- 28 May, 2019 40 commits
-
-
Maciej S. Szmigiero authored
cx25840 driver g_std operation queries the currently detected video signal, however this is what querystd operation should do, so let's rename the handler. None of the existing cx25840 driver users ever called the g_std operation, one of them calls querystd on each of its subdevs but then the result is only used to implement VIDIOC_QUERYSTD (as it should). Signed-off-by:
Maciej S. Szmigiero <mail@maciej.szmigiero.name> Signed-off-by:
Hans Verkuil <hverkuil-cisco@xs4all.nl> Signed-off-by:
Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
-
Maciej S. Szmigiero authored
cx25840_load_fw() does the same thing as cx25840_reset(), only keeps "is_initialized" flag so any further invocation of this function besides the first one is a NOP. Let's just call cx25840_reset() directly from cx25840_load_fw() instead of open coding it there. While we are at it, let's also improve comments about cx25840_load_fw() so they are current and in the proper style (one of them even referred to a non-existing cx25840 init operation). Signed-off-by:
-
Fabio Estevam authored
imx7_csi_enable() always return 0 and its return value is never checked, so convert it to void. Signed-off-by:
Fabio Estevam <festevam@gmail.com> Tested-by:
Rui Miguel Silva <rmfrfs@gmail.com> Reviewed-by:
-
Fabio Estevam authored
clk_prepare_enable() may fail, so we should better check its return value and propagate it in the case of error. Signed-off-by:
-
Fabio Estevam authored
Remove unneeded 'break' right after the 'return' statement as pointed out by checkpatch. Signed-off-by:
-
Fabio Estevam authored
In the case of devm_request_irq() failure, let's propagate the real error code instead of a fake one. Signed-off-by:
-
Fabio Estevam authored
In the case of platform_get_irq() failure, let's propagate the real error code instead of a fake one. Signed-off-by:
-
Fabio Estevam authored
Use devm_platform_ioremap_resource() to simplify the code a bit. While at it, propagate the real error value in case of devm_platform_ioremap_resource() failure. Signed-off-by:
-
Fabio Estevam authored
As per the i.MX7D Reference Manual only the MCLK is used for the CSI block, so only handle this single clock. Signed-off-by:
-
Steve Longerbeam authored
The media device is already available via multiple methods, there is no need to set driver data for v4l2_dev to the media device. In imx_media_link_notify(), get media device from link->graph_obj.mdev. In imx_media_capture_device_register(), get media device from v4l2_dev->mdev. Signed-off-by:
Steve Longerbeam <slongerbeam@gmail.com> Signed-off-by:
-
Steve Longerbeam authored
Export find_pipeline_pad(), renaming to imx_media_pipeline_pad(), and extend its functionality to allow searching for video devices in the enabled pipeline in addition to sub-devices. As part of this: - Rename imx_media_find_mipi_csi2_channel() to imx_media_pipeline_csi2_channel(). - Remove imx_media_find_upstream_pad(), it is redundant now. - Rename imx_media_find_upstream_subdev() to imx_media_pipeline_subdev() with an additional boolean argument for searching upstream or downstream. - Add imx_media_pipeline_video_device() which is analogous to imx_media_pipeline_subdev() but searches for video devices. - Remove imxmd pointer arg from all of the functions above, it was never used in those functions. With that change the i.MX5/6 CSI, VDIC, and IC sub-devices no longer require the media_device. Signed-off-by:
-
Steve Longerbeam authored
Re-organize modules, and which objects are linked into those modules, so that: - imx6-media (renamed from imx-media) is the media driver module for imx5/6 only, and has no symbol exports. - imx6-media-csi (renamed from imx-media-csi) is the subdev driver module for imx5/6 CSI. It is now linked direcly with imx-media-fim, since only the imx5/6 CSI makes use of the frame interval monitor. - imx-media-common now only contains common code between imx5/6 and imx7 media drivers. It contains imx-media-utils, imx-media-of, imx-media-dev-common, and imx-media-capture. In order to acheive that, some functions common to imx5/6 and imx7 have been moved out of imx-media-dev.c and into imx-media-dev-common.c. Signed-off-by:
-
Steve Longerbeam authored
Don't propagate the source pad format to the connected capture device. It's now the responsibility of userspace to call VIDIOC_S_FMT on the capture device to ensure the capture format and compose rectangle are compatible with the connected source. To check this, validate the capture format with the source before streaming starts. Signed-off-by:
-
Steve Longerbeam authored
