Colin Ian King [Wed, 1 Jul 2020 13:56:52 +0000 (15:56 +0200)]
media: gspca: remove redundant initialization of variable status
The variable status is being initialized with a value that is never read
and it is being updated later with a new value. The initialization is
redundant and can be removed.
Addresses-Coverity: ("Unused value")
Signed-off-by: Colin Ian King <colin.king@canonical.com> Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl> Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
Oliver Neukum [Tue, 5 May 2020 10:50:33 +0000 (12:50 +0200)]
go7007: add sanity checking for endpoints
A malicious USB device may lack endpoints the driver assumes to exist
Accessing them leads to NULL pointer accesses. This patch introduces
sanity checking.
Reported-and-tested-by: syzbot+cabfa4b5b05ff6be4ef0@syzkaller.appspotmail.com Signed-off-by: Oliver Neukum <oneukum@suse.com> Fixes: 866b8695d67e8 ("Staging: add the go7007 video driver") Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl> Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
Dmitry Osipenko [Wed, 24 Jun 2020 15:08:47 +0000 (17:08 +0200)]
media: staging: tegra-vde: Power-cycle hardware on probe
VDE partition is left turned ON after bootloader on most devices, hence
let's ensure that it's turned OFF in order to lower power leakage while
hardware is idling by turning it ON and OFF during of the driver's probe.
Dmitry Osipenko [Wed, 24 Jun 2020 15:08:46 +0000 (17:08 +0200)]
media: staging: tegra-vde: Turn ON power domain on shutdown
On some devices bootloader isn't ready to a clamped VDE power, and thus,
machine hangs on a warm reboot (CPU reset). The VDE power partition is
turned ON by default on a cold boot, hence VDE driver should keep power
partition enabled on system's reboot too. This fixes hang on a warm reboot
on a Tegra20 Acer A500 device, which is handy if Embedded Controller
driver is unavailable, i.e. cold reboot can't be performed.
Dmitry Osipenko [Wed, 24 Jun 2020 15:08:45 +0000 (17:08 +0200)]
media: staging: tegra-vde: Runtime PM is always available on Tegra
Runtime PM is always available on Tegra nowadays since commit 40b2bb1b132a
("ARM: tegra: enforce PM requirement"), hence the case of unavailable RPM
doesn't need to be handled.
media: cros-ec-cec: do not bail on device_init_wakeup failure
Do not fail probing when device_init_wakeup fails.
device_init_wakeup fails when the device is already enabled as wakeup
device. Hence, the driver fails to probe the device if:
- The device has already been enabled for wakeup (by e.g. sysfs)
- The driver has been unloaded and is being loaded again.
This goal of the patch is to fix the above cases.
Overwhelming majority of the drivers do not check device_init_wakeup
return code.
media: rockchip: rga: Only set output CSC mode for RGB input
Setting the output CSC mode is required for a YUV output, but must not
be set when the input is also YUV. Doing this (as tested with a YUV420P
to YUV420P conversion) results in wrong colors.
Adapt the logic to only set the output CSC mode when the output is YUV and
the input is RGB. Also add a comment to clarify the rationale.
media: rockchip: rga: Introduce color fmt macros and refactor CSC mode logic
This introduces two macros: RGA_COLOR_FMT_IS_YUV and RGA_COLOR_FMT_IS_RGB
which allow quick checking of the colorspace familily of a RGA color format.
These macros are then used to refactor the logic for CSC mode selection.
The two nested tests for input colorspace are simplified into a single one,
with a logical and, making the whole more readable.
Signed-off-by: Paul Kocialkowski <paul.kocialkowski@bootlin.com> Reviewed-by: Ezequiel Garcia <ezequiel@collabora.com> Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl> Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
Chuhong Yuan [Thu, 28 May 2020 06:41:47 +0000 (08:41 +0200)]
media: exynos4-is: Add missed check for pinctrl_lookup_state()
fimc_md_get_pinctrl() misses a check for pinctrl_lookup_state().
