Age | Commit message (Collapse) | Author | Files | Lines |
|
This patch is referred to Robert's commit cf54772b913b.
(usb: dwc2: call dwc2_is_controller_alive() under spinlock)
Below is commit message:
This patch fixes the following problem: data transmission in direction
IN break unless the GSNPSID register access is done with spinlock held.
This issue occurs at least in Exynos4412 SoC, probably in many SoC's
from Exynos familly.
The problem is described here:
https://lkml.org/lkml/2014/12/22/185
And there is linux mailing list discussion:
https://lkml.org/lkml/2015/1/14/17
The one of SDB hang issues should be fixed with this patch.
(Issue - Not triggered usb interrupt.)
Change-Id: If05d3cedb738b8804659dc35b652154e5b634ed4
Signed-off-by: Jaehoon Chung <jh80.chung@samsung.com>
|
|
Check if endpoint is enabled during dwc2_hsotg_ep_disable() function
processing and call dwc2_hsotg_ep_stop_xfr() to disable it and flush
associated FIFO.
Move dwc2_hsotg_ep_stop_xfr() and dwc2_hsotg_wait_bit_set() functions
upper before dwc2_hsotg_ep_enable and dwc2_hsotg_ep_disable function
definitions.
Signed-off-by: Vahram Aharonyan <vahrama@synopsys.com>
Signed-off-by: John Youn <johnyoun@synopsys.com>
Signed-off-by: Felipe Balbi <felipe.balbi@linux.intel.com>
[dwoo08.lee: back-ported from upstream commit a4f827714539]
Signed-off-by: Dongwoo Lee <dwoo08.lee@samsung.com>
Change-Id: I723387ec124cf3eaa4353790b424c1b42f59dc14
|
|
Correct dwc2_hsotg_ep_stop_xfr() function to follow dwc2 programming
guide for setting NAK on specific endpoint, disabling it and flushing
corresponding FIFO.
Current code does not take into account whether core acts in shared or
dedicated FIFO mode, current endpoint is periodic or not. It does not
clear EPDISBLD interrupt after programming of DXEPCTL_EPDIS, does not
flush shared TX FIFO and tries to clear global out NAK in wrong manner
instead of setting DCTL_CGOUTNAK.
Signed-off-by: Vahram Aharonyan <vahrama@synopsys.com>
Signed-off-by: John Youn <johnyoun@synopsys.com>
Signed-off-by: Felipe Balbi <felipe.balbi@linux.intel.com>
[dwoo08.lee: back-ported from upstream commit ae79dd5dddb6]
Signed-off-by: Dongwoo Lee <dwoo08.lee@samsung.com>
Change-Id: I8017bc33d0c8024ff9d46992727d2930769b8dab
|
|
As kill_all_requests() potentially flushes TX FIFO, we should should
free FIFO after calling it. Otherwise FIFO could stay unflushed properly.
Signed-off-by: Robert Baldyga <r.baldyga@samsung.com>
Signed-off-by: John Youn <johnyoun@synopsys.com>
Signed-off-by: Felipe Balbi <felipe.balbi@linux.intel.com>
[dwoo08.lee: back-ported from upstream commit 1c07b20eaa0e]
Signed-off-by: Dongwoo Lee <dwoo08.lee@samsung.com>
Change-Id: If7c6f60f3d48da348848e2f10012da3f919baf14
|
|
According DWC-OTG databook, "GOUTNakEff" is read only and can be
cleared only by "DCTL.CGOUTNak", but here we do not need to clear
it because DWC-OTG programming guide says that before disabling
any OUT endpoint, the application must enable Global OUT NAK mode,
so if this mode is enabled we can continue without this step.
Tested-by: John Keeping <john@metanate.com>
Signed-off-by: Vardan Mikayelyan <mvardan@synopsys.com>
Signed-off-by: John Youn <johnyoun@synopsys.com>
Signed-off-by: Felipe Balbi <felipe.balbi@linux.intel.com>
[dwoo08.lee: back-ported from upstream commit 6b58cb07a850]
Signed-off-by: Dongwoo Lee <dwoo08.lee@samsung.com>
Change-Id: I2c5b6b59edb42c71f5c867799510153d3bc50a4f
|
|
When receiving GINTSTS_GINNAKEFF or GINTSTS_GOUTNAKEFF interrupt,
DCTL will be overwritten with DCTL_CGOUTNAK or DCTL_CGNPINNAK values.
