1. 26 Jun, 2024 1 commit
  2. 24 Jun, 2024 13 commits
  3. 21 Jun, 2024 10 commits
    • Ivan Bornyakov's avatar
      media: chips-media: wave5: support Wave515 decoder · 6aa08291
      Ivan Bornyakov authored
      Add initial support for the Wave515 multi-decoder IP. For now it is only
      able to decode HEVC Main/Main10 profile videos into YUV420.
      
      This was tested on FPGA prototype, so wave5_dt_ids[] was not expanded.
      Users of the real hardware with Wave515 IP will have to
       * provide firmware specific to their SoC
       * add struct wave5_match_data like this:
      
      	static const struct wave5_match_data platform_name_wave515_data = {
      		.flags = WAVE5_IS_DEC,
      		.fw_name = "cnm/wave515_platform_name_fw.bin",
      		.sram_size = (71 * 1024),
      	};
      
       * add item to wave5_dt_ids[] like this:
      
      	{
      		.compatible = "vendor,soc-wave515",
      		.data = &platform_name_wave515_data,
      	},
      
       * describe new compatible in
         Documentation/devicetree/bindings/media/cnm,wave521c.yaml
      Signed-off-by: default avatarIvan Bornyakov <brnkv.i1@gmail.com>
      Signed-off-by: default avatarSebastian Fricke <sebastian.fricke@collabora.com>
      Signed-off-by: default avatarHans Verkuil <hverkuil-cisco@xs4all.nl>
      6aa08291
    • Ivan Bornyakov's avatar
      media: chips-media: wave5: drop "sram-size" DT property · a83d4a68
      Ivan Bornyakov authored
      Move the excessive "sram-size" device-tree property to the device match
      data. Also change the SRAM memory allocation strategy, instead of
      allocating exactly sram_size bytes, allocate all available SRAM memory
      up to sram_size. Add the placeholders wave5_vpu_dec_validate_sec_axi()
      and wave5_vpu_enc_validate_sec_axi() to validate that the allocated SRAM
      memory is sufficient to decode/encode bitstream with a given resolution.
      Signed-off-by: default avatarIvan Bornyakov <brnkv.i1@gmail.com>
      Signed-off-by: default avatarSebastian Fricke <sebastian.fricke@collabora.com>
      Signed-off-by: default avatarHans Verkuil <hverkuil-cisco@xs4all.nl>
      a83d4a68
    • Ivan Bornyakov's avatar
      media: chips-media: wave5: separate irq setup routine · 749476d4
      Ivan Bornyakov authored
      Implement a separate setup routine for interrupts to reduce code
      duplication. Also enable interrupts based on vpu_attr->support_encoders
      and vpu_attr->support_decoders fields to facilitate support for other
      Wave5xx IPs, because not all of them are both encoders and decoders.
      Signed-off-by: default avatarIvan Bornyakov <brnkv.i1@gmail.com>
      Signed-off-by: default avatarSebastian Fricke <sebastian.fricke@collabora.com>
      Signed-off-by: default avatarHans Verkuil <hverkuil-cisco@xs4all.nl>
      749476d4
    • Ivan Bornyakov's avatar
      media: chips-media: wave5: support reset lines · 2b918842
      Ivan Bornyakov authored
      Add initial support for optional reset lines. For now, simply deassert
      resets while probing the driver and assert them back when removing the
      driver.
      Signed-off-by: default avatarIvan Bornyakov <brnkv.i1@gmail.com>
      Signed-off-by: default avatarSebastian Fricke <sebastian.fricke@collabora.com>
      Signed-off-by: default avatarHans Verkuil <hverkuil-cisco@xs4all.nl>
      2b918842
    • Ivan Bornyakov's avatar
      media: chips-media: wave5: support decoding HEVC Main10 profile · 143e7ab4
      Ivan Bornyakov authored
      Add support for decoding HEVC Main10 profile by scaling the FBC
      buffer stride and size by a factor of (bitdepth / 8).
      Signed-off-by: default avatarIvan Bornyakov <brnkv.i1@gmail.com>
      Signed-off-by: default avatarSebastian Fricke <sebastian.fricke@collabora.com>
      Signed-off-by: default avatarHans Verkuil <hverkuil-cisco@xs4all.nl>
      143e7ab4
    • Ming Qian's avatar
      media: imx-jpeg: Drop initial source change event if capture has been setup · a8fb5fce
      Ming Qian authored
      In section 4.5.1.5. Initialization, the step 4 may be skipped and
      continue with the Capture Setup sequence, so if the capture has been
      setup, there is no need to trigger the initial source change event, just
      start decoding, and follow the dynamic resolution change flow if the
      configured values do not match those parsed by the decoder.
      
