Dmitry Torokhov [Tue, 15 Nov 2022 22:11:43 +0000 (14:11 -0800)]
media: i2c: s5k5baf: switch to using gpiod API
This patch switches the driver away from legacy gpio/of_gpio API to
gpiod API, and removes use of of_get_named_gpio_flags() which I want to
make private to gpiolib.
Lukas Bulwahn [Wed, 23 Nov 2022 07:52:16 +0000 (08:52 +0100)]
media: imx: remove code for non-existing config IMX_GPT_ICAP
There never was a config IMX_GPT_ICAP in the repository. So remove the code
conditional on this config and simplify the callers that just called empty
functions.
Shigeru Yoshida [Tue, 22 Nov 2022 18:51:59 +0000 (03:51 +0900)]
media: si470x: Fix use-after-free in si470x_int_in_callback()
syzbot reported use-after-free in si470x_int_in_callback() [1]. This
indicates that urb->context, which contains struct si470x_device
object, is freed when si470x_int_in_callback() is called.
The cause of this issue is that si470x_int_in_callback() is called for
freed urb.
si470x_usb_driver_probe() calls si470x_start_usb(), which then calls
usb_submit_urb() and si470x_start(). If si470x_start_usb() fails,
si470x_usb_driver_probe() doesn't kill urb, but it just frees struct
si470x_device object, as depicted below:
This patch fixes this issue by killing urb when si470x_start_usb()
fails and urb is submitted. If si470x_start_usb() fails and urb is
not submitted, i.e. submitting usb fails, it just frees struct
si470x_device object.
Jiasheng Jiang [Thu, 17 Nov 2022 06:56:52 +0000 (14:56 +0800)]
media: coda: Add check for dcoda_iram_alloc
As the coda_iram_alloc may return NULL pointer,
it should be better to check the return value
in order to avoid NULL poineter dereference,
same as the others.
The reset-gpios is described as xshutdown-gpios on the required
properties, as it is on the driver. Despite that, the device tree
example set the property 'reset-gpios' instead of the property
'xshutdown-gpios'.
Therefore, this patch updates the example to match the property specified
on the driver.
Acked-by: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org> Signed-off-by: Maíra Canal <mairacanal@riseup.net> Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
The Hantro G2 video decoder block sits behind an IOMMU. The device tree
binding needs a property to reference it. Without a reference for the
implementation to properly configure the IOMMU, it will fault and cause
the video decoder to fail.
Add an "iommus" property for referring to the IOMMU port. The master ID
in the example is taken from the IOMMU fault error message on Linux,
and the number seems to match the order in the user manual's IOMMU
diagram.
Linus Walleij [Tue, 8 Nov 2022 19:53:28 +0000 (20:53 +0100)]
media: s5k4ecgx: Delete driver
This driver was until the previous patch unused in the kernel
and depended on platform data that no board was defining.
As no users can be proven to exist, delete the driver.
Cc: Sylwester Nawrocki <s.nawrocki@samsung.com> Cc: Andrzej Hajda <andrzej.hajda@intel.com> Cc: Krzysztof Kozlowski <krzk@kernel.org> Cc: Alim Akhtar <alim.akhtar@samsung.com> Cc: Dmitry Torokhov <dmitry.torokhov@gmail.com> Suggested-by: Dmitry Torokhov <dmitry.torokhov@gmail.com> Signed-off-by: Linus Walleij <linus.walleij@linaro.org> Reviewed-by: Dmitry Torokhov <dmitry.torokhov@gmail.com> Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
Linus Walleij [Tue, 8 Nov 2022 19:53:27 +0000 (20:53 +0100)]
media: s5k4ecgx: Switch to GPIO descriptors
The driver has an option to pass in GPIO numbers from platform
data but this is not used in the kernel so delete this and the
whole platform data mechanism.
Get GPIO descriptors using the standard API and simplify the code,
gpiolib will handle any inversions.
Cc: Sylwester Nawrocki <s.nawrocki@samsung.com> Cc: Andrzej Hajda <andrzej.hajda@intel.com> Cc: Krzysztof Kozlowski <krzk@kernel.org> Cc: Alim Akhtar <alim.akhtar@samsung.com> Cc: Dmitry Torokhov <dmitry.torokhov@gmail.com> Reviewed-by: Andrzej Hajda <andrzej.hajda@intel.com> Reviewed-by: Tommaso Merciai <tommaso.merciai@amarulasolutions.com> Signed-off-by: Linus Walleij <linus.walleij@linaro.org> Reviewed-by: Dmitry Torokhov <dmitry.torokhov@gmail.com> Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
Yang Yingliang [Mon, 19 Sep 2022 15:58:43 +0000 (23:58 +0800)]
media: Switch to use dev_err_probe() helper
In the probe path, dev_err() can be replaced with dev_err_probe()
which will check if error code is -EPROBE_DEFER.
