- 04 Nov, 2022 28 commits
-
-
Yang Li authored
The print function dev_err() is redundant because platform_get_irq() already prints an error. Link: https://bugzilla.openanolis.cn/show_bug.cgi?id=2314Reported-by:
Abaci Robot <abaci@linux.alibaba.com> Signed-off-by:
Yang Li <yang.lee@linux.alibaba.com> Acked-by:
Jernej Skrabec <jernej.skrabec@gmail.com> Signed-off-by:
Hans Verkuil <hverkuil-cisco@xs4all.nl>
-
Laurent Pinchart authored
The V4L2 API historically allowed buffers to be queued with bytesused set to 0 on output devices, in which case the driver would use the buffer length. This behaviour is deprecated, and videobuf2 prints a warning message in the kernel log. Drop it from the documentation. Signed-off-by:
Laurent Pinchart <laurent.pinchart+renesas@ideasonboard.com> Reviewed-by:
Sakari Ailus <sakari.ailus@linux.intel.com> Signed-off-by:
-
Yang Yingliang authored
devm_pinctrl_get() may return ERR_PTR(-EPROBE_DEFER), add a minus sign to fix it. Fixes: 4163851f ("[media] s5p-fimc: Use pinctrl API for camera ports configuration") Signed-off-by:
Yang Yingliang <yangyingliang@huawei.com> Signed-off-by:
-
Colin Ian King authored
Variable n is just being incremented and it's never used anywhere else. The variable and the increment are redundant so remove it. This allows the for-loop to be replaced with a while-loop. Signed-off-by:
Colin Ian King <colin.i.king@gmail.com> Reviewed-by:
Tommaso Merciai <tommaso.merciai@amarulasolutions.com> Signed-off-by:
-
Liu Shixin authored
syzkaller found a bug: BUG: unable to handle page fault for address: ffffc9000a3b1000 #PF: supervisor write access in kernel mode #PF: error_code(0x0002) - not-present page PGD 100000067 P4D 100000067 PUD 10015f067 PMD 1121ca067 PTE 0 Oops: 0002 [#1] PREEMPT SMP CPU: 0 PID: 23489 Comm: vivid-000-vid-c Not tainted 6.1.0-rc1+ #512 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.13.0-1ubuntu1.1 04/01/2014 RIP: 0010:memcpy_erms+0x6/0x10 [...] Call Trace: <TASK> ? tpg_fill_plane_buffer+0x856/0x15b0 vivid_fillbuff+0x8ac/0x1110 vivid_thread_vid_cap_tick+0x361/0xc90 vivid_thread_vid_cap+0x21a/0x3a0 kthread+0x143/0x180 ret_from_fork+0x1f/0x30 </TASK> This is because we forget to check boundary after adjust compose->height int V4L2_SEL_TGT_CROP case. Add v4l2_rect_map_inside() to fix this problem for this case. Fixes: ef834f78 ("[media] vivid: add the video capture and output parts") Signed-off-by:
Liu Shixin <liushixin2@huawei.com> Signed-off-by:
-
Colin Ian King authored
Don't populate the const arrays on the stack, instead make them static. Also makes the object code smaller. Signed-off-by:
-
Takashi Iwai authored
The dvb-core tries to sync the releases of opened files at dvb_dmxdev_release() with two refcounts: dvbdev->users and dvr_dvbdev->users. A problem is present in those two syncs: when yet another dvb_demux_open() is called during those sync waits, dvb_demux_open() continues to process even if the device is being closed. This includes the increment of the former refcount, resulting in the leftover refcount after the sync of the latter refcount at dvb_dmxdev_release(). It ends up with use-after-free, since the function believes that all usages were gone and releases the resources. This patch addresses the problem by adding the check of dmxdev->exit flag at dvb_demux_open(), just like dvb_dvr_open() already does. With the exit flag check, the second call of dvb_demux_open() fails, hence the further corruption can be avoided. Also for avoiding the races of the dmxdev->exit flag reference, this patch serializes the dmxdev->exit set up and the sync waits with the dmxdev->mutex lock at dvb_dmxdev_release(). Without the mutex lock, dvb_demux_open() (or dvb_dvr_open()) may run concurrently with dvb_dmxdev_release(), which allows to skip the exit flag check and continue the open process that is being closed. CVE-2022-41218 is assigned to those bugs above. Reported-by:
Hyunwoo Kim <imv4bel@gmail.com> Cc: <stable@vger.kernel.org> Link: https://lore.kernel.org/20220908132754.30532-1-tiwai@suse.deSigned-off-by:
Takashi Iwai <tiwai@suse.de> Signed-off-by:
-
Andrzej Pietrasiewicz authored
The addresses of two elements of the segmap[][] member are passed to the hardware which expects 128-bit aligned addresses. However, without this patch offsetof(struct rkvdec_vp9_priv_tbl, segmap[0]) is an odd number (2421) but the hardware just ignores the 5 least significant bits of the address. As a result, the hardware writes the segmentation map to incorrect locations. Inserting 11 bytes of padding corrects this situation by making the said addresses divisible by 16 (i.e. aligned on a 128-bit boundary). Signed-off-by:
Andrzej Pietrasiewicz <andrzej.p@collabora.com> Fixes: f25709c4 ("media: rkvdec: Add the VP9 backend") Reviewed-by:
Nicolas Dufresne <nicolas.dufresne@collabora.com> Signed-off-by:
-
Jammy Huang authored
updated as below: Capture: Mode : Direct fetch VGA bpp mode : 32 Signal : lock Width : 1920 Height : 1080 FRC : 0 Compression: Format : JPEG Subsampling : 444 Quality : 4 Performance: Frame# : 4 Frame Duration(ms) : Now : 22 Min : 21 Max : 22 FPS : 45 Signed-off-by:Jammy Huang <jammy_huang@aspeedtech.com> Signed-off-by:
-
Jammy Huang authored
aspeed supports differential jpeg format which only compress the parts which are changed. In this way, it reduces both the amount of data to be transferred by network and those to be decoded on the client side. 2 new ctrls are added: * Aspeed HQ Mode: to control aspeed's high quality(2-pass) compression mode This only works with yuv444 subsampling. * Aspeed HQ Quality: to control the quality of aspeed's HQ mode only useful if Aspeed HQ mode is enabled Aspeed JPEG Format requires an additional buffer, called bcd, to store the information about which macro block in the new frame is different from the previous one. To have bcd correctly working, we need to swap the buffers for src0/1 to make src1 refer to previous frame and src0 to the coming new frame. Signed-off-by:
kernel test robot <lkp@intel.com> Signed-off-by:
-
Jammy Huang authored
Add user documentation for the aspeed-video driver. Signed-off-by:
-
Jammy Huang authored
Reserve controls for ASPEED video family. Aspeed video engine contains a few features which improve video quality, reduce amount of compressed data, and etc. Hence, 16 controls are reserved for these aspeed proprietary features. Signed-off-by:
-
Jammy Huang authored
This introduces support for the Aspeed JPEG format, where the new frame can refer to previous frame to reduce the amount of compressed data. The concept is similar to I/P frame of video compression. It will compare the new frame with previous one to decide which macroblock's data is changed, and only the changed macroblocks will be compressed. This Aspeed JPEG format is used by the video engine on Aspeed platforms, which is generally adapted for remote KVM. Signed-off-by:
-
Luca Ceresoli authored
At probe time this code path is followed: * tegra_csi_init * tegra_csi_channels_alloc * for_each_child_of_node(node, channel) -- iterates over channels * automatically gets 'channel' * tegra_csi_channel_alloc() * saves into chan->of_node a pointer to the channel OF node * automatically gets and puts 'channel' * now the node saved in chan->of_node has refcount 0, can disappear * tegra_csi_channels_init * iterates over channels * tegra_csi_channel_init -- uses chan->of_node After that, chan->of_node keeps storing the node until the device is removed. of_node_get() the node and of_node_put() it during teardown to avoid any risk. Fixes: 1ebaeb09 ("media: tegra-video: Add support for external sensor capture") Cc: stable@vger.kernel.org Cc: Sowjanya Komatineni <skomatineni@nvidia.com> Signed-off-by:Luca Ceresoli <luca.ceresoli@bootlin.com> Signed-off-by:
-
Luca Ceresoli authored
chan->mipi takes the return value of tegra_mipi_request() which can be a valid pointer or an error. However chan->mipi is checked in several places, including error-cleanup code in tegra_csi_channels_cleanup(), as 'if (chan->mipi)', which suggests the initial intent was that chan->mipi should be either NULL or a valid pointer, never an error. As a consequence, cleanup code in case of tegra_mipi_request() errors would dereference an invalid pointer. Fix by ensuring chan->mipi always contains either NULL or a void pointer. Also add that to the documentation. Fixes: 523c857e ("media: tegra-video: Add CSI MIPI pads calibration") Cc: stable@vger.kernel.org Reported-by:
Dan Carpenter <dan.carpenter@oracle.com> Signed-off-by:
-
Jernej Skrabec authored
While it doesn't matter if controls are initialized before or after queues and formats from open handler standpoint, initializing them last helps keeping s_ctrl handler simpler, since everything has already valid values. This is just preparation for follow up changes. No functional change is intended. Signed-off-by:
-
Jernej Skrabec authored
While all generations of display engine on Allwinner SoCs support untiled format, only first generation supports tiled format. Let's move untiled format up, so it can be picked before tiled one. If Cedrus variant doesn't support untiled format, tiled will still be picked as default format. Acked-by:
Paul Kocialkowski <paul.kocialkowski@bootlin.com> Signed-off-by:
-
Jernej Skrabec authored
Last user of cedrus_codec enum is cedrus_engine_enable() but this argument is completely redundant. Same information can be obtained via source pixel format. Let's remove this argument and enum. No functional changes intended. Acked-by:
-
Jernej Skrabec authored
We'll need codec ops soon after output format is set in following commits. Let's move current codec setup to set output format callback. While at it, let's remove one level of indirection by changing current_codec to point to codec ops structure directly. Acked-by:
-
Jernej Skrabec authored
Because not all Cedrus variants supports all codecs, controls should be registered only if codec related to individual control is supported by Cedrus. Replace codec enum, which is not used at all, with capabilities flags and register control only if capabilities are met. We have to be careful though, controls have to be tightly packed in ctx->ctrls array. Otherwise functions cedrus_find_control_data() and cedrus_get_num_of_controls() won't work properly. Signed-off-by:
-
Jernej Skrabec authored
There is several different Cedrus cores with varying capabilities, so some operations like listing formats depends on checks if feature is supported or not. Currently check for capabilities is only in format handling functions, but it will be used also elsewhere later. Let's convert this check to helper and while at it, also simplify it. There is no need to check if capability mask is zero, condition will still work properly. No functional changes intended. Signed-off-by:
-
Jernej Skrabec authored
Now that set output format helper is available, let's use that for setting default values. Advantage of this is that values will be always valid. Current code produced invalid default values for V3s SoC, which doesn't support MPEG2 decoding. Signed-off-by:
-
Jernej Skrabec authored
By re-arranging try format handlers and set out format handler, we can easily implement reset out/cap format helpers. There is only one subtle, but important functional change. Capture pixel format will be reset each time output format is set. This is actually expected behaviour per stateless decoder API. Signed-off-by:
-
Jernej Skrabec authored
cedrus_try_fmt_vid_out() is called two times inside cedrus_s_fmt_vid_out(), but nothing changes between calls which would influence output format. Remove first call, which was added later. Acked-by:
-
Moudy Ho authored
Adjust label "err_return" order to avoid double freeing, and add two labels for easy traceability. Fixes: 61890cca ("media: platform: mtk-mdp3: add MediaTek MDP3 driver") Signed-off-by:
Moudy Ho <moudy.ho@mediatek.com> Reviewed-by:
AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com> Signed-off-by:
-
Moudy Ho authored
Add goto statement in mdp_comp_clock_on() to avoid error code not being propagated or returning positive values. This change also performs a well-timed clock_off when an error occurs, and reduces unnecessary error logging in mdp_cmdq_send(). Fixes: 61890cca ("media: platform: mtk-mdp3: add MediaTek MDP3 driver") Signed-off-by:
-
Moudy Ho authored
Increase and refine the goto label in mdp_cmdq_send() to avoid double free and facilitate traceability. Also, remove redundant work queue event in blocking function mdp_cmdq_send(). Fixes: 61890cca ("media: platform: mtk-mdp3: add MediaTek MDP3 driver") Signed-off-by:
-
Moudy Ho authored
The communication between MDP3 kernel driver and SCP is pass through a shared memory, and the data structure is defined in the "mtk-img-ipi.h". However, there is a 4-byte read limit in further SCP hardware, so the data structure should be in 4-byte aligned. Signed-off-by:
-
- 25 Oct, 2022 8 commits
-
-
Hans Verkuil authored
The example on how to use and test Capture Overlay specified the wrong video device node. Back in 2015 the loop_video control moved from the output device to the capture device, but this example code is still referring to the output video device. Signed-off-by:
Mauro Carvalho Chehab <mchehab@kernel.org>