Instead of overwriting it, write only needed bits.
It could cause an issue if GINTSTS_GINNAKEFF or GINTSTS_GOUTNAKEFF
interrupt is received after dwc2 disabled pullup by writing
DCTL_SFTDISCON bit.
Pullup will then be re-enabled whereas it should not.
Acked-by: John Youn <johnyoun@synopsys.com>
Signed-off-by: Gregory Herrero <gregory.herrero@intel.com>
Signed-off-by: Felipe Balbi <balbi@ti.com>
[dwoo08.lee: back-ported from upstream commit 3be99cd0e882]
Signed-off-by: Dongwoo Lee <dwoo08.lee@samsung.com>
Change-Id: I48d6f9147906c658499dcaec5d3d0a555bb70e05
|
|
To stop an out endpoint, software should set sets the Global OUT NAK,
but not the Global Non-periodic IN NAK. This driver bug leads the out-ep
failed be in disabled state with below error.
dwc2_hsotg_ep_stop_xfr: timeout DOEPCTL.EPDisable
Acked-by: John Youn <johnyoun@synopsys.com>
Signed-off-by: Du, Changbin <changbin.du@intel.com>
Signed-off-by: Felipe Balbi <balbi@ti.com>
[dwoo08.lee: back-ported from upstream commit 0676c7e734e3]
Signed-off-by: Dongwoo Lee <dwoo08.lee@samsung.com>
Change-Id: Icce8220870ba555b6ee5f3781ad9840880e2800e
|
|
There are build errors on ext_vbus_io when the operational mode is
set to gadget only mode because it doesn't included by conditional
macro. In order to make including ext_vbus_io member for all
operational mode, this patch moves ext_vbus_io out of macro section.
Change-Id: Ib9a70c2a27cd6afd9969de422f3cbcbe80a2751d
Signed-off-by: Dongwoo <dwoo08.lee@samsung.com>
|
|
Large size request from sdbd usually causes memory allocation failure
in case of memory shortage. The failure is not handled by sdbd
properly and thus it makes sdbd a hung state. To prevent this
situation, this patch limits data buffer size to a single page so as
to guarantee memory allocation success.
* This is WORKAROUND solution for just use case of sdbd, it should be
reverted when the advanced dma solution is applied to f_fs *
Change-Id: Ib917c3aef2b00a3e00a3d87ca6d6940307038aa1
Signed-off-by: Dongwoo <dwoo08.lee@samsung.com>
|
|
Set the quirk_ep_out_aligned_size as ture.
This patch is fixed about occurring kernel panic after failed memory allocation.
Change-Id: Iafb6ccaa6f7d7dac4eb0593291166ab13cd8256d
Signed-off-by: Jaehoon Chung <jh80.chung@samsung.com>
|
|
The delay time in the schedule_delayed_work is changed because the
dac1_depop_work should be run immediately after calling.
In some situations, RT5659_STO_DAC_MIXER can be updated during the delay
time. Especially booting time, it can be found 100% if a application try
to play sounds right after. So, there is a possibility to update
dac1_sto_dac_mixer variable after saving.
For example, dac1_sto_dac_mixer is updated by DAPM_PRE_PMU event and
RT5659_STO_DAC_MIXER contents are saved into dac1_sto_dac_mixer(0xAAAA).
the value would be restored in depop_work but RT5659_STO_DAC_MIXER can
be changed to 0xAA8A before calling depop_work. However, the MIXER can
be overwrriten 0xAAAA in depop_work without considering updating
0xAAAA means that all registers related to DAC are turned off. the value
is changed to 0xAA8A if 'DAC MIXR DAC R1 Switch' is set to 1.
This problem makes mismatch kcontrol between platform and kernel.
'Stereo DAC MIXR DAC L1/R1 Switch' controls are still turned off even
though platform try to set UCM properly.
Change-Id: Ic66a829883d1b798b5e35009ffe5838bca857a69
Signed-off-by: Jaechul Lee <jcsing.lee@samsung.com>
|
|
Enable RT2X00 usb driver.
Change-Id: I8e071a988e2778088e80c5470cb5ff1e612025f4
Signed-off-by: Jaehoon Chung <jh80.chung@samsung.com>
|
|
Enable RT2X00 usb driver.
