This is an automatic generated email to let you know that the following patch were queued:
Subject: media: venus: venc_ctrls: Change default header mode
Author: Stanimir Varbanov <stanimir.varbanov(a)linaro.org>
Date: Sat Mar 6 13:13:46 2021 +0100
It is observed that on Venus v1 the default header-mode is producing
a bitstream which is not playble. Change the default header-mode to
joined with 1st frame.
Fixes: 002c22bd360e ("media: venus: venc: set inband mode property to FW.")
Cc: stable(a)vger.kernel.org # v5.12
Signed-off-by: Stanimir Varbanov <stanimir.varbanov(a)linaro.org>
Tested-by: Bryan O'Donoghue <bryan.odonoghue(a)linaro.org>
Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei(a)kernel.org>
drivers/media/platform/qcom/venus/venc_ctrls.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
---
diff --git a/drivers/media/platform/qcom/venus/venc_ctrls.c b/drivers/media/platform/qcom/venus/venc_ctrls.c
index fa6324414339..e452acf285cf 100644
--- a/drivers/media/platform/qcom/venus/venc_ctrls.c
+++ b/drivers/media/platform/qcom/venus/venc_ctrls.c
@@ -396,7 +396,7 @@ int venc_ctrl_init(struct venus_inst *inst)
V4L2_MPEG_VIDEO_HEADER_MODE_JOINED_WITH_1ST_FRAME,
~((1 << V4L2_MPEG_VIDEO_HEADER_MODE_SEPARATE) |
(1 << V4L2_MPEG_VIDEO_HEADER_MODE_JOINED_WITH_1ST_FRAME)),
- V4L2_MPEG_VIDEO_HEADER_MODE_SEPARATE);
+ V4L2_MPEG_VIDEO_HEADER_MODE_JOINED_WITH_1ST_FRAME);
v4l2_ctrl_new_std_menu(&inst->ctrl_handler, &venc_ctrl_ops,
V4L2_CID_MPEG_VIDEO_MULTI_SLICE_MODE,
This is an automatic generated email to let you know that the following patch were queued:
Subject: media: venus: pm_helpers: Set opp clock name for v1
Author: Stanimir Varbanov <stanimir.varbanov(a)linaro.org>
Date: Thu Feb 25 15:28:57 2021 +0100
The rate of the core clock is set through devm_pm_opp_set_rate and
to avoid errors from it we have to set the name of the clock via
dev_pm_opp_set_clkname.
Fixes: 9a538b83612c ("media: venus: core: Add support for opp tables/perf voting")
Cc: stable(a)vger.kernel.org # v5.10+
Signed-off-by: Stanimir Varbanov <stanimir.varbanov(a)linaro.org>
Tested-by: Bryan O'Donoghue <bryan.odonoghue(a)linaro.org>
Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei(a)kernel.org>
drivers/media/platform/qcom/venus/pm_helpers.c | 19 ++++++++++++++++++-
1 file changed, 18 insertions(+), 1 deletion(-)
---
diff --git a/drivers/media/platform/qcom/venus/pm_helpers.c b/drivers/media/platform/qcom/venus/pm_helpers.c
index e349d01422c5..95b4d40ff6a5 100644
--- a/drivers/media/platform/qcom/venus/pm_helpers.c
+++ b/drivers/media/platform/qcom/venus/pm_helpers.c
@@ -279,7 +279,22 @@ set_freq:
static int core_get_v1(struct venus_core *core)
{
- return core_clks_get(core);
+ int ret;
+
+ ret = core_clks_get(core);
+ if (ret)
+ return ret;
+
+ core->opp_table = dev_pm_opp_set_clkname(core->dev, "core");
+ if (IS_ERR(core->opp_table))
+ return PTR_ERR(core->opp_table);
+
+ return 0;
+}
+
+static void core_put_v1(struct venus_core *core)
+{
+ dev_pm_opp_put_clkname(core->opp_table);
}
static int core_power_v1(struct venus_core *core, int on)
@@ -296,6 +311,7 @@ static int core_power_v1(struct venus_core *core, int on)
static const struct venus_pm_ops pm_ops_v1 = {
.core_get = core_get_v1,
+ .core_put = core_put_v1,
.core_power = core_power_v1,
.load_scale = load_scale_v1,
};
@@ -368,6 +384,7 @@ static int venc_power_v3(struct device *dev, int on)
static const struct venus_pm_ops pm_ops_v3 = {
.core_get = core_get_v1,
+ .core_put = core_put_v1,
.core_power = core_power_v1,
.vdec_get = vdec_get_v3,
.vdec_power = vdec_power_v3,
This is an automatic generated email to let you know that the following patch were queued:
Subject: media: venus: hfi_parser: Check for instance after hfi platform get
Author: Stanimir Varbanov <stanimir.varbanov(a)linaro.org>
Date: Sun Mar 7 12:17:27 2021 +0100
The inst function argument is != NULL only for Venus v1 and
we did not migrate v1 to a hfi_platform abstraction yet. So
check for instance != NULL only after hfi_platform_get returns
no error.
