diff options
author | Linux Build Service Account <lnxbuild@localhost> | 2019-04-26 02:51:52 -0700 |
---|---|---|
committer | Linux Build Service Account <lnxbuild@localhost> | 2019-04-26 02:51:52 -0700 |
commit | 537b5837eecb836c45a18b2245bc2620a5aec7e1 (patch) | |
tree | 918c6ee0da827c88146e6505e87e8273e133d3c9 | |
parent | a5eded288d9b57646596072d8c0e5c658189d7d3 (diff) | |
parent | 42f4b566e6574da16c96f7c62afdc608450e8f25 (diff) |
Merge 42f4b566e6574da16c96f7c62afdc608450e8f25 on remote branchLA.UM.6.6.2.r1-07200-89xx.0
Change-Id: I432bc7fecbd066e3db4156d28e07215244a44a77
-rw-r--r-- | drivers/firmware/qcom/tz_log.c | 5 | ||||
-rw-r--r-- | drivers/iommu/iommu-debug.c | 24 | ||||
-rw-r--r-- | drivers/media/platform/msm/vidc/hfi_response_handler.c | 53 | ||||
-rw-r--r-- | drivers/media/platform/msm/vidc/venus_hfi.c | 68 | ||||
-rw-r--r-- | drivers/media/platform/msm/vidc_3x/hfi_response_handler.c | 53 | ||||
-rw-r--r-- | drivers/media/platform/msm/vidc_3x/venus_hfi.c | 65 | ||||
-rw-r--r-- | drivers/platform/msm/sps/sps.c | 30 | ||||
-rw-r--r-- | drivers/platform/msm/sps/sps_bam.c | 27 | ||||
-rw-r--r-- | drivers/platform/msm/sps/sps_dma.c | 11 | ||||
-rw-r--r-- | drivers/platform/msm/sps/sps_mem.c | 10 | ||||
-rw-r--r-- | drivers/platform/msm/sps/sps_rm.c | 14 | ||||
-rw-r--r-- | drivers/staging/android/ion/ion_system_heap.c | 6 |
12 files changed, 228 insertions, 138 deletions
diff --git a/drivers/firmware/qcom/tz_log.c b/drivers/firmware/qcom/tz_log.c index 9c1c81b66ad6..5580dc200e6f 100644 --- a/drivers/firmware/qcom/tz_log.c +++ b/drivers/firmware/qcom/tz_log.c @@ -1,4 +1,4 @@ -/* Copyright (c) 2011-2017, The Linux Foundation. All rights reserved. +/* Copyright (c) 2011-2017,2019 The Linux Foundation. All rights reserved. * * This program is free software; you can redistribute it and/or modify * it under the terms of the GNU General Public License version 2 and @@ -836,6 +836,9 @@ static ssize_t tzdbgfs_read(struct file *file, char __user *buf, break; } + if (count > debug_rw_buf_size) + count = debug_rw_buf_size; + if (len > count) len = count; diff --git a/drivers/iommu/iommu-debug.c b/drivers/iommu/iommu-debug.c index 25b85ab146a2..2dcac176812c 100644 --- a/drivers/iommu/iommu-debug.c +++ b/drivers/iommu/iommu-debug.c @@ -1,5 +1,5 @@ /* - * Copyright (c) 2015-2018, The Linux Foundation. All rights reserved. + * Copyright (c) 2015-2019, The Linux Foundation. All rights reserved. * * This program is free software; you can redistribute it and/or modify * it under the terms of the GNU General Public License version 2 and @@ -1349,6 +1349,7 @@ static ssize_t iommu_debug_dma_attach_read(struct file *file, char __user *ubuf, struct iommu_debug_device *ddev = file->private_data; struct device *dev = ddev->dev; char c[2]; + size_t buflen = sizeof(c); if (*offset) return 0; @@ -1359,13 +1360,14 @@ static ssize_t iommu_debug_dma_attach_read(struct file *file, char __user *ubuf, c[0] = dev->archdata.mapping->domain ? '1' : '0'; c[1] = '\n'; - if (copy_to_user(ubuf, &c, 2)) { + buflen = min(count, buflen); + if (copy_to_user(ubuf, &c, buflen)) { pr_err("copy_to_user failed\n"); return -EFAULT; } *offset = 1; /* non-zero means we're done */ - return 2; + return buflen; } static const struct file_operations iommu_debug_dma_attach_fops = { @@ -1393,7 +1395,7 @@ static ssize_t iommu_debug_test_virt_addr_read(struct file *file, else snprintf(buf, buf_len, "0x%pK\n", test_virt_addr); - buflen = strlen(buf); + buflen = min(count, strlen(buf)+1); if (copy_to_user(ubuf, buf, buflen)) { pr_err("Couldn't copy_to_user\n"); retval = -EFAULT; @@ -1424,19 +1426,21 @@ static ssize_t iommu_debug_attach_read(struct file *file, char __user *ubuf, { struct iommu_debug_device *ddev = file->private_data; char c[2]; + size_t buflen = sizeof(c); if (*offset) return 0; c[0] = ddev->domain ? '1' : '0'; c[1] = '\n'; - if (copy_to_user(ubuf, &c, 2)) { + buflen = min(count, buflen); + if (copy_to_user(ubuf, &c, buflen)) { pr_err("copy_to_user failed\n"); return -EFAULT; } *offset = 1; /* non-zero means we're done */ - return 2; + return buflen; } static const struct file_operations iommu_debug_attach_fops = { @@ -1514,7 +1518,7 @@ static ssize_t iommu_debug_pte_read(struct file *file, char __user *ubuf, else snprintf(buf, sizeof(buf), "pte=%016llx\n", pte); - buflen = strlen(buf); + buflen = min(count, strlen(buf)+1); if (copy_to_user(ubuf, buf, buflen)) { pr_err("Couldn't copy_to_user\n"); retval = -EFAULT; @@ -1583,7 +1587,7 @@ static ssize_t iommu_debug_atos_read(struct file *file, char __user *ubuf, snprintf(buf, 100, "%pa\n", &phys); } - buflen = strlen(buf); + buflen = min(count, strlen(buf)+1); if (copy_to_user(ubuf, buf, buflen)) { pr_err("Couldn't copy_to_user\n"); retval = -EFAULT; @@ -1636,7 +1640,7 @@ static ssize_t iommu_debug_dma_atos_read(struct file *file, char __user *ubuf, else snprintf(buf, sizeof(buf), "%pa\n", &phys); - buflen = strlen(buf); + buflen = min(count, strlen(buf)+1); if (copy_to_user(ubuf, buf, buflen)) { pr_err("Couldn't copy_to_user\n"); retval = -EFAULT; @@ -1869,7 +1873,7 @@ static ssize_t iommu_debug_dma_map_read(struct file *file, char __user *ubuf, iova = ddev->iova; snprintf(buf, sizeof(buf), "%pa\n", &iova); - buflen = strlen(buf); + buflen = min(count, strlen(buf)+1); if (copy_to_user(ubuf, buf, buflen)) { pr_err("Couldn't copy_to_user\n"); retval = -EFAULT; diff --git a/drivers/media/platform/msm/vidc/hfi_response_handler.c b/drivers/media/platform/msm/vidc/hfi_response_handler.c index 92deba17745f..1b82576f6532 100644 --- a/drivers/media/platform/msm/vidc/hfi_response_handler.c +++ b/drivers/media/platform/msm/vidc/hfi_response_handler.c @@ -365,9 +365,10 @@ static int hfi_process_session_error(u32 device_id, } static int hfi_process_event_notify(u32 device_id, - struct hfi_msg_event_notify_packet *pkt, + void *_pkt, struct msm_vidc_cb_info *info) { + struct hfi_msg_event_notify_packet *pkt = _pkt; dprintk(VIDC_DBG, "Received: EVENT_NOTIFY\n"); if (pkt->size < sizeof(struct hfi_msg_event_notify_packet)) { @@ -406,9 +407,10 @@ static int hfi_process_event_notify(u32 device_id, } static int hfi_process_sys_init_done(u32 device_id, - struct hfi_msg_sys_init_done_packet *pkt, + void *_pkt, struct msm_vidc_cb_info *info) { + struct hfi_msg_sys_init_done_packet *pkt = _pkt; struct msm_vidc_cb_cmd_done cmd_done = {0}; enum vidc_status status = VIDC_ERR_NONE; @@ -445,9 +447,10 @@ err_no_prop: } static int hfi_process_sys_rel_resource_done(u32 device_id, - struct hfi_msg_sys_release_resource_done_packet *pkt, + void *_pkt, struct msm_vidc_cb_info *info) { + struct hfi_msg_sys_release_resource_done_packet *pkt = _pkt; struct msm_vidc_cb_cmd_done cmd_done = {0}; enum vidc_status status = VIDC_ERR_NONE; u32 pkt_size; @@ -1249,9 +1252,10 @@ static void hfi_process_sess_get_prop_buf_req( } static int hfi_process_session_prop_info(u32 device_id, - struct hfi_msg_session_property_info_packet *pkt, + void *_pkt, struct msm_vidc_cb_info *info) { + struct hfi_msg_session_property_info_packet *pkt = _pkt; struct msm_vidc_cb_cmd_done cmd_done = {0}; struct buffer_requirements buff_req = { { {0} } }; @@ -1290,9 +1294,10 @@ static int hfi_process_session_prop_info(u32 device_id, } static int hfi_process_session_init_done(u32 device_id, - struct hfi_msg_sys_session_init_done_packet *pkt, + void *_pkt, struct msm_vidc_cb_info *info) { + struct hfi_msg_sys_session_init_done_packet *pkt = _pkt; struct msm_vidc_cb_cmd_done cmd_done = {0}; struct vidc_hal_session_init_done session_init_done = { {0} }; @@ -1317,9 +1322,10 @@ static int hfi_process_session_init_done(u32 device_id, } static int hfi_process_session_load_res_done(u32 device_id, - struct hfi_msg_session_load_resources_done_packet *pkt, + void *_pkt, struct msm_vidc_cb_info *info) { + struct hfi_msg_session_load_resources_done_packet *pkt = _pkt; struct msm_vidc_cb_cmd_done cmd_done = {0}; dprintk(VIDC_DBG, "RECEIVED: SESSION_LOAD_RESOURCES_DONE[%#x]\n", @@ -1345,9 +1351,10 @@ static int hfi_process_session_load_res_done(u32 device_id, } static int hfi_process_session_flush_done(u32 device_id, - struct hfi_msg_session_flush_done_packet *pkt, + void *_pkt, struct msm_vidc_cb_info *info) { + struct hfi_msg_session_flush_done_packet *pkt = _pkt; struct msm_vidc_cb_cmd_done cmd_done = {0}; dprintk(VIDC_DBG, "RECEIVED: SESSION_FLUSH_DONE[%#x]\n", @@ -1388,9 +1395,10 @@ static int hfi_process_session_flush_done(u32 device_id, } static int hfi_process_session_etb_done(u32 device_id, - struct hfi_msg_session_empty_buffer_done_packet *pkt, + void *_pkt, struct msm_vidc_cb_info *info) { + struct hfi_msg_session_empty_buffer_done_packet *pkt = _pkt; struct msm_vidc_cb_data_done data_done = {0}; struct hfi_picture_type *hfi_picture_type = NULL; @@ -1442,9 +1450,10 @@ static int hfi_process_session_etb_done(u32 device_id, } static int hfi_process_session_ftb_done( - u32 device_id, struct vidc_hal_msg_pkt_hdr *msg_hdr, + u32 device_id, void *_pkt, struct msm_vidc_cb_info *info) { + struct vidc_hal_msg_pkt_hdr *msg_hdr = _pkt; struct msm_vidc_cb_data_done data_done = {0}; bool is_decoder = false, is_encoder = false; @@ -1566,9 +1575,10 @@ static int hfi_process_session_ftb_done( } static int hfi_process_session_start_done(u32 device_id, - struct hfi_msg_session_start_done_packet *pkt, + void *_pkt, struct msm_vidc_cb_info *info) { + struct hfi_msg_session_start_done_packet *pkt = _pkt; struct msm_vidc_cb_cmd_done cmd_done = {0}; dprintk(VIDC_DBG, "RECEIVED: SESSION_START_DONE[%#x]\n", @@ -1592,9 +1602,10 @@ static int hfi_process_session_start_done(u32 device_id, } static int hfi_process_session_stop_done(u32 device_id, - struct hfi_msg_session_stop_done_packet *pkt, + void *_pkt, struct msm_vidc_cb_info *info) { + struct hfi_msg_session_stop_done_packet *pkt = _pkt; struct msm_vidc_cb_cmd_done cmd_done = {0}; dprintk(VIDC_DBG, "RECEIVED: SESSION_STOP_DONE[%#x]\n", @@ -1619,9 +1630,10 @@ static int hfi_process_session_stop_done(u32 device_id, } static int hfi_process_session_rel_res_done(u32 device_id, - struct hfi_msg_session_release_resources_done_packet *pkt, + void *_pkt, struct msm_vidc_cb_info *info) { + struct hfi_msg_session_release_resources_done_packet *pkt = _pkt; struct msm_vidc_cb_cmd_done cmd_done = {0}; dprintk(VIDC_DBG, "RECEIVED: SESSION_RELEASE_RESOURCES_DONE[%#x]\n", @@ -1646,9 +1658,10 @@ static int hfi_process_session_rel_res_done(u32 