- 07 Dec, 2022 5 commits
-
-
Michael Riesch authored
Some devices support sampling of the parallel data at both edges of the interface pixel clock in order to reduce the pixel clock by two. Add a mediabus flag that represents this feature. Signed-off-by:
Michael Riesch <michael.riesch@wolfvision.net> Reviewed-by:
Jacopo Mondi <jacopo+renesas@jmondi.org> Signed-off-by:
Hans Verkuil <hverkuil-cisco@xs4all.nl>
-
Michael Riesch authored
Some devices support sampling of the parallel data at both edges of the interface pixel clock in order to reduce the pixel clock by two. Use the pclk-sample property to reflect this feature in the device tree. Signed-off-by:
Rob Herring <robh@kernel.org> Signed-off-by:
-
Christophe JAILLET authored
Use dma_set_mask_and_coherent() instead of unrolling it with some dma_set_mask()+dma_set_coherent_mask(). Moreover, as stated in [1], dma_set_mask() with a 64-bit mask will never fail if dev->dma_mask is non-NULL. So, if it fails, the 32 bits case will also fail for the same reason. Simplify code and remove some dead code accordingly. [1]: https://lkml.org/lkml/2021/6/7/398Signed-off-by:
Christophe JAILLET <christophe.jaillet@wanadoo.fr> Acked-by:
Akihiro Tsukada <tskd08@gmail.com> Signed-off-by:
-
Adam Borowski authored
drivers/media/pci/intel/ipu3/cio2-bridge.c: In function ‘cio2_bridge_unregister_sensors’: drivers/media/pci/intel/ipu3/cio2-bridge.c:258:17: error: implicit declaration of function ‘i2c_unregister_device’; did you mean ‘spi_unregister_device’? [-Werror=implicit-function-declaration] 258 | i2c_unregister_device(sensor->vcm_i2c_client); | ^~~~~~~~~~~~~~~~~~~~~ | spi_unregister_device Link: https://lore.kernel.org/linux-media/S230142AbiJTWql/20221020224641Z+958@vger.kernel.orgSigned-off-by:Adam Borowski <kilobyte@angband.pl> Signed-off-by:
Mauro Carvalho Chehab <mchehab@kernel.org>
-
Hans de Goede authored
Add myself as maintainer for the drivers/staging/media/atomisp code. Link: https://lore.kernel.org/linux-media/20221123161447.15834-1-hdegoede@redhat.comSigned-off-by:
Hans de Goede <hdegoede@redhat.com> Acked-by:
Sakari Ailus <sakari.ailus@linux.intel.com> Signed-off-by:
-
- 26 Nov, 2022 1 commit
-
-
Aakarsh Jain authored
Commit 5441e9da ("[media] s5p-mfc: Core support for MFC v7") which adds mfc v7 support for Exynos3250 and use the same compatible string as used by Exynos5240 but both the IPs are a bit different in terms of IP clock. Add variant driver data based on the new compatible string "samsung,exynos3250-mfc" for Exynos3250 SoC. Suggested-by:
Alim Akhtar <alim.akhtar@samsung.com> Fixes: 5441e9da ("[media] s5p-mfc: Core support for MFC v7") Signed-off-by:
Aakarsh Jain <aakarsh.jain@samsung.com> Reviewed-by:
-
- 25 Nov, 2022 34 commits
-
-
Aakarsh Jain authored
Since MFC v7 support was present for both Exynos5420 and Exynos3250 SoC with same compatible string "samsung,mfc-v7". As both SoCs having different hardware properties and having same compatible string for both SoCs doesn't seems to be correct. Add new compatible for Exynos3250 SoC followed by mfc-v7 fallback which will differentiate the node properties for both SoCs which support MFC v7. Reviewed-by:
Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org> Reviewed-by:
Tommaso Merciai <tommaso.merciai@amarulasolutions.com> Suggested-by:
-
Yunfei Dong authored