Reviewed-by: Sean Young <sean@mess.org> Reviewed-by: Ricardo Ribalda <ribalda@chromium.org> Reviewed-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com> Signed-off-by: Yang Yingliang <yangyingliang@huawei.com> Acked-by: Sakari Ailus <sakari.ailus@linux.intel.com> Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
Gustavo A. R. Silva [Wed, 7 Sep 2022 18:55:44 +0000 (19:55 +0100)]
media: usb: pwc-uncompress: Use flex array destination for memcpy()
In preparation for FORTIFY_SOURCE performing run-time destination buffer
bounds checking for memcpy(), specify the destination output buffer
explicitly, instead of asking memcpy() to write past the end of what looked
like a fixed-size object.
Notice that raw_frame is a pointer to a structure that contains
flexible-array member rawframe[]:
drivers/media/usb/pwc/pwc.h:
190 struct pwc_raw_frame {
191 __le16 type; /* type of the webcam */
192 __le16 vbandlength; /* Size of 4 lines compressed (used by the
193 decompressor) */
194 __u8 cmd[4]; /* the four byte of the command (in case of
195 nala, only the first 3 bytes is filled) */
196 __u8 rawframe[]; /* frame_size = H / 4 * vbandlength */
197 } __packed;
Link: https://github.com/KSPP/linux/issues/200 Signed-off-by: Gustavo A. R. Silva <gustavoars@kernel.org> Reviewed-by: Kees Cook <keescook@chromium.org> Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
media: s5p-mfc: Fix to handle reference queue during finishing
On receiving last buffer driver puts MFC to MFCINST_FINISHING state which
in turn skips transferring of frame from SRC to REF queue. This causes
driver to stop MFC encoding and last frame is lost.
This patch guarantees safe handling of frames during MFCINST_FINISHING and
correct clearing of workbit to avoid early stopping of encoding.
media: s5p-mfc: Clear workbit to handle error condition
During error on CLOSE_INSTANCE command, ctx_work_bits was not getting
cleared. During consequent mfc execution NULL pointer dereferencing of
this context led to kernel panic. This patch fixes this issue by making
sure to clear ctx_work_bits always.
Philipp Zabel [Wed, 24 Aug 2022 10:32:10 +0000 (12:32 +0200)]
media: imx: Use get_mbus_config instead of parsing upstream DT endpoints
Stop parsing upstream neighbors' device-tree endpoints to retrieve the
media bus configuration. Instead use the get_mbus_config op and throw an
error if the upstream subdevice does not implement it.
Also drop the corresponding TODO entry and the now unused
imx_media_get_pad_fwnode() function.
Signed-off-by: Philipp Zabel <p.zabel@pengutronix.de> Reviewed-by: Jacopo Mondi <jacopo@jmondi.org> Tested-by: Marco Felsch <m.felsch@pengutronix.de> Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
Liang He [Tue, 19 Jul 2022 14:10:23 +0000 (22:10 +0800)]
media: c8sectpfe: Add of_node_put() when breaking out of loop
In configure_channels(), we should call of_node_put() when breaking
out of for_each_child_of_node() which will automatically increase
and decrease the refcount.
Fixes: c5f5d0f99794 ("[media] c8sectpfe: STiH407/10 Linux DVB demux support") Signed-off-by: Liang He <windhl@126.com> Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
Lecopzer Chen [Mon, 16 May 2022 17:15:15 +0000 (01:15 +0800)]
media: Kconfig: Make DVB_CORE=m possible when MEDIA_SUPPORT=y
A case that CONFIG_MEDIA_SUPPORT is y but we need DVB_CORE=m, and
this doesn't work since DVB_CORE is default MEDIA_DIGITAL_TV_SUPPORT
and then follows MEDIA_SUPPORT.
Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl> Signed-off-by: Lecopzer Chen <lecopzer.chen@mediatek.com>
Michael Riesch [Fri, 14 Jan 2022 10:57:55 +0000 (11:57 +0100)]
media: v4l2-mediabus: add support for dual edge sampling
Some devices support sampling of the parallel data at both edges of the
interface pixel clock in order to reduce the pixel clock by two.
Add a mediabus flag that represents this feature.
Signed-off-by: Michael Riesch <michael.riesch@wolfvision.net> Reviewed-by: Jacopo Mondi <jacopo+renesas@jmondi.org> Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
Michael Riesch [Fri, 14 Jan 2022 10:57:54 +0000 (11:57 +0100)]
dt-bindings: media: video-interfaces: add support for dual edge sampling
Some devices support sampling of the parallel data at both edges of the
interface pixel clock in order to reduce the pixel clock by two.
Use the pclk-sample property to reflect this feature in the device tree.
Signed-off-by: Michael Riesch <michael.riesch@wolfvision.net> Reviewed-by: Jacopo Mondi <jacopo+renesas@jmondi.org> Acked-by: Rob Herring <robh@kernel.org> Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
Christophe JAILLET [Sat, 1 Jan 2022 21:28:51 +0000 (22:28 +0100)]
media: pt3: Use dma_set_mask_and_coherent() and simplify code
Use dma_set_mask_and_coherent() instead of unrolling it with some
dma_set_mask()+dma_set_coherent_mask().
Moreover, as stated in [1], dma_set_mask() with a 64-bit mask will never
fail if dev->dma_mask is non-NULL.
So, if it fails, the 32 bits case will also fail for the same reason.
Simplify code and remove some dead code accordingly.
Adam Borowski [Thu, 15 Sep 2022 23:33:18 +0000 (00:33 +0100)]
media: ipu3-cio2: make the bridge depend on i2c
drivers/media/pci/intel/ipu3/cio2-bridge.c: In function ‘cio2_bridge_unregister_sensors’:
drivers/media/pci/intel/ipu3/cio2-bridge.c:258:17: error: implicit declaration of function ‘i2c_unregister_device’; did you mean ‘spi_unregister_device’? [-Werror=implicit-function-declaration]
258 | i2c_unregister_device(sensor->vcm_i2c_client);
| ^~~~~~~~~~~~~~~~~~~~~
| spi_unregister_device
Aakarsh Jain [Mon, 14 Nov 2022 11:50:23 +0000 (11:50 +0000)]
media: s5p-mfc: Add variant data for MFC v7 hardware for Exynos 3250 SoC
Commit 5441e9dafdfc6dc40 ("[media] s5p-mfc: Core support for MFC v7")
which adds mfc v7 support for Exynos3250 and use the same compatible
string as used by Exynos5240 but both the IPs are a bit different in
terms of IP clock.
Add variant driver data based on the new compatible string
"samsung,exynos3250-mfc" for Exynos3250 SoC.
Suggested-by: Alim Akhtar <alim.akhtar@samsung.com> Fixes: 5441e9dafdfc ("[media] s5p-mfc: Core support for MFC v7") Signed-off-by: Aakarsh Jain <aakarsh.jain@samsung.com> Reviewed-by: Alim Akhtar <alim.akhtar@samsung.com> Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl> Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>
Aakarsh Jain [Mon, 14 Nov 2022 11:50:22 +0000 (11:50 +0000)]
media: dt-bindings: s5p-mfc: Add new compatible string for Exynos3250 SoC
Since MFC v7 support was present for both Exynos5420 and Exynos3250
SoC with same compatible string "samsung,mfc-v7". As both SoCs
having different hardware properties and having same compatible
string for both SoCs doesn't seems to be correct.
Add new compatible for Exynos3250 SoC followed by mfc-v7 fallback
which will differentiate the node properties for both SoCs which
support MFC v7.
Reviewed-by: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org> Reviewed-by: Tommaso Merciai <tommaso.merciai@amarulasolutions.com> Suggested-by: Alim Akhtar <alim.akhtar@samsung.com> Signed-off-by: Aakarsh Jain <aakarsh.jain@samsung.com> Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl> Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>
Yunfei Dong [Thu, 17 Nov 2022 09:24:50 +0000 (09:24 +0000)]
media: mediatek: vcodec: Can't set dst buffer to done when lat decode error
Core thread will call v4l2_m2m_buf_done to set dst buffer done for
lat architecture. If lat call v4l2_m2m_buf_done_and_job_finish to
free dst buffer when lat decode error, core thread will access kernel
NULL pointer dereference, then crash.
