Loading drivers/mailbox/qti-tcs.c +27 −11 Original line number Diff line number Diff line Loading @@ -253,7 +253,6 @@ static inline struct tcs_response *get_response(struct tcs_drv *drv, u32 m, break; } pos++; udelay(1); } while (1); spin_unlock_irqrestore(&pool->lock, flags); Loading Loading @@ -455,8 +454,10 @@ static irqreturn_t tcs_irq_handler(int irq, void *p) sts = read_tcs_reg(base, TCS_DRV_CMD_STATUS, m, i); if ((!(sts & CMD_STATUS_ISSUED)) || ((resp->msg->is_complete || cmd->complete) && (!(sts & CMD_STATUS_COMPL)))) (!(sts & CMD_STATUS_COMPL)))) { resp->err = -EIO; break; } } /* Check for response if this was a read request */ Loading Loading @@ -697,7 +698,8 @@ static int find_slots(struct tcs_mbox *tcs, struct tcs_mbox_msg *msg) int n = 0; /* For active requests find the first free AMC. */ if (tcs->type == ACTIVE_TCS) if (msg->state == RPMH_ACTIVE_ONLY_STATE || msg->state == RPMH_AWAKE_STATE) return find_free_tcs(tcs); /* Find if we already have the msg in our TCS */ Loading Loading @@ -810,6 +812,10 @@ static int tcs_mbox_invalidate(struct mbox_chan *chan) spin_lock_irqsave(&tcs->tcs_lock, flags); for (i = 0; i < tcs->num_tcs; i++) { m = i + tcs->tcs_offset; if (!tcs_is_free(drv, m)) { spin_unlock_irqrestore(&tcs->tcs_lock, flags); return -EBUSY; } __tcs_buffer_invalidate(drv->reg_base, m); } /* Mark the TCS as free */ Loading Loading @@ -896,7 +902,8 @@ static int chan_tcs_write(struct mbox_chan *chan, void *data) goto tx_fail; } if (!msg->payload || msg->num_payload > MAX_RPMH_PAYLOAD) { if (!msg->payload || !msg->num_payload || msg->num_payload > MAX_RPMH_PAYLOAD) { dev_err(dev, "Payload error\n"); ret = -EINVAL; goto tx_fail; Loading Loading @@ -926,8 +933,11 @@ static int chan_tcs_write(struct mbox_chan *chan, void *data) * Since we are re-purposing the wake TCS, invalidate previous * contents to avoid confusion. */ if (msg->state == RPMH_AWAKE_STATE) tcs_mbox_invalidate(chan); if (msg->state == RPMH_AWAKE_STATE) { ret = tcs_mbox_invalidate(chan); if (ret) goto tx_fail; } /* Post the message to the TCS and trigger */ ret = tcs_mbox_write(chan, msg, true); Loading @@ -939,8 +949,10 @@ static int chan_tcs_write(struct mbox_chan *chan, void *data) drv, msg, chan, TCS_M_INIT, ret); dev_err(dev, "Error sending RPMH message %d\n", ret); if (resp) if (!IS_ERR(resp)) send_tcs_response(resp); else dev_err(dev, "No response object %ld\n", PTR_ERR(resp)); ret = 0; } Loading Loading @@ -1007,7 +1019,8 @@ static int chan_tcs_ctrl_write(struct mbox_chan *chan, void *data) goto tx_done; } if (msg->num_payload > MAX_RPMH_PAYLOAD) { if (!msg->payload || (!msg->num_payload && !msg->invalidate) || msg->num_payload > MAX_RPMH_PAYLOAD) { dev_err(dev, "Payload error\n"); goto tx_done; } Loading Loading @@ -1147,7 +1160,8 @@ static int tcs_drv_probe(struct platform_device *pdev) if (tcs->num_tcs > MAX_TCS_PER_TYPE) return -EINVAL; if (st > max_tcs) if (st + tcs->num_tcs > max_tcs && st + tcs->num_tcs >= sizeof(tcs->tcs_mask)) return -EINVAL; tcs->tcs_mask = ((1 << tcs->num_tcs) - 1) << st; Loading @@ -1169,10 +1183,12 @@ static int tcs_drv_probe(struct platform_device *pdev) for (j = 