]> rtime.felk.cvut.cz Git - sojka/nv-tegra/linux-3.10.git/blob - drivers/media/platform/tegra/cam_dev/virtual.c
media: tegra: camera: Fix stack overread
[sojka/nv-tegra/linux-3.10.git] / drivers / media / platform / tegra / cam_dev / virtual.c
1 /*
2  * virtual.c - Virtual kernel driver
3  *
4  * Copyright (c) 2013-2014, NVIDIA CORPORATION.  All rights reserved.
5
6  * This program is free software; you can redistribute it and/or modify it
7  * under the terms and conditions of the GNU General Public License,
8  * version 2, as published by the Free Software Foundation.
9
10  * This program is distributed in the hope it will be useful, but WITHOUT
11  * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
12  * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for
13  * more details.
14
15  * You should have received a copy of the GNU General Public License
16  * along with this program.  If not, see <http://www.gnu.org/licenses/>.
17  */
18
19 #define CAMERA_DEVICE_INTERNAL
20
21 #include <linux/kernel.h>
22 #include <linux/slab.h>
23 #include <linux/err.h>
24 #include <linux/uaccess.h>
25 #include <linux/delay.h>
26 #include <linux/gpio.h>
27 #include <linux/module.h>
28 #include <linux/of_device.h>
29 #include <linux/clk.h>
30
31 #include <media/nvc.h>
32 #include <media/camera.h>
33
34 struct chip_config {
35         int clk_num;
36         int gpio_num;
37         int reg_num;
38         struct camera_reg *seq_power_on;
39         struct camera_reg *seq_power_off;
40         char *reg_names[];
41 };
42
43 static int virtual_update(
44         struct camera_device *cdev, struct cam_update *upd, int num)
45 {
46         int err = 0;
47         int idx;
48
49         dev_dbg(cdev->dev, "%s %d\n", __func__, num);
50         mutex_lock(&cdev->mutex);
51         for (idx = 0; idx < num; idx++) {
52                 switch (upd[idx].type) {
53                 case UPDATE_CLOCK:
54                 {
55                         struct clk *ck;
56                         char *clk_name;
57
58                         if (!cdev->num_clk) {
59                                 dev_err(cdev->dev, "NO clock needed.\n");
60                                 err = -ENODEV;
61                                 break;
62                         }
63                         if (upd[idx].index >= cdev->num_clk) {
64                                 dev_err(cdev->dev,
65                                         "clock index %d out of range.\n",
66                                         upd[idx].index);
67                                 err = -ENODEV;
68                                 break;
69                         }
70
71                         clk_name = (void *)upd[idx].args;
72                         dev_dbg(cdev->dev, "%s UPDATE_CLOCK %d of %d, %s\n",
73                                 __func__, upd[idx].index,
74                                 cdev->num_clk, clk_name);
75                         ck = devm_clk_get(cdev->dev, clk_name);
76                         if (IS_ERR(ck)) {
77                                 dev_err(cdev->dev, "%s: get clock %s FAILED.\n",
78                                         __func__, clk_name);
79                                 return PTR_ERR(ck);
80                         }
81                         cdev->clks[upd[idx].index] = ck;
82                         dev_dbg(cdev->dev, "UPDATE_CLOCK: %d %s\n",
83                                 upd[idx].index, clk_name);
84                         break;
85                 }
86                 case UPDATE_PINMUX:
87                 {
88                         u32 *pinmux;
89
90                         if (!cdev->pinmux_num) {
91                                 dev_err(cdev->dev, "NO pinmux available.\n");
92                                 err = -ENODEV;
93                                 break;
94                         }
95                         if (upd[idx].arg >= cdev->pinmux_num) {
96                                 dev_err(cdev->dev,
97                                         "pinmux index %u out of range.\n",
