summaryrefslogtreecommitdiff
path: root/drivers/media
AgeCommit message (Collapse)Author
2018-11-29nvavp: avoid needless string copiesRolf Eike Beer
Signed-off-by: Rolf Eike Beer <eb@emlix.com> Acked-by: Marcel Ziswiler <marcel.ziswiler@toradex.com>
2018-06-22media: tegra_camera: stop capturing on errorApalis-TK1_LXDE-Image_2.8b3.111-20180626Gerard Salvatella
Kernel hangs if camera capture errors are not handled to allow for a way out of the the capture thread. Signed-off-by: Gerard Salvatella <gerard.salvatella@toradex.com> Acked-by: Marcel Ziswiler <marcel.ziswiler@toradex.com>
2018-06-21Merge tag 'tegra-l4t-r21.7' into toradex_tk1_l4t_r21.7-nextMarcel Ziswiler
Merge NVIDIA's latest Linux for Tegra aka L4T R21.7 Linux kernel changes from git://nv-tegra.nvidia.com/linux-3.10.git commit: e78bb38b883c42edf81766a1d557aed74458e08f Conflicts involved missing 24-bit LVDS support and a single whitespace aka tab difference in drivers/video/tegra/dc/sor.c. Signed-off-by: Marcel Ziswiler <marcel.ziswiler@toradex.com>
2018-04-19[media] xc2028: avoid use after freeMauro Carvalho Chehab
If struct xc2028_config is passed without a firmware name, the following trouble may happen: [11009.907205] xc2028 5-0061: type set to XCeive xc2028/xc3028 tuner [11009.907491] ================================================================== [11009.907750] BUG: KASAN: use-after-free in strcmp+0x96/0xb0 at addr ffff8803bd78ab40 [11009.907992] Read of size 1 by task modprobe/28992 [11009.907994] ============================================================================= [11009.907997] BUG kmalloc-16 (Tainted: G W ): kasan: bad access detected [11009.907999] ----------------------------------------------------------------------------- [11009.908008] INFO: Allocated in xhci_urb_enqueue+0x214/0x14c0 [xhci_hcd] age=0 cpu=3 pid=28992 [11009.908012] ___slab_alloc+0x581/0x5b0 [11009.908014] __slab_alloc+0x51/0x90 [11009.908017] __kmalloc+0x27b/0x350 [11009.908022] xhci_urb_enqueue+0x214/0x14c0 [xhci_hcd] [11009.908026] usb_hcd_submit_urb+0x1e8/0x1c60 [11009.908029] usb_submit_urb+0xb0e/0x1200 [11009.908032] usb_serial_generic_write_start+0xb6/0x4c0 [11009.908035] usb_serial_generic_write+0x92/0xc0 [11009.908039] usb_console_write+0x38a/0x560 [11009.908045] call_console_drivers.constprop.14+0x1ee/0x2c0 [11009.908051] console_unlock+0x40d/0x900 [11009.908056] vprintk_emit+0x4b4/0x830 [11009.908061] vprintk_default+0x1f/0x30 [11009.908064] printk+0x99/0xb5 [11009.908067] kasan_report_error+0x10a/0x550 [11009.908070] __asan_report_load1_noabort+0x43/0x50 [11009.908074] INFO: Freed in xc2028_set_config+0x90/0x630 [tuner_xc2028] age=1 cpu=3 pid=28992 [11009.908077] __slab_free+0x2ec/0x460 [11009.908080] kfree+0x266/0x280 [11009.908083] xc2028_set_config+0x90/0x630 [tuner_xc2028] [11009.908086] xc2028_attach+0x310/0x8a0 [tuner_xc2028] [11009.908090] em28xx_attach_xc3028.constprop.7+0x1f9/0x30d [em28xx_dvb] [11009.908094] em28xx_dvb_init.part.3+0x8e4/0x5cf4 [em28xx_dvb] [11009.908098] em28xx_dvb_init+0x81/0x8a [em28xx_dvb] [11009.908101] em28xx_register_extension+0xd9/0x190 [em28xx] [11009.908105] em28xx_dvb_register+0x10/0x1000 [em28xx_dvb] [11009.908108] do_one_initcall+0x141/0x300 [11009.908111] do_init_module+0x1d0/0x5ad [11009.908114] load_module+0x6666/0x9ba0 [11009.908117] SyS_finit_module+0x108/0x130 [11009.908120] entry_SYSCALL_64_fastpath+0x16/0x76 [11009.908123] INFO: Slab 0xffffea000ef5e280 objects=25 used=25 fp=0x (null) flags=0x2ffff8000004080 [11009.908126] INFO: Object 0xffff8803bd78ab40 @offset=2880 fp=0x0000000000000001 [11009.908130] Bytes b4 ffff8803bd78ab30: 01 00 00 00 2a 07 00 00 9d 28 00 00 01 00 00 00 ....*....