Currently, the uvc gadget driver allocates all uvc_requests as one array
and deallocates them all when the video stream stops. This includes
de-allocating all the usb_requests associated with those uvc_requests.
This can lead to use-after-free issues if any of those de-allocated
usb_requests were still owned by the usb controller.
This is patch 2 of 2 in fixing the use-after-free issue. It adds a new
flag to uvc_video to track when frames and requests should be flowing.
When disabling the video stream, the flag is tripped and, instead
of de-allocating all uvc_requests and usb_requests, the gadget
driver only de-allocates those usb_requests that are currently
owned by it (as present in req_free). Other usb_requests are left
untouched until their completion handler is called which takes care
of freeing the usb_request and its corresponding uvc_request.
Now that uvc_video does not depends on uvc->state, this patch removes
unnecessary upates to uvc->state that were made to accommodate uvc_video
logic. This should ensure that uvc gadget driver never accidentally
de-allocates a usb_request that it doesn't own.
Change-Id: Ie1cc134c191e087bcca114832ad99f5d3119e682
Link: https://lore.kernel.org/7cd81649-2795-45b6-8c10-b7df1055020d@google.com
Reviewed-by: Daniel Scally <dan.scally@ideasonboard.com>
Reviewed-by: Michael Grzeschik <m.grzeschik@pengutronix.de>
Suggested-by: Michael Grzeschik <m.grzeschik@pengutronix.de>
Tested-by: Michael Grzeschik <m.grzeschik@pengutronix.de>
Signed-off-by: Avichal Rakesh <arakesh@google.com>
Link: https://lore.kernel.org/r/20231109004104.3467968-4-arakesh@google.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: William Wu <william.wu@rock-chips.com>
(cherry picked from commit da324ffce34c521b239f319d4051260444a3eb4a)
Currently, the uvc gadget driver allocates all uvc_requests as one array
and deallocates them all when the video stream stops. This includes
de-allocating all the usb_requests associated with those uvc_requests.
This can lead to use-after-free issues if any of those de-allocated
usb_requests were still owned by the usb controller.
This patch is 1 of 2 patches addressing the use-after-free issue.
Instead of bulk allocating all uvc_requests as an array, this patch
allocates uvc_requests one at a time, which should allows for similar
granularity when deallocating the uvc_requests. This patch has no
functional changes other than allocating each uvc_request separately,
and similarly freeing each of them separately.
Change-Id: Ifc4c21cb46d5c947b6be03c5423ddfcbd5d9f23f
Link: https://lore.kernel.org/7cd81649-2795-45b6-8c10-b7df1055020d@google.com
Reviewed-by: Daniel Scally <dan.scally@ideasonboard.com>
Reviewed-by: Michael Grzeschik <m.grzeschik@pengutronix.de>
Suggested-by: Michael Grzeschik <m.grzeschik@pengutronix.de>
Tested-by: Michael Grzeschik <m.grzeschik@pengutronix.de>
Signed-off-by: Avichal Rakesh <arakesh@google.com>
Link: https://lore.kernel.org/r/20231109004104.3467968-2-arakesh@google.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: William Wu <william.wu@rock-chips.com>
(cherry picked from commit aeb686a98a9e9743c4c0338957e59643a2708146)
Take f_midi_bind() for example, when composite layer call it, it will
allocate hs descriptor by calling gadget_is_dualspeed() API to check
gadget max support speed capability, but most other gadget function didn't
do like this.
To follow other function drivers, it is safe to remove the check which
mean support all possible link speed by default in function driver.
Similar change apply to midi2 and uvc.
Also in midi and midi2, as there is no descriptor difference between
super speed and super speed plus, follow other gadget function drivers,
do not allocate descriptor for super speed plus, composite layer will
handle it properly.
Change-Id: Iabf23f6063767ad68e29dd13c05e2cceaf8d461e
Signed-off-by: Linyu Yuan <quic_linyyuan@quicinc.com>
Link: https://lore.kernel.org/r/20230803091053.9714-5-quic_linyyuan@quicinc.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: William Wu <william.wu@rock-chips.com>
(cherry picked from commit 46decc82ff)
For the userspace it is needed to distinguish between requests for the
control or streaming interface. The userspace would have to parse the
configfs to know which interface index it has to compare the ctrl
requests against. Since the interface numbers are not fixed, e.g. for
composite gadgets, the interface offset depends on the setup.