Yunfei Dong [Thu, 17 Nov 2022 09:24:49 +0000 (09:24 +0000)]
media: mediatek: vcodec: Fix getting NULL pointer for dst buffer
The driver may can't get v4l2 buffer when lat or core decode timeout,
will lead to crash when call v4l2_m2m_buf_done to set dst buffer
(NULL pointer) done.
Fixes: 7b182b8d9c85 ("media: mediatek: vcodec: Refactor get and put capture buffer flow") Signed-off-by: Yunfei Dong <yunfei.dong@mediatek.com> Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl> Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>
Ming Qian [Mon, 21 Nov 2022 06:34:42 +0000 (06:34 +0000)]
media: amphion: lock and check m2m_ctx in event handler
driver needs to cancel vpu before releasing the vpu instance,
so call v4l2_m2m_ctx_release() first,
to handle the redundant event triggered after m2m_ctx is released.
Ming Qian [Fri, 18 Nov 2022 08:51:29 +0000 (08:51 +0000)]
media: amphion: try to wakeup vpu core to avoid failure
firmware should be waked up by start or configure command,
but there is a very small chance that firmware failed to wakeup.
in such case, try to wakeup firmware again by sending a noop command
Irui Wang [Sat, 1 Oct 2022 03:07:52 +0000 (04:07 +0100)]
media: dt-bindings: mediatek: vcodec: Add the platform compatible to schema
There are venc node warnings when running dtbs_check, the clock-names
was unexpected, missing properties '#address-cells' and '#size-cells'.
Add the corresponding platform compatible to schema.
Signed-off-by: Irui Wang <irui.wang@mediatek.com> Acked-by: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org> Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl> Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>
Paul Kocialkowski [Fri, 9 Sep 2022 13:39:54 +0000 (14:39 +0100)]
media: sun8i-a83t-mipi-csi2: Register async subdev with no sensor attached
This allows the device to probe and register its async subdev without
a sensor attached.
The rationale is that the parent driver might otherwise wait for the
subdev to be registered when it should be available (from the fwnode
graph endpoint perspective). This is generally not problematic when
the MIPI CSI-2 bridge is the only device attached to the parent, but
in the case of a CSI controller that can feed from both MIPI CSI-2
and parallel, it would prevent using the parallel sensor due to the
parent waiting for the MIPI CSI-2 subdev to register.
Fixes: 576d196c522b ("media: sunxi: Add support for the A83T MIPI CSI-2 controller") Signed-off-by: Paul Kocialkowski <paul.kocialkowski@bootlin.com> Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl> Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>
Paul Kocialkowski [Fri, 9 Sep 2022 13:39:53 +0000 (14:39 +0100)]
media: sun6i-mipi-csi2: Register async subdev with no sensor attached
This allows the device to probe and register its async subdev without
a sensor attached.
The rationale is that the parent driver might otherwise wait for the
subdev to be registered when it should be available (from the fwnode
graph endpoint perspective). This is generally not problematic when
the MIPI CSI-2 bridge is the only device attached to the parent, but
in the case of a CSI controller that can feed from both MIPI CSI-2
and parallel, it would prevent using the parallel sensor due to the
parent waiting for the MIPI CSI-2 subdev to register.
Fixes: af54b4f4c17f ("media: sunxi: Add support for the A31 MIPI CSI-2 controller") Signed-off-by: Paul Kocialkowski <paul.kocialkowski@bootlin.com> Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl> Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>
Paul Kocialkowski [Fri, 9 Sep 2022 13:39:52 +0000 (14:39 +0100)]
media: sun8i-a83t-mipi-csi2: Require both pads to be connected for streaming
The bridge needs both its pads connected to be able to stream data.
Enforcing this is useful to produce an error when no sensor is
connected.
Fixes: 576d196c522b ("media: sunxi: Add support for the A83T MIPI CSI-2 controller") Signed-off-by: Paul Kocialkowski <paul.kocialkowski@bootlin.com> Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl> Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>
Paul Kocialkowski [Fri, 9 Sep 2022 13:39:51 +0000 (14:39 +0100)]
media: sun6i-mipi-csi2: Require both pads to be connected for streaming
The bridge needs both its pads connected to be able to stream data.
Enforcing this is useful to produce an error when no sensor is
connected.
