22 Apr, 2019
40 commits
-
Calling VIDIOC_DQBUF can release the core serialization lock pointed to
by vb2_queue->lock if it has to wait for a new buffer to arrive.However, if userspace dup()ped the video device filehandle, then it is
possible to read or call DQBUF from two filehandles at the same time.It is also possible to call REQBUFS from one filehandle while the other
is waiting for a buffer. This will remove all the buffers and reallocate
new ones. Removing all the buffers isn't the problem here (that's already
handled correctly by DQBUF), but the reallocating part is: DQBUF isn't
aware that the buffers have changed.This is fixed by setting a flag whenever the lock is released while waiting
for a buffer to arrive. And checking the flag where needed so we can return
-EBUSY.Signed-off-by: Hans Verkuil
Reported-by: Syzbot
Reviewed-by: Tomasz Figa
Signed-off-by: Hans Verkuil
Signed-off-by: Mauro Carvalho Chehab -
The ctrl_check_input() function is called from pvr2_ctrl_range_check().
It's supposed to validate user supplied input and return true or false
depending on whether the input is valid or not. The problem is that
negative shifts or shifts greater than 31 are undefined in C. In
practice with GCC they result in shift wrapping so this function returns
true for some inputs which are not valid and this could result in a
buffer overflow:drivers/media/usb/pvrusb2/pvrusb2-ctrl.c:205 pvr2_ctrl_get_valname()
warn: uncapped user index 'names[val]'The cptr->hdw->input_allowed_mask mask is configured in pvr2_hdw_create()
and the highest valid bit is BIT(4).Fixes: 7fb20fa38caa ("V4L/DVB (7299): pvrusb2: Improve logic which handles input choice availability")
Signed-off-by: Dan Carpenter
Signed-off-by: Hans Verkuil
Signed-off-by: Mauro Carvalho Chehab -
Currently, MEDIA_IOC_G_TOPOLOGY ioctl on cedrus fails due to incorrect
initialization order. Fix that by moving video_register_device() before
v4l2_m2m_register_media_controller() and while at it, fix error path.Reported-by: Jonas Karlman
Signed-off-by: Jernej Skrabec
Acked-by: Paul Kocialkowski
Signed-off-by: Hans Verkuil
Signed-off-by: Mauro Carvalho Chehab -
syzkaller reported crashes on kfree() called from
vivid_vid_cap_s_selection(). This looks like a simple typo, as
dev->bitmap_cap is allocated with vzalloc() throughout the file.Fixes: ef834f7836ec0 ("[media] vivid: add the video capture and output
parts")Signed-off-by: Alexander Potapenko
Reported-by: Syzbot
Signed-off-by: Hans Verkuil
Signed-off-by: Mauro Carvalho Chehab -
If a buffer is queued to a request, followed by an attempt to queue
the same buffer again, then the second qbuf returns an error since
the buffer is not in the DEQUEUED state anymore.However, before it gets to that check it executes the code under the
'if (!vb->prepared)' condition. This clears previously set data needed
for request handling, and now querybuf will no longer report that this
buffer is part of a request.Move the state check to before the 'if' and make sure to only do the
state check when called from QBUF and if V4L2_BUF_FLAG_REQUEST_FD is
set.Signed-off-by: Hans Verkuil
Signed-off-by: Mauro Carvalho Chehab -
Update referenced frame buffer's reference count when playing vp9
content which has show_existing_frame flag, and copy enough buffer
data to current shown frame.Signed-off-by: Maoguang Meng
Signed-off-by: Hans Verkuil
Signed-off-by: Mauro Carvalho Chehab -
The driver used %d for formatting unsigned values. Use %u instead.
Signed-off-by: Sakari Ailus
Reviewed-by: Bingbu Cao
Signed-off-by: Mauro Carvalho Chehab -
Current ImgU driver processes and releases the parameter buffer
immediately after queued from user. This does not align with other
image buffers which are grouped in sets and used for the same frame.
If user queues multiple parameter buffers continuously, only the last
one will take effect.
To make consistent buffers usage, this patch changes the parameter
buffer handling and group parameter buffer with other image buffers
for each frame.
Each time driver will queue one more group of buffers when previous
frame processed and buffers consumed by css.Signed-off-by: Tianshu Qiu
Signed-off-by: Bingbu Cao
Signed-off-by: Sakari Ailus
Signed-off-by: Mauro Carvalho Chehab -
This V4L2 subdev driver enables STMicroelectronics MIPID02 device.