      And it won't fail the gstreamer pipeline.
      
      Fixes: b833b178 ("media: imx-jpeg: notify source chagne event when the first picture parsed")
      Signed-off-by: default avatarMing Qian <ming.qian@nxp.com>
      Signed-off-by: default avatarHans Verkuil <hverkuil-cisco@xs4all.nl>
      a8fb5fce
    • Ming Qian's avatar
      media: imx-jpeg: Remove some redundant error logs · f10edd83
      Ming Qian authored
      If the picture size parsed by decoder is different from those previously
      established, it's a normal flow of dynamic resolution change, not an
      error case, the log may mislead that some error occurs in decoding, so
      remove the error log in this case.
      
      Fixes: 2db16c6e ("media: imx-jpeg: Add V4L2 driver for i.MX8 JPEG Encoder/Decoder")
      Signed-off-by: default avatarMing Qian <ming.qian@nxp.com>
      Signed-off-by: default avatarHans Verkuil <hverkuil-cisco@xs4all.nl>
      f10edd83
    • Allen Pais's avatar
      media: Convert from tasklet to BH workqueue · 1021dd01
      Allen Pais authored
      The only generic interface to execute asynchronously in the BH context is
      tasklet; however, it's marked deprecated and has some design flaws. To
      replace tasklets, BH workqueue support was recently added. A BH workqueue
      behaves similarly to regular workqueues except that the queued work items
      are executed in the BH context.
      
      This patch converts drivers/media/* from tasklet to BH workqueue.
      
      Based on the work done by Tejun Heo <tj@kernel.org>
      Signed-off-by: default avatarAllen Pais <allen.lkml@gmail.com>
      Signed-off-by: default avatarHans Verkuil <hverkuil-cisco@xs4all.nl>
      1021dd01
    • Christophe JAILLET's avatar
      media: cx231xx: Constify struct vb2_ops · d2ae63c2
      Christophe JAILLET authored
      "struct vb2_ops" are not modified in this driver.
      
      Constifying this structure moves some data to a read-only section, so
      increase overall security.
      
      On a x86_64, with allmodconfig:
      Before:
      ======
         text	   data	    bss	    dec	    hex	filename
        36607	   1156	      0	  37763	   9383	drivers/media/usb/cx231xx/cx231xx-417.o
      
      After:
      =====
         text	   data	    bss	    dec	    hex	filename
        36735	   1016	      0	  37751	   9377	drivers/media/usb/cx231xx/cx231xx-417.o
      Signed-off-by: default avatarChristophe JAILLET <christophe.jaillet@wanadoo.fr>
      Signed-off-by: default avatarHans Verkuil <hverkuil-cisco@xs4all.nl>
      d2ae63c2
    • Chi Zhiling's avatar
      media: xc2028: avoid use-after-free in load_firmware_cb() · 68594cec
      Chi Zhiling authored
      syzkaller reported use-after-free in load_firmware_cb() [1].
      The reason is because the module allocated a struct tuner in tuner_probe(),
      and then the module initialization failed, the struct tuner was released.
      A worker which created during module initialization accesses this struct
      tuner later, it caused use-after-free.
      
