both DTS modules - * @ac: Initialize modules in the ASM session. - * - * Initialize DTS modules on ASM session - * - * Return: Success. - */ -int msm_dts_eagle_init_master_module(struct audio_client *ac) -{ - _set_audioclient(ac); - msm_dts_eagle_enable_asm(ac, _is_hpx_enabled, - AUDPROC_MODULE_ID_DTS_HPX_PREMIX); - msm_dts_eagle_enable_asm(ac, _is_hpx_enabled, - AUDPROC_MODULE_ID_DTS_HPX_POSTMIX); - return 0; -} - -/** - * msm_dts_eagle_deinit_master_module() - Deinitialize both DTS modules - * @ac: Deinitialize modules in the ASM session. - * - * Deinitialize DTS modules on ASM session - * - * Return: Success. - */ -int msm_dts_eagle_deinit_master_module(struct audio_client *ac) -{ - msm_dts_eagle_deinit_pre(ac); - msm_dts_eagle_deinit_post(-1, 0); - _clear_audioclient(); - return 0; -} - -/** - * msm_dts_eagle_is_hpx_on() - Check if HPX effects are On - * - * Check if HPX effects are On - * - * Return: On/Off. - */ -int msm_dts_eagle_is_hpx_on(void) -{ - return _is_hpx_enabled; -} - -/** - * msm_dts_eagle_pcm_new() - Create hwdep node - * @runtime: snd_soc_pcm_runtime structure. - * - * Create hwdep node - * - * Return: Success. - */ -int msm_dts_eagle_pcm_new(struct snd_soc_pcm_runtime *runtime) -{ - if (!_ref_cnt++) { - _init_cb_descs(); - _reg_ion_mem(); - } - return 0; -} - -/** - * msm_dts_eagle_pcm_free() - remove hwdep node - * @runtime: snd_soc_pcm_runtime structure. - * - * Remove hwdep node - * - * Return: void. - */ -void msm_dts_eagle_pcm_free(struct snd_pcm *pcm) -{ - if (!--_ref_cnt) - _unreg_ion_mem(); - vfree(_depc); -} - -MODULE_DESCRIPTION("DTS EAGLE platform driver"); -MODULE_LICENSE("GPL v2"); diff --git a/sound/soc/msm/qdsp6v2/msm-dts-srs-tm-config.c b/sound/soc/msm/qdsp6v2/msm-dts-srs-tm-config.c index ddfbcecd0c402..f1af50680494e 100644 --- a/sound/soc/msm/qdsp6v2/msm-dts-srs-tm-config.c +++ b/sound/soc/msm/qdsp6v2/msm-dts-srs-tm-config.c @@ -1,4 +1,4 @@ -/* Copyright (c) 2012-2014, The Linux Foundation. All rights reserved. +/* Copyright (c) 2012-2014, 2017 The Linux Foundation. All rights reserved. * * This program is free software; you can redistribute it and/or modify * it under the terms of the GNU General Public License version 2 and @@ -19,7 +19,6 @@ #include #include #include -#include #include "msm-dts-srs-tm-config.h" #include "msm-pcm-routing-v2.h" diff --git a/sound/soc/msm/qdsp6v2/msm-pcm-routing-devdep.c b/sound/soc/msm/qdsp6v2/msm-pcm-routing-devdep.c index e57db7d9c4945..da177c99763b6 100644 --- a/sound/soc/msm/qdsp6v2/msm-pcm-routing-devdep.c +++ b/sound/soc/msm/qdsp6v2/msm-pcm-routing-devdep.c @@ -1,4 +1,4 @@ -/* Copyright (c) 2014, The Linux Foundation. All rights reserved. +/* Copyright (c) 2014, 2017 The Linux Foundation. All rights reserved. * * This program is free software; you can redistribute it and/or modify * it under the terms of the GNU General Public License version 2 and @@ -14,8 +14,6 @@ #include #include #include -#include - #include "msm-pcm-routing-devdep.h" #include "msm-ds2-dap-config.h" @@ -53,23 +51,6 @@ static int msm_pcm_routing_hwdep_ioctl(struct snd_hwdep *hw, struct file *file, case SNDRV_DEVDEP_DAP_IOCTL_GET_VISUALIZER: ret = msm_ds2_dap_ioctl(hw, file, cmd, argp); break; - case DTS_EAGLE_IOCTL_GET_CACHE_SIZE: - case DTS_EAGLE_IOCTL_SET_CACHE_SIZE: - case DTS_EAGLE_IOCTL_GET_PARAM: - case DTS_EAGLE_IOCTL_SET_PARAM: - case DTS_EAGLE_IOCTL_SET_CACHE_BLOCK: - case DTS_EAGLE_IOCTL_SET_ACTIVE_DEVICE: - case DTS_EAGLE_IOCTL_GET_LICENSE: - case DTS_EAGLE_IOCTL_SET_LICENSE: - case DTS_EAGLE_IOCTL_SEND_LICENSE: - case DTS_EAGLE_IOCTL_SET_VOLUME_COMMANDS: - ret = msm_dts_eagle_ioctl(cmd, arg); - if (ret == -EPERM) { - pr_err("%s called with invalid control 0x%X\n", - __func__, cmd); - ret = -EINVAL; - } - break; default: pr_err("%s called with invalid control 0x%X\n", __func__, cmd); ret = -EINVAL; @@ -81,7 +62,6 @@ static int msm_pcm_routing_hwdep_ioctl(struct snd_hwdep *hw, struct file *file, void msm_pcm_routing_hwdep_free(struct snd_pcm *pcm) { pr_debug("%s\n", __func__); - msm_dts_eagle_pcm_free(pcm); } #ifdef CONFIG_COMPAT @@ -105,23 +85,6 @@ static int msm_pcm_routing_hwdep_compat_ioctl(struct snd_hwdep *hw, case SNDRV_DEVDEP_DAP_IOCTL_GET_VISUALIZER32: ret = msm_ds2_dap_compat_ioctl(hw, file, cmd, argp); break; - case DTS_EAGLE_IOCTL_GET_CACHE_SIZE32: - case DTS_EAGLE_IOCTL_SET_CACHE_SIZE32: - case DTS_EAGLE_IOCTL_GET_PARAM32: - case DTS_EAGLE_IOCTL_SET_PARAM32: - case DTS_EAGLE_IOCTL_SET_CACHE_BLOCK32: - case DTS_EAGLE_IOCTL_SET_ACTIVE_DEVICE32: - case DTS_EAGLE_IOCTL_GET_LICENSE32: - case DTS_EAGLE_IOCTL_SET_LICENSE32: - case DTS_EAGLE_IOCTL_SEND_LICENSE32: - case DTS_EAGLE_IOCTL_SET_VOLUME_COMMANDS32: - ret = msm_dts_eagle_compat_ioctl(cmd, arg); - if (ret == -EPERM) { - pr_err("%s called with invalid control 0x%X\n", - __func__, cmd); - ret = -EINVAL; - } - break; default: pr_err("%s called with invalid control 0x%X\n", __func__, cmd); ret = -EINVAL; @@ -167,6 +130,6 @@ int msm_pcm_routing_hwdep_new(struct snd_soc_pcm_runtime *runtime, #ifdef CONFIG_COMPAT hwdep->ops.ioctl_compat = msm_pcm_routing_hwdep_compat_ioctl; #endif - return msm_dts_eagle_pcm_new(runtime); + return rc; } #endif diff --git a/sound/soc/msm/qdsp6v2/msm-pcm-routing-v2.c b/sound/soc/msm/qdsp6v2/msm-pcm-routing-v2.c index a3de26f45b1fb..d8dba3047e632 100644 --- a/sound/soc/msm/qdsp6v2/msm-pcm-routing-v2.c +++ b/sound/soc/msm/qdsp6v2/msm-pcm-routing-v2.c @@ -33,7 +33,6 @@ #include #include #include -#include #include #include @@ -155,10 +154,6 @@ static void msm_pcm_routing_cfg_pp(int port_id, int copp_idx, int topology, __func__, topology, port_id, rc); } break; - case ADM_CMD_COPP_OPEN_TOPOLOGY_ID_DTS_HPX: - pr_debug("%s: DTS_EAGLE_COPP_TOPOLOGY_ID\n", __func__); - msm_dts_eagle_init_post(port_id, copp_idx); - break; default: /* custom topology specific feature param handlers */ break; @@ -186,10 +181,6 @@ static void msm_pcm_routing_deinit_pp(int port_id, int topology) msm_dolby_dap_deinit(port_id); } break; - case ADM_CMD_COPP_OPEN_TOPOLOGY_ID_DTS_HPX: - pr_debug("%s: DTS_EAGLE_COPP_TOPOLOGY_ID\n", __func__); - msm_dts_eagle_deinit_post(port_id, topology); - break; default: /* custom topology specific feature deinit handlers */ break; @@ -5908,8 +5899,6 @@ static int msm_routing_probe(struct snd_soc_platform *platform) return -ENOMEM; snd_ctl_add(platform->card->snd_card, kctl); } - - msm_dts_eagle_add_controls(platform); return 0; } diff --git a/sound/soc/msm/qdsp6v2/q6adm.c b/sound/soc/msm/qdsp6v2/q6adm.c index 4b50471847cd7..1a823d1f5aaf8 100644 --- a/sound/soc/msm/qdsp6v2/q6adm.c +++ b/sound/soc/msm/qdsp6v2/q6adm.c @@ -1,4 +1,5 @@ -/* Copyright (c) 2012-2015, 2016, 2017 The Linux Foundation. All rights reserved. +/* Copyright (c) 2012-2015, 2016-2017 The Linux Foundation. All rights + * reserved. * * This program is free software; you can redistribute it and/or modify * it under the terms of the GNU General Public License version 2 and @@ -23,7 +24,6 @@ #include #include #include -#include #include "msm-dts-srs-tm-config.h" #define TIMEOUT_MS 1000 @@ -237,199 +237,6 @@ static int adm_get_next_available_copp(int port_idx) return idx; } -int adm_dts_eagle_set(int port_id, int copp_idx, int param_id, - void *data, uint32_t size) -{ - struct adm_cmd_set_pp_params_v5 admp; - int p_idx, ret = 0, *ob_params; - - pr_debug("DTS_EAGLE_ADM: %s - port id %i, copp idx %i, param id 0x%X size %u\n", - __func__, port_id, copp_idx, param_id, size); - - port_id = afe_convert_virtual_to_portid(port_id); - p_idx = adm_validate_and_get_port_index(port_id); - pr_debug("DTS_EAGLE_ADM: %s - after lookup, port id %i, port idx %i\n", - __func__, port_id, p_idx); - - if (p_idx < 0) { - pr_err("DTS_EAGLE_ADM: %s: invalid port index 0x%x, port id 0x%x\n", - __func__, p_idx, port_id); - return -EINVAL; - } - - if (copp_idx < 0 || copp_idx >= MAX_COPPS_PER_PORT) { - pr_err("DTS_EAGLE_ADM: %s: Invalid copp_idx: %d\n", __func__, - copp_idx); - return -EINVAL; - } - - ob_params = (int *)this_adm.outband_memmap.kvaddr; - if (ob_params == NULL) { - pr_err("DTS_EAGLE_ADM: %s - NULL memmap. Non Eagle topology selected?\n", - __func__); - ret = -EINVAL; - goto fail_cmd; - } - /* check for integer overflow */ - if (size > (UINT_MAX - APR_CMD_OB_HDR_SZ)) - ret = -EINVAL; - if ((ret < 0) || - (size + APR_CMD_OB_HDR_SZ > this_adm.outband_memmap.size)) { - pr_err("DTS_EAGLE_ADM - %s: ion alloc of size %zu too small for size requested %u\n", - __func__, this_adm.outband_memmap.size, - size + APR_CMD_OB_HDR_SZ); - ret = -EINVAL; - goto fail_cmd; - } - *ob_params++ = AUDPROC_MODULE_ID_DTS_HPX_POSTMIX; - *ob_params++ = param_id; - *ob_params++ = size; - memcpy(ob_params, data, size); - - admp.hdr.hdr_field = APR_HDR_FIELD(APR_MSG_TYPE_SEQ_CMD, - APR_HDR_LEN(APR_HDR_SIZE), APR_PKT_VER); - admp.hdr.pkt_size = APR_PKT_SIZE(APR_HDR_SIZE, sizeof(admp)); - admp.hdr.src_svc = APR_SVC_ADM; - admp.hdr.src_domain = APR_DOMAIN_APPS; - admp.hdr.src_port = port_id; - admp.hdr.dest_svc = APR_SVC_ADM; - admp.hdr.dest_domain = APR_DOMAIN_ADSP; - admp.hdr.dest_port = atomic_read(&this_adm.copp.id[p_idx][copp_idx]); - admp.hdr.token = p_idx << 16 | copp_idx; - admp.hdr.opcode = ADM_CMD_SET_PP_PARAMS_V5; - admp.payload_addr_lsw = lower_32_bits(this_adm.outband_memmap.paddr); - admp.payload_addr_msw = upper_32_bits(this_adm.outband_memmap.paddr); - admp.mem_map_handle = atomic_read(&this_adm.mem_map_cal_handles[ - ADM_DTS_EAGLE]); - admp.payload_size = size + sizeof(struct adm_param_data_v5); - - pr_debug("DTS_EAGLE_ADM: %s - Command was sent now check Q6 - port id = %d, size %d, module id %x, param id %x.\n", - __func__, admp.hdr.dest_port, - admp.payload_size, AUDPROC_MODULE_ID_DTS_HPX_POSTMIX, - param_id); - atomic_set(&this_adm.copp.stat[p_idx][copp_idx], 0); - ret = apr_send_pkt(this_adm.apr, (uint32_t *)&admp); - if (ret < 0) { - pr_err("DTS_EAGLE_ADM: %s - ADM enable for port %d failed\n", - __func__, port_id); - ret = -EINVAL; - goto fail_cmd; - } - ret = wait_event_timeout(this_adm.copp.wait[p_idx][copp_idx], - atomic_read(&this_adm.copp.stat[p_idx][copp_idx]), - msecs_to_jiffies(TIMEOUT_MS)); - if (!ret) { - pr_err("DTS_EAGLE_ADM: %s - set params timed out port = %d\n", - __func__, port_id); - ret = -EINVAL; - } else { - ret = 0; - } - -fail_cmd: - return ret; -} - -int adm_dts_eagle_get(int port_id, int copp_idx, int param_id, - void *data, uint32_t size) -{ - struct adm_cmd_get_pp_params_v5 admp; - int p_idx, ret = 0, *ob_params; - uint32_t orig_size = size; - pr_debug("DTS_EAGLE_ADM: %s - port id %i, copp idx %i, param id 0x%X\n", - __func__, port_id, copp_idx, param_id); - - port_id = afe_convert_virtual_to_portid(port_id); - p_idx = adm_validate_and_get_port_index(port_id); - if (p_idx < 0) { - pr_err("DTS_EAGLE_ADM: %s - invalid port index %i, port id %i, copp idx %i\n", - __func__, p_idx, port_id, copp_idx); - return -EINVAL; - } - - if (copp_idx < 0 || copp_idx >= MAX_COPPS_PER_PORT) { - pr_err("DTS_EAGLE_ADM: %s: Invalid copp_idx: %d\n", __func__, - copp_idx); - return -EINVAL; - } - - if ((size == 0) || !data) { - pr_err("DTS_EAGLE_ADM: %s - invalid size %u or pointer %p.\n", - __func__, size, data); - return -EINVAL; - } - - size = (size+3) & 0xFFFFFFFC; - - ob_params = (int *)(this_adm.outband_memmap.kvaddr); - if (ob_params == NULL) { - pr_err("DTS_EAGLE_ADM: %s - NULL memmap. Non Eagle topology selected?", - __func__); - ret = -EINVAL; - goto fail_cmd; - } - /* check for integer overflow */ - if (size > (UINT_MAX - APR_CMD_OB_HDR_SZ)) - ret = -EINVAL; - if ((ret < 0) || - (size + APR_CMD_OB_HDR_SZ > this_adm.outband_memmap.size)) { - pr_err("DTS_EAGLE_ADM - %s: ion alloc of size %zu too small for size requested %u\n", - __func__, this_adm.outband_memmap.size, - size + APR_CMD_OB_HDR_SZ); - ret = -EINVAL; - goto fail_cmd; - } - *ob_params++ = AUDPROC_MODULE_ID_DTS_HPX_POSTMIX; - *ob_params++ = param_id; - *ob_params++ = size; - - admp.hdr.hdr_field = APR_HDR_FIELD(APR_MSG_TYPE_SEQ_CMD, - APR_HDR_LEN(APR_HDR_SIZE), APR_PKT_VER); - admp.hdr.pkt_size = APR_PKT_SIZE(APR_HDR_SIZE, sizeof(admp)); - admp.hdr.src_svc = APR_SVC_ADM; - admp.hdr.src_domain = APR_DOMAIN_APPS; - admp.hdr.src_port = port_id; - admp.hdr.dest_svc = APR_SVC_ADM; - admp.hdr.dest_domain = APR_DOMAIN_ADSP; - admp.hdr.dest_port = atomic_read(&this_adm.copp.id[p_idx][copp_idx]); - admp.hdr.token = p_idx << 16 | copp_idx; - admp.hdr.opcode = ADM_CMD_GET_PP_PARAMS_V5; - admp.data_payload_addr_lsw = - lower_32_bits(this_adm.outband_memmap.paddr); - admp.data_payload_addr_msw = - upper_32_bits(this_adm.outband_memmap.paddr); - admp.mem_map_handle = atomic_read(&this_adm.mem_map_cal_handles[ - ADM_DTS_EAGLE]); - admp.module_id = AUDPROC_MODULE_ID_DTS_HPX_POSTMIX; - admp.param_id = param_id; - admp.param_max_size = size + sizeof(struct adm_param_data_v5); - admp.reserved = 0; - - atomic_set(&this_adm.copp.stat[p_idx][copp_idx], 0); - - ret = apr_send_pkt(this_adm.apr, (uint32_t *)&admp); - if (ret < 0) { - pr_err("DTS_EAGLE_ADM: %s - Failed to get EAGLE Params on port %d\n", - __func__, port_id); - ret = -EINVAL; - goto fail_cmd; - } - ret = wait_event_timeout(this_adm.copp.wait[p_idx][copp_idx], - atomic_read(&this_adm.copp.stat[p_idx][copp_idx]), - msecs_to_jiffies(TIMEOUT_MS)); - if (!ret) { - pr_err("DTS_EAGLE_ADM: %s - EAGLE get params timed out port = %d\n", - __func__, port_id); - ret = -EINVAL; - goto fail_cmd; - } - - memcpy(data, ob_params, orig_size); - ret = 0; -fail_cmd: - return ret; -} - int srs_trumedia_open(int port_id, int copp_idx, __s32 srs_tech_id, void *srs_params) { @@ -2166,8 +1973,7 @@ int adm_open(int port_id, int path, int rate, int channel_mode, int topology, flags = ADM_LOW_LATENCY_DEVICE_SESSION; if ((topology == DOLBY_ADM_COPP_TOPOLOGY_ID) || (topology == DS2_ADM_COPP_TOPOLOGY_ID) || - (topology == SRS_TRUMEDIA_TOPOLOGY_ID) || - (topology == ADM_CMD_COPP_OPEN_TOPOLOGY_ID_DTS_HPX)) + (topology == SRS_TRUMEDIA_TOPOLOGY_ID)) topology = DEFAULT_COPP_TOPOLOGY; } else { if (path == ADM_PATH_COMPRESSED_RX) @@ -2235,20 +2041,6 @@ int adm_open(int port_id, int path, int rate, int channel_mode, int topology, (uint32_t)this_adm.outband_memmap.size); } } - if ((topology == ADM_CMD_COPP_OPEN_TOPOLOGY_ID_DTS_HPX) && - (perf_mode == LEGACY_PCM_MODE)) { - int res = 0; - atomic_set(&this_adm.mem_map_cal_index, ADM_DTS_EAGLE); - msm_dts_ion_memmap(&this_adm.outband_memmap); - res = adm_memory_map_regions( - &this_adm.outband_memmap.paddr, - 0, - (uint32_t *)&this_adm.outband_memmap.size, - 1); - if (res < 0) - pr_err("%s: DTS_EAGLE mmap did not work!", - __func__); - } open.hdr.hdr_field = APR_HDR_FIELD(APR_MSG_TYPE_SEQ_CMD, APR_HDR_LEN(APR_HDR_SIZE), APR_PKT_VER); @@ -2510,22 +2302,6 @@ int adm_close(int port_id, int perf_mode, int copp_idx) } } - if ((perf_mode == LEGACY_PCM_MODE) && - (this_adm.outband_memmap.paddr != 0) && - (atomic_read( - &this_adm.copp.topology[port_idx][copp_idx]) == - ADM_CMD_COPP_OPEN_TOPOLOGY_ID_DTS_HPX)) { - atomic_set(&this_adm.mem_map_cal_index, ADM_DTS_EAGLE); - ret = adm_memory_unmap_regions(); - if (ret < 0) { - pr_err("%s: adm mem unmmap err %d", - __func__, ret); - } else { - atomic_set(&this_adm.mem_map_cal_handles - [ADM_DTS_EAGLE], 0); - } - } - close.hdr_field = APR_HDR_FIELD(APR_MSG_TYPE_SEQ_CMD, APR_HDR_LEN(APR_HDR_SIZE), APR_PKT_VER); @@ -2873,10 +2649,6 @@ static int adm_init_cal_data(void) {NULL, NULL, NULL, NULL, NULL, NULL} }, {NULL, NULL, cal_utils_match_buf_num} }, - {{DTS_EAGLE_CAL_TYPE, - {NULL, NULL, NULL, NULL, NULL, NULL} }, - {NULL, NULL, cal_utils_match_buf_num} }, - {{SRS_TRUMEDIA_CAL_TYPE, {NULL, NULL, NULL, NULL, NULL, NULL} }, {NULL, NULL, cal_utils_match_buf_num} } diff --git a/sound/soc/msm/qdsp6v2/q6asm.c b/sound/soc/msm/qdsp6v2/q6asm.c index 523b1ae61a473..a87f411bcf279 100644 --- a/sound/soc/msm/qdsp6v2/q6asm.c +++ b/sound/soc/msm/qdsp6v2/q6asm.c @@ -1,5 +1,5 @@ /* - * Copyright (c) 2012-2016, The Linux Foundation. All rights reserved. + * Copyright (c) 2012-2017, The Linux Foundation. All rights reserved. * Author: Brian Swetland * * This software is licensed under the terms of the GNU General Public @@ -38,8 +38,8 @@ #include #include #include -#include #include +#include #define TRUE 0x01 #define FALSE 0x00 @@ -2137,9 +2137,6 @@ static int __q6asm_open_read(struct audio_client *ac, open.src_endpointype = ASM_END_POINT_DEVICE_MATRIX; open.preprocopo_id = q6asm_get_asm_topology(); - if ((open.preprocopo_id == ASM_STREAM_POSTPROC_TOPO_ID_DTS_HPX) || - (open.preprocopo_id == ASM_STREAM_POSTPROC_TOPO_ID_HPX_PLUS)) - open.preprocopo_id = ASM_STREAM_POSTPROCOPO_ID_NONE; open.bits_per_sample = bits_per_sample; open.mode_flags = 0x0; @@ -2356,16 +2353,9 @@ static int __q6asm_open_write(struct audio_client *ac, uint32_t format, open.bits_per_sample = bits_per_sample; open.postprocopo_id = q6asm_get_asm_topology(); - if ((ac->perf_mode != LEGACY_PCM_MODE) && - ((open.postprocopo_id == ASM_STREAM_POSTPROC_TOPO_ID_DTS_HPX) || - (open.postprocopo_id == ASM_STREAM_POSTPROC_TOPO_ID_HPX_PLUS))) + if (ac->perf_mode != LEGACY_PCM_MODE) open.postprocopo_id = ASM_STREAM_POSTPROCOPO_ID_NONE; - /* For DTS EAGLE only, force 24 bit */ - if ((open.postprocopo_id == ASM_STREAM_POSTPROC_TOPO_ID_DTS_HPX) || - (open.postprocopo_id == ASM_STREAM_POSTPROC_TOPO_ID_HPX_PLUS)) - open.bits_per_sample = 24; - pr_debug("%s: perf_mode %d asm_topology 0x%x bps %d\n", __func__, ac->perf_mode, open.postprocopo_id, open.bits_per_sample); @@ -2530,10 +2520,6 @@ static int __q6asm_open_read_write(struct audio_client *ac, uint32_t rd_format, topology : open.postprocopo_id; ac->topology = open.postprocopo_id; - /* For DTS EAGLE only, force 24 bit */ - if ((open.postprocopo_id == ASM_STREAM_POSTPROC_TOPO_ID_DTS_HPX) || - (open.postprocopo_id == ASM_STREAM_POSTPROC_TOPO_ID_HPX_MASTER)) - open.bits_per_sample = 24; switch (wr_format) { case FORMAT_LINEAR_PCM: @@ -5175,213 +5161,6 @@ int q6asm_set_mute(struct audio_client *ac, int muteflag) return rc; } -int q6asm_dts_eagle_set(struct audio_client *ac, int param_id, uint32_t size, - void *data, struct param_outband *po, int m_id) -{ - int rc = 0, *ob_params = NULL; - uint32_t sz = sizeof(struct asm_dts_eagle_param) + (po ? 