Fixes: e29929266be1 ("media: venus: Get codecs and capabilities from hfi platform")
Cc: stable(a)vger.kernel.org # v5.12
Signed-off-by: Stanimir Varbanov <stanimir.varbanov(a)linaro.org>
Tested-by: Bryan O'Donoghue <bryan.odonoghue(a)linaro.org>
Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei(a)kernel.org>
drivers/media/platform/qcom/venus/hfi_parser.c | 6 +++---
1 file changed, 3 insertions(+), 3 deletions(-)
---
diff --git a/drivers/media/platform/qcom/venus/hfi_parser.c b/drivers/media/platform/qcom/venus/hfi_parser.c
index ce230974761d..5b8389b98299 100644
--- a/drivers/media/platform/qcom/venus/hfi_parser.c
+++ b/drivers/media/platform/qcom/venus/hfi_parser.c
@@ -235,13 +235,13 @@ static int hfi_platform_parser(struct venus_core *core, struct venus_inst *inst)
u32 enc_codecs, dec_codecs, count = 0;
unsigned int entries;
- if (inst)
- return 0;
-
plat = hfi_platform_get(core->res->hfi_version);
if (!plat)
return -EINVAL;
+ if (inst)
+ return 0;
+
if (plat->codecs)
plat->codecs(&enc_codecs, &dec_codecs, &count);
This is an automatic generated email to let you know that the following patch were queued:
Subject: media: venus: hfi_parser: Don't initialize parser on v1
Author: Stanimir Varbanov <stanimir.varbanov(a)linaro.org>
Date: Sun Mar 7 12:16:03 2021 +0100
The Venus v1 behaves differently comparing with the other Venus
version in respect to capability parsing and when they are send
to the driver. So we don't need to initialize hfi parser for
multiple invocations like what we do for > v1 Venus versions.
Fixes: 10865c98986b ("media: venus: parser: Prepare parser for multiple invocations")
Cc: stable(a)vger.kernel.org # v5.10+
Signed-off-by: Stanimir Varbanov <stanimir.varbanov(a)linaro.org>
Tested-by: Bryan O'Donoghue <bryan.odonoghue(a)linaro.org>
Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei(a)kernel.org>
drivers/media/platform/qcom/venus/hfi_parser.c | 6 ++++--
1 file changed, 4 insertions(+), 2 deletions(-)
---
diff --git a/drivers/media/platform/qcom/venus/hfi_parser.c b/drivers/media/platform/qcom/venus/hfi_parser.c
index 7263c0c32695..ce230974761d 100644
--- a/drivers/media/platform/qcom/venus/hfi_parser.c
+++ b/drivers/media/platform/qcom/venus/hfi_parser.c
@@ -277,8 +277,10 @@ u32 hfi_parser(struct venus_core *core, struct venus_inst *inst, void *buf,
parser_init(inst, &codecs, &domain);
- core->codecs_count = 0;
- memset(core->caps, 0, sizeof(core->caps));
+ if (core->res->hfi_version > HFI_VERSION_1XX) {
+ core->codecs_count = 0;
+ memset(core->caps, 0, sizeof(core->caps));
+ }
while (words_count) {
data = word + 1;
This is an automatic generated email to let you know that the following patch were queued:
Subject: media: staging/intel-ipu3: Fix set_fmt error handling
Author: Ricardo Ribalda <ribalda(a)chromium.org>
Date: Wed Mar 10 01:16:46 2021 +0100
If there in an error during a set_fmt, do not overwrite the previous
sizes with the invalid config.