      The process is as follows:
      
      task-6504           worker_thread
      tuner_probe                             <= alloc dvb_frontend [2]
      ...
      request_firmware_nowait                 <= create a worker
      ...
      tuner_remove                            <= free dvb_frontend
      ...
                          request_firmware_work_func  <= the firmware is ready
                          load_firmware_cb    <= but now the dvb_frontend has been freed
      
      To fix the issue, check the dvd_frontend in load_firmware_cb(), if it is
      null, report a warning and just return.
      
      [1]:
          ==================================================================
           BUG: KASAN: use-after-free in load_firmware_cb+0x1310/0x17a0
           Read of size 8 at addr ffff8000d7ca2308 by task kworker/2:3/6504
      
           Call trace:
            load_firmware_cb+0x1310/0x17a0
            request_firmware_work_func+0x128/0x220
            process_one_work+0x770/0x1824
            worker_thread+0x488/0xea0
            kthread+0x300/0x430
            ret_from_fork+0x10/0x20
      
           Allocated by task 6504:
            kzalloc
            tuner_probe+0xb0/0x1430
            i2c_device_probe+0x92c/0xaf0
            really_probe+0x678/0xcd0
            driver_probe_device+0x280/0x370
            __device_attach_driver+0x220/0x330
            bus_for_each_drv+0x134/0x1c0
            __device_attach+0x1f4/0x410
            device_initial_probe+0x20/0x30
            bus_probe_device+0x184/0x200
            device_add+0x924/0x12c0
            device_register+0x24/0x30
            i2c_new_device+0x4e0/0xc44
            v4l2_i2c_new_subdev_board+0xbc/0x290
            v4l2_i2c_new_subdev+0xc8/0x104
            em28xx_v4l2_init+0x1dd0/0x3770
      
           Freed by task 6504:
            kfree+0x238/0x4e4
            tuner_remove+0x144/0x1c0
            i2c_device_remove+0xc8/0x290
            __device_release_driver+0x314/0x5fc
            device_release_driver+0x30/0x44
            bus_remove_device+0x244/0x490
            device_del+0x350/0x900
            device_unregister+0x28/0xd0
            i2c_unregister_device+0x174/0x1d0
            v4l2_device_unregister+0x224/0x380
            em28xx_v4l2_init+0x1d90/0x3770
      
           The buggy address belongs to the object at ffff8000d7ca2000
            which belongs to the cache kmalloc-2k of size 2048
           The buggy address is located 776 bytes inside of
            2048-byte region [ffff8000d7ca2000, ffff8000d7ca2800)
           The buggy address belongs to the page:
           page:ffff7fe00035f280 count:1 mapcount:0 mapping:ffff8000c001f000 index:0x0
           flags: 0x7ff800000000100(slab)
           raw: 07ff800000000100 ffff7fe00049d880 0000000300000003 ffff8000c001f000
           raw: 0000000000000000 0000000080100010 00000001ffffffff 0000000000000000
           page dumped because: kasan: bad access detected
      
           Memory state around the buggy address:
            ffff8000d7ca2200: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
            ffff8000d7ca2280: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
           >ffff8000d7ca2300: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
                                 ^
            ffff8000d7ca2380: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
            ffff8000d7ca2400: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
           ==================================================================
      
      [2]
          Actually, it is allocated for struct tuner, and dvb_frontend is inside.
      Signed-off-by: default avatarChi Zhiling <chizhiling@kylinos.cn>
      Signed-off-by: default avatarHans Verkuil <hverkuil-cisco@xs4all.nl>
      68594cec
  4. 20 Jun, 2024 4 commits
  5. 17 Jun, 2024 8 commits
  6. 16 Jun, 2024 4 commits
    • Daniel Schaefer's avatar
      media: uvcvideo: Override default flags · 86419686
      Daniel Schaefer authored
      When the UVC device has a control that is readonly it doesn't set the
      SET_CUR flag. For example the privacy control has SET_CUR flag set in
      the defaults in the `uvc_ctrls` variable. Even if the device does not
      have it set, it's not cleared by uvc_ctrl_get_flags().
      
