[PATCH 0/3] iio: proximity: as3935: fix major drivers

[PATCH 0/3] iio: proximity: as3935: fix major drivers

[Matt Ranostay]

This series has some major ABI changes, and bugfixes related to stack
corruption.

Seems these partly are to blame from the driver's author being in one the
least active thunderstorm parts of the world (Oregon has almost none).

Matt Ranostay (3):
  iio: proximity: as3935: correct IIO_CHAN_INFO_RAW output
  iio: proximity: as3935: remove triggered buffer processing
  iio: proximity: as3935: fix buffer stack trashing

 .../ABI/testing/sysfs-bus-iio-proximity-as3935          |  2 +-
 drivers/iio/proximity/as3935.c                          | 17 ++++++++++++-----
 2 files changed, 13 insertions(+), 6 deletions(-)

-- 
2.7.4

[PATCH 1/3] iio: proximity: as3935: correct IIO_CHAN_INFO_RAW output

[Matt Ranostay]

IIO_CHAN_INFO_RAW was returning processed data which was incorrect.
This also adds the IIO_CHAN_INFO_SCALE value to convert to a processed value.

Signed-off-by: Matt Ranostay <mranostay@gmail.com>
---
 Documentation/ABI/testing/sysfs-bus-iio-proximity-as3935 |  2 +-
 drivers/iio/proximity/as3935.c                           | 10 ++++++++--
 2 files changed, 9 insertions(+), 3 deletions(-)

diff --git a/Documentation/ABI/testing/sysfs-bus-iio-proximity-as3935 b/Documentation/ABI/testing/sysfs-bus-iio-proximity-as3935
index 6708c5e..33e96f7 100644
--- a/Documentation/ABI/testing/sysfs-bus-iio-proximity-as3935
+++ b/Documentation/ABI/testing/sysfs-bus-iio-proximity-as3935
@@ -1,4 +1,4 @@
-What		/sys/bus/iio/devices/iio:deviceX/in_proximity_raw
+What		/sys/bus/iio/devices/iio:deviceX/in_proximity_input
 Date:		March 2014
 KernelVersion:	3.15
 Contact:	Matt Ranostay <mranostay@gmail.com>
diff --git a/drivers/iio/proximity/as3935.c b/drivers/iio/proximity/as3935.c
index f4d29d5..f0a0def 100644
--- a/drivers/iio/proximity/as3935.c
+++ b/drivers/iio/proximity/as3935.c
@@ -72,7 +72,8 @@ static const struct iio_chan_spec as3935_channels[] = {
 		.type           = IIO_PROXIMITY,
 		.info_mask_separate =
 			BIT(IIO_CHAN_INFO_RAW) |
-			BIT(IIO_CHAN_INFO_PROCESSED),
+			BIT(IIO_CHAN_INFO_PROCESSED) |
+			BIT(IIO_CHAN_INFO_SCALE),
 		.scan_index     = 0,
 		.scan_type = {
 			.sign           = 'u',
@@ -181,7 +182,12 @@ static int as3935_read_raw(struct iio_dev *indio_dev,
 		/* storm out of range */
 		if (*val == AS3935_DATA_MASK)
 			return -EINVAL;
-		*val *= 1000;
+
+		if (m == IIO_CHAN_INFO_PROCESSED)
+			*val *= 1000;
+		break;
+	case IIO_CHAN_INFO_SCALE:
+		*val = 1000;
 		break;
 	default:
 		return -EINVAL;
-- 
2.7.4

[PATCH 2/3] iio: proximity: as3935: remove triggered buffer processing

[Matt Ranostay]

Triggered buffers shouldn't return processed data, and the respective
conversion was overflowing the defined .realbits for the channel.

Cc: george.mccollister@gmail.com
Signed-off-by: Matt Ranostay <mranostay@gmail.com>
---
 drivers/iio/proximity/as3935.c | 1 -
 1 file changed, 1 deletion(-)

diff --git a/drivers/iio/proximity/as3935.c b/drivers/iio/proximity/as3935.c
index f0a0def..6aed024 100644
--- a/drivers/iio/proximity/as3935.c
+++ b/drivers/iio/proximity/as3935.c
@@ -213,7 +213,6 @@ static irqreturn_t as3935_trigger_handler(int irq, void *private)
 	if (ret)
 		goto err_read;
 	val &= AS3935_DATA_MASK;
-	val *= 1000;
 
 	iio_push_to_buffers_with_timestamp(indio_dev, &val, pf->timestamp);
 err_read:
-- 
2.7.4

[PATCH 3/3] iio: proximity: as3935: fix buffer stack trashing

[Matt Ranostay]

Buffer wasn't of a valid size to allow the timestamp, and correct padding.
This patchset also moves the buffer off the stack, and onto the heap.

