Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

RPi pipeline handler expects V4L2_PIX_FMT_SRGGB10P #1

Closed
kbingham opened this issue Sep 16, 2019 · 6 comments
Closed

RPi pipeline handler expects V4L2_PIX_FMT_SRGGB10P #1

kbingham opened this issue Sep 16, 2019 · 6 comments

Comments

@kbingham
Copy link
Owner

Creating an issue here to prevent thread pollution over at
raspberrypi/linux#3220

From @6by9

Is there some magic required to run qcam?
I've compiled your kbingham/rpi branch, it runs, select imx219 0-0010, hit OK, and it crashes

qt5ct: using qt5ct plugin
[0:09:55.710525042] INFO Camera camera_manager.cpp:94 libcamera v0.0.0+708-893f2dde
Using camera imx219 0-0010
[0:10:12.339871854] INFO Camera camera.cpp:666 configuring streams: (0) 320x240-0x56595559
[0:10:12.340219534]  ERR RPI raspberrypi.cpp:188 Failed to set format on Video device: 1920x1080-0x41414270
Failed to configure camera
qt.qpa.xcb: QXcbConnection: XCB error: 3 (BadWindow), sequence: 705, resource id: 20973393, major code: 40 (TranslateCoords), minor code: 0

/dev/video0 is set to 1920x1080 raw10 BGGR

Gstreamer seems not to be hitting issues when doing things like video transcode (filesrc ! matroskademux ! h264parse ! v4l2h264dec ! v4l2h264enc). That may be because it intercepts ctrl-c and does some cleanup.
v4l2convert doesn't support raw10, and throws a minor grump with raw8 from ov5647. I'm putting that down to a Gstreamer quirk rather than anything else.

@kbingham
Copy link
Owner Author

From : @andrey-konovalov

Is there some magic required to run qcam?
I've compiled your kbingham/rpi branch, it runs, select imx219 0-0010, hit OK, and it crashes

[0:10:12.340219534]  ERR RPI raspberrypi.cpp:188 Failed to set format on Video device: 1920x1080-0x41414270

...

/dev/video0 is set to 1920x1080 raw10 BGGR

The 0x41414270 (in the error message above) is indeed V4L2_PIX_FMT_SBGGR10P (what your /dev/video0 is using). But the pipeline handler (raspberrypi.cpp) tries to set V4L2_PIX_FMT_SRGGB10P (the hardcoded value), and returns the error ("Failed to set format on Video device...") if the resulting format is different from RGGB.

The quick hack I've used was to change the V4L2_PIX_FMT_SRGGB10P to V4L2_PIX_FMT_SBGGR10P in src/libcamera/pipeline/raspberrypi.cpp. (The proper fix would be to make the pipeline handler more flexible WRT sensor pixel format)

@6by9
Copy link
Contributor

6by9 commented Sep 16, 2019

Thanks @andrey-konovalov - that was exactly it.

IIRC It's not handled yet in the imx219 driver but HFLIP and VFLIP normally change the Bayer order on this sensor as they reverse the direction the array is readout. Unicam does the "wrong" thing at the moment by caching the values the sensor driver enumerates at boot, but any hardcoding of the Bayer format sounds like bad news. (I know it's still early days for this pipeline).

@kbingham
Copy link
Owner Author

Aha - ok - that explains the discrepency - I've just checked my kernel tree, and I seem to be carrying a patch from @6by9 "Fixup imx219: Correct flips/mirror to native orientation. Adds test pattern controls" which now I look into it - does indeed change the pixel formats:

  • fmt->format.code = MEDIA_BUS_FMT_SBGGR10_1X10;
  • fmt->format.code = MEDIA_BUS_FMT_SRGGB10_1X10;

sorry for the confusion - I must have picked that up during rebases on top of earlier branches of the imx219. But it does indeed show that I need to make the pipeline more dynamic already :-)

@kbingham
Copy link
Owner Author

7aca293 should resolve this issue. I've rebased and updated my kbingham/rpi branch to include this fix.