Change-Id: I0592f6a6408d2dece89e7e08f03d647449b99f2a
Signed-off-by: Jaehoon Chung <jh80.chung@samsung.com>
|
|
Enable Realtek USB driver to test Wifi Mesh.
Change-Id: I8a910a11666f7e6a8d8eab5a8ac791ea41648681
Signed-off-by: Jaehoon Chung <jh80.chung@samsung.com>
|
|
Enable Realtek USB driver to test WiFi Mesh.
Change-Id: I112640eaa46971a2ca958b7d5aea68e9745beff8
Signed-off-by: Jaehoon Chung <jh80.chung@samsung.com>
|
|
After the commit 3922eabecf08 ("usb: gadget: Allow to build both
USB functions and legacy gadgets"), usb options are changed and it
is not clear legacy composite gadget is set or not. To clarify,
sync defconfig for usb options.
Change-Id: Ia2f2f7e121094adfb5745cffbcf3edab243f6810
Signed-off-by: Seung-Woo Kim <sw0312.kim@samsung.com>
|
|
ConfigFS gadget
To replace legacy composite USB gadget for SDB, MTP, RNDIS with
ConfigFS gadget, this enables ConfigFS/FunctionFS support for USB
gadget.
Change-Id: I155a788ff6390d496ab047f9cd495aa141bc7d26
Signed-off-by: Dongwoo Lee <dwoo08.lee@samsung.com>
|
|
Eagleye board is provided the two user buttons.
(Defined them as "backkey" and "wakeup")
Change-Id: I524ca8b1b09b65b1c79d136adef02fd6872c6069
Signed-off-by: WooChang Kim <wchang.kim@samsung.com>
Signed-off-by: Jaehoon Chung <jh80.chung@samsung.com>
|
|
Enable the i2c_1 node.
Change-Id: I4aaafbe5cf5cecf2cd06eec80d59c2f004d6036b
Signed-off-by: Jaehoon Chung <jh80.chung@samsung.com>
|
|
Add the nodes relevant to spi/i2c/serial.
Change-Id: Ia578cf93f46c271c3836d8fbb94bcdbda15a77c7
Signed-off-by: Jaehoon Chung <jh80.chung@samsung.com>
|
|
touchscreen 'enabled' node needs to be supproted on Tizen because
deviced wants to handle touchscreen on/off for some reasons. Touch event
will be skipped if 'enabled' is 0.
Change-Id: I53eac0a5f38c09f326da24a5ee1d5e985d61332c
Signed-off-by: Jaechul Lee <jcsing.lee@samsung.com>
|
|
Because the change for size of module in the corresponding commit
seems to make failure on building boot image for artik710 board,
this reverts commit aece406a175adfb8de56c10e1d011ae2c6852cc5.
Change-Id: Ia18eaf165f180c39aded417be4a1130ba6edb113
Signed-off-by: Dongwoo Lee <dwoo08.lee@samsung.com>
|
|
These options enable DUMMY_HCD as a module to support USB test case
without real usb hardware.
Change-Id: I8ccb30d1cec4baad5dccdd0670039ab203bfbc2c
Signed-off-by: Dongwoo Lee <dwoo08.lee@samsung.com>
|
|
These options enable DUMMY_HCD as a module to support USB test case
without real usb hardware.
Change-Id: I4b20065a0644a68398ac6b8f2d4c5c96e1af1dd5
Signed-off-by: Dongwoo Lee <dwoo08.lee@samsung.com>
|
|
Currently it is possible to build in some subset of usb functions
*OR* some gadget module. This is limited only by Kconfig not
any functionality.
This patch removes this limitation. With this patch it is possible
to set up all build combinations:
1) Multiple gadgets build in
2) Part of functions build in, part of functions as a modules
3) Some gadgets build in and some part of functions build in/modules
etc.
