The vimc_ent_type structure contains static pointers to functions, and
no other information that need to be modified after initialization. Make
them const to avoid the risk of arbitrary code execution following an
overflow that would overwrite the structure's contents.
Signed-off-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
Signed-off-by: Shuah Khan <skhan@linuxfoundation.org>
Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
- Conversion of max9286 and adv748x to V4L2 subdev active state
- Cleanups and fixes for the Renesas R-Car VSP and VIN drivers
- Miscellaneous cleanups to V4L2 core
Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
Fix flags in X1 Yoga example. MEDIA_LNK_FL_DYNAMIC (0x4 in the link flag)
was removed in V4 Intel IPU6 and IPU6 input system drivers. Added -V flag
to media-ctl commands for X1 Yoga, lower-case v only makes it verbose
upper-case V sets the format.
Signed-off-by: Samuel Wein <sam@samwein.com>
[Sakari Ailus: Align subject line, rewrap commit message.]
Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
smatch generated this warning:
drivers/media/usb/b2c2/flexcop-usb.c:199 flexcop_usb_memory_req() warn: iterator 'i' not incremented
and indeed the function is not using i or updating buf.
The reason this always worked is that this function is called to write just
6 bytes (a MAC address) to the USB device, and so in practice there is only
a single chunk written. If we ever would need to write more than one chunk,
this function would fail since each chunk would read from or write to the
same buf address.
Rewrite the function to properly handle this.
Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
Enable documentation for v4l2-jpeg header related helper functions which
are useful for parsing jpeg files while decoding or creating jpeg headers
while encoding.
Signed-off-by: Devarsh Thakkar <devarsht@ti.com>
Signed-off-by: Sebastian Fricke <sebastian.fricke@collabora.com>
Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
Export reference quantization and huffman tables as provided in ITU-T.81 so
that they can be re-used by other JPEG drivers.
These are example tables provided in ITU-T.81 as reference tables and the
JPEG encoders are free to use either these or their own proprietary tables.
Also add necessary prefixes to be used for huffman tables in global header
file.
Signed-off-by: Devarsh Thakkar <devarsht@ti.com>
Reviewed-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
Signed-off-by: Sebastian Fricke <sebastian.fricke@collabora.com>
Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
Add dt-bindings for Imagination E5010 JPEG Encoder [1] which is implemented
as stateful V4L2 M2M driver.
The device supports baseline encoding with two different quantization
tables and compression ratio as demanded.
Minimum resolution supported is 64x64 and Maximum resolution supported is
8192x8192.
Link: https://www.ti.com/lit/pdf/spruj16 [1] (Section 7.6 JPEG Encoder)
Co-developed-by: David Huang <d-huang@ti.com>
Signed-off-by: David Huang <d-huang@ti.com>
Signed-off-by: Devarsh Thakkar <devarsht@ti.com>
Reviewed-by: Rob Herring <robh@kernel.org>
Signed-off-by: Sebastian Fricke <sebastian.fricke@collabora.com>
Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
Add initial support for the Wave515 multi-decoder IP. For now it is only
able to decode HEVC Main/Main10 profile videos into YUV420.
This was tested on FPGA prototype, so wave5_dt_ids[] was not expanded.
Users of the real hardware with Wave515 IP will have to
* provide firmware specific to their SoC
* add struct wave5_match_data like this:
static const struct wave5_match_data platform_name_wave515_data = {
.flags = WAVE5_IS_DEC,
.fw_name = "cnm/wave515_platform_name_fw.bin",
.sram_size = (71 * 1024),
};
* add item to wave5_dt_ids[] like this:
{
.compatible = "vendor,soc-wave515",
.data = &platform_name_wave515_data,
},
* describe new compatible in
Documentation/devicetree/bindings/media/cnm,wave521c.yaml
Signed-off-by: Ivan Bornyakov <brnkv.i1@gmail.com>
Signed-off-by: Sebastian Fricke <sebastian.fricke@collabora.com>
Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
Move the excessive "sram-size" device-tree property to the device match
data. Also change the SRAM memory allocation strategy, instead of
allocating exactly sram_size bytes, allocate all available SRAM memory
up to sram_size. Add the placeholders wave5_vpu_dec_validate_sec_axi()
and wave5_vpu_enc_validate_sec_axi() to validate that the allocated SRAM
memory is sufficient to decode/encode bitstream with a given resolution.