(...... [11009.908133] Object ffff8803bd78ab40: 01 00 00 00 00 00 00 00 b0 1d c3 6a 00 88 ff ff ...........j.... [11009.908137] CPU: 3 PID: 28992 Comm: modprobe Tainted: G B W 4.5.0-rc1+ #43 [11009.908140] Hardware name: /NUC5i7RYB, BIOS RYBDWi35.86A.0350.2015.0812.1722 08/12/2015 [11009.908142] ffff8803bd78a000 ffff8802c273f1b8 ffffffff81932007 ffff8803c6407a80 [11009.908148] ffff8802c273f1e8 ffffffff81556759 ffff8803c6407a80 ffffea000ef5e280 [11009.908153] ffff8803bd78ab40 dffffc0000000000 ffff8802c273f210 ffffffff8155ccb4 [11009.908158] Call Trace: [11009.908162] [<ffffffff81932007>] dump_stack+0x4b/0x64 [11009.908165] [<ffffffff81556759>] print_trailer+0xf9/0x150 [11009.908168] [<ffffffff8155ccb4>] object_err+0x34/0x40 [11009.908171] [<ffffffff8155f260>] kasan_report_error+0x230/0x550 [11009.908175] [<ffffffff81237d71>] ? trace_hardirqs_off_caller+0x21/0x290 [11009.908179] [<ffffffff8155e926>] ? kasan_unpoison_shadow+0x36/0x50 [11009.908182] [<ffffffff8155f5c3>] __asan_report_load1_noabort+0x43/0x50 [11009.908185] [<ffffffff8155ea00>] ? __asan_register_globals+0x50/0xa0 [11009.908189] [<ffffffff8194cea6>] ? strcmp+0x96/0xb0 [11009.908192] [<ffffffff8194cea6>] strcmp+0x96/0xb0 [11009.908196] [<ffffffffa13ba4ac>] xc2028_set_config+0x15c/0x630 [tuner_xc2028] [11009.908200] [<ffffffffa13bac90>] xc2028_attach+0x310/0x8a0 [tuner_xc2028] [11009.908203] [<ffffffff8155ea78>] ? memset+0x28/0x30 [11009.908206] [<ffffffffa13ba980>] ? xc2028_set_config+0x630/0x630 [tuner_xc2028] [11009.908211] [<ffffffffa157a59a>] em28xx_attach_xc3028.constprop.7+0x1f9/0x30d [em28xx_dvb] [11009.908215] [<ffffffffa157aa2a>] ? em28xx_dvb_init.part.3+0x37c/0x5cf4 [em28xx_dvb] [11009.908219] [<ffffffffa157a3a1>] ? hauppauge_hvr930c_init+0x487/0x487 [em28xx_dvb] [11009.908222] [<ffffffffa01795ac>] ? lgdt330x_attach+0x1cc/0x370 [lgdt330x] [11009.908226] [<ffffffffa01793e0>] ? i2c_read_demod_bytes.isra.2+0x210/0x210 [lgdt330x] [11009.908230] [<ffffffff812e87d0>] ? ref_module.part.15+0x10/0x10 [11009.908233] [<ffffffff812e56e0>] ? module_assert_mutex_or_preempt+0x80/0x80 [11009.908238] [<ffffffffa157af92>] em28xx_dvb_init.part.3+0x8e4/0x5cf4 [em28xx_dvb] [11009.908242] [<ffffffffa157a6ae>] ? em28xx_attach_xc3028.constprop.7+0x30d/0x30d [em28xx_dvb] [11009.908245] [<ffffffff8195222d>] ? string+0x14d/0x1f0 [11009.908249] [<ffffffff8195381f>] ? symbol_string+0xff/0x1a0 [11009.908253] [<ffffffff81953720>] ? uuid_string+0x6f0/0x6f0 [11009.908257] [<ffffffff811a775e>] ? __kernel_text_address+0x7e/0xa0 [11009.908260] [<ffffffff8104b02f>] ? print_context_stack+0x7f/0xf0 [11009.908264] [<ffffffff812e9846>] ? __module_address+0xb6/0x360 [11009.908268] [<ffffffff8137fdc9>] ? is_ftrace_trampoline+0x99/0xe0 [11009.908271] [<ffffffff811a775e>] ? __kernel_text_address+0x7e/0xa0 [11009.908275] [<ffffffff81240a70>] ? debug_check_no_locks_freed+0x290/0x290 [11009.908278] [<ffffffff8104a24b>] ? dump_trace+0x11b/0x300 [11009.908282] [<ffffffffa13e8143>] ? em28xx_register_extension+0x23/0x190 [em28xx] [11009.908285] [<ffffffff81237d71>] ? trace_hardirqs_off_caller+0x21/0x290 [11009.908289] [<ffffffff8123ff56>] ? trace_hardirqs_on_caller+0x16/0x590 [11009.908292] [<ffffffff812404dd>] ? trace_hardirqs_on+0xd/0x10 [11009.908296] [<ffffffffa13e8143>] ? em28xx_register_extension+0x23/0x190 [em28xx] [11009.908299] [<ffffffff822dcbb0>] ? mutex_trylock+0x400/0x400 [11009.908302] [<ffffffff810021a1>] ? do_one_initcall+0x131/0x300 [11009.908306] [<ffffffff81296dc7>] ? call_rcu_sched+0x17/0x20 [11009.908309] [<ffffffff8159e708>] ? put_object+0x48/0x70 [11009.908314] [<ffffffffa1579f11>] em28xx_dvb_init+0x81/0x8a [em28xx_dvb] [11009.908317] [<ffffffffa13e81f9>] em28xx_register_extension+0xd9/0x190 [em28xx] [11009.908320] [<ffffffffa0150000>] ? 