summaryrefslogtreecommitdiffstats
Commit message (Collapse)AuthorAgeFilesLines
* drm/exynos: use generic code for managing zpos plane propertyMarek Szyprowski2016-07-293-62/+13
| | | | | | | | | | | | | | | | | | | | | | This patch replaces zpos property handling custom code in Exynos DRM driver with calls to generic DRM code. Signed-off-by: Marek Szyprowski <m.szyprowski@samsung.com> Signed-off-by: Benjamin Gaignard <benjamin.gaignard@linaro.org> Cc: Inki Dae <inki.dae@samsung.com> Cc: Daniel Vetter <daniel@ffwll.ch> Cc: Ville Syrjala <ville.syrjala@linux.intel.com> Cc: Joonyoung Shim <jy0922.shim@samsung.com> Cc: Seung-Woo Kim <sw0312.kim@samsung.com> Cc: Andrzej Hajda <a.hajda@samsung.com> Cc: Krzysztof Kozlowski <k.kozlowski@samsung.com> Cc: Bartlomiej Zolnierkiewicz <b.zolnierkie@samsung.com> Cc: Tobias Jakobi <tjakobi@math.uni-bielefeld.de> Cc: Gustavo Padovan <gustavo@padovan.org> Cc: vincent.abriou@st.com Cc: fabien.dessenne@st.com Cc: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
* drm: sti: use generic zpos for planeBenjamin Gaignard2016-07-296-68/+38
| | | | | | | | | | | | | | | | | | | | | | remove private zpos property and use instead the generic new. zpos range is now fixed per plane type and normalized before being using in mixer. Signed-off-by: Benjamin Gaignard <benjamin.gaignard@linaro.org> Cc: Inki Dae <inki.dae@samsung.com> Cc: Daniel Vetter <daniel@ffwll.ch> Cc: Ville Syrjala <ville.syrjala@linux.intel.com> Cc: Joonyoung Shim <jy0922.shim@samsung.com> Cc: Seung-Woo Kim <sw0312.kim@samsung.com> Cc: Andrzej Hajda <a.hajda@samsung.com> Cc: Krzysztof Kozlowski <k.kozlowski@samsung.com> Cc: Bartlomiej Zolnierkiewicz <b.zolnierkie@samsung.com> Cc: Tobias Jakobi <tjakobi@math.uni-bielefeld.de> Cc: Gustavo Padovan <gustavo@padovan.org> Cc: vincent.abriou@st.com Cc: fabien.dessenne@st.com Cc: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
* drm: add generic zpos propertyMarek Szyprowski2016-07-297-1/+275
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | version 8: - move drm_blend.o from drm-y to drm_kms_helper-y to avoid EXPORT_SYMBOL(drm_atomic_helper_normalize_zpos) - remove dead function declarations in drm_crtc.h version 7: - remove useless EXPORT_SYMBOL() - better z-order wording in Documentation version 6: - add zpos in gpu documentation file - merge Ville patch about zpos initial value and API improvement. I have split Ville patch between zpos core and drivers version 5: - remove zpos range check and comeback to 0 to N-1 normalization algorithm version 4: - make sure that normalized zpos value is stay in the defined property range and warn user if not This patch adds support for generic plane's zpos property property with well-defined semantics: - added zpos properties to plane and plane state structures - added helpers for normalizing zpos properties of given set of planes - well defined semantics: planes are sorted by zpos values and then plane id value if zpos equals Normalized zpos values are calculated automatically when generic muttable zpos property has been initialized. Drivers can simply use plane_state->normalized_zpos in their atomic_check and/or plane_update callbacks without any additional calls to DRM core. Signed-off-by: Marek Szyprowski <m.szyprowski@samsung.com> Compare to Marek's original patch zpos property is now specific to each plane and no more to the core. Normalize function take care of the range of per plane defined range before set normalized_zpos. Signed-off-by: Benjamin Gaignard <benjamin.gaignard@linaro.org> Reviewed-by: Ville Syrjälä <ville.syrjala@linux.intel.com> Acked-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com> Tested-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com> Cc: Inki Dae <inki.dae@samsung.com> Cc: Daniel Vetter <daniel@ffwll.ch> Cc: Ville Syrjala <ville.syrjala@linux.intel.com> Cc: Joonyoung Shim <jy0922.shim@samsung.com> Cc: Seung-Woo Kim <sw0312.kim@samsung.com> Cc: Andrzej Hajda <a.hajda@samsung.com> Cc: Krzysztof Kozlowski <k.kozlowski@samsung.com> Cc: Bartlomiej Zolnierkiewicz <b.zolnierkie@samsung.com> Cc: Tobias Jakobi <tjakobi@math.uni-bielefeld.de> Cc: Gustavo Padovan <gustavo@padovan.org> Cc: vincent.abriou@st.com Cc: fabien.dessenne@st.com Cc: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