0 : size); - struct asm_dts_eagle_param *ad; - - if (!ac || ac->apr == NULL || (size == 0) || !data) { - pr_err("DTS_EAGLE_ASM - %s: APR handle NULL, invalid size %u or pointer %p.\n", - __func__, size, data); - return -EINVAL; - } - - ad = kzalloc(sz, GFP_KERNEL); - if (!ad) { - pr_err("DTS_EAGLE_ASM - %s: error allocating mem of size %u\n", - __func__, sz); - return -ENOMEM; - } - pr_debug("DTS_EAGLE_ASM - %s: ac %p param_id 0x%x size %u data %p m_id 0x%x\n", - __func__, ac, param_id, size, data, m_id); - q6asm_add_hdr_async(ac, &ad->hdr, sz, 1); - ad->hdr.opcode = ASM_STREAM_CMD_SET_PP_PARAMS_V2; - ad->param.data_payload_addr_lsw = 0; - ad->param.data_payload_addr_msw = 0; - - ad->param.mem_map_handle = 0; - ad->param.data_payload_size = size + - sizeof(struct asm_stream_param_data_v2); - ad->data.module_id = m_id; - ad->data.param_id = param_id; - ad->data.param_size = size; - ad->data.reserved = 0; - atomic_set(&ac->cmd_state, 1); - - if (po) { - struct list_head *ptr, *next; - struct asm_buffer_node *node; - pr_debug("DTS_EAGLE_ASM - %s: using out of band memory (virtual %p, physical %lu)\n", - __func__, po->kvaddr, (long)po->paddr); - ad->param.data_payload_addr_lsw = lower_32_bits(po->paddr); - ad->param.data_payload_addr_msw = upper_32_bits(po->paddr); - list_for_each_safe(ptr, next, &ac->port[IN].mem_map_handle) { - node = list_entry(ptr, struct asm_buffer_node, list); - if (node->buf_phys_addr == po->paddr) { - ad->param.mem_map_handle = node->mmap_hdl; - break; - } - } - if (ad->param.mem_map_handle == 0) { - pr_err("DTS_EAGLE_ASM - %s: mem map handle not found\n", - __func__); - rc = -EINVAL; - goto fail_cmd; - } - /* check for integer overflow */ - if (size > (UINT_MAX - APR_CMD_OB_HDR_SZ)) - rc = -EINVAL; - if ((rc < 0) || (size + APR_CMD_OB_HDR_SZ > po->size)) { - pr_err("DTS_EAGLE_ASM - %s: ion alloc of size %zu too small for size requested %u\n", - __func__, po->size, size + APR_CMD_OB_HDR_SZ); - rc = -EINVAL; - goto fail_cmd; - } - ob_params = (int *)po->kvaddr; - *ob_params++ = m_id; - *ob_params++ = param_id; - *ob_params++ = size; - memcpy(ob_params, data, size); - } else { - pr_debug("DTS_EAGLE_ASM - %s: using in band\n", __func__); - memcpy(((char *)ad) + sizeof(struct asm_dts_eagle_param), - data, size); - } - rc = apr_send_pkt(ac->apr, (uint32_t *)ad); - if (rc < 0) { - pr_err("DTS_EAGLE_ASM - %s: set-params send failed paramid[0x%x]\n", - __func__, ad->data.param_id); - rc = -EINVAL; - goto fail_cmd; - } - - rc = wait_event_timeout(ac->cmd_wait, - (atomic_read(&ac->cmd_state) <= 0), 1*HZ); - if (!rc) { - pr_err("DTS_EAGLE_ASM - %s: timeout, set-params paramid[0x%x]\n", - __func__, ad->data.param_id); - rc = -EINVAL; - goto fail_cmd; - } - rc = 0; -fail_cmd: - kfree(ad); - return rc; -} - -int q6asm_dts_eagle_get(struct audio_client *ac, int param_id, uint32_t size, - void *data, struct param_outband *po, int m_id) -{ - struct asm_dts_eagle_param_get *ad; - int rc = 0, *ob_params = NULL; - uint32_t sz = sizeof(struct asm_dts_eagle_param) + APR_CMD_GET_HDR_SZ + - (po ? 0 : size); - - if (!ac || ac->apr == NULL || (size == 0) || !data) { - pr_err("DTS_EAGLE_ASM - %s: APR handle NULL, invalid size %u or pointer %p\n", - __func__, size, data); - return -EINVAL; - } - ad = kzalloc(sz, GFP_KERNEL); - if (!ad) { - pr_err("DTS_EAGLE_ASM - %s: error allocating memory of size %u\n", - __func__, sz); - return -ENOMEM; - } - pr_debug("DTS_EAGLE_ASM - %s: ac %p param_id 0x%x size %u data %p m_id 0x%x\n", - __func__, ac, param_id, size, data, m_id); - q6asm_add_hdr(ac, &ad->hdr, sz, TRUE); - ad->hdr.opcode = ASM_STREAM_CMD_GET_PP_PARAMS_V2; - ad->param.data_payload_addr_lsw = 0; - ad->param.data_payload_addr_msw = 0; - ad->param.mem_map_handle = 0; - ad->param.module_id = m_id; - ad->param.param_id = param_id; - ad->param.param_max_size = size + APR_CMD_GET_HDR_SZ; - ad->param.reserved = 0; - atomic_set(&ac->cmd_state, 1); - - generic_get_data = kzalloc(size + sizeof(struct generic_get_data_), - GFP_KERNEL); - if (!generic_get_data) { - pr_err("DTS_EAGLE_ASM - %s: error allocating mem of size %u\n", - __func__, size); - rc = -ENOMEM; - goto fail_cmd; - } - - if (po) { - struct list_head *ptr, *next; - struct asm_buffer_node *node; - pr_debug("DTS_EAGLE_ASM - %s: using out of band memory (virtual %p, physical %lu)\n", - __func__, po->kvaddr, (long)po->paddr); - ad->param.data_payload_addr_lsw = lower_32_bits(po->paddr); - ad->param.data_payload_addr_msw = upper_32_bits(po->paddr); - list_for_each_safe(ptr, next, &ac->port[IN].mem_map_handle) { - node = list_entry(ptr, struct asm_buffer_node, list); - if (node->buf_phys_addr == po->paddr) { - ad->param.mem_map_handle = node->mmap_hdl; - break; - } - } - if (ad->param.mem_map_handle == 0) { - pr_err("DTS_EAGLE_ASM - %s: mem map handle not found\n", - __func__); - rc = -EINVAL; - goto fail_cmd; - } - /* check for integer overflow */ - if (size > (UINT_MAX - APR_CMD_OB_HDR_SZ)) - rc = -EINVAL; - if ((rc < 0) || (size + APR_CMD_OB_HDR_SZ > po->size)) { - pr_err("DTS_EAGLE_ASM - %s: ion alloc of size %zu too small for size requested %u\n", - __func__, po->size, size + APR_CMD_OB_HDR_SZ); - rc = -EINVAL; - goto fail_cmd; - } - ob_params = (int *)po->kvaddr; - *ob_params++ = m_id; - *ob_params++ = param_id; - *ob_params++ = size; - generic_get_data->is_inband = 0; - } else { - pr_debug("DTS_EAGLE_ASM - %s: using in band\n", __func__); - generic_get_data->is_inband = 1; - } - - rc = apr_send_pkt(ac->apr, (uint32_t *)ad); - if (rc < 0) { - pr_err("DTS_EAGLE_ASM - %s: Commmand 0x%x failed\n", __func__, - ad->hdr.opcode); - goto fail_cmd; - } - - rc = wait_event_timeout(ac->cmd_wait, - (atomic_read(&ac->cmd_state) <= 0), 1*HZ); - if (!rc) { - pr_err("DTS_EAGLE_ASM - %s: timeout in get\n", - __func__); - rc = -EINVAL; - goto fail_cmd; - } - - if (generic_get_data->valid) { - rc = 0; - memcpy(data, po ? ob_params : generic_get_data->ints, size); - } else { - rc = -EINVAL; - pr_err("DTS_EAGLE_ASM - %s: EAGLE get params problem getting data - check callback error value\n", - __func__); - } -fail_cmd: - kfree(ad); - kfree(generic_get_data); - generic_get_data = NULL; - return rc; -} - static int __q6asm_set_volume(struct audio_client *ac, int volume, int instance) { struct asm_volume_ctrl_master_gain vol; diff --git a/sound/soc/msm/qdsp6v2/q6core.c b/sound/soc/msm/qdsp6v2/q6core.c index e505089d1a7b4..ffcf21c7799e3 100644 --- a/sound/soc/msm/qdsp6v2/q6core.c +++ b/sound/soc/msm/qdsp6v2/q6core.c @@ -1,4 +1,4 @@ -/* Copyright (c) 2012-2014, The Linux Foundation. All rights reserved. +/* Copyright (c) 2012-2014, 2017 The Linux Foundation. All rights reserved. * * This program is free software; you can redistribute it and/or modify * it under the terms of the GNU General Public License version 2 and @@ -162,7 +162,7 @@ static int32_t aprv2_core_fn_q(struct apr_client_data *data, void *priv) generic_get_data->valid = 1; generic_get_data->size_in_ints = data->payload_size/sizeof(int); - pr_debug("DTS_EAGLE_CORE callback size = %i\n", + pr_debug("callback size = %i\n", data->payload_size); memcpy(generic_get_data->ints, data->payload, data->payload_size); @@ -334,115 +334,6 @@ int32_t core_get_license_status(uint32_t module_id) return ret; } -int core_dts_eagle_set(int size, char *data) -{ - struct adsp_dts_eagle *payload = NULL; - int rc = 0, size_aligned4byte; - - pr_debug("DTS_EAGLE_CORE - %s\n", __func__); - if (size <= 0 || !data) { - pr_err("DTS_EAGLE_CORE - %s: invalid size %i or pointer %p.\n", - __func__, size, data); - return -EINVAL; - } - - size_aligned4byte = (size+3) & 0xFFFFFFFC; - ocm_core_open(); - if (q6core_lcl.core_handle_q) { - payload = kzalloc(sizeof(struct adsp_dts_eagle) + - size_aligned4byte, GFP_KERNEL); - if (!payload) { - pr_err("DTS_EAGLE_CORE - %s: out of memory (aligned size %i).\n", - __func__, size_aligned4byte); - return -ENOMEM; - } - payload->hdr.hdr_field = APR_HDR_FIELD(APR_MSG_TYPE_EVENT, - APR_HDR_LEN(APR_HDR_SIZE), - APR_PKT_VER); - payload->hdr.pkt_size = sizeof(struct adsp_dts_eagle) + - size_aligned4byte; - payload->hdr.src_port = 0; - payload->hdr.dest_port = 0; - payload->hdr.token = 0; - payload->hdr.opcode = ADSP_CMD_SET_DTS_EAGLE_DATA_ID; - payload->id = DTS_EAGLE_LICENSE_ID; - payload->overwrite = 1; - payload->size = size; - memcpy(payload->data, data, size); - rc = apr_send_pkt(q6core_lcl.core_handle_q, - (uint32_t *)payload); - if (rc < 0) { - pr_err("DTS_EAGLE_CORE - %s: failed op[0x%x]rc[%d]\n", - __func__, payload->hdr.opcode, rc); - } - kfree(payload); - } - return rc; -} - -int core_dts_eagle_get(int id, int size, char *data) -{ - struct apr_hdr ah; - int rc = 0; - - pr_debug("DTS_EAGLE_CORE - %s\n", __func__); - if (size <= 0 || !data) { - pr_err("DTS_EAGLE_CORE - %s: invalid size %i or pointer %p.\n", - __func__, size, data); - return -EINVAL; - } - ocm_core_open(); - if (q6core_lcl.core_handle_q) { - ah.hdr_field = APR_HDR_FIELD(APR_MSG_TYPE_EVENT, - APR_HDR_LEN(APR_HDR_SIZE), APR_PKT_VER); - ah.pkt_size = sizeof(struct apr_hdr); - ah.src_port = 0; - ah.dest_port = 0; - ah.token = 0; - ah.opcode = id; - - q6core_lcl.bus_bw_resp_received = 0; - generic_get_data = kzalloc(sizeof(struct generic_get_data_) - + size, GFP_KERNEL); - if (!generic_get_data) { - pr_err("DTS_EAGLE_CORE - %s: error allocating memory of size %i\n", - __func__, size); - return -ENOMEM; - } - - rc = apr_send_pkt(q6core_lcl.core_handle_q, - (uint32_t *)&ah); - if (rc < 0) { - pr_err("DTS_EAGLE_CORE - %s: failed op[0x%x]rc[%d]\n", - __func__, ah.opcode, rc); - goto fail_cmd_2; - } - - rc = wait_event_timeout(q6core_lcl.bus_bw_req_wait, - (q6core_lcl.bus_bw_resp_received == 1), - msecs_to_jiffies(TIMEOUT_MS)); - if (!rc) { - pr_err("DTS_EAGLE_CORE - %s: EAGLE get params timed out\n", - __func__); - rc = -EINVAL; - goto fail_cmd_2; - } - if (generic_get_data->valid) { - rc = 0; - memcpy(data, generic_get_data->ints, size); - } else { - rc = -EINVAL; - pr_err("DTS_EAGLE_CORE - %s: EAGLE get params problem getting data - check callback error value\n", - __func__); - } - } - -fail_cmd_2: - kfree(generic_get_data); - generic_get_data = NULL; - return rc; -} - uint32_t core_set_dolby_manufacturer_id(int manufacturer_id) { struct adsp_dolby_manufacturer_id payload; From bf28ea900d6d013c74cbac93c1cfb7b9368b71ec Mon Sep 17 00:00:00 2001 From: Prasad Malisetty Date: Tue, 11 Apr 2017 23:03:43 +0530 Subject: [PATCH 05/41] mhi: core: remove unused dbgfs function Remove unused debug function that trigger MSI Change-Id: Ib747e579c732ece892f8695f2fdfbf107012c9c8 CRs-Fixed: 1116611 Signed-off-by: Prasad Malisetty --- drivers/platform/msm/mhi/mhi_sys.c | 28 +--------------------------- 1 file changed, 1 insertion(+), 27 deletions(-) diff --git a/drivers/platform/msm/mhi/mhi_sys.c b/drivers/platform/msm/mhi/mhi_sys.c index 07cd5f8b03c67..231c70b7905ff 100644 --- a/drivers/platform/msm/mhi/mhi_sys.c +++ b/drivers/platform/msm/mhi/mhi_sys.c @@ -1,4 +1,4 @@ -/* Copyright (c) 2014, The Linux Foundation. All rights reserved. +/* Copyright (c) 2014-2017, The Linux Foundation. All rights reserved. * * This program is free software; you can redistribute it and/or modify * it under the terms of the GNU General Public License version 2 and @@ -187,22 +187,6 @@ static const struct file_operations mhi_dbgfs_ev_fops = { .write = NULL, }; -static ssize_t mhi_dbgfs_trigger_msi(struct file *fp, const char __user *buf, - size_t count, loff_t *offp) -{ - u32 msi_nr = 0; - void *irq_ctxt = &((mhi_devices.device_list[0]).pcie_device->dev); - if (copy_from_user(&msi_nr, buf, sizeof(msi_nr))) - return -ENOMEM; - mhi_msi_handlr(msi_nr, irq_ctxt); - return 0; -} - -static const struct file_operations mhi_dbgfs_trigger_msi_fops = { - .read = NULL, - .write = mhi_dbgfs_trigger_msi, -}; - static ssize_t mhi_dbgfs_state_read(struct file *fp, char __user *buf, size_t count, loff_t *offp) { @@ -311,7 +295,6 @@ int mhi_init_debugfs(struct mhi_device_ctxt *mhi_dev_ctxt) { struct dentry *mhi_chan_stats; struct dentry *mhi_state_stats; - struct dentry *mhi_msi_trigger; struct dentry *mhi_ev_stats; mhi_dev_ctxt->mhi_parent_folder = debugfs_create_dir("mhi", NULL); @@ -340,21 +323,12 @@ int mhi_init_debugfs(struct mhi_device_ctxt *mhi_dev_ctxt) &mhi_dbgfs_state_fops); if (mhi_state_stats == NULL) goto clean_ev_stats; - mhi_msi_trigger = debugfs_create_file("mhi_msi_trigger", - 0444, - mhi_dev_ctxt->mhi_parent_folder, - mhi_dev_ctxt, - &mhi_dbgfs_trigger_msi_fops); - if (mhi_msi_trigger == NULL) - goto clean_state; mhi_dev_ctxt->chan_info = kmalloc(MHI_LOG_SIZE, GFP_KERNEL); if (mhi_dev_ctxt->chan_info == NULL) goto clean_all; return 0; clean_all: - debugfs_remove(mhi_msi_trigger); -clean_state: debugfs_remove(mhi_state_stats); clean_ev_stats: debugfs_remove(mhi_ev_stats); From c4402887cd091c255830709a6ca9ff98a68ba893 Mon Sep 17 00:00:00 2001 From: Zhen Kong Date: Fri, 24 Apr 2015 13:29:40 -0700 Subject: [PATCH 06/41] qseecom: change _qseecom_send_cmd errno if app is not found To notify client that tz app is not found, change _qseecom_send_cmd return errno to -ENOENT if app is not found. Besides, save app name in kernel client handle if that app exists or is loaded for the first time. Change-Id: Ib8da680601bcc823401403299b84889593db715b Signed-off-by: Zhen Kong --- drivers/misc/qseecom.