device_id, } static int hfi_process_session_rel_buf_done(u32 device_id, - struct hfi_msg_session_release_buffers_done_packet *pkt, + void *_pkt, struct msm_vidc_cb_info *info) { + struct hfi_msg_session_release_buffers_done_packet *pkt = _pkt; struct msm_vidc_cb_cmd_done cmd_done = {0}; if (!pkt || pkt->size < @@ -1679,9 +1692,10 @@ static int hfi_process_session_rel_buf_done(u32 device_id, } static int hfi_process_session_end_done(u32 device_id, - struct hfi_msg_sys_session_end_done_packet *pkt, + void *_pkt, struct msm_vidc_cb_info *info) { + struct hfi_msg_sys_session_end_done_packet *pkt = _pkt; struct msm_vidc_cb_cmd_done cmd_done = {0}; dprintk(VIDC_DBG, "RECEIVED: SESSION_END_DONE[%#x]\n", pkt->session_id); @@ -1704,9 +1718,10 @@ static int hfi_process_session_end_done(u32 device_id, } static int hfi_process_session_abort_done(u32 device_id, - struct hfi_msg_sys_session_abort_done_packet *pkt, + void *_pkt, struct msm_vidc_cb_info *info) { + struct hfi_msg_sys_session_abort_done_packet *pkt = _pkt; struct msm_vidc_cb_cmd_done cmd_done = {0}; dprintk(VIDC_DBG, "RECEIVED: SESSION_ABORT_DONE[%#x]\n", @@ -1774,9 +1789,10 @@ static void hfi_process_sys_get_prop_image_version( } static int hfi_process_sys_property_info(u32 device_id, - struct hfi_msg_sys_property_info_packet *pkt, + void *_pkt, struct msm_vidc_cb_info *info) { + struct hfi_msg_sys_property_info_packet *pkt = _pkt; if (!pkt) { dprintk(VIDC_ERR, "%s: invalid param\n", __func__); return -EINVAL; @@ -1808,7 +1824,7 @@ static int hfi_process_sys_property_info(u32 device_id, } static int hfi_process_ignore(u32 device_id, - struct vidc_hal_msg_pkt_hdr *msg_hdr, + void *_pkt, struct msm_vidc_cb_info *info) { *info = (struct msm_vidc_cb_info) { @@ -1889,5 +1905,6 @@ int hfi_process_msg_packet(u32 device_id, struct vidc_hal_msg_pkt_hdr *msg_hdr, break; } - return pkt_func ? pkt_func(device_id, msg_hdr, info) : -ENOTSUPP; + return pkt_func ? + pkt_func(device_id, (void *)msg_hdr, info) : -ENOTSUPP; } diff --git a/drivers/media/platform/msm/vidc/venus_hfi.c b/drivers/media/platform/msm/vidc/venus_hfi.c index 54b7e2cfe116..aa61352ed976 100644 --- a/drivers/media/platform/msm/vidc/venus_hfi.c +++ b/drivers/media/platform/msm/vidc/venus_hfi.c @@ -1,4 +1,4 @@ -/* Copyright (c) 2012-2018, The Linux Foundation. All rights reserved. +/* Copyright (c) 2012-2019, The Linux Foundation. All rights reserved. * * This program is free software; you can redistribute it and/or modify * it under the terms of the GNU General Public License version 2 and @@ -324,7 +324,7 @@ static int __write_queue(struct vidc_iface_q_info *qinfo, u8 *packet, { struct hfi_queue_header *queue; u32 packet_size_in_words, new_write_idx; - u32 empty_space, read_idx; + u32 empty_space, read_idx, write_idx; u32 *write_ptr; if (!qinfo || !packet) { @@ -347,16 +347,18 @@ static int __write_queue(struct vidc_iface_q_info *qinfo, u8 *packet, } packet_size_in_words = (*(u32 *)packet) >> 2; - if (!packet_size_in_words) { - dprintk(VIDC_ERR, "Zero packet size\n"); + if (!packet_size_in_words || packet_size_in_words > + qinfo->q_array.mem_size>>2) { + dprintk(VIDC_ERR, "Invalid packet size\n"); return -ENODATA; } read_idx = queue->qhdr_read_idx; + write_idx = queue->qhdr_write_idx; - empty_space = (queue->qhdr_write_idx >= read_idx) ? - (queue->qhdr_q_size - (queue->qhdr_write_idx - read_idx)) : - (read_idx - queue->qhdr_write_idx); + empty_space = (write_idx >= read_idx) ? + ((qinfo->q_array.mem_size>>2) - (write_idx - read_idx)) : + (read_idx - write_idx); if (empty_space <= packet_size_in_words) { queue->qhdr_tx_req = 1; dprintk(VIDC_ERR, "Insufficient size (%d) to write (%d)\n", @@ -366,13 +368,20 @@ static int __write_queue(struct vidc_iface_q_info *qinfo, u8 *packet, queue->qhdr_tx_req = 0; - new_write_idx = (queue->qhdr_write_idx + packet_size_in_words); + new_write_idx = write_idx + packet_size_in_words; write_ptr = (u32 *)((qinfo->q_array.align_virtual_addr) + - (queue->qhdr_write_idx << 2)); - if (new_write_idx < queue->qhdr_q_size) { + (write_idx << 2)); + if (write_ptr < (u32 *)qinfo->q_array.align_virtual_addr || + write_ptr > (u32 *)(qinfo->q_array.align_virtual_addr + + qinfo->q_array.mem_size)) { + dprintk(VIDC_ERR, "Invalid write index"); + return -ENODATA; + } + + if (new_write_idx < (qinfo->q_array.mem_size >> 2)) { memcpy(write_ptr, packet, packet_size_in_words << 2); } else { - new_write_idx -= queue->qhdr_q_size; + new_write_idx -= qinfo->q_array.mem_size >> 2; memcpy(write_ptr, packet, (packet_size_in_words - new_write_idx) << 2); memcpy((void *)qinfo->q_array.align_virtual_addr, @@ -468,7 +477,8 @@ static int __read_queue(struct vidc_iface_q_info *qinfo, u8 *packet, u32 packet_size_in_words, new_read_idx; u32 *read_ptr; u32 receive_request = 0; - int rc = 0; + u32 read_idx, write_idx; + int rc = 0; if (!qinfo || !packet || !pb_tx_req_is_set) { dprintk(VIDC_ERR, "Invalid Params\n"); @@ -501,7 +511,10 @@ static int __read_queue(struct vidc_iface_q_info *qinfo, u8 *packet, if (queue->qhdr_type & HFI_Q_ID_CTRL_TO_HOST_MSG_Q) receive_request = 1; - if (queue->qhdr_read_idx == queue->qhdr_write_idx) { + read_idx = queue->qhdr_read_idx; + write_idx = queue->qhdr_write_idx; + + if (read_idx == write_idx) { queue->qhdr_rx_req = receive_request; /* * mb() to ensure qhdr is updated in main memory @@ -518,21 +531,28 @@ static int __read_queue(struct vidc_iface_q_info *qinfo, u8 *packet, } read_ptr = (u32 *)((qinfo->q_array.align_virtual_addr) + - (queue->qhdr_read_idx << 2)); + (read_idx << 2)); + if (read_ptr < (u32 *)qinfo->q_array.align_virtual_addr || + read_ptr > (u32 *)(qinfo->q_array.align_virtual_addr + + qinfo->q_array.mem_size - sizeof(*read_ptr))) { + dprintk(VIDC_ERR, "Invalid read index\n"); + return -ENODATA; + } + packet_size_in_words = (*read_ptr) >> 2; if (!packet_size_in_words) { dprintk(VIDC_ERR, "Zero packet size\n"); return -ENODATA; } - new_read_idx = queue->qhdr_read_idx + packet_size_in_words; - if (((packet_size_in_words << 2) <= VIDC_IFACEQ_VAR_HUGE_PKT_SIZE) - && queue->qhdr_read_idx <= queue->qhdr_q_size) { - if (new_read_idx < queue->qhdr_q_size) { + new_read_idx = read_idx + packet_size_in_words; + if (((packet_size_in_words << 2) <= VIDC_IFACEQ_VAR_HUGE_PKT_SIZE) && + read_idx <= (qinfo->q_array.mem_size >> 2)) { + if (new_read_idx < (qinfo->q_array.mem_size >> 2)) { memcpy(packet, read_ptr, packet_size_in_words << 2); } else { - new_read_idx -= queue->qhdr_q_size; + new_read_idx -= (qinfo->q_array.mem_size >> 2); memcpy(packet, read_ptr, (packet_size_in_words - new_read_idx) << 2); memcpy(packet + ((packet_size_in_words - @@ -543,18 +563,18 @@ static int __read_queue(struct vidc_iface_q_info *qinfo, u8 *packet, } else { dprintk(VIDC_WARN, "BAD packet received, read_idx: %#x, pkt_size: %d\n", - queue->qhdr_read_idx, packet_size_in_words << 2); + read_idx, packet_size_in_words << 2); dprintk(VIDC_WARN, "Dropping this packet\n"); - new_read_idx = queue->qhdr_write_idx; + new_read_idx = write_idx; rc = -ENODATA; } - queue->qhdr_read_idx = new_read_idx; - - if (queue->qhdr_read_idx != queue->qhdr_write_idx) + if (new_read_idx != write_idx) queue->qhdr_rx_req = 0; else queue->qhdr_rx_req = receive_request; + + queue->qhdr_read_idx = new_read_idx; /* * mb() to ensure qhdr is updated in main memory * so that venus reads the updated header values diff --git a/drivers/media/platform/msm/vidc_3x/hfi_response_handler.c b/drivers/media/platform/msm/vidc_3x/hfi_response_handler.c index 8eaf1fd192af..9f85f5d8b0f0 100644 --- a/drivers/media/platform/msm/vidc_3x/hfi_response_handler.c +++ b/drivers/media/platform/msm/vidc_3x/hfi_response_handler.c @@ -322,9 +322,10 @@ static int hfi_process_session_error(u32 device_id, } static int hfi_process_event_notify(u32 device_id, - struct hfi_msg_event_notify_packet *pkt, + void *_pkt, struct msm_vidc_cb_info *info) { + struct hfi_msg_event_notify_packet *pkt = _pkt; dprintk(VIDC_DBG, "Received: EVENT_NOTIFY\n"); if (pkt->size < sizeof(struct hfi_msg_event_notify_packet)) { @@ -363,9 +364,10 @@ static int hfi_process_event_notify(u32 device_id, } static int hfi_process_sys_init_done(u32 device_id, - struct hfi_msg_sys_init_done_packet *pkt, + void *_pkt, struct msm_vidc_cb_info *info) { + struct hfi_msg_sys_init_done_packet *pkt = _pkt; struct msm_vidc_cb_cmd_done cmd_done = {0}; enum vidc_status status = VIDC_ERR_NONE; @@ -402,9 +404,10 @@ err_no_prop: } static int hfi_process_sys_rel_resource_done(u32 device_id, - struct hfi_msg_sys_release_resource_done_packet *pkt, + void *_pkt, struct msm_vidc_cb_info *info) { + struct hfi_msg_sys_release_resource_done_packet *pkt = _pkt; struct msm_vidc_cb_cmd_done cmd_done = {0}; enum vidc_status status = VIDC_ERR_NONE; u32 pkt_size; @@ -1228,9 +1231,10 @@ static void hfi_process_sess_get_prop_buf_req( } static int hfi_process_session_prop_info(u32 device_id, - struct hfi_msg_session_property_info_packet *pkt, + void *_pkt, struct msm_vidc_cb_info *info) { + struct hfi_msg_session_property_info_packet *pkt = _pkt; struct msm_vidc_cb_cmd_done cmd_done = {0}; struct hfi_profile_level profile_level = {0}; enum hal_h264_entropy entropy = HAL_UNUSED_ENTROPY; @@ -1303,9 +1307,10 @@ static int hfi_process_session_prop_info(u32 device_id, } static int hfi_process_session_init_done(u32 device_id, - struct hfi_msg_sys_session_init_done_packet *pkt, + void *_pkt, struct msm_vidc_cb_info *info) { + struct hfi_msg_sys_session_init_done_packet *pkt = _pkt; struct msm_vidc_cb_cmd_done cmd_done = {0}; struct vidc_hal_session_init_done session_init_done = { {0} }; @@ -1337,9 +1342,10 @@ static int hfi_process_session_init_done(u32 device_id, } static int hfi_process_session_load_res_done(u32 device_id, - struct hfi_msg_session_load_resources_done_packet *pkt, + void *_pkt, struct msm_vidc_cb_info *info) { + struct hfi_msg_session_load_resources_done_packet *pkt = _pkt; struct msm_vidc_cb_cmd_done cmd_done = {0}; dprintk(VIDC_DBG, "RECEIVED: SESSION_LOAD_RESOURCES_DONE[%#x]\n", @@ -1367,9 +1373,10 @@ static int hfi_process_session_load_res_done(u32 device_id, } static int hfi_process_session_flush_done(u32 device_id, - struct hfi_msg_session_flush_done_packet *pkt, + void *_pkt, struct msm_vidc_cb_info *info) { + struct hfi_msg_session_flush_done_packet *pkt = _pkt; struct msm_vidc_cb_cmd_done cmd_done = {0}; dprintk(VIDC_DBG, "RECEIVED: SESSION_FLUSH_DONE[%#x]\n", @@ -1412,9 +1419,10 @@ static int hfi_process_session_flush_done(u32 device_id, } static int hfi_process_session_etb_done(u32 device_id, - struct hfi_msg_session_empty_buffer_done_packet *pkt, + void *_pkt, struct msm_vidc_cb_info *info) { + struct hfi_msg_session_empty_buffer_done_packet *pkt = _pkt; struct msm_vidc_cb_data_done data_done = {0}; struct hfi_picture_type *hfi_picture_type = NULL; @@ -1463,9 +1471,10 @@ static int hfi_process_session_etb_done(u32 device_id, } static int hfi_process_session_ftb_done( - u32 device_id, struct vidc_hal_msg_pkt_hdr *msg_hdr, + u32 device_id, void *_pkt, struct msm_vidc_cb_info *info) { + struct vidc_hal_msg_pkt_hdr *msg_hdr = _pkt; struct msm_vidc_cb_data_done data_done = {0}; bool is_decoder = false, is_encoder = false; @@ -1590,9 +1599,10 @@ static int hfi_process_session_ftb_done( } static int hfi_process_session_start_done(u32 device_id, - struct hfi_msg_session_start_done_packet *pkt, + void *_pkt, struct msm_vidc_cb_info *info) { + struct hfi_msg_session_start_done_packet *pkt = _pkt; struct msm_vidc_cb_cmd_done cmd_done = {0}; dprintk(VIDC_DBG, "RECEIVED: SESSION_START_DONE[%#x]\n", @@ -1618,9 +1628,10 @@ static int hfi_process_session_start_done(u32 device_id, } static int hfi_process_session_stop_done(u32 device_id, - struct hfi_msg_session_stop_done_packet *pkt, + void *_pkt, struct msm_vidc_cb_info *info) { + struct hfi_msg_session_stop_done_packet *pkt = _pkt; struct msm_vidc_cb_cmd_done cmd_done = {0}; dprintk(VIDC_DBG, "RECEIVED: SESSION_STOP_DONE[%#x]\n", @@ -1647,9 +1658,10 @@ static int hfi_process_session_stop_done(u32 device_id, } static int hfi_process_session_rel_res_done(u32 device_id, - struct hfi_msg_session_release_resources_done_packet *pkt, + void *_pkt, struct msm_vidc_cb_info *info) { + struct hfi_msg_session_release_resources_done_packet *pkt = _pkt; struct msm_vidc_cb_cmd_done cmd_done = {0}; dprintk(VIDC_DBG, "RECEIVED: SESSION_RELEASE_RESOURCES_DONE[%#x]\n", @@ -1676,9 +1688,10 @@ static int hfi_process_session_rel_res_done(u32 device_id, } static int hfi_process_session_rel_buf_done(u32 device_id, - struct hfi_msg_session_release_buffers_done_packet *pkt, + void *_pkt, struct msm_vidc_cb_info *info) { + struct hfi_msg_session_release_buffers_done_packet *pkt = _pkt; struct msm_vidc_cb_cmd_done cmd_done = {0}; if (!pkt || pkt->size < @@ -1711,9 +1724,10 @@ static int hfi_process_session_rel_buf_done(u32 device_id, } static int hfi_process_session_end_done(u32 device_id, - struct hfi_msg_sys_session_end_done_packet *pkt, + void *_pkt, struct msm_vidc_cb_info *info) { + struct hfi_msg_sys_session_end_done_packet *pkt = _pkt; struct msm_vidc_cb_cmd_done cmd_done = {0}; dprintk(VIDC_DBG, "RECEIVED: SESSION_END_DONE[%#x]\n", pkt->session_id); @@ -1738,9 +1752,10 @@ static int hfi_process_session_end_done(u32 device_id, } static int hfi_process_session_abort_done(u32 device_id, - struct hfi_msg_sys_session_abort_done_packet *pkt, + void *_pkt, struct msm_vidc_cb_info *info) { + struct hfi_msg_sys_session_abort_done_packet *pkt = _pkt; struct msm_vidc_cb_cmd_done cmd_done = {0}; dprintk(VIDC_DBG, "RECEIVED: SESSION_ABORT_DONE[%#x]\n", @@ -1846,9 +1861,10 @@ static void hfi_process_sys_get_prop_image_version( } static int hfi_process_sys_property_info(u32 device_id, - struct hfi_msg_sys_property_info_packet *pkt, + void *_pkt, struct msm_vidc_cb_info *info) { + struct hfi_msg_sys_property_info_packet *pkt = _pkt; if (!pkt) { dprintk(VIDC_ERR, "%s: invalid param\n", __func__); return -EINVAL; @@ -1880,7 +1896,7 @@ static int hfi_process_sys_property_info(u32 device_id, } static int hfi_process_ignore(u32 device_id, - struct vidc_hal_msg_pkt_hdr *msg_hdr, + void *_pkt, struct msm_vidc_cb_info *info) { *info = (struct msm_vidc_cb_info) { @@ -1964,5 +1980,6 @@ int hfi_process_msg_packet(u32 device_id, struct vidc_hal_msg_pkt_hdr *msg_hdr, break; } - return pkt_func ? pkt_func(device_id, msg_hdr, info) : -ENOTSUPP; + return pkt_func ? + pkt_func(device_id, (void *)msg_hdr, info) : -ENOTSUPP; } diff --git a/drivers/media/platform/msm/vidc_3x/venus_hfi.c b/drivers/media/platform/msm/vidc_3x/venus_hfi.c index 0c3ed26cb090..89245292d458 100644 --- a/drivers/media/platform/msm/vidc_3x/venus_hfi.c +++ b/drivers/media/platform/msm/vidc_3x/venus_hfi.c @@ -331,7 +331,7 @@ static int __write_queue(struct vidc_iface_q_info *qinfo, u8 *packet, { struct hfi_queue_header *queue; u32 packet_size_in_words, new_write_idx; - u32 empty_space, read_idx; + u32 empty_space, read_idx, write_idx; u32 *write_ptr; if (!qinfo || !packet) { @@ -354,16 +354,18 @@ static int __write_queue(struct vidc_iface_q_info *qinfo, u8 *packet, } packet_size_in_words = (*(u32 *)packet) >> 2; - if (!packet_size_in_words) { - dprintk(VIDC_ERR, "Zero packet size\n"); + if (!packet_size_in_words || packet_size_in_words > + qinfo->q_array.mem_size>>2) { + dprintk(VIDC_ERR, "Invalid packet size\n"); return -ENODATA; } read_idx = queue->qhdr_read_idx; + write_idx = queue->qhdr_write_idx; - empty_space = (queue->qhdr_write_idx >= read_idx) ? - (queue->qhdr_q_size - (queue->qhdr_write_idx - read_idx)) : - (read_idx - queue->qhdr_write_idx); + empty_space = (write_idx >= read_idx) ? + ((qinfo->q_array.mem_size>>2) - (write_idx - read_idx)) : + (read_idx - write_idx); if (empty_space <= packet_size_in_words) { queue->qhdr_tx_req = 1; dprintk(VIDC_ERR, "Insufficient size (%d) to write (%d)\n", @@ -373,13 +375,20 @@ static int __write_queue(struct vidc_iface_q_info *qinfo, u8 *packet, queue->qhdr_tx_req = 0; - new_write_idx = (queue->qhdr_write_idx + packet_size_in_words); + new_write_idx = write_idx + packet_size_in_words; write_ptr = (u32 *)((qinfo->q_array.align_virtual_addr) + - (queue->qhdr_write_idx << 2)); - if (new_write_idx < queue->qhdr_q_size) { + (write_idx << 2)); + if (write_ptr < (u32 *)qinfo->q_array.align_virtual_addr || + write_ptr > (u32 *)(qinfo->q_array.align_virtual_addr + + qinfo->q_array.mem_size)) { + dprintk(VIDC_ERR, "Invalid write index"); + return -ENODATA; + } + + if (new_write_idx < (qinfo->q_array.mem_size >> 2)) { memcpy(write_ptr, packet, packet_size_in_words << 2); } else { - new_write_idx -= queue->qhdr_q_size; + new_write_idx -= qinfo->q_array.mem_size >> 2; memcpy(write_ptr, packet, (packet_size_in_words - new_write_idx) << 2); memcpy((void *)qinfo->q_array.align_virtual_addr, @@ -473,7 +482,8 @@ static int __read_queue(struct vidc_iface_q_info *qinfo, u8 *packet, u32 packet_size_in_words, new_read_idx; u32 *read_ptr; u32 receive_request = 0; - int rc = 0; + u32 read_idx, write_idx; + int rc = 0; if (!qinfo || !packet || !pb_tx_req_is_set) { dprintk(VIDC_ERR, "Invalid Params\n"); @@ -505,7 +515,10 @@ static int __read_queue(struct vidc_iface_q_info *qinfo, u8 *packet, if (queue->qhdr_type & HFI_Q_ID_CTRL_TO_HOST_MSG_Q) receive_request = 1; - if (queue->qhdr_read_idx == queue->qhdr_write_idx) { + read_idx = queue->qhdr_read_idx; + write_idx = queue->qhdr_write_idx; + + if (read_idx == write_idx) { queue->qhdr_rx_req = receive_request; *pb_tx_req_is_set = 0; dprintk(VIDC_DBG, @@ -517,21 +530,28 @@ static int __read_queue(struct vidc_iface_q_info *qinfo, u8 *packet, } read_ptr = (u32 *)((qinfo->q_array.align_virtual_addr) + - (queue->qhdr_read_idx << 2)); + (read_idx << 2)); + if (read_ptr < (u32 *)qinfo->q_array.align_virtual_addr || + read_ptr > (u32 *)(qinfo->q_array.align_virtual_addr + + qinfo->q_array.mem_size - sizeof(*read_ptr))) { + dprintk(VIDC_ERR, "Invalid read index\n"); + return -ENODATA; + } + packet_size_in_words = (*read_ptr) >> 2; if (!packet_size_in_words) { dprintk(VIDC_ERR, "Zero packet size\n"); return -ENODATA; } - new_read_idx = queue->qhdr_read_idx + packet_size_in_words; - if (((packet_size_in_words << 2) <= VIDC_IFACEQ_VAR_HUGE_PKT_SIZE) - && queue->qhdr_read_idx <= queue->qhdr_q_size) { - if (new_read_idx < queue->qhdr_q_size) { + new_read_idx = read_idx + packet_size_in_words; + if (((packet_size_in_words << 2) <= VIDC_IFACEQ_VAR_HUGE_PKT_SIZE) && + read_idx <= (qinfo->q_array.mem_size >> 2)) { + if (new_read_idx < (qinfo->q_array.mem_size >> 2)) { memcpy(packet, read_ptr, packet_size_in_words << 2); } else { - new_read_idx -= queue->qhdr_q_size; + new_read_idx -= (qinfo->q_array.mem_size >> 2); memcpy(packet, read_ptr, (packet_size_in_words - new_read_idx) << 2); memcpy(packet + ((packet_size_in_words - @@ -542,19 +562,18 @@ static int __read_queue(struct vidc_iface_q_info *qinfo, u8 *packet, } else { dprintk(VIDC_WARN, "BAD packet received, read_idx: %#x, pkt_size: %d\n", - queue->qhdr_read_idx, packet_size_in_words << 2); + read_idx, packet_size_in_words << 2); dprintk(VIDC_WARN, "Dropping this packet\n"); - new_read_idx = queue->qhdr_write_idx; + new_read_idx = write_idx; rc = -ENODATA; } - queue->qhdr_read_idx = new_read_idx; - - if (queue->qhdr_read_idx != queue->qhdr_write_idx) + if (new_read_idx != write_idx) queue->qhdr_rx_req = 0; else queue->qhdr_rx_req = receive_request; + queue->qhdr_read_idx = new_read_idx; *pb_tx_req_is_set = (queue->qhdr_tx_req == 1) ? 1 : 0; if (msm_vidc_debug & VIDC_PKT) { diff --git a/drivers/platform/msm/sps/sps.c b/drivers/platform/msm/sps/sps.c index 05a8c66d57aa..465e0793951c 100644 --- a/drivers/platform/msm/sps/sps.c +++ b/drivers/platform/msm/sps/sps.c @@ -1,4 +1,4 @@ -/* Copyright (c) 2011-2018, The Linux Foundation. All rights reserved. +/* Copyright (c) 2011-2019, The Linux Foundation. All rights reserved. * * This program is free software; you can redistribute it and/or modify * it under the terms of the GNU General Public License version 2 and @@ -675,7 +675,8 @@ int sps_get_bam_debug_info(unsigned long dev, u32 option, u32 para, /* Search for the target BAM device */ bam = sps_h2bam(dev); if (bam == NULL) { - pr_err("sps:Can't find any BAM with handle 0x%lx.", dev); + pr_err("sps:Can't find any BAM with handle 0x%pK.", + (void *)dev); mutex_unlock(&sps->lock); return SPS_ERROR; } @@ -1226,7 +1227,7 @@ struct sps_bam *sps_h2bam(unsigned long h) { struct sps_bam *bam; - SPS_DBG1(sps, "sps:%s: BAM handle:0x%lx.", __func__, h); + SPS_DBG1(sps, "sps:%s: BAM handle:0x%pK.", __func__, (void *)h); if (h == SPS_DEV_HANDLE_MEM || h == SPS_DEV_HANDLE_INVALID) return NULL; @@ -1236,7 +1237,7 @@ struct sps_bam *sps_h2bam(unsigned long h) return bam; } - SPS_ERR(sps, "sps:Can't find BAM device for handle 0x%lx.", h); + SPS_ERR(sps, "sps:Can't find BAM device