Add the missed check to fix it.
Fixes: 4163851f7b99 ("[media] s5p-fimc: Use pinctrl API for camera ports configuration]") Signed-off-by: Chuhong Yuan <hslester96@gmail.com> Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl> Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
Dafna Hirschfeld [Fri, 29 May 2020 14:03:51 +0000 (16:03 +0200)]
media: staging: rkisp1: set more precise size errors in debugfs
When a size error is signaled, it is possible to read a register
to see where the error comes from. So, in debugfs the general
error 'pic_size_err' can be replaced with 3 more precise errors.
Chuhong Yuan [Sat, 6 Jun 2020 14:39:18 +0000 (16:39 +0200)]
media: tvp5150: Add missed media_entity_cleanup()
This driver does not call media_entity_cleanup() in the error handler
of tvp5150_registered() and tvp5150_remove(), while it has called
media_entity_pads_init() at first.
Add the missed calls to fix it.
Dan Carpenter [Wed, 10 Jun 2020 17:26:15 +0000 (19:26 +0200)]
media: pxa_camera: remove an impossible condition
It's not possible for "pcdev->mclk" to be zero because we check for
that earlier and set it to 20000000 in that situation. If it were
possible, that would be a problem because it could have lead to an Oops
in the error handling when we call v4l2_clk_unregister(pcdev->mclk_clk);
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com> Acked-by: Robert Jarzmik <robert.jarzmik@free.fr> Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl> Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
Niklas Söderlund [Thu, 11 Jun 2020 19:32:32 +0000 (21:32 +0200)]
media: rcar-csi2: Rename confirm_start() to phy_post_init() to match its usage
Since the driver was picked-up the starting of the PHY have changed
quiet a bit. An artifact of these changes is the now poorly named
callback confirm_start(). It used to confirm start of the PHY but now
performs post PHY start initialization, rename it to phy_post_init() to
reflect this.
media: docs: dev-decoder: Add one more reason for dynamic change
Add bit-depth change as one more reason which could change in the
middle of the stream. For the worst case the stream is 8bit at the
beginning but later in the bit-stream it changes to 10bit. That
change should be propagated to the client so that it can take the
appropriate action. In that case it has to stop the streaming on
the capture queue, re-negotiate the pixel format, allocate new
buffers and start the streaming again.
Signed-off-by: Gustavo A. R. Silva <gustavoars@kernel.org> Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl> Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
John Cox [Wed, 17 Jun 2020 13:21:52 +0000 (15:21 +0200)]
media: videobuf2: Fix length check for single plane dmabuf queueing
Check against length in v4l2_buffer rather than vb2_buffer when the
buffer is a dmabuf. This makes the single plane test the same as the
existing multiplanar test.
Signed-off-by: John Cox <jc@kynesim.co.uk> Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl> Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
Helen Koike [Wed, 17 Jun 2020 18:08:01 +0000 (20:08 +0200)]
media: staging: rkisp1: rsz: fix resolution limitation on sink pad
Resizer sink pad is limited by what the ISP can generate.
The configurations describes what the resizer can produce.
This was tested on a Scarlet device with ChromiumOs, where the selfpath
receives 2592x1944 and produces 1600x1200 (which isn't possible without
this fix).
Fixes: 56e3b29f9f6b2 ("media: staging: rkisp1: add streaming paths") Signed-off-by: Helen Koike <helen.koike@collabora.com> Reviewed-by: Tomasz Figa <tfiga@chromium.org> Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl> Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
media: samsung: Rename Samsung and Exynos to lowercase
Fix up inconsistent usage of upper and lowercase letters in "Samsung"
and "Exynos" names.
"SAMSUNG" and "EXYNOS" are not abbreviations but regular trademarked
names. Therefore they should be written with lowercase letters starting
with capital letter.
The lowercase "Exynos" name is promoted by its manufacturer Samsung
Electronics Co., Ltd., in advertisement materials and on website.
