Merge "ais: Port bounds checking from camera_v2" (83e58ca1) · Commits · e / devices / android_kernel_xiaomi_markw

drivers/media/platform/msm/ais/isp/msm_isp_stats_util.c

+12 −0

Original line number	Diff line number	Diff line
		@@ -601,6 +601,12 @@ static int msm_isp_stats_update_cgc_override(struct vfe_device *vfe_dev,
		int i;
		uint32_t stats_mask = 0, idx;

		if (stream_cfg_cmd->num_streams > MSM_ISP_STATS_MAX) {
		pr_err("%s invalid num_streams %d\n", __func__,
		stream_cfg_cmd->num_streams);
		return -EINVAL;
		}

		for (i = 0; i < stream_cfg_cmd->num_streams; i++) {
		idx = STATS_IDX(stream_cfg_cmd->stream_handle[i]);

		@@ -672,12 +678,18 @@ static int msm_isp_start_stats_stream(struct vfe_device *vfe_dev,
		struct msm_vfe_stats_stream *stream_info;
		struct msm_vfe_stats_shared_data *stats_data = &vfe_dev->stats_data;

		if (stream_cfg_cmd->num_streams > MSM_ISP_STATS_MAX) {
		pr_err("%s invalid num_streams %d\n", __func__,
		stream_cfg_cmd->num_streams);
		return -EINVAL;
		}
		num_stats_comp_mask =
		vfe_dev->hw_info->stats_hw_info->num_stats_comp_mask;
		rc = vfe_dev->hw_info->vfe_ops.stats_ops.check_streams(
		stats_data->stream_info);
		if (rc < 0)
		return rc;

		for (i = 0; i < stream_cfg_cmd->num_streams; i++) {
		idx = STATS_IDX(stream_cfg_cmd->stream_handle[i]);

drivers/media/platform/msm/ais/isp/msm_isp_util.c

+5 −0

Original line number	Diff line number	Diff line
		@@ -678,6 +678,11 @@ static int msm_isp_set_dual_HW_master_slave_mode(
		}
		ISP_DBG("%s: vfe %d num_src %d\n", __func__, vfe_dev->pdev->id,
		dual_hw_ms_cmd->num_src);
		if (dual_hw_ms_cmd->num_src > VFE_SRC_MAX) {
		pr_err("%s: Error! Invalid num_src %d\n", __func__,
		dual_hw_ms_cmd->num_src);
		return -EINVAL;
		}
		/* This for loop is for non-primary intf to be marked with Master/Slave
		* in order for frame id sync. But their timestamp is not saved.
		* So no sof_info resource is allocated */

drivers/media/platform/msm/ais/ispif/msm_ispif.c

+59 −38

Original line number	Diff line number	Diff line
		@@ -74,7 +74,7 @@ static void msm_ispif_io_dump_reg(struct ispif_device *ispif)


		static inline int msm_ispif_is_intf_valid(uint32_t csid_version,
		uint8_t intf_type)
		enum msm_ispif_vfe_intf intf_type)
		{
		return ((csid_version <= CSID_VERSION_V22 && intf_type != VFE0) \|\|
		(intf_type >= VFE_MAX)) ? false : true;
		@@ -118,7 +118,8 @@ static void msm_ispif_get_pack_mask_from_cfg(
		int i;
		uint32_t temp;

		BUG_ON(!entry);
		if (WARN_ON(!entry))
		return;

		memset(pack_mask, 0, sizeof(uint32_t) * 2);
		for (i = 0; i < entry->num_cids; i++) {
		@@ -149,8 +150,10 @@ static int msm_ispif_config2(struct ispif_device *ispif,
		struct msm_ispif_param_data_ext *params =
		(struct msm_ispif_param_data_ext *)data;

		BUG_ON(!ispif);
		BUG_ON(!params);
		if (WARN_ON(!ispif) \|\| WARN_ON(!params)) {
		rc = -EINVAL;
		return rc;
		}

		if (ispif->ispif_state != ISPIF_POWER_UP) {
		pr_err("%s: ispif invalid state %d\n", __func__,
		@@ -228,10 +231,8 @@ static long msm_ispif_cmd_ext(struct v4l2_subdev *sd,
		}

		params = kzalloc(sizeof(struct msm_ispif_param_data_ext), GFP_KERNEL);
		if (!params) {
		CDBG("%s: params alloc failed\n", __func__);
		if (!params)
		return -ENOMEM;
		}
		if (copy_from_user(params, (void __user *)(pcdata.data),
		pcdata.size)) {
		kfree(params);
		@@ -258,7 +259,9 @@ static long msm_ispif_cmd_ext(struct v4l2_subdev *sd,
		static long msm_ispif_subdev_ioctl_compat(struct v4l2_subdev *sd,
		unsigned int cmd, void *arg)
		{
		BUG_ON(!sd);
		if (WARN_ON(!sd))
		return -EINVAL;

		switch (cmd) {
		case VIDIOC_MSM_ISPIF_CFG_EXT_COMPAT:
		return msm_ispif_cmd_ext(sd, arg);
		@@ -328,7 +331,8 @@ static int msm_ispif_get_regulator_info(struct ispif_device *ispif_dev,
		return -EINVAL;
		}

