Dan Carpenter [Thu, 11 Apr 2019 09:01:57 +0000 (05:01 -0400)]
media: omap_vout: potential buffer overflow in vidioc_dqbuf()
The "b->index" is a u32 the comes from the user in the ioctl. It hasn't
been checked. We aren't supposed to use it but we're instead supposed
to use the value that gets written to it when we call videobuf_dqbuf().
The videobuf_dqbuf() first memsets it to zero and then re-initializes it
inside the videobuf_status() function. It's this final value which we
want.
Hans Verkuil pointed out that we need to check the return from
videobuf_dqbuf(). I ended up doing a little cleanup related to that as
well.
Fixes: 72915e851da9 ("[media] V4L2: OMAP: VOUT: dma map and unmap v4l2 buffers in qbuf and dqbuf") Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com> Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl> Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
The subsystem will free the asd memory on notifier cleanup, if the asd is
added to the notifier.
However the memory is freed using kfree.
Thus, we cannot allocate the asd using devm_*
This can lead to crashes and problems.
To test this issue, just return an error at probe, but cleanup the
notifier beforehand.
Fixes: 106267444f ("[media] atmel-isc: add the Image Sensor Controller code") Signed-off-by: Eugen Hristev <eugen.hristev@microchip.com> Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl> Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
In case the completion function failes, unbind will be called
which will call cancel_work for awb_work.
This will trigger a WARN message from the workqueue.
To avoid this, move the INIT_WORK call at the start of the completion
function. This way the work is always initialized, which corresponds
to the 'always canceled' unbind code.
Fixes: 93d4a26c3d ("[media] atmel-isc: add the isc pipeline function") Signed-off-by: Eugen Hristev <eugen.hristev@microchip.com> Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl> Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
Eugen Hristev [Fri, 12 Apr 2019 10:19:40 +0000 (06:19 -0400)]
media: atmel: atmel-isc: limit incoming pixels per frame
This will limit the incoming pixels per frame from the sensor.
Currently, the ISC will stop sampling the frame only when the vsync/hsync
are detected.
If we misconfigure the resolution in the sensor w.r.t. resolution in the ISC,
the buffer used for DMA in the ISC will be smaller than the number of pixels
that the ISC DMA engine will copy.
In this case it happens that the DMA will overwrite parts of the memory which
should not be written, leading to memory corruption.
To avoid this situation, use the PFE CFG1 and PFE CFG2 registers, which crop
the incoming frame to the resolution that we configure.
This way the DMA engine will never write more data than we expect it to.
Signed-off-by: Eugen Hristev <eugen.hristev@microchip.com> Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl> Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
Missed documenting this property in the initial commit.
Signed-off-by: Eddie James <eajames@linux.ibm.com> Reviewed-by: Rob Herring <robh@kernel.org> Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl> Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
Eddie James [Wed, 24 Apr 2019 15:16:58 +0000 (11:16 -0400)]
media: platform: Aspeed: Make reserved memory optional
Reserved memory doesn't need to be required; system memory would work
fine.
Signed-off-by: Eddie James <eajames@linux.ibm.com> Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl> Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
Eddie James [Wed, 24 Apr 2019 15:16:57 +0000 (11:16 -0400)]
media: platform: Aspeed: Remove use of reset line
The reset line is toggled by enabling the clocks, so it's not necessary
to manually toggle the reset as well.
Signed-off-by: Eddie James <eajames@linux.ibm.com> Reviewed-by: Joel Stanley <joel@jms.id.au> Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl> Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
Laurent Pinchart [Thu, 28 Mar 2019 05:31:32 +0000 (01:31 -0400)]
media: vsp1: Add support for missing 16-bit RGB555 formats
Add support for the V4L2_PIX_FMT_RGBA555, V4L2_PIX_FMT_RGBX555,
V4L2_PIX_FMT_ABGR555, V4L2_PIX_FMT_XBGR555, V4L2_PIX_FMT_BGRA555 and
V4L2_PIX_FMT_BGRX555 formats to the VSP driver.
Laurent Pinchart [Thu, 28 Mar 2019 05:31:32 +0000 (01:31 -0400)]
media: vsp1: Add support for missing 16-bit RGB444 formats
Add support for the V4L2_PIX_FMT_RGBA444, V4L2_PIX_FMT_RGBX444,
V4L2_PIX_FMT_ABGR444, V4L2_PIX_FMT_XBGR444, V4L2_PIX_FMT_BGRA444 and
V4L2_PIX_FMT_BGRX444 formats to the VSP driver.