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/drivers/misc/qseecom.c b/drivers/misc/qseecom.c index 931235bdf885d..07214d4eaef20 100644 --- a/drivers/misc/qseecom.c +++ b/drivers/misc/qseecom.c @@ -2190,7 +2190,7 @@ static int __qseecom_send_cmd(struct qseecom_dev_handle *data, if (!found_app) { pr_err("app_id %d (%s) is not found\n", data->client.app_id, (char *)data->client.app_name); - return -EINVAL; + return -ENOENT; } if (qseecom.whitelist_support == false || data->use_legacy_cmd == true) @@ -3066,6 +3066,8 @@ int qseecom_start_app(struct qseecom_handle **handle, if (ret < 0) goto err; + data->client.app_id = ret; + strlcpy(data->client.app_name, app_name, MAX_APP_NAME_SIZE); if (ret > 0) { pr_warn("App id %d for [%s] app exists\n", ret, (char *)app_ireq.app_name); @@ -3090,8 +3092,6 @@ int qseecom_start_app(struct qseecom_handle **handle, ret = __qseecom_load_fw(data, app_name); if (ret < 0) goto err; - data->client.app_id = ret; - strlcpy(data->client.app_name, app_name, MAX_APP_NAME_SIZE); } data->client.app_id = ret; if (!found_app) { From a6a15c75ceb3ae6e695e7fb4ec4d0ef78b1027a7 Mon Sep 17 00:00:00 2001 From: VijayaKumar T M Date: Tue, 18 Apr 2017 13:27:14 +0530 Subject: [PATCH 07/41] msm: camera: sensor: Add boundary check for cci master Add boundary check for cci master in i2c_read. This value is passed from userpsace. If user sends an invalid number for master there is a possibility of accessing unintended buffer. This change addresses the issue. CRs-Fixed: 1086764 Signed-off-by: Rajesh Bondugula Signed-off-by: VijayaKumar T M Change-Id: Ice3bde902aea96382ceb4dfddfd28a5ea89c183d --- drivers/media/platform/msm/camera_v2/sensor/cci/msm_cci.c | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/drivers/media/platform/msm/camera_v2/sensor/cci/msm_cci.c b/drivers/media/platform/msm/camera_v2/sensor/cci/msm_cci.c index 5e51a0f0b5755..aee8d9c48d709 100644 --- a/drivers/media/platform/msm/camera_v2/sensor/cci/msm_cci.c +++ b/drivers/media/platform/msm/camera_v2/sensor/cci/msm_cci.c @@ -358,10 +358,17 @@ static int32_t msm_cci_i2c_read(struct v4l2_subdev *sd, enum cci_i2c_queue_t queue = QUEUE_1; struct cci_device *cci_dev = NULL; struct msm_camera_cci_i2c_read_cfg *read_cfg = NULL; + CDBG("%s line %d\n", __func__, __LINE__); cci_dev = v4l2_get_subdevdata(sd); master = c_ctrl->cci_info->cci_i2c_master; read_cfg = &c_ctrl->cfg.cci_i2c_read_cfg; + if (master >= MASTER_MAX || master < 0) { + pr_err("%s:%d Invalid I2C master %d\n", + __func__, __LINE__, master); + return -EINVAL; + } + mutex_lock(&cci_dev->cci_master_info[master].mutex); /* From 3bf0a6db12d454145e55e272d4b9b75740060f3c Mon Sep 17 00:00:00 2001 From: Utkarsh Saxena Date: Mon, 3 Apr 2017 13:21:58 +0530 Subject: [PATCH 08/41] msm: ipa: Fix memory leak in ipa driver Free the memory pointed by msg pointer if copy_to_user fails. Change-Id: I628e089d844a3e1818a1a550e77ac10f33640ac9 Acked-by: Mohammed Javid Signed-off-by: Utkarsh Saxena --- drivers/platform/msm/ipa/ipa_intf.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/drivers/platform/msm/ipa/ipa_intf.c b/drivers/platform/msm/ipa/ipa_intf.c index 63adbfa3b5a72..60ff79f545cc6 100644 --- a/drivers/platform/msm/ipa/ipa_intf.c +++ b/drivers/platform/msm/ipa/ipa_intf.c @@ -538,6 +538,8 @@ ssize_t ipa_read(struct file *filp, char __user *buf, size_t count, mutex_unlock(&ipa_ctx->msg_lock); if (copy_to_user(buf, &msg->meta, sizeof(struct ipa_msg_meta))) { + kfree(msg); + msg = NULL; ret = -EFAULT; break; } @@ -546,6 +548,8 @@ ssize_t ipa_read(struct file *filp, char __user *buf, size_t count, if (msg->buff) { if (copy_to_user(buf, msg->buff, msg->meta.msg_len)) { + kfree(msg); + msg = NULL; ret = -EFAULT; break; } From 3021a732518af9f3e0dd1e3b0a5f963227576f5c Mon Sep 17 00:00:00 2001 From: Sudarshan Rajagopalan Date: Thu, 6 Apr 2017 16:15:48 -0700 Subject: [PATCH 09/41] ashmem: remove cache maintenance support The cache maintenance routines in ashmem were causing several security issues. Since they are not being used anymore by any drivers, its well to remove them entirely. CRs-Fixed: 1107034, 2001129, 2007786 Change-Id: I955e33d90b888d58db5cf6bb490905283374425b Signed-off-by: Sudarshan Rajagopalan --- drivers/staging/android/ashmem.c | 41 -------------------------------- include/uapi/linux/ashmem.h | 3 --- 2 files changed, 44 deletions(-) diff --git a/drivers/staging/android/ashmem.c b/drivers/staging/android/ashmem.c index ee79ac8d90d64..f13aab21da4a2 100644 --- a/drivers/staging/android/ashmem.c +++ b/drivers/staging/android/ashmem.c @@ -32,7 +32,6 @@ #include #include #include -#include #include "ashmem.h" @@ -659,37 +658,6 @@ static int ashmem_pin_unpin(struct ashmem_area *asma, unsigned long cmd, return ret; } -static int ashmem_cache_op(struct ashmem_area *asma, - void (*cache_func)(const void *vstart, const void *vend)) -{ - int ret = 0; - struct vm_area_struct *vma; - if (!asma->vm_start) - return -EINVAL; - - down_read(¤t->mm->mmap_sem); - vma = find_vma(current->mm, asma->vm_start); - if (!vma) { - ret = -EINVAL; - goto done; - } - if (vma->vm_file != asma->file) { - ret = -EINVAL; - goto done; - } - if ((asma->vm_start + asma->size) > vma->vm_end) { - ret = -EINVAL; - goto done; - } - cache_func((void *)asma->vm_start, - (void *)(asma->vm_start + asma->size)); -done: - up_read(¤t->mm->mmap_sem); - if (ret) - asma->vm_start = 0; - return ret; -} - static long ashmem_ioctl(struct file *file, unsigned int cmd, unsigned long arg) { struct ashmem_area *asma = file->private_data; @@ -735,15 +703,6 @@ static long ashmem_ioctl(struct file *file, unsigned int cmd, unsigned long arg) ashmem_shrink(&ashmem_shrinker, &sc); } break; - case ASHMEM_CACHE_FLUSH_RANGE: - ret = ashmem_cache_op(asma, &dmac_flush_range); - break; - case ASHMEM_CACHE_CLEAN_RANGE: - ret = ashmem_cache_op(asma, &dmac_clean_range); - break; - case ASHMEM_CACHE_INV_RANGE: - ret = ashmem_cache_op(asma, &dmac_inv_range); - break; } return ret; diff --git a/include/uapi/linux/ashmem.h b/include/uapi/linux/ashmem.h index 7ec977f432a67..7797439756c13 100644 --- a/include/uapi/linux/ashmem.h +++ b/include/uapi/linux/ashmem.h @@ -34,8 +34,5 @@ struct ashmem_pin { #define ASHMEM_UNPIN _IOW(__ASHMEMIOC, 8, struct ashmem_pin) #define ASHMEM_GET_PIN_STATUS _IO(__ASHMEMIOC, 9) #define ASHMEM_PURGE_ALL_CACHES _IO(__ASHMEMIOC, 10) -#define ASHMEM_CACHE_FLUSH_RANGE _IO(__ASHMEMIOC, 11) -#define ASHMEM_CACHE_CLEAN_RANGE _IO(__ASHMEMIOC, 12) -#define ASHMEM_CACHE_INV_RANGE _IO(__ASHMEMIOC, 13) #endif /* _UAPI_LINUX_ASHMEM_H */ From 178b8e49b8be62c46a023cfc0cbde3c945ea4926 Mon Sep 17 00:00:00 2001 From: Divya Ojha Date: Thu, 30 Mar 2017 10:25:15 +0530 Subject: [PATCH 10/41] drivers: qcom: ultrasound: check concurrent device open operations Make opened device count atomic variable to avoid probable race condition. Race condition leads to memory leak and list corruption. Change-Id: I4da98f27d36f616bc8fa7b1a848c20cc7eea04e5 Signed-off-by: Divya Ojha --- drivers/misc/qcom/qdsp6v2/ultrasound/usf.c | 13 +++++-------- 1 file changed, 5 insertions(+), 8 deletions(-) diff --git a/drivers/misc/qcom/qdsp6v2/ultrasound/usf.c b/drivers/misc/qcom/qdsp6v2/ultrasound/usf.c index 9270dbcbb1e97..454d11a5b177b 100644 --- a/drivers/misc/qcom/qdsp6v2/ultrasound/usf.c +++ b/drivers/misc/qcom/qdsp6v2/ultrasound/usf.c @@ -1,4 +1,4 @@ -/* Copyright (c) 2011-2014, The Linux Foundation. All rights reserved. +/* Copyright (c) 2011-2017, The Linux Foundation. All rights reserved. * * This program is free software; you can redistribute it and/or modify * it under the terms of the GNU General Public License version 2 and @@ -172,7 +172,7 @@ static const int s_button_map[] = { }; /* The opened devices container */ -static int s_opened_devs[MAX_DEVS_NUMBER]; +static atomic_t s_opened_devs[MAX_DEVS_NUMBER]; #define USF_NAME_PREFIX "usf_" #define USF_NAME_PREFIX_SIZE 4 @@ -2297,14 +2297,11 @@ static uint16_t add_opened_dev(int minor) uint16_t ind = 0; for (ind = 0; ind < MAX_DEVS_NUMBER; ++ind) { - if (minor == s_opened_devs[ind]) { + if (minor == atomic_cmpxchg(&s_opened_devs[ind], 0, minor)) { pr_err("%s: device %d is already opened\n", __func__, minor); return USF_UNDEF_DEV_ID; - } - - if (s_opened_devs[ind] == 0) { - s_opened_devs[ind] = minor; + } else { pr_debug("%s: device %d is added; ind=%d\n", __func__, minor, ind); return ind; @@ -2359,7 +2356,7 @@ static int usf_release(struct inode *inode, struct file *file) usf_disable(&usf->usf_tx); usf_disable(&usf->usf_rx); - s_opened_devs[usf->dev_ind] = 0; + atomic_set(&s_opened_devs[usf->dev_ind], 0); mutex_unlock(&usf->mutex); mutex_destroy(&usf->mutex); From 7b9bab87762948ce143c2fef137be84aead0eefc Mon Sep 17 00:00:00 2001 From: AnilKumar Chimata Date: Mon, 13 Mar 2017 16:13:47 +0530 Subject: [PATCH 11/41] crypto: msm: Fix buffer overflow issue In multi-threaded environment diglen variable could be modified by multiple threads at the same time. Buffer overflow might happen in current thread if another thread changes the diglen variable. So add mutex locks to avoid this issue. Change-Id: I62c63c55c028dedb1dd0eec862851bd8e818a5d3 Signed-off-by: AnilKumar Chimata --- drivers/crypto/msm/qcedev.c | 51 +++++++++++++++++++++++++++++-------- 1 file changed, 41 insertions(+), 10 deletions(-) diff --git a/drivers/crypto/msm/qcedev.c b/drivers/crypto/msm/qcedev.c index f72bddeb56ba5..dac6ddec7e2b8 100644 --- a/drivers/crypto/msm/qcedev.c +++ b/drivers/crypto/msm/qcedev.c @@ -61,6 +61,7 @@ static uint8_t _std_init_vector_sha256_uint8[] = { static DEFINE_MUTEX(send_cmd_lock); static DEFINE_MUTEX(qcedev_sent_bw_req); +static DEFINE_MUTEX(hash_access_lock); static void qcedev_ce_high_bw_req(struct qcedev_control *podev, bool high_bw_req) @@ -1649,12 +1650,18 @@ long qcedev_ioctl(struct file *file, unsigned cmd, unsigned long arg) (void __user *)arg, sizeof(struct qcedev_sha_op_req))) return -EFAULT; - if (qcedev_check_sha_params(&qcedev_areq.sha_op_req, podev)) + mutex_lock(&hash_access_lock); + if (qcedev_check_sha_params(&qcedev_areq.sha_op_req, podev)) { + mutex_unlock(&hash_access_lock); return -EINVAL; + } qcedev_areq.op_type = QCEDEV_CRYPTO_OPER_SHA; err = qcedev_hash_init(&qcedev_areq, handle, &sg_src); - if (err) + if (err) { + mutex_unlock(&hash_access_lock); return err; + } + mutex_unlock(&hash_access_lock); if (copy_to_user((void __user *)arg, &qcedev_areq.sha_op_req, sizeof(struct qcedev_sha_op_req))) return -EFAULT; @@ -1672,32 +1679,42 @@ long qcedev_ioctl(struct file *file, unsigned cmd, unsigned long arg) (void __user *)arg, sizeof(struct qcedev_sha_op_req))) return -EFAULT; - if (qcedev_check_sha_params(&qcedev_areq.sha_op_req, podev)) + mutex_lock(&hash_access_lock); + if (qcedev_check_sha_params(&qcedev_areq.sha_op_req, podev)) { + mutex_unlock(&hash_access_lock); return -EINVAL; + } qcedev_areq.op_type = QCEDEV_CRYPTO_OPER_SHA; if (qcedev_areq.sha_op_req.alg == QCEDEV_ALG_AES_CMAC) { err = qcedev_hash_cmac(&qcedev_areq, handle, &sg_src); - if (err) + if (err) { + mutex_unlock(&hash_access_lock); return err; + } } else { if (handle->sha_ctxt.init_done == false) { pr_err("%s Init was not called\n", __func__); + mutex_unlock(&hash_access_lock); return -EINVAL; } err = qcedev_hash_update(&qcedev_areq, handle, &sg_src); - if (err) + if (err) { + mutex_unlock(&hash_access_lock); return err; + } } if (handle->sha_ctxt.diglen > QCEDEV_MAX_SHA_DIGEST) { pr_err("Invalid sha_ctxt.diglen %d\n", handle->sha_ctxt.diglen); + mutex_unlock(&hash_access_lock); return -EINVAL; } memcpy(&qcedev_areq.sha_op_req.digest[0], &handle->sha_ctxt.digest[0], handle->sha_ctxt.diglen); + mutex_unlock(&hash_access_lock); if (copy_to_user((void __user *)arg, &qcedev_areq.sha_op_req, sizeof(struct qcedev_sha_op_req))) return -EFAULT; @@ -1714,16 +1731,22 @@ long qcedev_ioctl(struct file *file, unsigned cmd, unsigned long arg) (void __user *)arg, sizeof(struct qcedev_sha_op_req))) return -EFAULT; - if (qcedev_check_sha_params(&qcedev_areq.sha_op_req, podev)) + mutex_lock(&hash_access_lock); + if (qcedev_check_sha_params(&qcedev_areq.sha_op_req, podev)) { + mutex_unlock(&hash_access_lock); return -EINVAL; + } qcedev_areq.op_type = QCEDEV_CRYPTO_OPER_SHA; err = qcedev_hash_final(&qcedev_areq, handle); - if (err) + if (err) { + mutex_unlock(&hash_access_lock); return err; + } qcedev_areq.sha_op_req.diglen = handle->sha_ctxt.diglen; memcpy(&qcedev_areq.sha_op_req.digest[0], &handle->sha_ctxt.digest[0], handle->sha_ctxt.diglen); + mutex_unlock(&hash_access_lock); if (copy_to_user((void __user *)arg, &qcedev_areq.sha_op_req, sizeof(struct qcedev_sha_op_req))) return -EFAULT; @@ -1738,20 +1761,28 @@ long qcedev_ioctl(struct file *file, unsigned cmd, unsigned long arg) (void __user *)arg, sizeof(struct qcedev_sha_op_req))) return -EFAULT; - if (qcedev_check_sha_params(&qcedev_areq.sha_op_req, podev)) + mutex_lock(&hash_access_lock); + if (qcedev_check_sha_params(&qcedev_areq.sha_op_req, podev)) { + mutex_unlock(&hash_access_lock); return -EINVAL; + } qcedev_areq.op_type = QCEDEV_CRYPTO_OPER_SHA; qcedev_hash_init(&qcedev_areq, handle, &sg_src); err = qcedev_hash_update(&qcedev_areq, handle, &sg_src); - if (err) + if (err) { + mutex_unlock(&hash_access_lock); return err; + } err = qcedev_hash_final(&qcedev_areq, handle); - if (err) + if (err) { + mutex_unlock(&hash_access_lock); return err; + } qcedev_areq.sha_op_req.diglen = handle->sha_ctxt.diglen; memcpy(&qcedev_areq.sha_op_req.digest[0], &handle->sha_ctxt.digest[0], handle->sha_ctxt.diglen); + mutex_unlock(&hash_access_lock); if (copy_to_user((void __user *)arg, &qcedev_areq.sha_op_req, sizeof(struct qcedev_sha_op_req))) return -EFAULT; From f6107ad55b7216456dfc8acb3eefaea61f1452e5 Mon Sep 17 00:00:00 2001 From: Satya Durga Srinivasu Prabhala Date: Tue, 4 Apr 2017 13:07:03 -0700 Subject: [PATCH 12/41] soc: qcom: remove debugfs interface from ssr As debugfs interface is intended to test the respective ssr, remove from the driver to make sure it won't be available by default. CRs-Fixed: 2025661 Change-Id: I6af9a8333c8028611f889cc2f9b0beb37ef12c9b Signed-off-by: Satya Durga Srinivasu Prabhala --- drivers/soc/qcom/subsystem_restart.c | 101 +-------------------------- include/soc/qcom/subsystem_restart.h | 3 +- 2 files changed, 4 insertions(+), 100 deletions(-) diff --git a/drivers/soc/qcom/subsystem_restart.c b/drivers/soc/qcom/subsystem_restart.c index 6470c04068330..3ce8a955c279a 100644 --- a/drivers/soc/qcom/subsystem_restart.c +++ b/drivers/soc/qcom/subsystem_restart.c @@ -29,7 +29,6 @@ #include #include #include -#include #include #include #include @@ -142,7 +141,6 @@ struct restart_log { * @restart_level: restart level (0 - panic, 1 - related, 2 - independent, etc.) * @restart_order: order of other devices this devices restarts with * @crash_count: number of times the device has crashed - * @dentry: debugfs directory for this device * @do_ramdump_on_put: ramdump on subsystem_put() if true * @err_ready: completion variable to record error ready from subsystem * @crashed: indicates if subsystem has crashed @@ -164,9 +162,6 @@ struct subsys_device { int restart_level; int crash_count; struct subsys_soc_restart_order *restart_order; -#ifdef CONFIG_DEBUG_FS - struct dentry *dentry; -#endif bool do_ramdump_on_put; struct cdev char_dev; dev_t dev_no; @@ -340,10 +335,11 @@ static struct device_attribute subsys_attrs[] = { __ATTR_NULL, }; -static struct bus_type subsys_bus_type = { +struct bus_type subsys_bus_type = { .name = "msm_subsys", .dev_attrs = subsys_attrs, }; +EXPORT_SYMBOL(subsys_bus_type); static DEFINE_IDA(subsys_ida); @@ -1064,87 +1060,6 @@ void notify_proxy_unvote(struct device *device) notify_each_subsys_device(&dev, 1, SUBSYS_PROXY_UNVOTE, NULL); } -#ifdef CONFIG_DEBUG_FS -static ssize_t subsys_debugfs_read(struct file *filp, char __user *ubuf, - size_t cnt, loff_t *ppos) -{ - int r; - char buf[40]; - struct subsys_device *subsys = filp->private_data; - - r = snprintf(buf, sizeof(buf), "%d\n", subsys->count); - return simple_read_from_buffer(ubuf, cnt, ppos, buf, r); -} - -static ssize_t subsys_debugfs_write(struct file *filp, - const char __user *ubuf, size_t cnt, loff_t *ppos) -{ - struct subsys_device *subsys = filp->private_data; - char buf[10]; - char *cmp; - - cnt = min(cnt, sizeof(buf) - 1); - if (copy_from_user(&buf, ubuf, cnt)) - return -EFAULT; - buf[cnt] = '\0'; - cmp = strstrip(buf); - - if (!strcmp(cmp, "restart")) { - if (subsystem_restart_dev(subsys)) - return -EIO; - } else if (!strcmp(cmp, "get")) { - if (subsystem_get(subsys->desc->name)) - return -EIO; - } else if (!strcmp(cmp, "put")) { - subsystem_put(subsys); - } else { - return -EINVAL; - } - - return cnt; -} - -static const struct file_operations subsys_debugfs_fops = { - .open = simple_open, - .read = subsys_debugfs_read, - .write = subsys_debugfs_write, -}; - -static struct dentry *subsys_base_dir; - -static int __init subsys_debugfs_init(void) -{ - subsys_base_dir = debugfs_create_dir("msm_subsys", NULL); - return !subsys_base_dir ? -ENOMEM : 0; -} - -static void subsys_debugfs_exit(void) -{ - debugfs_remove_recursive(subsys_base_dir); -} - -static int subsys_debugfs_add(struct subsys_device *subsys) -{ - if (!subsys_base_dir) - return -ENOMEM; - - subsys->dentry = debugfs_create_file(subsys->desc->name, - S_IRUGO | S_IWUSR, subsys_base_dir, - subsys, &subsys_debugfs_fops); - return !subsys->dentry ? -ENOMEM : 0; -} - -static void subsys_debugfs_remove(struct subsys_device *subsys) -{ - debugfs_remove(subsys->dentry); -} -#else -static int __init subsys_debugfs_init(void) { return 0; }; -static void subsys_debugfs_exit(void) { } -static int subsys_debugfs_add(struct subsys_device *subsys) { return 0; } -static void subsys_debugfs_remove(struct subsys_device *subsys) { } -#endif - static int