summaryrefslogtreecommitdiff
AgeCommit message (Collapse)Author
2023-01-27ANDROID: ABI: add allowed list for galaxyandroid-u-preview-2_r0.4android-u-preview-2_r0.3android-u-preview-2_r0.2android-u-beta-1_r0.5android-u-beta-1_r0.4android-u-beta-1_r0.3android-t-qpr3-beta-2_r0.5android-t-qpr3-beta-2_r0.4android-t-qpr3-beta-2_r0.3android-t-qpr3-beta-1_r0.5android-t-qpr3-beta-1_r0.4android-t-qpr3-beta-1_r0.3android-t-qpr3-beta-1_r0.1android-gs-raviole-5.10-u-preview-2android-gs-raviole-5.10-u-beta1android-gs-raviole-5.10-t-qpr3-beta-2android-gs-raviole-5.10-android13-qpr3-beta1android-gs-pantah-5.10-u-preview-2android-gs-pantah-5.10-u-beta1android-gs-pantah-5.10-t-qpr3-beta-2android-gs-pantah-5.10-android13-qpr3-beta1android-gs-bluejay-5.10-u-preview-2android-gs-bluejay-5.10-u-beta1android-gs-bluejay-5.10-t-qpr3-beta-2android-gs-bluejay-5.10-android13-qpr3-beta1Woogeun Lee
1 function symbol(s) added 'long int copy_from_kernel_nofault(void *, void *, size_t)' Bug: 266120240 Change-Id: Idf9ad76bd87d1caa952cbeca0929f559909a4fe5 Signed-off-by: Woogeun Lee <woogeun.lee@samsung.com>
2023-01-26UPSTREAM: firmware: tegra: Reduce stack usageArnd Bergmann
Building the bpmp-debugfs driver for Arm results in a warning for stack usage: drivers/firmware/tegra/bpmp-debugfs.c:321:16: error: stack frame size of 1224 bytes in function 'bpmp_debug_store' [-Werror,-Wframe-larger-than=] static ssize_t bpmp_debug_store(struct file *file, const char __user *buf, It should be possible to rearrange the code to not require two separate buffers for the file name, but the easiest workaround is to use dynamic allocation. Bug: 261962742 Fixes: 5e37b9c137ee ("firmware: tegra: Add support for in-band debug") Link: https://lore.kernel.org/all/20201204193714.3134651-1-arnd@kernel.org/ Signed-off-by: Arnd Bergmann <arnd@arndb.de> [treding@nvidia.com: consistently return NULL on failure] Signed-off-by: Thierry Reding <treding@nvidia.com> (cherry picked from commit 06c2d9a078abe784fd9fd0f1534e318e827712b4) Signed-off-by: Lee Jones <joneslee@google.com> Change-Id: Ic147141781cc5fd4250a6d09e283c23ba45cbd9a
2023-01-26UPSTREAM: scsi: bfa: Move a large struct from the stack onto the heapLee Jones
Fixes the following W=1 kernel build warning(s): drivers/scsi/bfa/bfa_fcs_lport.c: In function ‘bfa_fcs_lport_fdmi_build_rhba_pyld’: drivers/scsi/bfa/bfa_fcs_lport.c:2152:1: warning: the frame size of 1200 bytes is larger than 1024 bytes [-Wframe-larger-than=] Bug: 261962742 Link: https://lore.kernel.org/r/20210312094738.2207817-15-lee.jones@linaro.org Cc: Anil Gurumurthy <anil.gurumurthy@qlogic.com> Cc: Sudarsana Kalluru <sudarsana.kalluru@qlogic.com> Cc: "James E.J. Bottomley" <jejb@linux.ibm.com> Cc: "Martin K. Petersen" <martin.petersen@oracle.com> Cc: linux-scsi@vger.kernel.org Signed-off-by: Lee Jones <lee.jones@linaro.org> Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com> (cherry picked from commit a7a11b6cfec2c3dc77b8206966f371dfafabea47) Signed-off-by: Lee Jones <joneslee@google.com> Change-Id: I9d266d1fd3546d198e163b9186f9eae836f7572a
2023-01-26ANDROID: Revert "ANDROID: allmodconfig: disable WERROR"Lee Jones
This reverts commit eb57c31115051c5404d1bb1f2daec20e051b0287. This branch looks clean of WERROR warnings. Let's try to re-enable it. Fixes: eb57c31115051 ("ANDROID: allmodconfig: disable WERROR") (cherry picked from commit d19f8758ae7732b14fd85e97c66dec2855d3be73) Signed-off-by: Lee Jones <joneslee@google.com> Change-Id: I0106dcd43d7e4b4e20ac768f3faac40285bc837b
2023-01-26UPSTREAM: ALSA: pcm: Move rwsem lock inside snd_ctl_elem_read to prevent UAFClement Lecigne
[ Note: this is a fix that works around the bug equivalently as the two upstream commits: 1fa4445f9adf ("ALSA: control - introduce snd_ctl_notify_one() helper") 56b88b50565c ("ALSA: pcm: Move rwsem lock inside snd_ctl_elem_read to prevent UAF") but in a simpler way to fit with older stable trees -- tiwai ] Add missing locking in ctl_elem_read_user/ctl_elem_write_user which can be easily triggered and turned into an use-after-free. Example code paths with SNDRV_CTL_IOCTL_ELEM_READ: 64-bits: snd_ctl_ioctl snd_ctl_elem_read_user [takes controls_rwsem] snd_ctl_elem_read [lock properly held, all good] [drops controls_rwsem] 32-bits (compat): snd_ctl_ioctl_compat snd_ctl_elem_write_read_compat ctl_elem_write_read snd_ctl_elem_read [missing lock, not good] CVE-2023-0266 was assigned for this issue. Bug: 265303544 Signed-off-by: Clement Lecigne <clecigne@google.com> Cc: stable@kernel.org # 5.12 and older Signed-off-by: Takashi Iwai <tiwai@suse.de> Reviewed-by: Jaroslav Kysela <perex@perex.cz> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> (cherry picked from commit df02234e6b87d2a9a82acd3198e44bdeff8488c7) Signed-off-by: Lee Jones <joneslee@google.com> Change-Id: Ibe891cdcb9eaf0dfc7bd771689c85c32b5c0d1f7
2023-01-26UPSTREAM: drm/shmem-helper: Avoid vm_open error pathsRob Clark
commit 09bf649a74573cb596e211418a4f8008f265c5a9 upstream. vm_open() is not allowed to fail. Fortunately we are guaranteed that the pages are already pinned, thanks to the initial mmap which is now being cloned into a forked process, and only need to increment the refcnt. So just increment it directly. Previously if a signal was delivered at the wrong time to the forking process, the mutex_lock_interruptible() could fail resulting in the pages_use_count not being incremented. Bug: 260569666 Fixes: 2194a63a818d ("drm: Add library for shmem backed GEM objects") Cc: stable@vger.kernel.org Signed-off-by: Rob Clark <robdclark@chromium.org> Reviewed-by: Daniel Vetter <daniel.vetter@ffwll.ch> Signed-off-by: Javier Martinez Canillas <javierm@redhat.com> Link: https://patchwork.freedesktop.org/patch/msgid/20221130185748.357410-3-robdclark@gmail.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> Signed-off-by: Lee Jones <joneslee@google.com> Change-Id: I1f6d481c677e0ee4747352f7949570bccf39815c
2023-01-26UPSTREAM: nfp: fix use-after-free in area_cache_get()Jialiang Wang
