- 11 Apr, 2023 40 commits
-
-
Alexander Stein authored
'field' is zero-initialized to V4L2_FIELD_ANY, which is an invalid value to return to userspace. Instead default to non-interleaving. Signed-off-by:
Alexander Stein <alexander.stein@ew.tq-group.com> Reviewed-by:
Laurent Pinchart <laurent.pinchart@ideasonboard.com> Reviewed-by:
Rui Miguel Silva <rmfrfs@gmail.com> Signed-off-by:
Hans Verkuil <hverkuil-cisco@xs4all.nl>
-
Frieder Schrempf authored
The CSI requires a connected source subdev to operate. If fwnode_graph_get_endpoint_by_id() fails and returns NULL, there is no point in going on. Print an error message and abort instead. Also we don't need to check for an existing asd. Any failure of v4l2_async_nf_add_fwnode_remote() should abort the probe. Suggested-by:
Frieder Schrempf <frieder.schrempf@kontron.de> Reviewed-by:
-
Paul Elder authored
Implement VIDIOC_ENUM_FRAMESIZES for the rkisp1 capture devices. Signed-off-by:
Paul Elder <paul.elder@ideasonboard.com> Signed-off-by:
Dafna Hirschfeld <dafna@fastmail.com> Signed-off-by:
-
Paul Elder authored
Add support for NV16M and NV61M as output formats. As NV16, NV61, NV12M and NV21M are already supported, the infrastructure is already in place to support NV16M and NV61M, so it is sufficient to simply add relevant entries to the list of output formats. Signed-off-by:
-
Miaoqian Lin authored
rcar_fcp_get() take reference, which should be balanced with rcar_fcp_put(). Add missing rcar_fcp_put() in fdp1_remove and the error paths of fdp1_probe() to fix this. Fixes: 4710b752 ("[media] v4l: Add Renesas R-Car FDP1 Driver") Signed-off-by:
Miaoqian Lin <linmq006@gmail.com> Reviewed-by:
Laurent Pinchart <laurent.pinchart+renesas@ideasonboard.com> Signed-off-by:
-
Tomi Valkeinen authored
Print underrun interrupts with ratelimited print. Note that we don't enable the underrun interrupt. If we have underruns, we don't want to get flooded with interrupts about them. It's enough to see that an underrun happened at the end of a frame. Signed-off-by:
Tomi Valkeinen <tomi.valkeinen+renesas@ideasonboard.com> Reviewed-by:
-
Laurent Pinchart authored
The vsp1 driver uses the vb2_is_streaming() function in its .buf_queue() handler to check if the .start_streaming() operation has been called, and decide whether to just add the buffer to an internal queue, or also trigger a hardware run. vb2_is_streaming() relies on the vb2_queue structure's streaming field, which used to be set only after calling the .start_streaming() operation. Commit a10b2153 ("media: vb2: add (un)prepare_streaming queue ops") changed this, setting the .streaming field in vb2_core_streamon() before enqueuing buffers to the driver and calling .start_streaming(). This broke the vsp1 driver which now believes that .start_streaming() has been called when it hasn't, leading to a crash: [ 881.058705] Unable to handle kernel NULL pointer dereference at virtual address 0000000000000020 [ 881.067495] Mem abort info: [ 881.070290] ESR = 0x0000000096000006 [ 881.074042] EC = 0x25: DABT (current EL), IL = 32 bits [ 881.079358] SET = 0, FnV = 0 [ 881.082414] EA = 0, S1PTW = 0 [ 881.085558] FSC = 0x06: level 2 translation fault [ 881.090439] Data abort info: [ 881.093320] ISV = 0, ISS = 0x00000006 [ 881.097157] CM = 0, WnR = 0 [ 881.100126] user pgtable: 4k pages, 48-bit VAs, pgdp=000000004fa51000 [ 881.106573] [0000000000000020] pgd=080000004f36e003, p4d=080000004f36e003, pud=080000004f7ec003, pmd=0000000000000000 [ 881.117217] Internal error: Oops: 0000000096000006 [#1] PREEMPT SMP [ 881.123494] Modules linked in: rcar_fdp1 v4l2_mem2mem [ 881.128572] CPU: 0 PID: 1271 Comm: yavta Tainted: G B 6.2.0-rc1-00023-g6c94e2e99343 #556 [ 881.138061] Hardware name: Renesas Salvator-X 2nd version board based on r8a77965 (DT) [ 881.145981] pstate: 400000c5 (nZcv daIF -PAN -UAO -TCO -DIT -SSBS BTYPE=--) [ 881.152951] pc : vsp1_dl_list_add_body+0xa8/0xe0 [ 881.157580] lr : vsp1_dl_list_add_body+0x34/0xe0 [ 881.162206] sp : ffff80000c267710 [ 881.165522] x29: ffff80000c267710 x28: ffff000010938ae8 x27: ffff000013a8dd98 [ 881.172683] x26: ffff000010938098 x25: ffff000013a8dc00 x24: ffff000010ed6ba8 [ 881.179841] x23: ffff00000faa4000 x22: 0000000000000000 x21: 0000000000000020 [ 881.186998] x20: ffff00000faa4000 x19: 0000000000000000 x18: 0000000000000000 [ 881.194154] x17: 0000000000000000 x16: 0000000000000000 x15: 0000000000000000 [ 881.201309] x14: 0000000000000000 x13: 746e696174206c65 x12: ffff70000157043d [ 881.208465] x11: 1ffff0000157043c x10: ffff70000157043c x9 : dfff800000000000 [ 881.215622] x8 : ffff80000ab821e7 x7 : 00008ffffea8fbc4 x6 : 0000000000000001 [ 881.222779] x5 : ffff80000ab821e0 x4 : ffff70000157043d x3 : 0000000000000020 [ 881.229936] x2 : 0000000000000020 x1 : ffff00000e4f6400 x0 : 0000000000000000 [ 881.237092] Call trace: [ 881.239542] vsp1_dl_list_add_body+0xa8/0xe0 [ 881.243822] vsp1_video_pipeline_run+0x270/0x2a0 [ 881.248449] vsp1_video_buffer_queue+0x1c0/0x1d0 [ 881.253076] __enqueue_in_driver+0xbc/0x260 [ 881.257269] vb2_start_streaming+0x48/0x200 [ 881.261461] vb2_core_streamon+0x13c/0x280 [ 881.265565] vb2_streamon+0x3c/0x90 [ 881.269064] vsp1_video_streamon+0x2fc/0x3e0 [ 881.273344] v4l_streamon+0x50/0x70 [ 881.276844] __video_do_ioctl+0x2bc/0x5d0 [ 881.280861] video_usercopy+0x2a8/0xc80 [ 881.284704] video_ioctl2+0x20/0x40 [ 881.288201] v4l2_ioctl+0xa4/0xc0 [ 881.291525] __arm64_sys_ioctl+0xe8/0x110 [ 881.295543] invoke_syscall+0x68/0x190 [ 881.299303] el0_svc_common.constprop.0+0x88/0x170 [ 881.304105] do_el0_svc+0x4c/0xf0 [ 881.307430] el0_svc+0x4c/0xa0 [ 881.310494] el0t_64_sync_handler+0xbc/0x140 [ 881.314773] el0t_64_sync+0x190/0x194 [ 881.318450] Code: d50323bf d65f03c0 91008263 f9800071 (885f7c60) [ 881.324551] ---[ end trace 0000000000000000 ]--- [ 881.329173] note: yavta[1271] exited with preempt_count 1 A different regression report sent to the linux-media mailing list ([1]) was answered with a claim that the vb2_is_streaming() function has never been meant for this purpose. The document of the function, as well as of the struct vb2_queue streaming field, is sparse, so this claim may be hard to verify. The information needed by the vsp1 driver to decide how to process queued buffers is also available from the vb2_start_streaming_called() function. Use it instead of vb2_is_streaming() to fix the problem. [1] https://lore.kernel.org/linux-media/545610e7-3446-2b82-60dc-7385fea3774f@redhat.com/ Fixes: a10b2153 ("media: vb2: add (un)prepare_streaming queue ops") Signed-off-by:
Duy Nguyen <duy.nguyen.rh@renesas.com> Signed-off-by:
-
Gaosheng Cui authored
vsp1_subdev_internal_ops has been removed since commit 0efdf0f5 ("[media] v4l: vsp1: Implement and use the subdev pad::init_cfg configuration"), so remove it. Signed-off-by:
Gaosheng Cui <cuigaosheng1@huawei.com> Reviewed-by:
Kieran Bingham <kieran.bingham+renesas@ideasonboard.com> Reviewed-by:
-
Moudy Ho authored
For performance and multi-chip support, use dynamic layout instead of statically configured pools. Divide the shared memory into the 3 64-bit aligned layouts listed below: vpu->param_addr -> +-----------------------------------------+ | | | To SCP : Input frame parameters | | (struct img_ipi_frameparam) | | | +-----------------------------------------+ vpu->work_addr -> +-----------------------------------------+ | | | In SCP : Reserve for SCP calculation | | | +-----------------------------------------+ vpu->config_addr -> +-----------------------------------------+ | | | From SCP : Output component config | | (struct img_config) | | | +-----------------------------------------+ Signed-off-by:Moudy Ho <moudy.ho@mediatek.com> Signed-off-by:
-
Moudy Ho authored