Revert this commit, as imx_media_capture_device_set_format() will be removed. The arguments to mx_media_mbus_fmt_to_pix_fmt() and imx_media_capture_device_set_format() in imx7_csi_set_fmt() are also reverted. This reverts commit 5964cbd8. Signed-off-by:
-
Steve Longerbeam authored
Move imx_media_add_video_device() into imx_media_capture_device_register(). Also the former has no error conditions to convert to void. Signed-off-by:
-
Steve Longerbeam authored
Allocate and free a DMA coherent buffer in imx_media_alloc/free_dma_buf() from the given device. This allows DMA alloc and free using a device that is backed by real hardware, which for the imx5/6/7 CSI is the CSI unit, and for the internal IPU sub-devices, is the parent IPU. Signed-off-by:
-
Steve Longerbeam authored
Because the IPU sub-devices VDIC and IC are not present in the device-tree, platform devices were created for them instead. This allowed these sub-devices to be added to the media device's async notifier and registered asynchronously along with the other sub-devices that do have a device-tree presence (CSI and devices external to the IPU and SoC). But that approach isn't really necessary. The IPU sub-devices don't actually require a backing device (sd->dev is allowed to be NULL). And that approach can't get around the fact that the IPU sub-devices are not part of a device hierarchy, which makes it awkward to retrieve the parent IPU of these devices. By registering them synchronously, they can be registered from the CSI async bound notifier, so the init function for them can be given the CSI subdev, who's dev->parent is the IPU. That is a somewhat cleaner way to retrieve the parent IPU. So convert to synchronous registration for the VDIC and IC task sub-devices, at the time a CSI sub-device is bound. There is no longer a backing device for them (sd->dev is NULL), but that's ok. Also set the VDIC/IC sub-device owner as the IPU, so that a reference can be taken on the IPU module. Since the VDIC and IC task drivers are no longer platform drivers, they are now statically linked to imx-media module. Signed-off-by:
-
Steve Longerbeam authored
The imx6-specific subdevs that register a capture device will no longer hold a reference to the media device, so this commit must be reverted. This reverts commit 16204b8a. Signed-off-by:
-
Hans Verkuil authored
Document the 'field' field to fix this warning: samples/v4l/v4l2-pci-skeleton.c:80: warning: Function parameter or member 'field' not described in 'skeleton' Signed-off-by:
-
Vandana BN authored
SyzKaller hit the null pointer deref while reading from uninitialized udev->product in zr364xx_vidioc_querycap(). ================================================================== BUG: KASAN: null-ptr-deref in read_word_at_a_time+0xe/0x20 include/linux/compiler.h:274 Read of size 1 at addr 0000000000000000 by task v4l_id/5287 CPU: 1 PID: 5287 Comm: v4l_id Not tainted 5.1.0-rc3-319004-g43151d6 #6 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Call Trace: __dump_stack lib/dump_stack.c:77 [inline] dump_stack+0xe8/0x16e lib/dump_stack.c:113 kasan_report.cold+0x5/0x3c mm/kasan/report.c:321 read_word_at_a_time+0xe/0x20 include/linux/compiler.h:274 strscpy+0x8a/0x280 lib/string.c:207 zr364xx_vidioc_querycap+0xb5/0x210 drivers/media/usb/zr364xx/zr364xx.c:706 v4l_querycap+0x12b/0x340 drivers/media/v4l2-core/v4l2-ioctl.c:1062 __video_do_ioctl+0x5bb/0xb40 drivers/media/v4l2-core/v4l2-ioctl.c:2874 video_usercopy+0x44e/0xf00 drivers/media/v4l2-core/v4l2-ioctl.c:3056 v4l2_ioctl+0x14e/0x1a0 drivers/media/v4l2-core/v4l2-dev.c:364 vfs_ioctl fs/ioctl.c:46 [inline] file_ioctl fs/ioctl.c:509 [inline] do_vfs_ioctl+0xced/0x12f0 fs/ioctl.c:696 ksys_ioctl+0xa0/0xc0 fs/ioctl.c:713 __do_sys_ioctl fs/ioctl.c:720 [inline] __se_sys_ioctl fs/ioctl.c:718 [inline] __x64_sys_ioctl+0x74/0xb0 fs/ioctl.c:718 do_syscall_64+0xcf/0x4f0 arch/x86/entry/common.c:290 entry_SYSCALL_64_after_hwframe+0x49/0xbe RIP: 0033:0x7f3b56d8b347 Code: 90 90 90 48 8b 05 f1 fa 2a 00 64 c7 00 26 00 00 00 48 c7 c0 ff ff ff ff c3 90 90 90 90 90 90 90 90 90 90 b8 10 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 8b 0d c1 fa 2a 00 31 d2 48 29 c2 64 RSP: 002b:00007ffe005d5d68 EFLAGS: 00000202 ORIG_RAX: 0000000000000010 RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00007f3b56d8b347 RDX: 00007ffe005d5d70 RSI: 0000000080685600 RDI: 0000000000000003 RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000202 R12: 0000000000400884 R13: 00007ffe005d5ec0 R14: 0000000000000000 R15: 0000000000000000 ================================================================== For this device udev->product is not initialized and accessing it causes a NULL pointer deref. The fix is to check for NULL before strscpy() and copy empty string, if product is NULL Reported-by: syzbot+66010012fd4c531a1a96@syzkaller.appspotmail.com Signed-off-by:
Vandana BN <bnvandana@gmail.com> Signed-off-by:
-
Hariprasad Kelam authored
fix below warning reported by coccichec drivers/staging/media/imx/imx-media-capture.c:617:5-8: Unneeded variable: "ret". Return "0" on line 630 Signed-off-by:
Hariprasad Kelam <hariprasad.kelam@gmail.com> Reviewed-by:
-
Niklas Söderlund authored
The other subdevice implementations in vimc (debayer and scaler) which share their code structure with the sensor do not have an explicit return statement at the end of the s_stream(0) code path. Align the sensor subdevice by dropping the return statement. Signed-off-by:
Niklas Söderlund <niklas.soderlund+renesas@ragnatech.se> Signed-off-by:
-
Helen Koike authored
If the system has other devices being registered in the component framework, the compare function will be called with a device that doesn't belong to vimc. This device is not necessarily a platform_device, nor have a platform_data (which causes a NULL pointer dereference error) and if it does have a pdata, it is not necessarily type of struct vimc_platform_data. So casting to any of these types is wrong. Instead of expecting a given pdev with a given pdata, just expect for the device it self. vimc-core is the one who creates them, we know in advance exactly which object to expect in the match. Fixes: 4a29b709 ("[media] vimc: Subdevices as modules") Signed-off-by:
Helen Koike <helen.koike@collabora.com> Reviewed-by:
Boris Brezillon <boris.brezillon@collabora.com> Tested-by:
-
sumitg authored
Fixing use-after-free within __v4l2_ctrl_handler_setup(). Memory is being freed with kfree(new_ref) for duplicate control reference entry but ctrl->cluster pointer is still referring to freed duplicate entry resulting in error on access. Change done to update cluster pointer only when new control reference is added. ================================================================== BUG: KASAN: use-after-free in __v4l2_ctrl_handler_setup+0x388/0x428 Read of size 8 at addr ffffffc324e78618 by task systemd-udevd/312 Allocated by task 312: Freed by task 312: The buggy address belongs to the object at ffffffc324e78600 which belongs to the cache kmalloc-64 of size 64 The buggy address is located 24 bytes inside of 64-byte region [ffffffc324e78600, ffffffc324e78640) The buggy address belongs to the page: page:ffffffbf0c939e00 count:1 mapcount:0 mapping: (null) index:0xffffffc324e78f80 flags: 0x4000000000000100(slab) raw: 4000000000000100 0000000000000000 ffffffc324e78f80 000000018020001a raw: 0000000000000000 0000000100000001 ffffffc37040fb80 0000000000000000 page dumped because: kasan: bad access detected Memory state around the buggy address: ffffffc324e78500: fb fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc ffffffc324e78580: fb fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc >ffffffc324e78600: fb fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc ^ ffffffc324e78680: 00 00 00 00 00 00 00 00 fc fc fc fc fc fc fc fc ffffffc324e78700: 00 00 00 00 00 fc fc fc fc fc fc fc fc fc fc fc ================================================================== Suggested-by:Sumit Gupta <sumitg@nvidia.com> Signed-off-by:
-
Niklas Söderlund authored
Use the PTR_ERR_OR_ZERO() macro instead of construct: if (IS_ERR(foo)) return PTR_ERR(foo); return 0; Fixes: 3ae854cafd76 ("rcar-csi2: Use standby mode instead of resetting") Reported-by:kbuild test robot <lkp@intel.com> Signed-off-by:
Ulrich Hecht <uli+renesas@fpond.eu> Reviewed-by:
Geert Uytterhoeven <geert+renesas@glider.be> Reviewed-by:
Simon Horman <horms+renesas@verge.net.au> Signed-off-by:
-
Kefeng Wang authored
vim2m_device_release() will be called by video_unregister_device() to release various objects. There are two double-free issue, 1. dev->m2m_dev will be freed twice in error_m2m path/vim2m_device_release 2. the error_v4l2 and error_free path in vim2m_probe() will release same objects, since vim2m_device_release has done. Fixes: ea6c7e34 ("media: vim2m: replace devm_kzalloc by kzalloc") Cc: Laurent Pinchart <laurent.pinchart@ideasonboard.com> Reported-by:
Hulk Robot <hulkci@huawei.com> Signed-off-by:
Kefeng Wang <wangkefeng.wang@huawei.com> Signed-off-by:
-
Oliver Neukum authored
This converts the driver to using the BIT macro to increase readability Signed-off-by:
Oliver Neukum <oneukum@suse.com> Signed-off-by:
-
Oliver Neukum authored