Fixes: af54b4f4c17f ("media: sunxi: Add support for the A31 MIPI CSI-2 controller") Signed-off-by: Paul Kocialkowski <paul.kocialkowski@bootlin.com> Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl> Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>
Ming Qian [Thu, 25 Aug 2022 01:38:30 +0000 (02:38 +0100)]
media: amphion: tell and handle contiguous and non contiguous format
Driver should tell the number of memory planes and component planes.
the amphion vpu support non contiguous planes,
but for compatibility with other device
that only support contiguous planes.
driver can add support for contiguous planes in the same time.
Then the mem_planes can be different from the comp_planes.
driver need to handle buffer according mem_planes and comp_planes.
So driver can support NV12 and NV12M.
Signed-off-by: Ming Qian <ming.qian@nxp.com> Reviewed-by: Tommaso Merciai <tommaso.merciai@amarulasolutions.com> Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl> Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>
Xiu Jianfeng [Mon, 13 Jun 2022 13:08:45 +0000 (14:08 +0100)]
media: v4l: Use memset_after() helper
The CLEAR_AFTER_FIELD defined here is functionally the same as
memset_after() helper, so replace it with memset_after() to simplify the
code, no functional change in this patch.
Niklas Söderlund [Sun, 9 Oct 2022 18:35:51 +0000 (19:35 +0100)]
media: rcar-vin: Add support for Gen3 UDS (Up Down Scaler)
Add support for the UDS (Up Down Scaler) found in some Gen3 SoCs.
Not all Gen3 SoCs have scalers, and for those that do it's only
available to the master node of each VIN group. The setup for which SoCs
and nodes have access to a scaler are dealt with at probe time and then
function transparently reusing the schema from the already present Gen2
scaler.
Niklas Söderlund [Sun, 9 Oct 2022 18:35:50 +0000 (19:35 +0100)]
media: rcar-vin: Store scaler in a function pointer
The scaler implementation is different between the VIN generations, and
not all SoCs have a scaler. Currently only Gen2 scalers are supported.
Prepare to add support for more scalers by storing the setup in a
function pointer initialized at probe time. While at it move call site
to after, instead of before, the generic capture setup, this have no
effect on the Gen2 scaler but will be leveraged by the Gen3 scaler.
Niklas Söderlund [Sun, 9 Oct 2022 18:35:49 +0000 (19:35 +0100)]
media: rcar-vin: Do not cache remote rectangle
Prepare for scaling support in the media controller part of the driver
by not caching the remote rectangle. Mimic the omap3isp and look it up
each time it's needed.
Chen Zhongjin [Tue, 8 Nov 2022 03:30:05 +0000 (03:30 +0000)]
media: dvb-core: Fix ignored return value in dvb_register_frontend()
In dvb_register_frontend(), dvb_register_device() is possible to fail
but its return value is ignored.
It will cause use-after-free when module is removed, because in
dvb_unregister_frontend() it tries to unregister a not registered
device.
BUG: KASAN: use-after-free in dvb_remove_device+0x18b/0x1f0 [dvb_core]
Read of size 4 at addr ffff88800dff4824 by task rmmod/428
CPU: 3 PID: 428 Comm: rmmod
Call Trace:
<TASK>
...
dvb_remove_device+0x18b/0x1f0 [dvb_core]
dvb_unregister_frontend+0x7b/0x130 [dvb_core]
vidtv_bridge_remove+0x6e/0x160 [dvb_vidtv_bridge]
...
Fix this by catching return value of dvb_register_device().
However the fe->refcount can't be put to zero immediately, because
there are still modules calling dvb_frontend_detach() when
dvb_register_frontend() fails.
The dvb_usb_dib0700_ir_proto has been removed by
commit 0ffd1ab34a00 ("V4L/DVB: dib0700: properly implement IR
change_protocol"), so remove the orphan declaration.
Mazin Al Haddad [Wed, 24 Aug 2022 01:21:52 +0000 (02:21 +0100)]
media: dvb-usb: fix memory leak in dvb_usb_adapter_init()
Syzbot reports a memory leak in "dvb_usb_adapter_init()".
The leak is due to not accounting for and freeing current iteration's
adapter->priv in case of an error. Currently if an error occurs,
it will exit before incrementing "num_adapters_initalized",
which is used as a reference counter to free all adap->priv
in "dvb_usb_adapter_exit()". There are multiple error paths that
can exit from before incrementing the counter. Including the
error handling paths for "dvb_usb_adapter_stream_init()",
"dvb_usb_adapter_dvb_init()" and "dvb_usb_adapter_frontend_init()"
within "dvb_usb_adapter_init()".