Signed-off-by: Ivan Bornyakov <brnkv.i1@gmail.com>
Signed-off-by: Sebastian Fricke <sebastian.fricke@collabora.com>
Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
Implement a separate setup routine for interrupts to reduce code
duplication. Also enable interrupts based on vpu_attr->support_encoders
and vpu_attr->support_decoders fields to facilitate support for other
Wave5xx IPs, because not all of them are both encoders and decoders.
Signed-off-by: Ivan Bornyakov <brnkv.i1@gmail.com>
Signed-off-by: Sebastian Fricke <sebastian.fricke@collabora.com>
Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
Add initial support for optional reset lines. For now, simply deassert
resets while probing the driver and assert them back when removing the
driver.
Signed-off-by: Ivan Bornyakov <brnkv.i1@gmail.com>
Signed-off-by: Sebastian Fricke <sebastian.fricke@collabora.com>
Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
Add support for decoding HEVC Main10 profile by scaling the FBC
buffer stride and size by a factor of (bitdepth / 8).
Signed-off-by: Ivan Bornyakov <brnkv.i1@gmail.com>
Signed-off-by: Sebastian Fricke <sebastian.fricke@collabora.com>
Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
In section 4.5.1.5. Initialization, the step 4 may be skipped and
continue with the Capture Setup sequence, so if the capture has been
setup, there is no need to trigger the initial source change event, just
start decoding, and follow the dynamic resolution change flow if the
configured values do not match those parsed by the decoder.
And it won't fail the gstreamer pipeline.
Fixes: b833b17849 ("media: imx-jpeg: notify source chagne event when the first picture parsed")
Signed-off-by: Ming Qian <ming.qian@nxp.com>
Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
If the picture size parsed by decoder is different from those previously
established, it's a normal flow of dynamic resolution change, not an
error case, the log may mislead that some error occurs in decoding, so
remove the error log in this case.
Fixes: 2db16c6ed7 ("media: imx-jpeg: Add V4L2 driver for i.MX8 JPEG Encoder/Decoder")
Signed-off-by: Ming Qian <ming.qian@nxp.com>
Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
The only generic interface to execute asynchronously in the BH context is
tasklet; however, it's marked deprecated and has some design flaws. To
replace tasklets, BH workqueue support was recently added. A BH workqueue
behaves similarly to regular workqueues except that the queued work items
are executed in the BH context.
This patch converts drivers/media/* from tasklet to BH workqueue.
Based on the work done by Tejun Heo <tj@kernel.org>
Signed-off-by: Allen Pais <allen.lkml@gmail.com>
Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
"struct vb2_ops" are not modified in this driver.
Constifying this structure moves some data to a read-only section, so
increase overall security.
On a x86_64, with allmodconfig:
Before:
======
text data bss dec hex filename
36607 1156 0 37763 9383 drivers/media/usb/cx231xx/cx231xx-417.o
After:
=====
text data bss dec hex filename
36735 1016 0 37751 9377 drivers/media/usb/cx231xx/cx231xx-417.o
Signed-off-by: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
syzkaller reported use-after-free in load_firmware_cb() [1].
The reason is because the module allocated a struct tuner in tuner_probe(),
and then the module initialization failed, the struct tuner was released.
A worker which created during module initialization accesses this struct
tuner later, it caused use-after-free.
The process is as follows:
task-6504 worker_thread
tuner_probe <= alloc dvb_frontend [2]
...
request_firmware_nowait <= create a worker
...
tuner_remove <= free dvb_frontend
...
request_firmware_work_func <= the firmware is ready
load_firmware_cb <= but now the dvb_frontend has been freed
To fix the issue, check the dvd_frontend in load_firmware_cb(), if it is
null, report a warning and just return.