Kasan reported a use after free in cpia2_usb_disconnect() It first freed everything and then woke up those waiting. The reverse order is correct. Fixes: 6c493f8b ("[media] cpia2: major overhaul to get it in a working state again") Signed-off-by:
-
Steve Longerbeam authored
Add a paragraph to make it more clear that video equipment will transmit fields in the same order the fields were captured, and replace some of the "is transmitted first" language with "is the older field", since the latter is the important info for motion compensation applications. Signed-off-by:
-
Hans Verkuil authored
Unbinding the driver while streaming caused the driver to hang. The cause of this was failing to use the v4l2_device release function and the use of devm_kmalloc for the state structure. Signed-off-by:
-
Boris Brezillon authored
Make sure the default value at least passes the std_validate() tests. Signed-off-by:
-
Ezequiel Garcia authored
This commit clears the interrupt reason (INT_REASON) register on the interrupt handler. Without this clearing, the CODA hardware has been observed to get completely stalled on CODA980 variants, requiring a pretty deep hardware reset. The datasheet specifies that the INT_REASON register is set by the CODA hardware, and should be cleared by the host. While the CODA versions that are currently supported by this driver don't seem to need this change, it's a really small change, so it seems a wise thing to do to avoid hitting some rare race-condition in the hardware. Reviewed-by:
Philipp Zabel <p.zabel@pengutronix.de> Signed-off-by:
Ezequiel Garcia <ezequiel@collabora.com> Signed-off-by:
-
Ezequiel Garcia authored
The current interrupt handler is doing very little, and not doing any non-atomic operations. Pretty much all it does is accessing a couple registers, taking a couple spinlocks and then signalling a completion. There is no reason this should be a threaded interrupt handler, so move the handler to regular hard interrupt context. Reviewed-by:
-
Ezequiel Garcia authored
The mutex unlock in the threaded interrupt handler is not paired with any mutex lock. Remove it. This bug has been here for a really long time, so it applies to any stable repo. Reviewed-by:
-
Ezequiel Garcia authored
This is just a cosmetic change to print a more descriptive message, to distinguish decoder from encoder: So, instead of printing coda 2040000.vpu: codec registered as /dev/video[4-5] With this change, the driver now prints coda 2040000.vpu: encoder registered as /dev/video4 coda 2040000.vpu: decoder registered as /dev/video5 Signed-off-by:
-
Andrey Konovalov authored
When the pvrusb2 driver detects that there's something wrong with the device, it prints a warning message. Right now those message are printed in two different formats: 1. ***WARNING*** message here 2. WARNING: message here There's an issue with the second format. Syzkaller recognizes it as a message produced by a WARN_ON(), which is used to indicate a bug in the kernel. However pvrusb2 prints those warnings to indicate an issue with the device, not the bug in the kernel. This patch changes the pvrusb2 driver to consistently use the first warning message format. This will unblock syzkaller testing of this driver. Reported-by: syzbot+af8f8d2ac0d39b0ed3a0@syzkaller.appspotmail.com Reported-by: syzbot+170a86bf206dd2c6217e@syzkaller.appspotmail.com Signed-off-by:
Andrey Konovalov <andreyknvl@google.com> Reviewed-by:
Greg Kroah-Hartman <gregkh@linuxfoundation.org> Signed-off-by:
-
Hans Verkuil authored
It is really weird that the media controller sources are all top-level in drivers/media. It is a bit of a left-over from long ago when most media sources were all at the top-level. At some point we reorganized the directory structure, but the media-*.c sources where never moved to their own directory. So create a new mc directory and move all sources there. Also rename the prefix from media- to mc-. Signed-off-by:
-
Rui Miguel Silva authored
Setting the media entity pads after the async register subdev can be racy with probe complete callback. So, make sure that the media pads are initialized before the probe complete is called. For that move the media entity pads initialization to the registered subdev internal operation. Signed-off-by:
Rui Miguel Silva <rui.silva@linaro.org> Signed-off-by:
-
Boris Brezillon authored
vdev is guaranteed to be equal to vpu->vfd_enc thanks a test done a few lines above. Remove this useless test. Signed-off-by:
-
Ezequiel Garcia authored
In order to make the code more generic, introduce a pair of start/stop codec operations, and use them to allocate and release the JPEG bounce buffer. Signed-off-by:
-
