- 28 May, 2018 14 commits
-
-
Mauro Carvalho Chehab authored
The current logic makes Smatch to false-detect a Spectre variant 1 vulnerability. The problem is that it initializes an u32 indirectly from user space input. After trying to write a fixup, after a while I realized that, in practice, this shouldn't be a problem, as an u32 is initialized from u8, but it took some time to discover it. So, do some code cleanup to make it clearer for both humans and machines about the valid range for "op". Fix this warning: drivers/media/cec/cec-pin-error-inj.c:170 cec_pin_error_inj_parse_line() warn: potential spectre issue 'pin->error_inj_args' Signed-off-by:
Mauro Carvalho Chehab <mchehab+samsung@kernel.org> Signed-off-by:
Hans Verkuil <hans.verkuil@cisco.com> Signed-off-by:
-
Ezequiel Garcia authored
Some subdrivers access the gspca_dev->urb array in the completion handler. To prevent use-after-free (actually, NULL dereferences) we need to synchronously kill all the URBs before we release them. In particular, this is currently the case for drivers such as sn9c20x and sonixj, which access the gspca_dev->urb[0] in the context of completion handler for *any* of the URBs. This commit changes the destroy_urb implementation, so it kills all URBs first, and then proceed to set the URBs to NULL in the array and release them. Signed-off-by:
Ezequiel Garcia <ezequiel@collabora.com> Signed-off-by:
-
Hans Verkuil authored
Fix v4l2-compliance error: s_parm never set V4L2_CAP_TIMEPERFRAME. Also various g/s_parm-related cleanups. Signed-off-by:
Hans de Goede <hdegoede@redhat.com> Signed-off-by:
-
Hans Verkuil authored
The last user of this 'feature' was the gspca driver. Now that that driver has been converted to vb2 we can delete this code. Signed-off-by:
-
Hans Verkuil authored
Zero the reserved capture/output array. Zero the extendedmode (it is never used in drivers). Clear all flags in capture/outputmode except for V4L2_MODE_HIGHQUALITY, as that is the only valid flag. Signed-off-by:
-
Hans Verkuil authored
The gspca core has its own buffere implementation. Use the core VB 2 instead. Signed-off-by:
-
Hans Verkuil authored
When a buffer is queued or requeued in vb2_buffer_done, then don't call the finish memop. In this case the buffer is only returned to vb2, not to userspace. Calling 'finish' here will cause an unbalance when the queue is canceled, since the core will call the same memop again. Signed-off-by:
-
Akinobu Mita authored
The banding filter ON/OFF is controlled via bit 5 of COM8 register. It is attempted to be enabled in ov772x_set_params() by the following line. ret = ov772x_mask_set(client, COM8, BNDF_ON_OFF, 1); But this unexpectedly results disabling the banding filter, because the mask and set bits are exclusive. On the other hand, ov772x_s_ctrl() correctly sets the bit by: ret = ov772x_mask_set(client, COM8, BNDF_ON_OFF, BNDF_ON_OFF); Cc: Laurent Pinchart <laurent.pinchart@ideasonboard.com> Cc: Hans Verkuil <hans.verkuil@cisco.com> Acked-by:
Jacopo Mondi <jacopo+renesas@jmondi.org> Signed-off-by:
Akinobu Mita <akinobu.mita@gmail.com> Signed-off-by:
Sakari Ailus <sakari.ailus@linux.intel.com> Signed-off-by:
-
Akinobu Mita authored
This adds a device tree binding documentation for OV7720/OV7725 sensor. Cc: Jacopo Mondi <jacopo+renesas@jmondi.org> Cc: Hans Verkuil <hans.verkuil@cisco.com> Cc: Mauro Carvalho Chehab <mchehab@s-opensource.com> Cc: Rob Herring <robh+dt@kernel.org> Reviewed-by:
Rob Herring <robh@kernel.org> Reviewed-by:
Jacopo Mondi <jacopo@jmondi.org> Reviewed-by:
Laurent Pinchart <laurent.pinchart@ideasonboard.com> Signed-off-by:
-
Mauro Carvalho Chehab authored