@6by9
Copy link
Contributor

6by9 commented Sep 16, 2019

Hmm, test pattern control should have been merged. It's quite possible that I've messed up in my rebasing :-( Guess I'd better check

kbingham added a commit that referenced this issue Sep 24, 2019
When setting the format on the ViewFinder, a new image_ is allocated.
Any change in format deletes the existing allocation, but it is not
cleaned up on shutdown:

Direct leak of 32 byte(s) in 1 object(s) allocated from:
    #0 0x7f0bf8a7e17f in operator new(unsigned long) (/usr/lib/x86_64-linux-gnu/libasan.so.5+0x10e17f)
    #1 0x564c7205f7b0 in ViewFinder::setFormat(unsigned int, unsigned int, unsigned int) ../src/qcam/viewfinder.cpp:43
    #2 0x564c71fec467 in MainWindow::startCapture() ../src/qcam/main_window.cpp:152
    #3 0x564c71fe6c1a in MainWindow::MainWindow(libcamera::CameraManager*, OptionsParser::Options const&) ../src/qcam/main_window.cpp:40
    #4 0x564c71fdf133 in main ../src/qcam/main.cpp:76
    #5 0x7f0bf5944b6a in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x26b6a)

Provide a ViewFinder destructor, and delete the allocation as
appropriate.

Fixes: 97e8b3a ("qcam: Add Qt-based GUI application")
Reviewed-by: Jacopo Mondi <[email protected]>
Reviewed-by: Laurent Pinchart <[email protected]>
Signed-off-by: Kieran Bingham <[email protected]>
@kbingham
Copy link
Owner Author

The kbingham/rpi branch now resolves this issue through commit titled
"libcamera: pipeline: raspberrypi: Remove hardcoded sensor format"

(I'll not bother with a sha1 reference as my branch isn't stable yet)

kbingham pushed a commit that referenced this issue Apr 17, 2021
Enabling the gcc undefined behaviour sanitizer (with the meson configure
-Db_sanitize=undefined option) causes many tests to fail, with errors
such as the following (for test/object-invoke):

------------------------------------------------------------------------
../../include/libcamera/bound_method.h:198:27: runtime error: member access within address 0x55fcd7bfbd38 which does not point to an object of type 'BoundMethodBase'
0x55fcd7bfbd38: note: object has invalid vptr
 fc 55 00 00  2a 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  31 00 00 00 00 00 00 00  4b c6 72 88
              ^~~~~~~~~~~~~~~~~~~~~~~
              invalid vptr
../../include/libcamera/bound_method.h:198:41: runtime error: member call on null pointer of type 'struct InvokedObject'
../../include/libcamera/bound_method.h:198:41: runtime error: member access within null pointer of type 'struct InvokedObject'
Segmentation fault
------------------------------------------------------------------------