subsys_device_open(struct inode *inode, struct file *file) { struct subsys_device *device, *subsys_dev = 0; @@ -1554,10 +1469,6 @@ struct subsys_device *subsys_register(struct subsys_desc *desc) mutex_init(&subsys->track.lock); - ret = subsys_debugfs_add(subsys); - if (ret) - goto err_debugfs; - ret = device_register(&subsys->dev); if (ret) { device_unregister(&subsys->dev); @@ -1609,8 +1520,6 @@ struct subsys_device *subsys_register(struct subsys_desc *desc) if (ofnode) subsys_remove_restart_order(ofnode); err_register: - subsys_debugfs_remove(subsys); -err_debugfs: mutex_destroy(&subsys->track.lock); ida_simple_remove(&subsys_ida, subsys->id); err_ida: @@ -1643,7 +1552,6 @@ void subsys_unregister(struct subsys_device *subsys) WARN_ON(subsys->count); device_unregister(&subsys->dev); mutex_unlock(&subsys->track.lock); - subsys_debugfs_remove(subsys); subsys_char_device_remove(subsys); sysmon_notifier_unregister(subsys->desc); put_device(&subsys->dev); @@ -1681,9 +1589,6 @@ static int __init subsys_restart_init(void) ret = bus_register(&subsys_bus_type); if (ret) goto err_bus; - ret = subsys_debugfs_init(); - if (ret) - goto err_debugfs; char_class = class_create(THIS_MODULE, "subsys"); if (IS_ERR(char_class)) { @@ -1702,8 +1607,6 @@ static int __init subsys_restart_init(void) err_soc: class_destroy(char_class); err_class: - subsys_debugfs_exit(); -err_debugfs: bus_unregister(&subsys_bus_type); err_bus: destroy_workqueue(ssr_wq); diff --git a/include/soc/qcom/subsystem_restart.h b/include/soc/qcom/subsystem_restart.h index 408077df7b559..7875fc3003e51 100644 --- a/include/soc/qcom/subsystem_restart.h +++ b/include/soc/qcom/subsystem_restart.h @@ -1,4 +1,4 @@ -/* Copyright (c) 2014-2015, The Linux Foundation. All rights reserved. +/* Copyright (c) 2014-2015, 2017, The Linux Foundation. All rights reserved. * * This program is free software; you can redistribute it and/or modify * it under the terms of the GNU General Public License version 2 and @@ -18,6 +18,7 @@ #include struct subsys_device; +extern struct bus_type subsys_bus_type; enum { RESET_SOC = 0, From b2df81b1c67c3bf0981c93b13798c86a379dcbb3 Mon Sep 17 00:00:00 2001 From: Harsh Sahu Date: Thu, 13 Apr 2017 15:38:46 -0700 Subject: [PATCH 13/41] msm: mdss: fix race condition during mdp debugfs release Fix race condition in the release of the mdp debugfs functions panel_debug_base_release and mdss_debug_base_release by adding the lock for unpreempted freeing of the buffer so that multiple concurrent processes cannot affect the release which can possibly lead to use-after-free operation on the buffer. Change-Id: I9586081b65ae2eb0e7f6e30c606ee748ae9ef7e8 Signed-off-by: Harsh Sahu --- drivers/video/msm/mdss/mdss_debug.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/drivers/video/msm/mdss/mdss_debug.c b/drivers/video/msm/mdss/mdss_debug.c index 611a0954527dc..a4c5361f5090b 100644 --- a/drivers/video/msm/mdss/mdss_debug.c +++ b/drivers/video/msm/mdss/mdss_debug.c @@ -56,11 +56,13 @@ static int panel_debug_base_open(struct inode *inode, struct file *file) static int panel_debug_base_release(struct inode *inode, struct file *file) { struct mdss_debug_base *dbg = file->private_data; + mutex_lock(&mdss_debug_lock); if (dbg && dbg->buf) { kfree(dbg->buf); dbg->buf_len = 0; dbg->buf = NULL; } + mutex_unlock(&mdss_debug_lock); return 0; } @@ -370,11 +372,13 @@ static int mdss_debug_base_open(struct inode *inode, struct file *file) static int mdss_debug_base_release(struct inode *inode, struct file *file) { struct mdss_debug_base *dbg = file->private_data; + mutex_lock(&mdss_debug_lock); if (dbg && dbg->buf) { kfree(dbg->buf); dbg->buf_len = 0; dbg->buf = NULL; } + mutex_unlock(&mdss_debug_lock); return 0; } From 38f7101cd337f5c1ae1446cfcdc5fa8e6c5d6df5 Mon Sep 17 00:00:00 2001 From: Sarada Prasanna Garnayak Date: Mon, 17 Apr 2017 14:29:57 +0530 Subject: [PATCH 14/41] wcnss: fix the potential memory leak and heap overflow The wcnss platform driver update the wlan calibration data by the user space wlan daemon. The wlan user space daemon store the updated wlan calibration data reported by wlan firmware in user space and write it back to the wcnss platform calibration data buffer for the calibration data download and update. During the wlan calibration data store and retrieve operation there are some potential race condition which leads to memory leak and buffer overflow during the context switch. Fix the above issue by adding protection code and avoid usage of global pointer during the device file read and write operation. CRs-Fixed: 2015858 Change-Id: Ib5b57eb86dcb4e6ed799b5222d06396eaabfaad3 Signed-off-by: Sarada Prasanna Garnayak --- drivers/net/wireless/wcnss/wcnss_wlan.c | 89 +++++++++++++++---------- 1 file changed, 52 insertions(+), 37 deletions(-) diff --git a/drivers/net/wireless/wcnss/wcnss_wlan.c b/drivers/net/wireless/wcnss/wcnss_wlan.c index a097fdf593798..4c721d0b2eee4 100644 --- a/drivers/net/wireless/wcnss/wcnss_wlan.c +++ b/drivers/net/wireless/wcnss/wcnss_wlan.c @@ -1,4 +1,4 @@ -/* Copyright (c) 2011-2015, The Linux Foundation. All rights reserved. +/* Copyright (c) 2011-2015, 2017, The Linux Foundation. All rights reserved. * * This program is free software; you can redistribute it and/or modify * it under the terms of the GNU General Public License version 2 and @@ -408,7 +408,6 @@ static struct { int user_cal_available; u32 user_cal_rcvd; int user_cal_exp_size; - int device_opened; int iris_xo_mode_set; int fw_vbatt_state; char wlan_nv_macAddr[WLAN_MAC_ADDR_SIZE]; @@ -3010,14 +3009,6 @@ static int wcnss_node_open(struct inode *inode, struct file *file) return -EFAULT; } - mutex_lock(&penv->dev_lock); - penv->user_cal_rcvd = 0; - penv->user_cal_read = 0; - penv->user_cal_available = false; - penv->user_cal_data = NULL; - penv->device_opened = 1; - mutex_unlock(&penv->dev_lock); - return rc; } @@ -3026,7 +3017,7 @@ static ssize_t wcnss_wlan_read(struct file *fp, char __user { int rc = 0; - if (!penv || !penv->device_opened) + if (!penv) return -EFAULT; rc = wait_event_interruptible(penv->read_wait, penv->fw_cal_rcvd @@ -3063,55 +3054,66 @@ static ssize_t wcnss_wlan_write(struct file *fp, const char __user *user_buffer, size_t count, loff_t *position) { int rc = 0; - u32 size = 0; + char *cal_data = NULL; - if (!penv || !penv->device_opened || penv->user_cal_available) + if (!penv || penv->user_cal_available) return -EFAULT; - if (penv->user_cal_rcvd == 0 && count >= 4 - && !penv->user_cal_data) { - rc = copy_from_user((void *)&size, user_buffer, 4); - if (!size || size > MAX_CALIBRATED_DATA_SIZE) { - pr_err(DEVICE " invalid size to write %d\n", size); + if (!penv->user_cal_rcvd && count >= 4 && !penv->user_cal_exp_size) { + mutex_lock(&penv->dev_lock); + rc = copy_from_user((void *)&penv->user_cal_exp_size, + user_buffer, 4); + if (!penv->user_cal_exp_size || + penv->user_cal_exp_size > MAX_CALIBRATED_DATA_SIZE) { + pr_err(DEVICE " invalid size to write %d\n", + penv->user_cal_exp_size); + penv->user_cal_exp_size = 0; + mutex_unlock(&penv->dev_lock); return -EFAULT; } - - rc += count; - count -= 4; - penv->user_cal_exp_size = size; - penv->user_cal_data = kmalloc(size, GFP_KERNEL); - if (penv->user_cal_data == NULL) { - pr_err(DEVICE " no memory to write\n"); - return -ENOMEM; - } - if (0 == count) - goto exit; - - } else if (penv->user_cal_rcvd == 0 && count < 4) + mutex_unlock(&penv->dev_lock); + return count; + } else if (!penv->user_cal_rcvd && count < 4) { return -EFAULT; + } + mutex_lock(&penv->dev_lock); if ((UINT32_MAX - count < penv->user_cal_rcvd) || (penv->user_cal_exp_size < count + penv->user_cal_rcvd)) { pr_err(DEVICE " invalid size to write %zu\n", count + penv->user_cal_rcvd); - rc = -ENOMEM; - goto exit; + mutex_unlock(&penv->dev_lock); + return -ENOMEM; } - rc = copy_from_user((void *)penv->user_cal_data + - penv->user_cal_rcvd, user_buffer, count); - if (0 == rc) { + + cal_data = kmalloc(count, GFP_KERNEL); + if (!cal_data) { + mutex_unlock(&penv->dev_lock); + return -ENOMEM; + } + + rc = copy_from_user(cal_data, user_buffer, count); + if (!rc) { + memcpy(penv->user_cal_data + penv->user_cal_rcvd, + cal_data, count); penv->user_cal_rcvd += count; rc += count; } + + kfree(cal_data); if (penv->user_cal_rcvd == penv->user_cal_exp_size) { penv->user_cal_available = true; pr_info_ratelimited("wcnss: user cal written"); } + mutex_unlock(&penv->dev_lock); -exit: return rc; } +static int wcnss_node_release(struct inode *inode, struct file *file) +{ + return 0; +} static int wcnss_notif_cb(struct notifier_block *this, unsigned long code, void *ss_handle) @@ -3169,6 +3171,7 @@ static const struct file_operations wcnss_node_fops = { .open = wcnss_node_open, .read = wcnss_wlan_read, .write = wcnss_wlan_write, + .release = wcnss_node_release, }; static struct miscdevice wcnss_misc = { @@ -3196,6 +3199,13 @@ wcnss_wlan_probe(struct platform_device *pdev) } penv->pdev = pdev; + penv->user_cal_data = + devm_kzalloc(&pdev->dev, MAX_CALIBRATED_DATA_SIZE, GFP_KERNEL); + if (!penv->user_cal_data) { + dev_err(&pdev->dev, "Failed to alloc memory for cal data.\n"); + return -ENOMEM; + } + /* register sysfs entries */ ret = wcnss_create_sysfs(&pdev->dev); if (ret) { @@ -3216,6 +3226,11 @@ wcnss_wlan_probe(struct platform_device *pdev) mutex_init(&penv->pm_qos_mutex); init_waitqueue_head(&penv->read_wait); + penv->user_cal_rcvd = 0; + penv->user_cal_read = 0; + penv->user_cal_exp_size = 0; + penv->user_cal_available = false; + /* Since we were built into the kernel we'll be called as part * of kernel initialization. We don't know if userspace * applications are available to service PIL at this time From be73b8629c93b0f860438ff145e8bba8fda15683 Mon Sep 17 00:00:00 2001 From: kunleiz Date: Fri, 14 Apr 2017 10:28:42 +0800 Subject: [PATCH 15/41] ASoC: msm: qdspv2: add result check when audio process fail A audio_process_event_req is not always to success. Therefore, check the return value for audio_process_event_req, and initializ usr_evt before using it. CRs-Fixed: 2029798 Change-Id: I4adf682575f5f9233a1a1a533f9c6361af8a5bcf Signed-off-by: kunleiz --- drivers/misc/qcom/qdsp6v2/audio_utils_aio.c | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/drivers/misc/qcom/qdsp6v2/audio_utils_aio.c b/drivers/misc/qcom/qdsp6v2/audio_utils_aio.c index 5b2dbe702f943..51d5dfb3452aa 100644 --- a/drivers/misc/qcom/qdsp6v2/audio_utils_aio.c +++ b/drivers/misc/qcom/qdsp6v2/audio_utils_aio.c @@ -844,6 +844,7 @@ static long audio_aio_process_event_req_compat(struct q6audio_aio *audio, long rc; struct msm_audio_event32 usr_evt_32; struct msm_audio_event usr_evt; + memset(&usr_evt, 0, sizeof(struct msm_audio_event)); if (copy_from_user(&usr_evt_32, arg, sizeof(struct msm_audio_event32))) { @@ -853,6 +854,11 @@ static long audio_aio_process_event_req_compat(struct q6audio_aio *audio, usr_evt.timeout_ms = usr_evt_32.timeout_ms; rc = audio_aio_process_event_req_common(audio, &usr_evt); + if (rc < 0) { + pr_err("%s: audio process event failed, rc = %ld", + __func__, rc); + return rc; + } usr_evt_32.event_type = usr_evt.event_type; switch (usr_evt_32.event_type) { From 6b9659bc4c607aae4d3f4fce02cf6d6d46c1dba5 Mon Sep 17 00:00:00 2001 From: Eric Dumazet Date: Wed, 30 Dec 2015 08:51:12 -0500 Subject: [PATCH 16/41] udp: properly support MSG_PEEK with truncated buffers Backport of this upstream commit into stable kernels : 89c22d8c3b27 ("net: Fix skb csum races when peeking") exposed a bug in udp stack vs MSG_PEEK support, when user provides a buffer smaller than skb payload. In this case, skb_copy_and_csum_datagram_iovec(skb, sizeof(struct udphdr), msg->msg_iov); returns -EFAULT. This bug does not happen in upstream kernels since Al Viro did a great job to replace this into : skb_copy_and_csum_datagram_msg(skb, sizeof(struct udphdr), msg); This variant is safe vs short buffers. For the time being, instead reverting Herbert Xu patch and add back skb->ip_summed invalid changes, simply store the result of udp_lib_checksum_complete() so that we avoid computing the checksum a second time, and avoid the problematic skb_copy_and_csum_datagram_iovec() call. This patch can be applied on recent kernels as it avoids a double checksumming, then backported to stable kernels as a bug fix. Signed-off-by: Eric Dumazet Acked-by: Herbert Xu Signed-off-by: David S. Miller [d-cagle@codeaurora.org: Resolve trivial merge conflicts] Git-repo: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable.git Git-commit: 197c949e7798fbf28cfadc69d9ca0c2abbf93191 Change-Id: I70f19a362f627bd2d9d8e10e31bbcdb4b0600792 Signed-off-by: Dennis Cagle --- net/ipv4/udp.c | 6 ++++-- net/ipv6/udp.c | 6 ++++-- 2 files changed, 8 insertions(+), 4 deletions(-) diff --git a/net/ipv4/udp.c b/net/ipv4/udp.c index 463710f8a66d3..23d991a1754ee 100644 --- a/net/ipv4/udp.c +++ b/net/ipv4/udp.c @@ -1215,6 +1215,7 @@ int udp_recvmsg(struct kiocb *iocb, struct sock *sk, struct msghdr *msg, int peeked, off = 0; int err; int is_udplite = IS_UDPLITE(sk); + bool checksum_valid = false; bool slow; if (flags & MSG_ERRQUEUE) @@ -1240,11 +1241,12 @@ int udp_recvmsg(struct kiocb *iocb, struct sock *sk, struct msghdr *msg, */ if (copied < ulen || UDP_SKB_CB(skb)->partial_cov) { - if (udp_lib_checksum_complete(skb)) + checksum_valid = !udp_lib_checksum_complete(skb); + if (!checksum_valid) goto csum_copy_err; } - if (skb_csum_unnecessary(skb)) + if (checksum_valid || skb_csum_unnecessary(skb)) err = skb_copy_datagram_iovec(skb, sizeof(struct udphdr), msg->msg_iov, copied); else { diff --git a/net/ipv6/udp.c b/net/ipv6/udp.c index 2adb06986852b..d689b25e95102 100644 --- a/net/ipv6/udp.c +++ b/net/ipv6/udp.c @@ -370,6 +370,7 @@ int udpv6_recvmsg(struct kiocb *iocb, struct sock *sk, int peeked, off = 0; int err; int is_udplite = IS_UDPLITE(sk); + bool checksum_valid = false; int is_udp4; bool slow; @@ -401,11 +402,12 @@ int udpv6_recvmsg(struct kiocb *iocb, struct sock *sk, */ if (copied < ulen || UDP_SKB_CB(skb)->partial_cov) { - if (udp_lib_checksum_complete(skb)) + checksum_valid = !udp_lib_checksum_complete(skb); + if (!checksum_valid) goto csum_copy_err; } - if (skb_csum_unnecessary(skb)) + if (checksum_valid || skb_csum_unnecessary(skb)) err = skb_copy_datagram_iovec(skb, sizeof(struct udphdr), msg->msg_iov, copied); else { From f4f7648afa7b931bb8cd341a09723bc2dccf0def Mon Sep 17 00:00:00 2001 From: Daniel Rosenberg Date: Fri, 3 Feb 2017 20:37:06 -0800 Subject: [PATCH 17/41] ANDROID: ion: Protect kref from userspace manipulation This separates the kref for ion handles into two components. Userspace requests through the ioctl will hold at most one reference to the internally used kref. All additional requests will increment a separate counter, and the original reference is only put once that counter hits 0. This protects the kernel from a poorly behaving userspace. Bug: 34276203 Change-Id: Ibc36bc4405788ed0fea7337b541cad3be2b934c0 Signed-off-by: Daniel Rosenberg Git-repo: https://android.googlesource.com/kernel/msm/ Git-commit: 20abfcc16884a5af973a5e91dd013ddd789c44f4 [d-cagle@codeaurora.org: Resolve style issues] Signed-off-by: Dennis Cagle --- drivers/staging/android/ion/ion.c | 84 ++++++++++++++++++++++++++++--- 1 file changed, 77 insertions(+), 7 deletions(-) diff --git a/drivers/staging/android/ion/ion.c b/drivers/staging/android/ion/ion.c index bcf0deafe3334..ad8a40e65f3de 100755 --- a/drivers/staging/android/ion/ion.c +++ b/drivers/staging/android/ion/ion.c @@ -113,6 +113,7 @@ struct ion_client { */ struct ion_handle { struct kref ref; + unsigned int user_ref_count; struct ion_client *client; struct ion_buffer *buffer; struct rb_node node; @@ -434,6 +435,49 @@ int ion_handle_put(struct ion_handle *handle) return ret; } +/* Must hold the client lock */ +static void user_ion_handle_get(struct ion_handle *handle) +{ + if (handle->user_ref_count++ == 0) + kref_get(&handle->ref); +} + +/* Must hold the client lock */ +static struct ion_handle *user_ion_handle_get_check_overflow( + struct ion_handle *handle) +{ + if (handle->user_ref_count + 1 == 0) + return ERR_PTR(-EOVERFLOW); + user_ion_handle_get(handle); + return handle; +} + +/* passes a kref to the user ref count. + * We know we're holding a kref to the object before and + * after this call, so no need to reverify handle. */ +static struct ion_handle *pass_to_user(struct ion_handle *handle) +{ + struct ion_client *client = handle->client; + struct ion_handle *ret; + + mutex_lock(&client->lock); + ret = user_ion_handle_get_check_overflow(handle); + ion_handle_put_nolock(handle); + mutex_unlock(&client->lock); + return ret; +} + +/* Must hold the client lock */ +static int user_ion_handle_put_nolock(struct ion_handle *handle) +{ + int ret; + + if (--handle->user_ref_count == 0) + ret = ion_handle_put_nolock(handle); + + return ret; +} + static struct ion_handle *ion_handle_lookup(struct ion_client *client, struct ion_buffer *buffer) { @@ -650,6 +694,25 @@ static void ion_free_nolock(struct ion_client *client, struct ion_handle *handle ion_handle_put_nolock(handle); } +static void user_ion_free_nolock(struct ion_client *client, + struct ion_handle *handle) +{ + bool valid_handle; + + BUG_ON(client != handle->client); + + valid_handle = ion_handle_validate(client, handle); + if (!valid_handle) { + WARN(1, "%s: invalid handle passed to free.