Although advertisement materials usually use uppercase "SAMSUNG", the
lowercase version is used in all legal aspects (e.g. on Wikipedia and in
privacy/legal statements on
https://www.samsung.com/semiconductor/privacy-global/).
Signed-off-by: Krzysztof Kozlowski <krzk@kernel.org> Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl> Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
Dafna Hirschfeld [Thu, 18 Jun 2020 11:35:18 +0000 (13:35 +0200)]
media: staging: rkisp1: rsz: set default format if the given format is not RKISP1_ISP_SD_SRC
When setting the sink format of the 'rkisp1_resizer'
the format should be supported by 'rkisp1_isp' on
the video source pad. This patch checks this condition
and sets the format to default if the condition is false.
Fixes: 56e3b29f9f6b "media: staging: rkisp1: add streaming paths" Signed-off-by: Dafna Hirschfeld <dafna.hirschfeld@collabora.com> Reviewed-by: Tomasz Figa <tfiga@chromium.org> Acked-by: Helen Koike <helen.koike@collabora.com> Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl> Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
Dafna Hirschfeld [Thu, 18 Jun 2020 11:35:17 +0000 (13:35 +0200)]
media: staging: rkisp1: rename macros 'RKISP1_DIR_*' to 'RKISP1_ISP_SD_*'
The macros 'RKISP1_DIR_*' are flags that indicate on which
pads of the isp subdevice the media bus code is supported. So the
prefix RKISP1_ISP_SD_ is better.
Signed-off-by: Dafna Hirschfeld <dafna.hirschfeld@collabora.com> Acked-by: Helen Koike <helen.koike@collabora.com> Reviewed-by: Tomasz Figa <tfiga@chromium.org> Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl> Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
The macro RKISP1_DIR_SINK_SRC is a mask of two flags.
The macro hides the fact that it's a mask and the code
is actually more clear if we replace it the with bitwise-or explicitly.
Signed-off-by: Dafna Hirschfeld <dafna.hirschfeld@collabora.com> Acked-by: Helen Koike <helen.koike@collabora.com> Reviewed-by: Tomasz Figa <tfiga@chromium.org> Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl> Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
Dafna Hirschfeld [Thu, 18 Jun 2020 11:35:15 +0000 (13:35 +0200)]
media: staging: rkisp1: rsz: supported formats are the isp's src formats, not sink formats
The rkisp1_resizer's enum callback 'rkisp1_rsz_enum_mbus_code'
calls the enum callback of the 'rkisp1_isp' on it's video sink pad.
This is a bug, the resizer should support the same formats
supported by the 'rkisp1_isp' on the source pad (not the sink pad).
Fixes: 56e3b29f9f6b "media: staging: rkisp1: add streaming paths" Signed-off-by: Dafna Hirschfeld <dafna.hirschfeld@collabora.com> Acked-by: Helen Koike <helen.koike@collabora.com> Reviewed-by: Tomasz Figa <tfiga@chromium.org> Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl> Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
Laurent Pinchart [Sun, 21 Jun 2020 00:23:43 +0000 (02:23 +0200)]
media: vb2: Print the queue pointer in debug messages
When debugging issues that involve more than one video queue, messages
related to multiple queues get interleaved without any easy way to tell
which queue they relate to. Fix this by adding a queue name to
vb2_queue, and printing it in all debug messages in the vb2 core and
V4L2 layers. If the name isn't set by drivers, it is automatically
filled with the queue direction and address.
Benoit Parrot [Thu, 28 May 2020 13:26:05 +0000 (15:26 +0200)]
media: use v4l2_rect_enclosed helper
Several drivers implement the same enclosed_rectangle() function to
check if a rectangle is enclosed into another. Replace this with the
newly added v4l2_rect_enclosed() helper function.
Lad Prabhakar [Wed, 27 May 2020 12:16:49 +0000 (14:16 +0200)]
media: rcar-vin: Add support for MEDIA_BUS_FMT_SRGGB8_1X8 format
Add support for MEDIA_BUS_FMT_SRGGB8_1X8 format in rcar-vin by setting
format type to RAW8 in VNMC register and appropriately setting the bpp
and bytesperline to enable V4L2_PIX_FMT_SRGGB8.
