==2787216==ERROR: AddressSanitizer: heap-use-after-free on address 0xf4702448 at pc 0x0136c544 bp 0x9f54d358 sp 0x9f54d348
READ of size 4 at 0xf4702448 thread T0
0 0x136c543 in rpmsg_destroy_ept open-amp/lib/rpmsg/rpmsg.c:357
1 0x1252b29 in sensor_rpmsg_ns_unbind_cb sensors/sensor_rpmsg.c:1216
2 0x1371de5 in rpmsg_virtio_ns_callback open-amp/lib/rpmsg/rpmsg_virtio.c:663
3 0x1371026 in rpmsg_virtio_rx_callback open-amp/lib/rpmsg/rpmsg_virtio.c:583
4 0x137c105 in virtqueue_notification open-amp/lib/virtio/virtqueue.c:711
5 0x1368604 in rproc_virtio_notified open-amp/lib/remoteproc/remoteproc_virtio.c:433
6 0x1363abe in remoteproc_get_notification open-amp/lib/remoteproc/remoteproc.c:10
Signed-off-by: yintao <yintao@xiaomi.com>
convert from body coordinate system to right-hand
coordinate system.
Example:
Compared to the standard coordinate system,
the x-axis and y-axis are interchanged and have opposite directions,
the z-axis remains normal.
body coordinate ----> right-hand coordinate
+x +y
| |
| |
| |
| |
-y<-------. .------>+x
/ /
/ /
/ /
/ /
+z +z
So for the above conversion, using "P3" to represent transformation relationships
The front is 1 0 2, which represents the y x z axis.
The standard order is 0 1 2, so y and x are interchanged.
The following -1 1 1 indicates the direction of the axis.
The standard is 1 1 1. Because the current y-axis is opposite to
the standard x-axis, it is -1.
static const struct sensor_axis_map_s g_remap_tbl[] =
{
{ 0, 1, 2, 1, 1, 1 }, /* P0 */
{ 1, 0, 2, 1, -1, 1 }, /* P1 */
{ 0, 1, 2, -1, -1, 1 }, /* P2 */
{ 1, 0, 2, -1, 1, 1 }, /* P3 */
{ 0, 1, 2, -1, 1, -1 }, /* P4 */
{ 1, 0, 2, -1, -1, -1 }, /* P5 */
{ 0, 1, 2, 1, -1, -1 }, /* P6 */
{ 1, 0, 2, 1, 1, -1 }, /* P7 */
};
you can call the function sensor_remap_vector_raw16 and pass P3 parameters
to perform the conversion.
Signed-off-by: Jiuzhu Dong <dongjiuzhu1@xiaomi.com>
When the application calls poll and returns the POLLIN event,
QPOLL will be called again during the read operation,
causing rx_length to change and data to be lost.
Therefore, read only need to actively call qpoll to collect driver
data when rx length is 0.
Signed-off-by: dongjiuzhu1 <dongjiuzhu1@xiaomi.com>
I added a function that I didn't use when I upstream another patch. Delete it
https://github.com/apache/nuttx/pull/10709
Signed-off-by: zhanghongyu <zhanghongyu@xiaomi.com>
1.check the rpmsg name when clk_register.
2.clk_get rpmsg clk print error:
clk/clk.c:1231:3: runtime error: null pointer passed as argument 2, which is declared to never be null
3.fix some function miss keyword FAR.
4.clk_disable_unused may disable rpmsg clk which disable the clk that maybe used by others
Signed-off-by: dulibo1 <dulibo1@xiaomi.com>
1.client get the regualtor which is enabled by server, will disable the regualtor.
2.regulator_rpmsg_server_unbind will disable regualtor which maybe used by other client.