Signed-off-by: Mickael Guene
Signed-off-by: Sakari Ailus
Signed-off-by: Mauro Carvalho Chehab -
This adds documentation of device tree for MIPID02 CSI-2 to PARALLEL
bridge.Reviewed-by: Rob Herring
Signed-off-by: Mickael Guene
Signed-off-by: Sakari Ailus
Signed-off-by: Mauro Carvalho Chehab -
This patch adds MEDIA_BUS_FMT_BGR888_3X8 used by STM MIPID02 CSI-2 to
PARALLEL bridge driver when input format is MEDIA_BUS_FMT_BGR888_1X24.Signed-off-by: Mickael Guene
Signed-off-by: Sakari Ailus
Signed-off-by: Mauro Carvalho Chehab -
Avoid returning with mutex locked.
Fixes: fa8cb6444c32 ("[media] ov2659: Don't depend on subdev API")
Cc: "Lad, Prabhakar"
Signed-off-by: Akinobu Mita
Acked-by: Lad, Prabhakar
Signed-off-by: Sakari Ailus
Signed-off-by: Mauro Carvalho Chehab -
This driver returns an error if unsupported media bus pixel code is
requested by VIDIOC_SUBDEV_S_FMT.But according to Documentation/media/uapi/v4l/vidioc-subdev-g-fmt.rst,
Drivers must not return an error solely because the requested format
doesn't match the device capabilities. They must instead modify the
format to match what the hardware can provide.So select default format code and return success in that case.
This is detected by v4l2-compliance.
Cc: "Lad, Prabhakar"
Signed-off-by: Akinobu Mita
Acked-by: Lad, Prabhakar
Signed-off-by: Sakari Ailus
Signed-off-by: Mauro Carvalho Chehab -
Register V4L2 subdevice implemented by the driver to the V4L2
asynchronous subdevice framework.[Sakari Ailus: Remove extra call to v4l2_i2c_subdev_set_name]
Signed-off-by: Janusz Krzysztofik
Signed-off-by: Sakari Ailus
Signed-off-by: Mauro Carvalho Chehab -
In preparation for adding asynchronous subdevice support to the driver,
don't acquire v4l2_clk from the driver .probe() callback as that may
fail if the clock is provided by a bridge driver which may be not yet
initialized. Move the v4l2_clk_get() to ov6650_video_probe() helper
which is going to be converted to v4l2_subdev_internal_ops.registered()
callback, executed only when the bridge driver is ready.Signed-off-by: Janusz Krzysztofik
Signed-off-by: Sakari Ailus
Signed-off-by: Mauro Carvalho Chehab -
After removal of clock_start() from before soc_camera_init_i2c() in
soc_camera_probe() by commit 9aea470b399d ("[media] soc-camera: switch
I2C subdevice drivers to use v4l2-clk") introduced in v3.11, the ov6650
driver could no longer probe the sensor successfully because its clock
was no longer turned on in advance. The issue was initially worked
around by adding that missing clock_start() equivalent to OMAP1 camera
interface driver - the only user of this sensor - but a propoer fix
should be rather implemented in the sensor driver code itself.Fix the issue by inserting a delay between the clock is turned on and
the sensor I2C registers are read for the first time.Tested on Amstrad Delta with now out of tree but still locally
maintained omap1_camera host driver.Fixes: 9aea470b399d ("[media] soc-camera: switch I2C subdevice drivers to use v4l2-clk")
Signed-off-by: Janusz Krzysztofik
Cc: stable@vger.kernel.org
Signed-off-by: Sakari Ailus
Signed-off-by: Mauro Carvalho Chehab -
If the application was streaming from both videoX and vbiX, and streaming
from videoX was stopped, then the vbi streaming also stopped.The cause being that stop_streaming for video stopped the subdevs as well,
instead of only doing that if dev->streaming_users reached 0.au0828_stop_vbi_streaming was also wrong since it didn't stop the subdevs
at all when dev->streaming_users reached 0.Signed-off-by: Hans Verkuil
Tested-by: Shuah Khan
Signed-off-by: Mauro Carvalho Chehab -
Fix media_devnode_unregister() to clear devnode->media_dev while holding
media_devnode_lock. media_devnode_register()'s cdev_add_error handling
does this correctly.Signed-off-by: Shuah Khan
Signed-off-by: Hans Verkuil
Signed-off-by: Mauro Carvalho Chehab -
Fix au0828_analog_stream_enable() to check if device is in the right
state first. When unbind happens while bind is in progress, usbdev
pointer could be invalid in au0828_analog_stream_enable() and a call
to usb_ifnum_to_if() will result in the null pointer dereference.This problem is found with the new media_dev_allocator.sh test.
