- 25 Nov, 2022 40 commits
-
-
Chen Zhongjin authored
KASAN reports a use-after-free: BUG: KASAN: use-after-free in dvb_dmxdev_release+0x4d5/0x5d0 [dvb_core] Call Trace: ... dvb_dmxdev_release+0x4d5/0x5d0 [dvb_core] vidtv_bridge_probe+0x7bf/0xa40 [dvb_vidtv_bridge] platform_probe+0xb6/0x170 ... Allocated by task 1238: ... dvb_register_device+0x1a7/0xa70 [dvb_core] dvb_dmxdev_init+0x2af/0x4a0 [dvb_core] vidtv_bridge_probe+0x766/0xa40 [dvb_vidtv_bridge] ... Freed by task 1238: dvb_register_device+0x6d2/0xa70 [dvb_core] dvb_dmxdev_init+0x2af/0x4a0 [dvb_core] vidtv_bridge_probe+0x766/0xa40 [dvb_vidtv_bridge] ... It is because the error handling in vidtv_bridge_dvb_init() is wrong. First, vidtv_bridge_dmx(dev)_init() will clean themselves when fail, but goto fail_dmx(_dev): calls release functions again, which causes use-after-free. Also, in fail_fe, fail_tuner_probe and fail_demod_probe, j = i will cause out-of-bound when i finished its loop (i == NUM_FE). And the loop releasing is wrong, although now NUM_FE is 1 so it won't cause problem. Fix this by correctly releasing everything. Fixes: f90cf607 ("media: vidtv: add a bridge driver") Signed-off-by:
Chen Zhongjin <chenzhongjin@huawei.com> Signed-off-by:
Hans Verkuil <hverkuil-cisco@xs4all.nl> Signed-off-by:
Mauro Carvalho Chehab <mchehab@kernel.org>
-
Deepak R Varma authored
Use of standard min() helper macro is preferred over using ternary operator for logical evaluation and value assignment. This issue is identified by coccicheck using the minmax.cocci file. Signed-off-by:
Deepak R Varma <drv@mailo.com> Reviewed-by:
Neil Armstrong <neil.armstrong@linaro.org> Signed-off-by:
-
Daniel Almeida authored
A virtual stateless device for stateless uAPI development purposes. This tool's objective is to help the development and testing of userspace applications that use the V4L2 stateless API to decode media. A userspace implementation can use visl to run a decoding loop even when no hardware is available or when the kernel uAPI for the codec has not been upstreamed yet. This can reveal bugs at an early stage. This driver can also trace the contents of the V4L2 controls submitted to it. It can also dump the contents of the vb2 buffers through a debugfs interface. This is in many ways similar to the tracing infrastructure available for other popular encode/decode APIs out there and can help develop a userspace application by using another (working) one as a reference. Note that no actual decoding of video frames is performed by visl. The V4L2 test pattern generator is used to write various debug information to the capture buffers instead. Signed-off-by:
Daniel Almeida <daniel.almeida@collabora.com> Signed-off-by:
-
Ming Qian authored
vb2_queue_error is help to set the error of vb2_queue, don't need to set it manually Fixes: 3cd08451 ("media: amphion: add vpu v4l2 m2m support") Signed-off-by:
Ming Qian <ming.qian@nxp.com> Signed-off-by:
-
Ming Qian authored
the capture format may be changed when sequence header is parsed, it may be read and write in the same time, add lock around vdec_g_fmt to synchronize it Fixes: 6de8d628 ("media: amphion: add v4l2 m2m vpu decoder stateful driver") Signed-off-by:
-
Chen Zhongjin authored
In vimc_init(), when platform_driver_register(&vimc_pdrv) fails, platform_driver_unregister(&vimc_pdrv) is wrongly called rather than platform_device_unregister(&vimc_pdev), which causes kernel warning: Unexpected driver unregister! WARNING: CPU: 1 PID: 14517 at drivers/base/driver.c:270 driver_unregister+0x8f/0xb0 RIP: 0010:driver_unregister+0x8f/0xb0 Call Trace: <TASK> vimc_init+0x7d/0x1000 [vimc] do_one_initcall+0xd0/0x4e0 do_init_module+0x1cf/0x6b0 load_module+0x65c2/0x7820 Fixes: 4a29b709 ("[media] vimc: Subdevices as modules") Signed-off-by:
Shuah Khan <skhan@linuxfoundation.org> Signed-off-by:
-
Paul Kocialkowski authored
In order to use the isp and csi together, both devices need to be parented to the same v4l2 and media devices. We use the isp as top-level device and let the csi code hook to its v4l2 and media devices when async subdev registration takes place. As a result v4l2/media device setup is only called when the ISP is missing and the capture device is registered after the devices are hooked. The bridge subdev and its notifier are registered without any device when the ISP is available. Top-level pointers for the devices are introduced to either redirect to the hooked ones (isp available) or the registered ones (isp missing). Also keep track of whether the capture node was setup or not to avoid cleaning up resources when it wasn't. Signed-off-by:
Paul Kocialkowski <paul.kocialkowski@bootlin.com> Signed-off-by:
Sakari Ailus <sakari.ailus@linux.intel.com> Signed-off-by:
-
Paul Kocialkowski authored
Add a helper to detect whether the ISP is available and connected and store the indication in the driver-specific device structure. Signed-off-by:
-
Paul Kocialkowski authored
Add myself as maintainer of the Allwinner A31 ISP media driver. Signed-off-by:
Laurent Pinchart <laurent.pinchart@ideasonboard.com> Signed-off-by:
-
Paul Kocialkowski authored