0xffffffffa0150000 [11009.908324] [<ffffffffa0150010>] em28xx_dvb_register+0x10/0x1000 [em28xx_dvb] [11009.908327] [<ffffffff810021b1>] do_one_initcall+0x141/0x300 [11009.908330] [<ffffffff81002070>] ? try_to_run_init_process+0x40/0x40 [11009.908333] [<ffffffff8123ff56>] ? trace_hardirqs_on_caller+0x16/0x590 [11009.908337] [<ffffffff8155e926>] ? kasan_unpoison_shadow+0x36/0x50 [11009.908340] [<ffffffff8155e926>] ? kasan_unpoison_shadow+0x36/0x50 [11009.908343] [<ffffffff8155e926>] ? kasan_unpoison_shadow+0x36/0x50 [11009.908346] [<ffffffff8155ea37>] ? __asan_register_globals+0x87/0xa0 [11009.908350] [<ffffffff8144da7b>] do_init_module+0x1d0/0x5ad [11009.908353] [<ffffffff812f2626>] load_module+0x6666/0x9ba0 [11009.908356] [<ffffffff812e9c90>] ? symbol_put_addr+0x50/0x50 [11009.908361] [<ffffffffa1580037>] ? em28xx_dvb_init.part.3+0x5989/0x5cf4 [em28xx_dvb] [11009.908366] [<ffffffff812ebfc0>] ? module_frob_arch_sections+0x20/0x20 [11009.908369] [<ffffffff815bc940>] ? open_exec+0x50/0x50 [11009.908374] [<ffffffff811671bb>] ? ns_capable+0x5b/0xd0 [11009.908377] [<ffffffff812f5e58>] SyS_finit_module+0x108/0x130 [11009.908379] [<ffffffff812f5d50>] ? SyS_init_module+0x1f0/0x1f0 [11009.908383] [<ffffffff81004044>] ? lockdep_sys_exit_thunk+0x12/0x14 [11009.908394] [<ffffffff822e6936>] entry_SYSCALL_64_fastpath+0x16/0x76 [11009.908396] Memory state around the buggy address: [11009.908398] ffff8803bd78aa00: 00 00 fc fc fc fc fc fc fc fc fc fc fc fc fc fc [11009.908401] ffff8803bd78aa80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [11009.908403] >ffff8803bd78ab00: fc fc fc fc fc fc fc fc 00 00 fc fc fc fc fc fc [11009.908405] ^ [11009.908407] ffff8803bd78ab80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [11009.908409] ffff8803bd78ac00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [11009.908411] ================================================================== In order to avoid it, let's set the cached value of the firmware name to NULL after freeing it. While here, return an error if the memory allocation fails. Bug 1823317 Bug 1935735 Change-Id: I1825fc7eb08bd458ed5413fea8b47de539c9b23f Signed-off-by: Mauro Carvalho Chehab <mchehab@osg.samsung.com> Signed-off-by: Gagan Grover <ggrover@nvidia.com> Reviewed-on: https://git-master.nvidia.com/r/1690296 GVS: Gerrit_Virtual_Submit Reviewed-by: Bibek Basu <bbasu@nvidia.com> Tested-by: Amulya Yarlagadda <ayarlagadda@nvidia.com> Reviewed-by: Winnie Hsu <whsu@nvidia.com>
2018-04-03v4l2: prevent speculative loadJeetesh Burman
bug 2039126 Change-Id: Id1908c3058c9ecc0dfb4f2d85440a8d36db45db5 Signed-off-by: David Gilhooley <dgilhooley@nvidia.com> Signed-off-by: James Huang <jamehuang@nvidia.com> Reviewed-on: https://git-master.nvidia.com/r/1650029 Signed-off-by: Jeetesh Burman <jburman@nvidia.com> (cherry picked from commit 7a0213eca150614fe88d197a09d461fff6168652) Reviewed-on: https://git-master.nvidia.com/r/1660781 GVS: Gerrit_Virtual_Submit Reviewed-by: Bibek Basu <bbasu@nvidia.com>
2018-04-03drivers: speculative load before bound-checkJeetesh Burman
Data can be speculatively loaded from memory and stay in cache even when bound check fails. This can lead to unintended information disclosure via side-channel analysis. To mitigate this problem, insert speculation barrier. Bug 1964290 CVE-2017-5753 Change-Id: I7382dbcc6e9f352fafd457301beafe753925f3c4 Signed-off-by: Hien Goi <hgoi@nvidia.com> Signed-off-by: James Huang <jamehuang@nvidia.com> Reviewed-on: https://git-master.nvidia.com/r/1650791 Signed-off-by: Jeetesh Burman <jburman@nvidia.com> (cherry picked from commit 5cabd53985a30aa818896abdb64564a74c09ab9c) Reviewed-on: https://git-master.nvidia.com/r/1660772 GVS: Gerrit_Virtual_Submit Reviewed-by: Bibek Basu <bbasu@nvidia.com>
2017-11-29Merge tag 'tegra-l4t-r21.6' into toradex_tk1_l4t_r21.6Marcel Ziswiler
Merge NVIDIA's latest Linux for Tegra aka L4T R21.6 Linux kernel changes from git://nv-tegra.nvidia.com/linux-3.10.git commit: b271e8fa67a6d9c4600274a25636cfe00fdd1b68 Signed-off-by: Marcel Ziswiler <marcel.ziswiler@toradex.com> Acked-by: Dominik Sliwa <dominik.sliwa@toradex.com>
2017-11-29media: ov5640: major driver cleanuptoradex_tk1_l4t_r21.5Peter Gielda
Signed-off-by: Peter Gielda <pgielda@antmicro.com> Acked-by: Marcel Ziswiler <marcel.ziswiler@toradex.com>
2017-06-20media: tegra: nvavp: Fix UAF issue.Jitendra Kumar