Laurent Pinchart [Thu, 28 Mar 2019 05:23:54 +0000 (01:23 -0400)]
media: v4l: Add definitions for missing 16-bit RGB555 formats
The V4L2 API is missing the 16-bit RGB555 formats for the RGBA, RGBX,
ABGR, XBGR, BGRA and BGRX component orders. Add them, using the same
4CCs as DRM.
Laurent Pinchart [Thu, 28 Mar 2019 05:23:54 +0000 (01:23 -0400)]
media: v4l: Add definitions for missing 16-bit RGB4444 formats
The V4L2 API is missing the 16-bit RGB4444 formats for the RGBA, RGBX,
ABGR, XBGR, BGRA and BGRX component orders. Add them, using the same
4CCs as DRM.
The Amlogic G12A SoC embeds a second CEC controller with a totally
different design.
The two controller can work in the same time since the CEC line can
be set to two different pins on the two controllers.
This second CEC controller is documented as "AO-CEC-B", thus the
registers will be named "CECB_" to differentiate with the other
AO-CEC driver.
Unlike the other AO-CEC controller, this one takes the Oscillator
clock as input and embeds a dual-divider to provide a precise
32768Hz clock for communication. This is handled by registering
a clock in the driver.
Unlike the other AO-CEC controller, this controller supports setting
up to 15 logical addresses and supports the signal_free_time settings
in the transmit function.
Unfortunately, this controller does not support "monitor" mode.
Signed-off-by: Neil Armstrong <narmstrong@baylibre.com> Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl> Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
The Amlogic G12A embeds a second CEC controller named AO-CEC-B, and
the other one is AO-CEC-A described by the current bindings.
The register interface is very close but the internal architecture
is totally different.
The other difference is the clock source, the AO-CEC-B takes the
"oscin", the Always-On Oscillator clock, as input and embeds a
dual-divider clock divider to provide the precise 32768Hz base
clock for CEC communication.
Signed-off-by: Neil Armstrong <narmstrong@baylibre.com> Reviewed-by: Rob Herring <robh@kernel.org> Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl> Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
The CrosEC CEC driver never decremented the HDMI device refcount.
CEC drivers only need the HDMI device pointer as a key in the
notifier list, it never accesses the device, so there is no
need to keep a reference.
Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl> Reviewed-by: Neil Armstrong <narmstrong@baylibre.com> Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
Hans Verkuil [Wed, 10 Apr 2019 09:13:33 +0000 (05:13 -0400)]
media: seco-cec: decrement HDMI device refcount
The SECO CEC driver never decremented the HDMI device refcount.
CEC drivers only need the HDMI device pointer as a key in the
notifier list, it never accesses the device, so there is no
need to keep a reference.
Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl> Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
Hans Verkuil [Wed, 10 Apr 2019 09:13:32 +0000 (05:13 -0400)]
media: tegra_cec: use new cec_notifier_parse_hdmi_phandle helper
The Tegra CEC driver increased the HDMI device refcount when
it shouldn't. Use the new helper function to ensure that that
doesn't happen and to simplify the driver code.
Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl> Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
Hans Verkuil [Wed, 10 Apr 2019 09:13:31 +0000 (05:13 -0400)]
media: stih_cec: use new cec_notifier_parse_hdmi_phandle helper
The STI CEC driver increased the HDMI device refcount when
it shouldn't. Use the new helper function to ensure that that
doesn't happen and to simplify the driver code.
Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl> Acked-by: Benjamin Gaignard <benjamin.gaignard@linaro.org> Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
Hans Verkuil [Wed, 10 Apr 2019 09:13:30 +0000 (05:13 -0400)]
media: s5p_cec: use new cec_notifier_parse_hdmi_phandle helper
The S5P CEC driver increased the HDMI device refcount when
it shouldn't. Use the new helper function to ensure that that
doesn't happen and to simplify the driver code.
Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl> Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
Hans Verkuil [Wed, 10 Apr 2019 09:13:29 +0000 (05:13 -0400)]
media: meson: ao-cec: use new cec_notifier_parse_hdmi_phandle helper
The meson CEC driver increased the HDMI device refcount when
it shouldn't. Use the new helper function to ensure that that
doesn't happen and to simplify the driver code.
Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl> Acked-by: Neil Armstrong <narmstrong@baylibre.com> Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
Add helper function to parse the DT for the hdmi-phandle property
and return the corresponding struct device pointer.
It takes care to avoid increasing the device refcount since all
we need is the device pointer. This pointer is used in the
notifier list as a key, but it is never accessed by the CEC driver.
Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl> Reported-by: Wen Yang <wen.yang99@zte.com.cn> Acked-by: Wen Yang <wen.yang99@zte.com.cn> Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
Arnd Bergmann [Wed, 13 Mar 2019 21:18:07 +0000 (17:18 -0400)]
media: seco-cec: fix building with RC_CORE=m
I previously added an RC_CORE dependency here, but missed the corner
case of CONFIG_VIDEO_SECO_CEC=y with CONFIG_RC_CORE=m, which still
causes a link error:
drivers/media/platform/seco-cec/seco-cec.o: In function `secocec_probe':
seco-cec.c:(.text+0x1b8): undefined reference to `devm_rc_allocate_device'
seco-cec.c:(.text+0x2e8): undefined reference to `devm_rc_register_device'
drivers/media/platform/seco-cec/seco-cec.o: In function `secocec_irq_handler':
seco-cec.c:(.text+0xa2c): undefined reference to `rc_keydown'
Refine the dependency to disallow building the RC subdriver in this case.
This is the same logic we apply in other drivers like it.
Yizhuo [Wed, 30 Jan 2019 17:33:30 +0000 (12:33 -0500)]
media: ts2020: Variable "utmp" in function ts2020_set_tuner_rf() could be uninitialized
In function ts2020_set_tuner_rf(), local variable "utmp" could
be uninitialized if function regmap_read() returns -EINVAL.
However, this value is used in if statement and written to
the register, which is potentially unsafe.
Signed-off-by: Yizhuo <yzhai003@ucr.edu> Signed-off-by: Sean Young <sean@mess.org> Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
Matthias Reichl [Sun, 24 Mar 2019 09:43:51 +0000 (05:43 -0400)]
media: rc: xbox_remote: add protocol and set timeout
The timestamps in ir-keytable -t output showed that the Xbox DVD
IR dongle decodes scancodes every 64ms. The last scancode of a
longer button press is decodes 64ms after the last-but-one which
indicates the decoder doesn't use a timeout but decodes on the last
edge of the signal.
267.042629: lirc protocol(unknown): scancode = 0xace
267.042665: event type EV_MSC(0x04): scancode = 0xace
267.042665: event type EV_KEY(0x01) key_down: KEY_1(0x0002)
267.042665: event type EV_SYN(0x00).
267.106625: lirc protocol(unknown): scancode = 0xace
267.106643: event type EV_MSC(0x04): scancode = 0xace
267.106643: event type EV_SYN(0x00).
267.170623: lirc protocol(unknown): scancode = 0xace
267.170638: event type EV_MSC(0x04): scancode = 0xace
267.170638: event type EV_SYN(0x00).
267.234621: lirc protocol(unknown): scancode = 0xace
267.234636: event type EV_MSC(0x04): scancode = 0xace
267.234636: event type EV_SYN(0x00).
267.298623: lirc protocol(unknown): scancode = 0xace
267.298638: event type EV_MSC(0x04): scancode = 0xace
267.298638: event type EV_SYN(0x00).
267.543345: event type EV_KEY(0x01) key_down: KEY_1(0x0002)
267.543345: event type EV_SYN(0x00).
267.570015: event type EV_KEY(0x01) key_up: KEY_1(0x0002)
267.570015: event type EV_SYN(0x00).
Add a protocol with the repeat value and set the timeout in the
driver to 10ms (to have a bit of headroom for delays) so the Xbox
DVD remote performs more responsive.
Signed-off-by: Matthias Reichl <hias@horus.com> Acked-by: Benjamin Valentin <benpicco@googlemail.com> Signed-off-by: Sean Young <sean@mess.org> Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
Niklas Söderlund [Tue, 12 Mar 2019 23:50:18 +0000 (19:50 -0400)]
media: rcar-csi2: Update start procedure for H3 ES2
Latest information from hardware engineers reveals that H3 ES2 and ES3
behave differently when working with link speeds bellow 250 Mpbs.