      Originally written with assignment in commit 859086ae ("media:
      uvcvideo: Apply flags from device to actual properties"). But changed to
      |= in commit 0dc68cab ("media: uvcvideo: Prevent setting unavailable
      flags"). It would not clear the default flags.
      
      With this patch applied the correct flags are reported to user space.
      Tested with:
      
      ```
      > v4l2-ctl --list-ctrls | grep privacy
      privacy 0x009a0910 (bool)   : default=0 value=0 flags=read-only
      ```
      Signed-off-by: default avatarDaniel Schaefer <dhs@frame.work>
      Fixes: 0dc68cab ("media: uvcvideo: Prevent setting unavailable flags")
      Reviewed-by: default avatarRicardo Ribalda <ribalda@chromium.org>
      Reviewed-by: default avatarLaurent Pinchart <laurent.pinchart@ideasonboard.com>
      Link: https://lore.kernel.org/r/20240602065053.36850-1-dhs@frame.workSigned-off-by: default avatarLaurent Pinchart <laurent.pinchart@ideasonboard.com>
      86419686
    • Ricardo Ribalda's avatar
      media: uvcvideo: Enforce alignment of frame and interval · c8931ef5
      Ricardo Ribalda authored
      Struct uvc_frame and interval (u32*) are packaged together on
      streaming->formats on a single contiguous allocation.
      
      Right now they are allocated right after uvc_format, without taking into
      consideration their required alignment.
      
      This is working fine because both structures have a field with a
      pointer, but it will stop working when the sizeof() of any of those
      structs is not a multiple of the sizeof(void*).
      
      Enforce that alignment during the allocation.
      Signed-off-by: default avatarRicardo Ribalda <ribalda@chromium.org>
      Reviewed-by: default avatarLaurent Pinchart <laurent.pinchart@ideasonboard.com>
      Link: https://lore.kernel.org/r/20240404-uvc-align-v2-1-9e104b0ecfbd@chromium.orgSigned-off-by: default avatarLaurent Pinchart <laurent.pinchart@ideasonboard.com>
      c8931ef5
    • Oleksandr Natalenko's avatar
      media: uvcvideo: Add quirk for invalid dev_sof in Logitech C920 · 85fbe91a
      Oleksandr Natalenko authored
      Similarly to Logitech C922, C920 seems to also suffer from a firmware
      bug that breaks hardware timestamping.
      
      Add a quirk for this camera model too.
      
      Before applying the quirk:
      
      ```
      100 (4) [-] none 100 200717 B 212.919114 213.079004 33.727 fps ts mono/SoE
      101 (5) [-] none 101 200889 B 213.003703 213.114996 11.822 fps ts mono/SoE
      102 (6) [-] none 102 200926 B 213.035571 213.146999 31.379 fps ts mono/SoE
      103 (7) [-] none 103 200839 B 213.067424 213.179003 31.394 fps ts mono/SoE
      104 (0) [-] none 104 200692 B 213.293180 213.214991 4.430 fps ts mono/SoE
      105 (1) [-] none 105 200937 B 213.322374 213.247001 34.254 fps ts mono/SoE
      106 (2) [-] none 106 201013 B 213.352228 213.279005 33.496 fps ts mono/SoE
      …
      ```
      
      After applying the quirk:
      
      ```
      154 (2) [-] none 154 192417 B 42.199823 42.207788 27.779 fps ts mono/SoE
      155 (3) [-] none 155 192040 B 42.231834 42.239791 31.239 fps ts mono/SoE
      156 (4) [-] none 156 192213 B 42.263823 42.271822 31.261 fps ts mono/SoE
      157 (5) [-] none 157 191981 B 42.299824 42.303827 27.777 fps ts mono/SoE
      158 (6) [-] none 158 191953 B 42.331835 42.339811 31.239 fps ts mono/SoE
      159 (7) [-] none 159 191904 B 42.363824 42.371813 31.261 fps ts mono/SoE
      160 (0) [-] none 160 192210 B 42.399834 42.407801 27.770 fps ts mono/SoE
      ```
      