		BUG_ON(count > (ISPIF_VDD_INFO_MAX + ISPIF_VFE_VDD_INFO_MAX));
		if (WARN_ON(count > (ISPIF_VDD_INFO_MAX + ISPIF_VFE_VDD_INFO_MAX)))
		return -EINVAL;
		ispif_dev->vfe_vdd_count = 0;
		ispif_dev->ispif_vdd_count = 0;

		@@ -342,16 +346,18 @@ static int msm_ispif_get_regulator_info(struct ispif_device *ispif_dev,
		goto err;
		}
		if (strnstr(vdd_name, "vfe", strlen(vdd_name))) {
		BUG_ON(ispif_dev->vfe_vdd_count >=
		ISPIF_VFE_VDD_INFO_MAX);
		if (WARN_ON(ispif_dev->vfe_vdd_count >=
		ISPIF_VFE_VDD_INFO_MAX))
		return -EINVAL;
		rc = __get_vdd(pdev,
		&ispif_dev->vfe_vdd[ispif_dev->vfe_vdd_count],
		vdd_name);
		if (0 == rc)
		ispif_dev->vfe_vdd_count++;
		} else {
		BUG_ON(ispif_dev->vfe_vdd_count >=
		ISPIF_VDD_INFO_MAX);
		if (WARN_ON(ispif_dev->vfe_vdd_count >=
		ISPIF_VDD_INFO_MAX))
		return -EINVAL;
		rc = __get_vdd(pdev,
		&ispif_dev->ispif_vdd
		[ispif_dev->ispif_vdd_count],
		@@ -579,7 +585,8 @@ static int msm_ispif_reset(struct ispif_device *ispif)
		int rc = 0;
		int i, vfe_intf;

		BUG_ON(!ispif);
		if (WARN_ON(!ispif))
		return -EINVAL;

		memset(ispif->sof_count, 0, sizeof(ispif->sof_count));
		memset(ispif->vc_enable, 0, sizeof(ispif->vc_enable));
		@@ -655,7 +662,8 @@ static void msm_ispif_sel_csid_core(struct ispif_device *ispif,
		{
		uint32_t data;

		BUG_ON(!ispif);
		if (WARN_ON(!ispif))
		return;

		if (!msm_ispif_is_intf_valid(ispif->csid_version, vfe_intf)) {
		pr_err("%s: invalid interface type\n", __func__);
		@@ -696,7 +704,8 @@ static void msm_ispif_enable_crop(struct ispif_device *ispif,
		{
		uint32_t data;

		BUG_ON(!ispif);
		if (WARN_ON(!ispif))
		return;

		if (!msm_ispif_is_intf_valid(ispif->csid_version, vfe_intf)) {
		pr_err("%s: invalid interface type\n", __func__);
		@@ -718,7 +727,6 @@ static void msm_ispif_enable_crop(struct ispif_device *ispif,
		ispif->base + ISPIF_VFE_m_PIX_INTF_n_CROP(vfe_intf, 1));
		else {
		pr_err("%s: invalid intftype=%d\n", __func__, intftype);
		BUG_ON(1);
		return;
		}
		}
		@@ -728,7 +736,8 @@ static void msm_ispif_enable_intf_cids(struct ispif_device *ispif,
		{
		uint32_t intf_addr, data, i;

		BUG_ON(!ispif);
		if (WARN_ON(!ispif))
		return;

		if (!msm_ispif_is_intf_valid(ispif->csid_version, vfe_intf)) {
		pr_err("%s: invalid interface type\n", __func__);
		@@ -753,7 +762,6 @@ static void msm_ispif_enable_intf_cids(struct ispif_device *ispif,
		break;
		default:
		pr_err("%s: invalid intftype=%d\n", __func__, intftype);
		BUG_ON(1);
		return;
		}

		@@ -775,7 +783,8 @@ static int msm_ispif_validate_intf_status(struct ispif_device *ispif,
		int rc = 0;
		uint32_t data = 0;

		BUG_ON(!ispif);
		if (WARN_ON(!ispif))
		return -EINVAL;

		if (!msm_ispif_is_intf_valid(ispif->csid_version, vfe_intf)) {
		pr_err("%s: invalid interface type\n", __func__);
		@@ -867,7 +876,8 @@ static uint16_t msm_ispif_get_cids_mask_from_cfg(
		int i;
		uint16_t cids_mask = 0;

		BUG_ON(!entry);
		if (WARN_ON(!entry))
		return 0;

		for (i = 0; i < entry->num_cids && i < MAX_CID_CH_v2; i++)
		cids_mask \|= (1 << entry->cids[i]);
		@@ -883,8 +893,10 @@ static int msm_ispif_config(struct ispif_device *ispif,
		enum msm_ispif_intftype intftype;
		enum msm_ispif_vfe_intf vfe_intf;