Cc: george.mccollister@gmail.com
Signed-off-by: Matt Ranostay <mranostay@gmail.com>
---
 drivers/iio/proximity/as3935.c | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/drivers/iio/proximity/as3935.c b/drivers/iio/proximity/as3935.c
index 6aed024..8730451 100644
--- a/drivers/iio/proximity/as3935.c
+++ b/drivers/iio/proximity/as3935.c
@@ -64,6 +64,7 @@ struct as3935_state {
 	struct delayed_work work;
 
 	u32 tune_cap;
+	u8 buffer[16]; /* 8-bit data + 54-bit padding + 64-bit timestamp */
 	u8 buf[2] ____cacheline_aligned;
 };
 
@@ -212,9 +213,10 @@ static irqreturn_t as3935_trigger_handler(int irq, void *private)
 	ret = as3935_read(st, AS3935_DATA, &val);
 	if (ret)
 		goto err_read;
-	val &= AS3935_DATA_MASK;
 
-	iio_push_to_buffers_with_timestamp(indio_dev, &val, pf->timestamp);
+	st->buffer[0] = val & AS3935_DATA_MASK;
+	iio_push_to_buffers_with_timestamp(indio_dev, &st->buffer,
+					   pf->timestamp);
 err_read:
 	iio_trigger_notify_done(indio_dev->trig);
 
-- 
2.7.4

Re: [PATCH 3/3] iio: proximity: as3935: fix buffer stack trashing

[Matt Ranostay]

> On May 21, 2016, at 20:01, Matt Ranostay <mranostay@gmail.com> wrote:
> 
> Buffer wasn't of a valid size to allow the timestamp, and correct padding.
> This patchset also moves the buffer off the stack, and onto the heap.
> 
> Cc: george.mccollister@gmail.com
> Signed-off-by: Matt Ranostay <mranostay@gmail.com>
> ---
> drivers/iio/proximity/as3935.c | 6 ++++--
> 1 file changed, 4 insertions(+), 2 deletions(-)
> 
> diff --git a/drivers/iio/proximity/as3935.c b/drivers/iio/proximity/as3935.c
> index 6aed024..8730451 100644
> --- a/drivers/iio/proximity/as3935.c
> +++ b/drivers/iio/proximity/as3935.c
> @@ -64,6 +64,7 @@ struct as3935_state {
>    struct delayed_work work;
> 
>    u32 tune_cap;
> +    u8 buffer[16]; /* 8-bit data + 54-bit padding + 64-bit timestamp */

Just noticed that should be noted as 56-bit

>    u8 buf[2] ____cacheline_aligned;
> };
> 
> @@ -212,9 +213,10 @@ static irqreturn_t as3935_trigger_handler(int irq, void *private)
>    ret = as3935_read(st, AS3935_DATA, &val);
>    if (ret)
>        goto err_read;
> -    val &= AS3935_DATA_MASK;
> 
> -    iio_push_to_buffers_with_timestamp(indio_dev, &val, pf->timestamp);
> +    st->buffer[0] = val & AS3935_DATA_MASK;
> +    iio_push_to_buffers_with_timestamp(indio_dev, &st->buffer,
> +                       pf->timestamp);
> err_read:
>    iio_trigger_notify_done(indio_dev->trig);
> 
> -- 
> 2.7.4
> 

Re: [PATCH 1/3] iio: proximity: as3935: correct IIO_CHAN_INFO_RAW output

[Jonathan Cameron]

On 22/05/16 04:01, Matt Ranostay wrote:
> IIO_CHAN_INFO_RAW was returning processed data which was incorrect.
> This also adds the IIO_CHAN_INFO_SCALE value to convert to a processed value.
> 
> Signed-off-by: Matt Ranostay <mranostay@gmail.com>
Applied to the fixes-togreg-post-rc1 branch of iio.git and marked for stable.

