Merge 23b51487f1a4156f5b706c0dbf1f9e2773e2aa77 on remote branch (76e98d88) · Commits · e / devices / android_kernel_oneplus_sm7250

drivers/cam_icp/icp_hw/icp_hw_mgr/cam_icp_hw_mgr.c

+10 −2

Original line number	Diff line number	Diff line
		@@ -4189,7 +4189,8 @@ static bool cam_icp_mgr_is_valid_outconfig(struct cam_packet *packet)
		packet->io_configs_offset/4);

		for (i = 0 ; i < packet->num_io_configs; i++)
		if (io_cfg_ptr[i].direction == CAM_BUF_OUTPUT)
		if ((io_cfg_ptr[i].direction == CAM_BUF_OUTPUT) \|\|
		(io_cfg_ptr[i].direction == CAM_BUF_IN_OUT))
		num_out_map_entries++;

		if (num_out_map_entries <= CAM_MAX_OUT_RES) {
		@@ -4342,10 +4343,17 @@ static int cam_icp_mgr_process_io_cfg(struct cam_icp_hw_mgr *hw_mgr,
		if (io_cfg_ptr[i].direction == CAM_BUF_INPUT) {
		sync_in_obj[j++] = io_cfg_ptr[i].fence;
		prepare_args->num_in_map_entries++;
		} else {
		} else if ((io_cfg_ptr[i].direction == CAM_BUF_OUTPUT) \|\|
		(io_cfg_ptr[i].direction == CAM_BUF_IN_OUT)) {
		prepare_args->out_map_entries[k++].sync_id =
		io_cfg_ptr[i].fence;
		prepare_args->num_out_map_entries++;
		} else {
		CAM_ERR(CAM_ICP, "dir: %d, max_out:%u, out %u",
		io_cfg_ptr[i].direction,
		prepare_args->max_out_map_entries,
		prepare_args->num_out_map_entries);
		return -EINVAL;
		}
		CAM_DBG(CAM_REQ,
		"ctx_id: %u req_id: %llu dir[%d]: %u, fence: %u resource_type = %u memh %x",

drivers/cam_sensor_module/cam_eeprom/cam_eeprom_core.c

+24 −19

Original line number	Diff line number	Diff line
		// SPDX-License-Identifier: GPL-2.0-only
		/*
		* Copyright (c) 2017-2020, The Linux Foundation. All rights reserved.
		* Copyright (c) 2022-2023 Qualcomm Innovation Center, Inc. All rights reserved.
		* Copyright (c) 2022-2024 Qualcomm Innovation Center, Inc. All rights reserved.
		*/

		#include <linux/module.h>
		@@ -418,6 +418,7 @@ static int32_t cam_eeprom_parse_memory_map(
		int32_t rc = 0;
		int32_t cnt = 0;
		int32_t processed_size = 0;
		int32_t payload_count;
		uint8_t generic_op_code;
		struct cam_eeprom_memory_map_t *map = data->map;
		struct common_header *cmm_hdr =
		@@ -447,24 +448,25 @@ static int32_t cam_eeprom_parse_memory_map(
		switch (cmm_hdr->cmd_type) {
		case CAMERA_SENSOR_CMD_TYPE_I2C_RNDM_WR:
		i2c_random_wr = (struct cam_cmd_i2c_random_wr *)cmd_buf;
		payload_count = i2c_random_wr->header.count;

		if (i2c_random_wr->header.count == 0 \|\|
		i2c_random_wr->header.count >= MSM_EEPROM_MAX_MEM_MAP_CNT \|\|
		if (payload_count == 0 \|\|
		payload_count >= MSM_EEPROM_MAX_MEM_MAP_CNT \|\|
		(size_t)num_map >= ((MSM_EEPROM_MAX_MEM_MAP_CNT
		MSM_EEPROM_MEMORY_MAP_MAX_SIZE) -
		i2c_random_wr->header.count)) {
		payload_count)) {
		CAM_ERR(CAM_EEPROM, "OOB Error");
		return -EINVAL;
		}
		cmd_length_in_bytes = sizeof(struct cam_cmd_i2c_random_wr) +
		((i2c_random_wr->header.count - 1) *
		((payload_count - 1) *
		sizeof(struct i2c_random_wr_payload));

