mirror of
https://github.com/AuxXxilium/linux_dsm_epyc7002.git
synced 2025-01-14 22:16:26 +07:00
403265137f
A use-after-free bug occures when unbinding the device while it streams. The 'struct vimc_ent_device' allocated for the 'Sensor A' is freed when calling the sensor's 'rm' callback but the freed pointer is later accessed in the function 'vimc_streamer_pipeline_terminate'. To fix this bug, move the release callback of the vimc entities and vimc_device to the release callback of v4l2_device. The .rm callback of vimc_ent_config is replaced by two callbacks: .unregister - this is called upon removing the device and it unregisters the entity. This is an optional callback since subdevices don't need to implement it because they are already unregistered in v4l2_device_unregister. .release - this is called from the release callback of v4l2_device and it frees the entity. This ensures that the entities will be released when the last fh of any of the devices is closed. The commands that cause the crash and the KASAN report: media-ctl -d platform:vimc -V '"Sensor A":0[fmt:SBGGR8_1X8/640x480]' media-ctl -d platform:vimc -V '"Debayer A":0[fmt:SBGGR8_1X8/640x480]' v4l2-ctl -z platform:vimc -d "RGB/YUV Capture" -v width=1920,height=1440 v4l2-ctl -z platform:vimc -d "Raw Capture 0" -v pixelformat=BA81 v4l2-ctl --stream-mmap --stream-count=1000 -d /dev/video2 & sleep 1 echo -n vimc.0 >/sys/bus/platform/drivers/vimc/unbind [ 188.417934] BUG: KASAN: use-after-free in vimc_streamer_pipeline_terminate+0x75/0x140 [vimc] [ 188.420182] Read of size 8 at addr ffff8881e9c26008 by task bash/185 [ 188.421800] [ 188.422223] CPU: 0 PID: 185 Comm: bash Not tainted 5.5.0-rc1+ #1 [ 188.423681] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014 [ 188.425938] Call Trace: [ 188.426610] dump_stack+0x75/0xa0 [ 188.427519] ? vimc_streamer_pipeline_terminate+0x75/0x140 [vimc] [ 188.429057] print_address_description.constprop.6+0x16/0x220 [ 188.430462] ? vimc_streamer_pipeline_terminate+0x75/0x140 [vimc] [ 188.431979] ? vimc_streamer_pipeline_terminate+0x75/0x140 [vimc] [ 188.433455] __kasan_report.cold.9+0x1a/0x40 [ 188.434518] ? vimc_streamer_pipeline_terminate+0x75/0x140 [vimc] [ 188.436010] kasan_report+0xe/0x20 [ 188.436859] vimc_streamer_pipeline_terminate+0x75/0x140 [vimc] [ 188.438339] vimc_streamer_s_stream+0x8b/0x3c0 [vimc] [ 188.439576] vimc_cap_stop_streaming+0x22/0x40 [vimc] [ 188.440863] __vb2_queue_cancel+0x65/0x560 [videobuf2_common] [ 188.442391] vb2_core_queue_release+0x19/0x50 [videobuf2_common] [ 188.443974] vimc_cap_rm+0x10/0x20 [vimc] [ 188.444986] vimc_rm_subdevs+0x9e/0xe0 [vimc] [ 188.446179] vimc_remove+0x19/0x70 [vimc] [ 188.447301] platform_drv_remove+0x2f/0x50 [ 188.448468] device_release_driver_internal+0x133/0x260 [ 188.449814] unbind_store+0x121/0x150 [ 188.450726] kernfs_fop_write+0x142/0x230 [ 188.451724] ? sysfs_kf_bin_read+0x100/0x100 [ 188.452826] vfs_write+0xdc/0x230 [ 188.453760] ksys_write+0xaf/0x140 [ 188.454702] ? __ia32_sys_read+0x40/0x40 [ 188.455773] ? __do_page_fault+0x473/0x620 [ 188.456780] do_syscall_64+0x5e/0x1a0 [ 188.457711] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 188.459079] RIP: 0033:0x7f80f1f13504 [ 188.459969] Code: 00 f7 d8 64 89 02 48 c7 c0 ff ff ff ff eb b3 0f 1f 80 00 00 00 00 48 8d 05 f9 61 0d 00 8b 00 85 c0 75 13 b8 01 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 54 c3 0f 1f 00 41 54 49 89 d4 55 48 89 f5 53 [ 188.464445] RSP: 002b:00007ffd7e843b58 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 188.466276] RAX: ffffffffffffffda RBX: 0000000000000006 RCX: 00007f80f1f13504 [ 188.467999] RDX: 0000000000000006 RSI: 000055ef2eb21b10 RDI: 0000000000000001 [ 188.469708] RBP: 000055ef2eb21b10 R08: 00007f80f1fe68c0 R09: 00007f80f1e26740 [ 188.471407] R10: 000055ef2eade010 R11: 0000000000000246 R12: 00007f80f1fe5760 [ 188.473381] R13: 0000000000000006 