for handle 0x%pK.", (void *)h); return NULL; } @@ -1341,16 +1342,17 @@ int sps_connect(struct sps_pipe *h, struct sps_connect *connect) bam = sps_h2bam(dev); if (bam == NULL) { - SPS_ERR(sps, "sps:Invalid BAM device handle: 0x%lx", dev); + SPS_ERR(sps, "sps:Invalid BAM device handle: 0x%pK", + (void *)dev); result = SPS_ERROR; goto exit_err; } mutex_lock(&bam->lock); - SPS_DBG2(bam, "sps:sps_connect: bam %pa src 0x%lx dest 0x%lx mode %s", + SPS_DBG2(bam, "sps:sps_connect: bam %pa src 0x%pK dest 0x%pK mode %s", BAM_ID(bam), - connect->source, - connect->destination, + (void *)connect->source, + (void *)connect->destination, connect->mode == SPS_MODE_SRC ? "SRC" : "DEST"); /* Allocate resources for the specified connection */ @@ -1414,10 +1416,10 @@ int sps_disconnect(struct sps_pipe *h) } SPS_DBG2(bam, - "sps:sps_disconnect: bam %pa src 0x%lx dest 0x%lx mode %s", + "sps:sps_disconnect: bam %pa src 0x%pK dest 0x%pK mode %s", BAM_ID(bam), - pipe->connect.source, - pipe->connect.destination, + (void *)pipe->connect.source, + (void *)pipe->connect.destination, pipe->connect.mode == SPS_MODE_SRC ? "SRC" : "DEST"); result = SPS_ERROR; @@ -1813,7 +1815,8 @@ int sps_device_reset(unsigned long dev) /* Search for the target BAM device */ bam = sps_h2bam(dev); if (bam == NULL) { - SPS_ERR(sps, "sps:Invalid BAM device handle: 0x%lx", dev); + SPS_ERR(sps, "sps:Invalid BAM device handle: 0x%pK", + (void *)dev); result = SPS_ERROR; goto exit_err; } @@ -1824,7 +1827,8 @@ int sps_device_reset(unsigned long dev) result = sps_bam_reset(bam); mutex_unlock(&bam->lock); if (result) { - SPS_ERR(sps, "sps:Fail to reset BAM device: 0x%lx", dev); + SPS_ERR(sps, "sps:Fail to reset BAM device: 0x%pK", + (void *)dev); goto exit_err; } diff --git a/drivers/platform/msm/sps/sps_bam.c b/drivers/platform/msm/sps/sps_bam.c index 7d6a7eb039f6..475e9db39bd8 100644 --- a/drivers/platform/msm/sps/sps_bam.c +++ b/drivers/platform/msm/sps/sps_bam.c @@ -1,4 +1,4 @@ -/* Copyright (c) 2011-2018, The Linux Foundation. All rights reserved. +/* Copyright (c) 2011-2019, The Linux Foundation. All rights reserved. * * This program is free software; you can redistribute it and/or modify * it under the terms of the GNU General Public License version 2 and @@ -895,8 +895,8 @@ int sps_bam_pipe_connect(struct sps_pipe *bam_pipe, else iova = bam_pipe->connect.source_iova; SPS_DBG2(dev, - "sps:BAM %pa pipe %d uses IOVA 0x%lx.\n", - BAM_ID(dev), pipe_index, iova); + "sps:BAM %pa pipe %d uses IOVA 0x%pK.\n", + BAM_ID(dev), pipe_index, (void *)iova); hw_params.peer_phys_addr = (u32)iova; } else { hw_params.peer_phys_addr = peer_bam->props.phys_addr; @@ -918,9 +918,9 @@ int sps_bam_pipe_connect(struct sps_pipe *bam_pipe, hw_params.data_base = (phys_addr_t)bam_pipe->connect.data.iova; SPS_DBG2(dev, - "sps:BAM %pa pipe %d uses IOVA 0x%lx for data FIFO.\n", + "sps:BAM %pa pipe %d uses IOVA 0x%pK for data FIFO.\n", BAM_ID(dev), pipe_index, - bam_pipe->connect.data.iova); + (void *)(bam_pipe->connect.data.iova)); } else { hw_params.data_base = map->data.phys_base; } @@ -971,9 +971,9 @@ int sps_bam_pipe_connect(struct sps_pipe *bam_pipe, hw_params.desc_base = (phys_addr_t)bam_pipe->connect.desc.iova; SPS_DBG2(dev, - "sps:BAM %pa pipe %d uses IOVA 0x%lx for desc FIFO.\n", + "sps:BAM %pa pipe %d uses IOVA 0x%pK for desc FIFO.\n", BAM_ID(dev), pipe_index, - bam_pipe->connect.desc.iova); + (void *)(bam_pipe->connect.desc.iova)); } else { hw_params.desc_base = map->desc.phys_base; } @@ -1424,8 +1424,9 @@ int sps_bam_pipe_transfer_one(struct sps_bam *dev, u32 next_write; static int show_recom; - SPS_DBG(dev, "sps:BAM %pa pipe %d addr 0x%x size 0x%x flags 0x%x\n", - BAM_ID(dev), pipe_index, addr, size, flags); + SPS_DBG(dev, "sps:BAM %pa pipe %d addr 0x%pK size 0x%x flags 0x%x\n", + BAM_ID(dev), pipe_index, + (void *)(long)addr, size, flags); /* Is this a BAM-to-BAM or satellite connection? */ if ((pipe->state & (BAM_STATE_BAM2BAM | BAM_STATE_REMOTE))) { @@ -1951,8 +1952,8 @@ static void pipe_handler_eot(struct sps_bam *dev, struct sps_pipe *pipe) user = &pipe->sys.user_ptrs[offset / sizeof(struct sps_iovec)]; for (;;) { SPS_DBG(dev, - "sps:%s; pipe index:%d; iovec addr:0x%x; size:0x%x; flags:0x%x; enabled:0x%x; *user is %s NULL.\n", - __func__, pipe->pipe_index, cache->addr, + "sps:%s; pipe index:%d; iovec addr:0x%pK; size:0x%x; flags:0x%x; enabled:0x%x; *user is %s NULL.\n", + __func__, pipe->pipe_index, (void *)(long)cache->addr, cache->size, cache->flags, enabled, (*user == NULL) ? "" : "not"); @@ -2240,8 +2241,8 @@ int sps_bam_pipe_get_iovec(struct sps_bam *dev, u32 pipe_index, pipe->sys.acked_offset = 0; SPS_DBG(dev, - "sps:%s; pipe index:%d; iovec addr:0x%x; size:0x%x; flags:0x%x; acked_offset:0x%x.\n", - __func__, pipe->pipe_index, desc->addr, + "sps:%s; pipe index:%d; iovec addr:0x%pK; size:0x%x; flags:0x%x; acked_offset:0x%x.