* Merge remote-tracking branch 'media_tree/vsp1' into generic-zpos-v8Benjamin Gaignard2016-07-29122-7051/+7425
|\
| * [media] v4l: vsp1: wpf: Add flipping supportLaurent Pinchart2016-06-287-17/+170
| | | | | | | | | | | | | | | | Vertical flipping is available on both Gen2 and Gen3, while horizontal flipping is only available on Gen3. Signed-off-by: Laurent Pinchart <laurent.pinchart+renesas@ideasonboard.com> Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
| * [media] v4l: vsp1: rwpf: Support runtime modification of controlsLaurent Pinchart2016-06-284-14/+22
| | | | | | | | | | | | | | Allow reconfiguration of the alpha value at runtime. Signed-off-by: Laurent Pinchart <laurent.pinchart+renesas@ideasonboard.com> Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
| * [media] v4l: vsp1: Simplify alpha propagationLaurent Pinchart2016-06-285-37/+15
| | | | | | | | | | | | | | | | | | We don't need to walk the pipeline when propagating the alpha value as all the information needed for propagation is already available from the pipeline structure. Signed-off-by: Laurent Pinchart <laurent.pinchart+renesas@ideasonboard.com> Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
| * [media] v4l: vsp1: clu: Support runtime modification of controlsLaurent Pinchart2016-06-282-15/+30
| | | | | | | | | | | | | | | | Allow reconfiguration of the look-up table and processing mode at runtime. Signed-off-by: Laurent Pinchart <laurent.pinchart+renesas@ideasonboard.com> Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
| * [media] v4l: vsp1: lut: Support runtime modification of controlsLaurent Pinchart2016-06-282-10/+18
| | | | | | | | | | | | | | Allow reconfiguration of the look-up table at runtime. Signed-off-by: Laurent Pinchart <laurent.pinchart+renesas@ideasonboard.com> Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
| * [media] v4l: vsp1: Support runtime modification of controlsLaurent Pinchart2016-06-2812-13/+48
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Controls are applied to the hardware in the configure operation of the VSP entities, which is only called when starting the video stream. To enable runtime modification of controls we need to call the configure operations for every frame. Doing so is currently not safe, as most parameters shouldn't be modified during streaming. Furthermore the configure operation can sleep, preventing it from being called from the frame completion interrupt handler for the next frame. Fix this by adding an argument to the configure operation to tell entities whether to perform a full configuration (as done now) or a partial runtime configuration. In the latter case the operation will only configure the subset of parameters related to runtime-configurable controls, and won't be allowed to sleep when doing so. Because partial reconfiguration can depend on parameters computed when performing a full configuration, the core guarantees that the configure operation will always be called with full and partial modes in that order at stream start. Entities thus don't have to duplicate configuration steps in the full and partial code paths. This change affects the VSP driver core only, all entities return immediately from the configure operation when called for a partial runtime configuration. Entities will be modified one by one in further commits. Signed-off-by: Laurent Pinchart <laurent.pinchart+renesas@ideasonboard.com> Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
| * [media] v4l: vsp1: Add Cubic Look Up Table (CLU) supportLaurent Pinchart2016-06-288-5/+355