The kernel has this information when handing over the ctrl request to
the userspace. This patch removes the offset from the interface numbers
and expose the default interface defines in the uapi g_uvc.h.
Change-Id: Idb6845c962d3da6d2a96c5d5e0083b39e5bba8af
Signed-off-by: Michael Grzeschik <m.grzeschik@pengutronix.de>
Link: https://lore.kernel.org/r/20221011075348.1786897-1-m.grzeschik@pengutronix.de
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: William Wu <william.wu@rock-chips.com>
(cherry picked from commit d182bf156c)
In the specification documents for the Uncompressed and MJPEG USB
Video Payloads, the field name is bmInterlaceFlags - it has been
misnamed within the kernel.
Although renaming the field does break the kernel's interface to
userspace it should be low-risk in this instance. The field is read
only and hardcoded to 0, so there was never any value in anyone
reading it. A search of the uvc-gadget application and all the
forks that I could find for it did not reveal any users either.
Change-Id: I9d9903cebd796443387a40664a753498a10d6e6a
Fixes: cdda479f15 ("USB gadget: video class function driver")
Reviewed-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
Reviewed-by: Kieran Bingham <kieran.bingham@ideasonboard.com>
Signed-off-by: Daniel Scally <dan.scally@ideasonboard.com>
Link: https://lore.kernel.org/r/20221206161203.1562827-1-dan.scally@ideasonboard.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: William Wu <william.wu@rock-chips.com>
(cherry picked from commit 81c25247a2)
do_one_request cannot call crypto_finalize_akcipher_request,
otherwise it will result in a null pointer reference.
The asym algorithm needs to be changed to synchronous mode.
Signed-off-by: Lin Jinhan <troy.lin@rock-chips.com>
Change-Id: I6615f113691a334b148da0364b7a1e3764d27739
The top cru source clock of aclk rkvdec should enable when power on/off pd.
Signed-off-by: Finley Xiao <finley.xiao@rock-chips.com>
Change-Id: Ib6eea60ca59ad8a5fb79713781476f710bb51d9c
ATF will use npor reset, so we need a os_reg that can't be reset.
Change-Id: Ie13953a915524b203808909c090eb4d5d88381fc
Signed-off-by: Xuhui Lin <xuhui.lin@rock-chips.com>
According to the hardware test, the current 100M amplitude is too high,
and it is recommended to modify it to 0xc.
Change-Id: I6a50109d6ff171d4a3f1605b43bc6ca0ef21a750
Signed-off-by: David Wu <david.wu@rock-chips.com>
It's better to use a 50M clock for fephy, and the disable enable switch
ensures better timing.
Change-Id: I965648ce08a6e2c7c6137b18e9390cc589f48afe
Signed-off-by: David Wu <david.wu@rock-chips.com>
The layer sel configuration is exclusive for RV1126B, only one of
them can be set to 0b01 for either layer2_sel or layer1_sel when two
layers are displayed on the same time.
1. For RV1126B:
dsp_layer2_sel, that is top layer:
- 2'b00 WIN0 is top layer
- 2'b01 WIN2 is top layer
dsp_layer1_sel, that is bottom layer:
- 2'b00 WIN0 is bottom layer
- 2'b01 WIN2 is bottom layer
For {dsp_layer2_sel, dsp_layer1_sel}:
- 4'b0001 : WIN0 on the top, WIN2 on the bottom
- 4'b0100 : WIN2 on the top, WIN0 on the bottom
2. For other version:
- 2'b00 select WIN0
- 2'b10 select WIN2
Change-Id: I4ab4928868a599e9b398e83aca88074c6e5eaabb
Signed-off-by: Chaoyi Chen <chaoyi.chen@rock-chips.com>
1. Rockchip U-Boot will use kernel dtb by default.
2. The legacy U-Boot GPIO driver need regulator-boot-on in dtb to set
correct SDMMC0_PWREN value.
3. regulator-boot-on will not affect SDMMC0 function in kernel.
Change-Id: I7160a2c1f29e35e2fcf29389dca60f507dea8cb4
Signed-off-by: Xuhui Lin <xuhui.lin@rock-chips.com>
Signed-off-by: Yifeng Zhao <yifeng.zhao@rock-chips.com>
sg_phys(sgl) == SZ_4G must be regarded as an illegal value
because the address space exceeds 32 bits.
Change-Id: I50dca3970654ea8ce4d60ea20ced7d5dcc843724
Signed-off-by: Lin Jinhan <troy.lin@rock-chips.com>