commit 02e1a114fdb71e59ee6770294166c30d437bf86a upstream. area_cache_get() is used to distribute cache->area and set cache->id, and if cache->id is not 0 and cache->area->kref refcount is 0, it will release the cache->area by nfp_cpp_area_release(). area_cache_get() set cache->id before cpp->op->area_init() and nfp_cpp_area_acquire(). But if area_init() or nfp_cpp_area_acquire() fails, the cache->id is is already set but the refcount is not increased as expected. At this time, calling the nfp_cpp_area_release() will cause use-after-free. To avoid the use-after-free, set cache->id after area_init() and nfp_cpp_area_acquire() complete successfully. Note: This vulnerability is triggerable by providing emulated device equipped with specified configuration. BUG: KASAN: use-after-free in nfp6000_area_init (drivers/net/ethernet/netronome/nfp/nfpcore/nfp6000_pcie.c:760) Write of size 4 at addr ffff888005b7f4a0 by task swapper/0/1 Call Trace: <TASK> nfp6000_area_init (drivers/net/ethernet/netronome/nfp/nfpcore/nfp6000_pcie.c:760) area_cache_get.constprop.8 (drivers/net/ethernet/netronome/nfp/nfpcore/nfp_cppcore.c:884) Allocated by task 1: nfp_cpp_area_alloc_with_name (drivers/net/ethernet/netronome/nfp/nfpcore/nfp_cppcore.c:303) nfp_cpp_area_cache_add (drivers/net/ethernet/netronome/nfp/nfpcore/nfp_cppcore.c:802) nfp6000_init (drivers/net/ethernet/netronome/nfp/nfpcore/nfp6000_pcie.c:1230) nfp_cpp_from_operations (drivers/net/ethernet/netronome/nfp/nfpcore/nfp_cppcore.c:1215) nfp_pci_probe (drivers/net/ethernet/netronome/nfp/nfp_main.c:744) Freed by task 1: kfree (mm/slub.c:4562) area_cache_get.constprop.8 (drivers/net/ethernet/netronome/nfp/nfpcore/nfp_cppcore.c:873) nfp_cpp_read (drivers/net/ethernet/netronome/nfp/nfpcore/nfp_cppcore.c:924 drivers/net/ethernet/netronome/nfp/nfpcore/nfp_cppcore.c:973) nfp_cpp_readl (drivers/net/ethernet/netronome/nfp/nfpcore/nfp_cpplib.c:48) Bug: 254471126 Signed-off-by: Jialiang Wang <wangjialiang0806@163.com> Reviewed-by: Yinjun Zhang <yinjun.zhang@corigine.com> Acked-by: Simon Horman <simon.horman@corigine.com> Link: https://lore.kernel.org/r/20220810073057.4032-1-wangjialiang0806@163.com Signed-off-by: Jakub Kicinski <kuba@kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> Signed-off-by: Lee Jones <joneslee@google.com> Change-Id: Iad626deee45edc6bdf7a095d3de1defc5c6ad996 Signed-off-by: Lee Jones <joneslee@google.com>
2023-01-26ANDROID: usb: f_accessory: Check buffer size when initialised via compositeLee Jones
When communicating with accessory devices via USBFS, the initialisation call-stack looks like: ConfigFS > Gadget ConfigFS > UDC > Gadget ConfigFS > Composite Eventually ending up in composite_dev_prepare() where memory for the data buffer is allocated and initialised. The default size used for the allocation is USB_COMP_EP0_BUFSIZ (4k). When handling bulk transfers, acc_ctrlrequest() needs to be able to handle buffers up to BULK_BUFFER_SIZE (16k). Instead of adding new generic attributes to 'struct usb_request' to track the size of the allocated buffer, we can simply split off the affected thread of execution to travel via a knowledgeable abstracted function acc_ctrlrequest_composite() where we can complete the necessary specific checks. Bug: 264029575 Signed-off-by: Lee Jones <joneslee@google.com> Change-Id: Ia1280f85499621d3fa57f7262b4a2c80f4be7773 Signed-off-by: Lee Jones <joneslee@google.com>
2023-01-25UPSTREAM: loop: allow user to set the queue depthChaitanya Kulkarni
Instead of hardcoding queue depth allow user to set the hw queue depth using module parameter. Set default value to 128 to retain the existing behavior. Signed-off-by: Chaitanya Kulkarni <kch@nvidia.com> Reviewed-by: Himanshu Madhani <himanshu.madhani@oracle.com> Link: https://lore.kernel.org/r/20220215213310.7264-5-kch@nvidia.com Signed-off-by: Jens Axboe <axboe@kernel.dk> Bug: 265019048 Change-Id: I03cd1f6e36347dbe94ffc2aeb2ef50454a713864 (cherry picked from commit ef44c50837ab7818920bd9994b36d6e573312abc) Signed-off-by: Bart Van Assche <bvanassche@google.com>
2023-01-25UPSTREAM: proc: avoid integer type confusion in get_proc_longLinus Torvalds
commit e6cfaf34be9fcd1a8285a294e18986bfc41a409c upstream. proc_get_long() is passed a size_t, but then assigns it to an 'int' variable for the length. Let's not do that, even if our IO paths are limited to MAX_RW_COUNT (exactly because of these kinds of type errors). So do the proper test in the rigth type. Bug: 261488859 Reported-by: Kyle Zeng <zengyhkyle@gmail.com> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> Signed-off-by: Lee Jones <joneslee@google.com> Change-Id: Icb7df4e5d9061d8a2c854b3f7cccaa753d6ea540 Signed-off-by: Lee Jones <joneslee@google.com>
2023-01-25UPSTREAM: proc: proc_skip_spaces() shouldn't think it is working on C stringsLinus Torvalds
commit bce9332220bd677d83b19d21502776ad555a0e73 upstream. proc_skip_spaces() seems to think it is working on C strings, and ends up being just a wrapper around skip_spaces() with a really odd calling convention. Instead of basing it on skip_spaces(), it should have looked more like proc_skip_char(), which really is the exact same function (except it skips a particular character, rather than whitespace). So use that as inspiration, odd coding and all. Now the calling convention actually makes sense and works for the intended purpose. Bug: 261488859 Reported-and-tested-by: Kyle Zeng <zengyhkyle@gmail.com> Acked-by: Eric Dumazet <edumazet@google.com> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> Signed-off-by: Lee Jones <joneslee@google.com> Change-Id: Idda5e84344778ff8794bc21c981ba3da01e6a63b Signed-off-by: Lee Jones <joneslee@google.com>
2023-01-24UPSTREAM: usb: gadget: f_hid: fix f_hidg lifetime vs cdevJohn Keeping
[ Upstream commit 89ff3dfac604614287ad5aad9370c3f984ea3f4b ] The embedded struct cdev does not have its lifetime correctly tied to the enclosing struct f_hidg, so there is a use-after-free if /dev/hidgN is held open while the gadget is deleted. This can readily be replicated with libusbgx's example programs (for conciseness - operating directly via configfs is equivalent): gadget-hid exec 3<> /dev/hidg0 gadget-vid-pid-remove exec 3<&- Pull the existing device up in to struct f_hidg and make use of the cdev_device_{add,del}() helpers. This changes the lifetime of the device object to match struct f_hidg, but note that it is still added and deleted at the same time. Bug: 176850153 Fixes: 71adf1189469 ("USB: gadget: add HID gadget driver") Tested-by: Lee Jones <lee@kernel.org> Reviewed-by: Andrzej Pietrasiewicz <andrzej.p@collabora.com> Reviewed-by: Lee Jones <lee@kernel.org> Signed-off-by: John Keeping <john@metanate.com> Link: https://lore.kernel.org/r/20221122123523.3068034-2-john@metanate.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> Signed-off-by: Sasha Levin <sashal@kernel.org> Signed-off-by: Lee Jones <joneslee@google.com> Change-Id: I5d37ca47c5f087d5b1b303b4e8a1614ea3f50159