As this patch makes Kconfig quite complicated let me clarify how it works:
USB_F_<func name> - used in makefile for compilation
USB_CONFIGFS_F_<func name> - Chosen by user in function menu
USB_G_<gadget name>_REQ_F_<func name> - set up by gadget to mark
that this particular gadget requires this func to work
USB_F_<func name>_SELECTOR - helper config which is used to determine
if function should be build in or compiled as a module
The rules are quite simple:
1) If any of USB_CONFIGFS_F_<func name>, USB_G_*_REQ_F_<func name> equals
y, then USB_F_<func name> is set to y and function is build in
2) If none of USB_CONFIGFS_F_<func name>, USB_G_*_REQ_F_<func name> equals
y, but any of them equals m then USB_F_<func name> is set to m and function
is compiled as a module
Signed-off-by: Krzysztof Opasiak <k.opasiak@samsung.com>
[Backported from commit under review @linux-usb mailing list]
Signed-off-by: Krzysztof Opasiak <k.opasiak@samsung.com>
Signed-off-by: Dongwoo Lee <dwoo08.lee@samsung.com>
Change-Id: I86e796d7c057afce163695dc280861477a9f4b56
|
|
This patch enables CONFIG_VIDEO_OV5640.
Change-Id: I658411faa738295cf88faaa608da795b89fe9fc1
Signed-off-by: Jaehoon Chung <jh80.chung@samsung.com>
|
|
This patch removes redundant debug messages.
Change-Id: I471c15e31ae0e1c47e9f3db1c8f0af7b4eac30e4
Signed-off-by: Sooman Jeong <sm5.jeong@samsung.com>
|
|
This patch adds 200ms delay before turning on the MIPI
stream from the sensor.
By adding this delay, we can reduce the noise on the few
frames at the beginning of the streaming.
Change-Id: I1a6263860de840c4ac30492dd7e36533a895eaa2
Signed-off-by: Sooman Jeong <sm5.jeong@samsung.com>
|
|
This patch removes the unnecessary delay after setting QSXGA
resolution setting because the delay occasionally makes
unexpected frame loss at the starting of streaming.
Change-Id: Ib030e90155cf363f3c87e4b5a5b987628183c7a8
Signed-off-by: Sooman Jeong <sm5.jeong@samsung.com>
|
|
This patch changes the sequence fo setting new mode.
In case of changing the sub-sampling or scaling mode,
the previous version of the driver only sets the mode by writing
individual registers after calculating exposure values.
However, it does not work correctly with the current hardware.
In order to address this issue, we have to explicitly set mode
by loading registers directly right after calculating exposure.
Change-Id: Id60f5e57b98f96e6a7122dfadad68e1e0bce7857
Signed-off-by: Sooman Jeong <sm5.jeong@samsung.com>
|
|
This patch adds mode name to all settings of resolutions for
debugging purpose.
Change-Id: I09d6e356c7038ff88b3923b1ff6060fab29a9bab
Signed-off-by: Sooman Jeong <sm5.jeong@samsung.com>
|
|
This patch changes the period of pixel clock for VGA to 0x44.
We need to change the value for VGA resolution since the global
init table sets the value as 0x0a which is not applicable to
the VGA resolution.
Note that the value has to be determined depending on the value
of the MIPI clock rate.
Change-Id: Ic12f3d82f4d58b336ee24956d5b471ed83e95891
Signed-off-by: Sooman Jeong <sm5.jeong@samsung.com>
|
|
This patch fixes unexpected return value of ov5640_set_ctrl_exposure
in order to prevent a failure of s_stream.
If the return value of ov5640_get_vts is positive, this function
would return the unintended positive value that leads to a
below kernel WARN.