This means that in case of an error in any of these functions the
current iteration is not accounted for and the current iteration's
adap->priv is not freed.
Fix this by freeing the current iteration's adap->priv in the
"stream_init_err:" label in the error path. The rest of the
(accounted for) adap->priv objects are freed in dvb_usb_adapter_exit()
as expected using the num_adapters_initalized variable.
Lin Ma [Sun, 7 Aug 2022 14:59:52 +0000 (15:59 +0100)]
media: dvbdev: adopts refcnt to avoid UAF
dvb_unregister_device() is known that prone to use-after-free.
That is, the cleanup from dvb_unregister_device() releases the dvb_device
even if there are pointers stored in file->private_data still refer to it.
This patch adds a reference counter into struct dvb_device and delays its
deallocation until no pointer refers to the object.
YongSu Yoo [Thu, 23 Jun 2022 10:35:43 +0000 (11:35 +0100)]
media: dvb_ringbuffer : Fix a bug in dvb_ringbuffer.c
The function dvb_ringbuffer_pkt_next in
/linux-next/drviers/media/dvb-core/dvb_ringbuffer.c,
which searches the idx of the next valid packet in the ring
buffer of the ca->slot_info[slot].rx_buffer at
/linux-next/drivers/media/dvb-core/dvb_ca_en50221.c,
has the following problem.
In calculating the amounts of the consumed address of the ring
buffer, if the read address(rbuf->pread) of the ring buffer is
smaller than the idx, the amounts of the searched address
should be (idx - rbuf->pread),
whereas if the read address(rbuf->pread) of the ring buffer is
larger than the idx, the amounts of the consumed address should
be (idx - rbuf->pread + rbug->size). But there exists an
incorrect logic that the rbug-size was not properly added on
(idx - rbug->pread) in the later case. With this commit, we
fixed this bug.
media: dvb-core: Fix double free in dvb_register_device()
In function dvb_register_device() -> dvb_register_media_device() ->
dvb_create_media_entity(), dvb->entity is allocated and initialized. If
the initialization fails, it frees the dvb->entity, and return an error
code. The caller takes the error code and handles the error by calling
dvb_media_device_free(), which unregisters the entity and frees the
field again if it is not NULL. As dvb->entity may not NULLed in
dvb_create_media_entity() when the allocation of dvbdev->pad fails, a
double free may occur. This may also cause an Use After free in
media_device_unregister_entity().
Fix this by storing NULL to dvb->entity when it is freed.
Colin Ian King [Sun, 24 Apr 2022 15:47:20 +0000 (16:47 +0100)]
media: dvbdev: remove redundant initialization of variable ret
Variable ret is being ininitialized with a value that is never read.
The ininitializtion is redundant and can be removed. Move the variable
to the scope it is required.
Robert Schlabbach [Fri, 21 Jan 2022 21:18:49 +0000 (21:18 +0000)]
media: dvb-core: Enhance shared multi-frontend support
Drivers for devices with multiple frontends which cannot be used
concurrently due to hardware limitations which enforce that restriction
by setting the mfe_shared field to 1 exhibit rather unfriendly behavior
towards applications: The unavailable frontend devices cannot be opened
at all, not even for read-only access to query information. Even worse,
any open call is blocked for 5 seconds by default.
Allow drivers for such devices to behave like regular busy frontend
devices instead, i.e. still allowing concurrent read access to the
unavailable frontend and denying concurrent write access with -EBUSY
without delay.
This patch does not alter the behavior of any existing driver to avoid
regressions. Driver developers who wish to take advantage of this must
ensure their driver can handle all read-only accesses to the unavailable
frontend, and indicate the capability by setting the mfe_shared field to
2 instead of 1.
Add a check to dvb-usb-init.c when automatically setting the mfe_shared
field that when a driver has already set the field to 2, it is not
overwritten.
Document the additional capability in the code comment about mfe_shared.
Robert Schlabbach [Fri, 14 Jan 2022 07:43:48 +0000 (07:43 +0000)]
media: dvb: add DVB-C2 and DVB-S2X parameter values
Extend the DVB frontend parameter enums with additional values specified
by the DVB-C2 (ETSI EN 302 769) and DVB-S2X (ETSI EN 302 307-2)
standards to be ready for frontend drivers for such receivers.