Without this patch, v4l2-compliance ends up allocating 4GiB of RAM and
causing the following OOPs
[ 38.662975] ipu3-imgu 0000:00:05.0: swiotlb buffer is full (sz: 4096 bytes)
[ 38.662980] DMA: Out of SW-IOMMU space for 4096 bytes at device 0000:00:05.0
[ 38.663010] general protection fault: 0000 [#1] PREEMPT SMP
Cc: stable(a)vger.kernel.org
Fixes: 6d5f26f2e045 ("media: staging/intel-ipu3-v4l: reduce kernel stack usage")
Signed-off-by: Ricardo Ribalda <ribalda(a)chromium.org>
Signed-off-by: Sakari Ailus <sakari.ailus(a)linux.intel.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei(a)kernel.org>
drivers/staging/media/ipu3/ipu3-v4l2.c | 5 +++++
1 file changed, 5 insertions(+)
---
diff --git a/drivers/staging/media/ipu3/ipu3-v4l2.c b/drivers/staging/media/ipu3/ipu3-v4l2.c
index 60aa02eb7d2a..e8944e489c56 100644
--- a/drivers/staging/media/ipu3/ipu3-v4l2.c
+++ b/drivers/staging/media/ipu3/ipu3-v4l2.c
@@ -669,6 +669,7 @@ static int imgu_fmt(struct imgu_device *imgu, unsigned int pipe, int node,
struct imgu_css_pipe *css_pipe = &imgu->css.pipes[pipe];
struct imgu_media_pipe *imgu_pipe = &imgu->imgu_pipe[pipe];
struct imgu_v4l2_subdev *imgu_sd = &imgu_pipe->imgu_sd;
+ struct v4l2_pix_format_mplane fmt_backup;
dev_dbg(dev, "set fmt node [%u][%u](try = %u)", pipe, node, try);
@@ -734,6 +735,7 @@ static int imgu_fmt(struct imgu_device *imgu, unsigned int pipe, int node,
ret = -EINVAL;
goto out;
}
+ fmt_backup = *fmts[css_q];
*fmts[css_q] = f->fmt.pix_mp;
if (try)
@@ -741,6 +743,9 @@ static int imgu_fmt(struct imgu_device *imgu, unsigned int pipe, int node,
else
ret = imgu_css_fmt_set(&imgu->css, fmts, rects, pipe);
+ if (try || ret < 0)
+ *fmts[css_q] = fmt_backup;
+
/* ret is the binary number in the firmware blob */
if (ret < 0)
goto out;
On Wed, 2021-03-24 at 23:07 +0500, Muhammad Usama Anjum wrote:
> If some error occurs, URB buffers should also be freed. If they aren't
> freed with the dvb here, the em28xx_dvb_fini call doesn't frees the URB
> buffers as dvb is set to NULL. The function in which error occurs should
> do all the cleanup for the allocations it had done.
>
> Tested the patch with the reproducer provided by syzbot. This patch
> fixes the memleak.
>
> Reported-by: syzbot+889397c820fa56adf25d(a)syzkaller.appspotmail.com
> Signed-off-by: Muhammad Usama Anjum <musamaanjum(a)gmail.com>
> ---
> Resending the same path as some email addresses were missing from the
> earlier email.
>
> syzbot found the following issue on:
>
> HEAD commit: 1a4431a5 Merge tag 'afs-fixes-20210315' of git://git.kerne..