2023-01-24UPSTREAM: usb: gadget: f_hid: optional SETUP/SET_REPORT modeMaxim Devaev
[ Upstream commit d7428bc26fc767942c38d74b80299bcd4f01e7cb ] f_hid provides the OUT Endpoint as only way for receiving reports from the host. SETUP/SET_REPORT method is not supported, and this causes a number of compatibility problems with various host drivers, especially in the case of keyboard emulation using f_hid. - Some hosts do not support the OUT Endpoint and ignore it, so it becomes impossible for the gadget to receive a report from the host. In the case of a keyboard, the gadget loses the ability to receive the status of the LEDs. - Some BIOSes/UEFIs can't work with HID devices with the OUT Endpoint at all. This may be due to their bugs or incomplete implementation of the HID standard. For example, absolutely all Apple UEFIs can't handle the OUT Endpoint if it goes after IN Endpoint in the descriptor and require the reverse order (OUT, IN) which is a violation of the standard. Other hosts either do not initialize gadgets with a descriptor containing the OUT Endpoint completely (like some HP and DELL BIOSes and embedded firmwares like on KVM switches), or initialize them, but will not poll the IN Endpoint. This patch adds configfs option no_out_endpoint=1 to disable the OUT Endpoint and allows f_hid to receive reports from the host via SETUP/SET_REPORT. Previously, there was such a feature in f_hid, but it was replaced by the OUT Endpoint [1] in the commit 99c515005857 ("usb: gadget: hidg: register OUT INT endpoint for SET_REPORT"). So this patch actually returns the removed functionality while making it optional. For backward compatibility reasons, the OUT Endpoint mode remains the default behaviour. - The OUT Endpoint mode provides the report queue and reduces USB overhead (eliminating SETUP routine) on transmitting a report from the host. - If the SETUP/SET_REPORT mode is used, there is no report queue, so the userspace will only read last report. For classic HID devices like keyboards this is not a problem, since it's intended to transmit the status of the LEDs and only the last report is important. This mode provides better compatibility with strange and buggy host drivers. Both modes passed USBCV tests. Checking with the USB protocol analyzer also confirmed that everything is working as it should and the new mode ensures operability in all of the described cases. Bug: 176850153 Link: https://www.spinics.net/lists/linux-usb/msg65494.html [1] Reviewed-by: Maciej Żenczykowski <zenczykowski@gmail.com> Acked-by: Felipe Balbi <balbi@kernel.org> Signed-off-by: Maxim Devaev <mdevaev@gmail.com> Link: https://lore.kernel.org/r/20210821134004.363217-1-mdevaev@gmail.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> Stable-dep-of: 89ff3dfac604 ("usb: gadget: f_hid: fix f_hidg lifetime vs cdev") Signed-off-by: Sasha Levin <sashal@kernel.org> Signed-off-by: Lee Jones <joneslee@google.com> Change-Id: I0f5759015f17661fe4fe23a1216f1047978c79b1
2023-01-24ANDROID: GKI: KASAN: disable INLINERam Muthiah
and replace with PANIC_ON_WARN. The latter is needed to align with the standard KASAN template. The former is needed to workaround a boot issue on cuttlefish that hasn't been root-caused yet. Likely cause is the larger text space needed for the INLINE config. This issue was surfaced on cuttlefish when the BL implementation was changed to use a builtin environment 578b47ac41fe4433108. Bug: 218315905 Change-Id: I57486f8befa720bbf49afe89c5454af8348816a5
2023-01-23BACKPORT: arm64/bpf: Remove 128MB limit for BPF JIT programsRussell King
(Backport: resolve conflicts due to missing f4693c2716b35 and present d3578ba7a5ae, and also drop in_bpf_jit from fixup_exception the same way 5.15 backport 9c82ce593626 does it.) Commit 91fc957c9b1d ("arm64/bpf: don't allocate BPF JIT programs in module memory") restricts BPF JIT program allocation to a 128MB region to ensure BPF programs are still in branching range of each other. However this restriction should not apply to the aarch64 JIT, since BPF_JMP | BPF_CALL are implemented as a 64-bit move into a register and then a BLR instruction - which has the effect of being able to call anything without proximity limitation. The practical reason to relax this restriction on JIT memory is that 128MB of JIT memory can be quickly exhausted, especially where PAGE_SIZE is 64KB - one page is needed per program. In cases where seccomp filters are applied to multiple VMs on VM launch - such filters are classic BPF but converted to BPF - this can severely limit the number of VMs that can be launched. In a world where we support BPF JIT always on, turning off the JIT isn't always an option either. Fixes: 91fc957c9b1d ("arm64/bpf: don't allocate BPF JIT programs in module memory") Suggested-by: Ard Biesheuvel <ard.biesheuvel@linaro.org> Signed-off-by: Russell King <russell.king@oracle.com> Signed-off-by: Daniel Borkmann <daniel@iogearbox.net> Tested-by: Alan Maguire <alan.maguire@oracle.com> Link: https://lore.kernel.org/bpf/1636131046-5982-2-git-send-email-alan.maguire@oracle.com (cherry picked from commit b89ddf4cca43f1269093942cf5c4e457fd45c335) Bug: 252919296 Change-Id: Iec7d0b2bba001df94c2e21fcd5883ff002111cd5 Signed-off-by: Andrey Konovalov <andreyknvl@google.com>
2023-01-20ANDROID: fuse: Restore upstream type of bitfields in fuse_argsNathan Chancellor
Commit 88b7179fcdb59 ("ANDROID: fuse: Move functions in preparation for fuse-bpf") changed the type of these bitfields from the upstream type of 'bool' to 'int', which causes several warnings with recent versions of clang: /builds/linux/fs/fuse/dir.c:168:19: error: implicit truncation from 'int' to a one-bit wide bit-field changes value from 1 to -1 [-Werror,-Wsingle-bit-bitfield-constant-conversion] args->out_argvar = true; ^ ~~~~ /builds/linux/fs/fuse/dir.c:492:18: error: implicit truncation from 'int' to a one-bit wide bit-field changes value from 1 to -1 [-Werror,-Wsingle-bit-bitfield-constant-conversion] args.out_argvar = 1; ^ ~ /builds/linux/fs/fuse/dir.c:1649:20: error: implicit truncation from 'int' to a one-bit wide bit-field changes value from 1 to -1 [-Werror,-Wsingle-bit-bitfield-constant-conversion] ap.args.out_pages = true; ^ ~~~~ /builds/linux/fs/fuse/dir.c:1650:21: error: implicit truncation from 'int' to a one-bit wide bit-field changes value from 1 to -1 [-Werror,-Wsingle-bit-bitfield-constant-conversion] ap.args.out_argvar = true; ^ ~~~~ /builds/linux/fs/fuse/dir.c:1651:23: error: implicit truncation from 'int' to a one-bit wide bit-field changes value from 1 to -1 [-Werror,-Wsingle-bit-bitfield-constant-conversion] ap.args.page_zeroing = true; ^ ~~~~ 5 errors generated. When fuse_args was moved back to the internal implementation in commit 9a5023967b4d2 ("ANDROID: fuse-bpf: Use fuse_bpf_args in uapi"), the type was not restored. Do so now to fix the warnings and reduce the delta with upstream. Bug: 265200230 Change-Id: I4d51f331d842a1faff9a937140f0275130e70d73 Signed-off-by: Nathan Chancellor <nathan@kernel.org>