While most parameters will be "read-only" due to being autodetected by
the receiver and only being reported back for informational purposes,
the addition of SYS_DVBC2 to the delivery systems enum is required,
because there are DVB-C2 capable receivers which are not capable of
DVB-C/C2 autodetection and thus need this enum value to be explicitly
instructed to search for a DVB-C2 signal.
As for DVB-S2X, as that is an extension to DVB-S2, the same delivery
system enum as for DVB-S2 can be used.
Add the additional enum values and comments to the documentation.
Robert Schlabbach [Wed, 12 Jan 2022 03:33:41 +0000 (03:33 +0000)]
media: dvb_frontend: add missing DSS switch cases
While the documentation mentions the delivery system DSS as a satellite
system, it was missing from all but one switch statement in the DVB
frontend code, leading to tuning failures, because the frequency was not
correctly handled as being in kHz rather than Hz.
Add the missing switch cases so that DSS is handled like the other
satellite systems. For the rolloff, assume 0.20 as per one publication
found via Internet search.
Caused by vIN undervoltage lockout (status register bit 7) when raising LNB to 18V.
Addressed by using the higher-precision voltages available on the a8293 to gradually
increase (slew) the voltage when voltage increases are requested.
Adds volt_slew_nanos_per_mv to a8293_platform_data struct for specifying slew rate.
If value is <1 or non-sane (>1600), the original no-slew version for a8293_set_voltage is used.
Lukas Bulwahn [Wed, 16 Nov 2022 09:40:06 +0000 (09:40 +0000)]
media: i2c: refer to config VIDEO_DEV to make ov08x40 image sensor driver usable
Commit 9958d30f38b9 ("media: Kconfig: cleanup VIDEO_DEV dependencies")
removes the config VIDEO_V4L2 as it is merged with config VIDEO_DEV.
Long after this change, commit 38fc5136ac16 ("media: i2c: Add ov08x40 image
sensor driver") introduces and refers to the removed config VIDEO_V4L2,
basically making this driver impossible to build, test and use due to
dependencies that cannot be met.
Refer to config VIDEO_DEV instead to make this driver usable.
Kieran Bingham [Mon, 21 Nov 2022 17:39:50 +0000 (17:39 +0000)]
media: i2c: ov08x40: Make remove callback return void
In commit ed5c2f5fd10d ("i2c: Make remove callback return void") drivers
were updated to remove the return value of the remove callback, and
return void.
The OV08x40 was added after this commit but was not compile tested at
the time due to a KConfig issue, and this warning was missed.
Benjamin Mugnier [Thu, 10 Nov 2022 13:41:02 +0000 (13:41 +0000)]
media: i2c: st-vgxy61: Fix smatch warnings
Fix some 'vgxy61_write_reg' return vars not being signed int.
Fix 'expo_long_max' not being initialized.
Handle 'pm_runtime_get_sync' call that can return 1.
Reported-by: kernel test robot <lkp@intel.com> Reported-by: Dan Carpenter <error27@gmail.com> Signed-off-by: Benjamin Mugnier <benjamin.mugnier@foss.st.com> Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com> Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>
Jacopo Mondi [Fri, 4 Nov 2022 14:24:52 +0000 (14:24 +0000)]
media: ar0521: Rework startup sequence
The ar0521_write_mode() function explicitly programs the exposure time
register and the test pattern register, which are now setup by the call
to __v4l2_ctrl_handler_setup() in ar0521_set_stream().
Removing those register writes from ar0521_write_mode() reduces the
function to two operations: geometry configuration and pll
configuration.
Move geomerty configuration in the ar0521_set_stream() caller and rename
ar0521_write_mode() to ar0521_pll_config().
Signed-off-by: Jacopo Mondi <jacopo@jmondi.org> Reviewed-by: Dave Stevenson <dave.stevenson@raspberrypi.com> Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com> Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>
Jacopo Mondi [Fri, 4 Nov 2022 14:24:50 +0000 (14:24 +0000)]
media: ar0521: Adjust exposure and blankings limits
Adjust the control limits for V4L2_CID_VBLANK, V4L2_CID_HBLANK and
V4L2_CID_EXPOSURE when a new format is applied to the sensor.
Update the exposure control limits when a new blanking value is
applied and change the controls initialization to use valid values for the
default format.
The exposure control default value is changed to report the default
value of register 0x3012.