<6>[ 232.292000] ov5640 0-003c: ov5640_get_vts 1120
<3>[ 232.292000] nx-csi c00d0000.mipi_csi: failed to s_stream 1
<3>[ 232.292000] nx-clipper c0000000.soc:clipper0@c0063000: failed to s_stream 1
<4>[ 232.296000] ------------[ cut here ]------------
<4>[ 232.296000] WARNING: at drivers/media/v4l2-core/videobuf2-core.c:1315
<4>[ 232.296000] Modules linked in: aes_neon_blk 8021q iptable_nat nf_nat_ipv4
<4>[ 232.296000]
<4>[ 232.296000] CPU: 0 PID: 2436 Comm: camerasrc0:src Not tainted 4.4.71-02618-gb51e650-dirty #161
<4>[ 232.296000] Hardware name: Samsung artik710 raptor board based on s5p6818 (DT)
<4>[ 232.296000] task: ffffffc03b8bec00 ti: ffffffc02863c000 task.ti: ffffffc02863c000
<4>[ 232.296000] PC is at vb2_start_streaming+0xb8/0x124
<4>[ 232.296000] LR is at vb2_start_streaming+0x74/0x124
<4>[ 232.296000] pc : [<ffffffc0005a7780>] lr : [<ffffffc0005a773c>] pstate: 60000145
<4>[ 232.296000] sp : ffffffc02863fb40
<4>[ 232.296000] x29: ffffffc02863fb40 x28: 0000000000000000
<4>[ 232.296000] x27: 0000000000000001 x26: 0000000000000000
<4>[ 232.296000] x25: ffffffc03c795000 x24: ffffffc02867a100
<4>[ 232.296000] x23: ffffffc02863fd10 x22: ffffffc000d3fe68
<4>[ 232.296000] x21: ffffffc039042988 x20: 0000000000000460
<4>[ 232.296000] x19: ffffffc039042800 x18: 000000008a4c5fbd
<4>[ 232.296000] x17: 0000007f9de3a938 x16: ffffffc0001fa5e4
<4>[ 232.296000] x15: 00000000e6d02b3a x14: 3033363030634030
<4>[ 232.296000] x13: 72657070696c633a x12: 636f732e30303030
<4>[ 232.296000] x11: 303030633a6d726f x10: 6674616c702b3d45
<4>[ 232.296000] x9 : 4349564544006d72 x8 : 6f742064656c6961
<4>[ 232.296000] x7 : 66203a3030303336 x6 : ffffffc000da042e
<4>[ 232.296000] x5 : 0000000000000000 x4 : ffffffc02863fa70
<4>[ 232.296000] x3 : 0000000000000000 x2 : 0000000000000000
<4>[ 232.296000] x1 : 0000000000000460 x0 : 0000000000000008
Change-Id: Id81384100d1c7d11902e4ca4b208a320354b95f4
Signed-off-by: Sooman Jeong <sm5.jeong@samsung.com>
|
|
This patch adds error handling on s_power callback by reading
chip id of this sensor module.
By adding this handling, we can quickly catch error in the early
stage of initializing camera sensor.
Change-Id: I17ad81bf04a48a73abe35aff97ceddfff6436594
Signed-off-by: Sooman Jeong <sm5.jeong@samsung.com>
|
|
This patch adds s_param callback to set frame rate.
Current ov5640 sensor driver supports only two different
frame rate;30fps and 15fps.
Change-Id: I5fbd86bf81c116aec86e54c9b76c6870eb8674af
Signed-off-by: Sooman Jeong <sm5.jeong@samsung.com>
|
|
This patch adds s_power call on set stream callback since
the VIP sub-system of s5p4418 or s5p6818 does not have
separate s_power call sequence.
Also, 100ms sleep was added right before enabling stream
to guarantee stabilization time for MIPI CSI to be ready.
This change is a part of customizing ov5640 sensor driver
for the ARTIK modules which use s5p4418 or s5p6868 AP.
Change-Id: I8061ac6e9f4928eafc17687d2ba4f726464de09e
Signed-off-by: Sooman Jeong <sm5.jeong@samsung.com>
|
|
This patch sets xclk_freq as fixed value of 24MHz
because current target sensor module is using external
oscillator rather than using internal clock source.
This change is a part of customizing driver for the
LI-OV5640-MIPI-AF sensor module which was produced by
LeopardImaging.
Change-Id: I5bc6f5d5cc3aa4d7bbe25d3128928806c9844188
Signed-off-by: Sooman Jeong <sm5.jeong@samsung.com>
|
|
This patch add NULL check of fmt in order to prevent
kernel Oops.
Change-Id: I9a0def2fe0575fe3e1096d3364a021ea458f923d
Signed-off-by: Sooman Jeong <sm5.jeong@samsung.com>
|
|
This patch changes the return value of the exceptional case.
The ov5640_set_mode() function has to return zero even if
its internal callback has been failed.
This patch would be a tentative fix, but has to be applied
for now.
Change-Id: I96095d8ce664c05e36c9437545150d67c371de92
Signed-off-by: Sooman Jeong <sm5.jeong@samsung.com>
|
|
This patch fixes the frame rate of big size resolution.
If the target resolution is bigger than FHD (1920x1080),
frame rate has to be 15 fps.
Change-Id: I50b4637707b4ebf47f5aaf70300f2e19a0ecc7ba
Signed-off-by: Sooman Jeong <sm5.jeong@samsung.com>
|
|
This patch adds debugging messages by using dev_info
on major callbacks of ov5640 driver.