R14: 00007f80f1fe0760 R15: 0000000000000006 [ 188.475107] [ 188.475500] Allocated by task 473: [ 188.476351] save_stack+0x19/0x80 [ 188.477201] __kasan_kmalloc.constprop.6+0xc1/0xd0 [ 188.478507] vimc_sen_add+0x36/0x309 [vimc] [ 188.479649] vimc_probe+0x1e2/0x530 [vimc] [ 188.480776] platform_drv_probe+0x46/0xa0 [ 188.481829] really_probe+0x16c/0x520 [ 188.482732] driver_probe_device+0x114/0x170 [ 188.483783] device_driver_attach+0x85/0x90 [ 188.484800] __driver_attach+0xa8/0x190 [ 188.485734] bus_for_each_dev+0xe4/0x140 [ 188.486702] bus_add_driver+0x223/0x2d0 [ 188.487715] driver_register+0xca/0x140 [ 188.488767] 0xffffffffc037003d [ 188.489635] do_one_initcall+0x86/0x28f [ 188.490702] do_init_module+0xf8/0x340 [ 188.491773] load_module+0x3766/0x3a10 [ 188.492811] __do_sys_finit_module+0x11a/0x1b0 [ 188.494059] do_syscall_64+0x5e/0x1a0 [ 188.495079] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 188.496481] [ 188.496893] Freed by task 185: [ 188.497670] save_stack+0x19/0x80 [ 188.498493] __kasan_slab_free+0x125/0x170 [ 188.499486] kfree+0x8c/0x230 [ 188.500254] v4l2_subdev_release+0x64/0x70 [videodev] [ 188.501498] v4l2_device_release_subdev_node+0x1c/0x30 [videodev] [ 188.502976] device_release+0x3c/0xd0 [ 188.503867] kobject_put+0xf4/0x240 [ 188.507802] vimc_rm_subdevs+0x9e/0xe0 [vimc] [ 188.508846] vimc_remove+0x19/0x70 [vimc] [ 188.509792] platform_drv_remove+0x2f/0x50 [ 188.510752] device_release_driver_internal+0x133/0x260 [ 188.512006] unbind_store+0x121/0x150 [ 188.512899] kernfs_fop_write+0x142/0x230 [ 188.513874] vfs_write+0xdc/0x230 [ 188.514698] ksys_write+0xaf/0x140 [ 188.515523] do_syscall_64+0x5e/0x1a0 [ 188.516543] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 188.517710] [ 188.518034] The buggy address belongs to the object at ffff8881e9c26000 [ 188.518034] which belongs to the cache kmalloc-4k of size 4096 [ 188.520528] The buggy address is located 8 bytes inside of [ 188.520528] 4096-byte region [ffff8881e9c26000, ffff8881e9c27000) [ 188.523015] The buggy address belongs to the page: [ 188.524357] page:ffffea0007a70800 refcount:1 mapcount:0 mapping:ffff8881f6402140 index:0x0 compound_mapcount: 0 [ 188.527058] raw: 0200000000010200 dead000000000100 dead000000000122 ffff8881f6402140 [ 188.528983] raw: 0000000000000000 0000000000040004 00000001ffffffff 0000000000000000 [ 188.530883] page dumped because: kasan: bad access detected [ 188.532336] [ 188.532720] Memory state around the buggy address: [ 188.533871] ffff8881e9c25f00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 188.535631] ffff8881e9c25f80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 188.537370] >ffff8881e9c26000: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 188.538996] ^ [ 188.539812] ffff8881e9c26080: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 188.541549] ffff8881e9c26100: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb Signed-off-by: Dafna Hirschfeld <dafna.hirschfeld@collabora.com> Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl> Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
481 lines
13 KiB
C
481 lines
13 KiB
C
// SPDX-License-Identifier: GPL-2.0-or-later
|
|
/*
|
|
* vimc-capture.c Virtual Media Controller Driver
|
|
*
|
|
* Copyright (C) 2015-2017 Helen Koike <helen.fornazier@gmail.com>
|
|
*/
|
|
|
|
#include <media/v4l2-ioctl.h>
|
|
#include <media/videobuf2-core.h>
|
|
#include <media/videobuf2-vmalloc.h>
|
|
|
|
#include "vimc-common.h"
|
|
#include "vimc-streamer.h"
|
|
|
|
struct vimc_cap_device {
|
|
struct vimc_ent_device ved;
|
|
struct video_device vdev;
|
|
struct v4l2_pix_format format;
|
|
struct vb2_queue queue;
|
|
struct list_head buf_list;
|
|
/*
|
|
* NOTE: in a real driver, a spin lock must be used to access the
|
|
* queue because the frames are generated from a hardware interruption
|
|
* and the isr is not allowed to sleep.