| | | | | | | | | | | | | | | | | | The CLU processing block is a 2D/3D lookup table that converts the input three color component data into desired three color components using a lookup table. Signed-off-by: Laurent Pinchart <laurent.pinchart+renesas@ideasonboard.com> Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
| * [media] v4l: vsp1: lut: Expose configuration through a controlLaurent Pinchart2016-06-283-62/+54
| | | | | | | | | | | | | | | | Replace the custom ioctl with a V4L2 control in order to standardize the API. Signed-off-by: Laurent Pinchart <laurent.pinchart+renesas@ideasonboard.com> Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
| * [media] v4l: vsp1: lut: Initialize the mutexLaurent Pinchart2016-06-281-0/+2
| | | | | | | | | | | | | | The LUT mutex isn't initialized when creating the LUT, fix it. Signed-off-by: Laurent Pinchart <laurent.pinchart+renesas@ideasonboard.com> Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
| * [media] v4l: vsp1: dl: Don't free fragments with interrupts disabledLaurent Pinchart2016-06-281-14/+58
| | | | | | | | | | | | | | | | | | | | | | Freeing a fragment requires freeing DMA coherent memory, which can be performed with interrupts disabled as per the DMA mapping API contract. The fragments can't thus be freed synchronously when a display list is recycled. Instead, move the fragments to a garbage list and use a work queue to run the garbage collection. Signed-off-by: Laurent Pinchart <laurent.pinchart+renesas@ideasonboard.com> Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
| * [media] v4l: vsp1: Set entities functionsLaurent Pinchart2016-06-2810-11/+24
| | | | | | | | | | | | | | | | | | Initialize the function field of all subdev entities instantiated by the driver. This gets rids of multiple warnings printed by the media controller core. Signed-off-by: Laurent Pinchart <laurent.pinchart+renesas@ideasonboard.com> Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
| * [media] v4l: vsp1: Don't create LIF entity when the userspace API is enabledLaurent Pinchart2016-06-281-8/+8
| | | | | | | | | | | | | | | | | | | | | | The LIF is only used when feeding the VSP output to the DU. The only way to do so is by controlling the VSP directly from the DU driver and disabling the VSP userspace API. There is thus no need to create a LIF entity when the userspace API is enabled, as it can't be used in that case. Signed-off-by: Laurent Pinchart <laurent.pinchart+renesas@ideasonboard.com> Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
| * [media] v4l: vsp1: Don't register media device when userspace API is disabledLaurent Pinchart2016-06-281-7/+9
| | | | | | | | | | | | | | | | The media device doesn't need to be exposed to userspace when the VSP is fully controlled by the DU driver. Don't register it in that case. Signed-off-by: Laurent Pinchart <laurent.pinchart+renesas@ideasonboard.com> Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
| * [media] v4l: vsp1: Base link creation on availability of entitiesLaurent Pinchart2016-06-281-1/+1
| | | | | | | | | | | | | | | | | | | | Check the entity pointer instead of the feature flag to see if the entity is available before creating related links. The two methods are currently equivalent, but will differ in the future as we implement support for ignoring some of the entities present in the hardware. Signed-off-by: Laurent Pinchart <laurent.pinchart+renesas@ideasonboard.com> Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
| * [media] media: Add video statistics computation functionsLaurent Pinchart2016-06-282-0/+10
| | | | | | | | | | | | | | | | | | | | The video statistics function describes entities such as video histogram engines or 3A statistics engines. Signed-off-by: Laurent Pinchart <laurent.pinchart+renesas@ideasonboard.com> Acked-by: Hans Verkuil <hans.verkuil@cisco.com> Acked-by: Sakari Ailus <sakari.ailus@linux.intel.com> Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