Use locking to protect generated fd, so that it can't be freed before channel open completes. Also add null value checks in release call. CVE-2016-8449 (A-31798848) Bug 1830023 Bug 1849492 Change-Id: Ie6e2b29c7132fdfdff6b0bfa75440bd43afffd5f Signed-off-by: Gagan Grover <ggrover@nvidia.com> Reviewed-on: http://git-master/r/1285817 (cherry picked from commit 2ff0fdedfd65f269359d6540df4662e958681aa7) Reviewed-on: http://git-master/r/1299505 (cherry picked from commit ea1af2ce5a746bda36205357c9e0adaf527026bb) Reviewed-on: http://git-master/r/1489467 (cherry picked from commit 89559abb25f82dc333eafa26391be0a50d6e9e0a) Reviewed-on: http://git-master/r/1504674 Reviewed-by: Automatic_Commit_Validation_User GVS: Gerrit_Virtual_Submit Tested-by: Bibek Basu <bbasu@nvidia.com> Reviewed-by: Bibek Basu <bbasu@nvidia.com> Reviewed-by: Winnie Hsu <whsu@nvidia.com>
2017-05-16tegra: camera: Fix UAF security issueFrank Chen
Fix UAF (use-after-free) security issue in camera.pcl driver Bug 1832830 Change-Id: Ie0f8a58a7bb9d1b4949e0f68d25d6da108f06e76 Signed-off-by: Frank Chen <frankc@nvidia.com> Reviewed-on: http://git-master/r/1271371 Reviewed-by: Automatic_Commit_Validation_User GVS: Gerrit_Virtual_Submit Reviewed-by: Jihoon Bang <jbang@nvidia.com> Reviewed-by: Winnie Hsu <whsu@nvidia.com>
2017-05-16tegra: camera race condition vulnerabilityMark Salyzyn
- Add mutex_lock(cam_desc.d_mutex) around ioctl access functions. - Check cam->cdev in PCLLK_IOCTL_DEV_DEL ioctl. (Back ported from Nexus N9 project) Bug 1832830 Signed-off-by: <tiangangpi@gmail.com> Signed-off-by: Xiaya Hu <xiaya@nvidia.com> Signed-off-by: Mark Salyzyn <salyzyn@google.com> Bug: 28026625 Change-Id: I81fbab628fb6516afa2cf5d3e0adf333aa2eb003 Reviewed-on: http://git-master/r/1271370 Reviewed-by: Automatic_Commit_Validation_User GVS: Gerrit_Virtual_Submit Reviewed-by: Frank Chen <frankc@nvidia.com> Tested-by: Frank Chen <frankc@nvidia.com> Reviewed-by: Jihoon Bang <jbang@nvidia.com> Reviewed-by: Winnie Hsu <whsu@nvidia.com>
2017-05-16camera: tegra: Fix security vulnerabilityAmey Asgaonkar
Check a few input params to make sure there is no potential for a heap overflow in the driver. (Back ported from Nexus N9 project) Bug 1757475 (nvidia) Bug 1832830 (nvidia) Bug 28193342 (google) Change-Id: I979fa38c5f453cfad7070f0340ec04adde5bac13 Signed-off-by: Amey Asgaonkar <aasgaonkar@nvidia.com> Reviewed-on: http://git-master/r/1271369 Reviewed-by: Automatic_Commit_Validation_User GVS: Gerrit_Virtual_Submit Reviewed-by: Frank Chen <frankc@nvidia.com> Tested-by: Frank Chen <frankc@nvidia.com> Reviewed-by: Jihoon Bang <jbang@nvidia.com> Reviewed-by: Winnie Hsu <whsu@nvidia.com>
2017-05-16tegra: camera: validate PCLLK_IOCTL_SEQ_XX paramsGreg Hackmann
The driver expects the userspace-provided table to be terminated with addr == CAMERA_TABLE_END. Reject tables that aren't. (back ported from Nexus N9 project) Bug 1832830 Change-Id: Id1e168e02fbf323d094fe8c36c6e4bd90cceee4f Signed-off-by: Greg Hackmann <ghackmann@google.com> Reviewed-on: http://git-master/r/1271368 Reviewed-by: Automatic_Commit_Validation_User GVS: Gerrit_Virtual_Submit Reviewed-by: Frank Chen <frankc@nvidia.com> Tested-by: Frank Chen <frankc@nvidia.com> Reviewed-by: Jihoon Bang <jbang@nvidia.com> Reviewed-by: Winnie Hsu <whsu@nvidia.com>
2017-05-16media: tegra: camera: sanity-check ioctl parameterGreg Hackmann
Several places in the camera stack can hit integer overflows or cause bad allocations if userspace passes in a bogus sizeofvalue parameter. Protect against this by using appropriately-sized integer types, adding range checks, replacing array-allocation calls with kcalloc(), and checking for allocations returning ZERO_SIZE_PTR. For one specific ioctl (PCLLK_IOCTL_UPDATE) sizeofvalue = 0 is fine, since when that happens the subdrivers won't actually touch the returned allocation. In fact the existing userspace camera driver makes calls like these and expects them to succeed! Handle this special case by adding a __camera_get_params variant that optionally treats zero-sized inputs as valid. (back ported from Nexus N9 project) Bug 1832830 Change-Id: Ie3250d8a4b814de5820fa0190b4cbd1af3ca4b3f Reported-by: Jianqiang Zhao <zhaojianqiang1@gmail.com> Signed-off-by: Greg Hackmann <ghackmann@google.com> Reviewed-on: http://git-master/r/1271367 Reviewed-by: Automatic_Commit_Validation_User GVS: Gerrit_Virtual_Submit Reviewed-by: Frank Chen <frankc@nvidia.com> Tested-by: Frank Chen <frankc@nvidia.com> Reviewed-by: Jihoon Bang <jbang@nvidia.com> Reviewed-by: Winnie Hsu <whsu@nvidia.com>