98                                         upd[idx].arg);
99                                 err = -ENODEV;
100                                 break;
101                         }
102
103                         dev_dbg(cdev->dev, "UPDATE_PINMUX: %d %u\n",
104                                 upd[idx].index, upd[idx].arg);
105                         if (!upd[idx].index)
106                                 pinmux = &cdev->mclk_enable_idx;
107                         else
108                                 pinmux = &cdev->mclk_disable_idx;
109                         *pinmux = upd[idx].arg;
110                         break;
111                 }
112                 case UPDATE_GPIO:
113                 {
114                         struct nvc_gpio *gpio;
115
116                         if (upd[idx].index >= cdev->num_gpio) {
117                                 dev_err(cdev->dev,
118                                         "gpio index %d out of range.\n",
119                                         upd[idx].index);
120                                 err = -ENODEV;
121                                 break;
122                         }
123                         gpio = (void *)((unsigned long)upd[idx].arg);
124                         if (gpio->gpio >= ARCH_NR_GPIOS) {
125                                 dev_err(cdev->dev,
126                                         "gpio index %d out of range.\n",
127                                         gpio->gpio);
128                                 err = -ENODEV;
129                                 break;
130                         }
131
132                         dev_dbg(cdev->dev, "UPDATE_GPIO: %d %u\n",
133                                 upd[idx].index, upd[idx].arg);
134                         gpio->valid = true;
135                         cdev->gpios[upd[idx].index] = *gpio;
136                         break;
137                 }
138                 default:
139                         dev_err(cdev->dev,
140                                 "unsupported upd type %d\n", upd[idx].type);
141                         break;
142                 }
143
144                 if (err)
145                         break;
146         }
147         mutex_unlock(&cdev->mutex);
148         return err;
149 }
150
151 static int virtual_power_on(struct camera_device *cdev)
152 {
153         struct chip_config *c_info = cdev->chip->private;
154         struct camera_reg *pwr_seq = c_info->seq_power_on;
155         int err = 0;
156
157         dev_dbg(cdev->dev, "%s %x %p\n",
158                 __func__, cdev->is_power_on, pwr_seq);
159         if (cdev->is_power_on || !pwr_seq)
160                 return 0;
161
162         mutex_lock(&cdev->mutex);
163         err = camera_dev_wr_table(cdev, pwr_seq, NULL);
164         if (!err)
165                 cdev->is_power_on = 1;
166         mutex_unlock(&cdev->mutex);
167         return err;
168 }
169
170 static int virtual_power_off(struct camera_device *cdev)
171 {
172         struct chip_config *c_info = cdev->chip->private;
173         struct camera_reg *pwr_seq = c_info->seq_power_off;
174         int err = 0;
175
176         dev_dbg(cdev->dev, "%s %x %p\n",
177                 __func__, cdev->is_power_on, pwr_seq);
178         if (!cdev->is_power_on || !pwr_seq)
179                 return 0;
180
181         mutex_lock(&cdev->mutex);
182         err = camera_dev_wr_table(cdev, pwr_seq, NULL);
183         if (!err)
184                 cdev->is_power_on = 0;
185         mutex_unlock(&cdev->mutex);
186
187         return err;
188 }
189
190 static int virtual_shutdown(struct camera_device *cdev)
191 {
192         int err = 0;
193
194         dev_dbg(cdev->dev, "%s %x\n", __func__, cdev->is_power_on);
195         if (!cdev->is_power_on)
196                 return 0;
197
198         if (!err)
199                 err = virtual_power_off(cdev);
200
201         return err;
202 }
203
204 static int virtual_instance_destroy(struct camera_device *cdev)
205 {
206         void *buf;