|
|
* Even if it is not necessary a spinlock in the vimc driver, we
|
|
* use it here as a code reference
|
|
*/
|
|
spinlock_t qlock;
|
|
struct mutex lock;
|
|
u32 sequence;
|
|
struct vimc_stream stream;
|
|
struct media_pad pad;
|
|
};
|
|
|
|
static const struct v4l2_pix_format fmt_default = {
|
|
.width = 640,
|
|
.height = 480,
|
|
.pixelformat = V4L2_PIX_FMT_RGB24,
|
|
.field = V4L2_FIELD_NONE,
|
|
.colorspace = V4L2_COLORSPACE_DEFAULT,
|
|
};
|
|
|
|
struct vimc_cap_buffer {
|
|
/*
|
|
* struct vb2_v4l2_buffer must be the first element
|
|
* the videobuf2 framework will allocate this struct based on
|
|
* buf_struct_size and use the first sizeof(struct vb2_buffer) bytes of
|
|
* memory as a vb2_buffer
|
|
*/
|
|
struct vb2_v4l2_buffer vb2;
|
|
struct list_head list;
|
|
};
|
|
|
|
static int vimc_cap_querycap(struct file *file, void *priv,
|
|
struct v4l2_capability *cap)
|
|
{
|
|
strscpy(cap->driver, VIMC_PDEV_NAME, sizeof(cap->driver));
|
|
strscpy(cap->card, KBUILD_MODNAME, sizeof(cap->card));
|
|
snprintf(cap->bus_info, sizeof(cap->bus_info),
|
|
"platform:%s", VIMC_PDEV_NAME);
|
|
|
|
return 0;
|
|
}
|
|
|
|
static void vimc_cap_get_format(struct vimc_ent_device *ved,
|
|
struct v4l2_pix_format *fmt)
|
|
{
|
|
struct vimc_cap_device *vcap = container_of(ved, struct vimc_cap_device,
|
|
ved);
|
|
|
|
*fmt = vcap->format;
|
|
}
|
|
|
|
static int vimc_cap_g_fmt_vid_cap(struct file *file, void *priv,
|
|
struct v4l2_format *f)
|
|
{
|
|
struct vimc_cap_device *vcap = video_drvdata(file);
|
|
|
|
f->fmt.pix = vcap->format;
|
|
|
|
return 0;
|
|
}
|
|
|
|
static int vimc_cap_try_fmt_vid_cap(struct file *file, void *priv,
|
|
struct v4l2_format *f)
|
|
{
|
|
struct v4l2_pix_format *format = &f->fmt.pix;
|
|
const struct vimc_pix_map *vpix;
|
|
|
|
format->width = clamp_t(u32, format->width, VIMC_FRAME_MIN_WIDTH,
|
|
VIMC_FRAME_MAX_WIDTH) & ~1;
|
|
format->height = clamp_t(u32, format->height, VIMC_FRAME_MIN_HEIGHT,
|
|
VIMC_FRAME_MAX_HEIGHT) & ~1;
|
|
|
|
/* Don't accept a pixelformat that is not on the table */
|
|
vpix = vimc_pix_map_by_pixelformat(format->pixelformat);
|
|
if (!vpix) {
|
|
format->pixelformat = fmt_default.pixelformat;
|
|
vpix = vimc_pix_map_by_pixelformat(format->pixelformat);
|
|
}
|
|
/* TODO: Add support for custom bytesperline values */
|
|
format->bytesperline = format->width * vpix->bpp;
|
|
format->sizeimage = format->bytesperline * format->height;
|
|
|
|
if (format->field == V4L2_FIELD_ANY)
|
|
format->field = fmt_default.field;
|
|
|
|
vimc_colorimetry_clamp(format);
|
|
|
|
return 0;
|
|
}
|
|
|
|
static int vimc_cap_s_fmt_vid_cap(struct file *file, void *priv,
|
|
struct v4l2_format *f)
|
|
{
|
|
struct vimc_cap_device *vcap = video_drvdata(file);
|
|
int ret;
|
|
|
|
/* Do not change the format while stream is on */
|
|
if (vb2_is_busy(&vcap->queue))
|
|
return -EBUSY;
|
|
|
|
ret = vimc_cap_try_fmt_vid_cap(file, priv, f);
|