[1]:
==================================================================
BUG: KASAN: use-after-free in load_firmware_cb+0x1310/0x17a0
Read of size 8 at addr ffff8000d7ca2308 by task kworker/2:3/6504
Call trace:
load_firmware_cb+0x1310/0x17a0
request_firmware_work_func+0x128/0x220
process_one_work+0x770/0x1824
worker_thread+0x488/0xea0
kthread+0x300/0x430
ret_from_fork+0x10/0x20
Allocated by task 6504:
kzalloc
tuner_probe+0xb0/0x1430
i2c_device_probe+0x92c/0xaf0
really_probe+0x678/0xcd0
driver_probe_device+0x280/0x370
__device_attach_driver+0x220/0x330
bus_for_each_drv+0x134/0x1c0
__device_attach+0x1f4/0x410
device_initial_probe+0x20/0x30
bus_probe_device+0x184/0x200
device_add+0x924/0x12c0
device_register+0x24/0x30
i2c_new_device+0x4e0/0xc44
v4l2_i2c_new_subdev_board+0xbc/0x290
v4l2_i2c_new_subdev+0xc8/0x104
em28xx_v4l2_init+0x1dd0/0x3770
Freed by task 6504:
kfree+0x238/0x4e4
tuner_remove+0x144/0x1c0
i2c_device_remove+0xc8/0x290
__device_release_driver+0x314/0x5fc
device_release_driver+0x30/0x44
bus_remove_device+0x244/0x490
device_del+0x350/0x900
device_unregister+0x28/0xd0
i2c_unregister_device+0x174/0x1d0
v4l2_device_unregister+0x224/0x380
em28xx_v4l2_init+0x1d90/0x3770
The buggy address belongs to the object at ffff8000d7ca2000
which belongs to the cache kmalloc-2k of size 2048
The buggy address is located 776 bytes inside of
2048-byte region [ffff8000d7ca2000, ffff8000d7ca2800)
The buggy address belongs to the page:
page:ffff7fe00035f280 count:1 mapcount:0 mapping:ffff8000c001f000 index:0x0
flags: 0x7ff800000000100(slab)
raw: 07ff800000000100 ffff7fe00049d880 0000000300000003 ffff8000c001f000
raw: 0000000000000000 0000000080100010 00000001ffffffff 0000000000000000
page dumped because: kasan: bad access detected
Memory state around the buggy address:
ffff8000d7ca2200: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
ffff8000d7ca2280: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
>ffff8000d7ca2300: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
^
ffff8000d7ca2380: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
ffff8000d7ca2400: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
==================================================================
[2]
Actually, it is allocated for struct tuner, and dvb_frontend is inside.
Signed-off-by: Chi Zhiling <chizhiling@kylinos.cn>
Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
MT8195 and MT8188 share a similar MDP3 macro-block, with minor
differences - as in, the latter supports a subset of the number
of components supported by the former, but are otherwise handled
in the same way.
Add driver data for MT8188, reusing the already present MT8195
data where possible.
Signed-off-by: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com>
Reviewed-by: Fei Shao <fshao@chromium.org>
Signed-off-by: Sebastian Fricke <sebastian.fricke@collabora.com>
Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
uvcvideo fixes and improvements:
- add/fix quirks
- improve timestamp handling
- improve Power Line Frequency handling
Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
With ARCH=x86, make allmodconfig && make W=1 C=1 reports:
WARNING: modpost: missing MODULE_DESCRIPTION() in drivers/media/rc/rc-core.o
Add the missing invocation of the MODULE_DESCRIPTION() macro.
Signed-off-by: Jeff Johnson <quic_jjohnson@quicinc.com>
Signed-off-by: Sean Young <sean@mess.org>
Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
Some VSP modules initialize their control handler after initializing the
subdev, while some initialize it before. This makes the code
inconsistent and more error prone. Standardize on control initialization
after initializing the subdev.
