0c95c078771f637924fa7ae01b0d90df285dde64 |
|
02-May-2018 |
Ray Essick <essick@google.com> |
Revert "mm-video-v4l2: Protect buffer access and increase input buffer size" This reverts commit 4f368aba8c090006c96ad496558a66d15a63b79d. Reason for revert: regressions at oc-mr1/bullhead and pi/walleye Change-Id: Ie9caad90482698913db06cdb9aeebfd869fe1a6a Bug: 64340487 Bug: 78291359 Bug: 78913375
/hardware/qcom/media/msm8996/mm-video-v4l2/vidc/vdec/src/omx_vdec_v4l2.cpp
|
4f368aba8c090006c96ad496558a66d15a63b79d |
|
13-Apr-2018 |
Ray Essick <essick@google.com> |
mm-video-v4l2: Protect buffer access and increase input buffer size Protect buffer access for below scenarios: *Increase the scope of buf_lock in free_buffer to avoid access of freed buffer for both input and output buffers. Also, add check before output buffer access. *Disallow allocate buffer mode after client has called use buffer. Allocate additional 512 bytes of memory for input buffers on top of allocation size as per hardware requirement Author: Santhosh Behara <santhoshbehara@codeaurora.org> Bug: 64340487 Test: PoC before/after Change-Id: Icc65fe43134493fefe6e420ca818f60995084871
/hardware/qcom/media/msm8996/mm-video-v4l2/vidc/vdec/src/omx_vdec_v4l2.cpp
|
c8e6a3cc21c2fa657b143f4e06734eebab7e00b8 |
|
25-Oct-2017 |
Santhosh Behara <santhoshbehara@codeaurora.org> |
mm-video-v4l2: vdec: Fix issue with dynamic buffer mode disablement Video driver always operates in dynamic buffer mode for decoder output. Disable meta buffer mode even if driver fails to move to static buffer mode. Test: make vts -j123 && vts-tradefed run commandAndExit vts \ --skip-all-system-status-check \ --skip-preconditions -m VtsHalMediaOmxV1_0Host \ -l INFO Bug: 66804380 Change-Id: I9cfce1d812ee04120a127fd852cdc229fa30da25
/hardware/qcom/media/msm8996/mm-video-v4l2/vidc/vdec/src/omx_vdec_v4l2.cpp
|
17322c984e566ce2c11f8e07dbdfe7ea9d7d474c |
|
18-Oct-2017 |
Santhosh Behara <santhoshbehara@codeaurora.org> |
mm-video-v4l2: Set input buffer requirement on allocation Set input buffer requirement on driver, as input buffers may be allocated without set param, due to which driver may have 0 buffers allocated Test: make vts -j123 && vts-tradefed run commandAndExit vts \ --skip-all-system-status-check \ --skip-preconditions -m VtsHalMediaOmxV1_0Host \ -l INFO Bug: 66804380 Change-Id: Ib3ce91bcc1adcc11e4d562d688652e77e08e8972 Author: Surajit Podder<spodder@codeaurora.org>
/hardware/qcom/media/msm8996/mm-video-v4l2/vidc/vdec/src/omx_vdec_v4l2.cpp
|
a61df3d5c4abd639448faae4e77c1b291938f53a |
|
19-Jul-2017 |
Mahesh Lanka <mlanka@codeaurora.org> |
mm-video-v4l2: vdec: change notify flush done to client Component doesn't support flush on single port, Internally it calls flush on both ports though client request on single port. Hence notify flush done to client after flush on all the ports has been completed. author : Manikanta Kanamarlapudi <kmanikan@codeaurora.org> CRs-Fixed: 2076660 Merged-In: I319f42a02361a74d7c0c51215f6bdaa7a1c2a2d6 Change-Id: I319f42a02361a74d7c0c51215f6bdaa7a1c2a2d6