Some Allwinner platforms come with an Image Signal Processor, which supports various features in order to enhance and transform data received by image sensors into good-looking pictures. In most cases, the data is raw bayer, which gets internally converted to RGB and finally YUV, which is what the hardware produces. This driver supports ISPs that are similar to the A31 ISP, which was the first standalone ISP found in Allwinner platforms. Simpler ISP blocks were found in the A10 and A20, where they are tied to a CSI controller. Newer generations of Allwinner SoCs (starting with the H6, H616, etc) come with a new camera subsystem and revised ISP. Even though these previous and next-generation ISPs are somewhat similar to the A31 ISP, they have enough significant differences to be out of the scope of this driver. While the ISP supports many features, including 3A and many enhancement blocks, this implementation is limited to the following: - V3s (V3/S3) platform support; - Bayer media bus formats as input; - Semi-planar YUV (NV12/NV21) as output; - Debayering with per-component gain and offset configuration; - 2D noise filtering with configurable coefficients. Since many features are missing from the associated uAPI, the driver is aimed to integrate staging until all features are properly described. On the technical side, it uses the v4l2 and media controller APIs, with a video node for capture, a processor subdev and a video node for parameters submission. A specific uAPI structure and associated v4l2 meta format are used to configure parameters of the supported modules. One particular thing about the hardware is that configuration for module registers needs to be stored in a DMA buffer and gets copied to actual registers by the hardware at the next vsync, when instructed by a flag. This is handled by the "state" mechanism in the driver. Signed-off-by:
-
Paul Kocialkowski authored
Some Allwinner devices come with an Image Signal Processor (ISP) that allows processing camera data to produce good-looking images, especially from raw bayer representations. The ISP does not have a dedicated capture path: it is fed directly by one of the CSI controllers, which can be selected at run-time. Represent this possibility as a graph connection between the CSI controller and the ISP in the device-tree bindings. Signed-off-by:
Rob Herring <robh@kernel.org> Signed-off-by:
-
Paul Kocialkowski authored
This introduces YAML bindings documentation for the Allwinner A31 Image Signal Processor (ISP). Signed-off-by:
-
Paul Kocialkowski authored
Given the substantial rework of the driver that I carried out and the knowledge acquired about the hardware along the way, make myself a maintainer of the sun6i-csi driver. Also rename and move the entry while at it since the driver is not specific to the V3s. Signed-off-by:
Jernej Skrabec <jernej.skrabec@gmail.com> Signed-off-by:
-
Paul Kocialkowski authored
Request our interrupt shared since it is typically shared with the isp block. The interrupt routine looks good to go for shared irq. Signed-off-by:
-
Paul Kocialkowski authored
Check against the enabled bits and make sure capture is running before serving an interrupt, to add extra safety in the process. Signed-off-by:
-
Paul Kocialkowski authored
Add a streaming element to the capture state structure to know if the capture device is used or not. Only configure things related to output when streaming, including the output format, irq, state (dma buffer) and window configuration registers. After this change, it becomes possible to use the bridge without the capture device, which will be the case in the isp media flow. Signed-off-by:
-
Paul Kocialkowski authored
Introduce MIPI CSI-2 support to the bridge with a new port, source and hardware configuration helper. Signed-off-by:
-
Paul Kocialkowski authored
Cleanup includes, update copyright lines and some cosmetic changes. Signed-off-by:
-
Paul Kocialkowski authored
Now that the driver is properly split between bridge and capture, rename the video device to highlight its role and be in line with the bridge entity naming. Signed-off-by:
-
Paul Kocialkowski authored
In order to support the isp workflow, we need to be able to configure the hardware from the bridge when the capture device is not used. As a result, move all hardware configuration calls from capture to the bridge. Only the window configuration part (which is specific to using capture) remains there. This effectively opens the way for hooking the bridge to the isp in the future. Signed-off-by:
-
Paul Kocialkowski authored
The remote subdev connected to the capture video device is always our bridge, so get the bridge subdev directly instead of using a dedicated helper (which is removed by this commit). Signed-off-by:
-
Paul Kocialkowski authored
Rework the capture link validate implementation with actual logic that reflects the possibilities of the device instead of the combinatory helper functions, using the added match list helper sun6i_csi_is_format_supported() when needed. Remove the previous dedicated helper. Signed-off-by:
-
Paul Kocialkowski authored
Switch over to using the static format table descriptions to configure registers. Rework the hardware configuration helpers to leverage information from the format structures and benefit from their logic. Remove the previous dedicated helpers. The intention is to make the interaction between the different formats and the hardware side more visible and clear. Signed-off-by:
-
Paul Kocialkowski authored
Add a table that describes each pixel format and associated output register configuration with necessary tweaks. It will be used later on to configure the hardware. Signed-off-by:
-
Paul Kocialkowski authored
Introduce a more informative format list for the bridge, with information about how to configure the input. This separation will later be useful when using the bridge standalone (without capture) for the isp workflow. Signed-off-by:
-
Paul Kocialkowski authored
Some misc code cleanups and preparation for upcoming changes. Signed-off-by:
-
Paul Kocialkowski authored
Another instance of removing a duplicated variable and using common helpers instead. Signed-off-by:
-
Paul Kocialkowski authored
Introduce new helpers to ease getting information about the bridge. Signed-off-by:
-
Paul Kocialkowski authored
Remove the custom sun6i_csi_get_bpp helper in favor of common v4l2 infrastructure and rework the related window configuration code. Signed-off-by:
-
Paul Kocialkowski authored
Remove the need for local copies of the v4l2 format and add a common helper to prepare a format compatible with the driver, using the relevant v4l2 helpers. Report a raw colorspace for bayer-encoded pixel formats instead of SRGB. Also cleanup the size bound defines while at it. Signed-off-by:
-
Paul Kocialkowski authored
Continue moving things over to capture in tidy helpers. Also take the occasion to remove the config struct, which is unwelcome redundancy and use the capture helpers instead. The code is only adapted to reflect the removal of the config structure. No functional change intended. Signed-off-by:
-
Paul Kocialkowski authored
Let's just enable the module when we start using it (at stream on) and benefit from runtime pm instead of enabling it at first open. Also reorder the call to v4l2_pipeline_pm_get. Signed-off-by:
-
Paul Kocialkowski authored
Create minimal helpers that split the enable/disable flow, which will make it easier to move control over to the bridge later on. Generally speaking the goal is to move register configuration to the capture code and later split it with the bridge code. Signed-off-by:
-
Paul Kocialkowski authored
Instead of calculating the planar_offset at one point and using it later in a dedicated function, reimplement address configuration with v4l2 format info in the buffer_configure function. Signed-off-by:
-
Paul Kocialkowski authored
Define and export useful helpers to access dimensions and pixel format. Signed-off-by:
-
Paul Kocialkowski authored
This cleans up the register definitions a bit, adds a prefix, remove masks. Registers are now fully defined, some additional fields were added when needed. New format definitions are added for future use. Some fields are wrongly defined (inverted) in Allwinner literature (e.g. field vs frame prefixes), which is quite misleading. They are now corrected to reflect their actual behavior. This should only be a cosmetic commit. No functional change intended. Signed-off-by:
-
Paul Kocialkowski authored
The current implementation requires up to 3 buffers to properly implement page flipping without losing frames: one is configured before the video stream is started, one just after that and page flipping is synchronized to the frame done interrupt. The comment in the code mentions that "CSI will lookup the next dma buffer for next frame before the current frame done IRQ triggered". Based on observations of the CSI unit behavior, it seems that the buffer DMA address is sampled when the frame scan begins (in addition to starting the stream), which corresponds to the vblank interrupt that hits just before the frame-done interrupt of the previous frame. As a result, the address configured at the frame done interrupt is not actually used for the next frame but for the one after that. This proposal changes the page flipping sync point to the vsync interrupt, which allows the DMA address to be sampled for the next frame instead and allows operating with only two buffers. In addition to the change in the sync point, the code is refactored to introduce a notion of state that clarifies tracking of the buffers with tidy functions. Signed-off-by:
-
Paul Kocialkowski authored
In an effort to distinguish between the core csi engine (to be represented as the bridge) and the dma engine (the capture video device), rename the video component to capture, with the appropriate prefix. No functional change intended. [Sakari Ailus: fix wrong variable issue (video -> capture) missed in patch] Signed-off-by:
Maxime Ripard <maxime@cerno.tech> Signed-off-by:
-
Paul Kocialkowski authored
Introduce a bridge v4l2 subdev to prepare for separation between the processing part (bridge) and the dma engine, which is required to properly support ths isp workflow later on. Currently the bridge just manages fwnode mapping to media pads, using an async notifier (which was previously in the main code). The s_stream video op just forwards to the connected v4l2 subdev (sensor or MIPI CSI-2 bridge). The video capture device is now registered after the bridge and attaches to it with a media link. Signed-off-by:
-
Dave Stevenson authored
As noted in the headers for V4L2_SUBDEV_FL_HAS_EVENTS, "controls can send events, thus drivers exposing controls should set this flag". This driver exposes controls, but didn't reflect that it could generate events. Correct this, and add the default event handler functions. Signed-off-by:
Dave Stevenson <dave.stevenson@raspberrypi.com> Reviewed-by:
Jacopo Mondi <jacopo@jmondi.org> Signed-off-by:
-