Change-Id: Ib8553c160e2598e11806839f11bec5915ba30e23
Signed-off-by: Sooman Jeong <sm5.jeong@samsung.com>
|
|
This patch changes the output format of ov5640 sensor
from UYVY to YUYV as a part of customizing ov5640 sensor
for ARTIK modules which use s5p4418 or s5p6868 AP.
Change-Id: Id7cb2fc0dfb8fafe15a3c2f6c7d61dfc47d7cd27
Signed-off-by: Sooman Jeong <sm5.jeong@samsung.com>
|
|
This driver is based on ov5640_mipi.c from Freescale imx_3.10.17_1.0.0_beta
branch, modified heavily to bring forward to latest interfaces and code
cleanup.
Change-Id: I6e36860e18342ab90b3d25f0f03f9bffd0a6e4f3
Signed-off-by: Steve Longerbeam <steve_longerbeam@mentor.com>
Acked-by: Sakari Ailus <sakari.ailus@linux.intel.com>
Signed-off-by: Hans Verkuil <hans.verkuil@cisco.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
Signed-off-by: Sooman Jeong <sm5.jeong@samsung.com>
|
|
Eagleye ARTIK530s board is using its own device-tree.
This patch is referred to Dongwoo's patches.
"arm: dts: artik530_raptor: nable extcon notification for usb connection"
Change-Id: I22cfbe37813a9ae3d39706f2a9a205f091e948db
Signed-off-by: Jaehoon Chung <jh80.chung@samsung.com>
|
|
This patch changes hssettle value for MIPI PHY Setting
to an array since some sensors use various MIPI clock values
depending on the resolution.
The hssettle value has to be determined depending on the MIPI
clock rate of the given resolution of the image.
The new array of hssettles can cover VGA, HD, FHD, and 5MP
resolution.
Change-Id: Ib7d2ba9bc7fc2f66bd0c12e84c51d1ab3cd2a860
Signed-off-by: Sooman Jeong <sm5.jeong@samsung.com>
|
|
This patch change sound label to add more sound card as DT-overlay.
Change-Id: I2c5af490b420c6239d7650b2ba5e41301833c21d
Signed-off-by: Geonho Kim <gh007.kim@samsung.com>
|
|
This patch changes camera sensor configuration of clipper node
from S5K4EC to OV5640 since artik533 compy board only supports
new OV5640 sensor module.
Change-Id: Icc5f4f488281c77c040c21d7518cae7bf98bb61e
Signed-off-by: Sooman Jeong <sm5.jeong@samsung.com>
|
|
This patch removes mipi display configuration. This board will not be
supporting MIPI/LVDS display.
Change-Id: I63dad101c62fad88cec8fef4e4193922c4961a2c
Signed-off-by: sunghwansoon <hs2704.sung@samsung.com>
|
|
This patch adds new compy board.
Compy board uses the Artik533 module and the sub board has been changed.
Change-Id: Iff08606ae6a86c8bd292cd7216b2373e7474547a
Signed-off-by: Jaewon Kim <jaewon02.kim@samsung.com>
|
|
commit 85ea29f19eab56ec16ec6b92bc67305998706afa upstream.