      Fixes: 5d0fd3c8 ("[media] uvcvideo: Disable hardware timestamps by default")
      Signed-off-by: default avatarOleksandr Natalenko <oleksandr@natalenko.name>
      Reviewed-by: default avatarRicardo Ribalda <ribalda@chromium.org>
      Reviewed-by: default avatarLaurent Pinchart <laurent.pinchart@ideasonboard.com>
      Link: https://lore.kernel.org/r/20240325142611.15550-1-oleksandr@natalenko.nameSigned-off-by: default avatarLaurent Pinchart <laurent.pinchart@ideasonboard.com>
      85fbe91a
    • Ricardo Ribalda's avatar
      media: uvcvideo: Fix integer overflow calculating timestamp · 8676a5e7
      Ricardo Ribalda authored
      The function uvc_video_clock_update() supports a single SOF overflow. Or
      in other words, the maximum difference between the first ant the last
      timestamp can be 4096 ticks or 4.096 seconds.
      
      This results in a maximum value for y2 of: 0x12FBECA00, that overflows
      32bits.
      y2 = (u32)ktime_to_ns(ktime_sub(last->host_time, first->host_time)) + y1;
      
      Extend the size of y2 to u64 to support all its values.
      
      Without this patch:
       # yavta -s 1920x1080 -f YUYV -t 1/5 -c /dev/video0
      Device /dev/v4l/by-id/usb-Shine-Optics_Integrated_Camera_0001-video-index0 opened.
      Device `Integrated Camera: Integrated C' on `usb-0000:00:14.0-6' (driver 'uvcvideo') supports video, capture, without mplanes.
      Video format set: YUYV (56595559) 1920x1080 (stride 3840) field none buffer size 4147200d
      Video format: YUYV (56595559) 1920x1080 (stride 3840) field none buffer size 4147200d
      Current frame rate: 1/5
      Setting frame rate to: 1/5
      Frame rate set: 1/5
      8 buffers requested.
      length: 4147200d offset: 0 timestamp type/source: mono/SoE
      Buffer 0/0 mapped at address 0x7947ea94c000.
      length: 4147200d offset: 4149248 timestamp type/source: mono/SoE
      Buffer 1/0 mapped at address 0x7947ea557000.
      length: 4147200d offset: 8298496 timestamp type/source: mono/SoE
      Buffer 2/0 mapped at address 0x7947ea162000.
      length: 4147200d offset: 12447744 timestamp type/source: mono/SoE
      Buffer 3/0 mapped at address 0x7947e9d6d000.
      length: 4147200d offset: 16596992 timestamp type/source: mono/SoE
      Buffer 4/0 mapped at address 0x7947e9978000.
      length: 4147200d offset: 20746240 timestamp type/source: mono/SoE
      Buffer 5/0 mapped at address 0x7947e9583000.
      length: 4147200d offset: 24895488 timestamp type/source: mono/SoE
      Buffer 6/0 mapped at address 0x7947e918e000.
      length: 4147200d offset: 29044736 timestamp type/source: mono/SoE
      Buffer 7/0 mapped at address 0x7947e8d99000.
      0 (0) [-] none 0 4147200d B 507.554210 508.874282 242.836 fps ts mono/SoE
      1 (1) [-] none 2 4147200d B 508.886298 509.074289 0.751 fps ts mono/SoE
      2 (2) [-] none 3 4147200d B 509.076362 509.274307 5.261 fps ts mono/SoE
      3 (3) [-] none 4 4147200d B 509.276371 509.474336 5.000 fps ts mono/SoE