2023-01-17UPSTREAM: iommu: Avoid races around device probeandroid13-5.10-2023-01_r1Robin Murphy
We currently have 3 different ways that __iommu_probe_device() may be called, but no real guarantee that multiple callers can't tread on each other, especially once asynchronous driver probe gets involved. It would likely have taken a fair bit of luck to hit this previously, but commit 57365a04c921 ("iommu: Move bus setup to IOMMU device registration") ups the odds since now it's not just omap-iommu that may trigger multiple bus_iommu_probe() calls in parallel if probing asynchronously. Add a lock to ensure we can't try to double-probe a device, and also close some possible race windows to make sure we're truly robust against trying to double-initialise a group via two different member devices. Reported-by: Brian Norris <briannorris@chromium.org> Tested-by: Brian Norris <briannorris@chromium.org> Fixes: 57365a04c921 ("iommu: Move bus setup to IOMMU device registration") Link: https://lore.kernel.org/r/1946ef9f774851732eed78760a78ec40dbc6d178.1667591503.git.robin.murphy@arm.com Signed-off-by: Joerg Roedel <jroedel@suse.de> Signed-off-by: Robin Murphy <robin.murphy@arm.com> Bug: 264326526 (cherry picked from commit 01657bc14a3990c665375f77978631fee77b1fce) Change-Id: I51dbcdc5dc536b0e69c6187b2d7ac6a2031a305b Signed-off-by: Luke Chang <lukechang@google.com>
2023-01-12UPSTREAM: usb: gadget: composite: Show warning if function driver's ↵Qihang Hu
descriptors are incomplete. In the config_ep_by_speed_and_alt function, select the corresponding descriptor through g->speed. But some legacy or not well designed function drivers may not support the corresponding speed. So, we can directly display warnings instead of causing kernel panic. At the same time, it indicates the reasons in warning message. Reviewed-by: Peter Chen <peter.chen@kernel.org> Signed-off-by: Qihang Hu <huqihang@oppo.com> Link: https://lore.kernel.org/r/20211110101129.462357-1-huqihang@oppo.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> (cherry picked from commit 16d42759207fc3d1bff7cfd330a08a225e470ba0) Bug: 259171206 Change-Id: I5ceff4871e1e7693c7a2c68264e994f39194090b Signed-off-by: Avichal Rakesh <arakesh@google.com>
2023-01-11UPSTREAM: usb: gadget: uvc: Rename bmInterfaceFlags -> bmInterlaceFlagsDaniel Scally
In the specification documents for the Uncompressed and MJPEG USB Video Payloads, the field name is bmInterlaceFlags - it has been misnamed within the kernel. Although renaming the field does break the kernel's interface to userspace it should be low-risk in this instance. The field is read only and hardcoded to 0, so there was never any value in anyone reading it. A search of the uvc-gadget application and all the forks that I could find for it did not reveal any users either. Fixes: cdda479f15cd ("USB gadget: video class function driver") Reviewed-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com> Reviewed-by: Kieran Bingham <kieran.bingham@ideasonboard.com> Signed-off-by: Daniel Scally <dan.scally@ideasonboard.com> Link: https://lore.kernel.org/r/20221206161203.1562827-1-dan.scally@ideasonboard.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> (cherry picked from commit 81c25247a2a03a0f97e4805d7aff7541ccff6baa) Bug: 259171206 Change-Id: I95ad86d0c0ab097b215e1ef655beea80c2cdb570 Signed-off-by: Avichal Rakesh <arakesh@google.com>
2023-01-11UPSTREAM: usb: gadget: uvc: Prevent buffer overflow in setup handlerSzymon Heidrich
Setup function uvc_function_setup permits control transfer requests with up to 64 bytes of payload (UVC_MAX_REQUEST_SIZE), data stage handler for OUT transfer uses memcpy to copy req->actual bytes to uvc_event->data.data array of size 60. This may result in an overflow of 4 bytes. Fixes: cdda479f15cd ("USB gadget: video class function driver") Cc: stable <stable@kernel.org> Reviewed-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com> Reviewed-by: Daniel Scally <dan.scally@ideasonboard.com> Signed-off-by: Szymon Heidrich <szymon.heidrich@gmail.com> Link: https://lore.kernel.org/r/20221206141301.51305-1-szymon.heidrich@gmail.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> (cherry picked from commit 4c92670b16727365699fe4b19ed32013bab2c107) Bug: 259171206 Change-Id: I34eba1f89b36db7a3d32be2f4e45b29fbb8bdc31 Signed-off-by: Avichal Rakesh <arakesh@google.com>
2023-01-11UPSTREAM: usb: gadget: uvc: also use try_format in set_formatMichael Grzeschik
Since e219a712bc06 (usb: gadget: uvc: add v4l2 try_format api call) the try_format function is available. With this function includes checks for valid configurations programmed in the configfs. We use this function to ensure to return valid values on the set_format callback. Signed-off-by: Michael Grzeschik <m.grzeschik@pengutronix.de> Fixes: e219a712bc06 ("usb: gadget: uvc: add v4l2 try_format api call") Link: https://lore.kernel.org/r/20221026182240.363055-1-m.grzeschik@pengutronix.de Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> (cherry picked from commit 181babf7b4e5050b7a23cb47eb06277405cf132f) Bug: 259171206 Change-Id: I404c8d01dc53dcf3b400c0f9e1888992d9f65db8 Signed-off-by: Avichal Rakesh <arakesh@google.com>
2023-01-11UPSTREAM: usb: gadget: uvc: default the ctrl request interface offsetsMichael Grzeschik