At put_v4l2_window32(), it tries to access kp->clips. However,
kp points to an userspace pointer. So, it should be obtained
via get_user(), otherwise it can OOPS:
vivid-000: ================== END STATUS ==================
BUG: unable to handle kernel paging request at 00000000fffb18e0
IP: [<ffffffffc05468d9>] __put_v4l2_format32+0x169/0x220 [videodev]
PGD 3f5776067 PUD 3f576f067 PMD 3f5769067 PTE 800000042548f067
Oops: 0001 [#1] SMP
Modules linked in: vivid videobuf2_vmalloc videobuf2_memops v4l2_dv_timings videobuf2_core v4l2_common videodev media xt_CHECKSUM iptable_mangle ipt_MASQUERADE nf_nat_masquerade_ipv4 iptable_nat nf_nat_ipv4 nf_nat nf_conntrack_ipv4 nf_defrag_ipv4 xt_conntrack nf_conntrack tun bridge stp llc ebtable_filter ebtables ip6table_filter ip6_tables bluetooth rfkill binfmt_misc snd_hda_codec_hdmi i915 snd_hda_intel snd_hda_controller snd_hda_codec intel_rapl x86_pkg_temp_thermal snd_hwdep intel_powerclamp snd_pcm coretemp snd_seq_midi kvm_intel kvm snd_seq_midi_event snd_rawmidi i2c_algo_bit drm_kms_helper snd_seq drm crct10dif_pclmul e1000e snd_seq_device crc32_pclmul snd_timer ghash_clmulni_intel snd mei_me mei ptp pps_core soundcore lpc_ich video crc32c_intel [last unloaded: media]
CPU: 2 PID: 28332 Comm: v4l2-compliance Not tainted 3.18.102+ #107
Hardware name: /NUC5i7RYB, BIOS RYBDWi35.86A.0364.2017.0511.0949 05/11/2017
task: ffff8804293f8000 ti: ffff8803f5640000 task.ti: ffff8803f5640000
RIP: 0010:[<ffffffffc05468d9>] [<ffffffffc05468d9>] __put_v4l2_format32+0x169/0x220 [videodev]
RSP: 0018:ffff8803f5643e28 EFLAGS: 00010246
RAX: 0000000000000000 RBX: 0000000000000000 RCX: 00000000fffb1ab4
RDX: 00000000fffb1a68 RSI: 00000000fffb18d8 RDI: 00000000fffb1aa8
RBP: ffff8803f5643e48 R08: 0000000000000001 R09: ffff8803f54b0378
R10: 0000000000000000 R11: 0000000000000168 R12: 00000000fffb18c0
R13: 00000000fffb1a94 R14: 00000000fffb18c8 R15: 0000000000000000
FS: 0000000000000000(0000) GS:ffff880456d00000(0063) knlGS:00000000f7100980
CS: 0010 DS: 002b ES: 002b CR0: 0000000080050033
CR2: 00000000fffb18e0 CR3: 00000003f552b000 CR4: 00000000003407e0
Stack:
00000000fffb1a94 00000000c0cc5640 0000000000000056 ffff8804274f3600
ffff8803f5643ed0 ffffffffc0547e16 0000000000000003 ffff8803f5643eb0
ffffffff81301460 ffff88009db44b01 ffff880441942520 ffff8800c0d05640
Call Trace:
[<ffffffffc0547e16>] v4l2_compat_ioctl32+0x12d6/0x1b1d [videodev]
[<ffffffff81301460>] ? file_has_perm+0x70/0xc0
[<ffffffff81252a2c>] compat_SyS_ioctl+0xec/0x1200
[<ffffffff8173241a>] sysenter_dispatch+0x7/0x21
Code: 00 00 48 8b 80 48 c0 ff ff 48 83 e8 38 49 39 c6 0f 87 2b ff ff ff 49 8d 45 1c e8 a3 ce e3 c0 85 c0 0f 85 1a ff ff ff 41 8d 40 ff <4d> 8b 64 24 20 41 89 d5 48 8d 44 40 03 4d 8d 34 c4 eb 15 0f 1f
RIP [<ffffffffc05468d9>] __put_v4l2_format32+0x169/0x220 [videodev]
RSP <ffff8803f5643e28>
CR2: 00000000fffb18e0
Tested with vivid driver on Kernel v3.18.102.