kernel: [ 590.359623] BUG: unable to handle kernel NULL pointer dereference at 00000000000004e8
kernel: [ 590.359627] #PF error: [normal kernel read fault]
kernel: [ 590.359629] PGD 0 P4D 0
kernel: [ 590.359632] Oops: 0000 [#1] SMP PTI
kernel: [ 590.359634] CPU: 3 PID: 1458 Comm: v4l_id Not tainted 5.1.0-rc2+ #30
kernel: [ 590.359636] Hardware name: Dell Inc. OptiPlex 7 90/0HY9JP, BIOS A18 09/24/2013
kernel: [ 590.359641] RIP: 0010:usb_ifnum_to_if+0x6/0x60
kernel: [ 590.359643] Code: 5d 41 5e 41 5f 5d c3 48 83 c4
10 b8 fa ff ff ff 5b 41 5c 41 5d 41 5e 41 5f 5d c3 b8 fa ff ff ff c3 0f 1f 00 6
6 66 66 66 90 55 8b 97 e8 04 00 00 48 89 e5 48 85 d2 74 41 0f b6 4a 04 84 c
9 74
kernel: [ 590.359645] RSP: 0018:ffffad3cc3c1fc00 EFLAGS: 00010246
kernel: [ 590.359646] RAX: 0000000000000000 RBX: ffff8ded b1f3c000 RCX: 1f377e4500000000
kernel: [ 590.359648] RDX: ffff8dedfa3a6b50 RSI: 00000000 00000000 RDI: 0000000000000000
kernel: [ 590.359649] RBP: ffffad3cc3c1fc28 R08: 00000000 8574acc2 R09: ffff8dedfa3a6b50
kernel: [ 590.359650] R10: 0000000000000001 R11: 00000000 00000000 R12: 0000000000000000
kernel: [ 590.359652] R13: ffff8dedb1f3f0f0 R14: ffffffff adcf7ec0 R15: 0000000000000000
kernel: [ 590.359654] FS: 00007f7917198540(0000) GS:ffff 8dee258c0000(0000) knlGS:0000000000000000
kernel: [ 590.359655] CS: 0010 DS: 0000 ES: 0000 CR0: 00 00000080050033
kernel: [ 590.359657] CR2: 00000000000004e8 CR3: 00000001 a388e002 CR4: 00000000000606e0
kernel: [ 590.359658] Call Trace:
kernel: [ 590.359664] ? au0828_analog_stream_enable+0x2c/0x180
kernel: [ 590.359666] au0828_v4l2_open+0xa4/0x110
kernel: [ 590.359670] v4l2_open+0x8b/0x120
kernel: [ 590.359674] chrdev_open+0xa6/0x1c0
kernel: [ 590.359676] ? cdev_put.part.3+0x20/0x20
kernel: [ 590.359678] do_dentry_open+0x1f6/0x360
kernel: [ 590.359681] vfs_open+0x2f/0x40
kernel: [ 590.359684] path_openat+0x299/0xc20
kernel: [ 590.359688] do_filp_open+0x9b/0x110
kernel: [ 590.359695] ? _raw_spin_unlock+0x27/0x40
kernel: [ 590.359697] ? __alloc_fd+0xb2/0x160
kernel: [ 590.359700] do_sys_open+0x1ba/0x260
kernel: [ 590.359702] ? do_sys_open+0x1ba/0x260
kernel: [ 590.359712] __x64_sys_openat+0x20/0x30
kernel: [ 590.359715] do_syscall_64+0x5a/0x120
kernel: [ 590.359718] entry_SYSCALL_64_after_hwframe+0x44/0xa9Signed-off-by: Shuah Khan
Signed-off-by: Hans Verkuil
Signed-off-by: Mauro Carvalho Chehab -
Add a new test for Media Device Allocator API.
Media Device Allocator API to allows multiple drivers share a media device.