For the userspace it is needed to distinguish between requests for the control or streaming interface. The userspace would have to parse the configfs to know which interface index it has to compare the ctrl requests against. Since the interface numbers are not fixed, e.g. for composite gadgets, the interface offset depends on the setup. The kernel has this information when handing over the ctrl request to the userspace. This patch removes the offset from the interface numbers and expose the default interface defines in the uapi g_uvc.h. Signed-off-by: Michael Grzeschik <m.grzeschik@pengutronix.de> Link: https://lore.kernel.org/r/20221011075348.1786897-1-m.grzeschik@pengutronix.de Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> (cherry picked from commit d182bf156c4cb8b08ce4a75e82b3357b14a4382d) Bug: 259171206 Change-Id: Ie5978ef268731e67ca72940ce6fbc7f980cb4419 Signed-off-by: Avichal Rakesh <arakesh@google.com>
2023-01-11UPSTREAM: usb: gadget: uvc: fix sg handling during video encodeJeff Vanhoof
In uvc_video_encode_isoc_sg, the uvc_request's sg list is incorrectly being populated leading to corrupt video being received by the remote end. When building the sg list the usage of buf->sg's 'dma_length' field is not correct and instead its 'length' field should be used. Fixes: e81e7f9a0eb9 ("usb: gadget: uvc: add scatter gather support") Cc: <stable@vger.kernel.org> Signed-off-by: Jeff Vanhoof <qjv001@motorola.com> Signed-off-by: Dan Vacura <w36195@motorola.com> Link: https://lore.kernel.org/r/20221018215044.765044-5-w36195@motorola.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> (cherry picked from commit b57b08e6f431348363adffa5b6643fe3ec9dc7fe) Bug: 259171206 Change-Id: I6b6ee215676592e44dc1a12081efc049c3d50d4b Signed-off-by: Avichal Rakesh <arakesh@google.com>
2023-01-11UPSTREAM: usb: gadget: uvc: fix sg handling in error caseDan Vacura
If there is a transmission error the buffer will be returned too early, causing a memory fault as subsequent requests for that buffer are still queued up to be sent. Refactor the error handling to wait for the final request to come in before reporting back the buffer to userspace for all transfer types (bulk/isoc/isoc_sg). This ensures userspace knows if the frame was successfully sent. Fixes: e81e7f9a0eb9 ("usb: gadget: uvc: add scatter gather support") Cc: <stable@vger.kernel.org> Signed-off-by: Dan Vacura <w36195@motorola.com> Link: https://lore.kernel.org/r/20221018215044.765044-4-w36195@motorola.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> (cherry picked from commit 0a0a2760b04814428800d48281a447a7522470ad) Bug: 259171206 Change-Id: I9fa41c05a26c3118c6af609d18e1e447a5e4b304 Signed-off-by: Avichal Rakesh <arakesh@google.com>
2023-01-11UPSTREAM: usb: gadget: uvc: fix dropped frame after missed isocDan Vacura
With the re-use of the previous completion status in 0d1c407b1a749 ("usb: dwc3: gadget: Return proper request status") it could be possible that the next frame would also get dropped if the current frame has a missed isoc error. Ensure that an interrupt is requested for the start of a new frame. Fixes: fc78941d8169 ("usb: gadget: uvc: decrease the interrupt load to a quarter") Cc: <stable@vger.kernel.org> Signed-off-by: Dan Vacura <w36195@motorola.com> Link: https://lore.kernel.org/r/20221018215044.765044-2-w36195@motorola.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> (cherry picked from commit 8e8e923a49967b798e7d69f1ce9eff1dd2533547) Bug: 259171206 Change-Id: I7d1b9243b788d2fb3593c52f4fb49ba195720af6 Signed-off-by: Avichal Rakesh <arakesh@google.com>
2023-01-11UPSTREAM: usb: gadget: uvc: don't put item still in useMichael Grzeschik
With the patch "588b9e85609b (usb: gadget: uvc: add v4l2 enumeration api calls)" the driver is keeping a list of configfs entries currently configured. The list is used in uvc_v4l2 on runtime. The driver now is giving back the list item just after it was referenced with config_item_put. It also calls config_item_put on uvc_free, which is the only and right place to give back the reference. This patch fixes the issue by removing the extra config_item_put in uvc_alloc. Fixes: 588b9e85609b (usb: gadget: uvc: add v4l2 enumeration api calls) Signed-off-by: Michael Grzeschik <m.grzeschik@pengutronix.de> Link: https://lore.kernel.org/r/20220930122839.1747279-1-m.grzeschik@pengutronix.de Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> (cherry picked from commit 3180d827c807d8d6e5d6ba4f2e08eed9efa083af) Bug: 259171206 Change-Id: Idf19d732cc5b90f09311a94d5d07c6e1805043f5 Signed-off-by: Avichal Rakesh <arakesh@google.com>
2023-01-11UPSTREAM: usb: gadget: uvc: Fix argument to sizeof() in uvc_register_video()Nathan Chancellor
When building s390 allmodconfig after commit 9b91a6523078 ("usb: gadget: uvc: increase worker prio to WQ_HIGHPRI"), the following error occurs: In file included from ../include/linux/string.h:253, from ../include/linux/bitmap.h:11, from ../include/linux/cpumask.h:12, from ../include/linux/smp.h:13, from ../include/linux/lockdep.h:14, from ../include/linux/rcupdate.h:29, from ../include/linux/rculist.h:11, from ../include/linux/pid.h:5, from ../include/linux/sched.h:14, from ../include/linux/ratelimit.h:6, from ../include/linux/dev_printk.h:16, from ../include/linux/device.h:15, from ../drivers/usb/gadget/function/f_uvc.c:9: In function ‘fortify_memset_chk’, inlined from ‘uvc_register_video’ at ../drivers/usb/gadget/function/f_uvc.c:424:2: ../include/linux/fortify-string.h:301:25: error: call to ‘__write_overflow_field’ declared with attribute warning: detected write beyond size of field (1st parameter); maybe use struct_group()? [-Werror=attribute-warning] 301 | __write_overflow_field(p_size_field, size); | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ This points to the memset() in uvc_register_video(). It is clear that the argument to sizeof() is incorrect, as uvc->vdev (a 'struct video_device') is being zeroed out but the size of uvc->video (a 'struct uvc_video') is being used as the third arugment to memset(). pahole shows that prior to commit 9b91a6523078 ("usb: gadget: uvc: increase worker prio to WQ_HIGHPRI"), 'struct video_device' and 'struct ucv_video' had the same size, meaning that the argument to sizeof() is incorrect semantically but there is no visible issue: $ pahole -s build/drivers/usb/gadget/function/f_uvc.o | grep -E "(uvc_video|video_device)\s+" video_device 1400 4 uvc_video 1400 3 After that change, uvc_video becomes slightly larger, meaning that the memset() will overwrite by 8 bytes: $ pahole -s build/drivers/usb/gadget/function/f_uvc.o | grep -E "(uvc_video|video_device)\s+" video_device 1400 4 uvc_video 1408 3 Fix the arugment to sizeof() so that there is no overwrite. Cc: stable@vger.kernel.org Fixes: e4ce9ed835bc ("usb: gadget: uvc: ensure the vdev is unset") Signed-off-by: Nathan Chancellor <nathan@kernel.org> Reviewed-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com> Reviewed-by: Kees Cook <keescook@chromium.org> Link: https://lore.kernel.org/r/20220928201921.3152163-1-nathan@kernel.org Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> (cherry picked from commit a15e17acce5aaae54243f55a7349c2225450b9bc) Bug: 259171206 Change-Id: Id48717e01c36fa2ace9570b97553f371e5743fc3 Signed-off-by: Avichal Rakesh <arakesh@google.com>