Add a SoC match for H3 ES2.* and use the correct startup sequence.
Niklas Söderlund [Tue, 12 Mar 2019 23:49:30 +0000 (19:49 -0400)]
media: rcar-csi2: Use standby mode instead of resetting
Later versions of the datasheet updates the reset procedure to more
closely resemble the standby mode. Update the driver to enter and exit
the standby mode instead of resetting the hardware before and after
streaming is started and stopped. This replaces the software reset
(SRST.SRST) control.
While at it break out the full start and stop procedures from
rcsi2_s_stream() into the existing helper functions.
Niklas Söderlund [Tue, 12 Mar 2019 23:49:29 +0000 (19:49 -0400)]
media: dt-bindings: rcar-csi2: List resets as a mandatory property
The resets property will become mandatory to operate the device, list it
as such. All device tree source files have always included the reset
property so making it mandatory will not introduce any regressions.
While at it improve the description for the clocks property.
Philipp Zabel [Mon, 8 Apr 2019 12:32:55 +0000 (08:32 -0400)]
media: coda: throw error on create_bufs with too small size
If VIDIOC_CREATE_BUFS is called with a sizeimage smaller than the
queue sizeimage, fail with -EINVAL instead of correcting the size
and continuing without error. This is required by v4l2-compliance.
Signed-off-by: Philipp Zabel <p.zabel@pengutronix.de> Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl> Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
Philipp Zabel [Mon, 8 Apr 2019 12:32:54 +0000 (08:32 -0400)]
media: coda: allow encoder to set colorimetry on the output queue
v4l2-compliance sets colorimetry on the output queue and then verifies
that querying colorimetry on the capture queue returns the same
configuration. For this to work, the encoder must allow setting context
colorimetry parameters on the output queue.
Signed-off-by: Philipp Zabel <p.zabel@pengutronix.de> Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl> Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
Philipp Zabel [Mon, 8 Apr 2019 12:32:50 +0000 (08:32 -0400)]
media: coda: add min number of buffers controls
Add min number of buffers for capture (decoder) and output (encoder)
controls, which are required by the stateful video decoder / encoder
interface specification.
Signed-off-by: Philipp Zabel <p.zabel@pengutronix.de> Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl> Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
Philipp Zabel [Mon, 8 Apr 2019 12:32:49 +0000 (08:32 -0400)]
media: coda: clear error return value before picture run
The error return value is not written by some firmware codecs, such as
MPEG-2 decode on CodaHx4. Clear the error return value before starting
the picture run to avoid misinterpreting unrelated values returned by
sequence initialization as error return value.
Signed-off-by: Philipp Zabel <p.zabel@pengutronix.de> Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl> Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
Philipp Zabel [Mon, 8 Apr 2019 12:32:47 +0000 (08:32 -0400)]
media: coda: set codec earlier
The chosen codec depends on the coded format, which is known as soon as
the S_FMT call on the coded queue. This allows to use the codec in
callbacks that may be called before start_streaming, such as buf_queue.
Signed-off-by: Philipp Zabel <p.zabel@pengutronix.de> Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl> Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
Hans Verkuil [Mon, 19 Nov 2018 11:09:00 +0000 (06:09 -0500)]
media: vb2: add waiting_in_dqbuf flag
Calling VIDIOC_DQBUF can release the core serialization lock pointed to
by vb2_queue->lock if it has to wait for a new buffer to arrive.
However, if userspace dup()ped the video device filehandle, then it is
possible to read or call DQBUF from two filehandles at the same time.
It is also possible to call REQBUFS from one filehandle while the other
is waiting for a buffer. This will remove all the buffers and reallocate
new ones. Removing all the buffers isn't the problem here (that's already
handled correctly by DQBUF), but the reallocating part is: DQBUF isn't
aware that the buffers have changed.
This is fixed by setting a flag whenever the lock is released while waiting
for a buffer to arrive. And checking the flag where needed so we can return
-EBUSY.