The communication between the MDP3 kernel driver and SCP is to pass a shared memory through the cooperation of "mtk-mdp3-vpu.c" and remoteproc driver. The data structure of this shared memory is defined in "mtk-img-ipi.h", as shown below: vpu->work_addr -> +-----------------------------------------+ | | | To SCP : Input frame parameters | | (struct img_ipi_frameparam) | | | vpu->pool -> +-----------------------------------------+ | | | From SCP : Output component config pool | | (struct img_config) | | | | *struct img_config 1 | | | | | | | | v | | *struct img_config N | | (N = MDP_CONFIG_POOL_SIZE) | +-----------------------------------------+ One output component configuration contains the components currently used by the pipeline, and has the register settings that each component needs to set. Since the quantity, type and function of components on each chip will vary, the effect is that the size of the "struct img_config" and its substructures will be different on each chip. In addition, all chips will have to update their SCP firmware for every change if the output component config structure is defined and shared by a common header. Therefore, all functions that operate on "struct img_config" and its substructures must be separated by chips and so are the relevant definations. Signed-off-by: -
Moudy Ho authored
Separate the generic definitions used in MDP3 to avoid recursive includes when splitting chip-related definitions in further. Signed-off-by:
-
Moudy Ho authored
For extensibility of adding more MDP3 components in the further, the magic number is removed by dynamically allocating component clocks. Signed-off-by:
-
Moudy Ho authored
Due to future support for hardware compression formats, the MDP3 internal color format expression needs to be extended. Signed-off-by:
-
Moudy Ho authored
In MDP3, a pipe is used to represent a data path which consisting of different components and MUTEX, as shown in the following diagram: +----------------------------+ | MUTEX [*1] | +----------------------------+ S ^ S ^ S ^ S ^ S ^ | | | | | | | | | | | | | | | | | | | | +--------------+ | | | | | | | | +-------------+ | +--------------+ | | | | | | +-------------+ | | | +------+ | | | | +------+ | | | | | +------+ | | +------+ | | | | | | | | | | | | | | | | | | | | | | | v E v E v E v E v E +-------+ +-----+ +-------+ +-----+ +-------+ B>--->| RDMA0 |>-->| PQ |>-->| RSZ0 |>-->| PQ |>-->| WROT0 |>-->B +-------+ +-----+ +-------+ +-----+ +-------+ [*1] MUTEX is SOF/EOF signal controller [*2] S = Start of frame (SOF) [*3] E = End of frame (EOF) [*4] B = frame buffer More pipes will be introduced in future chips for applications such as higher frame rate frequency, which should integrate and reorder related information into specific chip config file. Signed-off-by: -
Moudy Ho authored
Due to differences in hardware design, the supported max and min resolutions and scaling capabilities will vary, and should be integrated into specific config file. Signed-off-by:
-
Moudy Ho authored
Due to differences in hardware design, the supported color formats will vary and should be integrated into specific config file. Signed-off-by:
-
Moudy Ho authored
Integrate subcomponent related information into specific config file for further multi-chip compatibility. Signed-off-by:
-
Moudy Ho authored
For different chips, different types and numbers of components are configured in the MDP3 to achieve the desired application, which will cause ID compatibility problems in the same driver. Subdivide the component ID into two kinds: 1. public_id (compatible with other chips) 2. inner_id (what the current chip actually owns) In addition, the chip configuration related structures of MDP3 components are integrated into specific file. Signed-off-by:
-
Moudy Ho authored
In order to be compatible with more MDP3 chip settings in further, integrate and separate chip-related configurations into specific files. Signed-off-by:
-
Moudy Ho authored
Fix overflow risk when setting certain formats whose frame size exceeds a RGB24 with 7723x7723 resolution. For example, a 7723x7724 RGB24 frame: 1. bpl (byte per line) = 7723 * 3. 2. Overflow occurs when bpl * 7724 * depth. Fixes: 61890cca ("media: platform: mtk-mdp3: add MediaTek MDP3 driver") Signed-off-by: -
Yu Zhe authored
Pointer variables of void * type do not require type cast. Signed-off-by:
Yu Zhe <yuzhe@nfschina.com> Signed-off-by:
-
Zheng Wang authored