or

------------------------------------------------------------------------
../../include/libcamera/bound_method.h:198:27: runtime error: member access within address 0x603000006628 which does not point to an object of type 'BoundMethodBase'
0x603000006628: note: object has invalid vptr
 70 55 00 00  2a 00 00 00 be be be be  03 02 00 00 18 00 00 00  01 00 00 60 00 00 00 00  05 00 80 07
              ^~~~~~~~~~~~~~~~~~~~~~~
              invalid vptr
=================================================================
==941==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x603000006630 at pc 0x55704e461371 bp 0x7fff539b9040 sp 0x7fff539b9030
READ of size 8 at 0x603000006630 thread T0
    #0 0x55704e461370 in libcamera::BoundMethodMember<InvokedObject, void, int>::invoke(int) (libcamera/build/x86-gcc-11.0.1/test/object-invoke+0x47370)
    #1 0x55704e4622ca in void libcamera::BoundMethodArgs<void, int>::invokePack<0ul>(libcamera::BoundMethodPackBase*, std::integer_sequence<unsigned long, 0ul>) (libcamera/build/x86-gcc-11.0.1/test/object-invoke+0x482ca)
    #2 0x55704e460a93 in libcamera::BoundMethodArgs<void, int>::invokePack(libcamera::BoundMethodPackBase*) (libcamera/build/x86-gcc-11.0.1/test/object-invoke+0x46a93)
    #3 0x7fdc38a5fec4 in libcamera::InvokeMessage::invoke() ../../src/libcamera/message.cpp:154
    #4 0x7fdc38a62faf in libcamera::Object::message(libcamera::Message*) ../../src/libcamera/object.cpp:183
    #5 0x7fdc38ad3742 in libcamera::Thread::dispatchMessages(libcamera::Message::Type) ../../src/libcamera/thread.cpp:575
    #6 0x7fdc38972d8d in libcamera::EventDispatcherPoll::processEvents() ../../src/libcamera/event_dispatcher_poll.cpp:148
    #7 0x55704e44bc15 in ObjectInvokeTest::run() (libcamera/build/x86-gcc-11.0.1/test/object-invoke+0x31c15)
    #8 0x55704e4630ab in Test::execute() ../../test/libtest/test.cpp:28
    #9 0x55704e44965b in main ../../test/object-invoke.cpp:204
    #10 0x7fdc36090eba in __libc_start_main ../csu/libc-start.c:314
    #11 0x55704e449359 in _start (libcamera/build/x86-gcc-11.0.1/test/object-invoke+0x2f359)