| * [media] media: Add video processing entity functionsLaurent Pinchart2016-06-282-0/+64
| | | | | | | | | | | | | | | | | | | | Add composer, pixel formatter, pixel encoding converter and scaler functions. Signed-off-by: Laurent Pinchart <laurent.pinchart+renesas@ideasonboard.com> Acked-by: Hans Verkuil <hans.verkuil@cisco.com> Acked-by: Sakari Ailus <sakari.ailus@linux.intel.com> Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
| * [media] v4l: vsp1: sru: Fix intensity control IDLaurent Pinchart2016-06-281-1/+1
| | | | | | | | | | | | | | | | The intensity control reused the V4L2_CID_CONTRAST control ID by mistake. Fix it by using an ID from the device-specific IDs range. Signed-off-by: Laurent Pinchart <laurent.pinchart+renesas@ideasonboard.com> Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
| * [media] v4l: vsp1: Stop the pipeline upon the first STREAMOFFLaurent Pinchart2016-06-281-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The device is stopped when STREAMOFF is called on the last video node in the pipeline. This results in possible memory corruption and/or crashes, as userspace could free buffers while the hardware is still writing to them, and the frame completion interrupt handler could try to access buffers that don't exist anymore. Fix this by stopping the pipeline upon the first STREAMOFF call, not the last. Reported-by: Kuninori Morimoto <kuninori.morimoto.gx@renesas.com> Signed-off-by: Laurent Pinchart <laurent.pinchart+renesas@ideasonboard.com> Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
| * [media] v4l: vsp1: Constify operation structuresLaurent Pinchart2016-06-289-18/+18
| | | | | | | | | | | | | | The structures are never modified, make them const. Signed-off-by: Laurent Pinchart <laurent.pinchart+renesas@ideasonboard.com> Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
| * [media] v4l: vsp1: pipe: Fix typo in commentLaurent Pinchart2016-06-281-1/+1
| | | | | | | | | | | | | | | | The vsp1_pipeline wq field is a wait queue, not a work queue. Fix the comment accordingly. Signed-off-by: Laurent Pinchart <laurent.pinchart+renesas@ideasonboard.com> Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
| * [media] v4l: vsp1: Fix crash when resetting pipelineLaurent Pinchart2016-06-281-5/+9
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The vsp1_pipeline_reset() function loops over pipeline inputs and output and resets them. When doing so it assumes both that the pipeline has been correctly configured with an output, and that inputs are are stored in the pipe inputs array at positions 0 to num_inputs-1. Both the assumptions are incorrect. The pipeline might need to be reset after a failed attempts to configure it, without any output specified. Furthermore, inputs are stored in a positiong equal to their RPF index, possibly creating holes in the inputs array if the RPFs are not used in sequence. Fix both issues by looping over the whole inputs array and skipping unused entries, and ignoring the output when not set. Fixes: ff7e97c94d9f ("[media] v4l: vsp1: Store pipeline pointer in rwpf") Signed-off-by: Laurent Pinchart <laurent.pinchart+renesas@ideasonboard.com> Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
| * [media] v4l: vsp1: Fix descriptions of Gen2 VSP instancesLaurent Pinchart2016-06-281-3/+3
| | | | | | | | | | | | | | The number of UDS and WPF are set to incorrect values, fix them. Signed-off-by: Laurent Pinchart <laurent.pinchart+renesas@ideasonboard.com> Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
| * [media] v4l: vsp1: Fix typo in register field namesLaurent Pinchart2016-06-281-4/+4
| | | | | | | | | | | | | | The VI6_RPF_ALPH_SEL ALPHA0 and ALPHA1 fields are inverted, swap them. Signed-off-by: Laurent Pinchart <laurent.pinchart+renesas@ideasonboard.com> Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
| * [media] v4l: vsp1: Remove deprecated DRM APILaurent Pinchart2016-06-202-29/+5