\n", __func__); + return; + } + if (!handle->user_ref_count > 0) { + WARN(1, "%s: User does not have access!\n", __func__); + return; + } + user_ion_handle_put_nolock(handle); +} + void ion_free(struct ion_client *client, struct ion_handle *handle) { BUG_ON(client != handle->client); @@ -1476,7 +1539,7 @@ static long ion_ioctl(struct file *filp, unsigned int cmd, unsigned long arg) data.allocation.flags, true); if (IS_ERR(handle)) return PTR_ERR(handle); - + pass_to_user(handle); data.allocation.handle = handle->id; cleanup_handle = handle; @@ -1492,7 +1555,7 @@ static long ion_ioctl(struct file *filp, unsigned int cmd, unsigned long arg) mutex_unlock(&client->lock); return PTR_ERR(handle); } - ion_free_nolock(client, handle); + user_ion_free_nolock(client, handle); ion_handle_put_nolock(handle); mutex_unlock(&client->lock); break; @@ -1516,10 +1579,15 @@ static long ion_ioctl(struct file *filp, unsigned int cmd, unsigned long arg) struct ion_handle *handle; handle = ion_import_dma_buf(client, data.fd.fd); - if (IS_ERR(handle)) + if (IS_ERR(handle)) { ret = PTR_ERR(handle); - else - data.handle.handle = handle->id; + } else { + handle = pass_to_user(handle); + if (IS_ERR(handle)) + ret = PTR_ERR(handle); + else + data.handle.handle = handle->id; + } break; } case ION_IOC_SYNC: @@ -1551,8 +1619,10 @@ static long ion_ioctl(struct file *filp, unsigned int cmd, unsigned long arg) if (dir & _IOC_READ) { if (copy_to_user((void __user *)arg, &data, _IOC_SIZE(cmd))) { if (cleanup_handle) { - ion_free(client, cleanup_handle); - ion_handle_put(cleanup_handle); + mutex_lock(&client->lock); + user_ion_free_nolock(client, cleanup_handle); + ion_handle_put_nolock(cleanup_handle); + mutex_unlock(&client->lock); } return -EFAULT; } From e5239733b58244cb0c55cfe92dde4aaac0aa05a5 Mon Sep 17 00:00:00 2001 From: Jan Kara Date: Mon, 19 Sep 2016 17:39:09 +0200 Subject: [PATCH 18/41] posix_acl: Clear SGID bit when setting file permissions When file permissions are modified via chmod(2) and the user is not in the owning group or capable of CAP_FSETID, the setgid bit is cleared in inode_change_ok(). Setting a POSIX ACL via setxattr(2) sets the file permissions as well as the new ACL, but doesn't clear the setgid bit in a similar way; this allows to bypass the check in chmod(2). Fix that. References: CVE-2016-7097 Reviewed-by: Christoph Hellwig Reviewed-by: Jeff Layton Signed-off-by: Jan Kara Signed-off-by: Andreas Gruenbacher Git-repo: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/ linux.git Git-commit: 073931017b49d9458aa351605b43a7e34598caef Change-Id: Idf7cd8d0fb030fedeabd46254e4c4a9c08bce8b5 [d-cagle@codeaurora.org: Resolve merge conflicts and style] Signed-off-by: Dennis Cagle [stummala@codeaurora.org: Resolve merge conflicts on existing files and skip files fs/ceph/acl.c, fs/hfsplus/posix_acl.c and fs/jfs/acl.c from original change as those files are not present/fix is not applicable on 3.10 kernel] Signed-off-by: Sahitya Tummala --- fs/9p/acl.c | 41 +++++++++++++++++---------------------- fs/btrfs/acl.c | 7 +++---- fs/ext2/acl.c | 13 +++++-------- fs/ext4/acl.c | 13 +++++-------- fs/f2fs/acl.c | 7 +++---- fs/gfs2/acl.c | 5 +++-- fs/jffs2/acl.c | 9 ++++----- fs/ocfs2/acl.c | 8 ++++---- fs/posix_acl.c | 31 +++++++++++++++++++++++++++++ fs/reiserfs/xattr_acl.c | 9 +++------ fs/xfs/xfs_acl.c | 5 +++-- include/linux/posix_acl.h | 3 +++ 12 files changed, 85 insertions(+), 66 deletions(-) diff --git a/fs/9p/acl.c b/fs/9p/acl.c index 7af425f53beef..f29d1f00a4d82 100644 --- a/fs/9p/acl.c +++ b/fs/9p/acl.c @@ -320,32 +320,27 @@ static int v9fs_xattr_set_acl(struct dentry *dentry, const char *name, case ACL_TYPE_ACCESS: name = POSIX_ACL_XATTR_ACCESS; if (acl) { - umode_t mode = inode->i_mode; - retval = posix_acl_equiv_mode(acl, &mode); - if (retval < 0) + struct iattr iattr; + + retval = posix_acl_update_mode(inode, + &iattr.ia_mode, &acl); + if (retval) goto err_out; - else { - struct iattr iattr; - if (retval == 0) { - /* - * ACL can be represented - * by the mode bits. So don't - * update ACL. - */ - acl = NULL; - value = NULL; - size = 0; - } - /* Updte the mode bits */ - iattr.ia_mode = ((mode & S_IALLUGO) | - (inode->i_mode & ~S_IALLUGO)); - iattr.ia_valid = ATTR_MODE; - /* FIXME should we update ctime ? - * What is the following setxattr update the - * mode ? + if (!acl) { + /* + * ACL can be represented + * by the mode bits. So don't + * update ACL. */ - v9fs_vfs_setattr_dotl(dentry, &iattr); + value = NULL; + size = 0; } + iattr.ia_valid = ATTR_MODE; + /* FIXME should we update ctime ? + * What is the following setxattr update the + * mode ? + */ + v9fs_vfs_setattr_dotl(dentry, &iattr); } break; case ACL_TYPE_DEFAULT: diff --git a/fs/btrfs/acl.c b/fs/btrfs/acl.c index 0890c83643e94..1fc4626beccbc 100644 --- a/fs/btrfs/acl.c +++ b/fs/btrfs/acl.c @@ -118,11 +118,10 @@ static int btrfs_set_acl(struct btrfs_trans_handle *trans, case ACL_TYPE_ACCESS: name = POSIX_ACL_XATTR_ACCESS; if (acl) { - ret = posix_acl_equiv_mode(acl, &inode->i_mode); - if (ret < 0) + ret = posix_acl_update_mode(inode, + &inode->i_mode, &acl); + if (ret) return ret; - if (ret == 0) - acl = NULL; } ret = 0; break; diff --git a/fs/ext2/acl.c b/fs/ext2/acl.c index 110b6b371a4ed..36ad07b03e065 100644 --- a/fs/ext2/acl.c +++ b/fs/ext2/acl.c @@ -206,15 +206,12 @@ ext2_set_acl(struct inode *inode, int type, struct posix_acl *acl) case ACL_TYPE_ACCESS: name_index = EXT2_XATTR_INDEX_POSIX_ACL_ACCESS; if (acl) { - error = posix_acl_equiv_mode(acl, &inode->i_mode); - if (error < 0) + error = posix_acl_update_mode(inode, + &inode->i_mode, &acl); + if (error) return error; - else { - inode->i_ctime = CURRENT_TIME_SEC; - mark_inode_dirty(inode); - if (error == 0) - acl = NULL; - } + inode->i_ctime = CURRENT_TIME_SEC; + mark_inode_dirty(inode); } break; diff --git a/fs/ext4/acl.c b/fs/ext4/acl.c index 39a54a0e9fe4a..9bbdc3847681c 100644 --- a/fs/ext4/acl.c +++ b/fs/ext4/acl.c @@ -211,15 +211,12 @@ ext4_set_acl(handle_t *handle, struct inode *inode, int type, case ACL_TYPE_ACCESS: name_index = EXT4_XATTR_INDEX_POSIX_ACL_ACCESS; if (acl) { - error = posix_acl_equiv_mode(acl, &inode->i_mode); - if (error < 0) + error = posix_acl_update_mode(inode, + &inode->i_mode, &acl); + if (error) return error; - else { - inode->i_ctime = ext4_current_time(inode); - ext4_mark_inode_dirty(handle, inode); - if (error == 0) - acl = NULL; - } + inode->i_ctime = ext4_current_time(inode); + ext4_mark_inode_dirty(handle, inode); } break; diff --git a/fs/f2fs/acl.c b/fs/f2fs/acl.c index 44abc2f286e00..059375a0d4faa 100644 --- a/fs/f2fs/acl.c +++ b/fs/f2fs/acl.c @@ -223,12 +223,11 @@ static int f2fs_set_acl(struct inode *inode, int type, struct posix_acl *acl) case ACL_TYPE_ACCESS: name_index = F2FS_XATTR_INDEX_POSIX_ACL_ACCESS; if (acl) { - error = posix_acl_equiv_mode(acl, &inode->i_mode); - if (error < 0) + error = posix_acl_update_mode(inode, + &inode->i_mode, &acl); + if (error) return error; set_acl_inode(fi, inode->i_mode); - if (error == 0) - acl = NULL; } break; diff --git a/fs/gfs2/acl.c b/fs/gfs2/acl.c index f69ac0af5496c..688dcbfaaf714 100644 --- a/fs/gfs2/acl.c +++ b/fs/gfs2/acl.c @@ -267,8 +267,9 @@ static int gfs2_xattr_system_set(struct dentry *dentry, const char *name, goto out_release; if (type == ACL_TYPE_ACCESS) { - umode_t mode = inode->i_mode; - error = posix_acl_equiv_mode(acl, &mode); + umode_t mode; + + error = posix_acl_update_mode(inode, &mode, &acl); if (error <= 0) { posix_acl_release(acl); diff --git a/fs/jffs2/acl.c b/fs/jffs2/acl.c index 223283c301116..9335b8d3cf521 100644 --- a/fs/jffs2/acl.c +++ b/fs/jffs2/acl.c @@ -243,9 +243,10 @@ static int jffs2_set_acl(struct inode *inode, int type, struct posix_acl *acl) case ACL_TYPE_ACCESS: xprefix = JFFS2_XPREFIX_ACL_ACCESS; if (acl) { - umode_t mode = inode->i_mode; - rc = posix_acl_equiv_mode(acl, &mode); - if (rc < 0) + umode_t mode; + + rc = posix_acl_update_mode(inode, &mode, &acl); + if (rc) return rc; if (inode->i_mode != mode) { struct iattr attr; @@ -257,8 +258,6 @@ static int jffs2_set_acl(struct inode *inode, int type, struct posix_acl *acl) if (rc < 0) return rc; } - if (rc == 0) - acl = NULL; } break; case ACL_TYPE_DEFAULT: diff --git a/fs/ocfs2/acl.c b/fs/ocfs2/acl.c index 8a404576fb265..713f87d3f1e6c 100644 --- a/fs/ocfs2/acl.c +++ b/fs/ocfs2/acl.c @@ -274,9 +274,10 @@ static int ocfs2_set_acl(handle_t *handle, case ACL_TYPE_ACCESS: name_index = OCFS2_XATTR_INDEX_POSIX_ACL_ACCESS; if (acl) { - umode_t mode = inode->i_mode; - ret = posix_acl_equiv_mode(acl, &mode); - if (ret < 0) + umode_t mode; + + ret = posix_acl_update_mode(inode, &mode, &acl); + if (ret) return ret; else { if (ret == 0) @@ -286,7 +287,6 @@ static int ocfs2_set_acl(handle_t *handle, handle, mode); if (ret) return ret; - } } break; diff --git a/fs/posix_acl.c b/fs/posix_acl.c index 3542f1f814e2a..2bc32c0b30ca1 100644 --- a/fs/posix_acl.c +++ b/fs/posix_acl.c @@ -424,3 +424,34 @@ posix_acl_chmod(struct posix_acl **acl, gfp_t gfp, umode_t mode) return err; } EXPORT_SYMBOL(posix_acl_chmod); + +/** + * posix_acl_update_mode - update mode in set_acl + * + * Update the file mode when setting an ACL: compute the new file permission + * bits based on the ACL. In addition, if the ACL is equivalent to the new + * file mode, set *acl to NULL to indicate that no ACL should be set. + * + * As with chmod, clear the setgit bit if the caller is not in the owning group + * or capable of CAP_FSETID (see inode_change_ok). + * + * Called from set_acl inode operations. + */ +int posix_acl_update_mode(struct inode *inode, umode_t *mode_p, + struct posix_acl **acl) +{ + umode_t mode = inode->i_mode; + int error; + + error = posix_acl_equiv_mode(*acl, &mode); + if (error < 0) + return error; + if (error == 0) + *acl = NULL; + if (!in_group_p(inode->i_gid) && + !capable_wrt_inode_uidgid(inode, CAP_FSETID)) + mode &= ~S_ISGID; + *mode_p = mode; + return 0; +} +EXPORT_SYMBOL(posix_acl_update_mode); diff --git a/fs/reiserfs/xattr_acl.c b/fs/reiserfs/xattr_acl.c index 6c8767fdfc6a2..df5ad5574810b 100644 --- a/fs/reiserfs/xattr_acl.c +++ b/fs/reiserfs/xattr_acl.c @@ -286,13 +286,10 @@ reiserfs_set_acl(struct reiserfs_transaction_handle *th, struct inode *inode, case ACL_TYPE_ACCESS: name = POSIX_ACL_XATTR_ACCESS; if (acl) { - error = posix_acl_equiv_mode(acl, &inode->i_mode); - if (error < 0) + error = posix_acl_update_mode(inode, + &inode->i_mode, &acl); + if (error) return error; - else { - if (error == 0) - acl = NULL; - } } break; case ACL_TYPE_DEFAULT: diff --git a/fs/xfs/xfs_acl.c b/fs/xfs/xfs_acl.c index 306d883d89bc7..2a60773831fc4 100644 --- a/fs/xfs/xfs_acl.c +++ b/fs/xfs/xfs_acl.c @@ -388,8 +388,9 @@ xfs_xattr_acl_set(struct dentry *dentry, const char *name, goto out_release; if (type == ACL_TYPE_ACCESS) { - umode_t mode = inode->i_mode; - error = posix_acl_equiv_mode(acl, &mode); + umode_t mode; + + error = posix_acl_update_mode(inode, &mode, &acl); if (error <= 0) { posix_acl_release(acl); diff --git a/include/linux/posix_acl.h b/include/linux/posix_acl.h index 7931efe711755..94d2f4282a24c 100644 --- a/include/linux/posix_acl.h +++ b/include/linux/posix_acl.h @@ -95,6 +95,9 @@ extern struct posix_acl *get_posix_acl(struct inode *, int); extern int set_posix_acl(struct inode *, int, struct posix_acl *); #ifdef CONFIG_FS_POSIX_ACL +extern int posix_acl_update_mode(struct inode *, umode_t *, + struct posix_acl **); + static inline struct posix_acl **acl_by_type(struct inode *inode, int type) { switch (type) { From 8e423c27f01b49d772cdef468ffc8033113e7102 Mon Sep 17 00:00:00 2001 From: Zhen Kong Date: Mon, 27 Feb 2017 13:41:07 -0800 Subject: [PATCH 19/41] qseecom: add mutex around qseecom_set_client_mem_param Add mutex around qseecom_set_client_mem_param to prevent an ioctl thread modifying and corrupting data which is being processed by another ioctl in the other thread Change-Id: I0cfb8afab4001c2913be693dfe44c761b9568893 Signed-off-by: Zhen Kong --- drivers/misc/qseecom.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/drivers/misc/qseecom.c b/drivers/misc/qseecom.c index 07214d4eaef20..de7d6b223f1d2 100644 --- a/drivers/misc/qseecom.c +++ b/drivers/misc/qseecom.c @@ -5239,7 +5239,11 @@ long qseecom_ioctl(struct file *file, unsigned cmd, unsigned long arg) break; } pr_debug("SET_MEM_PARAM: qseecom addr = 0x%pK\n", data); + mutex_lock(&app_access_lock); + atomic_inc(&data->ioctl_count); ret = qseecom_set_client_mem_param(data, argp); + atomic_dec(&data->ioctl_count); + mutex_unlock(&app_access_lock); if (ret) pr_err("failed Qqseecom_set_mem_param request: %d\n", ret); From 52deca656bb243c1d0dc65698346dd712b70b18f Mon Sep 17 00:00:00 2001 From: Daniel Rosenberg Date: Tue, 4 Apr 2017 14:27:16 -0700 Subject: [PATCH 20/41] ANDROID: ion: Fix uninitialized variable Fix an uninitialized variable in user_ion_handle_put_nolock Change-Id: Ia634b790661089ad01aca8e5975984435463d148 Signed-off-by: Daniel Rosenberg Bug: 34276203 [d-cagle@codeaurora.org: Add commit message] Signed-off-by: Dennis Cagle --- drivers/staging/android/ion/ion.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/staging/android/ion/ion.c b/drivers/staging/android/ion/ion.c index ad8a40e65f3de..005a611669702 100755 --- a/drivers/staging/android/ion/ion.c +++ b/drivers/staging/android/ion/ion.c @@ -470,7 +470,7 @@ static struct ion_handle *pass_to_user(struct ion_handle *handle) /* Must hold the client lock */ static int user_ion_handle_put_nolock(struct ion_handle *handle) { - int ret; + int ret = 0; if (--handle->user_ref_count == 0) ret = ion_handle_put_nolock(handle); From 0a4d95d83e54d773f4700683bdd08132dfac2546 Mon Sep 17 00:00:00 2001 From: Cong Wang Date: Tue, 13 Dec 2016 10:33:34 -0800 Subject: [PATCH 21/41] FROMLIST: 9p: fix a potential acl leak (https://lkml.org/lkml/2016/12/13/579) posix_acl_update_mode() could possibly clear 'acl', if so we leak the memory pointed by 'acl'. Save this pointer before calling posix_acl_update_mode() and release the memory if 'acl' really gets cleared. Reported-by: Mark Salyzyn Reviewed-by: Jan Kara Reviewed-by: Greg Kurz Cc: Eric Van Hensbergen Cc: Ron Minnich Cc: Latchesar Ionkov Signed-off-by: Cong Wang Bug: 32458736 Change-Id: Ia78da401e6fd1bfd569653bd2cd0ebd3f9c737a0 Git-repo: https://android.googlesource.com/kernel/msm/ Git-commit: 7c780387c931f63fe67830c817f65c1272512bb1 Signed-off-by: Dennis Cagle --- fs/9p/acl.