Same bug happens upstream too:
BUG: KASAN: user-memory-access in __put_v4l2_format32+0x98/0x4d0 [videodev]
Read of size 8 at addr 00000000ffe48400 by task v4l2-compliance/8713
CPU: 0 PID: 8713 Comm: v4l2-compliance Not tainted 4.16.0-rc4+ #108
Hardware name: /NUC5i7RYB, BIOS RYBDWi35.86A.0364.2017.0511.0949 05/11/2017
Call Trace:
dump_stack+0x5c/0x7c
kasan_report+0x164/0x380
? __put_v4l2_format32+0x98/0x4d0 [videodev]
__put_v4l2_format32+0x98/0x4d0 [videodev]
v4l2_compat_ioctl32+0x1aec/0x27a0 [videodev]
? __fsnotify_inode_delete+0x20/0x20
? __put_v4l2_format32+0x4d0/0x4d0 [videodev]
compat_SyS_ioctl+0x646/0x14d0
? do_ioctl+0x30/0x30
do_fast_syscall_32+0x191/0x3f4
entry_SYSENTER_compat+0x6b/0x7a
==================================================================
Disabling lock debugging due to kernel taint
BUG: unable to handle kernel paging request at 00000000ffe48400
IP: __put_v4l2_format32+0x98/0x4d0 [videodev]
PGD 3a22fb067 P4D 3a22fb067 PUD 39b6f0067 PMD 39b6f1067 PTE 80000003256af067
Oops: 0001 [#1] SMP KASAN
Modules linked in: vivid videobuf2_vmalloc videobuf2_dma_contig videobuf2_memops v4l2_tpg v4l2_dv_timings videobuf2_v4l2 videobuf2_common v4l2_common videodev xt_CHECKSUM iptable_mangle ipt_MASQUERADE nf_nat_masquerade_ipv4 iptable_nat nf_nat_ipv4 nf_nat nf_conntrack_ipv4 nf_defrag_ipv4 xt_conntrack nf_conntrack libcrc32c tun bridge stp llc ebtable_filter ebtables ip6table_filter ip6_tables bluetooth rfkill ecdh_generic binfmt_misc snd_hda_codec_hdmi intel_rapl x86_pkg_temp_thermal intel_powerclamp i915 coretemp snd_hda_intel snd_hda_codec kvm_intel snd_hwdep snd_hda_core kvm snd_pcm irqbypass crct10dif_pclmul crc32_pclmul snd_seq_midi ghash_clmulni_intel snd_seq_midi_event i2c_algo_bit intel_cstate snd_rawmidi intel_uncore snd_seq drm_kms_helper e1000e snd_seq_device snd_timer intel_rapl_perf
drm ptp snd mei_me mei lpc_ich pps_core soundcore video crc32c_intel
CPU: 0 PID: 8713 Comm: v4l2-compliance Tainted: G B 4.16.0-rc4+ #108
Hardware name: /NUC5i7RYB, BIOS RYBDWi35.86A.0364.2017.0511.0949 05/11/2017
RIP: 0010:__put_v4l2_format32+0x98/0x4d0 [videodev]
RSP: 0018:ffff8803b9be7d30 EFLAGS: 00010282
RAX: 0000000000000000 RBX: ffff8803ac983e80 RCX: ffffffff8cd929f2
RDX: 1ffffffff1d0a149 RSI: 0000000000000297 RDI: 0000000000000297
RBP: 00000000ffe485c0 R08: fffffbfff1cf5123 R09: ffffffff8e7a8948
R10: 0000000000000001 R11: fffffbfff1cf5122 R12: 00000000ffe483e0
R13: 00000000ffe485c4 R14: ffff8803ac985918 R15: 00000000ffe483e8
FS: 0000000000000000(0000) GS:ffff880407400000(0063) knlGS:00000000f7a46980
CS: 0010 DS: 002b ES: 002b CR0: 0000000080050033
CR2: 00000000ffe48400 CR3: 00000003a83f2003 CR4: 00000000003606f0
Call Trace:
v4l2_compat_ioctl32+0x1aec/0x27a0 [videodev]
? __fsnotify_inode_delete+0x20/0x20
? __put_v4l2_format32+0x4d0/0x4d0 [videodev]
compat_SyS_ioctl+0x646/0x14d0
? do_ioctl+0x30/0x30
do_fast_syscall_32+0x191/0x3f4
entry_SYSENTER_compat+0x6b/0x7a
Code: 4c 89 f7 4d 8d 7c 24 08 e8 e6 a4 69 cb 48 8b 83 98 1a 00 00 48 83 e8 10 49 39 c7 0f 87 9d 01 00 00 49 8d 7c 24 20 e8 c8 a4 69 cb <4d> 8b 74 24 20 4c 89 ef 4c 89 fe ba 10 00 00 00 e8 23 d9 08 cc
RIP: __put_v4l2_format32+0x98/0x4d0 [videodev] RSP: ffff8803b9be7d30
CR2: 00000000ffe48400
cc: stable@vger.kernel.org
Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
Reviewed-by: Sakari Ailus <sakari.ailus@linux.intel.com>
Reviewed-by: Hans Verkuil <hans.verkuil@cisco.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
[sw0312.kim: cherry-pick from linux-4.4.y to fix v4l2 issue]
Signed-off-by: Seung-Woo Kim <sw0312.kim@samsung.com>
Change-Id: I4741d767f4ca23cf7684b66d173c6c24c606c008
|