Lad Prabhakar [Wed, 27 May 2020 12:16:48 +0000 (14:16 +0200)]
media: rcar-vin: Invalidate pipeline if conversion is not possible on input formats
Up until now the VIN was capable to convert any of its supported input mbus
formats to any of it's supported output pixel formats. With the addition of
RAW formats this is no longer true.
This patch invalidates the pipeline by adding a check if given vin input
format can be converted to supported output pixel format.
Dinghao Liu [Sun, 24 May 2020 04:31:32 +0000 (06:31 +0200)]
media: venus: venc: Fix runtime PM imbalance in venc_open
pm_runtime_get_sync() increments the runtime PM usage counter even
when it returns an error code. Thus a pairing decrement is needed on
the error handling path to keep the counter balanced.
Currently we are considering the instances which are available
in core->inst list for load calculation in min_loaded_core()
function, but this is incorrect because by the time we call
decide_core() for second instance, the third instance not
filled yet codec_freq_data pointer.
Solve this by considering the instances whose session has started.
Cc: stable@vger.kernel.org # v5.7+ Fixes: 4ebf969375bc ("media: venus: introduce core selection") Tested-by: Douglas Anderson <dianders@chromium.org> Signed-off-by: Mansur Alisha Shaik <mansur@codeaurora.org> Signed-off-by: Stanimir Varbanov <stanimir.varbanov@linaro.org> Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
Evgeny Novikov [Thu, 18 Jun 2020 13:15:38 +0000 (15:15 +0200)]
media: rc: return proper error code on error handling path in init
If lirc_dev_init() fails during module initialization, rc_core_init()
returns 0 denoting success. This can cause different issues during
further operation of the module. The patch fixes the return value of
rc_core_init() on the corresponding error handling path.
Found by Linux Driver Verification project (linuxtesting.org).
Signed-off-by: Evgeny Novikov <novikov@ispras.ru> Signed-off-by: Sean Young <sean@mess.org> Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
Sean Young [Tue, 16 Jun 2020 10:04:17 +0000 (12:04 +0200)]
media: cx23888: remove unused functions
Found with clang:
drivers/media/pci/cx23885/cx23888-ir.c:178:19: warning: unused function 'ns_to_clock_divider' [-Wunused-function]
static inline u16 ns_to_clock_divider(unsigned int ns)
^
drivers/media/pci/cx23885/cx23888-ir.c:184:28: warning: unused function 'clock_divider_to_ns' [-Wunused-function]
static inline unsigned int clock_divider_to_ns(unsigned int divider)
^
drivers/media/pci/cx23885/cx23888-ir.c:202:19: warning: unused function 'freq_to_clock_divider' [-Wunused-function]
static inline u16 freq_to_clock_divider(unsigned int freq,
^
Cc: Andy Walls <awalls@md.metrocast.net> Signed-off-by: Sean Young <sean@mess.org> Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
Sean Young [Tue, 16 Jun 2020 09:45:14 +0000 (11:45 +0200)]
media: drx-k: remove unused MulDiv32 function
This function has never been used. Found with clang:
drivers/media/dvb-frontends/drxk_hard.c:159:19: warning: unused function 'MulDiv32' [-Wunused-function]
static inline u32 MulDiv32(u32 a, u32 b, u32 c)
Signed-off-by: Sean Young <sean@mess.org> Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
Hans Verkuil [Fri, 26 Jun 2020 11:53:20 +0000 (13:53 +0200)]
media: staging/media/soc_camera: remove this driver
The soc_camera driver (and related soc_camera-dependent sensor
drivers) is obsolete and depends on BROKEN for a long time now.
Nobody is using it, so it is time to kill it off.
The soc_camera driver is about to be removed, so drop camera
support from this board. Note that the soc_camera driver itself has
long since been deprecated and can't be compiled anymore (it depends
on BROKEN), so camera support on this board has been broken for a long
time (at least since 4.9 when the pxa_camera.c was removed from soc_camera).