      4 (4) [-] none 5 4147200d B 509.476394 509.674394 4.999 fps ts mono/SoE
      5 (5) [-] none 6 4147200d B 509.676506 509.874345 4.997 fps ts mono/SoE
      6 (6) [-] none 7 4147200d B 509.876430 510.074370 5.002 fps ts mono/SoE
      7 (7) [-] none 8 4147200d B 510.076434 510.274365 5.000 fps ts mono/SoE
      8 (0) [-] none 9 4147200d B 510.276421 510.474333 5.000 fps ts mono/SoE
      9 (1) [-] none 10 4147200d B 510.476391 510.674429 5.001 fps ts mono/SoE
      10 (2) [-] none 11 4147200d B 510.676434 510.874283 4.999 fps ts mono/SoE
      11 (3) [-] none 12 4147200d B 510.886264 511.074349 4.766 fps ts mono/SoE
      12 (4) [-] none 13 4147200d B 511.070577 511.274304 5.426 fps ts mono/SoE
      13 (5) [-] none 14 4147200d B 511.286249 511.474301 4.637 fps ts mono/SoE
      14 (6) [-] none 15 4147200d B 511.470542 511.674251 5.426 fps ts mono/SoE
      15 (7) [-] none 16 4147200d B 511.672651 511.874337 4.948 fps ts mono/SoE
      16 (0) [-] none 17 4147200d B 511.873988 512.074462 4.967 fps ts mono/SoE
      17 (1) [-] none 18 4147200d B 512.075982 512.278296 4.951 fps ts mono/SoE
      18 (2) [-] none 19 4147200d B 512.282631 512.482423 4.839 fps ts mono/SoE
      19 (3) [-] none 20 4147200d B 518.986637 512.686333 0.149 fps ts mono/SoE
      20 (4) [-] none 21 4147200d B 518.342709 512.886386 -1.553 fps ts mono/SoE
      21 (5) [-] none 22 4147200d B 517.909812 513.090360 -2.310 fps ts mono/SoE
      22 (6) [-] none 23 4147200d B 517.590775 513.294454 -3.134 fps ts mono/SoE
      23 (7) [-] none 24 4147200d B 513.298465 513.494335 -0.233 fps ts mono/SoE
      24 (0) [-] none 25 4147200d B 513.510273 513.698375 4.721 fps ts mono/SoE
      25 (1) [-] none 26 4147200d B 513.698904 513.902327 5.301 fps ts mono/SoE
      26 (2) [-] none 27 4147200d B 513.895971 514.102348 5.074 fps ts mono/SoE
      27 (3) [-] none 28 4147200d B 514.099091 514.306337 4.923 fps ts mono/SoE
      28 (4) [-] none 29 4147200d B 514.310348 514.510567 4.734 fps ts mono/SoE
      29 (5) [-] none 30 4147200d B 514.509295 514.710367 5.026 fps ts mono/SoE
      30 (6) [-] none 31 4147200d B 521.532513 514.914398 0.142 fps ts mono/SoE
      31 (7) [-] none 32 4147200d B 520.885277 515.118385 -1.545 fps ts mono/SoE
      32 (0) [-] none 33 4147200d B 520.411140 515.318336 -2.109 fps ts mono/SoE
      33 (1) [-] none 34 4147200d B 515.325425 515.522278 -0.197 fps ts mono/SoE
      34 (2) [-] none 35 4147200d B 515.538276 515.726423 4.698 fps ts mono/SoE
      35 (3) [-] none 36 4147200d B 515.720767 515.930373 5.480 fps ts mono/SoE
      
      Cc: stable@vger.kernel.org
      Fixes: 66847ef0 ("[media] uvcvideo: Add UVC timestamps support")
      Signed-off-by: default avatarRicardo Ribalda <ribalda@chromium.org>
      Reviewed-by: default avatarLaurent Pinchart <laurent.pinchart@ideasonboard.com>
      Link: https://lore.kernel.org/r/20240610-hwtimestamp-followup-v1-2-f9eaed7be7f0@chromium.orgSigned-off-by: default avatarLaurent Pinchart <laurent.pinchart@ideasonboard.com>
      8676a5e7