Signed-off-by: Hans Verkuil <hverkuil@xs4all.nl> Reported-by: Syzbot <syzbot+4180ff9ca6810b06c1e9@syzkaller.appspotmail.com> Reviewed-by: Tomasz Figa <tfiga@chromium.org> Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl> Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
Dan Carpenter [Mon, 8 Apr 2019 09:52:38 +0000 (05:52 -0400)]
media: pvrusb2: Prevent a buffer overflow
The ctrl_check_input() function is called from pvr2_ctrl_range_check().
It's supposed to validate user supplied input and return true or false
depending on whether the input is valid or not. The problem is that
negative shifts or shifts greater than 31 are undefined in C. In
practice with GCC they result in shift wrapping so this function returns
true for some inputs which are not valid and this could result in a
buffer overflow:
drivers/media/usb/pvrusb2/pvrusb2-ctrl.c:205 pvr2_ctrl_get_valname()
warn: uncapped user index 'names[val]'
The cptr->hdw->input_allowed_mask mask is configured in pvr2_hdw_create()
and the highest valid bit is BIT(4).
Fixes: 7fb20fa38caa ("V4L/DVB (7299): pvrusb2: Improve logic which handles input choice availability") Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com> Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl> Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
Currently, MEDIA_IOC_G_TOPOLOGY ioctl on cedrus fails due to incorrect
initialization order. Fix that by moving video_register_device() before
v4l2_m2m_register_media_controller() and while at it, fix error path.
Reported-by: Jonas Karlman <jonas@kwiboo.se> Signed-off-by: Jernej Skrabec <jernej.skrabec@siol.net> Acked-by: Paul Kocialkowski <paul.kocialkowski@bootlin.com> Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl> Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
media: vivid: use vfree() instead of kfree() for dev->bitmap_cap
syzkaller reported crashes on kfree() called from
vivid_vid_cap_s_selection(). This looks like a simple typo, as
dev->bitmap_cap is allocated with vzalloc() throughout the file.
Fixes: ef834f7836ec0 ("[media] vivid: add the video capture and output
parts")
Signed-off-by: Alexander Potapenko <glider@google.com> Reported-by: Syzbot <syzbot+6c0effb5877f6b0344e2@syzkaller.appspotmail.com> Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl> Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
Hans Verkuil [Mon, 1 Apr 2019 12:41:58 +0000 (08:41 -0400)]
media: videobuf2-v4l2.c: move up STATE_DEQUEUED check
If a buffer is queued to a request, followed by an attempt to queue
the same buffer again, then the second qbuf returns an error since
the buffer is not in the DEQUEUED state anymore.
However, before it gets to that check it executes the code under the
'if (!vb->prepared)' condition. This clears previously set data needed
for request handling, and now querybuf will no longer report that this
buffer is part of a request.
Move the state check to before the 'if' and make sure to only do the
state check when called from QBUF and if V4L2_BUF_FLAG_REQUEST_FD is
set.
Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl> Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
media: mtk-vcodec: fix vp9 content playback error with show exist frame
Update referenced frame buffer's reference count when playing vp9
content which has show_existing_frame flag, and copy enough buffer
data to current shown frame.
Current ImgU driver processes and releases the parameter buffer
immediately after queued from user. This does not align with other
image buffers which are grouped in sets and used for the same frame.
If user queues multiple parameter buffers continuously, only the last
one will take effect.
To make consistent buffers usage, this patch changes the parameter
buffer handling and group parameter buffer with other image buffers
for each frame.
Each time driver will queue one more group of buffers when previous
frame processed and buffers consumed by css.
Signed-off-by: Tianshu Qiu <tian.shu.qiu@intel.com> Signed-off-by: Bingbu Cao <bingbu.cao@intel.com> Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com> Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
Akinobu Mita [Sat, 30 Mar 2019 14:01:31 +0000 (10:01 -0400)]
media: ov2659: make S_FMT succeed even if requested format doesn't match
This driver returns an error if unsupported media bus pixel code is
requested by VIDIOC_SUBDEV_S_FMT.
But according to Documentation/media/uapi/v4l/vidioc-subdev-g-fmt.rst,
Drivers must not return an error solely because the requested format
doesn't match the device capabilities. They must instead modify the
format to match what the hardware can provide.