/hardware/qcom/media/msm8996/mm-video-v4l2/vidc/vdec/src/omx_vdec_v4l2.cpp
|
240fc6e79b5c531171a420124ca6c78bff821a7b |
|
02-May-2017 |
Mathias Agopian <mathias@google.com> |
fix circular dependency libnativewindow <-> libui Bug: 37647680, 37648355 Test: compile, manual Change-Id: I7214dcc1e57f2a0466fc28173dd5de5d54c9a721
/hardware/qcom/media/msm8996/mm-video-v4l2/vidc/vdec/src/omx_vdec_v4l2.cpp
|
7ab8354641c04c403a5d51104866c8f43b95bf61 |
|
30-Mar-2017 |
Praveen Chavan <pchavan@codeaurora.org> |
mm-video-v4l2:Add Vendor extensions support mm-video-v4l2: vdec: Add Vendor extensions support in decoder component Add Vendor extensions in vdec and implement 'decode-order' extension Bug: 32746650 Change-Id: Ia7c3fb3b8641d24dbaa3489cb087e15f0d980fde CRs-Fixed: 2026950
/hardware/qcom/media/msm8996/mm-video-v4l2/vidc/vdec/src/omx_vdec_v4l2.cpp
|
7c03ed4f9e7ef832adfc34771e27a26aa2da9b2e |
|
19-Oct-2016 |
Praveen Chavan <pchavan@codeaurora.org> |
mm-video-v4l2: vdec: Disallow input usebuffer for secure case am: 7b99376ecf Change-Id: I8104f710d235307138c01dda4c19ad006aa5788b
|
7b99376ecf7a6746e3bcb146975c00fc9ea560ab |
|
17-Sep-2016 |
Praveen Chavan <pchavan@codeaurora.org> |
mm-video-v4l2: vdec: Disallow input usebuffer for secure case In secure mode, input buffer _must_ be allocated by the component to allocate a secure buffer. Client-supplied memory via usebuffer does not qualify as secure-memory and must be rejected. This also avoids accidental heap-overflow while copying bitstream from user-memory to a smaller-sized secure-payload (usually the buffer-header itself) Bug : 30148882 Fixes : Heap Overflow/LPE in MediaServer (libOmxVdec problem #11) CRs-Fixed: 1071731 Change-Id: Ibbde2d6a9c1f30e8482a533cadb13e44d8dcb2c0
/hardware/qcom/media/msm8996/mm-video-v4l2/vidc/vdec/src/omx_vdec_v4l2.cpp
|
22daac47544d119c860181a8bc0de92f21697a4d |
|
14-Oct-2016 |
Ray Essick <essick@google.com> |
mm-video-v4l2: vdec: Disallow changing buffer modes/counts on allocated ports am: e6587c9dca Change-Id: Ibbb41174e7285a72a7340c372fb6755aca2dc670
|
8784ace2ba59bd2729f2cde9ff0df8d0d8d5a816 |
|
14-Oct-2016 |
Praveen Chavan <pchavan@codeaurora.org> |
mm-video-v4l2: vdec: Disallow changing buffer modes/counts on allocated ports am: ee06e61ff4 Change-Id: I226d535a430d2790338224598beba99a3936f4a2
|
e6587c9dca65ca18161b74dfe87ef64fc9c22a1e |
|
13-Oct-2016 |
Ray Essick <essick@google.com> |
mm-video-v4l2: vdec: Disallow changing buffer modes/counts on allocated ports This is the n-mr1 specific portion of this change; it strips pieces already provided by an earlier patch. Changing Count, size, usage-mode (metadata/bytebuffer/native-handle) or allocation-mode (allocateBuffer/UseBuffer) of buffers should only be allowed when the port hasn't been allocated yet. Since buffer-modes determine the payload-size in case of meta-buffer-mode, and also determine the memory-base to derive buffer indices from buffer- headers, letting the client change count/size/mode on a pre-allocated port will cause inconsistencies in the size of memory allocated for headers and lead to index overflows. Fix the range checks for the derived buffer-indices to avoid out-of-bounds writes. Also, ensure buffer-mode settings (metadata-mode, native-handle-mode) are intended for the right ports. Bug: 29617572 : Heap Overflow/LPE in MediaServer (libOmxVdec problem #8) Bug: 29982686 : Memory Write/LPE in MediaServer (libOmxVdec problem #10) Change-Id: I25dd791e5d9593bba14a8ea50edb3908ba9055f2