		if (cmd_length_in_bytes > remain_buf_len) {
		CAM_ERR(CAM_EEPROM, "Not enough buffer remaining");
		return -EINVAL;
		}
		for (cnt = 0; cnt < (i2c_random_wr->header.count);
		for (cnt = 0; cnt < (payload_count);
		cnt++) {
		map[*num_map + cnt].page.addr =
		i2c_random_wr->random_wr_payload[cnt].reg_addr;
		@@ -477,16 +479,16 @@ static int32_t cam_eeprom_parse_memory_map(
		map[*num_map + cnt].page.valid_size = 1;
		}

		*num_map += (i2c_random_wr->header.count - 1);
		cmd_buf += cmd_length_in_bytes / sizeof(int32_t);
		*num_map += (payload_count - 1);
		processed_size +=
		cmd_length_in_bytes;
		break;
		case CAMERA_SENSOR_CMD_TYPE_I2C_CONT_RD:
		i2c_cont_rd = (struct cam_cmd_i2c_continuous_rd *)cmd_buf;
		cmd_length_in_bytes = sizeof(struct cam_cmd_i2c_continuous_rd);
		payload_count = i2c_cont_rd->header.count;

		if (i2c_cont_rd->header.count >= U32_MAX - data->num_data) {
		if (payload_count >= U32_MAX - data->num_data) {
		CAM_ERR(CAM_EEPROM,
		"int overflow on eeprom memory block");
		return -EINVAL;
		@@ -495,8 +497,7 @@ static int32_t cam_eeprom_parse_memory_map(
		map[*num_map].mem.addr_type = i2c_cont_rd->header.addr_type;
		map[*num_map].mem.data_type = i2c_cont_rd->header.data_type;
		map[*num_map].mem.valid_size =
		i2c_cont_rd->header.count;
		cmd_buf += cmd_length_in_bytes / sizeof(int32_t);
		payload_count;
		processed_size +=
		cmd_length_in_bytes;
		data->num_data += map[*num_map].mem.valid_size;
		@@ -1075,6 +1076,8 @@ static int32_t cam_eeprom_get_cal_data(struct cam_eeprom_ctrl_t *e_ctrl,
		{
		struct cam_buf_io_cfg *io_cfg;
		uint32_t i = 0;
		size_t plane_offset;
		int32_t mem_handle;
		int rc = 0;
		uintptr_t buf_addr;
		size_t buf_size;
		@@ -1084,6 +1087,8 @@ static int32_t cam_eeprom_get_cal_data(struct cam_eeprom_ctrl_t *e_ctrl,
		io_cfg = (struct cam_buf_io_cfg ) ((uint8_t )
		&csl_packet->payload +
		csl_packet->io_configs_offset);
		plane_offset = io_cfg->offsets[0];
		mem_handle = io_cfg->mem_handle[0];

		CAM_DBG(CAM_EEPROM, "number of IO configs: %d:",
		csl_packet->num_io_configs);
		@@ -1091,21 +1096,21 @@ static int32_t cam_eeprom_get_cal_data(struct cam_eeprom_ctrl_t *e_ctrl,
		for (i = 0; i < csl_packet->num_io_configs; i++) {
		CAM_DBG(CAM_EEPROM, "Direction: %d:", io_cfg->direction);
		if (io_cfg->direction == CAM_BUF_OUTPUT) {
		rc = cam_mem_get_cpu_buf(io_cfg->mem_handle[0],
		rc = cam_mem_get_cpu_buf(mem_handle,
		&buf_addr, &buf_size);
		if (rc) {
		CAM_ERR(CAM_EEPROM, "Fail in get buffer: %d",
		rc);
		return rc;
		}
		if (buf_size <= io_cfg->offsets[0]) {
		if (buf_size <= plane_offset) {
		CAM_ERR(CAM_EEPROM, "Not enough buffer");
		cam_mem_put_cpu_buf(io_cfg->mem_handle[0]);
		cam_mem_put_cpu_buf(mem_handle);
		rc = -EINVAL;
		return rc;
		}