0x603000006630 is located 0 bytes to the right of 32-byte region [0x603000006610,0x603000006630)
allocated by thread T0 here:
    #0 0x7fdc3ad757c7 in operator new(unsigned long) /var/tmp/portage/sys-devel/gcc-11.0.1_pre9999/work/gcc-11.0.1_pre9999/libsanitizer/asan/asan_new_delete.cpp:99
    #1 0x55704e45afea in __gnu_cxx::new_allocator<std::_Sp_counted_ptr_inplace<libcamera::BoundMethodPack<void, int>, std::allocator<libcamera::BoundMethodPack<void, int> >, (__gnu_cxx::_Lock_policy)2> >::allocate(unsigned long, void const*) (libcamera/build/x86-gcc-11.0.1/test/object-invoke+0x40fea)
    #2 0x55704e45a45d in std::allocator_traits<std::allocator<std::_Sp_counted_ptr_inplace<libcamera::BoundMethodPack<void, int>, std::allocator<libcamera::BoundMethodPack<void, int> >, (__gnu_cxx::_Lock_policy)2> > >::allocate(std::allocator<std::_Sp_counted_ptr_inplace<libcamera::BoundMethodPack<void, int>, std::allocator<libcamera::BoundMethodPack<void, int> >, (__gnu_cxx::_Lock_policy)2> >&, unsigned long) (libcamera/build/x86-gcc-11.0.1/test/object-invoke+0x4045d)
    #3 0x55704e458339 in std::__allocated_ptr<std::allocator<std::_Sp_counted_ptr_inplace<libcamera::BoundMethodPack<void, int>, std::allocator<libcamera::BoundMethodPack<void, int> >, (__gnu_cxx::_Lock_policy)2> > > std::__allocate_guarded<std::allocator<std::_Sp_counted_ptr_inplace<libcamera::BoundMethodPack<void, int>, std::allocator<libcamera::BoundMethodPack<void, int> >, (__gnu_cxx::_Lock_policy)2> > >(std::allocator<std::_Sp_counted_ptr_inplace<libcamera::BoundMethodPack<void, int>, std::allocator<libcamera::BoundMethodPack<void, int> >, (__gnu_cxx::_Lock_policy)2> >&) (libcamera/build/x86-gcc-11.0.1/test/object-invoke+0x3e339)
    #4 0x55704e4574ad in std::__shared_count<(__gnu_cxx::_Lock_policy)2>::__shared_count<libcamera::BoundMethodPack<void, int>, std::allocator<libcamera::BoundMethodPack<void, int> >, int&>(libcamera::BoundMethodPack<void, int>*&, std::_Sp_alloc_shared_tag<std::allocator<libcamera::BoundMethodPack<void, int> > >, int&) (libcamera/build/x86-gcc-11.0.1/test/object-invoke+0x3d4ad)
    #5 0x55704e4569c7 in std::__shared_ptr<libcamera::BoundMethodPack<void, int>, (__gnu_cxx::_Lock_policy)2>::__shared_ptr<std::allocator<libcamera::BoundMethodPack<void, int> >, int&>(std::_Sp_alloc_shared_tag<std::allocator<libcamera::BoundMethodPack<void, int> > >, int&) (libcamera/build/x86-gcc-11.0.1/test/object-invoke+0x3c9c7)
    #6 0x55704e455f9d in std::shared_ptr<libcamera::BoundMethodPack<void, int> >::shared_ptr<std::allocator<libcamera::BoundMethodPack<void, int> >, int&>(std::_Sp_alloc_shared_tag<std::allocator<libcamera::BoundMethodPack<void, int> > >, int&) (libcamera/build/x86-gcc-11.0.1/test/object-invoke+0x3bf9d)
    #7 0x55704e454eb5 in std::shared_ptr<libcamera::BoundMethodPack<void, int> > std::allocate_shared<libcamera::BoundMethodPack<void, int>, std::allocator<libcamera::BoundMethodPack<void, int> >, int&>(std::allocator<libcamera::BoundMethodPack<void, int> > const&, int&) (libcamera/build/x86-gcc-11.0.1/test/object-invoke+0x3aeb5)
    #8 0x55704e454220 in std::shared_ptr<libcamera::BoundMethodPack<void, int> > std::make_shared<libcamera::BoundMethodPack<void, int>, int&>(int&) (libcamera/build/x86-gcc-11.0.1/test/object-invoke+0x3a220)
    #9 0x55704e450e60 in libcamera::BoundMethodMember<InvokedObject, void, int>::activate(int, bool) (libcamera/build/x86-gcc-11.0.1/test/object-invoke+0x36e60)
    #10 0x55704e44efb2 in void libcamera::Object::invokeMethod<InvokedObject, void, int, int, (void*)0>(void (InvokedObject::*)(int), libcamera::ConnectionType, int) (libcamera/build/x86-gcc-11.0.1/test/object-invoke+0x34fb2)
    #11 0x55704e44b7cc in ObjectInvokeTest::run() (libcamera/build/x86-gcc-11.0.1/test/object-invoke+0x317cc)
    #12 0x55704e4630ab in Test::execute() ../../test/libtest/test.cpp:28
    #13 0x55704e44965b in main ../../test/object-invoke.cpp:204
    #14 0x7fdc36090eba in __libc_start_main ../csu/libc-start.c:314

SUMMARY: AddressSanitizer: heap-buffer-overflow (libcamera/build/x86-gcc-11.0.1/test/object-invoke+0x47370) in libcamera::BoundMethodMember<InvokedObject, void, int>::invoke(int)
Shadow bytes around the buggy address:
  0x0c067fff8c70: 00 fa fa fa 00 00 06 fa fa fa fd fd fd fd fa fa
  0x0c067fff8c80: 00 00 06 fa fa fa 00 00 03 fa fa fa 00 00 00 05
  0x0c067fff8c90: fa fa 00 00 04 fa fa fa 00 00 00 00 fa fa fd fd
  0x0c067fff8ca0: fd fd fa fa fd fd fd fd fa fa fd fd fd fd fa fa
  0x0c067fff8cb0: fd fd fd fd fa fa 00 00 00 00 fa fa 00 00 00 00
=>0x0c067fff8cc0: fa fa 00 00 00 00[fa]fa fd fd fd fa fa fa fa fa
  0x0c067fff8cd0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c067fff8ce0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c067fff8cf0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c067fff8d00: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c067fff8d10: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07
  Heap left redzone:       fa
  Freed heap region:       fd
  Stack left redzone:      f1
  Stack mid redzone:       f2
  Stack right redzone:     f3
  Stack after return:      f5
  Stack use after scope:   f8
  Global redzone:          f9
  Global init order:       f6
  Poisoned by user:        f7
  Container overflow:      fc
  Array cookie:            ac
  Intra object redzone:    bb
  ASan internal:           fe
  Left alloca redzone:     ca
  Right alloca redzone:    cb
  Shadow gap:              cc
==941==ABORTING
------------------------------------------------------------------------