This API solves a very common use-case for media devices where one physical
device (an USB stick) provides both audio and video. When such media device
exposes a standard USB Audio class, a proprietary Video class, two or more
independent drivers will share a single physical USB bridge. In such cases,
it is necessary to coordinate access to the shared resource.Using this API, drivers can allocate a media device with the shared struct
device as the key. Once the media device is allocated by a driver, other
drivers can get a reference to it. The media device is released when all
the references are released.This test does a series of unbind/bind tests to make sure media device
is released correctly when it is no longer is use and when the last
driver releases the reference.Signed-off-by: Shuah Khan
Signed-off-by: Hans Verkuil
Signed-off-by: Mauro Carvalho Chehab -
Enable and disable source interfaces aren't consistent in enforcing
how video and audio share the tuner resource.Fix these issues to enforce the following rules and allow
sharing between audio and video applications.- When DVB is streaming, audio/video/vbi/s-video/composite
should find the resource busy. DVB holds the tuner in
exclusive mode.
- When video/VBI is streaming, audio can share the tuner and vice versa.
- v4l2 allows multiple applications to open video device.
- Video applications call enable source multiple times during their
run-time. Resource should stay locked until the last application
releases it.
- A shared resource should stay in shared state and locked when it is
in use by audio and video. More than one video application is allowed
to use the tuner as long as video streaming protocol allows such usage.
Resource is released when the last video/audio application releases it.
- S-Video and Composite hold the resource in exclusive mode.Signed-off-by: Shuah Khan
Signed-off-by: Hans Verkuil
Signed-off-by: Mauro Carvalho Chehab -
Media Device Allocator API to allows multiple drivers share a media device.
This API solves a very common use-case for media devices where one physical
device (an USB stick) provides both audio and video. When such media device
exposes a standard USB Audio class, a proprietary Video class, two or more
independent drivers will share a single physical USB bridge. In such cases,
it is necessary to coordinate access to the shared resource.Using this API, drivers can allocate a media device with the shared struct
device as the key. Once the media device is allocated by a driver, other
drivers can get a reference to it. The media device is released when all
the references are released.Change the ALSA driver to use the Media Controller API to share media
resources with DVB, and V4L2 drivers on a AU0828 media device.The Media Controller specific initialization is done after sound card is
registered. ALSA creates Media interface and entity function graph nodes
for Control, Mixer, PCM Playback, and PCM Capture devices.snd_usb_hw_params() will call Media Controller enable source handler
interface to request the media resource. If resource request is granted,
it will release it from snd_usb_hw_free(). If resource is busy, -EBUSY is
returned.Media specific cleanup is done in usb_audio_disconnect().
Reviewed-by: Takashi Iwai
Signed-off-by: Shuah Khan
Signed-off-by: Hans Verkuil
Signed-off-by: Mauro Carvalho Chehab -
Move PCM_CAPTURE, PCM_PLAYBACK, and CONTROL ALSA MEDIA_INTF_T* interface
types back into __KERNEL__ scope to get ready for adding ALSA support for
these to the media controller.Signed-off-by: Shuah Khan
Signed-off-by: Hans Verkuil
Signed-off-by: Mauro Carvalho Chehab -
Media Device Allocator API to allows multiple drivers share a media device.
This API solves a very common use-case for media devices where one physical
device (an USB stick) provides both audio and video. When such media device
exposes a standard USB Audio class, a proprietary Video class, two or more
independent drivers will share a single physical USB bridge. In such cases,
it is necessary to coordinate access to the shared resource.Using this API, drivers can allocate a media device with the shared struct
device as the key. Once the media device is allocated by a driver, other
drivers can get a reference to it. The media device is released when all
the references are released.Change au0828 to use Media Device Allocator API to allocate media device
with the parent usb struct device as the key, so it can be shared with the
snd_usb_audio driver.Signed-off-by: Shuah Khan
Signed-off-by: Hans Verkuil
Signed-off-by: Mauro Carvalho Chehab -
Media Device Allocator API to allows multiple drivers share a media device.
This API solves a very common use-case for media devices where one physical
device (an USB stick) provides both audio and video. When such media device
exposes a standard USB Audio class, a proprietary Video class, two or more
independent drivers will share a single physical USB bridge. In such cases,
it is necessary to coordinate access to the shared resource.Using this API, drivers can allocate a media device with the shared struct
device as the key. Once the media device is allocated by a driver, other
drivers can get a reference to it. The media device is released when all
the references are released.Signed-off-by: Shuah Khan
Signed-off-by: Hans Verkuil
Signed-off-by: Mauro Carvalho Chehab -
Do not access sd_formats[] if num_of_sd_formats is zero, ie
subdev sensor didn't expose any formats.Signed-off-by: Hugues Fruchet
Signed-off-by: Hans Verkuil
Signed-off-by: Mauro Carvalho Chehab -
Report overrun error only when it exceeds a given threshold.