| | | | | | | | | | | | | | | | The DRM driver has switched to the new API, remove the deprecated macros and inline wrapper. Signed-off-by: Laurent Pinchart <laurent.pinchart+renesas@ideasonboard.com> Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
| * [media] drm: rcar-du: Add Z-order support for VSP planesLaurent Pinchart2016-06-172-3/+10
| | | | | | | | | | | | | | | | | | Make the Z-order of VSP planes configurable through the zpos property, exactly as for the native DU planes. Signed-off-by: Laurent Pinchart <laurent.pinchart+renesas@ideasonboard.com> Acked-by: Dave Airlie <airlied@redhat.com> Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
| * [media] drm: rcar-du: Add alpha support for VSP planesLaurent Pinchart2016-06-171-19/+19
| | | | | | | | | | | | | | | | | | Make the global alpha multiplier of VSP planes configurable through the alpha property, exactly as for the native DU planes. Signed-off-by: Laurent Pinchart <laurent.pinchart+renesas@ideasonboard.com> Acked-by: Dave Airlie <airlied@redhat.com> Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
| * [media] v4l: vsp1: Group DRM RPF parameters in a structureLaurent Pinchart2016-06-172-51/+64
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The vsp1_du_atomic_update_ext() function takes 7 RPF configuration parameters, and more will likely be added later. This makes the code difficult to read and error-prone as multiple parameters have the same type. Make the API safer and easier to extend in the future by grouping all parameters in a structure. Use macro magic to ease the transition to the new function by allowing the old and new functions to be called using the same name. The macros and static inline wrapper will be removed as soon as the caller is updated. Signed-off-by: Laurent Pinchart <laurent.pinchart+renesas@ideasonboard.com> Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
| * [media] v4l: vsp1: Move frame sequence number from video node to pipelineLaurent Pinchart2016-06-174-4/+5
| | | | | | | | | | | | | | | | The frame sequence number is global to the pipeline, there's no need to store copies in each video node. Signed-off-by: Laurent Pinchart <laurent.pinchart+renesas@ideasonboard.com> Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
| * [media] v4l: vsp1: Make vsp1_entity_get_pad_compose() more genericLaurent Pinchart2016-06-173-10/+29
| | | | | | | | | | | | | | | | Turn the helper into a function that can retrieve crop and compose selection rectangles. Signed-off-by: Laurent Pinchart <laurent.pinchart+renesas@ideasonboard.com> Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
| * [media] v4l: vsp1: Replace container_of() with dedicated macroLaurent Pinchart2016-06-171-2/+8
| | | | | | | | | | | | | | | | Add a macro to cast from a struct media_entity to a struct vsp1_entity to replace the manual implementations. Signed-off-by: Laurent Pinchart <laurent.pinchart+renesas@ideasonboard.com> Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
| * [media] v4l: vsp1: Add output node value to routing tableLaurent Pinchart2016-06-172-19/+39
| | | | | | | | | | | | | | | | The output node value indicates the value to be used in a sampling point register to use the node as the source of histogram data. Signed-off-by: Laurent Pinchart <laurent.pinchart+renesas@ideasonboard.com> Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
| * [media] v4l: vsp1: Add FCP supportLaurent Pinchart2016-06-174-1/+28
| | | | | | | | | | | | | | | | | | On some platforms the VSP performs memory accesses through an FCP. When that's the case get a reference to the FCP from the VSP DT node and enable/disable it at runtime as needed. Signed-off-by: Laurent Pinchart <laurent.pinchart+renesas@ideasonboard.com> Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
| * [media] v4l: vsp1: Don't handle clocks manuallyLaurent Pinchart2016-06-172-19/+2