Note that there is a new pxa_camera.c driver that replaced the old
soc_camera based driver, but using that would require these boards to
be converted to use the device tree.
Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl> Cc: Robert Jarzmik <robert.jarzmik@free.fr> Acked-by: Arnd Bergmann <arnd@arndb.de> Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
The soc_camera driver is about to be removed, so drop camera
support from this board. Note that the soc_camera driver itself has
long since been deprecated and can't be compiled anymore (it depends
on BROKEN), so camera support on this board has been broken for a long
time (at least since 4.6 when the omap1_camera.c was removed from soc_camera).
Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl> Cc: Tony Lindgren <tony@atomide.com> Acked-by: Arnd Bergmann <arnd@arndb.de> Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
The soc_camera.h header driver is about to be removed, so drop camera
support from this board. Note that the soc_camera driver itself has
long since been deprecated and can't be compiled anymore (it depends
on BROKEN), so camera support on this board has been broken for a long
time (at least since 4.6 when the mx2_camera.c was removed from soc_camera).
Jeff Chase [Mon, 22 Jun 2020 23:59:49 +0000 (01:59 +0200)]
media: cec: add adap_controls_phys_addr option
Use of the cec notifier framework is required to support
CEC_CAP_CONNECTOR_INFO but some devices do not want physical address
updates from the notifier. This adds an option to allow registering
with a cec notifier without getting address updates.
[hans: document the new adap_controls_phys_addr bool]
Signed-off-by: Jeff Chase <jnchase@google.com> Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl> Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
Eugeniu Rosca [Tue, 2 Jun 2020 19:50:16 +0000 (21:50 +0200)]
media: vsp1: dl: Fix NULL pointer dereference on unbind
In commit f3b98e3c4d2e16 ("media: vsp1: Provide support for extended
command pools"), the vsp pointer used for referencing the VSP1 device
structure from a command pool during vsp1_dl_ext_cmd_pool_destroy() was
not populated.
Correctly assign the pointer to prevent the following
null-pointer-dereference when removing the device:
Colin Ian King [Fri, 24 Apr 2020 11:25:54 +0000 (13:25 +0200)]
media: cx231xx: remove redundant assignment to variable err
The variable err is being initialized with a value that is
never read and it is being updated later with a new value. The
initialization is redundant and can be removed.
Addresses-Coverity: ("Unused value")
Signed-off-by: Colin Ian King <colin.king@canonical.com> Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl> Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
Eizan Miyamoto [Thu, 7 May 2020 10:23:48 +0000 (12:23 +0200)]
media: mtk-mdp: convert mtk_mdp_dev.comp array to list
The functions mtk_mdp_register/unregister_component have been created to
add / remove items from the list of components.
This will eventually enable us to specify a list of components in the
device tree instead of hardcoding them into this driver.
The list is modified by a single thread at driver probe time, and will
not be traversed by another thread until the call to pm_runtime_enable
at the end of probing.
Signed-off-by: Eizan Miyamoto <eizan@chromium.org> Reviewed-by: Enric Balletbo I Serra <enric.balletbo@collabora.com> Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl> Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
The mtk-mdp driver uses states to check if the formats have been set
on the capture and output when turning the streaming on, setting
controls or setting the selection rectangles.
Those states are reset when 0 buffers are requested like when checking
capabilities.
This patch removes all format checks and set one by default as queues in
V4L2 are expected to always have a format set.
Dan Carpenter [Fri, 8 May 2020 14:40:22 +0000 (16:40 +0200)]
media: firewire: Using uninitialized values in node_probe()
If fw_csr_string() returns -ENOENT, then "name" is uninitialized. So
then the "strlen(model_names[i]) <= name_len" is true because strlen()
is unsigned and -ENOENT is type promoted to a very high positive value.
Then the "strncmp(name, model_names[i], name_len)" uses uninitialized
data because "name" is uninitialized.