207         u32 idx;
208
209         dev_dbg(cdev->dev, "%s\n", __func__);
210
211         if (!cdev->dev)
212                 return 0;
213
214         buf = dev_get_drvdata(cdev->dev);
215         dev_set_drvdata(cdev->dev, NULL);
216
217         for (idx = 0; idx < cdev->num_reg; idx++)
218                 if (likely(cdev->regs[idx].vreg))
219                         regulator_put(cdev->regs[idx].vreg);
220
221         cdev->num_gpio = 0;
222         cdev->num_reg = 0;
223         kfree(buf);
224         return 0;
225 }
226
227 static int virtual_instance_create(struct camera_device *cdev, void *pdata)
228 {
229         struct chip_config *c_info = cdev->chip->private;
230         u32 idx;
231
232         dev_dbg(cdev->dev, "%s\n", __func__);
233         cdev->gpios = kzalloc(c_info->gpio_num * sizeof(*cdev->gpios) +
234                 c_info->reg_num * sizeof(*cdev->regs) +
235                 c_info->clk_num * sizeof(*cdev->clks),
236                 GFP_KERNEL);
237         if (cdev->gpios == NULL) {
238                 dev_err(cdev->dev, "%s memory low!\n", __func__);
239                 return -ENOMEM;
240         }
241
242         cdev->pinmux_num = ((struct camera_platform_data *)pdata)->pinmux_num;
243         cdev->pinmux_tbl = ((struct camera_platform_data *)pdata)->pinmux;
244         cdev->num_gpio = c_info->gpio_num;
245         cdev->regs = (void *)cdev->gpios +
246                 c_info->gpio_num * sizeof(*cdev->gpios);
247         cdev->num_reg = c_info->reg_num;
248         cdev->clks = (void *)cdev->regs + c_info->reg_num * sizeof(*cdev->regs);
249         cdev->num_clk = c_info->clk_num;
250         cdev->mclk_enable_idx = CAMDEV_INVALID;
251         cdev->mclk_disable_idx = CAMDEV_INVALID;
252
253         for (idx = 0; idx < cdev->num_gpio; idx++)
254                 cdev->gpios[idx].valid = false;
255
256         for (idx = 0; idx < cdev->num_reg; idx++) {
257                 cdev->regs[idx].vreg_name =
258                         (const char *)c_info->reg_names[idx];
259                 camera_regulator_get(cdev->dev, &cdev->regs[idx],
260                         (char *)cdev->regs[idx].vreg_name);
261         }
262
263         dev_set_drvdata(cdev->dev, cdev->gpios);
264         return 0;
265 }
266
267 static struct regmap_config regmap_cfg_default = {
268         .reg_bits = 16,
269         .val_bits = 8,
270         .cache_type = REGCACHE_NONE,
271 };
272
273 static int virtual_device_sanity_check(
274         struct device *dev, struct virtual_device *dev_info, int *len)
275 {
276         u32 num;
277         u8 *nptr;
278         int n;
279
280         dev_dbg(dev, "%s: %s, bus type %d, addr bits %d, val bits %d\n",
281                 __func__, dev_info->name, dev_info->bus_type,
282                 dev_info->regmap_cfg.addr_bits, dev_info->regmap_cfg.val_bits);
283         dev_dbg(dev, "gpios %d, regs %d, clks %d\n",
284                 dev_info->gpio_num, dev_info->reg_num, dev_info->clk_num);
285         if (dev_info->name[0] == '\0') {
286                 dev_err(dev, "%s need a device name!\n", __func__);
287                 return -ENODEV;
288         }
289
290         if (dev_info->bus_type != CAMERA_DEVICE_TYPE_I2C) {
291                 dev_err(dev, "%s unsupported device type %d!\n",
292                 __func__, dev_info->bus_type);
293                 return -ENODEV;
294         }
295
296         if (dev_info->regmap_cfg.addr_bits != 0 &&
297                 dev_info->regmap_cfg.addr_bits != 8 &&
298                 dev_info->regmap_cfg.addr_bits != 16) {
299                 dev_err(dev, "%s unsupported address bits %d!\n",
300                 __func__, dev_info->regmap_cfg.addr_bits);
301                 return -ENODEV;
302         }
303
304         if (dev_info->regmap_cfg.val_bits != 8 &&
305                 dev_info->regmap_cfg.val_bits != 16) {
306                 dev_err(dev, "%s unsupported data bits %d!\n",
307                 __func__, dev_info->regmap_cfg.val_bits);
308                 return -ENODEV;
309         }