|
if (ret)
|
|
return ret;
|
|
|
|
dev_dbg(vcap->ved.dev, "%s: format update: "
|
|
"old:%dx%d (0x%x, %d, %d, %d, %d) "
|
|
"new:%dx%d (0x%x, %d, %d, %d, %d)\n", vcap->vdev.name,
|
|
/* old */
|
|
vcap->format.width, vcap->format.height,
|
|
vcap->format.pixelformat, vcap->format.colorspace,
|
|
vcap->format.quantization, vcap->format.xfer_func,
|
|
vcap->format.ycbcr_enc,
|
|
/* new */
|
|
f->fmt.pix.width, f->fmt.pix.height,
|
|
f->fmt.pix.pixelformat, f->fmt.pix.colorspace,
|
|
f->fmt.pix.quantization, f->fmt.pix.xfer_func,
|
|
f->fmt.pix.ycbcr_enc);
|
|
|
|
vcap->format = f->fmt.pix;
|
|
|
|
return 0;
|
|
}
|
|
|
|
static int vimc_cap_enum_fmt_vid_cap(struct file *file, void *priv,
|
|
struct v4l2_fmtdesc *f)
|
|
{
|
|
const struct vimc_pix_map *vpix = vimc_pix_map_by_index(f->index);
|
|
|
|
if (!vpix)
|
|
return -EINVAL;
|
|
|
|
f->pixelformat = vpix->pixelformat;
|
|
|
|
return 0;
|
|
}
|
|
|
|
static int vimc_cap_enum_framesizes(struct file *file, void *fh,
|
|
struct v4l2_frmsizeenum *fsize)
|
|
{
|
|
const struct vimc_pix_map *vpix;
|
|
|
|
if (fsize->index)
|
|
return -EINVAL;
|
|
|
|
/* Only accept code in the pix map table */
|
|
vpix = vimc_pix_map_by_code(fsize->pixel_format);
|
|
if (!vpix)
|
|
return -EINVAL;
|
|
|
|
fsize->type = V4L2_FRMSIZE_TYPE_CONTINUOUS;
|
|
fsize->stepwise.min_width = VIMC_FRAME_MIN_WIDTH;
|
|
fsize->stepwise.max_width = VIMC_FRAME_MAX_WIDTH;
|
|
fsize->stepwise.min_height = VIMC_FRAME_MIN_HEIGHT;
|
|
fsize->stepwise.max_height = VIMC_FRAME_MAX_HEIGHT;
|
|
fsize->stepwise.step_width = 1;
|
|
fsize->stepwise.step_height = 1;
|
|
|
|
return 0;
|
|
}
|
|
|
|
static const struct v4l2_file_operations vimc_cap_fops = {
|
|
.owner = THIS_MODULE,
|
|
.open = v4l2_fh_open,
|
|
.release = vb2_fop_release,
|
|
.read = vb2_fop_read,
|
|
.poll = vb2_fop_poll,
|
|
.unlocked_ioctl = video_ioctl2,
|
|
.mmap = vb2_fop_mmap,
|
|
};
|
|
|
|
static const struct v4l2_ioctl_ops vimc_cap_ioctl_ops = {
|
|
.vidioc_querycap = vimc_cap_querycap,
|
|
|
|
.vidioc_g_fmt_vid_cap = vimc_cap_g_fmt_vid_cap,
|
|
.vidioc_s_fmt_vid_cap = vimc_cap_s_fmt_vid_cap,
|
|
.vidioc_try_fmt_vid_cap = vimc_cap_try_fmt_vid_cap,
|
|
.vidioc_enum_fmt_vid_cap = vimc_cap_enum_fmt_vid_cap,
|
|
.vidioc_enum_framesizes = vimc_cap_enum_framesizes,
|
|
|
|
.vidioc_reqbufs = vb2_ioctl_reqbufs,
|
|
.vidioc_create_bufs = vb2_ioctl_create_bufs,
|
|
.vidioc_prepare_buf = vb2_ioctl_prepare_buf,
|
|
.vidioc_querybuf = vb2_ioctl_querybuf,
|
|
.vidioc_qbuf = vb2_ioctl_qbuf,
|
|
.vidioc_dqbuf = vb2_ioctl_dqbuf,
|
|
.vidioc_expbuf = vb2_ioctl_expbuf,
|
|
.vidioc_streamon = vb2_ioctl_streamon,
|
|
.vidioc_streamoff = vb2_ioctl_streamoff,
|
|
};
|
|
|
|
static void vimc_cap_return_all_buffers(struct vimc_cap_device *vcap,
|
|
enum vb2_buffer_state state)
|
|
{
|
|
struct vimc_cap_buffer *vbuf, *node;
|
|
|
|
spin_lock(&vcap->qlock);
|
|
|
|
list_for_each_entry_safe(vbuf, node, &vcap->buf_list, list) {