2017-04-04media: ov5640: set continuous clock for all modesWojciech Bieganski
Signed-off-by: Wojciech Bieganski <wbieganski@antmicro.com> Acked-by: Marcel Ziswiler <marcel.ziswiler@toradex.com>
2017-04-04media: tegra_camera: add continuous clk supportWojciech Bieganski
Signed-off-by: Wojciech Bieganski <wbieganski@antmicro.com> Acked-by: Marcel Ziswiler <marcel.ziswiler@toradex.com>
2017-04-04media: three csi2 inputs: tc378743 (csia/b), adv7280m (csie)Wojciech Bieganski
Signed-off-by: Wojciech Bieganski <wbieganski@antmicro.com> Acked-by: Marcel Ziswiler <marcel.ziswiler@toradex.com>
2017-04-04media: fix pal supportWojciech Bieganski
Signed-off-by: Wojciech Bieganski <wbieganski@antmicro.com> Acked-by: Marcel Ziswiler <marcel.ziswiler@toradex.com>
2017-04-04media: fix simultaneous captureWojciech Bieganski
Signed-off-by: Wojciech Bieganski <wbieganski@antmicro.com> Acked-by: Marcel Ziswiler <marcel.ziswiler@toradex.com>
2017-04-04Reapply "media: tegra_camera: introduce 2 kthreads for capture"Mariusz Glebocki
This reverts commit b2f6b2abc791802631ff1c85488cdf3c1f0a97e2. Signed-off-by: Mariusz Glebocki <mglebocki@antmicro.com> Acked-by: Marcel Ziswiler <marcel.ziswiler@toradex.com>
2016-11-21Revert "media: tegra_camera: introduce 2 kthreads for capture"Marcel Ziswiler
This reverts commit ff5bccb61c1f8da1f63451fda88bd1f65dbee5b2. This makes Antmicro's OV5640 camera module work again as described on their blog here: http://antmicro.com/Blog/2015/09/jetson-tk1-cameras/ Further investigation pending. Acked-by: Marcel Ziswiler <marcel.ziswiler@toradex.com> Acked-by: Dominik Sliwa <dominik.sliwa@toradex.com>
2016-11-21media: support for second single-lane decoder (ADV7280M)Wojciech Bieganski
Connected to CSI CIL-E. Cameras doesn't work simultaneously. Acked-by: Marcel Ziswiler <marcel.ziswiler@toradex.com> Acked-by: Dominik Sliwa <dominik.sliwa@toradex.com>
2016-11-21media: tc358743: update hdmi to csi-2 driverTomasz Gorochowik
A major part of the driver has been rewritten in order to avoid writing binary blobs to the chip. This version also adds support for more video modes. Input video modes supported: - 1920x1080 @ 60 - 1280x1024 @ 75 - 1280x720 @ 60 - 1024x768 @ 75 - 800x600 @ 75 - 640x480 @ 75 Acked-by: Marcel Ziswiler <marcel.ziswiler@toradex.com> Acked-by: Dominik Sliwa <dominik.sliwa@toradex.com>
2016-11-21ADV7280M video decoder with deinterlacer supportWojciech Bieganski
known issues: - decoder outputs PAL (720x576), but the image looks fine only when streamed in 640x576 mode, - vertical synchronisation glitches, - setting queue-size in gstreamer greater than 1 results in blinking image, - every start of streaming requires reloading of the modules Acked-by: Marcel Ziswiler <marcel.ziswiler@toradex.com> Acked-by: Dominik Sliwa <dominik.sliwa@toradex.com>
2016-11-21TC358743 HDMI to CSI-2 bridge supportWojciech Bieganski
known issues: - HDMI input works only in 640x480 mode, 720p only in test pattern mode, any 4-lane mode doesn't work - set HDMI transmitter to VGA mode before starting the stream Acked-by: Marcel Ziswiler <marcel.ziswiler@toradex.com> Acked-by: Dominik Sliwa <dominik.sliwa@toradex.com>
2016-11-21OV5640 camera supportWojciech Bieganski
known issues: - works only in 1080p mode, - vertical synchronisation glitches, - setting queue-size in gstreamer greater than 1 results in blinking image - every start of streaming requires reloading of the modules Acked-by: Marcel Ziswiler <marcel.ziswiler@toradex.com> Acked-by: Dominik Sliwa <dominik.sliwa@toradex.com>
2016-11-21AP1302 from ON Semiconductor support addedMarcel Ziswiler
