kernel/drivers/media/platform/qcom/venus, branch linux-6.9.y

Merge tag 'media/v6.9-1' of git://git.kernel.org/pub/scm/linux/kernel/git/mchehab/linux-media

2024-03-15T18:36:54Z

Pull media updates from Mauro Carvalho Chehab: - DVB budget legacy API was finally documented. It took only 20+ years to get some documentation about it... - hantro driver has gained support for STM32MP25 VDEC/VENC - rkisp1 has gained support for i.MX8MP - atomisp got rid of two items from its todo list. Still 5 items pending for moving it out of staging - lots of driver fixes, cleanups and improvements * tag 'media/v6.9-1' of git://git.kernel.org/pub/scm/linux/kernel/git/mchehab/linux-media: (252 commits) media: rcar-isp: Disallow unbind of devices media: usbtv: Remove useless locks in usbtv_video_free() media: mediatek: vcodec: avoid -Wcast-function-type-strict warning media: ttpci: fix two memleaks in budget_av_attach media: go7007: fix a memleak in go7007_load_encoder media: dvb-frontends: avoid stack overflow warnings with clang media: pvrusb2: fix uaf in pvr2_context_set_notify media: usb: s2255: Refactor s2255_get_fx2fw media: ti: j721e-csi2rx: Convert to platform remove callback returning void media: stm32-dcmipp: Convert to platform remove callback returning void media: nxp: imx8-isi: Convert to platform remove callback returning void media: nuvoton: Convert to platform remove callback returning void media: chips-media: wave5: Convert to platform remove callback returning void media: chips-media: wave5: Remove unnecessary semicolons media: i2c: imx290: Fix IMX920 typo media: platform: replace of_graph_get_next_endpoint() media: i2c: replace of_graph_get_next_endpoint() media: ivsc: csi: Make use of sub-device state media: ivsc: csi: Swap SINK and SOURCE pads media: ipu-bridge: Serialise calls to IPU bridge init ...

media: venus: Convert to dev_pm_domain_attach|detach_list() for vcodec

2024-02-14T09:26:11Z

Let's avoid some of the boilerplate code to manage the vcodec PM domains, by converting into using dev_pm_domain_attach|detach_list(). Cc: Mauro Carvalho Chehab Cc: Stanimir Varbanov Cc: Vikash Garodia Cc: Bjorn Andersson Cc: Konrad Dybcio Cc: Tested-by: Bryan O'Donoghue Reviewed-by: Bryan O'Donoghue Signed-off-by: Ulf Hansson Link: https://lore.kernel.org/r/20240130123951.236243-6-ulf.hansson@linaro.org

media: qcom: venus: Fix kerneldoc

2024-02-05T11:57:45Z

Remove doc for missing field. Signed-off-by: Ricardo Ribalda Reviewed-by: Randy Dunlap Signed-off-by: Hans Verkuil

media: videobuf2: core: Rename min_buffers_needed field in vb2_queue

2023-12-13T16:31:27Z

Rename min_buffers_needed into min_queued_buffers and update the documentation about it. Signed-off-by: Benjamin Gaignard Signed-off-by: Hans Verkuil [hverkuil: Drop the change where min_queued_buffers + 1 buffers would be] [hverkuil: allocated. Now this patch only renames this field instead of making] [hverkuil: a functional change as well.] [hverkuil: Renamed 3 remaining min_buffers_needed occurrences.]

media: venus: core: Set up secure memory ranges for SC7280

2023-12-12T07:54:54Z

Not all SC7280 devices ship with ChromeOS firmware. Other devices need PAS for image authentication. That requires the predefined virtual address ranges to be passed via scm calls. Define them to enable Venus on non-CrOS SC7280 devices. Reviewed-by: Konrad Dybcio Reviewed-by: Bryan O'Donoghue Reviewed-by: Vikash Garodia Signed-off-by: Luca Weiss Signed-off-by: Stanimir Varbanov Signed-off-by: Hans Verkuil

media: venus: Fix firmware path for resources

2023-10-23T10:24:53Z

The firmware path for some of the resources is still the old format. This fixes the path to address the firmware correctly using the new .mbn format. Signed-off-by: Patrick Whewell Signed-off-by: Stanimir Varbanov Signed-off-by: Hans Verkuil

media: venus: hfi_cmds: Replace one-element array with flex-array member and use __counted_by