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/fs/9p/acl.c b/fs/9p/acl.c index f29d1f00a4d82..6b951d1140dd4 100644 --- a/fs/9p/acl.c +++ b/fs/9p/acl.c @@ -321,6 +321,7 @@ static int v9fs_xattr_set_acl(struct dentry *dentry, const char *name, name = POSIX_ACL_XATTR_ACCESS; if (acl) { struct iattr iattr; + struct posix_acl *old_acl = acl; retval = posix_acl_update_mode(inode, &iattr.ia_mode, &acl); @@ -332,6 +333,7 @@ static int v9fs_xattr_set_acl(struct dentry *dentry, const char *name, * by the mode bits. So don't * update ACL. */ + posix_acl_release(old_acl); value = NULL; size = 0; } From fdb66128fc6f1ec3310bcf1853406d26cbdc034a Mon Sep 17 00:00:00 2001 From: Mark Salyzyn Date: Mon, 23 Jan 2017 12:56:41 -0800 Subject: [PATCH 22/41] ANDROID: fix acl leaks Fixes regressions associated with commit 073931017b49d9458aa351605b43a7e34598caef Signed-off-by: Mark Salyzyn Bug: 32458736 Change-Id: I6ee127dfdf3594d24ccd8560541ac554c5b05eb6 [stummala@codeaurora.org: Fixed merge conflicts] Signed-off-by: Sahitya Tummala --- fs/gfs2/acl.c | 13 +++++-------- fs/jfs/xattr.c | 8 +++++--- fs/xfs/xfs_acl.c | 13 +++++-------- 3 files changed, 15 insertions(+), 19 deletions(-) diff --git a/fs/gfs2/acl.c b/fs/gfs2/acl.c index 688dcbfaaf714..d4b2bbd7cf481 100644 --- a/fs/gfs2/acl.c +++ b/fs/gfs2/acl.c @@ -268,16 +268,13 @@ static int gfs2_xattr_system_set(struct dentry *dentry, const char *name, if (type == ACL_TYPE_ACCESS) { umode_t mode; + struct posix_acl *old_acl = acl; error = posix_acl_update_mode(inode, &mode, &acl); - - if (error <= 0) { - posix_acl_release(acl); - acl = NULL; - - if (error < 0) - return error; - } + if (!acl) + posix_acl_release(old_acl); + if (error) + goto out_release; error = gfs2_set_mode(inode, mode); if (error) diff --git a/fs/jfs/xattr.c b/fs/jfs/xattr.c index 42d67f9757bf6..7adb97da7b2a0 100644 --- a/fs/jfs/xattr.c +++ b/fs/jfs/xattr.c @@ -693,11 +693,13 @@ static int can_set_system_xattr(struct inode *inode, const char *name, return rc; } if (acl) { - rc = posix_acl_equiv_mode(acl, &inode->i_mode); - posix_acl_release(acl); + struct posix_acl *old_acl = acl; + + rc = posix_acl_update_mode(inode, &inode->i_mode, &acl); + posix_acl_release(old_acl); if (rc < 0) { printk(KERN_ERR - "posix_acl_equiv_mode returned %d\n", + "posix_acl_update_mode returned %d\n", rc); return rc; } diff --git a/fs/xfs/xfs_acl.c b/fs/xfs/xfs_acl.c index 2a60773831fc4..0c59d960efe89 100644 --- a/fs/xfs/xfs_acl.c +++ b/fs/xfs/xfs_acl.c @@ -389,16 +389,13 @@ xfs_xattr_acl_set(struct dentry *dentry, const char *name, if (type == ACL_TYPE_ACCESS) { umode_t mode; + struct posix_acl *old_acl = acl; error = posix_acl_update_mode(inode, &mode, &acl); - - if (error <= 0) { - posix_acl_release(acl); - acl = NULL; - - if (error < 0) - return error; - } + if (!acl) + posix_acl_release(old_acl); + if (error) + goto out_release; error = xfs_set_mode(inode, mode); if (error) From 5905ef1cd1cd93ba73caa1db13e8b898cb0f91d4 Mon Sep 17 00:00:00 2001 From: Zhen Kong Date: Tue, 21 Feb 2017 11:35:37 -0800 Subject: [PATCH 23/41] crypto: msm: check invalid src and dst vbuf in qcedev.c src and dst vbuf address and length are provided from userspace, and they are invalid if vbuf address is NULL but length is not zero. Add additional checks in qcedev_check_cipher_params to prevent it. Change-Id: Iadc1a0c1c5b2f7a56acd03a23c08e45b5a671b19 Signed-off-by: Zhen Kong --- drivers/crypto/msm/qcedev.c | 10 ++++++++++ 1 file changed, 10 insertions(+) diff --git a/drivers/crypto/msm/qcedev.c b/drivers/crypto/msm/qcedev.c index dac6ddec7e2b8..0dfe0fa352750 100644 --- a/drivers/crypto/msm/qcedev.c +++ b/drivers/crypto/msm/qcedev.c @@ -1502,6 +1502,11 @@ static int qcedev_check_cipher_params(struct qcedev_cipher_op_req *req, } /* Check for sum of all dst length is equal to data_len */ for (i = 0, total = 0; i < req->entries; i++) { + if (!req->vbuf.dst[i].vaddr && req->vbuf.dst[i].len) { + pr_err("%s: NULL req dst vbuf[%d] with length %d\n", + __func__, i, req->vbuf.dst[i].len); + goto error; + } if (req->vbuf.dst[i].len >= U32_MAX - total) { pr_err("%s: Integer overflow on total req dst vbuf length\n", __func__); @@ -1516,6 +1521,11 @@ static int qcedev_check_cipher_params(struct qcedev_cipher_op_req *req, } /* Check for sum of all src length is equal to data_len */ for (i = 0, total = 0; i < req->entries; i++) { + if (!req->vbuf.src[i].vaddr && req->vbuf.src[i].len) { + pr_err("%s: NULL req src vbuf[%d] with length %d\n", + __func__, i, req->vbuf.src[i].len); + goto error; + } if (req->vbuf.src[i].len > U32_MAX - total) { pr_err("%s: Integer overflow on total req src vbuf length\n", __func__); From dd01e995b683ef3b54b7d722ff8015e0ad8b3401 Mon Sep 17 00:00:00 2001 From: "Se Wang (Patrick) Oh" Date: Mon, 29 Jun 2015 11:43:39 -0700 Subject: [PATCH 24/41] ion: Fix unprotected userspace access After enabling KASan, unprotected userspace access causes a PTE translation fault as it can covers only kernel memory region. Following is the crash error for the reference. Unable to handle kernel paging request at virtual address dfffff901ff64b84 pgd = ffffffc083266000 [dfffff901ff64b84] *pgd=0000000000000000, *pud=0000000000000000 Internal error: Oops: 96000004 [#1] PREEMPT SMP Modules linked in: CPU: 1 PID: 8527 Comm: iveaudiolatency Tainted: G W 3.18.0-g5a4a5d5-07255-g8e80921-dirty #21 Hardware name: Qualcomm Technologies, Inc. MSM 8996 v2 + PMI8994 MTP (DT) task: ffffffc02bfeb600 ti: ffffffc083378000 task.ti: ffffffc083378000 PC is at compat_msm_ion_ioctl+0x23c/0x614 LR is at compat_msm_ion_ioctl+0x1d8/0x614 pc : [] lr : [] pstate: 80000145 sp : ffffffc08337faf0 x29: ffffffc08337faf0 x28: 0000000000000000 x27: ffffffc083378000 x26: 00000000ffb25c20 x25: 00000000e2fa6000 x24: 0000000000000000 x23: 00000000ffb25c18 x22: 0000000000000000 x21: ffffffc08fcaa640 x20: 00000000c0144d00 x19: 00000000ffb25c74 x18: 0000000000000000 x17: 0000000000000000 x16: ffffffc000385a88 x15: 0000000000000000 x14: 00000000f73517c9 x13: 00000000ffb25c30 x12: 0000000000000001 x11: 00000000ffffffff x10: ffffff881066ff3a x9 : 1ffffff81066ff3a x8 : dfffff9000000000 x7 : 0000000000000036 x6 : ffffffc08337f9d4 x5 : 0000000000000003 x4 : 00000000ffb25c30 x3 : ffffffc0012bd334 x2 : 0000000000000001 x1 : 000000001ff64b84 x0 : dfffff9000000000 Process iveaudiolatency (pid: 8527, stack limit = 0xffffffc083378058) Call trace: [] compat_msm_ion_ioctl+0x23c/0x614 [] ion_ioctl+0x4dc/0x680 [] compat_ion_ioctl+0xb98/0xbc0 [] compat_SyS_ioctl+0x288/0x2048 Code: 910022fa d2dff200 d343ff41 f2fbffe0 (38e06820) ---[ end trace 490ef1c3bde7b96c ]--- coresight-tmc 3028000.tmc: TMC aborted Change-Id: I7595bbf5f311182d40f7158654df56dc8bcf672a Signed-off-by: Se Wang (Patrick) Oh --- drivers/staging/android/ion/msm/compat_msm_ion.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/staging/android/ion/msm/compat_msm_ion.c b/drivers/staging/android/ion/msm/compat_msm_ion.c index c34b3a7827d28..ddb9fc73a3e47 100644 --- a/drivers/staging/android/ion/msm/compat_msm_ion.c +++ b/drivers/staging/android/ion/msm/compat_msm_ion.c @@ -58,7 +58,7 @@ static int compat_get_ion_flush_data( err |= put_user(i, &data->fd); err |= get_user(u, &data32->vaddr); /* upper bits won't get set, zero them */ - data->vaddr = NULL; + err |= put_user(NULL, &data->vaddr); err |= put_user(u, (compat_uptr_t *)&data->vaddr); err |= get_user(l, &data32->offset); err |= put_user(l, &data->offset); From ba5e28d00ced7a90883be30a0af0ffb4862126be Mon Sep 17 00:00:00 2001 From: Skylar Chang Date: Fri, 14 Apr 2017 19:23:05 -0700 Subject: [PATCH 25/41] msm: rmnet_ipa: fix memory overflow issue Fix the security issue where mux channel name might not be null-terminated causing memory access overflow in ipa wan driver. Change-Id: I3ef440b62cf3861464fb60c1e7f65f2be5e39ed0 Acked-by: Shihuan Liu Signed-off-by: Skylar Chang --- drivers/platform/msm/ipa/rmnet_ipa.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/drivers/platform/msm/ipa/rmnet_ipa.c b/drivers/platform/msm/ipa/rmnet_ipa.c index 5475de8bf5877..7b562236a52f5 100644 --- a/drivers/platform/msm/ipa/rmnet_ipa.c +++ b/drivers/platform/msm/ipa/rmnet_ipa.c @@ -1,4 +1,4 @@ -/* Copyright (c) 2014-2015, The Linux Foundation. All rights reserved. +/* Copyright (c) 2014-2017, The Linux Foundation. All rights reserved. * * This program is free software; you can redistribute it and/or modify * it under the terms of the GNU General Public License version 2 and @@ -1277,6 +1277,8 @@ static int ipa_wwan_ioctl(struct net_device *dev, struct ifreq *ifr, int cmd) memcpy(mux_channel[rmnet_index].vchannel_name, extend_ioctl_data.u.rmnet_mux_val.vchannel_name, sizeof(mux_channel[rmnet_index].vchannel_name)); + mux_channel[rmnet_index].vchannel_name[ + IFNAMSIZ - 1] = '\0'; IPAWANDBG("cashe device[%s:%d] in IPA_wan[%d]\n", mux_channel[rmnet_index].vchannel_name, mux_channel[rmnet_index].mux_id, From d22bc5b5a8101dee8cc2459e612a91bf476ec9ec Mon Sep 17 00:00:00 2001 From: Dilip Kota Date: Mon, 21 Mar 2016 11:28:51 +0530 Subject: [PATCH 26/41] slim-msm : Synchronize SSR callbacks Subsystem will restart within short timeframe. Synchronise subsytem up/down callback notifications to avoid functionality failures. Use mutex locks to achieve synchronization. Change-Id: I5881c7d468507bb8402a2e9f8178b9c31e57e8a5 Signed-off-by: Dilip Kota --- drivers/slimbus/slim-msm-ngd.c | 7 ++++++- drivers/slimbus/slim-msm.h | 3 ++- 2 files changed, 8 insertions(+), 2 deletions(-) diff --git a/drivers/slimbus/slim-msm-ngd.c b/drivers/slimbus/slim-msm-ngd.c index 9a0e2b765a735..815f48e6f9a1d 100644 --- a/drivers/slimbus/slim-msm-ngd.c +++ b/drivers/slimbus/slim-msm-ngd.c @@ -1,4 +1,4 @@ -/* Copyright (c) 2011-2015, The Linux Foundation. All rights reserved. +/* Copyright (c) 2011-2016,2017 The Linux Foundation. All rights reserved. * * This program is free software; you can redistribute it and/or modify * it under the terms of the GNU General Public License version 2 and @@ -1295,11 +1295,13 @@ static void ngd_adsp_down(struct work_struct *work) struct slim_controller *ctrl = &dev->ctrl; struct slim_device *sbdev; + mutex_lock(&dev->ssr_lock); ngd_slim_enable(dev, false); /* device up should be called again after SSR */ list_for_each_entry(sbdev, &ctrl->devs, dev_list) slim_report_absent(sbdev); SLIM_INFO(dev, "SLIM ADSP SSR (DOWN) done\n"); + mutex_unlock(&dev->ssr_lock); } static void ngd_adsp_up(struct work_struct *work) @@ -1308,7 +1310,9 @@ static void ngd_adsp_up(struct work_struct *work) container_of(work, struct msm_slim_qmi, ssr_up); struct msm_slim_ctrl *dev = container_of(qmi, struct msm_slim_ctrl, qmi); + mutex_lock(&dev->ssr_lock); ngd_slim_enable(dev, true); + mutex_unlock(&dev->ssr_lock); } static ssize_t show_mask(struct device *device, struct device_attribute *attr, @@ -1462,6 +1466,7 @@ static int ngd_slim_probe(struct platform_device *pdev) init_completion(&dev->ctrl_up); mutex_init(&dev->tx_lock); mutex_init(&dev->tx_buf_lock); + mutex_init(&dev->ssr_lock); spin_lock_init(&dev->rx_lock); dev->ee = 1; dev->irq = irq->start; diff --git a/drivers/slimbus/slim-msm.h b/drivers/slimbus/slim-msm.h index 05dca46938497..ebb15a65c824d 100644 --- a/drivers/slimbus/slim-msm.h +++ b/drivers/slimbus/slim-msm.h @@ -1,4 +1,4 @@ -/* Copyright (c) 2011-2014, The Linux Foundation. All rights reserved. +/* Copyright (c) 2011-2016,2017 The Linux Foundation. All rights reserved. * * This program is free software; you can redistribute it and/or modify * it under the terms of the GNU General Public License version 2 and @@ -258,6 +258,7 @@ struct msm_slim_ctrl { struct clk *hclk; struct mutex tx_lock; struct mutex tx_buf_lock; + struct mutex ssr_lock; u8 pgdla; enum msm_slim_msgq use_rx_msgqs; enum msm_slim_msgq use_tx_msgqs; From 3d013572ddc7663d67895c7df1b1aca48cc3e475 Mon Sep 17 00:00:00 2001 From: VijayaKumar T M Date: Wed, 3 May 2017 15:36:43 +0530 Subject: [PATCH 27/41] msm: camera: Add regulator enable and disable independent of CSID Regulator enable and disable of CSIPHY depends on the CSID module. Make the enable and disable of clk regulator independent of CSIPHY. CRs-Fixed: 1107702 Change-Id: Iabb5eb28d63b34a4c3201c53be17054a1907f4fe Signed-off-by: Ravi Kishore Tanuku Signed-off-by: VijayaKumar T M --- arch/arm/boot/dts/qcom/msm8992-camera.dtsi | 11 +- arch/arm/boot/dts/qcom/msm8994-camera.dtsi | 11 +- .../msm/camera_v2/sensor/csiphy/msm_csiphy.c | 131 +++++++++++++++++- .../msm/camera_v2/sensor/csiphy/msm_csiphy.h | 4 +- 4 files changed, 153 insertions(+), 4 deletions(-) diff --git a/arch/arm/boot/dts/qcom/msm8992-camera.dtsi b/arch/arm/boot/dts/qcom/msm8992-camera.dtsi index c5513bac2ecb6..a14a4d803ec8c 100644 --- a/arch/arm/boot/dts/qcom/msm8992-camera.dtsi +++ b/arch/arm/boot/dts/qcom/msm8992-camera.dtsi @@ -1,5 +1,5 @@ /* - * Copyright (c) 2014-2015, The Linux Foundation. All rights reserved. + * Copyright (c) 2014-2015, 2017 The Linux Foundation. All rights reserved. * * This program is free software; you can redistribute it and/or modify * it under the terms of the GNU General Public License version 2 and @@ -26,6 +26,9 @@ reg-names = "csiphy", "csiphy_clk_mux"; interrupts = <0 78 0>; interrupt-names = "csiphy"; + qcom,csi-vdd-voltage = <1250000>; + qcom,mipi-csi-vdd-supply = <&pm8994_l2>; + qcom,gdscr-vdd-supply = <&gdsc_camss_top>; clocks = <&clock_mmss clk_camss_top_ahb_clk>, <&clock_mmss clk_camss_ispif_ahb_clk>, <&clock_mmss clk_csi0_clk_src>, @@ -48,6 +51,9 @@ reg-names = "csiphy", "csiphy_clk_mux"; interrupts = <0 79 0>; interrupt-names = "csiphy"; + qcom,csi-vdd-voltage = <1250000>; + qcom,mipi-csi-vdd-supply = <&pm8994_l2>; + qcom,gdscr-vdd-supply = <&gdsc_camss_top>; clocks = <&clock_mmss clk_camss_top_ahb_clk>, <&clock_mmss clk_camss_ispif_ahb_clk>, <&clock_mmss clk_csi1_clk_src>, @@ -70,6 +76,9 @@ reg-names = "csiphy", "csiphy_clk_mux"; interrupts = <0 80 0>; interrupt-names = "csiphy"; + qcom,csi-vdd-voltage = <1250000>; + qcom,mipi-csi-vdd-supply = <&pm8994_l2>; + qcom,gdscr-vdd-supply = <&gdsc_camss_top>; clocks = <&clock_mmss clk_camss_top_ahb_clk>, <&clock_mmss clk_camss_ispif_ahb_clk>, <&clock_mmss clk_csi2_clk_src>, diff --git a/arch/arm/boot/dts/qcom/msm8994-camera.dtsi b/arch/arm/boot/dts/qcom/msm8994-camera.dtsi index 1239c7277001c..8c1f58d6c67bc 100644 --- a/arch/arm/boot/dts/qcom/msm8994-camera.dtsi +++ b/arch/arm/boot/dts/qcom/msm8994-camera.dtsi @@ -1,5 +1,5 @@ /* - * Copyright (c) 2014-2015, The Linux Foundation. All rights reserved. + * Copyright (c) 2014-2015, 2017 The Linux Foundation. All rights reserved. * * This program is free software; you can redistribute it and/or modify * it under the terms of the GNU General Public License version 2 and @@ -26,6 +26,9 @@ reg-names = "csiphy", "csiphy_clk_mux"; interrupts = <0 78 0>; interrupt-names = "csiphy"; + qcom,csi-vdd-voltage = <1250000>; + qcom,mipi-csi-vdd-supply = <&pm8994_l2>; + qcom,gdscr-vdd-supply = <&gdsc_camss_top>; clocks = <&clock_mmss clk_camss_top_ahb_clk>, <&clock_mmss clk_camss_ispif_ahb_clk>, <&clock_mmss clk_csi0_clk_src>, @@ -48,6 +51,9 @@ reg-names = "csiphy", "csiphy_clk_mux"; interrupts = <0 79 0>; interrupt-names = "csiphy"; + qcom,csi-vdd-voltage = <1250000>; + qcom,mipi-csi-vdd-supply = <&pm8994_l2>; + qcom,gdscr-vdd-supply = <&gdsc_camss_top>; clocks = <&clock_mmss clk_camss_top_ahb_clk>, <&clock_mmss clk_camss_ispif_ahb_clk>, <&clock_mmss clk_csi1_clk_src>, @@ -70,6 +76,9 @@ reg-names = "csiphy", "csiphy_clk_mux"; interrupts = <0 80 0>; interrupt-names = "csiphy"; + qcom,csi-vdd-voltage = <1250000>; + qcom,mipi-csi-vdd-supply = <&pm8994_l2>; + qcom,gdscr-vdd-supply = <&gdsc_camss_top>; clocks = <&clock_mmss clk_camss_top_ahb_clk>, <&clock_mmss clk_camss_ispif_ahb_clk>, <&clock_mmss clk_csi2_clk_src>, diff --git a/drivers/media/platform/msm/camera_v2/sensor/csiphy/msm_csiphy.c b/drivers/media/platform/msm/camera_v2/sensor/csiphy/msm_csiphy.c index d1bb1160d3de7..58f6e49b9ea20 100644 --- a/drivers/media/platform/msm/camera_v2/sensor/csiphy/msm_csiphy.c +++ b/drivers/media/platform/msm/camera_v2/sensor/csiphy/msm_csiphy.c @@ -1,4 +1,4 @@ -/* Copyright (c) 2011-2014, The Linux Foundation. All rights reserved. +/* Copyright (c) 2011-2014, 2017 The Linux Foundation. All rights reserved. * * This program is free software; you can redistribute it and/or modify * it under the terms of the GNU General Public License version 2 and @@ -37,6 +37,10 @@ #define CLK_LANE_OFFSET 1 #define NUM_LANES_OFFSET 4 +static struct camera_vreg_t csiphy_vreg_info[] = { + {"qcom,mipi-csi-vdd", 0, 0, 12000}, +}; + #undef CDBG #define CDBG(fmt, args...) pr_debug(fmt, ##args) @@ -308,6 +312,35 @@ static int msm_csiphy_init(struct csiphy_device *csiphy_dev) } CDBG("%s:%d called\n", __func__, __LINE__); + rc = msm_camera_config_vreg(&csiphy_dev->pdev->dev, + csiphy_vreg_info, ARRAY_SIZE(csiphy_vreg_info), + NULL, 0, &csiphy_dev->csi_vdd, 1); + if (rc < 0) { + pr_err("%s: regulator config failed\n", __func__); + goto csiphy_vreg_config_fail; + } + rc = msm_camera_enable_vreg(&csiphy_dev->pdev->dev, + csiphy_vreg_info, ARRAY_SIZE(csiphy_vreg_info), + NULL, 0, &csiphy_dev->csi_vdd, 1); + if (rc < 0) { + pr_err("%s: regulator enable failed\n", __func__); + goto csiphy_vreg_enable_fail; + } + + csiphy_dev->reg_ptr = regulator_get(&(csiphy_dev->pdev->dev), + "qcom,gdscr-vdd"); + if (IS_ERR_OR_NULL(csiphy_dev->reg_ptr)) { + pr_err(" %s: Failed in getting TOP gdscr regulator handle", + __func__); + } else { + rc = regulator_enable(csiphy_dev->reg_ptr); + if (rc) { + pr_err(" %s: regulator enable