/hardware/qcom/media/msm8996/mm-video-v4l2/vidc/vdec/src/omx_vdec_v4l2.cpp
|
ee06e61ff49357884de5c6714828c263966895ee |
|
17-Aug-2016 |
Praveen Chavan <pchavan@codeaurora.org> |
mm-video-v4l2: vdec: Disallow changing buffer modes/counts on allocated ports Changing Count, size, usage-mode (metadata/bytebuffer/native-handle) or allocation-mode (allocateBuffer/UseBuffer) of buffers should only be allowed when the port hasn't been allocated yet. Since buffer-modes determine the payload-size in case of meta-buffer-mode, and also determine the memory-base to derive buffer indices from buffer- headers, letting the client change count/size/mode on a pre-allocated port will cause inconsistencies in the size of memory allocated for headers and lead to index overflows. Fix the range checks for the derived buffer-indices to avoid out-of-bounds writes. Also, ensure buffer-mode settings (metadata-mode, native-handle-mode) are intended for the right ports. Bug: 29617572 : Heap Overflow/LPE in MediaServer (libOmxVdec problem #8) Bug: 29982686 : Memory Write/LPE in MediaServer (libOmxVdec problem #10) Change-Id: I619636a48779580c247bffb3752c3e4025b46542
/hardware/qcom/media/msm8996/mm-video-v4l2/vidc/vdec/src/omx_vdec_v4l2.cpp
|
bfdb1adb7ea840c4c0a9e0c9ad8ebc0ecd43919a |
|
09-Aug-2016 |
Hangyu Kuang <hkuang@google.com> |
Merge "mm-video-v4l2: vidc: Fix read/write colorspace from/to gralloc-handle" into nyc-mr1-dev
|
939bc4145117bc6b87d6cef5c0219c63efff113b |
|
29-Jul-2016 |
Praveen Chavan <pchavan@codeaurora.org> |
mm-video-v4l2: vidc: Fix read/write colorspace from/to gralloc-handle Encoder: Read the colorspace from metadata in gralloc-handle and set the appropriate colorspace to the driver. Recommend color-aspects based on the colorspace of destination-YUV that C2D/Venus convert in case input is RGBA8888 Leave the unspecified aspects with client's-defaults, rather than setting them to enuemarated "unspecified" values. Decoder: Default the colorspace as indicated by client in case there is no color info in bitstream. Since VP8 encoder does not support encoding color-info yet, default everything to 601-LR for now. Bug: 29550317 Change-Id: I603cd592647b3f9b81c4da714a72aae871ced25a
/hardware/qcom/media/msm8996/mm-video-v4l2/vidc/vdec/src/omx_vdec_v4l2.cpp
|
187779f25a339c00d37ff09a478113f0b2047120 |
|
29-Jul-2016 |
Praveen Chavan <pchavan@codeaurora.org> |
mm-video-v4l2: vdec: Use client defaults if bitstream aspects are unspecified Return client-supplied-default values for color aspects if the bitstream has unspecified values rather than enumerating "Unspecified". Also, default to 601 (instead of 601-FR) in case colorspace is unknown. Bug: 29189938 Change-Id: Icbfd95a81152275a16f7f00b47973e76e7853569