drivers/media/i2c/imx258.c: In function 'imx258_init_controls': drivers/media/i2c/imx258.c:1117:6: warning: variable 'exposure_max' set but not used [-Wunused-but-set-variable] s64 exposure_max; ^~~~~~~~~~~~ Signed-off-by: -
Jason Chen authored
Add a V4L2 sub-device driver for the Sony IMX258 image sensor. This is a camera sensor using the I2C bus for control and the CSI-2 bus for data. Signed-off-by:
Jason Chen <jasonx.z.chen@intel.com> Signed-off-by:
Andy Yeh <andy.yeh@intel.com> Signed-off-by:
Alan Chiang <alanx.chiang@intel.com> Reviewed-by:
Tomasz Figa <tfiga@chromium.org> Signed-off-by:
-
Niklas Söderlund authored
Instead of failing the set_fmt() if a unsupported format is requested set a default one and return the changed format to the user. Signed-off-by:
Niklas Söderlund <niklas.soderlund+renesas@ragnatech.se> Reported-by:
Sakari Ailus <sakari.ailus@iki.fi> Signed-off-by:
-
Niklas Söderlund authored
A V4L2 driver for Renesas R-Car MIPI CSI-2 receiver. The driver supports the R-Car Gen3 SoCs where separate CSI-2 hardware blocks are connected between the video sources and the video grabbers (VIN). Driver is based on a prototype by Koji Matsuoka in the Renesas BSP. Signed-off-by:
Maxime Ripard <maxime.ripard@bootlin.com> Signed-off-by:
-
Niklas Söderlund authored
Documentation for Renesas R-Car MIPI CSI-2 receiver. The CSI-2 receivers are located between the video sources (CSI-2 transmitters) and the video grabbers (VIN) on Gen3 of Renesas R-Car SoC. Each CSI-2 device is connected to more than one VIN device which simultaneously can receive video from the same CSI-2 device. Each VIN device can also be connected to more than one CSI-2 device. The routing of which links are used is controlled by the VIN devices. There are only a few possible routes which are set by hardware limitations, which are different for each SoC in the Gen3 family. Signed-off-by:
-
- 25 May, 2018 26 commits
-
-
Kieran Bingham authored
We are now able to configure a pipeline directly into a local display list body. Take advantage of this fact, and create a cacheable body to store the configuration of the pipeline in the pipeline object. vsp1_video_pipeline_run() is now the last user of the pipe->dl object. Convert this function to use the cached pipe->stream_config body and obtain a local display list reference. Attach the pipe->stream_config body to the display list when needed before committing to hardware. Use a flag 'configured' to know when we should attach our stream_config to the next outgoing display list to reconfigure the hardware in the event of our first frame, or the first frame following a suspend/resume cycle. Our video DL usage now looks like the below output: dl->body0 contains our disposable runtime configuration. Max 41. dl_child->body0 is our partition specific configuration. Max 12. dl->bodies shows our constant configuration and LUTs. These two are LUT/CLU: * dl->bodies[x]->num_entries 256 / max 256 * dl->bodies[x]->num_entries 4914 / max 4914 Which shows that our 'constant' configuration cache is currently utilised to a maximum of 64 entries. trace-cmd report | \ dl->body0->num_entries 13 / max 128 dl->body0->num_entries 14 / max 128 dl->body0->num_entries 16 / max 128 dl->body0->num_entries 20 / max 128 dl->body0->num_entries 27 / max 128 dl->body0->num_entries 34 / max 128 dl->body0->num_entries 41 / max 128 dl_child->body0->num_entries 10 / max 128 dl_child->body0->num_entries 12 / max 128 dl->bodies[x]->num_entries 15 / max 128 dl->bodies[x]->num_entries 16 / max 128 dl->bodies[x]->num_entries 17 / max 128 dl->bodies[x]->num_entries 18 / max 128 dl->bodies[x]->num_entries 20 / max 128 dl->bodies[x]->num_entries 21 / max 128 dl->bodies[x]->num_entries 256 / max 256 dl->bodies[x]->num_entries 31 / max 128 dl->bodies[x]->num_entries 32 / max 128 dl->bodies[x]->num_entries 39 / max 128 dl->bodies[x]->num_entries 40 / max 128 dl->bodies[x]->num_entries 47 / max 128 dl->bodies[x]->num_entries 48 / max 128 dl->bodies[x]->num_entries 4914 / max 4914 dl->bodies[x]->num_entries 55 / max 128 dl->bodies[x]->num_entries 56 / max 128 dl->bodies[x]->num_entries 63 / max 128 dl->bodies[x]->num_entries 64 / max 128 Signed-off-by:Kieran Bingham <kieran.bingham+renesas@ideasonboard.com> Signed-off-by:
Laurent Pinchart <laurent.pinchart+renesas@ideasonboard.com> Signed-off-by:
-
Kieran Bingham authored
Currently the entities store their configurations into a display list. Adapt this such that the code can be configured into a body directly, allowing greater flexibility and control of the content. All users of vsp1_dl_list_write() are removed in this process, thus it too is removed. A helper, vsp1_dl_list_get_body0() is provided to access the internal body0 from the display list. [laurent.pinchart+renesas@ideasonboard.com: Don't remove blank line unnecessarily] Signed-off-by:
-
Kieran Bingham authored
The entities provide a single .configure operation which configures the object into the target display list, based on the vsp1_entity_params selection. Split the configure function into three parts, '.configure_stream()', '.configure_frame()', and '.configure_partition()' to facilitate splitting the configuration of each parameter class into separate display list bodies. [laurent.pinchart+renesas@ideasonboard.com: Blank line reformatting, remote unneeded local variable initialization] Signed-off-by:
-
Kieran Bingham authored
Extend the display list body with a reference count, allowing bodies to be kept as long as a reference is maintained. This provides the ability to keep a cached copy of bodies which will not change, so that they can be re-applied to multiple display lists. Signed-off-by:
-
Kieran Bingham authored
Adapt the dl->body0 object to use an object from the body pool. This greatly reduces the pressure on the TLB for IPMMU use cases, as all of the lists use a single allocation for the main body. The CLU and LUT objects pre-allocate a pool containing three bodies, allowing a userspace update before the hardware has committed a previous set of tables. Bodies are no longer 'freed' in interrupt context, but instead released back to their respective pools. This allows us to remove the garbage collector in the DLM. Signed-off-by:
-
Kieran Bingham authored
Each display list allocates a body to store register values in a dma accessible buffer from a dma_alloc_wc() allocation. Each of these results in an entry in the IOMMU TLB, and a large number of display list allocations adds pressure to this resource. Reduce TLB pressure on the IPMMUs by allocating multiple display list bodies in a single allocation, and providing these to the display list through a 'body pool'. A pool can be allocated by the display list manager or entities which require their own body allocations. Signed-off-by:
-
Kieran Bingham authored
The body write function relies on the code never asking it to write more than the entries available in the list. Currently with each list body containing 256 entries, this is fine, but we can reduce this number greatly saving memory. In preparation of this add a level of protection to catch any buffer overflows. Signed-off-by:
-
Kieran Bingham authored
Throughout the codebase, the term 'fragment' is used to represent a display list body. This term duplicates the 'body' which is already in use. The datasheet references these objects as a body, therefore replace all mentions of a fragment with a body, along with the corresponding pluralised terms. Signed-off-by:
-
Kieran Bingham authored