The root cause isn't clear, but this change fixes the issue. It may be a
bug in gcc.

Signed-off-by: Laurent Pinchart <[email protected]>
Acked-by: Kieran Bingham <[email protected]>
kbingham pushed a commit that referenced this issue Aug 16, 2021
When the stream is stopped, the V4L2VideoDevice sends back all
the queued buffers with FrameMetadata::FrameCancelled status.
It is the responsibility of the pipeline handler to handle
these buffers with FrameMetadata::FrameCancelled. VIMC is
currently missing this handling path.

As the FrameMetadata::FrameCancelled is set when the stream is
stopped, we can be sure that no more queued and re-use of request
shall happen.  Hence, cancel all the requests' buffers force a
complete with completeBuffer().

The issue is caught by the gstreamer_single_stream_test.cpp running
with vimc. During the check with meson built-in option
	'-Db_sanitize=address,undefined'
it was observed:

==118003==ERROR: AddressSanitizer: heap-use-after-free on address 0x60e000037108 at pc 0x7f225160c9ac bp 0x7f224a47b620 sp 0x7f224a47b618
READ of size 4 at 0x60e000037108 thread T1
    #0 0x7f225160c9ab in libcamera::Request::sequence() const ../include/libcamera/request.h:55
    #1 0x7f22518297aa in libcamera::VimcCameraData::bufferReady(libcamera::FrameBuffer*) ../src/libcamera/pipeline/vimc/vimc.cpp:577
    #2 0x7f225183b1ef in libcamera::BoundMethodMember<libcamera::VimcCameraData, void, libcamera::FrameBuffer*>::activate(libcamera::FrameBuffer*, bool) ../include/libcamera/base/bound_method.h:194
    #3 0x7f22515cc91f in libcamera::Signal<libcamera::FrameBuffer*>::emit(libcamera::FrameBuffer*) ../include/libcamera/base/signal.h:126
    #4 0x7f22515c3305 in libcamera::V4L2VideoDevice::streamOff() ../src/libcamera/v4l2_videodevice.cpp:1605
    #5 0x7f225181f345 in libcamera::PipelineHandlerVimc::stop(libcamera::Camera*) ../src/libcamera/pipeline/vimc/vimc.cpp:365

The VimcCameraData::bufferReady seems to emit even after the stream
is stopped. It's primarily due to vimc's lack of handling
FrameMetadata::FrameCancelled in its pipeline handler.

Signed-off-by: Umang Jain <[email protected]>
Reviewed-by: Laurent Pinchart <[email protected]>
Tested-by: Laurent Pinchart <[email protected]>
Reviewed-by: Kieran Bingham <[email protected]>
kbingham pushed a commit that referenced this issue Aug 16, 2021
When the stream is stopped, the V4L2VideoDevice sends back all
the queued buffers with FrameMetadata::FrameCancelled status.
It is the responsibility of the pipeline handler to handle
these buffers with FrameMetadata::FrameCancelled. VIMC is
currently missing this handling path.

As the FrameMetadata::FrameCancelled is set when the stream is
stopped, we can be sure that no more queued and re-use of request
shall happen.  Hence, cancel all the requests' buffers force a
complete with completeBuffer().