So select default format code and return success in that case.
media: ov6650: Move v4l2_clk_get() to ov6650_video_probe() helper
In preparation for adding asynchronous subdevice support to the driver,
don't acquire v4l2_clk from the driver .probe() callback as that may
fail if the clock is provided by a bridge driver which may be not yet
initialized. Move the v4l2_clk_get() to ov6650_video_probe() helper
which is going to be converted to v4l2_subdev_internal_ops.registered()
callback, executed only when the bridge driver is ready.
Signed-off-by: Janusz Krzysztofik <jmkrzyszt@gmail.com> Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com> Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
media: ov6650: Fix sensor possibly not detected on probe
After removal of clock_start() from before soc_camera_init_i2c() in
soc_camera_probe() by commit 9aea470b399d ("[media] soc-camera: switch
I2C subdevice drivers to use v4l2-clk") introduced in v3.11, the ov6650
driver could no longer probe the sensor successfully because its clock
was no longer turned on in advance. The issue was initially worked
around by adding that missing clock_start() equivalent to OMAP1 camera
interface driver - the only user of this sensor - but a propoer fix
should be rather implemented in the sensor driver code itself.
Fix the issue by inserting a delay between the clock is turned on and
the sensor I2C registers are read for the first time.
Tested on Amstrad Delta with now out of tree but still locally
maintained omap1_camera host driver.
Fixes: 9aea470b399d ("[media] soc-camera: switch I2C subdevice drivers to use v4l2-clk") Signed-off-by: Janusz Krzysztofik <jmkrzyszt@gmail.com> Cc: stable@vger.kernel.org Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com> Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
Fix media_devnode_unregister() to clear devnode->media_dev while holding
media_devnode_lock. media_devnode_register()'s cdev_add_error handling
does this correctly.
media: au0828: Fix NULL pointer dereference in au0828_analog_stream_enable()
Fix au0828_analog_stream_enable() to check if device is in the right
state first. When unbind happens while bind is in progress, usbdev
pointer could be invalid in au0828_analog_stream_enable() and a call
to usb_ifnum_to_if() will result in the null pointer dereference.
This problem is found with the new media_dev_allocator.sh test.
Media Device Allocator API to allows multiple drivers share a media device.
This API solves a very common use-case for media devices where one physical
device (an USB stick) provides both audio and video. When such media device
exposes a standard USB Audio class, a proprietary Video class, two or more
independent drivers will share a single physical USB bridge. In such cases,
it is necessary to coordinate access to the shared resource.
Using this API, drivers can allocate a media device with the shared struct
device as the key. Once the media device is allocated by a driver, other
drivers can get a reference to it. The media device is released when all
the references are released.
This test does a series of unbind/bind tests to make sure media device
is released correctly when it is no longer is use and when the last
driver releases the reference.
media: au0828: fix enable and disable source audio and video inconsistencies
Enable and disable source interfaces aren't consistent in enforcing
how video and audio share the tuner resource.
Fix these issues to enforce the following rules and allow
sharing between audio and video applications.
- When DVB is streaming, audio/video/vbi/s-video/composite
should find the resource busy. DVB holds the tuner in
exclusive mode.
- When video/VBI is streaming, audio can share the tuner and vice versa.
- v4l2 allows multiple applications to open video device.
- Video applications call enable source multiple times during their
run-time. Resource should stay locked until the last application
releases it.
- A shared resource should stay in shared state and locked when it is
in use by audio and video. More than one video application is allowed
to use the tuner as long as video streaming protocol allows such usage.
Resource is released when the last video/audio application releases it.
- S-Video and Composite hold the resource in exclusive mode.
media: sound/usb: Use Media Controller API to share media resources
Media Device Allocator API to allows multiple drivers share a media device.
This API solves a very common use-case for media devices where one physical
device (an USB stick) provides both audio and video. When such media device
exposes a standard USB Audio class, a proprietary Video class, two or more
independent drivers will share a single physical USB bridge. In such cases,
it is necessary to coordinate access to the shared resource.
Using this API, drivers can allocate a media device with the shared struct
device as the key. Once the media device is allocated by a driver, other
drivers can get a reference to it. The media device is released when all
the references are released.
Change the ALSA driver to use the Media Controller API to share media
resources with DVB, and V4L2 drivers on a AU0828 media device.