Signed-off-by: Laurent Pinchart <laurent.pinchart+renesas@ideasonboard.com>
Reviewed-by: Jacopo Mondi <jacopo.mondi+renesas@ideasonboard.com>
To prepare for the removal of the vsp1_entity.state field, pass the
state to all entity operations that needs to access it, instead of
accessing the state from the entity inside the operation handlers. This
lowers the number of accesses to the field.
Signed-off-by: Laurent Pinchart <laurent.pinchart+renesas@ideasonboard.com>
Reviewed-by: Jacopo Mondi <jacopo.mondi+renesas@ideasonboard.com>
checkpatch.pl complains when function arguments are not named:
WARNING: function definition argument 'struct vsp1_entity *' should also have an identifier name
+ void (*configure_stream)(struct vsp1_entity *,
In preparation for reworking some of the vsp1_entity_operations
functions, fix the warnings for the existing ones.
Signed-off-by: Laurent Pinchart <laurent.pinchart+renesas@ideasonboard.com>
Reviewed-by: Jacopo Mondi <jacopo.mondi+renesas@ideasonboard.com>
Entities access various piece of information from the subdev state when
configuring a partition. The same data is available through the
partition structure passed to the .configure_partition() operation. Use
it to avoid accessing the state, which will simplify moving to the V4L2
subdev active state API.
Signed-off-by: Laurent Pinchart <laurent.pinchart+renesas@ideasonboard.com>
Reviewed-by: Jacopo Mondi <jacopo.mondi+renesas@ideasonboard.com>
The DRM pipelines don't partition frames, as the hardware operates
synchronously with the display. The entity operations access
configuration data from the entity state in that case, instead of
accessing the partition structure. This requires special cases in
entity-specific code, increasing the driver complexity.
To prepare for simplifying the code, initialize a single partition for
the DRM pipelines, similarly to how video pipelines create one partition
spanning the full image when partitioning isn't needed. The partition is
allocated statically in the vsp1_drm_pipeline structure instead of
dynamically as for video pipelines, as DRM pipelines are guaranteed to
operate on a single partition.
Signed-off-by: Laurent Pinchart <laurent.pinchart+renesas@ideasonboard.com>
Reviewed-by: Jacopo Mondi <jacopo.mondi+renesas@ideasonboard.com>
Some of the code that handles pipeline configuration assumes that
entities in a pipeline's entities list are sorted from sink to source.
To prepare for using that code with the DRM pipeline, insert the BRx
just before the WPF, and the RPFs at the head of the list.
Signed-off-by: Laurent Pinchart <laurent.pinchart+renesas@ideasonboard.com>
Reviewed-by: Kieran Bingham <kieran.bingham@ideasonboard.com>
Reviewed-by: Jacopo Mondi <jacopo.mondi@ideasonboard.com>
It is useful for debugging purpose to dump a vsp1_pipeline to the kernel
log. Add a new function to do so, and use it when initializing the video
and DRM pipelines.
As __vsp1_pipeline_dump() needs to construct the log message
iteratively, it uses pr_cont(...) (exact equivalent to the more verbose
"printk(KERN_CONT ..."). The function thus can't use dev_dbg() to log
the initial part of the message, for two reasons:
- pr_cont() doesn't seem to work with dev_*(). Even if the format string
passed to dev_*() doesn't end with a '\n', pr_cont() starts a new line
in the log. This behaviour doesn't seem to be clearly documented, and
may or may not be on purpose.
- Messages printed by dev_dbg() may be omitted if dynamic debugging is
enabled. In that case, the continuation messages will still be
printed, leading to confusing log messages.
To still benefit from the dynamic debug infrastructure, we declare a
vsp1_pipeline_dump() macro that uses _dynamic_func_call() when dynamic
debugging is enabled. The whole vsp1_pipeline_dump() call can be
selected at runtime. The __vsp1_pipeline_dump() function then uses a
plain "printk(KERN_DEBUG ...)" to print the message header using the
debug log level, and pr_cont() to print the rest of the message on the
same line.