/hardware/qcom/media/msm8996/mm-video-v4l2/vidc/vdec/src/omx_vdec_v4l2.cpp
|
c8dc4a1e8fb2cc3509afecfbb64c2500174e0248 |
|
20-Jul-2016 |
Praveen Chavan <pchavan@codeaurora.org> |
mm-video-v4l2: vidc: Color primaries fixes - Update internal colorspace when color in VUI is different notify the client with a reconfig event - Update client's colorspace in getconfig if internal color info has been updated. - Remove metadata setting for ITU 601-625. - Remove the VP8 spec mention. Author: Praneeth Paladugu <ppaladug@codeaurora.org> Bug: 29189938 Change-Id: I912cd197ef9f2905d94eacf91914150232862aa6
/hardware/qcom/media/msm8996/mm-video-v4l2/vidc/vdec/src/omx_vdec_v4l2.cpp
|
ebe3411770bc467e978eacd66ebc1495a16d4a56 |
|
08-Jul-2016 |
Praveen Chavan <pchavan@codeaurora.org> |
mm-video-v4l2: vidc: Add support for color aspects Add support for color aspects setting from clients and embed that information in bit-stream. When client sets different color format than in bit-stream, update them with correct one. Author: Praneeth Paladugu <ppaladug@codeaurora.org> Bug: 29189938 Bug: 29620306 Change-Id: I31bf3a81ef0690dc3565875d2fba4607abf46536
/hardware/qcom/media/msm8996/mm-video-v4l2/vidc/vdec/src/omx_vdec_v4l2.cpp
|
da491142bd05b7bbb5704579b04f1b968b47a9b6 |
|
08-Jul-2016 |
Praveen Chavan <pchavan@codeaurora.org> |
mm-video-v4l2: vidc: Add support for color space Convey the correct color space information to Venus from Camera. Also enable corresponding extradata to process the color space info from bit stream and inform display through metadata. Bug: 29189938 Bug: 29620306 Author: Praneeth Paladugu <ppaladug@codeaurora.org> Change-Id: Ibc4bca8c1cd5a42894971628686814876cf91f7b
/hardware/qcom/media/msm8996/mm-video-v4l2/vidc/vdec/src/omx_vdec_v4l2.cpp
|
bb6e2c659c093ccb6266b679b07513cbeeb9fb24 |
|
25-Jun-2016 |
Steve Pfetsch <spfetsch@google.com> |
media: Update to AU 205 drop Update to AU_LINUX_ANDROID_LA.HB.1.3.9.06.00.01.213.205 media_hal: 1df75f0 Merge "mm-video-v4l2: venc: Avoid processing ETBs/FTBs in invalid states" dc623d6 mm-video-v4l2: vdec: Avoid processing ETBs/FTBs in invalid states, d57cbc1 mm-video-v4l2: venc: Avoid processing ETBs/FTBs in invalid states 2b33b5a Merge "mm-video-v4l2: venc: add support for encoding temporal layers" 815b4be mm-video-v4l2: venc: add support for encoding temporal layers d450628 mm-video-v4l2: vidc: venc: Fix issues with Hier P a7ead0c mm-video-v4l2: vidc: Enumerate supported HEVC decoder profiles 9e096e8 mm-video-v4l2: vidc: HEVC Main10 profile support a42a61d mm-video-v4l2: vdec: Add support for prefetching secure memory Change-Id: I16f46e6d896e296cb2cf3eab6e6683c93f9daa8c
/hardware/qcom/media/msm8996/mm-video-v4l2/vidc/vdec/src/omx_vdec_v4l2.cpp
|
968020d5b6a1b3b6356f70e079952dbf054a888a |
|
16-Jun-2016 |
Vineeta Srivastava <vsrivastava@google.com> |
Revert "media: Update to AU 199 drop" This reverts commit 077cdbe545ad0c82c45087d9e8a0c8cfa9cdd954.