Acked-by: Marcel Ziswiler <marcel.ziswiler@toradex.com> Acked-by: Dominik Sliwa <dominik.sliwa@toradex.com>
2016-11-21YUV sensors support added to tegra_camera driverWojciech Bieganski
Acked-by: Marcel Ziswiler <marcel.ziswiler@toradex.com> Acked-by: Dominik Sliwa <dominik.sliwa@toradex.com>
2016-09-29media: platform: tegra: fix gcc-6 compilationMarcel Ziswiler
drivers/media/platform/tegra/ad5816.c: In function 'ad5816_param_wr': drivers/media/platform/tegra/ad5816.c:682:6: error: this 'if' clause does not guard... [-Werror=misleading-indentation] if (info->s_mode != NVC_SYNC_STEREO) ^~ Signed-off-by: Marcel Ziswiler <marcel.ziswiler@toradex.com> Acked-by: Max Krummenacher <max.krummenacher@toradex.com>
2016-09-29media: tegra: fix gcc-6 compilationMarcel Ziswiler
drivers/media/platform/tegra/dw9718.c:627:6: error: this 'if' clause does not guard... [-Werror=misleading-indentation] if (info->s_mode != NVC_SYNC_STEREO) ^~ Signed-off-by: Marcel Ziswiler <marcel.ziswiler@toradex.com> Acked-by: Max Krummenacher <max.krummenacher@toradex.com>
2016-09-15nvavp: Add missing mutex unlockSoumen Kumar Dey
Add missing mutex unlock for nvavp_submit. bug 1775299 Change-Id: I1b525e192bfd9dd19bcd0211484400445eda7b2b Signed-off-by: Soumen Kumar Dey <sdey@nvidia.com> Reviewed-on: http://git-master/r/1221210 GVS: Gerrit_Virtual_Submit Reviewed-by: Matthew Pedro <mapedro@nvidia.com>
2016-09-15nvavp: Add mutex lock for all avp submitSoumen Kumar Dey
Add mutex lock for nvavp_submit to avoid race condition. bug 1775299 Change-Id: I11a66a58a1f048d6a0ee5aa949f852bfef56dc07 Signed-off-by: Soumen Kumar Dey <sdey@nvidia.com> Reviewed-on: http://git-master/r/1164117 (cherry picked from commit 1faa6a739996fdacff3dbc85ad46235f42ad79c9) Reviewed-on: http://git-master/r/1214643 GVS: Gerrit_Virtual_Submit Reviewed-by: Matthew Pedro <mapedro@nvidia.com>
2016-09-06tegra:nvavp: Fix buffer overflow issuePraveen Kumar Reddy M.V
Fixed possible buffer overflow issue in func nvavp_pushbuffer_update(). Bug 1774401 Change-Id: Id0dec1cbf91d492335d0809c3c0bf146f6cb9d3d Signed-off-by: Praveen Kumar Reddy M.V. <pkreddy@nvidia.com> Reviewed-on: http://git-master/r/1163365 (cherry picked from commit 1e9ba50b225e841b52a93503fce818c1a21100f7) Reviewed-on: http://git-master/r/1164130 Reviewed-by: Automatic_Commit_Validation_User Reviewed-by: Matthew Pedro <mapedro@nvidia.com> GVS: Gerrit_Virtual_Submit Reviewed-by: Bibek Basu <bbasu@nvidia.com> Tested-by: Bibek Basu <bbasu@nvidia.com>
2016-05-26platform: tegra: nvavp: fix for pre-decrement of clk_enabled cntrBhushan Rupde
Bug 1729847 Change-Id: Ie455b0469a1d4e35453ca9e36c5e90dfdc6f56a2 Signed-off-by: Bhushan Rupde <brupde@nvidia.com> Reviewed-on: http://git-master/r/1147432 Reviewed-by: Mohan Nimaje <mnimaje@nvidia.com> Reviewed-by: Soumen Dey <sdey@nvidia.com> Reviewed-by: Bharat Nihalani <bnihalani@nvidia.com>
2016-05-23camera: tegra: Fix security vulnerability issueFrank Chen
Deprecate outdated UPDATE_GPIO function in camera.pcl driver. This function is not used by any code anymore and is a security vulnerability since it is trying to access user mode pointer directly. Bug 1745102 Change-Id: I4e7e5f9c186f980dcadfe52ec4284102255f19cf Signed-off-by: Frank Chen <frankc@nvidia.com> Reviewed-on: http://git-master/r/1115302 (cherry picked from commit 2e5c355c904a19d71456a04c70f3fb4fc7d918b0) Reviewed-on: http://git-master/r/1123362 Reviewed-by: Matthew Pedro <mapedro@nvidia.com> Tested-by: Matthew Pedro <mapedro@nvidia.com>
2016-05-20camera: tegra: Fix security vulnerability issueFrank Chen
We need to validate power on/off function size passed in from user mode in order to avoid integer overflow or out of memory failures. Bug 1745100 Change-Id: Idddd848f7dc1e864559ad219f9204325128484e5 Signed-off-by: Frank Chen <frankc@nvidia.com> Signed-off-by: Bibek Basu <bbasu@nvidia.com> Reviewed-on: http://git-master/r/1114354 (cherry picked from commit 8b3afcc132882f3102083f9a24de7f55476ca59b) Reviewed-on: http://git-master/r/1150944 Reviewed-by: Automatic_Commit_Validation_User GVS: Gerrit_Virtual_Submit Reviewed-by: Matthew Pedro <mapedro@nvidia.com>