2023-10-23T10:24:52Z

Array `data` in `struct hfi_sfr` is being used as a fake flexible array at run-time: drivers/media/platform/qcom/venus/hfi_venus.c: 1033 p = memchr(sfr->data, '\0', sfr->buf_size); 1034 /* 1035 * SFR isn't guaranteed to be NULL terminated since SYS_ERROR indicates 1036 * that Venus is in the process of crashing. 1037 */ 1038 if (!p) 1039 sfr->data[sfr->buf_size - 1] = '\0'; 1040 1041 dev_err_ratelimited(dev, "SFR message from FW: %s\n", sfr->data); Fake flexible arrays are deprecated, and should be replaced by flexible-array members. So, replace one-element array with a flexible-array member in `struct hfi_sfr`. While there, also annotate array `data` with __counted_by() to prepare for the coming implementation by GCC and Clang of the __counted_by attribute. Flexible array members annotated with __counted_by can have their accesses bounds-checked at run-time via CONFIG_UBSAN_BOUNDS (for array indexing) and CONFIG_FORTIFY_SOURCE (for strcpy/memcpy-family functions). This results in no differences in binary output. This issue was found with the help of Coccinelle, and audited and fixed manually. Signed-off-by: Gustavo A. R. Silva Reviewed-by: Kees Cook Signed-off-by: Stanimir Varbanov Signed-off-by: Hans Verkuil

media: venus: hfi_parser: Add check to keep the number of codecs within range

2023-10-23T10:24:52Z

Supported codec bitmask is populated from the payload from venus firmware. There is a possible case when all the bits in the codec bitmask is set. In such case, core cap for decoder is filled and MAX_CODEC_NUM is utilized. Now while filling the caps for encoder, it can lead to access the caps array beyong 32 index. Hence leading to OOB write. The fix counts the supported encoder and decoder. If the count is more than max, then it skips accessing the caps. Cc: stable@vger.kernel.org Fixes: 1a73374a04e5 ("media: venus: hfi_parser: add common capability parser") Signed-off-by: Vikash Garodia Signed-off-by: Stanimir Varbanov Signed-off-by: Hans Verkuil

media: venus: hfi: add checks to handle capabilities from firmware

2023-10-23T10:24:52Z

The hfi parser, parses the capabilities received from venus firmware and copies them to core capabilities. Consider below api, for example, fill_caps - In this api, caps in core structure gets updated with the number of capabilities received in firmware data payload. If the same api is called multiple times, there is a possibility of copying beyond the max allocated size in core caps. Similar possibilities in fill_raw_fmts and fill_profile_level functions. Cc: stable@vger.kernel.org Fixes: 1a73374a04e5 ("media: venus: hfi_parser: add common capability parser") Signed-off-by: Vikash Garodia Signed-off-by: Stanimir Varbanov Signed-off-by: Hans Verkuil

media: venus: hfi: fix the check to handle session buffer requirement

2023-10-23T10:24:52Z

Buffer requirement, for different buffer type, comes from video firmware. While copying these requirements, there is an OOB possibility when the payload from firmware is more than expected size. Fix the check to avoid the OOB possibility. Cc: stable@vger.kernel.org Fixes: 09c2845e8fe4 ("[media] media: venus: hfi: add Host Firmware Interface (HFI)") Reviewed-by: Nathan Hebert Signed-off-by: Vikash Garodia Signed-off-by: Stanimir Varbanov Signed-off-by: Hans Verkuil