/hardware/qcom/media/msm8996/mm-video-v4l2/vidc/vdec/src/omx_vdec_v4l2.cpp
|
077cdbe545ad0c82c45087d9e8a0c8cfa9cdd954 |
|
14-Jun-2016 |
Steve Pfetsch <spfetsch@google.com> |
media: Update to AU 199 drop Update to AU_LINUX_ANDROID_LA.HB.1.3.9.06.00.01.213.199 media_hal: 1df75f0 Merge "mm-video-v4l2: venc: Avoid processing ETBs/FTBs in invalid states" dc623d6 mm-video-v4l2: vdec: Avoid processing ETBs/FTBs in invalid states, d57cbc1 mm-video-v4l2: venc: Avoid processing ETBs/FTBs in invalid states 2b33b5a Merge "mm-video-v4l2: venc: add support for encoding temporal layers" 815b4be mm-video-v4l2: venc: add support for encoding temporal layers d450628 mm-video-v4l2: vidc: venc: Fix issues with Hier P a7ead0c mm-video-v4l2: vidc: Enumerate supported HEVC decoder profiles 9e096e8 mm-video-v4l2: vidc: HEVC Main10 profile support a42a61d mm-video-v4l2: vdec: Add support for prefetching secure memory Change-Id: I96796ba5bb69761c7ce375a5d247e619e752fcfe
/hardware/qcom/media/msm8996/mm-video-v4l2/vidc/vdec/src/omx_vdec_v4l2.cpp
|
c95df19b09ae7a772054e7449692acdedc233fb6 |
|
24-May-2016 |
Praveen Chavan <pchavan@codeaurora.org> |
Merge changes I898b4203,Iaac2e383 into nyc-dev am: a8fcf27d15 * commit 'a8fcf27d158120163227dfb16d758deed294bbd2': mm-video-v4l2: venc: Avoid processing ETBs/FTBs in invalid states mm-video-v4l2: vdec: Avoid processing ETBs/FTBs in invalid states Change-Id: I506375c4afeab3ddd1a67920a0fc4de0a2c33883
|
4173299cd1f7b2cc9a9eefb8e954b6abae9ac642 |
|
19-Apr-2016 |
Praveen Chavan <pchavan@codeaurora.org> |
mm-video-v4l2: vdec: allocate secure buffer as native_handle Rather than stashing a file-descriptor directly in pBuffer, wrap the fd in a native_handle to enable client to pass fds safely to crypto process. Bug: 28522683 Change-Id: Ica3beac395a0e63c1e0aeec061ec88bb9055a31f
/hardware/qcom/media/msm8996/mm-video-v4l2/vidc/vdec/src/omx_vdec_v4l2.cpp
|
97e3ddfad60bf0417cbbc93dda97d2b887589fc0 |
|
25-Apr-2016 |
Praveen Chavan <pchavan@codeaurora.org> |
mm-video-v4l2: vdec: Avoid processing ETBs/FTBs in invalid states (per the spec) ETB/FTB should not be handled in states other than Executing, Paused and Idle. This avoids accessing invalid buffers. Also add a lock to protect the private-buffers from being deleted while accessing from another thread. Bug: 27890802 Security Vulnerability - Heap Use-After-Free and Possible LPE in MediaServer (libOmxVdec problem #6) Change-Id: Iaac2e383cd53cf9cf8042c9ed93ddc76dba3907e
/hardware/qcom/media/msm8996/mm-video-v4l2/vidc/vdec/src/omx_vdec_v4l2.cpp
|
c9770704a9bb7c26205cf0e5bca05d4397aab1c3 |
|
17-Mar-2016 |
Praveen Chavan <pchavan@codeaurora.org> |
mm-video-v4l2: vidc: fix matching of extension strings Using strncmp with the strlen of source string can result in false positives when it is a substring of the passed string. Eg: strncmp("OMX.extn.x", "OMX.extn.xyz", strlen(OMX.extn.x)) will result in a match. Use strcmp instead. Bug: 27344524 Change-Id: I68839f2bea8b97a31f43885538e9dce51aa8c1b4
/hardware/qcom/media/msm8996/mm-video-v4l2/vidc/vdec/src/omx_vdec_v4l2.cpp
|
ff8f9f29b46df8de6dba9bda31eab4beb67146b8 |
|
23-Mar-2016 |
Praveen Chavan <pchavan@codeaurora.org> |