In saa7134_initdev, it will call saa7134_hwinit1. There are three function invoking here: saa7134_video_init1, saa7134_ts_init1 and saa7134_vbi_init1. All of them will init a timer with same function. Take saa7134_video_init1 as an example. It'll bound &dev->video_q.timeout with saa7134_buffer_timeout. In buffer_activate, the timer funtcion is started. If we remove the module or device which will call saa7134_finidev to make cleanup, there may be a unfinished work. The possible sequence is as follows, which will cause a typical UAF bug. Fix it by canceling the timer works accordingly before cleanup in saa7134_finidev. CPU0 CPU1 |saa7134_buffer_timeout saa7134_finidev | kfree(dev); | | | saa7134_buffer_next | //use dev Fixes: 1e7126b4 ("media: saa7134: Convert timers to use timer_setup()") Signed-off-by:Zheng Wang <zyytlz.wz@163.com> Signed-off-by:
-
Zheng Wang authored
In dm1105_probe, it called dm1105_ir_init and bound &dm1105->ir.work with dm1105_emit_key. When it handles IRQ request with dm1105_irq, it may call schedule_work to start the work. When we call dm1105_remove to remove the driver, there may be a sequence as follows: Fix it by finishing the work before cleanup in dm1105_remove CPU0 CPU1 |dm1105_emit_key dm1105_remove | dm1105_ir_exit | rc_unregister_device | rc_free_device | rc_dev_release | kfree(dev); | | | rc_keydown | //use Fixes: 34d2f9bf ("V4L/DVB: dm1105: use dm1105_dev & dev instead of dm1105dvb") Signed-off-by: -
Oliver Neukum authored
We are setting a value. That is output and the pipe has to match that. Signed-off-by:
Oliver Neukum <oneukum@suse.com> Signed-off-by:
-
Yang Li authored
According to commit 7945f929 ("drivers: provide devm_platform_ioremap_resource()"), convert platform_get_resource(), devm_ioremap_resource() to a single call to use devm_platform_ioremap_resource(), as this is exactly what this function does. Signed-off-by:
Yang Li <yang.lee@linux.alibaba.com> Reviewed-by:
Claudiu Beznea <claudiu.beznea@microchip.com> Signed-off-by:
-
Niklas Söderlund authored
If the pattern generator is enabled the device shall not be queried for timings. Instead the timings programmed shall be reported as they are the ones being used to generate the pattern. Before this change an external HDMI source needed to be connected for the pattern generator to work. The driver would query this external HDMI source for timings and program the pattern generator using those. With this change the user can control the timings and have the pattern generator work without the need of an external HDMI source being connected. Signed-off-by:
Niklas Söderlund <niklas.soderlund+renesas@ragnatech.se> Signed-off-by:
-
Niklas Söderlund authored
When initializing the HDMI block during probe an initial set of timings are selected. These timings are stored in the drivers private data, but not written to the device. This in itself is not bad, but in s_dv_timings() the timings stored in the drivers private data are compared to the new timings, if they match no action is taken. This creates the corner-case where the timing selected at initialization is the first timings a user want to use as the driver then never writes it to the device preventing proper operation. Fix this by writing the timings to the device at initialization in addition to storing them in the drivers private data. Signed-off-by:
-
Niklas Söderlund authored
The loop to match the requested timings with the ones supported by the driver is incorrect. It always iterates thru the whole array of supported modes. The bounds check after the loop always triggers resulting in adv748x_hdmi_set_video_timings() always returning -EINVAL. Fix this by correcting the lookup to break the loop when a match is found. Signed-off-by:
Geert Uytterhoeven <geert+renesas@glider.be> Signed-off-by:
-
Milen Mitkov authored