Jacopo Mondi [Fri, 4 Nov 2022 14:24:48 +0000 (14:24 +0000)]
media: ar0521: Refuse unsupported controls
Refuse unsupported controls by returning -EINVAL in the s_ctrl
operation. While at it, remove a the default switch case in the first
switch as it effectively is now a no-op.
Jacopo Mondi [Fri, 4 Nov 2022 14:24:47 +0000 (14:24 +0000)]
media: ar0521: Rework PLL computation
Rework the PLL computation procedure to take into account the currently
configured format bpp and the number of data lanes.
Comment the PLL configuration procedure with information provided by the
sensor chip manual and remove the hardcoded divider from the pixel clock
calculation.
Jacopo Mondi [Fri, 4 Nov 2022 14:24:46 +0000 (14:24 +0000)]
media: ar0521: Set maximum resolution to 2592x1944
Change the largest visibile resolution to 2592x1944, which corresponds
to the active pixel array area size. Take into account the horizontal
and vertical limits when programming the visible sizes to skip
dummy/inactive pixels.
Marek Vasut [Tue, 23 Aug 2022 22:22:16 +0000 (23:22 +0100)]
media: mt9p031: Increase post-reset delay
The MT9P006 sensor driver sporadically fails to probe because the sensor
responds with a NACK condition to I2C address on the bus during an attempt
to read the sensor MT9P031_CHIP_VERSION register in mt9p031_registered().
Neither the MT9P006 nor MT9P031 datasheets are clear on reset signal timing.
Older MT9M034 [1] datasheet provides those timing figures in Appendix-A and
indicates it is necessary to wait 850000 EXTCLK cycles before starting any
I2C communication.
Add such a delay, which does make the sporadic I2C NACK go away, so it is
likely similar constraint applies to this sensor.
Laurent Pinchart [Wed, 15 Jun 2022 22:14:06 +0000 (23:14 +0100)]
media: dt-bindings: Use new video interface bus type macros in examples
Now that a header exists with macros for the media interface bus-type
values, replace hardcoding numerical constants with the corresponding
macros in the DT binding examples.
Signed-off-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com> Reviewed-by: Rob Herring <robh@kernel.org> Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com> Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>
Laurent Pinchart [Wed, 15 Jun 2022 22:14:05 +0000 (23:14 +0100)]
media: dt-bindings: media: Add macros for video interface bus types
Add a new dt-bindings/media/video-interfaces.h header that defines
macros corresponding to the bus types from media/video-interfaces.yaml.
This allows avoiding hardcoded constants in device tree sources.
Signed-off-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com> Reviewed-by: Rob Herring <robh@kernel.org> Reviewed-by: Jacopo Mondi <jacopo@jmondi.org> Reviewed-by: Paul Elder <paul.elder@ideasonboard.com> Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com> Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>
Marek Vasut [Sun, 20 Nov 2022 14:13:04 +0000 (14:13 +0000)]
media: mt9p031: Drop bogus v4l2_subdev_get_try_crop() call from mt9p031_init_cfg()
The mt9p031_init_cfg() already calls __mt9p031_get_pad_crop(), which
correctly calls v4l2_subdev_get_try_crop() on V4L2_SUBDEV_FORMAT_TRY
or returns &mt9p031->crop on V4L2_SUBDEV_FORMAT_ACTIVE. No need to
call v4l2_subdev_get_try_crop() in mt9p031_init_cfg() again in case
of both V4L2_SUBDEV_FORMAT_TRY and V4L2_SUBDEV_FORMAT_ACTIVE.
This also fixes a splat generated by this call since commit 2ba3e38517f5a ("media: v4l: subdev: Fail graciously when getting try data for NULL state")
because v4l2_subdev_get_try_crop() is called with sd_state = NULL
in mt9p031_init_cfg().
Fixes: 69681cd041648 ("media: mt9p031: Move open subdev op init code into init_cfg") Signed-off-by: Marek Vasut <marex@denx.de> Reviewed-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com> Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com> Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>
Previously regulators were enabled on probe and never again.
However, as regulators are disabled on power off. After a second power off
the regulator counter will underflow. Plus regulators are not required
for probing the sensor, but for streaming.
Fix this by enabling regulators on power on to balance regulator counter
properly.
Signed-off-by: Benjamin Mugnier <benjamin.mugnier@foss.st.com> Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com> Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>
projects / users / jedix / linux-maple.git / log