2023-01-11UPSTREAM: usb: gadget: uvc: add v4l2 try_format api callMichael Grzeschik
This patch adds the uvc_v4l2_try_format api call to validate the setting of v4l2_format. It will fallback to the nearest allowed framesize. Signed-off-by: Michael Grzeschik <m.grzeschik@pengutronix.de> Link: https://lore.kernel.org/r/20220909221335.15033-5-m.grzeschik@pengutronix.de Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> (cherry picked from commit e219a712bc06dc68ecccb3085cb91438bee2466a) Bug: 259171206 Change-Id: Ic83d90252ec07372470906d7f6259bde131d1a8a Signed-off-by: Avichal Rakesh <arakesh@google.com>
2023-01-11UPSTREAM: usb: gadget: uvc: add v4l2 enumeration api callsMichael Grzeschik
This patch adds support to the v4l2 VIDIOCs for enum_format, enum_framesizes and enum_frameintervals. This way, the userspace application can use these VIDIOCS to query the via configfs exported frame capabilities. With thes callbacks the userspace doesn't have to bring its own configfs parser. Signed-off-by: Michael Grzeschik <m.grzeschik@pengutronix.de> Link: https://lore.kernel.org/r/20220909221335.15033-4-m.grzeschik@pengutronix.de Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> (cherry picked from commit 588b9e85609bcb2f84a2be83591480aa943943b6) Bug: 259171206 Change-Id: I26bf3a509158da6f521c2e62076ef014cf0235b8 Signed-off-by: Avichal Rakesh <arakesh@google.com>
2023-01-11BACKPORT: media: uvcvideo: move uvc_format_desc to common headerMichael Grzeschik
The uvc_format_desc, GUID defines and the uvc_format_by_guid helper is also useful for the uvc gadget stack. This patch moves them to a common header. Tested-by: Daniel Scally <dan.scally@ideasonboard.com> Reviewed-by: Daniel Scally <dan.scally@ideasonboard.com> Signed-off-by: Michael Grzeschik <m.grzeschik@pengutronix.de> Link: https://lore.kernel.org/r/20220909221335.15033-3-m.grzeschik@pengutronix.de Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> (cherry picked from commit 6b028df7d466a5f7c0263a46256c9bdc42debd9f) arakesh: resolved minor conflicts in drivers/media/usb/uvc/uvc_driver.c and drivers/media/usb/uvc/uvcvideo.h Bug: 259171206 Change-Id: I37b839850896fff279159fca93a50f4788184354 Signed-off-by: Avichal Rakesh <arakesh@google.com>
2023-01-11BACKPORT: media: v4l: move helper functions for fractions from uvc to ↵Michael Grzeschik
v4l2-common The functions uvc_simplify_fraction and uvc_fraction_to_interval are generic helpers which are also useful for other v4l2 drivers. This patch moves them to v4l2-common. Tested-by: Daniel Scally <dan.scally@ideasonboard.com> Reviewed-by: Daniel Scally <dan.scally@ideasonboard.com> Signed-off-by: Michael Grzeschik <m.grzeschik@pengutronix.de> Link: https://lore.kernel.org/r/20220909221335.15033-2-m.grzeschik@pengutronix.de Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> (cherry picked from commit 6ba8b8d45335180523df8f1b6cd1c995a3dbf560) arakesh: resolved minor conflicts in include/media/v4l2-common.h and drivers/media/v4l2-core/v4l2-common.c Bug: 259171206 Change-Id: I17eea1ef6788ba98599b1d8a12499147ebef7d60 Signed-off-by: Avichal Rakesh <arakesh@google.com>
2023-01-10UPSTREAM: usb: gadget: uvc: increase worker prio to WQ_HIGHPRIMichael Grzeschik
This patch is changing the simple workqueue in the gadget driver to be allocated as async_wq with a higher priority. The pump worker, that is filling the usb requests, will have a higher priority and will not be scheduled away so often while the video stream is handled. This will lead to fewer streaming underruns. Signed-off-by: Michael Grzeschik <m.grzeschik@pengutronix.de> Link: https://lore.kernel.org/r/20220907215818.2670097-1-m.grzeschik@pengutronix.de Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> (cherry picked from commit 9b91a65230784a9ef644b8bdbb82a79ba4ae9456) Bug: 242344221 Change-Id: I91ffbc93e8769c3b2674134679d5f9d48b566dbd Signed-off-by: Avichal Rakesh <arakesh@google.com>
2023-01-10UPSTREAM: usb: move from strlcpy with unused retval to strscpyWolfram Sang
Follow the advice of the below link and prefer 'strscpy' in this subsystem. Conversion is 1:1 because the return value is not used. Generated by a coccinelle script. Link: https://lore.kernel.org/r/CAHk-=wgfRnXz0W3D37d01q3JFkr_i_uTL=V6A6G1oUZcprmknw@mail.gmail.com/ Reviewed-by: Richard Leitner <richard.leitner@skidata.com> Reviewed-by: Laurent Pinchart <laurent.pinchart+renesas@ideasonboard.com> Acked-by: Shuah Khan <skhan@linuxfoundation.org> Signed-off-by: Wolfram Sang <wsa+renesas@sang-engineering.com> Link: https://lore.kernel.org/r/20220818210116.7517-1-wsa+renesas@sang-engineering.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> (cherry picked from commit b7db5733a5ace9acc1f3104c9050c5aa1363f13b) Bug: 242344221 Change-Id: Id0c3b164fa1f493905a17c04828455c6959eb0b5 Signed-off-by: Avichal Rakesh <arakesh@google.com>
2023-01-10UPSTREAM: usb: gadget: uvc: fix changing interface name via configfsMichael Grzeschik
When setting the function name, it is always truncated by one char since snprintf is always including the null-termination in the len parameter. We use strscpy and fix the size setting to use len + 1 instead. Fixes: 324e4f85070f ("usb: gadget: uvc: allow changing interface name via configfs") Signed-off-by: Michael Grzeschik <m.grzeschik@pengutronix.de> Link: https://lore.kernel.org/r/20220707115612.2760569-1-m.grzeschik@pengutronix.de Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> (cherry picked from commit 3d0dc539029b09fbd125444c16b11a8ed10b9d0f) Bug: 242344221 Change-Id: I9a138af30c0628b1ec127f7986ace12df77b2d00 Signed-off-by: Avichal Rakesh <arakesh@google.com>
2023-01-10UPSTREAM: usb: gadget: uvc: fix list double add in uvcg_video_pumpDan Vacura