310
311         if (dev_info->regmap_cfg.cache_type != REGCACHE_NONE &&
312                 dev_info->regmap_cfg.cache_type != REGCACHE_RBTREE &&
313                 dev_info->regmap_cfg.cache_type != REGCACHE_COMPRESSED) {
314                 dev_err(dev, "%s unsupported cache type %d!\n",
315                 __func__, dev_info->regmap_cfg.cache_type);
316                 return -ENODEV;
317         }
318
319         if (dev_info->gpio_num >= ARCH_NR_GPIOS) {
320                 dev_err(dev, "%s too many gpios %d!\n",
321                 __func__, dev_info->gpio_num);
322                 return -ENODEV;
323         }
324
325         if (dev_info->gpio_num >= 6) {
326                 dev_notice(dev, "%s WHAT?! Are you sure you need %d gpios?\n",
327                         __func__, dev_info->gpio_num);
328         }
329
330         if (dev_info->clk_num >= 5) {
331                 dev_notice(dev, "%s WHAT?! Are you sure you need %d clocks?\n",
332                         __func__, dev_info->clk_num);
333         }
334
335         if (dev_info->reg_num >= VIRTUAL_DEV_MAX_REGULATORS) {
336                 dev_err(dev, "%s too many regulators %u!\n",
337                         __func__, dev_info->reg_num);
338                 return -ENODEV;
339         }
340
341         *len = 0;
342         num = dev_info->reg_num;
343         nptr = &dev_info->reg_names[0];
344         while (num) {
345                 n = strlen(nptr);
346                 if (!n) {
347                         dev_err(dev, "%s NULL reg name @ %d\n",
348                                 __func__, dev_info->reg_num - num);
349                         return -ENODEV;
350                 }
351                 *len += n + 1;
352                 nptr += CAMERA_MAX_NAME_LENGTH;
353                 num--;
354         }
355         dev_dbg(dev, "regulator name size: %d\n", *len);
356
357         return 0;
358 }
359
360 static int virtual_chip_config(
361         struct device *dev,
362         struct virtual_device *dev_info,
363         struct chip_config *c_info)
364 {
365         char *rptr = (void *)c_info;
366         char *nptr = dev_info->reg_names;
367         int len;
368         u32 idx;
369
370         dev_dbg(dev, "%s regulators:\n", __func__);
371         c_info->clk_num = dev_info->clk_num;
372         c_info->gpio_num = dev_info->gpio_num;
373         c_info->reg_num = dev_info->reg_num;
374         rptr += sizeof(*c_info) + sizeof(char *) * c_info->reg_num;
375         for (idx = 0; idx < c_info->reg_num; idx++) {
376                 c_info->reg_names[idx] = rptr;
377                 len = strlen(nptr);
378                 dev_dbg(dev, "#%d %s len %d\n", idx, nptr, len);
379                 strcpy(rptr, nptr);
380                 rptr[len] = '\0';
381                 rptr += len + 1;
382                 nptr += CAMERA_MAX_NAME_LENGTH;
383                 dev_dbg(dev, "#%d - %s\n", idx, c_info->reg_names[idx]);
384         }
385
386         c_info->seq_power_on = (void *)rptr;
387         if (copy_from_user(
388                 c_info->seq_power_on,
389                 (const void __user *)(unsigned long)dev_info->power_on,
390                 sizeof(struct camera_reg) * dev_info->pwr_on_size)) {
391                 dev_err(dev, "%s copy_from_user err line %d\n",
392                         __func__, __LINE__);
393                         return -EFAULT;
394         }
395
396         c_info->seq_power_off = (void *)c_info->seq_power_on +
397                 sizeof(struct camera_reg) * dev_info->pwr_on_size;
398         if (copy_from_user(
399                 c_info->seq_power_off,
400                 (const void __user *)(unsigned long)dev_info->power_off,
401                 sizeof(struct camera_reg) * dev_info->pwr_off_size)) {
402                 dev_err(dev, "%s copy_from_user err line %d\n",
403                         __func__, __LINE__);
404                         return -EFAULT;
405         }
406
407         return 0;
408 }
409
410 int virtual_device_add(struct device *dev, unsigned long arg)