The Media Controller specific initialization is done after sound card is
registered. ALSA creates Media interface and entity function graph nodes
for Control, Mixer, PCM Playback, and PCM Capture devices.
snd_usb_hw_params() will call Media Controller enable source handler
interface to request the media resource. If resource request is granted,
it will release it from snd_usb_hw_free(). If resource is busy, -EBUSY is
returned.
Media specific cleanup is done in usb_audio_disconnect().
Move PCM_CAPTURE, PCM_PLAYBACK, and CONTROL ALSA MEDIA_INTF_T* interface
types back into __KERNEL__ scope to get ready for adding ALSA support for
these to the media controller.
media: change au0828 to use Media Device Allocator API
Media Device Allocator API to allows multiple drivers share a media device.
This API solves a very common use-case for media devices where one physical
device (an USB stick) provides both audio and video. When such media device
exposes a standard USB Audio class, a proprietary Video class, two or more
independent drivers will share a single physical USB bridge. In such cases,
it is necessary to coordinate access to the shared resource.
Using this API, drivers can allocate a media device with the shared struct
device as the key. Once the media device is allocated by a driver, other
drivers can get a reference to it. The media device is released when all
the references are released.
Change au0828 to use Media Device Allocator API to allocate media device
with the parent usb struct device as the key, so it can be shared with the
snd_usb_audio driver.
Media Device Allocator API to allows multiple drivers share a media device.
This API solves a very common use-case for media devices where one physical
device (an USB stick) provides both audio and video. When such media device
exposes a standard USB Audio class, a proprietary Video class, two or more
independent drivers will share a single physical USB bridge. In such cases,
it is necessary to coordinate access to the shared resource.
Using this API, drivers can allocate a media device with the shared struct
device as the key. Once the media device is allocated by a driver, other
drivers can get a reference to it. The media device is released when all
the references are released.
Colin Ian King [Sat, 30 Mar 2019 15:25:03 +0000 (11:25 -0400)]
media: dvb: clean up redundant break statements
There are several places where a break statement occurs before
a following break statement; these are unnecessary and can be
removed to clean up the code a little.
Signed-off-by: Colin Ian King <colin.king@canonical.com> Reviewed-by: Mukesh Ojha <mojha@codeaurora.org> Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl> Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
The image renderer (IMR), or the distortion correction engine, is a
drawing processor with a simple instruction system capable of referencing
video capture data or data in an external memory as the 2D texture data
and performing texture mapping and drawing with respect to any shape that
is split into triangular objects.
Document the device tree bindings for the image renderer light extended 4
(IMR-LX4) found in the R-Car gen3 SoCs...
Signed-off-by: Sergei Shtylyov <sergei.shtylyov@cogentembedded.com> Acked-by: Rob Herring <robh@kernel.org> Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl> Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
Helen Fornazier [Wed, 13 Mar 2019 18:29:37 +0000 (14:29 -0400)]
media: vimc: propagate pixel format in the stream
Media bus codes were being mapped to pixelformats, which causes a
limitation on vimc because not all pixelformats can be mapped to media
bus codes.
Also, media bus codes are an internal configuration from the device.
Userspace only assures media bus codes matches between pads and expects
the image in a given pixelformat. So we can allow almost any media bus
format to be configured between pads, except for debayer that expects a
media bus code of type bayer in the sink pad.
[hverkuil-cisco@xs4all.nl: drop use of v4l2_get_fourcc_name: not yet available]
[hverkuil-cisco@xs4all.nl: made vimc_mbus_list static]
Signed-off-by: Helen Koike <helen.koike@collabora.com> Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl> Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
Ezequiel Garcia [Thu, 28 Mar 2019 18:07:03 +0000 (14:07 -0400)]
media: rockchip/vpu: Rename pixel format helpers
The rockchip VPU driver uses generic names for its pixel format
helpers. We want to use the same names for generic versions
of these helpers, so rename the rockchip ones.
The driver will be switched to the generic helpers later.
Yannick Fertre [Fri, 29 Mar 2019 12:39:42 +0000 (08:39 -0400)]
media: platform: stm32: wait end of transmission
It is mandatory to write CEC_CFGR only when CECEN=0. To protect
transmission, a check have been added to delayed logical address
modification. This patch is necessary tp pass all tests of compliance.