Use the multistream series function video_device_pipeline_alloc_start to allows multiple clients of the same pipeline. If the VFE entity is used by another instance of the pipeline, the pipeline won't be stopped. This allows for stopping and starting streams at any point without disrupting the other running streams. To prepare and start multiple virtual channels each CSID source pad corresponding to a virtual channel must be linked to the corresponding IFE entity. CSID pad 1 (1st source pad) corresponds to virtual channel 0, CSID pad 2 corresponds to virtual channel 1 and so on. Each of these must be linked to corresponding IFE RDI port. E.g. to enable vc 0 on CSID0: media-ctl -l '"msm_csid0":1->"msm_vfe0_rdi0":0[1]' To enable vc1 on CSID0: media-ctl -l '"msm_csid0":2->"msm_vfe0_rdi1":0[1]' And so on. Note that on SM8250 each CSID is connected, at the hardware level, to only one IFE. Thus, you must link CSID0 with IFE0, you can't link it with IFE1. Example: the following media controller setup expects multiplexed sensor data on CSIPHY2. Data will be passed on to CSID0, which will demux it to 2 streams - for RDI0 and RD1 ports of IFE0: media-ctl -v -d /dev/media0 -V '"imx577 '22-001a'":0[fmt:SRGGB10/3840x2160 field:none]' media-ctl -V '"msm_csiphy2":0[fmt:SRGGB10/3840x2160]' media-ctl -V '"msm_csid0":0[fmt:SRGGB10/3840x2160]' media-ctl -V '"msm_csid0":1[fmt:SRGGB10/3840x2160]' media-ctl -V '"msm_csid0":2[fmt:SRGGB10/3840x2160]' media-ctl -V '"msm_vfe0_rdi0":0[fmt:SRGGB10/3840x2160]' media-ctl -V '"msm_vfe0_rdi1":0[fmt:SRGGB10/3840x2160]' media-ctl -l '"msm_csiphy2":1->"msm_csid0":0[1]' media-ctl -l '"msm_csid0":1->"msm_vfe0_rdi0":0[1]' media-ctl -l '"msm_csid0":2->"msm_vfe0_rdi1":0[1]' Note: CSID's entity pad 0 is a sink pad, pads 1..4 are source pads To start streaming a v4l2 client must open the corresponding /dev/videoN node. For example, with yavta: yavta -B capture-mplane -c -I -n 5 -f SRGGB10P -s 3840x2160 -F /dev/video0 yavta -B capture-mplane -c -I -n 5 -f SRGGB10P -s 3840x2160 -F /dev/video1 Note that IFEs (vfe0, vfe1) on SM8250 have 3 RDI ports and a single PIX port and IFELites (vfe2, vfe3) have 4 RDI ports and no PIX port. Signed-off-by:
Milen Mitkov <quic_mmitkov@quicinc.com> Reviewed-by:
Robert Foss <robert.foss@linaro.org> Tested-by:
Bryan O'Donoghue <bryan.odonoghue@linaro.org> Acked-by:
-
Milen Mitkov authored
On SM8250 each VFE supports at least 3 RDI channels, or 4 in case of VFE-Lite, so add appropriate IRQ setup and handling. Signed-off-by:
-
Milen Mitkov authored
For multiple virtual channels support, each VFE line can be in either ON, RESERVED or OFF states. This allows the starting and stopping of a VFE line independently of other active VFE lines (e.g. already- running lines stay in ON state, and newly-added lines are RESERVED) Also, link the CSID entity's source ports to corresponding VFE lines. Signed-off-by:
-
Milen Mitkov authored
CSID hardware on SM8250 can demux up to 4 simultaneous streams based on virtual channel (vc) or datatype (dt). The CSID subdevice entity now has 4 source ports that can be enabled/disabled and thus can control which virtual channels are enabled. Datatype demuxing not tested. In order to keep a valid internal state of the subdevice, implicit format propagation from the sink to the source pads has been preserved. However, the format on each source pad can be different and in that case it must be configured explicitly. CSID's s_stream is called when any stream is started or stopped. It will call configure_streams() that will rewrite IRQ settings to HW. When multiple streams are running simultaneously there is an issue when writing IRQ settings for one stream while another is still running, thus avoid re-writing settings if they were not changed in link setup, or by fully powering off the CSID hardware. Signed-off-by:
-
Uwe Kleine-König authored
The .remove() callback for a platform driver returns an int which makes many driver authors wrongly assume it's possible to do error handling by returning an error code. However the value returned is (mostly) ignored and this typically results in resource leaks. To improve here there is a quest to make the remove callback return void. In the first step of this quest all drivers are converted to .remove_new() which already returns void. Trivially convert this driver from always returning zero in the remove callback to the void returning variant. Signed-off-by:
Uwe Kleine-König <u.kleine-koenig@pengutronix.de> Signed-off-by:
-
Uwe Kleine-König authored