411 {
412         struct virtual_device dev_info;
413         struct camera_chip *v_chip;
414         struct chip_config *c_info;
415         struct regmap_config *p_regmap;
416         int buf_len;
417         int err = 0;
418
419 #ifdef CONFIG_COMPAT
420         struct virtual_device_32 dvi32;
421         if (copy_from_user(
422                 &dvi32, (const void __user *)arg, sizeof(dvi32))) {
423                 dev_err(dev, "%s copy_from_user err line %d\n",
424                         __func__, __LINE__);
425                         return -EFAULT;
426         }
427         dev_info.power_on = (void *)((unsigned long)dvi32.power_on);
428         dev_info.power_off = (void *)((unsigned long)dvi32.power_off);
429         dev_info.regmap_cfg = dvi32.regmap_cfg;
430         dev_info.bus_type = dvi32.bus_type;
431         dev_info.gpio_num = dvi32.gpio_num;
432         dev_info.reg_num = dvi32.reg_num;
433         dev_info.pwr_on_size = dvi32.pwr_on_size;
434         dev_info.pwr_off_size = dvi32.pwr_off_size;
435         dev_info.clk_num = dvi32.clk_num;
436         memcpy(dev_info.name, dvi32.name, sizeof(dvi32.name));
437         memcpy(dev_info.reg_names, dvi32.reg_names,
438                 sizeof(dvi32.reg_names));
439 #else
440         if (copy_from_user(
441                 &dev_info, (const void __user *)arg, sizeof(dev_info))) {
442                 dev_err(dev, "%s copy_from_user err line %d\n",
443                         __func__, __LINE__);
444                         return -EFAULT;
445         }
446 #endif
447
448         dev_info(dev, "%s\n", __func__);
449         err = virtual_device_sanity_check(dev, &dev_info, &buf_len);
450         if (err)
451                 return err;
452
453         buf_len += sizeof(char *) * dev_info.reg_num +
454                 sizeof(struct camera_reg) * dev_info.pwr_on_size +
455                 sizeof(struct camera_reg) * dev_info.pwr_off_size;
456         v_chip = kzalloc(
457                 sizeof(*v_chip) + sizeof(*c_info) + buf_len, GFP_KERNEL);
458         if (!v_chip) {
459                 dev_err(dev, "%s unable to allocate memory!\n", __func__);
460                 return -ENOMEM;
461         }
462
463         c_info = (void *)v_chip + sizeof(*v_chip);
464         err = virtual_chip_config(dev, &dev_info, c_info);
465         if (err) {
466                 kfree(v_chip);
467                 return err;
468         }
469
470         strncpy((u8 *)v_chip->name, (u8 const *)dev_info.name,
471                 sizeof(v_chip->name));
472
473         p_regmap = (struct regmap_config *)&v_chip->regmap_cfg;
474         memcpy(p_regmap, &regmap_cfg_default, sizeof(*p_regmap));
475         v_chip->type = dev_info.bus_type;
476         if (dev_info.regmap_cfg.addr_bits)
477                 p_regmap->reg_bits = dev_info.regmap_cfg.addr_bits;
478         if (dev_info.regmap_cfg.val_bits)
479                 p_regmap->val_bits = dev_info.regmap_cfg.val_bits;
480         p_regmap->cache_type = dev_info.regmap_cfg.cache_type;
481
482         INIT_LIST_HEAD(&v_chip->list);
483         v_chip->private = c_info;
484         v_chip->init = virtual_instance_create;
485         v_chip->release = virtual_instance_destroy,
486         v_chip->power_on = virtual_power_on,
487         v_chip->power_off = virtual_power_off,
488         v_chip->shutdown = virtual_shutdown,
489         v_chip->update = virtual_update,
490
491         err = camera_chip_add(v_chip);
492         if (err) {
493                 kfree(v_chip);
494                 if (err == -EEXIST)
495                         err = 0;
496         }
497
498         return err;
499 }
500
501 static int __init virtual_init(void)
502 {
503         pr_info("%s\n", __func__);
504         return 0;
505 }
506 device_initcall(virtual_init);
507
508 static void __exit virtual_exit(void)
509 {
510 }
511 module_exit(virtual_exit);
512
513 MODULE_DESCRIPTION("virtual sensor device");
514 MODULE_AUTHOR("Charlie Huang <chahuang@nvidia.com>");
515 MODULE_LICENSE("GPL v2");