Signed-off-by: Hugues Fruchet
Signed-off-by: Hans Verkuil
Signed-off-by: Mauro Carvalho Chehab -
Revisit and add some error messages.
Signed-off-by: Hugues Fruchet
Signed-off-by: Hans Verkuil
Signed-off-by: Mauro Carvalho Chehab -
There are several places where a break statement occurs before
a following break statement; these are unnecessary and can be
removed to clean up the code a little.Signed-off-by: Colin Ian King
Reviewed-by: Mukesh Ojha
Signed-off-by: Hans Verkuil
Signed-off-by: Mauro Carvalho Chehab -
Enlarge the plane number to support more complex case
and add the support for fmt change case.Signed-off-by: Yunfei Dong
Signed-off-by: Hans Verkuil
Signed-off-by: Mauro Carvalho Chehab -
The image renderer (IMR), or the distortion correction engine, is a
drawing processor with a simple instruction system capable of referencing
video capture data or data in an external memory as the 2D texture data
and performing texture mapping and drawing with respect to any shape that
is split into triangular objects.Document the device tree bindings for the image renderer light extended 4
(IMR-LX4) found in the R-Car gen3 SoCs...Signed-off-by: Sergei Shtylyov
Acked-by: Rob Herring
Signed-off-by: Hans Verkuil
Signed-off-by: Mauro Carvalho Chehab -
We should get 'driver_data' from 'struct device' directly. Going via
platform_device is an unneeded step back and forth.Signed-off-by: Wolfram Sang
Reviewed-by: Rui Miguel Silva
Reviewed-by: Simon Horman
Signed-off-by: Hans Verkuil
Signed-off-by: Mauro Carvalho Chehab -
Media bus codes were being mapped to pixelformats, which causes a
limitation on vimc because not all pixelformats can be mapped to media
bus codes.
Also, media bus codes are an internal configuration from the device.
Userspace only assures media bus codes matches between pads and expects
the image in a given pixelformat. So we can allow almost any media bus
format to be configured between pads, except for debayer that expects a
media bus code of type bayer in the sink pad.[hverkuil-cisco@xs4all.nl: drop use of v4l2_get_fourcc_name: not yet available]
[hverkuil-cisco@xs4all.nl: made vimc_mbus_list static]Signed-off-by: Helen Koike
Signed-off-by: Hans Verkuil
Signed-off-by: Mauro Carvalho Chehab -
Add bayer format information in struct v4l2_format_info table.
Signed-off-by: Helen Koike
Signed-off-by: Hans Verkuil
Signed-off-by: Mauro Carvalho Chehab -
Add two new API helpers, v4l2_fill_pixfmt and v4l2_fill_pixfmt_mp,
to be used by drivers to calculate plane sizes and bytes per lines.Note that driver-specific padding and alignment are not
taken into account, and must be done by drivers using this API.Signed-off-by: Ezequiel Garcia
Signed-off-by: Hans Verkuil
Signed-off-by: Mauro Carvalho Chehab -
The rockchip VPU driver uses generic names for its pixel format
helpers. We want to use the same names for generic versions
of these helpers, so rename the rockchip ones.The driver will be switched to the generic helpers later.
Signed-off-by: Ezequiel Garcia
Signed-off-by: Hans Verkuil
Signed-off-by: Mauro Carvalho Chehab -
Minor fix for helper function and comment, s/v4l2_vb2_buffer/vb2_v4l2_buffer.
Signed-off-by: Ezequiel Garcia
Signed-off-by: Hans Verkuil
Signed-off-by: Mauro Carvalho Chehab -
Somehow the string "Controls name" got pasted in two places
where it doesn't belong. Remove that text.Signed-off-by: Hans Verkuil
Signed-off-by: Mauro Carvalho Chehab -
It is mandatory to write CEC_CFGR only when CECEN=0. To protect
transmission, a check have been added to delayed logical address
modification. This patch is necessary tp pass all tests of compliance.Signed-off-by: Yannick Fertré
Reviewed-by: Benjamin Gaignard
Signed-off-by: Hans Verkuil
Signed-off-by: Mauro Carvalho Chehab -
ISC will output the "ARGB32" configuration in byte order: B, G, R, Alpha.
This is in fact the format BGRA, aka ABGR32.
If alpha is missing, the same format is equivalent to XBGR32.
Added both formats and removed ARGB32 which is wrong.Signed-off-by: Eugen Hristev
Signed-off-by: Hans Verkuil
Signed-off-by: Mauro Carvalho Chehab