2016-05-20media: tegra: camera: Fix stack overreadAmey Asgaonkar
We are not checking a variable which is user controlled. This can lead to reading of the stack data. Adding a check to ensure it is less than the max possible value of the variable. Bug 1763649 Change-Id: I395e882d030199bdd7684837906a9b5d60741650 Signed-off-by: Amey Asgaonkar <aasgaonkar@nvidia.com> Signed-off-by: Bibek Basu <bbasu@nvidia.com> Reviewed-on: http://git-master/r/1150943 GVS: Gerrit_Virtual_Submit Reviewed-by: Matthew Pedro <mapedro@nvidia.com>
2016-04-28[media] v4l: vb2-dma-contig: fix vb2_get_vma()Sri Krishna chowdary
nvmap expects that same VMA is opened and closed to disallow memory leaks. So, nvmap panics if a previously non-existent vma is being closed through it. Hence modify the sequence in vb2_get_vma() to open the vma_copy before returning it. This way nvmap sees that the vma_copy exists in its list and will close the vma. Bug 200164002 Change-Id: I45dfb8ca710375a0e70d9802ebdcc9fd4d0b4600 Signed-off-by: Sri Krishna chowdary <schowdary@nvidia.com> Reviewed-on: http://git-master/r/931997 (cherry picked from commit bf1d15d8a879a599f9801310cecbbb61ea60e931) Reviewed-on: http://git-master/r/1133707 Tested-by: Bryan Wu <pengw@nvidia.com> Reviewed-by: Bryan Wu <pengw@nvidia.com> Reviewed-by: Krishna Reddy <vdumpa@nvidia.com> Reviewed-by: Matthew Pedro <mapedro@nvidia.com>
2016-04-05media: tegra: nvavp: Fix reloc offset checkSomu Sundaram
- Check whether command buffer data offset is 32-bit aligned - Check whether relocation offset is 32-bit aligned and calculated offset is within command buffer size - Check whether target offset is 32-bit aligned and derived address is within target buffer size Bug 1741516 Change-Id: Ie5370bc1538c8cf9a702904fb88eb850baeb063d Signed-off-by: Somu Sundaram <somasundaram@nvidia.com> Reviewed-on: http://git-master/r/1113949 Reviewed-by: Automatic_Commit_Validation_User GVS: Gerrit_Virtual_Submit Tested-by: Somu Sundaram <somasundarams@nvidia.com> Reviewed-by: Bibek Basu <bbasu@nvidia.com> Reviewed-by: Bharat Nihalani <bnihalani@nvidia.com>
2016-04-05media: tegra: nvavp: Fix arbitrary kernel writeSomu Sundaram
Add checks for command buffer offset, relocation offset in command buffer and target offset for patching relocation to prevent aritrary kernel write Bug 1741516 Change-Id: Ia6183ca75f983c0ede23606be9e5d824aa5fa41d Signed-off-by: Somu Sundaram <somasundaram@nvidia.com> Reviewed-on: http://git-master/r/1111699 Reviewed-by: Automatic_Commit_Validation_User Reviewed-by: Matthew Pedro <mapedro@nvidia.com> GVS: Gerrit_Virtual_Submit Tested-by: Somu Sundaram <somasundarams@nvidia.com> Reviewed-by: Bibek Basu <bbasu@nvidia.com> Reviewed-by: Bharat Nihalani <bnihalani@nvidia.com>
2016-03-16media: tegra: nvavp: Fix heap overflowSomasundaram S
Increase NVAVP_MAX_RELOCATION_COUNT to max. possible value and add check to return error if num_relocs in nvavp_pushbuffer_submit_ioctl exceeds NVAVP_MAX_RELOCATION_COUNT Bug 1739930 Change-Id: Ief36cedd692aa53135fc6a0039b19f18609259dd Signed-off-by: Somasundaram S <somasundaram@nvidia.com> Reviewed-on: http://git-master/r/1030885 Tested-by: Somu Sundaram <somasundarams@nvidia.com> Reviewed-by: Automatic_Commit_Validation_User Reviewed-by: Bharat Nihalani <bnihalani@nvidia.com>
2015-10-29media: tegra_camera: introduce 2 kthreads for captureBryan Wu
Use one kthread to start capture a frame and wait for next frame start. Before waiting, it will move the current buffer to another queue which will be handled another kthread. The second kthread (capture_done) will wait for memory output done sync point event and handle the buffer to videobuffer2 framework as capture done. Bug 1686911 Change-Id: Ia092c708ecca3b2e7cbc657a96fd247ea4a00d2f Signed-off-by: Bryan Wu <pengw@nvidia.com> Reviewed-on: http://git-master/r/819177 GVS: Gerrit_Virtual_Submit Reviewed-by: Matthew Pedro <mapedro@nvidia.com>