0; j < i; j++) { ret = of_parse_phandle_with_args(np, "mboxes", "#mbox-cells", j, &p); if (!ret && p.np == pdev->dev.of_node) of_node_put(p.np); if (!ret && p.np == pdev->dev.of_node) { num_chans++; break; } num_chans++; } } if (!num_chans) { Loading drivers/soc/qcom/rpmh.c +6 −4 Original line number Diff line number Diff line Loading @@ -530,7 +530,7 @@ EXPORT_SYMBOL(rpmh_write); int rpmh_write_passthru(struct rpmh_client *rc, enum rpmh_state state, struct tcs_cmd *cmd, int *n) { struct rpmh_msg *rpm_msg[RPMH_MAX_REQ_IN_BATCH]; struct rpmh_msg *rpm_msg[RPMH_MAX_REQ_IN_BATCH] = { NULL }; DECLARE_COMPLETION_ONSTACK(compl); atomic_t wait_count = ATOMIC_INIT(0); /* overwritten */ int count = 0; Loading @@ -548,7 +548,7 @@ int rpmh_write_passthru(struct rpmh_client *rc, enum rpmh_state state, if (ret) return ret; while (n[count++]) while (n[count++] > 0) ; count--; if (!count || count > RPMH_MAX_REQ_IN_BATCH) Loading Loading @@ -674,7 +674,7 @@ int rpmh_write_control(struct rpmh_client *rc, struct tcs_cmd *cmd, int n) { DEFINE_RPMH_MSG_ONSTACK(rc, 0, NULL, NULL, rpm_msg); if (IS_ERR_OR_NULL(rc) || n > MAX_RPMH_PAYLOAD) if (IS_ERR_OR_NULL(rc) || n <= 0 || n > MAX_RPMH_PAYLOAD) return -EINVAL; if (rpmh_standalone) Loading Loading @@ -906,8 +906,10 @@ static struct rpmh_mbox *get_mbox(struct platform_device *pdev, rpmh->msg_pool = kzalloc(sizeof(struct rpmh_msg) * RPMH_MAX_FAST_RES, GFP_KERNEL); if (!rpmh->msg_pool) if (!rpmh->msg_pool) { of_node_put(spec.np); return ERR_PTR(-ENOMEM); } rpmh->mbox_dn = spec.np; INIT_LIST_HEAD(&rpmh->resources); Loading Loading
drivers/mailbox/qti-tcs.c +27 −11 Original line number Diff line number Diff line Loading @@ -253,7 +253,6 @@ static inline struct tcs_response *get_response(struct tcs_drv *drv, u32 m, break; } pos++; udelay(1); } while (1); spin_unlock_irqrestore(&pool->lock, flags); Loading Loading @@ -455,8 +454,10 @@ static irqreturn_t tcs_irq_handler(int irq, void *p) sts = read_tcs_reg(base, TCS_DRV_CMD_STATUS, m, i); if ((!(sts & CMD_STATUS_ISSUED)) || ((resp->msg->is_complete || cmd->complete) && (!(sts & CMD_STATUS_COMPL)))) (!(sts & CMD_STATUS_COMPL)))) { resp->err = -EIO; break; } } /* Check for response if this was a read request */ Loading Loading @@ -697,7 +698,8 @@ static int find_slots(struct tcs_mbox *tcs, struct tcs_mbox_msg *msg) int n = 0; /* For active requests find the first free AMC. */ if (tcs->type == ACTIVE_TCS) if (msg->state == RPMH_ACTIVE_ONLY_STATE || msg->state == RPMH_AWAKE_STATE) return find_free_tcs(tcs); /* Find if we already have the msg in our TCS */ Loading Loading @@ -810,6 +812,10 @@ static int tcs_mbox_invalidate(struct mbox_chan *chan) spin_lock_irqsave(&tcs->tcs_lock, flags); for (i = 0; i < tcs->num_tcs; i++) { m = i + tcs->tcs_offset; if (!tcs_is_free(drv, m)) { spin_unlock_irqrestore(&tcs->tcs_lock, flags); return -EBUSY; } __tcs_buffer_invalidate(drv->reg_base, m); } /* Mark the TCS as free */ Loading Loading @@ -896,7 +902,8 @@ static int chan_tcs_write(struct mbox_chan *chan, void *data) goto tx_fail; } if (!msg->payload || msg->num_payload > MAX_RPMH_PAYLOAD) { if (!msg->payload || !msg->num_payload || msg->num_payload > MAX_RPMH_PAYLOAD) { dev_err(dev, "Payload error\n"); ret = -EINVAL; goto tx_fail; Loading Loading @@ -926,8 +933,11 @@ static int chan_tcs_write(struct mbox_chan *chan, void *data) * Since we are re-purposing the wake TCS, invalidate previous * contents to avoid confusion. */ if (msg->state == RPMH_AWAKE_STATE) tcs_mbox_invalidate(chan); if (msg->state == RPMH_AWAKE_STATE) { ret = tcs_mbox_invalidate(chan); if (ret) goto tx_fail; } /* Post the message to the TCS and trigger */ ret = tcs_mbox_write(chan, msg, true); Loading @@ -939,8 +949,10 @@ static int chan_tcs_write(struct mbox_chan *chan, void *data) drv, msg, chan, TCS_M_INIT, ret); dev_err(dev, "Error sending RPMH message %d\n", ret); if (resp) if (!IS_ERR(resp)) send_tcs_response(resp); else dev_err(dev, "No response object %ld\n", PTR_ERR(resp)); ret = 0; } Loading Loading @@ -1007,7 +1019,8 @@ static int chan_tcs_ctrl_write(struct mbox_chan *chan, void *data) goto tx_done; } if (msg->num_payload > MAX_RPMH_PAYLOAD) { if (!msg->payload || (!msg->num_payload && !msg->invalidate) || msg->num_payload > MAX_RPMH_PAYLOAD) { dev_err(dev, "Payload error\n"); goto tx_done; } Loading Loading @@ -1147,7 +1160,8 @@ static int tcs_drv_probe(struct platform_device *pdev) if (tcs->num_tcs > MAX_TCS_PER_TYPE) return -EINVAL; if (st > max_tcs) if (st + tcs->num_tcs > max_tcs && st + tcs->num_tcs >= sizeof(tcs->tcs_mask)) return -EINVAL; tcs->tcs_mask = ((1 << tcs->num_tcs) - 1) << st; Loading @@ -1169,10 +1183,12 @@ static int tcs_drv_probe(struct platform_device *pdev) for (j = 0; j < i; j++) { ret = of_parse_phandle_with_args(np, "mboxes", "#mbox-cells", j, &p); if (!ret && p.np == pdev->dev.of_node) of_node_put(p.np); if (!ret && p.np == pdev->dev.of_node) { num_chans++; break; } num_chans++; } } if (!num_chans) { Loading
drivers/soc/qcom/rpmh.c +6 −4 Original line number Diff line number Diff line Loading @@ -530,7 +530,7 @@ EXPORT_SYMBOL(rpmh_write); int rpmh_write_passthru(struct rpmh_client *rc, enum rpmh_state state, struct tcs_cmd *cmd, int *n) { struct rpmh_msg *rpm_msg[RPMH_MAX_REQ_IN_BATCH]; struct rpmh_msg *rpm_msg[RPMH_MAX_REQ_IN_BATCH] = { NULL }; DECLARE_COMPLETION_ONSTACK(compl); atomic_t wait_count = ATOMIC_INIT(0); /* overwritten */ int count = 0; Loading @@ -548,7 +548,7 @@ int rpmh_write_passthru(struct rpmh_client *rc, enum rpmh_state state, if (ret) return ret; while (n[count++]) while (n[count++] > 0) ; count--; if (!count || count > RPMH_MAX_REQ_IN_BATCH) Loading Loading @@ -674,7 +674,7 @@ int rpmh_write_control(struct rpmh_client *rc, struct tcs_cmd *cmd, int n) { DEFINE_RPMH_MSG_ONSTACK(rc, 0, NULL, NULL, rpm_msg); if (IS_ERR_OR_NULL(rc) || n > MAX_RPMH_PAYLOAD) if (IS_ERR_OR_NULL(rc) || n <= 0 || n > MAX_RPMH_PAYLOAD) return -EINVAL; if (rpmh_standalone) Loading Loading @@ -906,8 +906,10 @@ static struct rpmh_mbox *get_mbox(struct platform_device *pdev, rpmh->msg_pool = kzalloc(sizeof(struct rpmh_msg) * RPMH_MAX_FAST_RES, GFP_KERNEL); if (!rpmh->msg_pool) if (!rpmh->msg_pool) { of_node_put(spec.np); return ERR_PTR(-ENOMEM); } rpmh->mbox_dn = spec.np; INIT_LIST_HEAD(&rpmh->resources); Loading