3.regulator_rpmsg_server_unbind will be deadloop when the regulator is always_on;
4.regulator_rpmsg_client_destroy does not match server cpu name,may destory by stop other rptun dev
Signed-off-by: dulibo1 <dulibo1@xiaomi.com>
These structures need to be aligned with the firmware, packed_struct will cause the scan information from Wi-Fi firmware not to be parsed by broadcom Wi-Fi driver. Therefore, we need to remove the packed_struct of the structure associated with the scan information.
Signed-off-by: zhanghongyu <zhanghongyu@xiaomi.com>
Solve the problem that when a user modifies the sampling rate,
the difference between the generation and the mainline generation
may be greater than the own sampling interval.
After this problem occurs, sensor_is_update() will continue to
return true, resulting in a busy loop in the upper-layer application,
so, need update user generation according to mainline generation.
Signed-off-by: dongjiuzhu1 <dongjiuzhu1@xiaomi.com>
When the upper layer calls goldfish_camera_data_uninit, priv->capture_cb=NULL, but when there is data transmission in goldfish_camera_thread, priv->capture_cb will be called, which will cause a crash.
Signed-off-by: yangsen5 <yangsen5@xiaomi.com>
1.Change priv to client or server
2.Allocate memory for name in regulator_rpmsg_get
3.Lock/unlock regulator_list in regulator_rpmsg_server_s
Signed-off-by: Xiang Xiao <xiaoxiang@xiaomi.com>
It uses the memory block as the serial communication medium, which can communicate between different processes or different CPUs
Using the following configuration, the cross-core communication rate of 200MHz cortex-M55 is about 461KB/s
RAM_UART_BUFSIZE=1024
RAM_UART_POLLING_INTERVAL=100
Signed-off-by: yinshengkai <yinshengkai@xiaomi.com>
A dead lock may happen before this patch:
rptun thread (usrsock_rpmsg_recvfrom_handler):
Gets all tx payload but waiting net_lock in psock_recvfrom
net driver thread (higher priority):
Receives a packet, holding net_lock, calling usrsock_rpmsg_send_event
But no tx buffer left, so rpmsg_send blocks, and won't release net_lock
In short:
Rptun: Hold all `tx_payload_buffer` -> want `net_lock`
Driver: Hold `net_lock` -> want `tx_payload_buffer`
This patch use net_lock to combine get_tx_payload and recvfrom together,
then:
- If it's waiting net_lock, tx payload will not be held, other threads
may get tx buffer and do their work.
- If net_lock is got, it won't be disturbed before finish receiving,
then tx payload won't have chance to be blocked before releasing.
Signed-off-by: Zhe Weng <wengzhe@xiaomi.com>
Note:
tcp_poll_eventhandler have logic after poll_notify, if we teardown poll
inside poll callback without clearing revents, use-after-free will
happen.
Signed-off-by: Zhe Weng <wengzhe@xiaomi.com>
The circbuf part is implemented by the fb driver, and goldfish needs to
delete the part related to circbuf and adapt to the interface of the fb
driver.
Signed-off-by: jianglianfang <jianglianfang@xiaomi.com>
refact vsync queue to support multi fb poll and overlay poll.
Signed-off-by: pengyiqiang <pengyiqiang@xiaomi.com>
Signed-off-by: rongyichang <rongyichang@xiaomi.com>
Summary
The following compilation error occurs after configuring CONFIG_DEBUG_OPTLEVEL="-O3"
CC: ping.c video/video.c: In function 'video_ioctl':
video/video.c:2347:22: error: 'control.size' may be used uninitialized [-Werror=maybe-uninitialized]
2347 | control->size,
| ^~
video/video.c:2273:28: note: 'control' declared here
2273 | struct v4l2_ext_control control;
| ^~~~~~~
Signed-off-by: wangming9 <wangming9@xiaomi.com>
Add usb_fs driver so that userspace can directly transfer USB packets
through the EP node. ADB, Fastboot, MTP will use usb_fs, these class
driver only need to provide the descriptors and register the usb_fs device.