		BUG_ON(!ispif);
		BUG_ON(!params);
		if (WARN_ON(!ispif) \|\| WARN_ON(!params)) {
		rc = -EINVAL;
		return rc;
		}

		if (ispif->ispif_state != ISPIF_POWER_UP) {
		pr_err("%s: ispif invalid state %d\n", __func__,
		@@ -966,8 +978,8 @@ static void msm_ispif_intf_cmd(struct ispif_device *ispif, uint32_t cmd_bits,
		enum msm_ispif_intftype intf_type;
		enum msm_ispif_vfe_intf vfe_intf;

		BUG_ON(!ispif);
		BUG_ON(!params);
		if (WARN_ON(!ispif) \|\| WARN_ON(!params))
		return;

		for (i = 0; i < params->num; i++) {
		intf_type = params->entries[i].intftype;
		@@ -1014,8 +1026,10 @@ static int msm_ispif_stop_immediately(struct ispif_device *ispif,
		{
		int rc = 0, i = 0;

		BUG_ON(!ispif);
		BUG_ON(!params);
		if (WARN_ON(!ispif) \|\| WARN_ON(!params)) {
		rc = -EINVAL;
		return rc;
		}

		if (ispif->ispif_state != ISPIF_POWER_UP) {
		pr_err("%s: ispif invalid state %d\n", __func__,
		@@ -1108,9 +1122,10 @@ static int msm_ispif_stop_frame_boundary(struct ispif_device *ispif,
		enum msm_ispif_vfe_intf vfe_intf;
		uint32_t stop_flag = 0;

		BUG_ON(!ispif);
		BUG_ON(!params);

		if (WARN_ON(!ispif) \|\| WARN_ON(!params)) {
		rc = -EINVAL;
		return rc;
		}

		if (ispif->ispif_state != ISPIF_POWER_UP) {
		pr_err("%s: ispif invalid state %d\n", __func__,
		@@ -1181,8 +1196,8 @@ end:
		static void ispif_process_irq(struct ispif_device *ispif,
		struct ispif_irq_status *out, enum msm_ispif_vfe_intf vfe_id)
		{
		BUG_ON(!ispif);
		BUG_ON(!out);
		if (WARN_ON(!ispif) \|\| WARN_ON(!out))
		return;

		if (out[vfe_id].ispifIrqStatus0 &
		ISPIF_IRQ_STATUS_PIX_SOF_MASK) {
		@@ -1228,8 +1243,8 @@ static inline void msm_ispif_read_irq_status(struct ispif_irq_status *out,
		bool fatal_err = false;
		int i = 0;

		BUG_ON(!ispif);
		BUG_ON(!out);
		if (WARN_ON(!ispif) \|\| WARN_ON(!out))
		return;

		out[VFE0].ispifIrqStatus0 = msm_camera_io_r(ispif->base +
		ISPIF_VFE_m_IRQ_STATUS_0(VFE0));
		@@ -1378,7 +1393,10 @@ static int msm_ispif_init(struct ispif_device *ispif,
		{
		int rc = 0;

		BUG_ON(!ispif);
		if (WARN_ON(!ispif)) {
		rc = -EINVAL;
		return rc;
		}

		if (ispif->ispif_state == ISPIF_POWER_UP) {
		pr_err("%s: ispif already initted state = %d\n", __func__,
		@@ -1430,7 +1448,8 @@ error_ahb:

		static void msm_ispif_release(struct ispif_device *ispif)
		{
		BUG_ON(!ispif);
		if (WARN_ON(!ispif))
		return;

		msm_ispif_reset(ispif);
		msm_ispif_reset_hw(ispif);
		@@ -1451,8 +1470,10 @@ static long msm_ispif_cmd(struct v4l2_subdev sd, void arg)
		struct ispif_device *ispif =
		(struct ispif_device *)v4l2_get_subdevdata(sd);

		BUG_ON(!sd);
		BUG_ON(!pcdata);
		if (WARN_ON(!sd) \|\| WARN_ON(!pcdata)) {
		rc = -EINVAL;
		return rc;
		}

		mutex_lock(&ispif->mutex);
		CDBG("%s cfg_type = %d\n", __func__, pcdata->cfg_type);

drivers/media/platform/msm/ais/sensor/csid/msm_csid.c

+7 −0

Original line number	Diff line number	Diff line
		@@ -61,6 +61,7 @@
		#define TRUE 1
		#define FALSE 0

		#define MAX_LANE_COUNT 4
		#define CSID_TIMEOUT msecs_to_jiffies(100)

		#undef CDBG
		@@ -318,6 +319,12 @@ static int msm_csid_config(struct csid_device *csid_dev)
		csid_params->lane_assign);
		CDBG("%s csid_params phy_sel = %d\n", __func__,
		csid_params->phy_sel);
		if ((csid_params->lane_cnt == 0) \|\|
		(csid_params->lane_cnt > MAX_LANE_COUNT)) {
		pr_err("%s:%d invalid lane count = %d\n",
		__func__, __LINE__, csid_params->lane_cnt);
		return -EINVAL;
		}

		#ifdef RESET_CSID_CFG
		rc = msm_csid_reset(csid_dev);