Core thread will continue to work when core_list is not empty, not depends on lat_list. Fixes: 365e4ba0 ("media: mtk-vcodec: Add work queue for core hardware decode") Signed-off-by:
Yunfei Dong <yunfei.dong@mediatek.com> Reviewed-by:
AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com> Signed-off-by:
-
Yunfei Dong authored
Need to set lat buf to lat_list when lat decode error, or lat buffer will be lost. Fixes: 5d418351 ("media: mediatek: vcodec: support stateless VP9 decoding") Signed-off-by:
-
Yunfei Dong authored
Will set lat buffer to lat_list two times when lat decode timeout for inner racing mode. If core thread can't get frame buffer, need to return error value. Fixes: 59fba9ee ("media: mediatek: vcodec: support stateless H.264 decoding for mt8192") Signed-off-by:
-
Yunfei Dong authored
Core thread will call v4l2_m2m_buf_done to set dst buffer done for lat architecture. If lat call v4l2_m2m_buf_done_and_job_finish to free dst buffer when lat decode error, core thread will access kernel NULL pointer dereference, then crash. Signed-off-by:
-
Yunfei Dong authored
The driver may can't get v4l2 buffer when lat or core decode timeout, will lead to crash when call v4l2_m2m_buf_done to set dst buffer (NULL pointer) done. Fixes: 7b182b8d ("media: mediatek: vcodec: Refactor get and put capture buffer flow") Signed-off-by:
-
Ming Qian authored
driver needs to cancel vpu before releasing the vpu instance, so call v4l2_m2m_ctx_release() first, to handle the redundant event triggered after m2m_ctx is released. lock and check m2m_ctx in the event handler. Fixes: 3cd08451 ("media: amphion: add vpu v4l2 m2m support") Signed-off-by:
Ming Qian <ming.qian@nxp.com> Signed-off-by:
-
Ming Qian authored
Revert "media: amphion: release m2m ctx when releasing vpu instance" This reverts commit d91d7bc8. Call v4l2_m2m_ctx_release() to cancel vpu, afterwards release the vpu instance. Fixes: d91d7bc8 ("media: amphion: release m2m ctx when releasing vpu instance") Signed-off-by:
-
Ming Qian authored
firmware should be waked up by start or configure command, but there is a very small chance that firmware failed to wakeup. in such case, try to wakeup firmware again by sending a noop command Fixes: 6de8d628 ("media: amphion: add v4l2 m2m vpu decoder stateful driver") Signed-off-by:
-
Irui Wang authored
There are venc node warnings when running dtbs_check, the clock-names was unexpected, missing properties '#address-cells' and '#size-cells'. Add the corresponding platform compatible to schema. Signed-off-by:
Irui Wang <irui.wang@mediatek.com> Acked-by:
-
Peter Robinson authored
The VIDEO_ASPEED is part of the Aspeed silicon so it makes sense to depend on ARCH_ASPEED and for compile testing. Signed-off-by:
Peter Robinson <pbrobinson@gmail.com> Signed-off-by:
-
Deming Wang authored
remove the double word 'in'. Signed-off-by:
Deming Wang <wangdeming@inspur.com> Signed-off-by:
-
Paul Kocialkowski authored
This allows the device to probe and register its async subdev without a sensor attached. The rationale is that the parent driver might otherwise wait for the subdev to be registered when it should be available (from the fwnode graph endpoint perspective). This is generally not problematic when the MIPI CSI-2 bridge is the only device attached to the parent, but in the case of a CSI controller that can feed from both MIPI CSI-2 and parallel, it would prevent using the parallel sensor due to the parent waiting for the MIPI CSI-2 subdev to register. Fixes: 576d196c ("media: sunxi: Add support for the A83T MIPI CSI-2 controller") Signed-off-by:
Paul Kocialkowski <paul.kocialkowski@bootlin.com> Signed-off-by:
-
Paul Kocialkowski authored
This allows the device to probe and register its async subdev without a sensor attached. The rationale is that the parent driver might otherwise wait for the subdev to be registered when it should be available (from the fwnode graph endpoint perspective). This is generally not problematic when the MIPI CSI-2 bridge is the only device attached to the parent, but in the case of a CSI controller that can feed from both MIPI CSI-2 and parallel, it would prevent using the parallel sensor due to the parent waiting for the MIPI CSI-2 subdev to register. Fixes: af54b4f4 ("media: sunxi: Add support for the A31 MIPI CSI-2 controller") Signed-off-by:
-
Paul Kocialkowski authored
The bridge needs both its pads connected to be able to stream data. Enforcing this is useful to produce an error when no sensor is connected. Fixes: 576d196c ("media: sunxi: Add support for the A83T MIPI CSI-2 controller") Signed-off-by:
-
Paul Kocialkowski authored
The bridge needs both its pads connected to be able to stream data. Enforcing this is useful to produce an error when no sensor is connected. Fixes: af54b4f4 ("media: sunxi: Add support for the A31 MIPI CSI-2 controller") Signed-off-by:
-
Ming Qian authored
encoder add support for contiguous formats NV12 Signed-off-by:
-
Ming Qian authored
decoder add support for contiguous formats V4L2_PIX_FMT_NV12_8L128 and V4L2_PIX_FMT_NV12_10BE_8L128 Signed-off-by:
-
Ming Qian authored
Driver should tell the number of memory planes and component planes. the amphion vpu support non contiguous planes, but for compatibility with other device that only support contiguous planes. driver can add support for contiguous planes in the same time. Then the mem_planes can be different from the comp_planes. driver need to handle buffer according mem_planes and comp_planes. So driver can support NV12 and NV12M. Signed-off-by:
-
Ming Qian authored
add contiguous nv12 tiled format nv12_8l128 and nv12_10be_8l128 Signed-off-by:
Nicolas Dufresne <nicolas.dufresne@collabora.com> Signed-off-by:
-
Xiu Jianfeng authored
The CLEAR_AFTER_FIELD defined here is functionally the same as memset_after() helper, so replace it with memset_after() to simplify the code, no functional change in this patch. Signed-off-by:
Xiu Jianfeng <xiujianfeng@huawei.com> Reviewed-by:
Laurent Pinchart <laurent.pinchart@ideasonboard.com> Acked-by:
-
Niklas Söderlund authored
Add support for the UDS (Up Down Scaler) found in some Gen3 SoCs. Not all Gen3 SoCs have scalers, and for those that do it's only available to the master node of each VIN group. The setup for which SoCs and nodes have access to a scaler are dealt with at probe time and then function transparently reusing the schema from the already present Gen2 scaler. Signed-off-by:
Niklas Söderlund <niklas.soderlund+renesas@ragnatech.se> Signed-off-by:
-
Niklas Söderlund authored
The scaler implementation is different between the VIN generations, and not all SoCs have a scaler. Currently only Gen2 scalers are supported. Prepare to add support for more scalers by storing the setup in a function pointer initialized at probe time. While at it move call site to after, instead of before, the generic capture setup, this have no effect on the Gen2 scaler but will be leveraged by the Gen3 scaler. Signed-off-by:
-
Niklas Söderlund authored
Prepare for scaling support in the media controller part of the driver by not caching the remote rectangle. Mimic the omap3isp and look it up each time it's needed. Signed-off-by:
-
Baisong Zhong authored
Wei Chen reports a kernel bug as blew: general protection fault, probably for non-canonical address KASAN: null-ptr-deref in range [0x0000000000000010-0x0000000000000017] ... Call Trace: <TASK> __i2c_transfer+0x77e/0x1930 drivers/i2c/i2c-core-base.c:2109 i2c_transfer+0x1d5/0x3d0 drivers/i2c/i2c-core-base.c:2170 i2cdev_ioctl_rdwr+0x393/0x660 drivers/i2c/i2c-dev.c:297 i2cdev_ioctl+0x75d/0x9f0 drivers/i2c/i2c-dev.c:458 vfs_ioctl fs/ioctl.c:51 [inline] __do_sys_ioctl fs/ioctl.c:870 [inline] __se_sys_ioctl+0xfb/0x170 fs/ioctl.c:856 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x3d/0x90 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x63/0xcd RIP: 0033:0x7fd834a8bded In az6027_i2c_xfer(), if msg[i].addr is 0x99, a null-ptr-deref will caused when accessing msg[i].buf. For msg[i].len is 0 and msg[i].buf is null. Fix this by checking msg[i].len in az6027_i2c_xfer(). Link: https://lore.kernel.org/lkml/CAO4mrfcPHB5aQJO=mpqV+p8mPLNg-Fok0gw8gZ=zemAfMGTzMg@mail.gmail.com/ Link: https://lore.kernel.org/linux-media/20221120065918.2160782-1-zhongbaisong@huawei.com Fixes: 76f9a820 ("V4L/DVB: AZ6027: Initial import of the driver") Reported-by:
Wei Chen <harperchen1110@gmail.com> Signed-off-by:
Baisong Zhong <zhongbaisong@huawei.com> Signed-off-by:
-
Chen Zhongjin authored
In dvb_register_frontend(), dvb_register_device() is possible to fail but its return value is ignored. It will cause use-after-free when module is removed, because in dvb_unregister_frontend() it tries to unregister a not registered device. BUG: KASAN: use-after-free in dvb_remove_device+0x18b/0x1f0 [dvb_core] Read of size 4 at addr ffff88800dff4824 by task rmmod/428 CPU: 3 PID: 428 Comm: rmmod Call Trace: <TASK> ... dvb_remove_device+0x18b/0x1f0 [dvb_core] dvb_unregister_frontend+0x7b/0x130 [dvb_core] vidtv_bridge_remove+0x6e/0x160 [dvb_vidtv_bridge] ... Fix this by catching return value of dvb_register_device(). However the fe->refcount can't be put to zero immediately, because there are still modules calling dvb_frontend_detach() when dvb_register_frontend() fails. Link: https://lore.kernel.org/linux-media/20221108033005.169095-1-chenzhongjin@huawei.com Fixes: 1da177e4 ("Linux-2.6.12-rc2") Signed-off-by:
Chen Zhongjin <chenzhongjin@huawei.com> Signed-off-by:
-
Yuan Can authored
After commit 5e9c85d9("[media] dib8096: enhancement"), no one use struct dibx090p_adc, so remove it. Link: https://lore.kernel.org/linux-media/20220927133827.99097-1-yuancan@huawei.comSigned-off-by:
Yuan Can <yuancan@huawei.com> Signed-off-by:
-
Gaosheng Cui authored
The dvb_usb_dib0700_ir_proto has been removed by commit 0ffd1ab3 ("V4L/DVB: dib0700: properly implement IR change_protocol"), so remove the orphan declaration. Link: https://lore.kernel.org/linux-media/20220920015902.785337-1-cuigaosheng1@huawei.comSigned-off-by:
Gaosheng Cui <cuigaosheng1@huawei.com> Signed-off-by:
-
Mazin Al Haddad authored