mm-video-v4l2: vdec: deprecate unused config OMX_IndexVendorVideoExtraData This config (used to set header offline) is no longer used. Remove handling this config since it uses non-process-safe ways to pass memory pointers. Fixes: Security Vulnerability - Segfault in MediaServer (libOmxVdec problem #2) Bug: 27475409 Change-Id: I7a535a3da485cbe83cf4605a05f9faf70dcca42f
/hardware/qcom/media/msm8996/mm-video-v4l2/vidc/vdec/src/omx_vdec_v4l2.cpp
|
fd65fa891104fd7cedb06a8ba0849934dae63640 |
|
23-Mar-2016 |
Praveen Chavan <pchavan@codeaurora.org> |
mm-video-v4l2: vdec: add safety checks for freeing buffers Allow only up to 64 buffers on input/output port (since the allocation bitmap is only 64-wide). Do not allow changing the actual buffer count while still holding allocation (Client can technically negotiate buffer count on a free/disabled port) Add safety checks to free only as many buffers were allocated. Fixes: Security Vulnerability - Heap Overflow and Possible Local Privilege Escalation in MediaServer (libOmxVdec problem #3) Bug: 27532282 27661749 Change-Id: I06dd680d43feaef3efdc87311e8a6703e234b523
/hardware/qcom/media/msm8996/mm-video-v4l2/vidc/vdec/src/omx_vdec_v4l2.cpp
|
16ee85d1d456a4b694fd32baa5f52341e638b5d8 |
|
30-Mar-2016 |
Praveen Chavan <pchavan@codeaurora.org> |
mm-video-v4l2: vidc: validate omx param/config data Check the sanity of config/param strcuture objects passed to get/set _ config()/parameter() methods. Bug: 27533317 Security Vulnerability in MediaServer omx_vdec::get_config() Can lead to arbitrary write Change-Id: I6c3243afe12055ab94f1a1ecf758c10e88231809
/hardware/qcom/media/msm8996/mm-video-v4l2/vidc/vdec/src/omx_vdec_v4l2.cpp
|
ce256dab580d6601e34cf59642f642bd496952ae |
|
08-Mar-2016 |
Patrick Tjin <pattjin@google.com> |
msm8996: Fix clang build errors Bug: 27420204 Change-Id: I1d0ec866cf244b734897fd39b07551a556c7a0a7 Signed-off-by: Patrick Tjin <pattjin@google.com>
/hardware/qcom/media/msm8996/mm-video-v4l2/vidc/vdec/src/omx_vdec_v4l2.cpp
|
e4010605f233a213cf0d972397bb33c34c364227 |
|
07-Mar-2016 |
Patrick Tjin <pattjin@google.com> |
Initial import of msm8996 media HAL 1) Move existing HAL to msm8974/ 2) Import msm8996 HAL from LA.HB.1.1.2_rb1.12 3) Modify Makefiles to remove kernel dependencies and fix for new directory structure 4) Modify top level makefile for new directory structure Top commits from LA.HB.1.1.2_rb1.12 included in this commit: db7937a mm-video: vidc: memset struct v4l2_format prior to S_FMT d77ab10 Merge "mm-video-v4l2: vidc: Do not queue output buffer if flush is in progress" 8895985 mm-video-v4l2: vidc: vdec: Add property to disable UBWC for OPB 675af75 Merge "mm-video: vidc: Communicate the right colorformat to the driver" dd79df2 Merge "mm-video: vidc: Reliably stop the message thread" c3e8618 Merge "mm-video-v4l2: vidc: venc: Fix B-Frame handling" 755ec08 mm-video-v4l2: vidc: Do not queue output buffer if flush is in progress 3ac8410 mm-video: vidc: Reliably stop the message thread b73dcba Merge "mm-video-v4l2: vidc: venc: Bug fixes for VZIP" 8358109 Merge "mm-video-v4l2: vdec: fix picture type decode mode return status" BUG=27420204 Signed-off-by: Patrick Tjin <pattjin@google.com> Change-Id: I71aa0190e48b332268334677894b0ad7c606296b
/hardware/qcom/media/msm8996/mm-video-v4l2/vidc/vdec/src/omx_vdec_v4l2.cpp
|