Use after free can happen in below scenario.
[1] In msm_vidc_open, When instance count reaches max count or when
open failed it waits for core lock before removing instance from
instance list.
[2] During this time backward thread can get invoked to handle firmware
response for cmds, It increments reference count and gets instance.
[3] If forward thread resumes after this, and frees intance,
backward thread will end up using freed instance.
[4] To address this, calling kref_put(&inst->kref) and freeing instance
immediately if ref count is zero, if recount is not zero, backward
thread frees instance memory in put_inst_helper.
Change-Id: I58c81d4d9fda1523d0fa29ebdb33455db839d46f
Signed-off-by: Vasantha Balla <quic_c_vballa@quicinc.com>
(cherry picked from commit ccddad0c4992ab7b4e3651e2c5c8df3e79bb7c43)
(cherry picked from commit cc9f3cc50311796626b2c40b049daeef0a5719ea)
Dynamic properties such as IDR insertion is not supported
when hybrid layers are enabled . Hybrid layers required only
HFR usecase. Hence enabling hybrid only when VBR+noLTR+HFR
use cases.
Change-Id: I36e4ecb9c98135790cff0487a237a1a4fd33d241
- Bits: 0-27 are used to specify the level
information and bits 28-31 are reserved for
non-level information. For HEVC, these 4 bits(MSB)
are used for communicating the tier info.
- CTS tc will set the tier first, the level
next and the same is set to firmware. In
doing so, the level will override the tier value
which is set earlier and the same is communicated to
the firmware resulting in level info mismatch.
- Fix here is to extract the 4 MSB bits containing the
tier info and add it to the level value, then communicate
it to the firmware.
Change-Id: I530f0a0a92417f2076d5a1f93f724b6514ae9309
Signed-off-by: Madhukumar S J <quic_msj@quicinc.com>
(cherry picked from commit 51311d2374)
- Bits: 0-27 are used to specify the level
information and bits 28-31 are reserved for
non-level information. For HEVC, these 4 bits(MSB)
are used for communicating the tier info.
- CTS tc will set the tier first, the level
next and the same is set to firmware. In
doing so, the level will override the tier value
which is set earlier and the same is communicated to
the firmware resulting in level info mismatch.
- Fix here is to extract the 4 MSB bits containing the
tier info and add it to the level value, then communicate
it to the firmware.
Change-Id: I530f0a0a92417f2076d5a1f93f724b6514ae9309
Signed-off-by: Madhukumar S J <quic_msj@quicinc.com>
If voting is not added for eos and flush command processing,
Firmware is processing only high priority session commands
which causes non real time session to wait for completion of
realtime session for its eos processing. So adding votes for eos
and flush commands.
Change-Id: I9de8c1d0dc79e93d991d34d2d687e2fa1910531b
Signed-off-by: Vasantha Balla <quic_vballa@quicinc.com>
If voting is not added for eos and flush command processing,
Firmware is processing only high priority session commands
which causes non real time session to wait for completion of
realtime session for its eos processing. So adding votes for eos
and flush commands.
Change-Id: I9de8c1d0dc79e93d991d34d2d687e2fa1910531b
Signed-off-by: Vasantha Balla <quic_vballa@quicinc.com>
Add crop-left/right/width/height into enum msm_vidc_cb_event_types
to support reporting crop infomation from driver side. Video framework
can get crop info during output port reconfiguration.
Change-Id: I59a77ad698b586c197de735ee65ec049e42cbc7f
Signed-off-by: Miaomiao Chen <quic_miaochen@quicinc.com>
Cancel batch work when core is suspended due to
pm suspend.
Change-Id: I5c6e4f0eb0883a9c3cd2711f65e0d74a6cced310
Signed-off-by: Priyanka Gujjula <pgujjula@codeaurora.org>
Added PING command. Send the command to video firmware
when any awaited response is not received within the
stipulated time.
PING would help firmware to check if some commands or
messages are not processed in queue. At the same time,
the interrupts for handling PING command would clear
up the queues processing, if any.
Change-Id: Iee981dde3b3a1a21b74639703f86881fd5779027
Signed-off-by: Vikash Garodia <vgarodia@codeaurora.org>
Signed-off-by: Govindaraj Rajagopal <grajagop@codeaurora.org>
Don't set AUDO_FRAME_RATE for non camera-recorder usercase.
Change-Id: I1e072538d2a7f431653c7bfd933b5d1c0b83f906
Signed-off-by: Yang Xiaoqin <quic_xiaoqiny@codeaurora.org>
Adding support to enable dynamic maximum no of instances for
video sessions based on the different platforms.
Change-Id: I16b92cc8cc740809042947590dcd73dcf4801f96
Signed-off-by: Sayantan Majumder <smajumde@codeaurora.org>
Added new compatibility string to enable video H/W acceleration
for qcm6490
Change-Id: I51fcc010cc85e05f26ac5b1e8d3ba4ad5fa8b052
Signed-off-by: Sayantan Majumder <smajumde@codeaurora.org>
Adding support to enable dynamic maximum no of instances for
video sessions based on the different platforms.
Change-Id: I16b92cc8cc740809042947590dcd73dcf4801f96
Signed-off-by: Sayantan Majumder <smajumde@codeaurora.org>
Added new compatibility string to enable video H/W acceleration
for qcm6490
Change-Id: I51fcc010cc85e05f26ac5b1e8d3ba4ad5fa8b052
Signed-off-by: Sayantan Majumder <smajumde@codeaurora.org>
Add support for encoder complexity handling.
Enable lowpower mode if the complexity is 0.
Change-Id: Ife290b377c844e5b1d3be93b2509c787f8e05c59
Signed-off-by: Santhosh Behara <santhoshbehara@codeaurora.org>