|
|
list_del(&vbuf->list);
|
|
vb2_buffer_done(&vbuf->vb2.vb2_buf, state);
|
|
}
|
|
|
|
spin_unlock(&vcap->qlock);
|
|
}
|
|
|
|
static int vimc_cap_start_streaming(struct vb2_queue *vq, unsigned int count)
|
|
{
|
|
struct vimc_cap_device *vcap = vb2_get_drv_priv(vq);
|
|
struct media_entity *entity = &vcap->vdev.entity;
|
|
int ret;
|
|
|
|
vcap->sequence = 0;
|
|
|
|
/* Start the media pipeline */
|
|
ret = media_pipeline_start(entity, &vcap->stream.pipe);
|
|
if (ret) {
|
|
vimc_cap_return_all_buffers(vcap, VB2_BUF_STATE_QUEUED);
|
|
return ret;
|
|
}
|
|
|
|
ret = vimc_streamer_s_stream(&vcap->stream, &vcap->ved, 1);
|
|
if (ret) {
|
|
media_pipeline_stop(entity);
|
|
vimc_cap_return_all_buffers(vcap, VB2_BUF_STATE_QUEUED);
|
|
return ret;
|
|
}
|
|
|
|
return 0;
|
|
}
|
|
|
|
/*
|
|
* Stop the stream engine. Any remaining buffers in the stream queue are
|
|
* dequeued and passed on to the vb2 framework marked as STATE_ERROR.
|
|
*/
|
|
static void vimc_cap_stop_streaming(struct vb2_queue *vq)
|
|
{
|
|
struct vimc_cap_device *vcap = vb2_get_drv_priv(vq);
|
|
|
|
vimc_streamer_s_stream(&vcap->stream, &vcap->ved, 0);
|
|
|
|
/* Stop the media pipeline */
|
|
media_pipeline_stop(&vcap->vdev.entity);
|
|
|
|
/* Release all active buffers */
|
|
vimc_cap_return_all_buffers(vcap, VB2_BUF_STATE_ERROR);
|
|
}
|
|
|
|
static void vimc_cap_buf_queue(struct vb2_buffer *vb2_buf)
|
|
{
|
|
struct vimc_cap_device *vcap = vb2_get_drv_priv(vb2_buf->vb2_queue);
|
|
struct vimc_cap_buffer *buf = container_of(vb2_buf,
|
|
struct vimc_cap_buffer,
|
|
vb2.vb2_buf);
|
|
|
|
spin_lock(&vcap->qlock);
|
|
list_add_tail(&buf->list, &vcap->buf_list);
|
|
spin_unlock(&vcap->qlock);
|
|
}
|
|
|
|
static int vimc_cap_queue_setup(struct vb2_queue *vq, unsigned int *nbuffers,
|
|
unsigned int *nplanes, unsigned int sizes[],
|
|
struct device *alloc_devs[])
|
|
{
|
|
struct vimc_cap_device *vcap = vb2_get_drv_priv(vq);
|
|
|
|
if (*nplanes)
|
|
return sizes[0] < vcap->format.sizeimage ? -EINVAL : 0;
|
|
/* We don't support multiplanes for now */
|
|
*nplanes = 1;
|
|
sizes[0] = vcap->format.sizeimage;
|
|
|
|
return 0;
|
|
}
|
|
|
|
static int vimc_cap_buffer_prepare(struct vb2_buffer *vb)
|
|
{
|
|
struct vimc_cap_device *vcap = vb2_get_drv_priv(vb->vb2_queue);
|
|
unsigned long size = vcap->format.sizeimage;
|
|
|
|
if (vb2_plane_size(vb, 0) < size) {
|
|
dev_err(vcap->ved.dev, "%s: buffer too small (%lu < %lu)\n",
|
|
vcap->vdev.name, vb2_plane_size(vb, 0), size);
|
|
return -EINVAL;
|
|
}
|
|
return 0;
|
|
}
|
|
|
|
static const struct vb2_ops vimc_cap_qops = {
|
|
.start_streaming = vimc_cap_start_streaming,
|
|
.stop_streaming = vimc_cap_stop_streaming,
|
|
.buf_queue = vimc_cap_buf_queue,
|
|
.queue_setup = vimc_cap_queue_setup,
|
|
.buf_prepare = vimc_cap_buffer_prepare,
|
|
/*
|
|
* Since q->lock is set we can use the standard
|
|
* vb2_ops_wait_prepare/finish helper functions.