failed for GDSCR\n", + __func__); + goto csiphy_enable_regulator_gdscr_fail; + } + } + if (csiphy_dev->hw_dts_version < CSIPHY_VERSION_V30) { rc = msm_cam_clk_enable(&csiphy_dev->pdev->dev, csiphy_clk_info, csiphy_dev->csiphy_clk, @@ -368,6 +401,20 @@ static int msm_csiphy_init(struct csiphy_device *csiphy_dev) csiphy_dev->hw_version); csiphy_dev->csiphy_state = CSIPHY_POWER_UP; return 0; + +csiphy_enable_regulator_gdscr_fail: + rc = msm_camera_enable_vreg(&csiphy_dev->pdev->dev, + csiphy_vreg_info, ARRAY_SIZE(csiphy_vreg_info), + NULL, 0, &csiphy_dev->csi_vdd, 0); +csiphy_vreg_enable_fail: + rc = msm_camera_config_vreg(&csiphy_dev->pdev->dev, + csiphy_vreg_info, ARRAY_SIZE(csiphy_vreg_info), + NULL, 0, &csiphy_dev->csi_vdd, 0); +csiphy_vreg_config_fail: + iounmap(csiphy_dev->base); + csiphy_dev->base = NULL; + return rc; + } #else static int msm_csiphy_init(struct csiphy_device *csiphy_dev) @@ -403,6 +450,36 @@ static int msm_csiphy_init(struct csiphy_device *csiphy_dev) rc = -ENOMEM; return rc; } + + rc = msm_camera_config_vreg(&csiphy_dev->pdev->dev, + csiphy_vreg_info, ARRAY_SIZE(csiphy_vreg_info), + NULL, 0, &csiphy_dev->csi_vdd, 1); + if (rc < 0) { + pr_err("%s: regulator config failed\n", __func__); + goto csiphy_vreg_config_fail; + } + rc = msm_camera_enable_vreg(&csiphy_dev->pdev->dev, + csiphy_vreg_info, ARRAY_SIZE(csiphy_vreg_info), + NULL, 0, &csiphy_dev->csi_vdd, 1); + if (rc < 0) { + pr_err("%s: regulator enable failed\n", __func__); + goto csiphy_vreg_enable_fail; + } + + csiphy_dev->reg_ptr = regulator_get(&(csiphy_dev->pdev->dev), + "qcom,gdscr-vdd"); + if (IS_ERR_OR_NULL(csiphy_dev->reg_ptr)) { + pr_err(" %s: Failed in getting TOP gdscr regulator handle", + __func__); + } else { + rc = regulator_enable(csiphy_dev->reg_ptr); + if (rc) { + pr_err(" %s: regulator enable failed for GDSCR\n", + __func__); + goto csiphy_enable_regulator_gdscr_fail; + } + } + if (csiphy_dev->hw_dts_version <= CSIPHY_VERSION_V22) { CDBG("%s:%d called\n", __func__, __LINE__); rc = msm_cam_clk_enable(&csiphy_dev->pdev->dev, @@ -461,6 +538,19 @@ static int msm_csiphy_init(struct csiphy_device *csiphy_dev) csiphy_dev->hw_version); csiphy_dev->csiphy_state = CSIPHY_POWER_UP; return 0; + +csiphy_enable_regulator_gdscr_fail: + rc = msm_camera_enable_vreg(&csiphy_dev->pdev->dev, + csiphy_vreg_info, ARRAY_SIZE(csiphy_vreg_info), + NULL, 0, &csiphy_dev->csi_vdd, 0); +csiphy_vreg_enable_fail: + rc = msm_camera_config_vreg(&csiphy_dev->pdev->dev, + csiphy_vreg_info, ARRAY_SIZE(csiphy_vreg_info), + NULL, 0, &csiphy_dev->csi_vdd, 0); +csiphy_vreg_config_fail: + iounmap(csiphy_dev->base); + csiphy_dev->base = NULL; + return rc; } #endif @@ -548,6 +638,19 @@ static int msm_csiphy_release(struct csiphy_device *csiphy_dev, void *arg) csiphy_dev->num_clk, 0); iounmap(csiphy_dev->clk_mux_base); } + + msm_camera_enable_vreg(&csiphy_dev->pdev->dev, + csiphy_vreg_info, ARRAY_SIZE(csiphy_vreg_info), + NULL, 0, &csiphy_dev->csi_vdd, 0); + msm_camera_config_vreg(&csiphy_dev->pdev->dev, + csiphy_vreg_info, ARRAY_SIZE(csiphy_vreg_info), + NULL, 0, &csiphy_dev->csi_vdd, 0); + + if (!IS_ERR_OR_NULL(csiphy_dev->reg_ptr)) { + regulator_disable(csiphy_dev->reg_ptr); + regulator_put(csiphy_dev->reg_ptr); + } + iounmap(csiphy_dev->base); csiphy_dev->base = NULL; csiphy_dev->csiphy_state = CSIPHY_POWER_DOWN; @@ -636,6 +739,18 @@ static int msm_csiphy_release(struct csiphy_device *csiphy_dev, void *arg) iounmap(csiphy_dev->clk_mux_base); } + msm_camera_enable_vreg(&csiphy_dev->pdev->dev, + csiphy_vreg_info, ARRAY_SIZE(csiphy_vreg_info), + NULL, 0, &csiphy_dev->csi_vdd, 0); + msm_camera_config_vreg(&csiphy_dev->pdev->dev, + csiphy_vreg_info, ARRAY_SIZE(csiphy_vreg_info), + NULL, 0, &csiphy_dev->csi_vdd, 0); + + if (!IS_ERR_OR_NULL(csiphy_dev->reg_ptr)) { + regulator_disable(csiphy_dev->reg_ptr); + regulator_put(csiphy_dev->reg_ptr); + } + iounmap(csiphy_dev->base); csiphy_dev->base = NULL; csiphy_dev->csiphy_state = CSIPHY_POWER_DOWN; @@ -825,6 +940,7 @@ static int msm_csiphy_get_clk_info(struct csiphy_device *csiphy_dev, static int csiphy_probe(struct platform_device *pdev) { struct csiphy_device *new_csiphy_dev; + uint32_t csi_vdd_voltage = 0; int rc = 0; new_csiphy_dev = kzalloc(sizeof(struct csiphy_device), GFP_KERNEL); @@ -858,6 +974,19 @@ static int csiphy_probe(struct platform_device *pdev) return -EFAULT; } + rc = of_property_read_u32((&pdev->dev)->of_node, + "qcom,csi-vdd-voltage", &csi_vdd_voltage); + if (rc < 0) { + pr_err("%s:%d failed to read qcom,csi-vdd-voltage\n", + __func__, __LINE__); + return rc; + } + CDBG("%s:%d reading mipi_csi_vdd is %d\n", __func__, __LINE__, + csi_vdd_voltage); + + csiphy_vreg_info[0].min_voltage = csi_vdd_voltage; + csiphy_vreg_info[0].max_voltage = csi_vdd_voltage; + new_csiphy_dev->mem = platform_get_resource_byname(pdev, IORESOURCE_MEM, "csiphy"); if (!new_csiphy_dev->mem) { diff --git a/drivers/media/platform/msm/camera_v2/sensor/csiphy/msm_csiphy.h b/drivers/media/platform/msm/camera_v2/sensor/csiphy/msm_csiphy.h index 174afe1d7a346..8ff3bfee96edd 100644 --- a/drivers/media/platform/msm/camera_v2/sensor/csiphy/msm_csiphy.h +++ b/drivers/media/platform/msm/camera_v2/sensor/csiphy/msm_csiphy.h @@ -1,4 +1,4 @@ -/* Copyright (c) 2011-2014, The Linux Foundation. All rights reserved. +/* Copyright (c) 2011-2014, 2017 The Linux Foundation. All rights reserved. * * This program is free software; you can redistribute it and/or modify * it under the terms of the GNU General Public License version 2 and @@ -84,6 +84,8 @@ struct csiphy_device { uint32_t is_3_1_20nm_hw; uint32_t csiphy_clk_index; uint32_t csiphy_max_clk; + struct regulator *csi_vdd; + struct regulator *reg_ptr; }; #define VIDIOC_MSM_CSIPHY_RELEASE \ From 9cb6bf34f1d004bcf2027c38ac6cb0af0387961f Mon Sep 17 00:00:00 2001 From: Siba Prasad Date: Fri, 28 Apr 2017 11:50:36 +0530 Subject: [PATCH 28/41] mmc: card: block: check the user controlled parameters to avoid overflow According to specs, some commands require a delay after issuing the command. idata->ic struct is received from user in mmc_blk_ioctl_cmd(). So idata->ic.postsleep_min_us, idata->ic.postsleep_max_us are user controlled. If the min and max values are set such as max < min, then operation in the function do_usleep_range will overflow. For avoiding this, put a condition for checking max < min. If the condition is true, then print the error message with respective values and return error. Change-Id: Iaf966d19275741a666d2dae1f0c32b72ab0642eb Signed-off-by: Siba Prasad --- drivers/mmc/card/block.c | 9 +++++++++ 1 file changed, 9 insertions(+) diff --git a/drivers/mmc/card/block.c b/drivers/mmc/card/block.c index 81278aeab5139..cc8dec9e7bfca 100644 --- a/drivers/mmc/card/block.c +++ b/drivers/mmc/card/block.c @@ -677,6 +677,15 @@ static int mmc_blk_ioctl_cmd(struct block_device *bdev, idata = mmc_blk_ioctl_copy_from_user(ic_ptr); if (IS_ERR_OR_NULL(idata)) return PTR_ERR(idata); + if (idata->ic.postsleep_max_us < idata->ic.postsleep_min_us) { + pr_err("%s: min value: %u must not be greater than max value: %u\n", + __func__, idata->ic.postsleep_min_us, + idata->ic.postsleep_max_us); + WARN_ON(1); + err = -EPERM; + goto cmd_err; + } + md = mmc_blk_get(bdev->bd_disk); if (!md) { err = -EINVAL; From 99c22cee0883236ab861341bb454c1330d4def55 Mon Sep 17 00:00:00 2001 From: Gaoxiang Chen Date: Tue, 21 Mar 2017 03:38:19 -0700 Subject: [PATCH 29/41] msm: sensor: validating the flash initialization parameters Copying the flash initialization parameters from userspace memory to kernel memory and in turn checking for the validity of the flash initialization parameters pointer sent from userspace. CRs-Fixed: 1068903 Change-Id: I17d57016c254fb6628844a152b0e7d45c0b23b2d Signed-off-by: Gaoxiang Chen --- .../msm/camera_v2/sensor/flash/msm_flash.c | 38 ++++++++++++++++++- 1 file changed, 37 insertions(+), 1 deletion(-) diff --git a/drivers/media/platform/msm/camera_v2/sensor/flash/msm_flash.c b/drivers/media/platform/msm/camera_v2/sensor/flash/msm_flash.c index 7e89bda7b2a37..3d51dd5b074fb 100644 --- a/drivers/media/platform/msm/camera_v2/sensor/flash/msm_flash.c +++ b/drivers/media/platform/msm/camera_v2/sensor/flash/msm_flash.c @@ -496,6 +496,42 @@ static int32_t msm_flash_init( return 0; } +#ifdef CONFIG_COMPAT +static int32_t msm_flash_init_prepare( + struct msm_flash_ctrl_t *flash_ctrl, + struct msm_flash_cfg_data_t *flash_data) +{ + return msm_flash_init(flash_ctrl, flash_data); +} +#else +static int32_t msm_flash_init_prepare( + struct msm_flash_ctrl_t *flash_ctrl, + struct msm_flash_cfg_data_t *flash_data) +{ + struct msm_flash_cfg_data_t flash_data_k; + struct msm_flash_init_info_t flash_init_info; + int32_t i = 0; + + flash_data_k.cfg_type = flash_data->cfg_type; + for (i = 0; i < MAX_LED_TRIGGERS; i++) { + flash_data_k.flash_current[i] = + flash_data->flash_current[i]; + flash_data_k.flash_duration[i] = + flash_data->flash_duration[i]; + } + + flash_data_k.cfg.flash_init_info = &flash_init_info; + if (copy_from_user(&flash_init_info, + (void *)(flash_data->cfg.flash_init_info), + sizeof(struct msm_flash_init_info_t))) { + pr_err("%s copy_from_user failed %d\n", + __func__, __LINE__); + return -EFAULT; + } + return msm_flash_init(flash_ctrl, &flash_data_k); +} +#endif + static int32_t msm_flash_low( struct msm_flash_ctrl_t *flash_ctrl, struct msm_flash_cfg_data_t *flash_data) @@ -599,7 +635,7 @@ static int32_t msm_flash_config(struct msm_flash_ctrl_t *flash_ctrl, switch (flash_data->cfg_type) { case CFG_FLASH_INIT: - rc = msm_flash_init(flash_ctrl, flash_data); + rc = msm_flash_init_prepare(flash_ctrl, flash_data); break; case CFG_FLASH_RELEASE: if (flash_ctrl->flash_state == MSM_CAMERA_FLASH_INIT) From f63fcba2e13a44fd08d0bedea60cf631cb039f5f Mon Sep 17 00:00:00 2001 From: Kamal Negi Date: Tue, 2 May 2017 12:44:32 +0530 Subject: [PATCH 30/41] radio-iris: Use copy_from_user API to access userspace memory Directly accessing userspace memory pointer in kernel space without checking validity of pointer. This can lead to security vulnerability. Use copy_from_user API's to make sure there is no illegal memory access. Change-Id: I66a0b1931814ee19634a30dee02a5600066aa70b Signed-off-by: Kamal Negi --- drivers/media/radio/radio-iris.c | 16 +++++++++++++--- 1 file changed, 13 insertions(+), 3 deletions(-) diff --git a/drivers/media/radio/radio-iris.c b/drivers/media/radio/radio-iris.c index 601a93c06495a..5c39f4e3c78cf 100644 --- a/drivers/media/radio/radio-iris.c +++ b/drivers/media/radio/radio-iris.c @@ -3658,6 +3658,7 @@ static int iris_vidioc_s_ext_ctrls(struct file *file, void *priv, struct hci_fm_set_cal_req_proc proc_cal_req; struct hci_fm_set_spur_table_req spur_tbl_req; char *spur_data; + char tmp_buf[2]; struct iris_device *radio = video_get_drvdata(video_devdata(file)); char *data = NULL; @@ -3796,9 +3797,18 @@ static int iris_vidioc_s_ext_ctrls(struct file *file, void *priv, case V4L2_CID_PRIVATE_IRIS_SET_SPURTABLE: memset(&spur_tbl_req, 0, sizeof(spur_tbl_req)); data = (ctrl->controls[0]).string; - bytes_to_copy = (ctrl->controls[0]).size; - spur_tbl_req.mode = data[0]; - spur_tbl_req.no_of_freqs_entries = data[1]; + if (copy_from_user(&bytes_to_copy, &((ctrl->controls[0]).size), + sizeof(bytes_to_copy))) { + retval = -EFAULT; + goto END; + } + if (copy_from_user(&tmp_buf[0], &data[0], + sizeof(tmp_buf))) { + retval = -EFAULT; + goto END; + } + spur_tbl_req.mode = tmp_buf[0]; + spur_tbl_req.no_of_freqs_entries = tmp_buf[1]; if (((spur_tbl_req.no_of_freqs_entries * SPUR_DATA_LEN) != bytes_to_copy - 2) || From a4a0d245cb27ebe5613983e8d9a9a1f34cf7b17a Mon Sep 17 00:00:00 2001 From: Siena Richard Date: Wed, 26 Apr 2017 11:18:15 -0700 Subject: [PATCH 31/41] ASoC: msm: qdsp6v2: clear address on error Set address to NULL on error to ensure a stale address is not used. CRs-Fixed: 2038685 Signed-off-by: Siena Richard Change-Id: I17e7b7b404625d21721b2466e70fa8be2370b517 --- sound/soc/msm/qdsp6v2/audio_cal_utils.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/sound/soc/msm/qdsp6v2/audio_cal_utils.c b/sound/soc/msm/qdsp6v2/audio_cal_utils.c index 279636eef02ca..625c8495ea19d 100644 --- a/sound/soc/msm/qdsp6v2/audio_cal_utils.c +++ b/sound/soc/msm/qdsp6v2/audio_cal_utils.c @@ -574,7 +574,9 @@ static struct cal_block_data *create_cal_block(struct cal_type_data *cal_type, return cal_block; err: kfree(cal_block->cal_info); + cal_block->cal_info = NULL; kfree(cal_block->client_info); + cal_block->client_info = NULL; kfree(cal_block); cal_block = NULL; return cal_block; From 8e22f435088dc48d84a16c79d987b8d56c01a634 Mon Sep 17 00:00:00 2001 From: Trishansh Bhardwaj Date: Fri, 7 Apr 2017 11:16:29 +0530 Subject: [PATCH 32/41] msm: camera: Allow driver file to be opend only once. Use proper synchronization to ensure driver file is opened only once. CRs-Fixed: 2023513 Change-Id: I71e55e2d487fe561d3f596590b3e8102c5e921b5 Signed-off-by: Trishansh Bhardwaj --- drivers/media/platform/msm/camera_v2/msm.c | 6 ++---- 1 file changed, 2 insertions(+), 4 deletions(-) diff --git a/drivers/media/platform/msm/camera_v2/msm.c b/drivers/media/platform/msm/camera_v2/msm.c index b76bdc3afd525..6f1c7ffdeebf8 100644 --- a/drivers/media/platform/msm/camera_v2/msm.c +++ b/drivers/media/platform/msm/camera_v2/msm.c @@ -1,4 +1,4 @@ -/* Copyright (c) 2012-2015, The Linux Foundation. All rights reserved. +/* Copyright (c) 2012-2015, 2017 The Linux Foundation. All rights reserved. * * This program is free software; you can redistribute it and/or modify * it under the terms of the GNU General Public License version 2 and @@ -844,11 +844,9 @@ static int msm_open(struct file *filep) BUG_ON(!pvdev); /* !!! only ONE open is allowed !!! */ - if (atomic_read(&pvdev->opened)) + if (atomic_cmpxchg(&pvdev->opened, 0, 1)) return -EBUSY; - atomic_set(&pvdev->opened, 1); - spin_lock_irqsave(&msm_pid_lock, flags); msm_pid = get_pid(task_pid(current)); spin_unlock_irqrestore(&msm_pid_lock, flags); From 7f1ca48c82d91d250588cb56b84b51d0cb8a31d5 Mon Sep 17 00:00:00 2001 From: Andy Whitcroft Date: Wed, 22 Mar 2017 07:29:31 +0000 Subject: [PATCH 33/41] xfrm_user: validate XFRM_MSG_NEWAE XFRMA_REPLAY_ESN_VAL replay_window When a new xfrm state is created during an XFRM_MSG_NEWSA call we validate the user supplied replay_esn to ensure that the size is valid and to ensure that the replay_window size is within the allocated buffer. However later it is possible to update this replay_esn via a XFRM_MSG_NEWAE call. There we again validate the size of the supplied buffer matches the existing state and if so inject the contents. We do not at this point check that the replay_window is within the allocated memory. This leads to out-of-bounds reads and writes triggered by netlink packets. This leads to memory corruption and the potential for privilege escalation. We already attempt to validate the incoming replay information in xfrm_new_ae() via xfrm_replay_verify_len(). This confirms that the user is not trying to change the size of the replay state buffer which includes the replay_esn. It however does not check the replay_window remains within that buffer. Add validation of the contained replay_window. CVE-2017-7184 Signed-off-by: Andy Whitcroft Acked-by: Steffen Klassert Signed-off-by: Linus Torvalds Change-Id: Ifc8055e9d3ee94c3e017f1f9b0be06cd171844a6 Git-repo: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git Git-commit: 677e806da4d916052585301785d847c3b3e6186a Signed-off-by: Dennis Cagle --- net/xfrm/xfrm_user.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/net/xfrm/xfrm_user.c b/net/xfrm/xfrm_user.c index 7a70a5a5671aa..8b55d42076d2a 100644 --- a/net/xfrm/xfrm_user.c +++ b/net/xfrm/xfrm_user.c @@ -393,6 +393,9 @@ static inline int xfrm_replay_verify_len(struct xfrm_replay_state_esn *replay_es if (nla_len(rp) < ulen || xfrm_replay_state_esn_len(replay_esn) != ulen) return -EINVAL; + if (up->replay_window > up->bmp_len * sizeof(__u32) * 8) + return -EINVAL; + return 0; } From 9fcd5941344362778fe3fef0e928cca9be9e024c Mon Sep 17 00:00:00 2001 From: Andy Whitcroft Date: Thu, 23 Mar 2017 07:45:44 +0000 Subject: [PATCH 34/41] xfrm_user: validate XFRM_MSG_NEWAE incoming ESN size harder Kees Cook has pointed out that xfrm_replay_state_esn_len() is subject to wrapping issues. To ensure we are correctly ensuring that the two ESN structures are the same size compare both the overall size as reported by xfrm_replay_state_esn_len() and the internal length are the same. CVE-2017-7184 Signed-off-by: Andy Whitcroft Acked-by: Steffen Klassert Signed-off-by: Linus Torvalds Change-Id: I035fb0bbb9449fc999d83302c8343b0700316229 Git-repo: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git Git-commit: f843ee6dd019bcece3e74e76ad9df0155655d0df Signed-off-by: Dennis Cagle --- net/xfrm/xfrm_user.