/* * Fast C2P (Chunky-to-Planar) Conversion * * Copyright (C) 2003-2008 Geert Uytterhoeven * * This file is subject to the terms and conditions of the GNU General Public * License. See the file COPYING in the main directory of this archive * for more details. */ #include #include #include #include "c2p.h" #include "c2p_core.h" /* * Perform a full C2P step on 16 8-bit pixels, stored in 4 32-bit words * containing * - 16 8-bit chunky pixels on input * - permutated planar data (2 planes per 32-bit word) on output */ static void c2p_16x8(u32 d[4]) { transp4(d, 8, 2); transp4(d, 1, 2); transp4x(d, 16, 2); transp4x(d, 2, 2); transp4(d, 4, 1); } /* * Array containing the permutation indices of the planar data after c2p */ static const int perm_c2p_16x8[4] = { 1, 3, 0, 2 }; /* * Store a full block of iplan2 data after c2p conversion */ static inline void store_iplan2(void *dst, u32 bpp, u32 d[4]) { int i; for (i = 0; i < bpp/2; i++, dst += 4) put_unaligned_be32(d[perm_c2p_16x8[i]], dst); } /* * Store a partial block of iplan2 data after c2p conversion */ static inline void store_iplan2_masked(void *dst, u32 bpp, u32 d[4], u32 mask) { int i; for (i = 0; i < bpp/2; i++, dst += 4) put_unaligned_be32(comp(d[perm_c2p_16x8[i]], get_unaligned_be32(dst), mask), dst); } /* * c2p_iplan2 - Copy 8-bit chunky image data to an interleaved planar * frame buffer with 2 bytes of interleave * @dst: Starting address of the planar frame buffer * @dx: Horizontal destination offset (in pixels) * @dy: Vertical destination offset (in pixels) * @width: Image width (in pixels) * @height: Image height (in pixels) * @dst_nextline: Frame buffer offset to the next line (in bytes) * @src_nextline: Image offset to the next line (in bytes) * @bpp: Bits per pixel of the planar frame buffer (2, 4, or 8) */ void c2p_iplan2(void *dst, const void *src, u32 dx, u32 dy, u32 width, u32 height, u32 dst_nextline, u32 src_nextline, u32 bpp) { union { u8 pixels[16]; u32 words[4]; } d; u32 dst_idx, first, last, w; const u8 *c; void *p; dst += dy*dst_nextline+(dx & ~15)*bpp; dst_idx = dx % 16; first = 0xffffU >> dst_idx; first |= first << 16; last = 0xffffU ^ (0xffffU >> ((dst_idx+width) % 16)); last |= last << 16; while (height--) { c = src; p = dst; w = width; if (dst_idx+width <= 16) { /* Single destination word */ first &= last; memset(d.pixels, 0, sizeof(d)); memcpy(d.pixels+dst_idx, c, width); c += width; c2p_16x8(d.words); store_iplan2_masked(p, bpp, d.words, first); p += bpp*2; } else { /* Multiple destination words */ w = width; /* Leading bits */ if (dst_idx) { w = 16 - dst_idx; memset(d.pixels, 0, dst_idx); memcpy(d.pixels+dst_idx, c, w); c += w; c2p_16x8(d.words); store_iplan2_masked(p, bpp, d.words, first); p += bpp*2; w = width-w; } /* Main chunk */ while (w >= 16) { memcpy(d.pixels, c, 16); c += 16; c2p_16x8(d.words); store_iplan2(p, bpp, d.words); p += bpp*2; w -= 16; } /* Trailing bits */ w %= 16; if (w > 0) { memcpy(d.pixels, c, w); memset(d.pixels+w, 0, 16-w); c2p_16x8(d.words); store_iplan2_masked(p, bpp, d.words, last); } } src += src_nextline; dst += dst_nextline; } } EXPORT_SYMBOL_GPL(c2p_iplan2); MODULE_LICENSE("GPL"); value='7'>7space:mode:
authorIago Abal <mail@iagoabal.eu>2017-01-11 14:00:21 +0100
committerVinod Koul <vinod.koul@intel.com>2017-01-25 15:35:11 +0530
commit91539eb1fda2d530d3b268eef542c5414e54bf1a (patch)
tree960f5ca6342ad20837aff18aad6e8ecd7da32fd6 /net/mac80211/rate.h
parent6610d0edf6dc7ee97e46ab3a538a565c79d26199 (diff)
dmaengine: pl330: fix double lock
The static bug finder EBA (http://www.iagoabal.eu/eba/) reported the following double-lock bug: Double lock: 1. spin_lock_irqsave(pch->lock, flags) at pl330_free_chan_resources:2236; 2. call to function `pl330_release_channel' immediately after; 3. call to function `dma_pl330_rqcb' in line 1753; 4. spin_lock_irqsave(pch->lock, flags) at dma_pl330_rqcb:1505. I have fixed it as suggested by Marek Szyprowski. First, I have replaced `pch->lock' with `pl330->lock' in functions `pl330_alloc_chan_resources' and `pl330_free_chan_resources'. This avoids the double-lock by acquiring a different lock than `dma_pl330_rqcb'. NOTE that, as a result, `pl330_free_chan_resources' executes `list_splice_tail_init' on `pch->work_list' under lock `pl330->lock', whereas in the rest of the code `pch->work_list' is protected by `pch->lock'. I don't know if this may cause race conditions. Similarly `pch->cyclic' is written by `pl330_alloc_chan_resources' under `pl330->lock' but read by `pl330_tx_submit' under `pch->lock'. Second, I have removed locking from `pl330_request_channel' and `pl330_release_channel' functions. Function `pl330_request_channel' is only called from `pl330_alloc_chan_resources', so the lock is already held. Function `pl330_release_channel' is called from `pl330_free_chan_resources', which already holds the lock, and from `pl330_del'. Function `pl330_del' is called in an error path of `pl330_probe' and at the end of `pl330_remove', but I assume that there cannot be concurrent accesses to the protected data at those points. Signed-off-by: Iago Abal <mail@iagoabal.eu> Reviewed-by: Marek Szyprowski <m.szyprowski@samsung.com> Signed-off-by: Vinod Koul <vinod.koul@intel.com>
Diffstat (limited to 'net/mac80211/rate.h')