| | | | | | | | | | | | | | | | The power domain performs functional clock handling when using runtime PM, there's no need to enable and disable the clock manually. Signed-off-by: Laurent Pinchart <laurent.pinchart+renesas@ideasonboard.com> Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
| * [media] v4l: vsp1: Implement runtime PM supportLaurent Pinchart2016-06-173-53/+53
| | | | | | | | | | | | | | Replace the manual refcount and clock management code by runtime PM. Signed-off-by: Laurent Pinchart <laurent.pinchart+renesas@ideasonboard.com> Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
| * [media] v4l: Add Renesas R-Car FCP driverLaurent Pinchart2016-06-175-0/+242
| | | | | | | | | | | | | | | | | | | | | | | | | | The FCP is a companion module of video processing modules in the Renesas R-Car Gen3 SoCs. It provides data compression and decompression, data caching, and conversion of AXI transactions in order to reduce the memory bandwidth. The driver is not meant to be used standalone but provides an API to the video processing modules to control the FCP. Signed-off-by: Laurent Pinchart <laurent.pinchart+renesas@ideasonboard.com> Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
| * [media] dt-bindings: Add Renesas R-Car FCP DT bindingsLaurent Pinchart2016-06-171-0/+32
| | | | | | | | | | | | | | | | | | | | | | | | The FCP is a companion module of video processing modules in the Renesas R-Car Gen3 SoCs. It provides data compression and decompression, data caching, and conversion of AXI transactions in order to reduce the memory bandwidth. Signed-off-by: Laurent Pinchart <laurent.pinchart+renesas@ideasonboard.com> Acked-by: Geert Uytterhoeven <geert+renesas@glider.be> Acked-by: Rob Herring <robh@kernel.org> Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
| * [media] media-devnode.h: Fix documentationMauro Carvalho Chehab2016-06-161-2/+3
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Two parameters were documented with a wrong name, and a struct device pointer description was missing. That caused the following warnings, when building documentation: include/media/media-devnode.h:102: warning: No description found for parameter 'media_dev' include/media/media-devnode.h:126: warning: No description found for parameter 'mdev' include/media/media-devnode.h:126: warning: Excess function parameter 'media_dev' description in 'media_devnode_register' Rename the description, to match the function parameter and fix Documentation. No funcional changes. Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
| * [media] rcar-vin: get rid of an unused varMauro Carvalho Chehab2016-06-161-3/+0
| | | | | | | | | | | | | | | | | | drivers/media/platform/rcar-vin/rcar-core.c: In function 'rvin_graph_notify_complete': drivers/media/platform/rcar-vin/rcar-core.c:65:22: warning: variable 'sd' set but not used [-Wunused-but-set-variable] struct v4l2_subdev *sd; ^ Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
| * [media] rcar-vin: add Renesas R-Car VIN driverNiklas Söderlund2016-06-1610-3/+2484
| | | | | | | | | | | | | | | | | | | | A V4L2 driver for Renesas R-Car VIN driver that do not depend on soc_camera. The driver is heavily based on its predecessor and aims to replace it. Signed-off-by: Niklas Söderlund <niklas.soderlund+renesas@ragnatech.se> Signed-off-by: Hans Verkuil <hans.verkuil@cisco.com> Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
| * [media] videobuf2-v4l2: Verify planes array in buffer dequeueingSakari Ailus2016-06-161-0/+6