Signed-off-by: zhangyuan21 <zhangyuan21@xiaomi.com>
Signed-off-by: zhangyuan21 <zhangyuan21@xiaomi.com>
The RPMB partition cannot be accessed via standard block layer, but by a set of specific commands: WRITE, READ, GET_WRITE_COUNTER, and PROGRAM_KEY. Such a partition provides authenticated and replay protected access, hence suitable as a secure storage.
Signed-off-by: wanggang26 <wanggang26@xiaomi.com>
In sensor_rpmsg_ioctl, when rpmsg_get_tx_payload_buffer is block,
The rptun thread will continue to process rx_buffers from other cores,
So the proxy may be released in sensor_unadv_handler, then if using
the proxy, It causes a crash.
backtrace:
0 0x06007c2e in is_rpmsg_ept_ready (ept=0x5a5a5a5a) at nuttx/include/openamp/rpmsg.h:172
1 0x06013354 in rpmsg_send_nocopy (len=<optimized out>,
data=<optimized out>, ept=<optimized out>) at nuttx/include/openamp/rpmsg.h:521
2 rpmsg_send_nocopy (ept=0x5a5a5a5a, data=data@entry=0x201facf0,
len=len@entry=40) at nuttx/include/openamp/rpmsg.h:512
3 0x06013b34 in sensor_rpmsg_ioctl (dev=dev@entry=0x201b7388,
cmd=538701816, cmd@entry=2690, arg=0, len=len@entry=0,
wait=<error reading variable: dwarf2_find_location_expression:
Corrupted DWARF expression.>) at ../../../drivers/sensors/sensor_rpmsg.c:395
4 0x06013cce in sensor_rpmsg_alloc_proxy (dev=dev@entry=0x201b7388,
ept=ept@entry=0x202073d0, msg=msg@entry=0x201684f0) at ../../../drivers/sensors/sensor_rpmsg.c:498
5 0x06013d12 in sensor_rpmsg_adv_handler (ept=0x202073d0,
data=0x201684f0, len=49, src=<optimized out>, priv=0x202073c8) at ../../../drivers/sensors/sensor_rpmsg.c:905
6 0x0600d45e in sensor_rpmsg_ept_cb (ept=<optimized out>,
data=<optimized out>, len=<optimized out>, src=<optimized out>,
priv=0x202073c8) at ../../../drivers/sensors/sensor_rpmsg.c:1168
Signed-off-by: dongjiuzhu1 <dongjiuzhu1@xiaomi.com>
vfork use waitpid hang father process,
but waitpid release child processs information by default.
So when user call wait, it return errno 10.
Signed-off-by: yangyalei <yangyalei@xiaomi.com>
When the machine is cold started, the psram area where the syslog
buffer is located contains some random values, so it will cause
loss of valid log.
Signed-off-by: dongjiuzhu1 <dongjiuzhu1@xiaomi.com>
When the system starts up, the hw count may not start counting from 0,
which can cause the processing time of the first oneshot handler to be
too long. Therefore, the current tick value should be set based on the
hw count during initialization.
Signed-off-by: zhangyuan21 <zhangyuan21@xiaomi.com>
The class device only handles descriptor information specific to the class,
and shared descriptor information is passed through parameters and
handled by the composite driver.
Signed-off-by: zhangyuan21 <zhangyuan21@xiaomi.com>
Whevenever the bit rate is going to be set, it's necessary to first
set the master clock if the underlying device supports it. If it
fails, just return the error code.
According to the struct `mclk_rate_s`, set the default sample rate
to its lowest valid value. This prevents the underlying driver from
setting unsupported values.
Create bmi160_base.h, bmi160_base.c bmi160_uorb.c files, the bmi160_base file stores
public function interfaces, and the bmi160_uorb file stores functions related to the
uorb framework. Switch the character interface and UORB interface through the
macro CONFIG_SENSORS_BMI160_UORB.
Signed-off-by: likun17 <likun17@xiaomi.com>