Signed-off-by: Yannick Fertré <yannick.fertre@st.com> Reviewed-by: Benjamin Gaignard <benjamin.gaignard@linaro.org> Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl> Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
Eugen Hristev [Fri, 29 Mar 2019 07:38:31 +0000 (03:38 -0400)]
media: atmel: atmel-isc: removed ARGB32 added ABGR32 and XBGR32
ISC will output the "ARGB32" configuration in byte order: B, G, R, Alpha.
This is in fact the format BGRA, aka ABGR32.
If alpha is missing, the same format is equivalent to XBGR32.
Added both formats and removed ARGB32 which is wrong.
Signed-off-by: Eugen Hristev <eugen.hristev@microchip.com> Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl> Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
Eugen Hristev [Fri, 29 Mar 2019 07:38:28 +0000 (03:38 -0400)]
media: atmel: atmel-isc: reworked driver and formats
This change is a redesign in the formats and the way the ISC is
configured w.r.t. sensor format and the output format from the ISC.
I have changed the splitting between sensor output (which is also ISC input)
and ISC output.
The sensor format represents the way the sensor is configured, and what ISC
is receiving.
The format configuration represents the way ISC is interpreting the data and
formatting the output to the subsystem.
Now it's much easier to figure out what is the ISC configuration for input, and
what is the configuration for output.
The non-raw format can be obtained directly from sensor or it can be done
inside the ISC. The controller format list will include a configuration for
each format.
The old supported formats are still in place, if we want to dump the sensor
format directly to the output, the try format routine will detect and
configure the pipeline accordingly.
This also fixes the previous issues when the raw format was NULL which
resulted in many crashes for sensors which did not have the expected/tested
formats.
Signed-off-by: Eugen Hristev <eugen.hristev@microchip.com> Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl> Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
Fish Lin [Fri, 29 Mar 2019 03:20:46 +0000 (23:20 -0400)]
media: v4l: add I / P frame min max QP definitions
Add following V4L2 QP parameters for H.264:
* V4L2_CID_MPEG_VIDEO_H264_I_FRAME_MIN_QP
* V4L2_CID_MPEG_VIDEO_H264_I_FRAME_MAX_QP
* V4L2_CID_MPEG_VIDEO_H264_P_FRAME_MIN_QP
* V4L2_CID_MPEG_VIDEO_H264_P_FRAME_MAX_QP
These controls will limit QP range for intra and inter frame,
provide more manual control to improve video encode quality.
Signed-off-by: Fish Lin <linfish@google.com> Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl> Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
Akinobu Mita [Mon, 18 Mar 2019 15:25:43 +0000 (11:25 -0400)]
media: ov7740: enable to get exposure control in autoexposure mode
The exposure control is clustered with the autoexposure control and
flagged as volatile, but the g_volatile_ctrl() doesn't handle
V4L2_CID_EXPOSURE_AUTO. So, the value of the exposure control can't be
read in autoexposure mode.
This enables to get the exposure control in autoexposure mode by making
ov7740_get_volatile_ctrl() deal with V4L2_CID_EXPOSURE_AUTO.
This also sets the exposure control as volatile by specifying the
argument to v4l2_ctrl_auto_cluster() instead of manually flagging it.
Cc: Wenyou Yang <wenyou.yang@microchip.com> Cc: Eugen Hristev <eugen.hristev@microchip.com> Signed-off-by: Akinobu Mita <akinobu.mita@gmail.com> Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com> Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
Dan Carpenter [Tue, 26 Mar 2019 05:12:07 +0000 (01:12 -0400)]
media: wl128x: prevent two potential buffer overflows
Smatch marks skb->data as untrusted so it warns that "evt_hdr->dlen"
can copy up to 255 bytes and we only have room for two bytes. Even
if this comes from the firmware and we trust it, the new policy
generally is just to fix it as kernel hardenning.
I can't test this code so I tried to be very conservative. I considered
not allowing "evt_hdr->dlen == 1" because it doesn't initialize the
whole variable but in the end I decided to allow it and manually
initialized "asic_id" and "asic_ver" to zero.
Fixes: e8454ff7b9a4 ("[media] drivers:media:radio: wl128x: FM Driver Common sources") Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com> Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl> Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
projects / mirror_ubuntu-eoan-kernel.git / log