Syzbot reports a memory leak in "dvb_usb_adapter_init()". The leak is due to not accounting for and freeing current iteration's adapter->priv in case of an error. Currently if an error occurs, it will exit before incrementing "num_adapters_initalized", which is used as a reference counter to free all adap->priv in "dvb_usb_adapter_exit()". There are multiple error paths that can exit from before incrementing the counter. Including the error handling paths for "dvb_usb_adapter_stream_init()", "dvb_usb_adapter_dvb_init()" and "dvb_usb_adapter_frontend_init()" within "dvb_usb_adapter_init()". This means that in case of an error in any of these functions the current iteration is not accounted for and the current iteration's adap->priv is not freed. Fix this by freeing the current iteration's adap->priv in the "stream_init_err:" label in the error path. The rest of the (accounted for) adap->priv objects are freed in dvb_usb_adapter_exit() as expected using the num_adapters_initalized variable. Syzbot report: BUG: memory leak unreferenced object 0xffff8881172f1a00 (size 512): comm "kworker/0:2", pid 139, jiffies 4294994873 (age 10.960s) hex dump (first 32 bytes): 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ backtrace: [<ffffffff844af012>] dvb_usb_adapter_init drivers/media/usb/dvb-usb/dvb-usb-init.c:75 [inline] [<ffffffff844af012>] dvb_usb_init drivers/media/usb/dvb-usb/dvb-usb-init.c:184 [inline] [<ffffffff844af012>] dvb_usb_device_init.cold+0x4e5/0x79e drivers/media/usb/dvb-usb/dvb-usb-init.c:308 [<ffffffff830db21d>] dib0700_probe+0x8d/0x1b0 drivers/media/usb/dvb-usb/dib0700_core.c:883 [<ffffffff82d3fdc7>] usb_probe_interface+0x177/0x370 drivers/usb/core/driver.c:396 [<ffffffff8274ab37>] call_driver_probe drivers/base/dd.c:542 [inline] [<ffffffff8274ab37>] really_probe.part.0+0xe7/0x310 drivers/base/dd.c:621 [<ffffffff8274ae6c>] really_probe drivers/base/dd.c:583 [inline] [<ffffffff8274ae6c>] __driver_probe_device+0x10c/0x1e0 drivers/base/dd.c:752 [<ffffffff8274af6a>] driver_probe_device+0x2a/0x120 drivers/base/dd.c:782 [<ffffffff8274b786>] __device_attach_driver+0xf6/0x140 drivers/base/dd.c:899 [<ffffffff82747c87>] bus_for_each_drv+0xb7/0x100 drivers/base/bus.c:427 [<ffffffff8274b352>] __device_attach+0x122/0x260 drivers/base/dd.c:970 [<ffffffff827498f6>] bus_probe_device+0xc6/0xe0 drivers/base/bus.c:487 [<ffffffff82745cdb>] device_add+0x5fb/0xdf0 drivers/base/core.c:3405 [<ffffffff82d3d202>] usb_set_configuration+0x8f2/0xb80 drivers/usb/core/message.c:2170 [<ffffffff82d4dbfc>] usb_generic_driver_probe+0x8c/0xc0 drivers/usb/core/generic.c:238 [<ffffffff82d3f49c>] usb_probe_device+0x5c/0x140 drivers/usb/core/driver.c:293 [<ffffffff8274ab37>] call_driver_probe drivers/base/dd.c:542 [inline] [<ffffffff8274ab37>] really_probe.part.0+0xe7/0x310 drivers/base/dd.c:621 [<ffffffff8274ae6c>] really_probe drivers/base/dd.c:583 [inline] [<ffffffff8274ae6c>] __driver_probe_device+0x10c/0x1e0 drivers/base/dd.c:752 Link: https://syzkaller.appspot.com/bug?extid=f66dd31987e6740657be Reported-and-tested-by: syzbot+f66dd31987e6740657be@syzkaller.appspotmail.com Link: https://lore.kernel.org/linux-media/20220824012152.539788-1-mazinalhaddad05@gmail.comSigned-off-by:Mazin Al Haddad <mazinalhaddad05@gmail.com> Signed-off-by:
-
Lin Ma authored
dvb_unregister_device() is known that prone to use-after-free. That is, the cleanup from dvb_unregister_device() releases the dvb_device even if there are pointers stored in file->private_data still refer to it. This patch adds a reference counter into struct dvb_device and delays its deallocation until no pointer refers to the object. Link: https://lore.kernel.org/linux-media/20220807145952.10368-1-linma@zju.edu.cnSigned-off-by:
Lin Ma <linma@zju.edu.cn> Reported-by:
kernel test robot <lkp@intel.com> Signed-off-by:
-
wangjianli authored
Delete the redundant word 'in'. Link: https://lore.kernel.org/linux-media/20220724073242.15279-1-wangjianli@cdjrlc.comSigned-off-by:
wangjianli <wangjianli@cdjrlc.com> Signed-off-by:
-
YongSu Yoo authored
The function dvb_ringbuffer_pkt_next in /linux-next/drviers/media/dvb-core/dvb_ringbuffer.c, which searches the idx of the next valid packet in the ring buffer of the ca->slot_info[slot].rx_buffer at /linux-next/drivers/media/dvb-core/dvb_ca_en50221.c, has the following problem. In calculating the amounts of the consumed address of the ring buffer, if the read address(rbuf->pread) of the ring buffer is smaller than the idx, the amounts of the searched address should be (idx - rbuf->pread), whereas if the read address(rbuf->pread) of the ring buffer is larger than the idx, the amounts of the consumed address should be (idx - rbuf->pread + rbug->size). But there exists an incorrect logic that the rbug-size was not properly added on (idx - rbug->pread) in the later case. With this commit, we fixed this bug. Link: https://lore.kernel.org/linux-media/20220623103543.4138-1-yongsuyoo0215@gmail.comSigned-off-by:
Yongsu Yoo <yongsuyoo0215@gmail.com> Signed-off-by:
-
Lecopzer Chen authored
MANTIS_CORE needs DVB_CORE, set 'depends on' explicitly ERROR: modpost: "dvb_dmx_init" [drivers/media/pci/mantis/mantis_core.ko] undefined! ERROR: modpost: "dvb_unregister_adapter" [drivers/media/pci/mantis/mantis_core.ko] undefined! ERROR: modpost: "dvb_register_frontend" [drivers/media/pci/mantis/mantis_core.ko] undefined! ERROR: modpost: "dvb_ca_en50221_camchange_irq" [drivers/media/pci/mantis/mantis_core.ko] undefined! ERROR: modpost: "dvb_unregister_frontend" [drivers/media/pci/mantis/mantis_core.ko] undefined! >> ERROR: modpost: "dvb_ca_en50221_camready_irq" [drivers/media/pci/mantis/mantis_core.ko] undefined! >> ERROR: modpost: "dvb_frontend_detach" [drivers/media/pci/mantis/mantis_core.ko] undefined! >> ERROR: modpost: "dvb_dmxdev_release" [drivers/media/pci/mantis/mantis_core.ko] undefined! >> ERROR: modpost: "dvb_dmx_swfilter" [drivers/media/pci/mantis/mantis_core.ko] undefined! Link: https://lore.kernel.org/linux-media/20220516171515.16404-2-lecopzer.chen@mediatek.comReported-by:
Lecopzer Chen <lecopzer.chen@mediatek.com> Signed-off-by:
-
Keita Suzuki authored
In function dvb_register_device() -> dvb_register_media_device() -> dvb_create_media_entity(), dvb->entity is allocated and initialized. If the initialization fails, it frees the dvb->entity, and return an error code. The caller takes the error code and handles the error by calling dvb_media_device_free(), which unregisters the entity and frees the field again if it is not NULL. As dvb->entity may not NULLed in dvb_create_media_entity() when the allocation of dvbdev->pad fails, a double free may occur. This may also cause an Use After free in media_device_unregister_entity(). Fix this by storing NULL to dvb->entity when it is freed. Link: https://lore.kernel.org/linux-media/20220426052921.2088416-1-keitasuzuki.park@sslab.ics.keio.ac.jp Fixes: fcd5ce4b ("media: dvb-core: fix a memory leak bug") Cc: stable@vger.kernel.org Cc: Wenwen Wang <wenwen@cs.uga.edu> Signed-off-by:
Keita Suzuki <keitasuzuki.park@sslab.ics.keio.ac.jp> Signed-off-by:
-