Thanks,
Jonathan
> ---
>  Documentation/ABI/testing/sysfs-bus-iio-proximity-as3935 |  2 +-
>  drivers/iio/proximity/as3935.c                           | 10 ++++++++--
>  2 files changed, 9 insertions(+), 3 deletions(-)
> 
> diff --git a/Documentation/ABI/testing/sysfs-bus-iio-proximity-as3935 b/Documentation/ABI/testing/sysfs-bus-iio-proximity-as3935
> index 6708c5e..33e96f7 100644
> --- a/Documentation/ABI/testing/sysfs-bus-iio-proximity-as3935
> +++ b/Documentation/ABI/testing/sysfs-bus-iio-proximity-as3935
> @@ -1,4 +1,4 @@
> -What		/sys/bus/iio/devices/iio:deviceX/in_proximity_raw
> +What		/sys/bus/iio/devices/iio:deviceX/in_proximity_input
>  Date:		March 2014
>  KernelVersion:	3.15
>  Contact:	Matt Ranostay <mranostay@gmail.com>
> diff --git a/drivers/iio/proximity/as3935.c b/drivers/iio/proximity/as3935.c
> index f4d29d5..f0a0def 100644
> --- a/drivers/iio/proximity/as3935.c
> +++ b/drivers/iio/proximity/as3935.c
> @@ -72,7 +72,8 @@ static const struct iio_chan_spec as3935_channels[] = {
>  		.type           = IIO_PROXIMITY,
>  		.info_mask_separate =
>  			BIT(IIO_CHAN_INFO_RAW) |
> -			BIT(IIO_CHAN_INFO_PROCESSED),
> +			BIT(IIO_CHAN_INFO_PROCESSED) |
> +			BIT(IIO_CHAN_INFO_SCALE),
>  		.scan_index     = 0,
>  		.scan_type = {
>  			.sign           = 'u',
> @@ -181,7 +182,12 @@ static int as3935_read_raw(struct iio_dev *indio_dev,
>  		/* storm out of range */
>  		if (*val == AS3935_DATA_MASK)
>  			return -EINVAL;
> -		*val *= 1000;
> +
> +		if (m == IIO_CHAN_INFO_PROCESSED)
> +			*val *= 1000;
> +		break;
> +	case IIO_CHAN_INFO_SCALE:
> +		*val = 1000;
>  		break;
>  	default:
>  		return -EINVAL;
> 

Re: [PATCH 2/3] iio: proximity: as3935: remove triggered buffer processing

[Jonathan Cameron]

On 22/05/16 04:01, Matt Ranostay wrote:
> Triggered buffers shouldn't return processed data, and the respective
> conversion was overflowing the defined .realbits for the channel.
> 
> Cc: george.mccollister@gmail.com
> Signed-off-by: Matt Ranostay <mranostay@gmail.com>
Applied to the fixes-togreg-post-rc1 branch of iio.git (because it was handy)
and marked for stable.
> ---
>  drivers/iio/proximity/as3935.c | 1 -
>  1 file changed, 1 deletion(-)
> 
> diff --git a/drivers/iio/proximity/as3935.c b/drivers/iio/proximity/as3935.c
> index f0a0def..6aed024 100644
> --- a/drivers/iio/proximity/as3935.c
> +++ b/drivers/iio/proximity/as3935.c
> @@ -213,7 +213,6 @@ static irqreturn_t as3935_trigger_handler(int irq, void *private)
>  	if (ret)
>  		goto err_read;
>  	val &= AS3935_DATA_MASK;
> -	val *= 1000;
>  
>  	iio_push_to_buffers_with_timestamp(indio_dev, &val, pf->timestamp);
>  err_read:
> 

Re: [PATCH 3/3] iio: proximity: as3935: fix buffer stack trashing

[Jonathan Cameron]

On 22/05/16 07:28, Matt Ranostay wrote:
> 
>> On May 21, 2016, at 20:01, Matt Ranostay <mranostay@gmail.com> wrote:
>>
>> Buffer wasn't of a valid size to allow the timestamp, and correct padding.
>> This patchset also moves the buffer off the stack, and onto the heap.
>>
>> Cc: george.mccollister@gmail.com
>> Signed-off-by: Matt Ranostay <mranostay@gmail.com>
Applied as per the other 2.
>> ---
>> drivers/iio/proximity/as3935.c | 6 ++++--
>> 1 file changed, 4 insertions(+), 2 deletions(-)
>>
>> diff --git a/drivers/iio/proximity/as3935.c b/drivers/iio/proximity/as3935.c
>> index 6aed024..8730451 100644
>> --- a/drivers/iio/proximity/as3935.c
>> +++ b/drivers/iio/proximity/as3935.c
>> @@ -64,6 +64,7 @@ struct as3935_state {
>>    struct delayed_work work;
>>
>>    u32 tune_cap;
>> +    u8 buffer[16]; /* 8-bit data + 54-bit padding + 64-bit timestamp */
> 
> Just noticed that should be noted as 56-bit
Fixed up.
> 
>>    u8 buf[2] ____cacheline_aligned;
>> };
>>
>> @@ -212,9 +213,10 @@ static irqreturn_t as3935_trigger_handler(int irq, void *private)
>>    ret = as3935_read(st, AS3935_DATA, &val);
>>    if (ret)
>>        goto err_read;
>> -    val &= AS3935_DATA_MASK;
>>
>> -    iio_push_to_buffers_with_timestamp(indio_dev, &val, pf->timestamp);
>> +    st->buffer[0] = val & AS3935_DATA_MASK;
>> +    iio_push_to_buffers_with_timestamp(indio_dev, &st->buffer,
>> +                       pf->timestamp);
>> err_read:
>>    iio_trigger_notify_done(indio_dev->trig);
>>
>> -- 
>> 2.7.4
>>
> --
> To unsubscribe from this list: send the line "unsubscribe linux-iio" in
> the body of a message to majordomo@vger.kernel.org
> More majordomo info at  http://vger.kernel.org/majordomo-info.html
>