> git tree: upstream
> console output: https://syzkaller.appspot.com/x/log.txt?x=11013a7cd00000
> kernel config: https://syzkaller.appspot.com/x/.config?x=ff6b8b2e9d5a1227
> dashboard link: https://syzkaller.appspot.com/bug?extid=889397c820fa56adf25d
> syz repro: https://syzkaller.appspot.com/x/repro.syz?x=1559ae3ad00000
> C reproducer: https://syzkaller.appspot.com/x/repro.c?x=176985c6d00000
>
> drivers/media/usb/em28xx/em28xx-dvb.c | 1 +
> 1 file changed, 1 insertion(+)
>
> diff --git a/drivers/media/usb/em28xx/em28xx-dvb.c b/drivers/media/usb/em28xx/em28xx-dvb.c
> index 526424279637..471bd74667e3 100644
> --- a/drivers/media/usb/em28xx/em28xx-dvb.c
> +++ b/drivers/media/usb/em28xx/em28xx-dvb.c
> @@ -2010,6 +2010,7 @@ static int em28xx_dvb_init(struct em28xx *dev)
> return result;
>
> out_free:
> + em28xx_uninit_usb_xfer(dev, EM28XX_DIGITAL_MODE);
> kfree(dvb);
> dev->dvb = NULL;
> goto ret;
I'd received the following notice and waiting for the review:
On Thu, 2021-03-25 at 09:06 +0000, Patchwork wrote:
> Hello,
>
> The following patch (submitted by you) has been updated in Patchwork:
>
> * linux-media: media: em28xx: fix memory leak
> - http://patchwork.linuxtv.org/project/linux-media/patch/20210324180753.GA410…
> - for: Linux Media kernel patches
> was: New
> now: Under Review
>
> This email is a notification only - you do not need to respond.
>
> Happy patchworking.
>
Thanks,
Usama
From: Johannes Berg <johannes.berg(a)intel.com>
Recompiling with the new extended version of struct rfkill_event
broke systemd in *two* ways:
- It used "sizeof(struct rfkill_event)" to read the event, but
then complained if it actually got something != 8, this broke
it on new kernels (that include the updated API);
- It used sizeof(struct rfkill_event) to write a command, but
didn't implement the intended expansion protocol where the
kernel returns only how many bytes it accepted, and errored
out due to the unexpected smaller size on kernels that didn't
include the updated API.
Even though systemd has now been fixed, that fix may not be always
deployed, and other applications could potentially have similar
issues.
As such, in the interest of avoiding regressions, revert the
default API "struct rfkill_event" back to the original size.
Instead, add a new "struct rfkill_event_ext" that extends it by
the new field, and even more clearly document that applications
should be prepared for extensions in two ways:
* write might only accept fewer bytes on older kernels, and
will return how many to let userspace know which data may
have been ignored;
* read might return anything between 8 (the original size) and
whatever size the application sized its buffer at, indicating
how much event data was supported by the kernel.
Perhaps that will help avoid such issues in the future and we
won't have to come up with another version of the struct if we
ever need to extend it again.
Applications that want to take advantage of the new field will
have to be modified to use struct rfkill_event_ext instead now,
which comes with the danger of them having already been updated
to use it from 'struct rfkill_event', but I found no evidence
of that, and it's still relatively new.
Cc: stable(a)vger.kernel.org # 5.11
Reported-by: Takashi Iwai <tiwai(a)suse.de>
Signed-off-by: Johannes Berg <johannes.berg(a)intel.com>
---
include/uapi/linux/rfkill.h | 80 +++++++++++++++++++++++++++++++------
net/rfkill/core.c | 7 ++--
2 files changed, 72 insertions(+), 15 deletions(-)
diff --git a/include/uapi/linux/rfkill.h b/include/uapi/linux/rfkill.h
index 03e8af87b364..9b77cfc42efa 100644
--- a/include/uapi/linux/rfkill.h
+++ b/include/uapi/linux/rfkill.h
@@ -86,34 +86,90 @@ enum rfkill_hard_block_reasons {
* @op: operation code
* @hard: hard state (0/1)
* @soft: soft state (0/1)
+ *
+ * Structure used for userspace communication on /dev/rfkill,
+ * used for events from the kernel and control to the kernel.
+ */
+struct rfkill_event {
+ __u32 idx;
+ __u8 type;
+ __u8 op;
+ __u8 soft;
+ __u8 hard;
+} __attribute__((packed));
+
+/**
+ * struct rfkill_event_ext - events for userspace on /dev/rfkill
+ * @idx: index of dev rfkill
+ * @type: type of the rfkill struct
+ * @op: operation code
+ * @hard: hard state (0/1)
+ * @soft: soft state (0/1)
* @hard_block_reasons: valid if hard is set. One or several reasons from
* &enum rfkill_hard_block_reasons.