|
|
*/
|
|
.wait_prepare = vb2_ops_wait_prepare,
|
|
.wait_finish = vb2_ops_wait_finish,
|
|
};
|
|
|
|
static const struct media_entity_operations vimc_cap_mops = {
|
|
.link_validate = vimc_vdev_link_validate,
|
|
};
|
|
|
|
void vimc_cap_release(struct vimc_ent_device *ved)
|
|
{
|
|
struct vimc_cap_device *vcap =
|
|
container_of(ved, struct vimc_cap_device, ved);
|
|
|
|
media_entity_cleanup(vcap->ved.ent);
|
|
kfree(vcap);
|
|
}
|
|
|
|
void vimc_cap_unregister(struct vimc_ent_device *ved)
|
|
{
|
|
struct vimc_cap_device *vcap =
|
|
container_of(ved, struct vimc_cap_device, ved);
|
|
|
|
vb2_queue_release(&vcap->queue);
|
|
video_unregister_device(&vcap->vdev);
|
|
}
|
|
|
|
static void *vimc_cap_process_frame(struct vimc_ent_device *ved,
|
|
const void *frame)
|
|
{
|
|
struct vimc_cap_device *vcap = container_of(ved, struct vimc_cap_device,
|
|
ved);
|
|
struct vimc_cap_buffer *vimc_buf;
|
|
void *vbuf;
|
|
|
|
spin_lock(&vcap->qlock);
|
|
|
|
/* Get the first entry of the list */
|
|
vimc_buf = list_first_entry_or_null(&vcap->buf_list,
|
|
typeof(*vimc_buf), list);
|
|
if (!vimc_buf) {
|
|
spin_unlock(&vcap->qlock);
|
|
return ERR_PTR(-EAGAIN);
|
|
}
|
|
|
|
/* Remove this entry from the list */
|
|
list_del(&vimc_buf->list);
|
|
|
|
spin_unlock(&vcap->qlock);
|
|
|
|
/* Fill the buffer */
|
|
vimc_buf->vb2.vb2_buf.timestamp = ktime_get_ns();
|
|
vimc_buf->vb2.sequence = vcap->sequence++;
|
|
vimc_buf->vb2.field = vcap->format.field;
|
|
|
|
vbuf = vb2_plane_vaddr(&vimc_buf->vb2.vb2_buf, 0);
|
|
|
|
memcpy(vbuf, frame, vcap->format.sizeimage);
|
|
|
|
/* Set it as ready */
|
|
vb2_set_plane_payload(&vimc_buf->vb2.vb2_buf, 0,
|
|
vcap->format.sizeimage);
|
|
vb2_buffer_done(&vimc_buf->vb2.vb2_buf, VB2_BUF_STATE_DONE);
|
|
return NULL;
|
|
}
|
|
|
|
struct vimc_ent_device *vimc_cap_add(struct vimc_device *vimc,
|
|
const char *vcfg_name)
|
|
{
|
|
struct v4l2_device *v4l2_dev = &vimc->v4l2_dev;
|
|
const struct vimc_pix_map *vpix;
|
|
struct vimc_cap_device *vcap;
|
|
struct video_device *vdev;
|
|
struct vb2_queue *q;
|
|
int ret;
|
|
|
|
/* Allocate the vimc_cap_device struct */
|
|
vcap = kzalloc(sizeof(*vcap), GFP_KERNEL);
|
|
if (!vcap)
|
|
return NULL;
|
|
|
|
/* Initialize the media entity */
|
|
vcap->vdev.entity.name = vcfg_name;
|
|
vcap->vdev.entity.function = MEDIA_ENT_F_IO_V4L;
|
|
vcap->pad.flags = MEDIA_PAD_FL_SINK;
|
|