		remain_len = buf_size - io_cfg->offsets[0];
		remain_len = buf_size - plane_offset;
		CAM_DBG(CAM_EEPROM, "buf_addr : %pK, buf_size : %zu\n",
		(void *)buf_addr, buf_size);

		@@ -1113,16 +1118,16 @@ static int32_t cam_eeprom_get_cal_data(struct cam_eeprom_ctrl_t *e_ctrl,
		if (!read_buffer) {
		CAM_ERR(CAM_EEPROM,
		"invalid buffer to copy data");
		cam_mem_put_cpu_buf(io_cfg->mem_handle[0]);
		cam_mem_put_cpu_buf(mem_handle);
		rc = -EINVAL;
		return rc;
		}
		read_buffer += io_cfg->offsets[0];
		read_buffer += plane_offset;

		if (remain_len < e_ctrl->cal_data.num_data) {
		CAM_ERR(CAM_EEPROM,
		"failed to copy, Invalid size");
		cam_mem_put_cpu_buf(io_cfg->mem_handle[0]);
		cam_mem_put_cpu_buf(mem_handle);
		rc = -EINVAL;
		return rc;
		}
		@@ -1131,7 +1136,7 @@ static int32_t cam_eeprom_get_cal_data(struct cam_eeprom_ctrl_t *e_ctrl,
		e_ctrl->cal_data.num_data);
		memcpy(read_buffer, e_ctrl->cal_data.mapdata,
		e_ctrl->cal_data.num_data);
		cam_mem_put_cpu_buf(io_cfg->mem_handle[0]);
		cam_mem_put_cpu_buf(mem_handle);
		} else {
		CAM_ERR(CAM_EEPROM, "Invalid direction");
		rc = -EINVAL;

drivers/cam_sensor_module/cam_sensor_utils/cam_sensor_util.c

+5 −5

Original line number	Diff line number	Diff line
		@@ -289,10 +289,11 @@ static int32_t cam_sensor_handle_random_read(
		struct cam_buf_io_cfg *io_cfg)
		{
		struct i2c_settings_list *i2c_list;
		int32_t rc = 0, cnt = 0;
		int32_t rc = 0, cnt = 0, payload_count = 0;

		payload_count = cmd_i2c_random_rd->header.count;
		i2c_list = cam_sensor_get_i2c_ptr(i2c_reg_settings,
		cmd_i2c_random_rd->header.count);
		payload_count);
		if ((i2c_list == NULL) \|\|
		(i2c_list->i2c_settings.reg_setting == NULL)) {
		CAM_ERR(CAM_SENSOR,
		@@ -307,7 +308,7 @@ static int32_t cam_sensor_handle_random_read(
		} else {
		*cmd_length_in_bytes = sizeof(struct i2c_rdwr_header) +
		(sizeof(struct cam_cmd_read) *
		(cmd_i2c_random_rd->header.count));
		payload_count);
		i2c_list->op_code = CAM_SENSOR_I2C_READ_RANDOM;
		i2c_list->i2c_settings.addr_type =
		cmd_i2c_random_rd->header.addr_type;
		@@ -316,8 +317,7 @@ static int32_t cam_sensor_handle_random_read(
		i2c_list->i2c_settings.size =
		cmd_i2c_random_rd->header.count;

		for (cnt = 0; cnt < (cmd_i2c_random_rd->header.count);
		cnt++) {
		for (cnt = 0; cnt < payload_count; cnt++) {
		i2c_list->i2c_settings.reg_setting[cnt].reg_addr =
		cmd_i2c_random_rd->data_read[cnt].reg_data;
		}