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/net/xfrm/xfrm_user.c b/net/xfrm/xfrm_user.c index 8b55d42076d2a..c7dac1759658f 100644 --- a/net/xfrm/xfrm_user.c +++ b/net/xfrm/xfrm_user.c @@ -390,7 +390,12 @@ static inline int xfrm_replay_verify_len(struct xfrm_replay_state_esn *replay_es up = nla_data(rp); ulen = xfrm_replay_state_esn_len(up); - if (nla_len(rp) < ulen || xfrm_replay_state_esn_len(replay_esn) != ulen) + /* Check the overall length and the internal bitmap length to avoid + * potential overflow. + */ + if (nla_len(rp) < ulen || + xfrm_replay_state_esn_len(replay_esn) != ulen || + replay_esn->bmp_len != up->bmp_len) return -EINVAL; if (up->replay_window > up->bmp_len * sizeof(__u32) * 8) From f29f1c2c2c618bfe1e39e080203922acba2cb438 Mon Sep 17 00:00:00 2001 From: Robb Glasser Date: Tue, 14 Feb 2017 13:25:46 -0800 Subject: [PATCH 35/41] Prevent heap overflow in uvc driver The size of uvc_control_mapping is user controlled leading to a potential heap overflow in the uvc driver. This adds a check to verify the user provided size fits within the bounds of the defined buffer size. Bug: 33300353 Change-Id: If29c1b396633b6137966a12e38f6fd1841b045bd Signed-off-by: Robb Glasser Git-repo: https://android.googlesource.com/kernel/msm Git-commit: 8bc3ec72a02052187397d0de1a7b8bbe7340451c Signed-off-by: Dennis Cagle --- drivers/media/usb/uvc/uvc_ctrl.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/drivers/media/usb/uvc/uvc_ctrl.c b/drivers/media/usb/uvc/uvc_ctrl.c index a2f4501c23ca3..f61d1d7ba7656 100644 --- a/drivers/media/usb/uvc/uvc_ctrl.c +++ b/drivers/media/usb/uvc/uvc_ctrl.c @@ -1939,6 +1939,9 @@ int uvc_ctrl_add_mapping(struct uvc_video_chain *chain, if (!found) return -ENOENT; + if (ctrl->info.size < mapping->size) + return -EINVAL; + if (mutex_lock_interruptible(&chain->ctrl_mutex)) return -ERESTARTSYS; From 4ee2ddbbd7a9e0ca1bca3bd19f3541afaf247ba1 Mon Sep 17 00:00:00 2001 From: Nick Desaulniers Date: Fri, 3 Mar 2017 15:40:12 -0800 Subject: [PATCH 36/41] tracing: do not leak kernel addresses This likely breaks tracing tools like trace-cmd. It logs in the same format but now addresses are all 0x0. Bug: 34277115 Change-Id: Ifb0d4d2a184bf0d95726de05b1acee0287a375d9 Git-repo: https://android.googlesource.com/kernel/msm Git-commit: 9ad8f2cc1bb73a3e2255dff4ee9c45c909869225 Signed-off-by: Srinivasa Rao Kuppala --- kernel/trace/trace_printk.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/kernel/trace/trace_printk.c b/kernel/trace/trace_printk.c index a9077c1b4ad3f..d492b1b5e87a1 100644 --- a/kernel/trace/trace_printk.c +++ b/kernel/trace/trace_printk.c @@ -272,7 +272,7 @@ static int t_show(struct seq_file *m, void *v) const char *str = *fmt; int i; - seq_printf(m, "0x%lx : \"", *(unsigned long *)fmt); + seq_printf(m, "0x%lx : \"", 0L); /* * Tabs and new lines need to be converted. From 71a578bf49d8593d4d685a834a876b51c7678921 Mon Sep 17 00:00:00 2001 From: Takashi Iwai Date: Mon, 12 Dec 2016 17:33:06 +0100 Subject: [PATCH 37/41] ALSA: pcm : Call kill_fasync() in stream lock Currently kill_fasync() is called outside the stream lock in snd_pcm_period_elapsed(). This is potentially racy, since the stream may get released even during the irq handler is running. Although snd_pcm_release_substream() calls snd_pcm_drop(), this doesn't guarantee that the irq handler finishes, thus the kill_fasync() call outside the stream spin lock may be invoked after the substream is detached, as recently reported by KASAN. As a quick workaround, move kill_fasync() call inside the stream lock. The fasync is rarely used interface, so this shouldn't have a big impact from the performance POV. Ideally, we should implement some sync mechanism for the proper finish of stream and irq handler. But this oneliner should suffice for most cases, so far. Change-Id: I6e50dfd91d6f8888a089d8bc29e1331c5e013a66 Reported-by: Baozeng Ding Signed-off-by: Takashi Iwai Signed-off-by: Willy Tarreau Git-repo: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable.git Git-commit: a27178e05b7c332522df40904f27674e36ee3757 Signed-off-by: Dennis Cagle --- sound/core/pcm_lib.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/sound/core/pcm_lib.c b/sound/core/pcm_lib.c index d80963097e774..46bf55e351c45 100644 --- a/sound/core/pcm_lib.c +++ b/sound/core/pcm_lib.c @@ -1870,10 +1870,10 @@ void snd_pcm_period_elapsed(struct snd_pcm_substream *substream) if (substream->timer_running) snd_timer_interrupt(substream->timer, 1); _end: + kill_fasync(&runtime->fasync, SIGIO, POLL_IN); snd_pcm_stream_unlock_irqrestore(substream, flags); if (runtime->transfer_ack_end) runtime->transfer_ack_end(substream); - kill_fasync(&runtime->fasync, SIGIO, POLL_IN); } EXPORT_SYMBOL(snd_pcm_period_elapsed); From 21d422eeccfc301abad0db6b29f973ca82780650 Mon Sep 17 00:00:00 2001 From: Ravi kumar Koyyana Date: Tue, 11 Apr 2017 18:47:44 -0700 Subject: [PATCH 38/41] msm: camera2: cpp: Fix out-of-bounds frame or command buffer access When user application provides invalid (out of range) stripe size and stripe indices, while submitting requests for the stripe based image processing by the CPP kernel driver, the driver could perform out of bounds access of the internal buffers. This fix ensures that stripe size and indices of frame/command buffer are properly validated during the configuration and before processing such requests through the CPP hardware block. CRs-fixed: 2002207 Change-Id: Ib79e36fb507d8e75d8fc28afb990020a0e1bf845 Signed-off-by: Ravi kumar Koyyana --- .../msm/camera_v2/pproc/cpp/msm_cpp.c | 28 ++++++++++++++++--- 1 file changed, 24 insertions(+), 4 deletions(-) diff --git a/drivers/media/platform/msm/camera_v2/pproc/cpp/msm_cpp.c b/drivers/media/platform/msm/camera_v2/pproc/cpp/msm_cpp.c index 908b4a9627c20..6052777dbb1eb 100644 --- a/drivers/media/platform/msm/camera_v2/pproc/cpp/msm_cpp.c +++ b/drivers/media/platform/msm/camera_v2/pproc/cpp/msm_cpp.c @@ -1926,9 +1926,29 @@ static int msm_cpp_cfg_frame(struct cpp_device *cpp_dev, return -EINVAL; } - if (stripe_base == UINT_MAX || new_frame->num_strips > - (UINT_MAX - 1 - stripe_base) / stripe_size) { - pr_err("Invalid frame message,num_strips %d is large\n", + /* Stripe index starts at zero */ + if ((!new_frame->num_strips) || + (new_frame->first_stripe_index >= new_frame->num_strips) || + (new_frame->last_stripe_index >= new_frame->num_strips) || + (new_frame->first_stripe_index > + new_frame->last_stripe_index)) { + pr_err("Invalid frame message, #stripes=%d, stripe indices=[%d,%d]\n", + new_frame->num_strips, + new_frame->first_stripe_index, + new_frame->last_stripe_index); + return -EINVAL; + } + + if (!stripe_size) { + pr_err("Invalid frame message, invalid stripe_size (%d)!\n", + stripe_size); + return -EINVAL; + } + + if ((stripe_base == UINT_MAX) || + (new_frame->num_strips > + (UINT_MAX - 1 - stripe_base) / stripe_size)) { + pr_err("Invalid frame message, num_strips %d is large\n", new_frame->num_strips); return -EINVAL; } @@ -2202,7 +2222,7 @@ static int msm_cpp_cfg(struct cpp_device *cpp_dev, if (copy_from_user(&k_frame_info, (void __user *)ioctl_ptr->ioctl_ptr, sizeof(k_frame_info))) - return -EFAULT; + return -EFAULT; frame = msm_cpp_get_frame(ioctl_ptr); if (!frame) { From d76e79b05266f4661f028277f82c403c6e803408 Mon Sep 17 00:00:00 2001 From: Gaoxiang Chen Date: Fri, 31 Mar 2017 14:28:33 +0800 Subject: [PATCH 39/41] msm: camera: don't cut to 8bits for validating enum variable In msm_ispif_is_intf_valid(), we convert a enum variable msm_ispif_vfe_intf, to uint8_t type for validating. This could cause potential issue, if the value is crafted in such a way that lower 8bits pass the validation. Don't use uint8_t as input parm to avoid such vulnerability. CRs-Fixed: 2008469 Change-Id: I4ee400ac0edd830decfbe5712966d968976a268a Signed-off-by: Gaoxiang Chen --- .../media/platform/msm/camera_v2/ispif/msm_ispif.c | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-) diff --git a/drivers/media/platform/msm/camera_v2/ispif/msm_ispif.c b/drivers/media/platform/msm/camera_v2/ispif/msm_ispif.c index 4e07d4d0dc876..8409a6458e93c 100644 --- a/drivers/media/platform/msm/camera_v2/ispif/msm_ispif.c +++ b/drivers/media/platform/msm/camera_v2/ispif/msm_ispif.c @@ -64,7 +64,7 @@ static void msm_ispif_io_dump_reg(struct ispif_device *ispif) static inline int msm_ispif_is_intf_valid(uint32_t csid_version, - uint8_t intf_type) + enum msm_ispif_vfe_intf intf_type) { return ((csid_version <= CSID_VERSION_V22 && intf_type != VFE0) || (intf_type >= VFE_MAX)) ? false : true; @@ -347,7 +347,7 @@ static int msm_ispif_subdev_g_chip_ident(struct v4l2_subdev *sd, } static void msm_ispif_sel_csid_core(struct ispif_device *ispif, - uint8_t intftype, uint8_t csid, uint8_t vfe_intf) + uint8_t intftype, uint8_t csid, enum msm_ispif_vfe_intf vfe_intf) { uint32_t data; @@ -387,7 +387,7 @@ static void msm_ispif_sel_csid_core(struct ispif_device *ispif, } static void msm_ispif_enable_crop(struct ispif_device *ispif, - uint8_t intftype, uint8_t vfe_intf, uint16_t start_pixel, + uint8_t intftype, enum msm_ispif_vfe_intf vfe_intf, uint16_t start_pixel, uint16_t end_pixel) { uint32_t data; @@ -419,7 +419,7 @@ static void msm_ispif_enable_crop(struct ispif_device *ispif, } static void msm_ispif_enable_intf_cids(struct ispif_device *ispif, - uint8_t intftype, uint16_t cid_mask, uint8_t vfe_intf, uint8_t enable) + uint8_t intftype, uint16_t cid_mask, enum msm_ispif_vfe_intf vfe_intf, uint8_t enable) { uint32_t intf_addr, data; @@ -461,7 +461,7 @@ static void msm_ispif_enable_intf_cids(struct ispif_device *ispif, } static int msm_ispif_validate_intf_status(struct ispif_device *ispif, - uint8_t intftype, uint8_t vfe_intf) + uint8_t intftype, enum msm_ispif_vfe_intf vfe_intf) { int rc = 0; uint32_t data = 0; @@ -501,7 +501,7 @@ static int msm_ispif_validate_intf_status(struct ispif_device *ispif, } static void msm_ispif_select_clk_mux(struct ispif_device *ispif, - uint8_t intftype, uint8_t csid, uint8_t vfe_intf) + uint8_t intftype, uint8_t csid, enum msm_ispif_vfe_intf vfe_intf) { uint32_t data = 0; From 30083e24721a693a3648f7ef8e05bcd15502027a Mon Sep 17 00:00:00 2001 From: Sunil Khatri Date: Tue, 2 May 2017 19:21:34 +0530 Subject: [PATCH 40/41] msm: kgsl: Fix kgsl memory allocation and free race condition When allocating userspace memory keep reference to memory allocation till it is completely initialized and info is send back to userspace Change-Id: Id72c82bf98c094ecbd4722813c732a998dcbb188 Signed-off-by: Tarun Karra Signed-off-by: Sunil Khatri --- drivers/gpu/msm/kgsl.c | 16 ++++++++++++++-- 1 file changed, 14 insertions(+), 2 deletions(-) diff --git a/drivers/gpu/msm/kgsl.c b/drivers/gpu/msm/kgsl.c index fcbc9fb690bf7..7e9bb19adc931 100644 --- a/drivers/gpu/msm/kgsl.c +++ b/drivers/gpu/msm/kgsl.c @@ -1,4 +1,4 @@ -/* Copyright (c) 2008-2016, The Linux Foundation. All rights reserved. +/* Copyright (c) 2008-2017, The Linux Foundation. All rights reserved. * * This program is free software; you can redistribute it and/or modify * it under the terms of the GNU General Public License version 2 and @@ -209,8 +209,11 @@ kgsl_mem_entry_create(void) { struct kgsl_mem_entry *entry = kzalloc(sizeof(*entry), GFP_KERNEL); - if (entry) + if (entry) { kref_init(&entry->refcount); + /* put this ref in the caller functions after init */ + kref_get(&entry->refcount); + } return entry; } @@ -3270,6 +3273,9 @@ long kgsl_ioctl_map_user_mem(struct kgsl_device_private *dev_priv, trace_kgsl_mem_map(entry, param->fd); kgsl_mem_entry_commit_process(private, entry); + + /* put the extra refcount for kgsl_mem_entry_create() */ + kgsl_mem_entry_put(entry); return result; error_attach: @@ -3626,6 +3632,9 @@ long kgsl_ioctl_gpumem_alloc(struct kgsl_device_private *dev_priv, param->flags = entry->memdesc.flags; kgsl_mem_entry_commit_process(private, entry); + + /* put the extra refcount for kgsl_mem_entry_create() */ + kgsl_mem_entry_put(entry); return result; err: kgsl_sharedmem_free(&entry->memdesc); @@ -3673,6 +3682,9 @@ long kgsl_ioctl_gpumem_alloc_id(struct kgsl_device_private *dev_priv, param->gpuaddr = entry->memdesc.gpuaddr; kgsl_mem_entry_commit_process(private, entry); + + /* put the extra refcount for kgsl_mem_entry_create() */ + kgsl_mem_entry_put(entry); return result; err: if (entry) From 43cfd3d4defec07e7f6fbd590566cd9dba9d1eb4 Mon Sep 17 00:00:00 2001 From: Ravi kumar Koyyana Date: Mon, 27 Mar 2017 17:44:36 -0700 Subject: [PATCH 41/41] msm: camera2: cpp: Fix iommu_attach/detach compat_ioctl issue When the Camera application exercises the V4L2 ioctl operations, CPP driver would attempt to the copy user space buffer contents into the internal kernel buffer. If an invalid length of the user space buffer is passed onto the driver, it could trigger buffer overflow condition. Thus, fix this by copying user space buffer contents into kernel space buffer of the driver for further processing, only after checking for proper length of user space buffer. CRs-fixed: 2025367 Change-Id: I85cf4a961884c7bb0d036299b886044aef7baf7c Signed-off-by: Ravi kumar Koyyana --- .../msm/camera_v2/pproc/cpp/msm_cpp.c | 52 +++++++++++++++++-- 1 file changed, 47 insertions(+), 5 deletions(-) diff --git a/drivers/media/platform/msm/camera_v2/pproc/cpp/msm_cpp.c b/drivers/media/platform/msm/camera_v2/pproc/cpp/msm_cpp.c index 6052777dbb1eb..b5bf95f4270cf 100644 --- a/drivers/media/platform/msm/camera_v2/pproc/cpp/msm_cpp.c +++ b/drivers/media/platform/msm/camera_v2/pproc/cpp/msm_cpp.c @@ -2304,15 +2304,43 @@ static int msm_cpp_copy_from_ioctl_ptr(void *dst_ptr, } #endif + +static int msm_cpp_validate_ioctl_input(unsigned int cmd, void *arg, + struct msm_camera_v4l2_ioctl_t **ioctl_ptr) +{ + switch (cmd) { + case MSM_SD_SHUTDOWN: + case VIDIOC_MSM_CPP_IOMMU_ATTACH: + case VIDIOC_MSM_CPP_IOMMU_DETACH: + break; + default: { + if (ioctl_ptr == NULL) { + pr_err("Wrong ioctl_ptr for cmd %u\n", cmd); + return -EINVAL; + } + + *ioctl_ptr = arg; + if (((*ioctl_ptr) == NULL) || + ((*ioctl_ptr)->ioctl_ptr == NULL) || + ((*ioctl_ptr)->len == 0)) { + pr_err("Error invalid ioctl argument cmd %u", cmd); + return -EINVAL; + } + break; + } + } + return 0; +} + long msm_cpp_subdev_ioctl(struct v4l2_subdev *sd, unsigned int cmd, void *arg) { struct cpp_device *cpp_dev = NULL; - struct msm_camera_v4l2_ioctl_t *ioctl_ptr = arg; + struct msm_camera_v4l2_ioctl_t *ioctl_ptr = NULL; int rc = 0; - if ((sd == NULL) || (ioctl_ptr == NULL)) { - pr_err("Wrong ioctl_ptr %p, sd %p\n", ioctl_ptr, sd); + if (sd == NULL) { + pr_err("sd %pK\n", sd); return -EINVAL; } @@ -2321,6 +2349,12 @@ long msm_cpp_subdev_ioctl(struct v4l2_subdev *sd, return -EINVAL; } + rc = msm_cpp_validate_ioctl_input(cmd, arg, &ioctl_ptr); + if (rc != 0) { + pr_err("input validation failed\n"); + return rc; + } + cpp_dev = v4l2_get_subdevdata(sd); if (cpp_dev == NULL) { pr_err("cpp_dev is null\n"); @@ -2758,6 +2792,7 @@ long msm_cpp_subdev_ioctl(struct v4l2_subdev *sd, pr_err("%s:%dError iommu_attach_device failed\n", __func__, __LINE__); rc = -EINVAL; + break; } cpp_dev->iommu_state = CPP_IOMMU_STATE_ATTACHED; } else { @@ -2772,10 +2807,17 @@ long msm_cpp_subdev_ioctl(struct v4l2_subdev *sd, (cpp_dev->stream_cnt == 0)) { iommu_detach_device(cpp_dev->domain, cpp_dev->iommu_ctx); + if (rc < 0) { + pr_err("%s:%dError iommu detach failed\n", + __func__, __LINE__); + rc = -EINVAL; + break; + } cpp_dev->iommu_state = CPP_IOMMU_STATE_DETACHED; } else { pr_err("%s:%d IOMMMU attach triggered in invalid state\n", __func__, __LINE__); + rc = -EINVAL; } break; } @@ -3386,7 +3428,7 @@ static long msm_cpp_subdev_fops_compat_ioctl(struct file *file, default: pr_err_ratelimited("%s: unsupported compat type :%x LOAD %lu\n", __func__, cmd, VIDIOC_MSM_CPP_LOAD_FIRMWARE); - break; + return -EINVAL; } switch (cmd) { @@ -3412,7 +3454,7 @@ static long msm_cpp_subdev_fops_compat_ioctl(struct file *file, default: pr_err_ratelimited("%s: unsupported compat type :%d\n", __func__, cmd); - break; + return -EINVAL; } if (is_copytouser_req) {