ret = media_entity_pads_init(&vcap->vdev.entity,
|
|
1, &vcap->pad);
|
|
if (ret)
|
|
goto err_free_vcap;
|
|
|
|
/* Initialize the lock */
|
|
mutex_init(&vcap->lock);
|
|
|
|
/* Initialize the vb2 queue */
|
|
q = &vcap->queue;
|
|
q->type = V4L2_BUF_TYPE_VIDEO_CAPTURE;
|
|
q->io_modes = VB2_MMAP | VB2_DMABUF | VB2_USERPTR;
|
|
q->drv_priv = vcap;
|
|
q->buf_struct_size = sizeof(struct vimc_cap_buffer);
|
|
q->ops = &vimc_cap_qops;
|
|
q->mem_ops = &vb2_vmalloc_memops;
|
|
q->timestamp_flags = V4L2_BUF_FLAG_TIMESTAMP_MONOTONIC;
|
|
q->min_buffers_needed = 2;
|
|
q->lock = &vcap->lock;
|
|
|
|
ret = vb2_queue_init(q);
|
|
if (ret) {
|
|
dev_err(vimc->mdev.dev, "%s: vb2 queue init failed (err=%d)\n",
|
|
vcfg_name, ret);
|
|
goto err_clean_m_ent;
|
|
}
|
|
|
|
/* Initialize buffer list and its lock */
|
|
INIT_LIST_HEAD(&vcap->buf_list);
|
|
spin_lock_init(&vcap->qlock);
|
|
|
|
/* Set default frame format */
|
|
vcap->format = fmt_default;
|
|
vpix = vimc_pix_map_by_pixelformat(vcap->format.pixelformat);
|
|
vcap->format.bytesperline = vcap->format.width * vpix->bpp;
|
|
vcap->format.sizeimage = vcap->format.bytesperline *
|
|
vcap->format.height;
|
|
|
|
/* Fill the vimc_ent_device struct */
|
|
vcap->ved.ent = &vcap->vdev.entity;
|
|
vcap->ved.process_frame = vimc_cap_process_frame;
|
|
vcap->ved.vdev_get_format = vimc_cap_get_format;
|
|
vcap->ved.dev = vimc->mdev.dev;
|
|
|
|
/* Initialize the video_device struct */
|
|
vdev = &vcap->vdev;
|
|
vdev->device_caps = V4L2_CAP_VIDEO_CAPTURE | V4L2_CAP_STREAMING;
|
|
vdev->entity.ops = &vimc_cap_mops;
|
|
vdev->release = video_device_release_empty;
|
|
vdev->fops = &vimc_cap_fops;
|
|
vdev->ioctl_ops = &vimc_cap_ioctl_ops;
|
|
vdev->lock = &vcap->lock;
|
|
vdev->queue = q;
|
|
vdev->v4l2_dev = v4l2_dev;
|
|
vdev->vfl_dir = VFL_DIR_RX;
|
|
strscpy(vdev->name, vcfg_name, sizeof(vdev->name));
|
|
video_set_drvdata(vdev, &vcap->ved);
|
|
|
|
/* Register the video_device with the v4l2 and the media framework */
|
|
ret = video_register_device(vdev, VFL_TYPE_VIDEO, -1);
|
|
if (ret) {
|
|
dev_err(vimc->mdev.dev, "%s: video register failed (err=%d)\n",
|
|
vcap->vdev.name, ret);
|
|
goto err_release_queue;
|
|
}
|
|
|
|
return &vcap->ved;
|
|
|
|
err_release_queue:
|
|
vb2_queue_release(q);
|
|
err_clean_m_ent:
|
|
media_entity_cleanup(&vcap->vdev.entity);
|
|
err_free_vcap:
|
|
kfree(vcap);
|
|
|
|
return NULL;
|
|
}
|