A panic can occur if the endpoint becomes disabled and the uvcg_video_pump adds the request back to the req_free list after it has already been queued to the endpoint. The endpoint complete will add the request back to the req_free list. Invalidate the local request handle once it's been queued. <6>[ 246.796704][T13726] configfs-gadget gadget: uvc: uvc_function_set_alt(1, 0) <3>[ 246.797078][ T26] list_add double add: new=ffffff878bee5c40, prev=ffffff878bee5c40, next=ffffff878b0f0a90. <6>[ 246.797213][ T26] ------------[ cut here ]------------ <2>[ 246.797224][ T26] kernel BUG at lib/list_debug.c:31! <6>[ 246.807073][ T26] Call trace: <6>[ 246.807180][ T26] uvcg_video_pump+0x364/0x38c <6>[ 246.807366][ T26] process_one_work+0x2a4/0x544 <6>[ 246.807394][ T26] worker_thread+0x350/0x784 <6>[ 246.807442][ T26] kthread+0x2ac/0x320 Fixes: f9897ec0f6d3 ("usb: gadget: uvc: only pump video data if necessary") Cc: stable@vger.kernel.org Reviewed-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com> Signed-off-by: Dan Vacura <w36195@motorola.com> Link: https://lore.kernel.org/r/20220617163154.16621-1-w36195@motorola.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> (cherry picked from commit 96163f835e65f8c9897487fac965819f0651d671) Bug: 242344221 Change-Id: Ib3181d5965281318619c7b78da2c334701750e14 Signed-off-by: Avichal Rakesh <arakesh@google.com>
2023-01-10UPSTREAM: usb: gadget: uvc: calculate the number of request depending on ↵Michael Grzeschik
framesize The current limitation of possible number of requests being handled is dependent on the gadget speed. It makes more sense to depend on the typical frame size when calculating the number of requests. This patch is changing this and is using the previous limits as boundaries for reasonable minimum and maximum number of requests. For a 1080p jpeg encoded video stream with a maximum imagesize of e.g. 800kB with a maxburst of 8 and an multiplier of 1 the resulting number of requests is calculated to 49. 800768 1 nreqs = ------ * -------------- ~= 49 2 (1024 * 8 * 1) Tested-by: Dan Vacura <w36195@motorola.com> Signed-off-by: Michael Grzeschik <m.grzeschik@pengutronix.de> Link: https://lore.kernel.org/r/20220529223848.105914-2-m.grzeschik@pengutronix.de Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> (cherry picked from commit 87d76b5f1d8eeb49efa16e2018e188864cbb9401) Bug: 242344221 Change-Id: I3cf760340c9c2cde32f1c8ca9023735d0639c5fb Signed-off-by: Avichal Rakesh <arakesh@google.com>
2023-01-10UPSTREAM: usb: gadget: uvc: Fix comment blocks styleLaurent Pinchart
The UVC gadget driver historically uses the /* Comment * style */ for multi-line block comments, which is frowned upon. Patches for the driver are required to use the more standard /* * Comment * style */ style. This result in inconsistencies. Fix it by converting all remaining instances of the old style. Reviewed-by: Kieran Bingham <kieran.bingham+renesas@ideasonboard.com> Signed-off-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com> Link: https://lore.kernel.org/r/20220608174918.14656-1-laurent.pinchart@ideasonboard.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> (cherry picked from commit c5d337a358b3e41bb4f7abd99a79b68a28eafaa2) Bug: 242344221 Change-Id: I7bf64ebabf9f5d9ad4434cba36200d6edd925e73 Signed-off-by: Avichal Rakesh <arakesh@google.com>
2023-01-10UPSTREAM: usb: gadget: uvc: track frames in format entriesMichael Grzeschik
Just like the header is tracking the formats in a linked list, in this patch we track the frames in a linked list of the formats. It simplifies the parsing of the configfs structure. Signed-off-by: Michael Grzeschik <m.grzeschik@pengutronix.de> Link: https://lore.kernel.org/r/20220421211427.3400834-6-m.grzeschik@pengutronix.de Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> (cherry picked from commit a2673d570bd648851e00ac531bdf695f4ebb4f78) Bug: 242344221 Change-Id: I8d3e4ba5b13cad2f195400ef4de5c8e196e25a8a Signed-off-by: Avichal Rakesh <arakesh@google.com>
2023-01-10UPSTREAM: usb: gadget: uvc: move structs to common headerMichael Grzeschik
The functions and structs of the configfs interface should also be used by the uvc gadget driver. This patch prepares the stack by moving the common structs and functions to the common header file. Reviewed-by: Paul Elder <paul.elder@ideasonboard.com> Reviewed-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com> Signed-off-by: Michael Grzeschik <m.grzeschik@pengutronix.de> Link: https://lore.kernel.org/r/20220421211427.3400834-5-m.grzeschik@pengutronix.de Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> (cherry picked from commit e2fa7b36de90de26da11b7f37fe0ce16935ab8a8) Bug: 242344221 Change-Id: I682ca939d2f6092868c75aa73ca3a98713ffca84 Signed-off-by: Avichal Rakesh <arakesh@google.com>
2023-01-10UPSTREAM: usb: gadget: uvc: prevent index variables to start from 0Michael Grzeschik
Some configfs variables like bDefaultFrameIndex are always starting by 1. This patch adds a check to prevent setting those variables to 0. Signed-off-by: Michael Grzeschik <m.grzeschik@pengutronix.de> Link: https://lore.kernel.org/r/20220421211427.3400834-4-m.grzeschik@pengutronix.de Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> (cherry picked from commit a350cfb6537f94be8a6423bc68a7a7883263c306) Bug: 242344221 Change-Id: Ieb800223fe0071c7a3650b146a1d0c6f5f7ad8a2 Signed-off-by: Avichal Rakesh <arakesh@google.com>
2023-01-10UPSTREAM: usb: gadget: uvc: improve sg exit conditionMichael Grzeschik
The exit condition to quit iterating over the sg_list, while encoding the sg entries, has to consider the case that the dma_len of the entry could be zero. This patch takes this condition to account. Signed-off-by: Michael Grzeschik <m.grzeschik@pengutronix.de> Link: https://lore.kernel.org/r/20220402232744.3622565-4-m.grzeschik@pengutronix.de Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> (cherry picked from commit aef11279888c00e1841a3533a35d279285af3a51) Bug: 242344221 Change-Id: I7eddc039ec0c54982fd6bae95af2f73f4ce04ef6 Signed-off-by: Avichal Rakesh <arakesh@google.com>
2023-01-10UPSTREAM: usb: gadget: uvc: giveback vb2 buffer on req completeMichael Grzeschik
On uvc_video_encode_isoc_sg the mapped vb2 buffer is returned to early. Only after the last usb_request worked with the buffer it is allowed to give it back to vb2. This patch fixes that. Signed-off-by: Michael Grzeschik <m.grzeschik@pengutronix.de> Link: https://lore.kernel.org/r/20220402232744.3622565-3-m.grzeschik@pengutronix.de Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> (cherry picked from commit 9b969f93bcef9b3d9e92f1810e22bbd6c344a0e5) Bug: 242344221 Change-Id: If2dbb1ec5ca6a2b5f11153cec4db76cbcc1065c3 Signed-off-by: Avichal Rakesh <arakesh@google.com>