\n", + __func__, pipe->pipe_index, (void *)(long)desc->addr, desc->size, desc->flags, pipe->sys.acked_offset); return 0; diff --git a/drivers/platform/msm/sps/sps_dma.c b/drivers/platform/msm/sps/sps_dma.c index abdcabc8cddd..0cc428399ecf 100644 --- a/drivers/platform/msm/sps/sps_dma.c +++ b/drivers/platform/msm/sps/sps_dma.c @@ -1,4 +1,4 @@ -/* Copyright (c) 2011-2013, 2015, 2017, The Linux Foundation. All rights +/* Copyright (c) 2011-2013, 2015, 2017, 2019, The Linux Foundation. All rights * reserved. * * This program is free software; you can redistribute it and/or modify @@ -381,7 +381,7 @@ int sps_dma_device_de_init(unsigned long h) dev = sps_dma_find_device(h); if (dev == NULL) { - SPS_ERR(sps, "sps:BAM-DMA: not registered: %lx", h); + SPS_ERR(sps, "sps:BAM-DMA: not registered: %pK", (void *)h); result = SPS_ERROR; goto exit_err; } @@ -547,8 +547,8 @@ int sps_alloc_dma_chan(const struct sps_alloc_dma_chan *alloc, dev = sps_dma_find_device(alloc->dev); if (dev == NULL) { - SPS_ERR(sps, "sps:BAM-DMA: invalid BAM handle: %lx", - alloc->dev); + SPS_ERR(sps, "sps:BAM-DMA: invalid BAM handle: %pK", + (void *)alloc->dev); goto exit_err; } @@ -621,7 +621,8 @@ int sps_free_dma_chan(struct sps_dma_chan *chan) dev = sps_dma_find_device(chan->dev); if (dev == NULL) { - SPS_ERR(sps, "sps:BAM-DMA: invalid BAM handle: %lx", chan->dev); + SPS_ERR(sps, "sps:BAM-DMA: invalid BAM handle: %pK", + (void *)chan->dev); result = SPS_ERROR; goto exit_err; } diff --git a/drivers/platform/msm/sps/sps_mem.c b/drivers/platform/msm/sps/sps_mem.c index 105135a0e022..f5e026ba62ed 100644 --- a/drivers/platform/msm/sps/sps_mem.c +++ b/drivers/platform/msm/sps/sps_mem.c @@ -1,4 +1,4 @@ -/* Copyright (c) 2011-2013, 2015, 2017, The Linux Foundation. +/* Copyright (c) 2011-2013, 2015, 2017, 2019, The Linux Foundation. * All rights reserved. * * This program is free software; you can redistribute it and/or modify @@ -75,8 +75,8 @@ phys_addr_t sps_mem_alloc_io(u32 bytes) return SPS_ADDR_INVALID; } - SPS_DBG3(sps, "sps:sps_mem_alloc_io.phys=%pa.virt=0x%lx.size=0x%x.", - &phys_addr, virt_addr, bytes); + SPS_DBG3(sps, "sps:sps_mem_alloc_io.phys=%pa.virt=0x%pK.size=0x%x.", + &phys_addr, (void *)virt_addr, bytes); return phys_addr; } @@ -92,8 +92,8 @@ void sps_mem_free_io(phys_addr_t phys_addr, u32 bytes) iomem_offset = phys_addr - iomem_phys; virt_addr = (uintptr_t) iomem_virt + iomem_offset; - SPS_DBG3(sps, "sps:sps_mem_free_io.phys=%pa.virt=0x%lx.size=0x%x.", - &phys_addr, virt_addr, bytes); + SPS_DBG3(sps, "sps:sps_mem_free_io.phys=%pa.virt=0x%pK.size=0x%x.", + &phys_addr, (void *)virt_addr, bytes); gen_pool_free(pool, virt_addr, bytes); total_free += bytes; diff --git a/drivers/platform/msm/sps/sps_rm.c b/drivers/platform/msm/sps/sps_rm.c index 276b847979e1..ef6029a9e518 100644 --- a/drivers/platform/msm/sps/sps_rm.c +++ b/drivers/platform/msm/sps/sps_rm.c @@ -1,4 +1,4 @@ -/* Copyright (c) 2011-2015, 2017, The Linux Foundation. All rights reserved. +/* Copyright (c) 2011-2015, 2017, 2019, The Linux Foundation. All rights reserved. * * This program is free software; you can redistribute it and/or modify * it under the terms of the GNU General Public License version 2 and @@ -380,8 +380,8 @@ static struct sps_connection *sps_rm_create(struct sps_pipe *pipe) map->src.bam = sps_h2bam(map->src.dev); if (map->src.bam == NULL) { if (map->src.dev != SPS_DEV_HANDLE_MEM) { - SPS_ERR(sps, "sps:Invalid BAM handle: %pa", - &map->src.dev); + SPS_ERR(sps, "sps:Invalid BAM handle: %pK", + (void *)(&map->src.dev)); goto exit_err; } map->src.pipe_index = SPS_BAM_PIPE_INVALID; @@ -389,8 +389,8 @@ static struct sps_connection *sps_rm_create(struct sps_pipe *pipe) map->dest.bam = sps_h2bam(map->dest.dev); if (map->dest.bam == NULL) { if (map->dest.dev != SPS_DEV_HANDLE_MEM) { - SPS_ERR(sps, "sps:Invalid BAM handle: %pa", - &map->dest.dev); + SPS_ERR(sps, "sps:Invalid BAM handle: %pK", + (void *)(&map->dest.dev)); goto exit_err; } map->dest.pipe_index = SPS_BAM_PIPE_INVALID; @@ -399,8 +399,8 @@ static struct sps_connection *sps_rm_create(struct sps_pipe *pipe) /* Check the BAM device for the pipe */ if ((dir == SPS_MODE_SRC && map->src.bam == NULL) || (dir != SPS_MODE_SRC && map->dest.bam == NULL)) { - SPS_ERR(sps, "sps:Invalid BAM endpt: dir %d src %pa dest %pa", - dir, &map->src.dev, &map->dest.dev); + SPS_ERR(sps, "sps:Invalid BAM endpt: dir %d src %pK dest %pK", + dir, (void *)(&map->src.dev), (void *)(&map->dest.dev)); goto exit_err; } diff --git a/drivers/staging/android/ion/ion_system_heap.c b/drivers/staging/android/ion/ion_system_heap.c index eb7c61b8d375..79c1541fdca3 100644 --- a/drivers/staging/android/ion/ion_system_heap.c +++ b/drivers/staging/android/ion/ion_system_heap.c @@ -2,7 +2,7 @@ * drivers/staging/android/ion/ion_system_heap.c * * Copyright (C) 2011 Google, Inc. - * Copyright (c) 2011-2018, The Linux Foundation. All rights reserved. + * Copyright (c) 2011-2019, The Linux Foundation. All rights reserved. * * This software is licensed under the terms of the GNU General Public * License version 2, as published by the Free Software Foundation, and @@ -275,6 +275,9 @@ static struct page_info *alloc_from_pool_preferred( struct page_info *info; int i; + if (buffer->flags & ION_FLAG_POOL_FORCE_ALLOC) + goto force_alloc; + info = kmalloc(sizeof(*info), GFP_KERNEL); if (!info) return NULL; @@ -306,6 +309,7 @@ static struct page_info *alloc_from_pool_preferred( } kfree(info); +force_alloc: return alloc_largest_available(heap, buffer, size, max_order); } |