The suspend and resume handlers are only utilised by video pipelines, yet the functions currently reside in the vsp1_pipe object. This causes an issue with resume, as the functions incorrectly call vsp1_pipeline_run() directly instead of processing the video object through vsp1_video_pipeline_run(). Move the functions to the video object, renaming accordingly and update the resume handler to call vsp1_video_pipeline_run() as appropriate. Signed-off-by:
-
Kieran Bingham authored
Commit 372b2b03 ("media: v4l: vsp1: Release buffers in start_streaming error path") introduced a helper to clean up buffers on error paths, but inadvertently changed the code such that only the output WPF buffers were cleaned, rather than the video node being operated on. Since then vsp1_video_cleanup_pipeline() has grown to perform both video node cleanup, as well as pipeline cleanup. Split the implementation into two distinct functions that perform the required work, so that each video node can release its buffers correctly on streamoff. The pipe cleanup that was performed in the vsp1_video_stop_streaming() (releasing the pipe->dl) is moved to the function for clarity. Fixes: 372b2b03 ("media: v4l: vsp1: Release buffers in start_streaming error path") Cc: stable@vger.kernel.org # v4.14+ Signed-off-by:
-
Geert Uytterhoeven authored
VIDEO_RENESAS_VSP1 depends on ARCH_RENESAS && OF. As ARCH_RENESAS implies OF, the latter can be dropped. Signed-off-by:
Geert Uytterhoeven <geert+renesas@glider.be> Reviewed-by:
Simon Horman <horms+renesas@verge.net.au> Signed-off-by:
-
Hans Verkuil authored
The CEC receive buffer was not always cleared correctly. The datasheet was a bit confusing since sometimes it mentioned that the bit in CEC register 0x4a had to be toggled, and sometimes it suggested it was a 'Clear-on-write' bit. But it really needs to be toggled. The patch also enables/disables the CEC irqs after the other irq are enabled/disabled instead of doing it before. It may not matter, but it feels more logical to do it in that order, and the implementation that we (Cisco) have used until now and that is known to be reliable also did it in that order. Signed-off-by:
Hans Verkuil <hansverk@cisco.com> Signed-off-by:
-
Fabien Dessenne authored
Set the DMA_MASK and stop using the GFP_DMA flag Signed-off-by:
Fabien Dessenne <fabien.dessenne@st.com> Signed-off-by:
-
Fabien Dessenne authored
Set the DMA_MASK and stop using the GFP_DMA flag Signed-off-by:
-
Hans Verkuil authored
Clarify the description of status bits, particularly w.r.t. ERROR and NACK. Signed-off-by:
-
Hans Verkuil authored
In function 'strncpy', inlined from 'soc_camera_platform_probe' at drivers/media/platform/soc_camera/soc_camera_platform.c:162:2: include/linux/string.h:246:9: warning: '__builtin_strncpy' specified bound 32 equals destination size [-Wstringop-truncation] return __builtin_strncpy(p, q, size); ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Signed-off-by: -
Hans Verkuil authored
In function 'strncpy', inlined from 'ceu_notify_complete' at drivers/media/platform/renesas-ceu.c:1378:2: include/linux/string.h:246:9: warning: '__builtin_strncpy' output truncated before terminating nul copying 11 bytes from a string of the same length [-Wstringop-truncation] return __builtin_strncpy(p, q, size); ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Signed-off-by: -
Hans Verkuil authored
drivers/staging/media/imx/imx-media-capture.c: In function 'vidioc_querycap': drivers/staging/media/imx/imx-media-capture.c:76:2: warning: 'strncpy' output truncated copying 15 bytes from a string of length 17 [-Wstringop-truncation] strncpy(cap->driver, "imx-media-capture", sizeof(cap->driver) - 1); ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Signed-off-by:
Steve Longerbeam <steve_longerbeam@mentor.com> Signed-off-by:
-
Hans Verkuil authored
In function 'strncpy', inlined from 'vidioc_g_audio' at media-git/drivers/media/usb/hdpvr/hdpvr-video.c:876:2: media-git/include/linux/string.h:246:9: warning: '__builtin_strncpy' specified bound 32 equals destination size [-Wstringop-truncation] return __builtin_strncpy(p, q, size); ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Signed-off-by: -
Hans Verkuil authored
media-git/drivers/media/platform/s5p-mfc/s5p_mfc_enc.c: In function 'vidioc_querycap': media-git/drivers/media/platform/s5p-mfc/s5p_mfc_enc.c:1317:2: warning: 'strncpy' output may be truncated copying 31 bytes from a string of length 31 [-Wstringop-truncation] strncpy(cap->card, dev->vfd_enc->name, sizeof(cap->card) - 1); ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ media-git/drivers/media/platform/s5p-mfc/s5p_mfc_dec.c: In function 'vidioc_querycap': media-git/drivers/media/platform/s5p-mfc/s5p_mfc_dec.c:275:2: warning: 'strncpy' output may be truncated copying 31 bytes from a string of length 31 [-Wstringop-truncation] strncpy(cap->card, dev->vfd_dec->name, sizeof(cap->card) - 1); ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Signed-off-by:
Sylwester Nawrocki <s.nawrocki@samsung.com> Signed-off-by:
-
Hans Verkuil authored
In file included from media-git/include/linux/bitmap.h:9, from media-git/include/linux/cpumask.h:12, from media-git/arch/x86/include/asm/cpumask.h:5, from media-git/arch/x86/include/asm/msr.h:11, from media-git/arch/x86/include/asm/processor.h:21, from media-git/arch/x86/include/asm/cpufeature.h:5, from media-git/arch/x86/include/asm/thread_info.h:53, from media-git/include/linux/thread_info.h:38, from media-git/arch/x86/include/asm/preempt.h:7, from media-git/include/linux/preempt.h:81, from media-git/include/linux/spinlock.h:51, from media-git/include/linux/seqlock.h:36, from media-git/include/linux/time.h:6, from media-git/include/linux/stat.h:19, from media-git/include/linux/module.h:10, from media-git/drivers/staging/media/zoran/zoran_driver.c:44: In function 'strncpy', inlined from 'zoran_querycap' at media-git/drivers/staging/media/zoran/zoran_driver.c:1512:2: media-git/include/linux/string.h:246:9: warning: '__builtin_strncpy' output may be truncated copying 31 bytes from a string of length 31 [-Wstringop-truncation] return __builtin_strncpy(p, q, size); ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Signed-off-by: -
Hans Verkuil authored
drivers/media/usb/go7007/go7007-v4l2.c:637:2: warning: 'strncpy' specified bound 32 equals destination size [-Wstringop-truncation] drivers/media/usb/go7007/go7007-fw.c:1507:3: warning: this statement may fall through [-Wimplicit-fallthrough=] Signed-off-by:
-
Luca Ceresoli authored
The API limitation described here is about the CROP API, not about the entire V4L2. Signed-off-by:
Luca Ceresoli <luca@lucaceresoli.net> Signed-off-by:
-
Luca Ceresoli authored
Split section "Comparison with old cropping API" in paragraphs for easier reading and improve visible links text. Signed-off-by:
-
Luca Ceresoli authored
These files have an automatically-generated numbering. Rename them with a name that suggests their meaning. Reported-by:
Hans Verkuil <hverkuil@xs4all.nl> Signed-off-by:
-
Luca Ceresoli authored
Having two somewhat similar and largely overlapping APIs is confusing, especially since the older one appears in the docs before the newer and most featureful counterpart. Clarify all of this in several ways: - swap the two sections - give a name to the two APIs in the section names - add a note at the beginning of the CROP API section - update note about VIDIOC_CROPCAP Also remove a note that is incorrect (correct wording is in vidioc-cropcap.rst). Signed-off-by:
-