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | When a buffer is being dequeued using VIDIOC_DQBUF IOCTL, the exact buffer which will be dequeued is not known until the buffer has been removed from the queue. The number of planes is specific to a buffer, not to the queue. This does lead to the situation where multi-plane buffers may be requested and queued with n planes, but VIDIOC_DQBUF IOCTL may be passed an argument struct with fewer planes. __fill_v4l2_buffer() however uses the number of planes from the dequeued videobuf2 buffer, overwriting kernel memory (the m.planes array allocated in video_usercopy() in v4l2-ioctl.c) if the user provided fewer planes than the dequeued buffer had. Oops! Fixes: b0e0e1f83de3 ("[media] media: videobuf2: Prepare to divide videobuf2") Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com> Acked-by: Hans Verkuil <hans.verkuil@cisco.com> Cc: stable@vger.kernel.org # for v4.4 and later Signed-off-by: Mauro Carvalho Chehab <mchehab@osg.samsung.com> Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
| * [media] vb2: core: Skip planes array verification if pb is NULLSakari Ailus2016-06-161-4/+6
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | An earlier patch fixing an input validation issue introduced another issue: vb2_core_dqbuf() is called with pb argument value NULL in some cases, causing a NULL pointer dereference. Fix this by skipping the verification as there's nothing to verify. Fixes: e7e0c3e26587 ("[media] videobuf2-core: Check user space planes array in dqbuf") Signed-off-by: David R <david@unsolicited.net> Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com> Reviewed-by: Hans Verkuil <hans.verkuil@cisco.com> Cc: stable@vger.kernel.org # for v4.4 and later Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
| * [media] media: fix media devnode ioctl/syscall and unregister raceShuah Khan2016-06-153-10/+29
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Media devnode open/ioctl could be in progress when media device unregister is initiated. System calls and ioctls check media device registered status at the beginning, however, there is a window where unregister could be in progress without changing the media devnode status to unregistered. process 1 process 2 fd = open(/dev/media0) media_devnode_is_registered() (returns true here) media_device_unregister() (unregister is in progress and devnode isn't unregistered yet) ... ioctl(fd, ...) __media_ioctl() media_devnode_is_registered() (returns true here) ... media_devnode_unregister() ... (driver releases the media device memory) media_device_ioctl() (By this point devnode->media_dev does not point to allocated memory. use-after free in in mutex_lock_nested) BUG: KASAN: use-after-free in mutex_lock_nested+0x79c/0x800 at addr ffff8801ebe914f0 Fix it by clearing register bit when unregister starts to avoid the race. process 1 process 2 fd = open(/dev/media0) media_devnode_is_registered() (could return true here) media_device_unregister() (clear the register bit, then start unregister.) ... ioctl(fd, ...) __media_ioctl() media_devnode_is_registered() (return false here, ioctl returns I/O error, and will not access media device memory) ... media_devnode_unregister() ... (driver releases the media device memory) Signed-off-by: Shuah Khan <shuahkh@osg.samsung.com> Suggested-by: Sakari Ailus <sakari.ailus@linux.intel.com> Reported-by: Mauro Carvalho Chehab <mchehab@osg.samsung.com> Tested-by: Mauro Carvalho Chehab <mchehab@osg.samsung.com> Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
| * [media] media: fix use-after-free in cdev_put() when app exits after driver ↵Shuah Khan2016-06-152-21/+33
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | unbind When driver unbinds while media_ioctl is in progress, cdev_put() fails with when app exits after driver unbinds. Add devnode struct device kobj as the cdev parent kobject. cdev_add() gets a reference to it and releases it in cdev_del() ensuring that the devnode is not deallocated as long as the application has the device file open. media_devnode_register() initializes the struct device kobj before calling cdev_add(). media_devnode_unregister() does cdev_del() and then deletes the device. devnode is released when the last reference to the struct device is gone. This problem is found on uvcvideo, em28xx, and au0828 drivers and fix has been tested on all