Fixes: 92374e886c75 ("[media] firedtv: drop obsolete backend abstraction") Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com> Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl> Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
media: usb: pwc: pwc.h: Replace zero-length array with flexible-array member
The current codebase makes use of the zero-length array language
extension to the C90 standard, but the preferred mechanism to declare
variable-length types such as these ones is a flexible array member[1][2],
introduced in C99:
struct foo {
int stuff;
struct boo array[];
};
By making use of the mechanism above, we will get a compiler warning
in case the flexible array does not occur last in the structure, which
will help us prevent some kind of undefined behavior bugs from being
inadvertently introduced[3] to the codebase from now on.
Also, notice that, dynamic memory allocations won't be affected by
this change:
"Flexible array members have incomplete type, and so the sizeof operator
may not be applied. As a quirk of the original implementation of
zero-length arrays, sizeof evaluates to zero."[1]
Signed-off-by: Gustavo A. R. Silva <gustavo@embeddedor.com> Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl> Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
media: camss: use proper media entity function for subdevices
Currently for msm_csiphy, msm_csid, and msm_ispif subdevices the media
entity function field is set to MEDIA_ENT_F_IO_V4L. This is incorrect
as MEDIA_ENT_F_IO_V4L implies V4L2 video node.
Change it to MEDIA_ENT_F_PROC_VIDEO_PIXEL_FORMATTER as this is the best
fit from the functions defined in include/uapi/linux/media.h.
Signed-off-by: Andrey Konovalov <andrey.konovalov@linaro.org> Tested-by: Robert Foss <robert.foss@linaro.org> Reviewed-by: Robert Foss <robert.foss@linaro.org> Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl> Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
What led to this crash was an injected memory allocation failure in
media_request_alloc():
FAULT_INJECTION: forcing a failure.
name failslab, interval 1, probability 0, space 0, times 0
should_failslab+0x5/0x20
kmem_cache_alloc_trace+0x57/0x300
? anon_inode_getfile+0xe5/0x170
media_request_alloc+0x339/0x440
media_device_request_alloc+0x94/0xc0
media_device_ioctl+0x1fb/0x330
? do_vfs_ioctl+0x6ea/0x1a00
? media_ioctl+0x101/0x120
? __media_device_usb_init+0x430/0x430
? media_poll+0x110/0x110
__se_sys_ioctl+0xf9/0x160
do_syscall_64+0xf3/0x1b0
When that allocation fails, filp->private_data is left uninitialized
which media_request_close() does not expect and crashes.
To avoid this, reorder media_request_alloc() such that
allocating the struct file happens as the last step thus
media_request_close() will no longer get called for a partially created
media request.
Reported-by: syzbot+6bed2d543cf7e48b822b@syzkaller.appspotmail.com Cc: stable@vger.kernel.org Signed-off-by: Tuomas Tynkkynen <tuomas.tynkkynen@iki.fi> Fixes: 10905d70d788 ("media: media-request: implement media requests") Reviewed-by: Hans Verkuil <hverkuil-cisco@xs4all.nl> Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com> Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
Qingwu Zhang [Fri, 12 Jun 2020 09:42:02 +0000 (11:42 +0200)]
media: ov2740: add NVMEM interface to read customized OTP data
ov2740 includes 512bytes of one-time programmable memory and
256 bytes are reserved for customers which can be used to store
customized information. This patch provide an NVMEM interface
to support read out the customized data in OTP.
Signed-off-by: Bingbu Cao <bingbu.cao@intel.com> Signed-off-by: Qingwu Zhang <qingwu.zhang@intel.com> Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com> Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
Andrey Konovalov [Fri, 12 Jun 2020 13:53:55 +0000 (15:53 +0200)]
media: i2c: imx290: set bus_type before calling v4l2_fwnode_endpoint_alloc_parse()
The bus_type field of v4l2_fwnode_endpoint structure passed as the argument
to v4l2_fwnode_endpoint_alloc_parse() function must be initiaized.