*
* Structure used for userspace communication on /dev/rfkill,
* used for events from the kernel and control to the kernel.
+ *
+ * See the extensibility docs below.
*/
-struct rfkill_event {
+struct rfkill_event_ext {
__u32 idx;
__u8 type;
__u8 op;
__u8 soft;
__u8 hard;
+
+ /*
+ * older kernels will accept/send only up to this point,
+ * and if extended further up to any chunk marked below
+ */
+
__u8 hard_block_reasons;
} __attribute__((packed));
-/*
- * We are planning to be backward and forward compatible with changes
- * to the event struct, by adding new, optional, members at the end.
- * When reading an event (whether the kernel from userspace or vice
- * versa) we need to accept anything that's at least as large as the
- * version 1 event size, but might be able to accept other sizes in
- * the future.
+/**
+ * DOC: Extensibility
+ *
+ * Originally, we had planned to allow backward and forward compatible
+ * changes by just adding fields at the end of the structure that are
+ * then not reported on older kernels on read(), and not written to by
+ * older kernels on write(), with the kernel reporting the size it did
+ * accept as the result.
+ *
+ * This would have allowed userspace to detect on read() and write()
+ * which kernel structure version it was dealing with, and if was just
+ * recompiled it would have gotten the new fields, but obviously not
+ * accessed them, but things should've continued to work.
+ *
+ * Unfortunately, while actually exercising this mechanism to add the
+ * hard block reasons field, we found that userspace (notably systemd)
+ * did all kinds of fun things not in line with this scheme:
+ *
+ * 1. treat the (expected) short writes as an error;
+ * 2. ask to read sizeof(struct rfkill_event) but then compare the
+ * actual return value to RFKILL_EVENT_SIZE_V1 and treat any
+ * mismatch as an error.
+ *
+ * As a consequence, just recompiling with a new struct version caused
+ * things to no longer work correctly on old and new kernels.
+ *
+ * Hence, we've rolled back &struct rfkill_event to the original version
+ * and added &struct rfkill_event_ext. This effectively reverts to the
+ * old behaviour for all userspace, unless it explicitly opts in to the
+ * rules outlined here by using the new &struct rfkill_event_ext.
+ *
+ * Userspace using &struct rfkill_event_ext must adhere to the following
+ * rules
*
- * One exception is the kernel -- we already have two event sizes in
- * that we've made the 'hard' member optional since our only option
- * is to ignore it anyway.
+ * 1. accept short writes, optionally using them to detect that it's
+ * running on an older kernel;
+ * 2. accept short reads, knowing that this means it's running on an
+ * older kernel;
+ * 3. treat reads that are as long as requested as acceptable, not
+ * checking against RFKILL_EVENT_SIZE_V1 or such.
*/
-#define RFKILL_EVENT_SIZE_V1 8
+#define RFKILL_EVENT_SIZE_V1 sizeof(struct rfkill_event)
/* ioctl for turning off rfkill-input (if present) */
#define RFKILL_IOC_MAGIC 'R'
diff --git a/net/rfkill/core.c b/net/rfkill/core.c
index 68d6ef9e59fc..ac15a944573f 100644
--- a/net/rfkill/core.c
+++ b/net/rfkill/core.c
@@ -69,7 +69,7 @@ struct rfkill {
struct rfkill_int_event {
struct list_head list;
- struct rfkill_event ev;
+ struct rfkill_event_ext ev;
};
struct rfkill_data {
@@ -253,7 +253,8 @@ static void rfkill_global_led_trigger_unregister(void)
}
#endif /* CONFIG_RFKILL_LEDS */
-static void rfkill_fill_event(struct rfkill_event *ev, struct rfkill *rfkill,
+static void rfkill_fill_event(struct rfkill_event_ext *ev,
+ struct rfkill *rfkill,
enum rfkill_operation op)
{
unsigned long flags;
@@ -1237,7 +1238,7 @@ static ssize_t rfkill_fop_write(struct file *file, const char __user *buf,
size_t count, loff_t *pos)
{
struct rfkill *rfkill;
- struct rfkill_event ev;
+ struct rfkill_event_ext ev;
int ret;
/* we don't need the 'hard' variable but accept it */
--
2.30.2