three. kernel: [ 193.599736] BUG: KASAN: use-after-free in cdev_put+0x4e/0x50 kernel: [ 193.599745] Read of size 8 by task media_device_te/1851 kernel: [ 193.599792] INFO: Allocated in __media_device_register+0x54 kernel: [ 193.599951] INFO: Freed in media_devnode_release+0xa4/0xc0 kernel: [ 193.601083] Call Trace: kernel: [ 193.601093] [<ffffffff81aecac3>] dump_stack+0x67/0x94 kernel: [ 193.601102] [<ffffffff815359b2>] print_trailer+0x112/0x1a0 kernel: [ 193.601111] [<ffffffff8153b5e4>] object_err+0x34/0x40 kernel: [ 193.601119] [<ffffffff8153d9d4>] kasan_report_error+0x224/0x530 kernel: [ 193.601128] [<ffffffff814a2c3d>] ? kzfree+0x2d/0x40 kernel: [ 193.601137] [<ffffffff81539d72>] ? kfree+0x1d2/0x1f0 kernel: [ 193.601154] [<ffffffff8157ca7e>] ? cdev_put+0x4e/0x50 kernel: [ 193.601162] [<ffffffff8157ca7e>] cdev_put+0x4e/0x50 kernel: [ 193.601170] [<ffffffff815767eb>] __fput+0x52b/0x6c0 kernel: [ 193.601179] [<ffffffff8117743a>] ? switch_task_namespaces+0x2a kernel: [ 193.601188] [<ffffffff815769ee>] ____fput+0xe/0x10 kernel: [ 193.601196] [<ffffffff81170023>] task_work_run+0x133/0x1f0 kernel: [ 193.601204] [<ffffffff8117746e>] ? switch_task_namespaces+0x5e kernel: [ 193.601213] [<ffffffff8111b50c>] do_exit+0x72c/0x2c20 kernel: [ 193.601224] [<ffffffff8111ade0>] ? release_task+0x1250/0x1250 - - - kernel: [ 193.601360] [<ffffffff81003587>] ? exit_to_usermode_loop+0xe7 kernel: [ 193.601368] [<ffffffff810035c0>] exit_to_usermode_loop+0x120 kernel: [ 193.601376] [<ffffffff810061da>] syscall_return_slowpath+0x16a kernel: [ 193.601386] [<ffffffff82848b33>] entry_SYSCALL_64_fastpath+0xa6 Signed-off-by: Shuah Khan <shuahkh@osg.samsung.com> Tested-by: Mauro Carvalho Chehab <mchehab@osg.samsung.com> Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
| * [media] media-device: dynamically allocate struct media_devnodeMauro Carvalho Chehab2016-06-156-23/+52
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | struct media_devnode is currently embedded at struct media_device. While this works fine during normal usage, it leads to a race condition during devnode unregister. the problem is that drivers assume that, after calling media_device_unregister(), the struct that contains media_device can be freed. This is not true, as it can't be freed until userspace closes all opened /dev/media devnodes. In other words, if the media devnode is still open, and media_device gets freed, any call to an ioctl will make the core to try to access struct media_device, with will cause an use-after-free and even GPF. Fix this by dynamically allocating the struct media_devnode and only freeing it when it is safe. Signed-off-by: Mauro Carvalho Chehab <mchehab@osg.samsung.com> Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
| * [media] media-devnode: fix namespace messMauro Carvalho Chehab2016-06-152-63/+63
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Along all media controller code, "mdev" is used to represent a pointer to struct media_device, and "devnode" for a pointer to struct media_devnode. However, inside media-devnode.[ch], "mdev" is used to represent a pointer to struct media_devnode. This is very confusing and may lead to development errors. So, let's change all occurrences at media-devnode.[ch] to also use "devnode" for such pointers. This patch doesn't make any functional changes. Signed-off-by: Mauro Carvalho Chehab <mchehab@osg.samsung.com> Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
| * Update my main e-mails at the Kernel treeMauro Carvalho Chehab2016-06-145-19/+38
| | | | | | | | | | | | | | | | | | | | For the third time in three years, I'm changing my e-mail at Samsung. That's bad, as it may stop communications with me for a while. So, this time, I'll also the mchehab@kernel.org e-mail, as it remains stable since ever. Cc: stable@vger.kernel.org Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
generated by cgit v1.2.3 (git 2.25.1) at 2024-11-08 15:10:38 +0000