Set it to V4L2_MBUS_CSI2_DPHY, and check for -ENXIO which is returned
when the requested media bus type doesn't match the fwnode.
Also remove v4l2_fwnode_endpoint field from struct imx290 as it is only
needed in the probe function: use the local variable for this purpose.
media: i2c: imx290: Move the settle time delay out of loop
The 10ms settle time is needed only at the end of all consecutive
register writes. So move the delay to outside of the for loop of
imx290_set_register_array().
IMX290 is capable of outputting frames in both Raw Bayer (packed) 10 and
12 bit formats. Since the driver already supports RAW10 mode, let's add
the missing RAW12 mode as well.
media: i2c: imx290: Add configurable link frequency and pixel rate
IMX290 operates with multiple link frequency and pixel rate combinations.
The initial driver used a single setting for both but since we now have
the lane count support in place, let's add configurable link frequency
and pixel rate.
The IMX290 sensor can output frames with 2/4 CSI2 data lanes. This commit
adds support for 2 lane mode in addition to the 4 lane and also
configuring the data lane settings in the driver based on system
configuration.
Andrey Konovalov [Fri, 12 Jun 2020 13:53:48 +0000 (15:53 +0200)]
media: i2c: imx290: fix reset GPIO pin handling
According to https://www.kernel.org/doc/Documentation/gpio/consumer.txt,
- all of the gpiod_set_value_xxx() functions operate with the *logical*
value. So in imx290_power_on() the reset signal should be cleared
(de-asserted) with gpiod_set_value_cansleep(imx290->rst_gpio, 0), and in
imx290_power_off() the value of 1 must be used to apply/assert the reset
to the sensor. In the device tree the reset pin is described as
GPIO_ACTIVE_LOW, and gpiod_set_value_xxx() functions take this into
account,
- when devm_gpiod_get_optional() is called with GPIOD_ASIS, the GPIO is
not initialized, and the direction must be set later; using a GPIO
without setting its direction first is illegal and will result in undefined
behavior. Fix this by using GPIOD_OUT_HIGH instead of GPIOD_ASIS (this
asserts the reset signal to the sensor initially).
Andrey Konovalov [Fri, 12 Jun 2020 13:53:46 +0000 (15:53 +0200)]
media: i2c: imx290: set the format before VIDIOC_SUBDEV_G_FMT is called
With the current driver 'media-ctl -p' issued right after the imx290 driver
is loaded prints:
pad0: Source
[fmt:unknown/0x0]
The format value of zero is due to the current_format field of the imx290
struct not being initialized yet.
As imx290_entity_init_cfg() calls imx290_set_fmt(), the current_mode field
is also initialized, so the line which set current_mode to a default value
in driver's probe() function is no longer needed.
mccic_register() forgets to cleanup the notifier in its error handler.
mccic_shutdown() also misses calling v4l2_async_notifier_cleanup().
Add the missed calls to fix them.
Fixes: 3eefe36cc00c ("media: marvell-ccic: use async notifier to get the sensor") Signed-off-by: Chuhong Yuan <hslester96@gmail.com> Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com> Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
Dinghao Liu [Mon, 25 May 2020 08:19:58 +0000 (10:19 +0200)]
media: smiapp: Fix runtime PM imbalance on error
When v4l2_async_register_subdev_sensor_common() returns
an error code, a pairing runtime PM usage counter
decrement is needed to keep the counter balanced.
Signed-off-by: Dinghao Liu <dinghao.liu@zju.edu.cn> Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com> Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
Hans Verkuil [Sat, 20 Jun 2020 10:16:40 +0000 (12:16 +0200)]
media: cec: remove unused waitq and phys_addrs fields
The cec_adapter struct contained a waitq field that isn't used
anywhere, so drop this.
It also contained a phys_addrs array to store any reported physical
addresses. However, this was never actually used, so this field is
removed as well. The original idea was to let the core keep track of
this information, but nothing was ever done with this. Should this
be needed in the future then it is easy enough to resurrect this.
Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl> Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
Jia-Ju Bai [Sat, 30 May 2020 14:42:08 +0000 (16:42 +0200)]
media: pci: ttpci: av7110: fix possible buffer overflow caused by bad DMA value in debiirq()
The value av7110->debi_virt is stored in DMA memory, and it is assigned
to data, and thus data[0] can be modified at any time by malicious
hardware. In this case, "if (data[0] < 2)" can be passed, but then
data[0] can be changed into a large number, which may cause buffer
overflow when the code "av7110->ci_slot[data[0]]" is used.
To fix this possible bug, data[0] is assigned to a local variable, which
replaces the use of data[0].
Signed-off-by: Jia-Ju Bai <baijiaju@tsinghua.edu.cn> Signed-off-by: Sean Young <sean@mess.org> Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
media: dvbsky: MyGica T230* receivers also do DVB-C and DVB-T
MyGica T230* receivers also do DVB-C and DVB-T: change their names.
Signed-off-by: Jan Pieter van Woerkom <jp@jpvw.nl> Signed-off-by: Sean Young <sean@mess.org> Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
Arnd Bergmann [Thu, 7 May 2020 21:33:14 +0000 (23:33 +0200)]
media: cxusb-analog: fix V4L2 dependency
CONFIG_DVB_USB_CXUSB_ANALOG is a 'bool' symbol with a dependency on the
tristate CONFIG_VIDEO_V4L2, which means it can be enabled as =y even
when its dependency is =m. This leads to a link failure:
drivers/media/usb/dvb-usb/cxusb-analog.o: In function `cxusb_medion_analog_init':
cxusb-analog.c:(.text+0x92): undefined reference to `v4l2_subdev_call_wrappers'
drivers/media/usb/dvb-usb/cxusb-analog.o: In function `cxusb_medion_register_analog':
cxusb-analog.c:(.text+0x466): undefined reference to `v4l2_device_register'
cxusb-analog.c:(.text+0x4c3): undefined reference to `v4l2_i2c_new_subdev'
cxusb-analog.c:(.text+0x4fb): undefined reference to `v4l2_subdev_call_wrappers'
...
Change the dependency only disallow the analog portion of the driver
in that configuration.
Fixes: e478d4054054 ("media: cxusb: add analog mode support for Medion MD95700") Signed-off-by: Arnd Bergmann <arnd@arndb.de> Signed-off-by: Sean Young <sean@mess.org> Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
Hans Verkuil [Tue, 26 May 2020 08:59:53 +0000 (10:59 +0200)]
media: videodev2.h: add V4L2_FMT_FLAG_ENC_CAP_FRAME_INTERVAL flag
Add the V4L2_FMT_FLAG_ENC_CAP_FRAME_INTERVAL flag to signal that
the coded frame interval can be set separately from the raw frame
interval for stateful encoders.
Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl> Reviewed-by: Michael Tretter <m.tretter@pengutronix.de> Acked-by: Tomasz Figa <tfiga@chromium.org> Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
Tomasz Figa [Tue, 19 Nov 2019 11:34:57 +0000 (12:34 +0100)]
media: docs-rst: Document memory-to-memory video encoder interface
Due to complexity of the video encoding process, the V4L2 drivers of
stateful encoder hardware require specific sequences of V4L2 API calls
to be followed. These include capability enumeration, initialization,
encoding, encode parameters change, drain and reset.
Specifics of the above have been discussed during Media Workshops at
LinuxCon Europe 2012 in Barcelona and then later Embedded Linux
Conference Europe 2014 in Düsseldorf. The de facto Codec API that
originated at those events was later implemented by the drivers we already
have merged in mainline, such as s5p-mfc or coda.
The only thing missing was the real specification included as a part of
Linux Media documentation. Fix it now and document the encoder part of
the Codec API.
Signed-off-by: Tomasz Figa <tfiga@chromium.org> Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl> Reviewed-by: Michael Tretter <m.tretter@pengutronix.de> Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>