The .remove() callback for a platform driver returns an int which makes many driver authors wrongly assume it's possible to do error handling by returning an error code. However the value returned is (mostly) ignored and this typically results in resource leaks. To improve here there is a quest to make the remove callback return void. In the first step of this quest all drivers are converted to .remove_new() which already returns void. Trivially convert this driver from always returning zero in the remove callback to the void returning variant. Signed-off-by:
-
Uwe Kleine-König authored
The .remove() callback for a platform driver returns an int which makes many driver authors wrongly assume it's possible to do error handling by returning an error code. However the value returned is (mostly) ignored and this typically results in resource leaks. To improve here there is a quest to make the remove callback return void. In the first step of this quest all drivers are converted to .remove_new() which already returns void. Trivially convert this driver from always returning zero in the remove callback to the void returning variant. Signed-off-by:
-
Uwe Kleine-König authored
The .remove() callback for a platform driver returns an int which makes many driver authors wrongly assume it's possible to do error handling by returning an error code. However the value returned is (mostly) ignored and this typically results in resource leaks. To improve here there is a quest to make the remove callback return void. In the first step of this quest all drivers are converted to .remove_new() which already returns void. Trivially convert this driver from always returning zero in the remove callback to the void returning variant. Signed-off-by:
-
Uwe Kleine-König authored
The .remove() callback for a platform driver returns an int which makes many driver authors wrongly assume it's possible to do error handling by returning an error code. However the value returned is (mostly) ignored and this typically results in resource leaks. To improve here there is a quest to make the remove callback return void. In the first step of this quest all drivers are converted to .remove_new() which already returns void. Trivially convert this driver from always returning zero in the remove callback to the void returning variant. Signed-off-by:
-
Uwe Kleine-König authored
The .remove() callback for a platform driver returns an int which makes many driver authors wrongly assume it's possible to do error handling by returning an error code. However the value returned is (mostly) ignored and this typically results in resource leaks. To improve here there is a quest to make the remove callback return void. In the first step of this quest all drivers are converted to .remove_new() which already returns void. Trivially convert this driver from always returning zero in the remove callback to the void returning variant. Signed-off-by:
-
Uwe Kleine-König authored
The .remove() callback for a platform driver returns an int which makes many driver authors wrongly assume it's possible to do error handling by returning an error code. However the value returned is (mostly) ignored and this typically results in resource leaks. To improve here there is a quest to make the remove callback return void. In the first step of this quest all drivers are converted to .remove_new() which already returns void. Trivially convert this driver from always returning zero in the remove callback to the void returning variant. Signed-off-by:
-
Uwe Kleine-König authored
The .remove() callback for a platform driver returns an int which makes many driver authors wrongly assume it's possible to do error handling by returning an error code. However the value returned is (mostly) ignored and this typically results in resource leaks. To improve here there is a quest to make the remove callback return void. In the first step of this quest all drivers are converted to .remove_new() which already returns void. Trivially convert this driver from always returning zero in the remove callback to the void returning variant. Signed-off-by:
Jernej Skrabec <jernej.skrabec@gmail.com> Signed-off-by:
-