2023-01-10UPSTREAM: usb: gadget: uvc: rework uvcg_queue_next_buffer to ↵Michael Grzeschik
uvcg_complete_buffer The function uvcg_queue_next_buffer is used different than its name suggests. The return value nextbuf is never used by any caller. This patch reworks the function to its actual purpose, by removing the unused code and renaming it. The function name uvcg_complete_buffer makes it more clear that it is actually marking the current video buffer as complete. Signed-off-by: Michael Grzeschik <m.grzeschik@pengutronix.de> Link: https://lore.kernel.org/r/20220402232744.3622565-2-m.grzeschik@pengutronix.de Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> (cherry picked from commit 61aa709ca58a0dbeeb817bfa9230c1a92979f2c6) Bug: 242344221 Change-Id: I50f0995acabff20b36721d368aa9691a713381d7 Signed-off-by: Avichal Rakesh <arakesh@google.com>
2023-01-10UPSTREAM: usb: gadget: uvc: remove pause flag useDan Vacura
The pause flag doesn't appear to serve a purpose as it is possible for the pump worker thread to not be running when new buffers are queued. Before the following change was introduced: "43cd0023872e usb: gadget: uvc_video: add worker to handle the frame pumping", the pause flag status was discarded and never returned. This masked a current issues of the userspace receiving non-zero values (considered unsuccessful) and prevents trace_v4l2_qbuf() from being called. Signed-off-by: Dan Vacura <w36195@motorola.com> Link: https://lore.kernel.org/r/20220413192402.26063-1-w36195@motorola.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> (cherry picked from commit be30e3502771ac0b5080ec61223d915354cde1cc) Bug: 242344221 Change-Id: I5c2a67641d8a0af7a11ac43ad57b76b69bba26fc Signed-off-by: Avichal Rakesh <arakesh@google.com>
2023-01-10UPSTREAM: usb: gadget: uvc: allow changing interface name via configfsDan Vacura
Add a configfs entry, "function_name", to change the iInterface field for VideoControl. This name is used on host devices for user selection, useful when multiple cameras are present. The default will remain "UVC Camera". Signed-off-by: Dan Vacura <w36195@motorola.com> Link: https://lore.kernel.org/r/20220401160447.5919-1-w36195@motorola.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> (cherry picked from commit 324e4f85070f89b58c5f9926370ad19dea907dc7) Bug: 242344221 Change-Id: I5b4666156ce2300ae902bca2ff380560d19d3f0a Signed-off-by: Avichal Rakesh <arakesh@google.com>
2023-01-10UPSTREAM: usb: gadget: uvc: implement dwPresentationTime and scrSourceClockMichael Olbrich
This patch adds the fields UVC_STREAM_PTS and UVC_STREAM_SCR to the uvc header, in case this data is available. It also enables the copy of the timestamp to the vb2_v4l2_buffer by setting V4L2_BUF_FLAG_TIMESTAMP_COPY in the queue.timestamp_flags. Signed-off-by: Michael Olbrich <m.olbrich@pengutronix.de> Signed-off-by: Michael Grzeschik <m.grzeschik@pengutronix.de> Link: https://lore.kernel.org/r/20211022093223.26493-2-m.grzeschik@pengutronix.de Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> (cherry picked from commit fd03af27c3dfbff4f6b3905c5fceedebeca70e5e) Bug: 242344221 Change-Id: Icccbf2d453f58e05984d995c572524ec3d9f577b Signed-off-by: Avichal Rakesh <arakesh@google.com>
2023-01-10UPSTREAM: usb: gadget: uvc: use on returned header len in video_encode_isoc_sgMichael Grzeschik
The function uvc_video_encode_header function returns the number of bytes used for the header. We change the video_encode_isoc_sg function to use the returned header_len rather than UVCG_REQUEST_HEADER_LEN and make the encode function more flexible. Signed-off-by: Michael Grzeschik <m.grzeschik@pengutronix.de> Link: https://lore.kernel.org/r/20211022093223.26493-1-m.grzeschik@pengutronix.de Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> (cherry picked from commit f262ce66d40cc6858d1fcb11e7b7f960448a4f38) Bug: 242344221 Change-Id: I3f3fe1deb42ca9a3c559968ef324af3e850d073f Signed-off-by: Avichal Rakesh <arakesh@google.com>
2023-01-10UPSTREAM: usb: gadget: uvc: ensure the vdev is unsetMichael Grzeschik
Since the uvc video device is created on demand, we have to ensure that the struct is always zeroed. Otherwise the previous settings might collide with the new values. Reviewed-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com> Reviewed-by: Paul Elder <paul.elder@ideasonboard.com> Signed-off-by: Michael Grzeschik <m.grzeschik@pengutronix.de> Link: https://lore.kernel.org/r/20211017215017.18392-7-m.grzeschik@pengutronix.de Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> (cherry picked from commit e4ce9ed835bcaf4cd3230a53a79645986c25ce0f) Bug: 242344221 Change-Id: Iff680809310e34b0341a902250f208be4e6cdb6e Signed-off-by: Avichal Rakesh <arakesh@google.com>
2023-01-10UPSTREAM: usb: gadget: uvc: only pump video data if necessaryMichael Grzeschik
If the streaming endpoint is not enabled, the worker has nothing to do. In the case buffers are still queued, this patch ensures that it will bail out without handling any data. Reviewed-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com> Reviewed-by: Paul Elder <paul.elder@ideasonboard.com> Signed-off-by: Michael Grzeschik <m.grzeschik@pengutronix.de> Link: https://lore.kernel.org/r/20211017215017.18392-6-m.grzeschik@pengutronix.de Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> (cherry picked from commit f9897ec0f6d34e8b2bc2f4c8ab8789351090f3d2) Bug: 242344221 Change-Id: I1d43fb5b45f209ec98ac5ca335a04c88d536075f Signed-off-by: Avichal Rakesh <arakesh@google.com>
2023-01-10UPSTREAM: usb: gadget: uvc: only schedule stream in streaming stateMichael Grzeschik
This patch ensures that the video pump thread will only be scheduled if the uvc is really in streaming state. This way the worker will not have to run on an empty queue. Reviewed-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com> Reviewed-by: Paul Elder <paul.elder@ideasonboard.com> Signed-off-by: Michael Grzeschik <m.grzeschik@pengutronix.de> Link: https://lore.kernel.org/r/20211017215017.18392-5-m.grzeschik@pengutronix.de Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> (cherry picked from commit 5fc49d8bee73648a706f5892663f5bd728ab07ea) Bug: 242344221 Change-Id: I9b38b336d69e1840de6c557ad52d5f0c5e2afc96 Signed-off-by: Avichal Rakesh <arakesh@google.com>
generated by cgit v1.2.3 (git 2.25.1) at 2024-05-20 02:20:55 +0000