-
Hans Verkuil authored
If node_types does not have video/vbi/meta inputs or outputs, then set num_inputs/num_outputs to 0 instead of 1. Signed-off-by:
-
Hans Verkuil authored
>From what I can see, this is not needed. And since using it issues a 'deprecated' warning, just drop it. Signed-off-by:
-
Hans Verkuil authored
vivid_update_format_cap() can be called from an s_ctrl callback. In that case (keep_controls == true) no control framework functions can be called that take the control handler mutex. The new call to v4l2_ctrl_modify_dimensions() did exactly that. Signed-off-by:
-
Hans Verkuil authored
If it is a progressive (non-interlaced) format, then ignore the interlaced timing values. Signed-off-by:
-
Hans Verkuil authored
Add sanity checks to v4l2_valid_dv_timings() to ensure that the provided blanking values are reasonable. Signed-off-by:
-
Hans Verkuil authored
Whenever the compose width/height values change, the dev->bitmap_cap vmalloc'ed array must be freed and dev->bitmap_cap set to NULL. This was done in some places, but not all. This is only an issue if overlay support is enabled and the bitmap clipping is used. Signed-off-by:
-
Hans Verkuil authored
VIDIOC_S_FBUF is by definition a scary ioctl, which is why only root can use it. But at least check if the framebuffer parameters match that of one of the framebuffer created by vivid, and reject anything else. Signed-off-by:
-
- 23 Oct, 2022 4 commits
-
-
Linus Torvalds authored
-
git://git.kernel.org/pub/scm/virt/kvm/kvmLinus Torvalds authored
Pull kvm fixes from Paolo Bonzini: "RISC-V: - Fix compilation without RISCV_ISA_ZICBOM - Fix kvm_riscv_vcpu_timer_pending() for Sstc ARM: - Fix a bug preventing restoring an ITS containing mappings for very large and very sparse device topology - Work around a relocation handling error when compiling the nVHE object with profile optimisation - Fix for stage-2 invalidation holding the VM MMU lock for too long by limiting the walk to the largest block mapping size - Enable stack protection and branch profiling for VHE - Two selftest fixes x86: - add compat implementation for KVM_X86_SET_MSR_FILTER ioctl selftests: - synchronize includes between include/uapi and tools/include/uapi" * tag 'for-linus' of git://git.kernel.org/pub/scm/virt/kvm/kvm: tools: include: sync include/api/linux/kvm.h KVM: x86: Add compat handler for KVM_X86_SET_MSR_FILTER KVM: x86: Copy filter arg outside kvm_vm_ioctl_set_msr_filter() kvm: Add support for arch compat vm ioctls RISC-V: KVM: Fix kvm_riscv_vcpu_timer_pending() for Sstc RISC-V: Fix compilation without RISCV_ISA_ZICBOM KVM: arm64: vgic: Fix exit condition in scan_its_table() KVM: arm64: nvhe: Fix build with profile optimization KVM: selftests: Fix number of pages for memory slot in memslot_modification_stress_test KVM: arm64: selftests: Fix multiple versions of GIC creation KVM: arm64: Enable stack protection and branch profiling for VHE KVM: arm64: Limit stage2_apply_range() batch size to largest block KVM: arm64: Work out supported block level at compile time -
Jason A. Donenfeld authored
This reverts commit 72a95859. It broke reboots on big-endian MIPS and MIPS64 malta QEMU instances, which use the syscon driver. Little-endian is not effected, which means likely it's important to handle regmap_get_val_endian() in this function after all. Fixes: 72a95859 ("mfd: syscon: Remove repetition of the regmap_get_val_endian()") Reviewed-by:
Andy Shevchenko <andriy.shevchenko@linux.intel.com> Cc: Lee Jones <lee@kernel.org> Signed-off-by:
Jason A. Donenfeld <Jason@zx2c4.com> Signed-off-by:
Linus Torvalds <torvalds@linux-foundation.org>
-
Linus Torvalds authored
Commit bfca3dd3 ("kernel/utsname_sysctl.c: print kernel arch") added a new entry to the uts_kern_table[] array, but didn't update the UTS_PROC_xyz enumerators of older entries, breaking anything that used them. Which is admittedly not many cases: it's really just the two uses of uts_proc_notify() in kernel/sys.c. But apparently journald-systemd actually uses this to detect hostname changes. Reported-by:
Torsten Hilbrich <torsten.hilbrich@secunet.com> Fixes: bfca3dd3 ("kernel/utsname_sysctl.c: print kernel arch") Link: https://lore.kernel.org/lkml/0c2b92a6-0f25-9538-178f-eee3b06da23f@secunet.com/ Link: https://linux-regtracking.leemhuis.info/regzbot/regression/0c2b92a6-0f25-9538-178f-eee3b06da23f@secunet.com/ Cc: Petr Vorel <pvorel@suse.cz> Signed-off-by:
-