The issue is caught by the gstreamer_single_stream_test.cpp running
with vimc. During the check with meson built-in option
	'-Db_sanitize=address,undefined'
it was observed:

==118003==ERROR: AddressSanitizer: heap-use-after-free on address 0x60e000037108 at pc 0x7f225160c9ac bp 0x7f224a47b620 sp 0x7f224a47b618
READ of size 4 at 0x60e000037108 thread T1
    #0 0x7f225160c9ab in libcamera::Request::sequence() const ../include/libcamera/request.h:55
    #1 0x7f22518297aa in libcamera::VimcCameraData::bufferReady(libcamera::FrameBuffer*) ../src/libcamera/pipeline/vimc/vimc.cpp:577
    #2 0x7f225183b1ef in libcamera::BoundMethodMember<libcamera::VimcCameraData, void, libcamera::FrameBuffer*>::activate(libcamera::FrameBuffer*, bool) ../include/libcamera/base/bound_method.h:194
    #3 0x7f22515cc91f in libcamera::Signal<libcamera::FrameBuffer*>::emit(libcamera::FrameBuffer*) ../include/libcamera/base/signal.h:126
    #4 0x7f22515c3305 in libcamera::V4L2VideoDevice::streamOff() ../src/libcamera/v4l2_videodevice.cpp:1605
    #5 0x7f225181f345 in libcamera::PipelineHandlerVimc::stop(libcamera::Camera*) ../src/libcamera/pipeline/vimc/vimc.cpp:365

The VimcCameraData::bufferReady seems to emit even after the stream
is stopped. It's primarily due to vimc's lack of handling
FrameMetadata::FrameCancelled in its pipeline handler.

Signed-off-by: Umang Jain <[email protected]>
Reviewed-by: Laurent Pinchart <[email protected]>
Tested-by: Laurent Pinchart <[email protected]>
Reviewed-by: Kieran Bingham <[email protected]>
Tested-by: Kieran Bingham <[email protected]>
kbingham pushed a commit that referenced this issue Nov 5, 2024
When the ASan runtime is linked using --as-needed, its dependency on the
C++ standard library is stripped. This results to a failure to properly
handled exceptions when a C++ dynamically loaded .so is used, as in the
Python unit tests that load the libcamera Python module:

AddressSanitizer: CHECK failed: asan_interceptors.cpp:335 "((__interception::real___cxa_throw)) != (0)" (0x0, 0x0) (tid=32679)
    #0 0x7fa2f32e6c19 in CheckUnwind /var/tmp/portage/sys-devel/gcc-13.3.1_p20241025/work/gcc-13-20241025/libsanitizer/asan/asan_rtl.cpp:69
    #1 0x7fa2f330c9fd in __sanitizer::CheckFailed(char const*, int, char const*, unsigned long long, unsigned long long) /var/tmp/portage/sys-devel/gcc-13.3.1_p20241025/work/gcc-13-20241025/libsanitizer/sanitizer_common/sanitizer_termination.cpp:86
    #2 0x7fa2f3247824 in __interceptor___cxa_throw /var/tmp/portage/sys-devel/gcc-13.3.1_p20241025/work/gcc-13-20241025/libsanitizer/asan/asan_interceptors.cpp:335
    #3 0x7fa2f3247824 in __interceptor___cxa_throw /var/tmp/portage/sys-devel/gcc-13.3.1_p20241025/work/gcc-13-20241025/libsanitizer/asan/asan_interceptors.cpp:334
    #4 0x7fa2efb6da8b in operator() ../../src/py/libcamera/py_main.cpp:157
[...]

The issue has been reported in [1] and so far remains unfixed. Work
around it by preloading the C++ standard library.

[1] google/sanitizers#934

Signed-off-by: Laurent Pinchart <[email protected]>
Reviewed-by: Kieran Bingham <[email protected]>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

2 participants