2015-10-29media: tegra_camera: replace workqueue with kthreadBryan Wu
Use kthread instead of workqueue, which will create a dedicated kernel thread for capture. Remove useless mutex and convert spin_lock_irq() to normal spin_lock(). Bug 1686911 Change-Id: Ib236a7ebbdd0359f2705774a979825f1f9e9d82a Signed-off-by: Bryan Wu <pengw@nvidia.com> Reviewed-on: http://git-master/r/819176 GVS: Gerrit_Virtual_Submit Reviewed-by: Matthew Pedro <mapedro@nvidia.com>
2015-10-29media: tegra_camera: add line alignment checkBryan Wu
bytes_per_line should be 64 bytes aligned in Tegra. Add a function to check that and return the right value for LINE_STRIDE register. Bug 1694764 Change-Id: I1bb926a416719d19cad509f9a9a7c4fce06b851a Signed-off-by: Bryan Wu <pengw@nvidia.com> Reviewed-on: http://git-master/r/816975 Reviewed-by: Automatic_Commit_Validation_User GVS: Gerrit_Virtual_Submit Reviewed-by: Matthew Pedro <mapedro@nvidia.com>
2015-09-01Kernel: ar0330: change 720p settingsArun Kannan
Based on latest info from Aptina, change 720p settings. Bug 1643556 Change-Id: Ia1ea066ebf265670bb8e0503e9502ac9f24a27ff Signed-off-by: Arun Kannan <akannan@nvidia.com> Reviewed-on: http://git-master/r/748499 Reviewed-by: Winnie Hsu <whsu@nvidia.com> Tested-by: Winnie Hsu <whsu@nvidia.com>
2015-08-07AR0330: validate with V4L2 for Jetson TK1Arun Kannan
Bug 1643556 Change-Id: I7330bd3ec33e2309577c75bac79e120167b0f81e Signed-off-by: Arun Kannan <akannan@nvidia.com> Reviewed-on: http://git-master/r/748395 Reviewed-by: Winnie Hsu <whsu@nvidia.com> Tested-by: Winnie Hsu <whsu@nvidia.com>
2015-06-24media:ar0330: add 4 lanes setting 2048x1296tegra-l4t-r21.4Ming Wong
bug 1655159 Change-Id: I5c09cb63075f3465e90aee4f3619df02c34bca95 Signed-off-by: Ming Wong <miwong@nvidia.com> Reviewed-on: http://git-master/r/757527 Reviewed-by: Automatic_Commit_Validation_User GVS: Gerrit_Virtual_Submit Reviewed-by: Bibek Basu <bbasu@nvidia.com> Reviewed-by: Venkat Moganty <vmoganty@nvidia.com>
2015-06-19media: tegra_camera: add start streaming callBryan Wu
Queueing buffer might happen before starting streaming. So any queueing buffer operation before starting streaming shouldn't trigger real capture but just queue the buffer. After starting streaming, it will wake up kernel workqueue to start real capture. Bug 1639982 Change-Id: I66fd527bbd12790b2d688f320214976e70a658f3 Signed-off-by: Bryan Wu <pengw@nvidia.com> Reviewed-on: http://git-master/r/754710 Reviewed-by: Automatic_Commit_Validation_User Reviewed-by: David Wang (SW-TEGRA) <davidw@nvidia.com> Reviewed-by: Winnie Hsu <whsu@nvidia.com>
2015-06-19media: tegra_camera: optimize single shot modeBryan Wu
Current single shot mode, pixel parser is disabled after capture one frame and software waits for memory write ack done syncpoint, which only gives us half the frame rate. Optimized single shot mode: - during capture setup, set single shot mode - for each frame, wait for FRAME_START syncpoint - arm single shot bit to start capture - for the last frame, wait for MWA_DONE syncpoint to make sure capture finished. With optimized single shot mode, frame rate is about 4208x3120 @ 24fps for IMX135 and 1920x1080 @ 30fps for AR0261. Bug 1639982 Change-Id: I0b15d02c2853647d03f5b2d38a7fe5c145174bd5 Signed-off-by: Bryan Wu <pengw@nvidia.com> Reviewed-on: http://git-master/r/754709 Reviewed-by: Automatic_Commit_Validation_User Reviewed-by: David Wang (SW-TEGRA) <davidw@nvidia.com> Reviewed-by: Winnie Hsu <whsu@nvidia.com>
2015-06-05media: tegra_camera: change MIPI_CAL print levelBryan Wu
Bug 1648875 Change-Id: I970a3eafcd7ec10f217f4c1cb13db9193dc037f6 Signed-off-by: Bryan Wu <pengw@nvidia.com> Reviewed-on: http://git-master/r/752761 Reviewed-by: Automatic_Commit_Validation_User Reviewed-by: Arun Kannan <akannan@nvidia.com> GVS: Gerrit_Virtual_Submit Reviewed-by: Matthew Pedro <mapedro@nvidia.com>
generated by cgit v1.2.3 (git 2.0.4) at 2024-06-11 06:20:53 +0000