Signed-off-by: Laurent Pinchart <laurent.pinchart+renesas@ideasonboard.com>
Reviewed-by: Jacopo Mondi <jacopo.mondi+renesas@ideasonboard.com>
The vsp1_partition_window structure is used to store the horizontal size
of a partition window. This is all that is currently needed, as all
partitions span the whole image vertically. The horizontal window size
is retrieved in the .configure_partition() handler from the
vsp1_partition_window structure, and the vertical window size from the
subdev state.
Accessing the subdev state in the .configure_partition() handler is
problematic in the context of moving to the V4L2 subdev active state
API, as .configure_partition() is called in non-interruptable context,
and the state lock can't be taken. To avoid this, start by storing the
vertical size in the window, replacing the custom vsp1_partition_window
structure with a v4l2_rect. Retrieving the vertical size from the window
in .configure_partition() will be done in a subsequent change.
Signed-off-by: Laurent Pinchart <laurent.pinchart+renesas@ideasonboard.com>
Reviewed-by: Jacopo Mondi <jacopo.mondi+renesas@ideasonboard.com>
The entity .configure_partition() function operates on a partition, and
has to retrieve that partition from the pipeline's current partition
field. Pass the partition pointer to the function to make it clearer
what partition it operates on, and remove the vsp1_pipeline.partition
field.
This change clearly shows that the DRM pipeline doesn't use partitions,
which makes entity implementation more complex and error-prone. This
will be addressed in a further cleanup.
Signed-off-by: Laurent Pinchart <laurent.pinchart+renesas@ideasonboard.com>
Reviewed-by: Jacopo Mondi <jacopo.mondi+renesas@ideasonboard.com>
The vsp1_partition structure stores the RPF partition configuration in a
single field for all RPF instances, while each RPF can have its own
configuration. Fix it by storing the configuration separately for each
RPF instance.
Signed-off-by: Laurent Pinchart <laurent.pinchart+renesas@ideasonboard.com>
Fixes: ab45e85851 ("media: v4l: vsp1: Allow entities to participate in the partition algorithm")
Reviewed-by: Jacopo Mondi <jacopo.mondi+renesas@ideasonboard.com>
When calculation a partition in vsp1_pipeline_calculate_partition(),
there is no need to handle the case where the whole image is covered by
a single partition locally. In that case, the index and div_size
parameters are 0 and format->width respectively, which makes the general
code behave exactly as the special case. Drop the special case.
Signed-off-by: Laurent Pinchart <laurent.pinchart+renesas@ideasonboard.com>
Reviewed-by: Jacopo Mondi <jacopo.mondi+renesas@ideasonboard.com>
The histogram module is the only one that has a custom .get_fmt()
handler, to handle the special case of the output format being fixed.
This can equally well be handled in the .set_fmt() handler instead.
Beside avoiding special cases and using the same .get_fmt() handler in
all modules, it ensures that the correct format is stored in the active
state for the source pad, including when .set_fmt() is called from
vsp1_entity_init_state(). Both are needed to later switch to the V4L2
subdev active state API.
Signed-off-by: Laurent Pinchart <laurent.pinchart+renesas@ideasonboard.com>
Reviewed-by: Jacopo Mondi <jacopo.mondi+renesas@ideasonboard.com>
The brx_get_compose() function is just a wrapper around
v4l2_subdev_state_get_compose() without any added value. Drop it and
call v4l2_subdev_state_get_compose() directly.
Signed-off-by: Laurent Pinchart <laurent.pinchart+renesas@ideasonboard.com>
Reviewed-by: Jacopo Mondi <jacopo.mondi+renesas@ideasonboard.com>
The vsp1_entity_get_pad_selection() function is just a wrapper around
v4l2_subdev_state_get_crop() or v4l2_subdev_state_get_compose() without
any added value. Drop it and call the functions it wraps directly.
Signed-off-by: Laurent Pinchart <laurent.pinchart+renesas@ideasonboard.com>
Reviewed-by: Jacopo Mondi <jacopo.mondi+renesas@ideasonboard.com>
