Nicolas Dufresne [Mon, 17 Feb 2025 21:46:54 +0000 (16:46 -0500)]
media: verisilicon: Fix AV1 decoder clock frequency
The desired clock frequency was correctly set to 400MHz in the device tree
but was lowered by the driver to 300MHz breaking 4K 60Hz content playback.
Fix the issue by removing the driver call to clk_set_rate(), which reduce
the amount of board specific code.
Fixes: 003afda97c65 ("media: verisilicon: Enable AV1 decoder on rk3588") Cc: stable@vger.kernel.org Reviewed-by: Benjamin Gaignard <benjamin.gaignard@collabora.com> Reviewed-by: Philipp Zabel <p.zabel@pengutronix.de> Signed-off-by: Nicolas Dufresne <nicolas.dufresne@collabora.com> Signed-off-by: Hans Verkuil <hverkuil@xs4all.nl>
Jernej Skrabec [Fri, 23 May 2025 15:43:59 +0000 (17:43 +0200)]
media: cedrus: Add support for additional output formats
If VPU supports untiled output, it actually supports several different
YUV 4:2:0 layouts, namely NV12, NV21, YUV420 and YVU420.
Add support for all of them.
Signed-off-by: Jernej Skrabec <jernej.skrabec@siol.net> Reviewed-by: Paul Kocialkowski <paulk@sys-base.io> Signed-off-by: Nicolas Dufresne <nicolas.dufresne@collabora.com> Signed-off-by: Hans Verkuil <hverkuil@xs4all.nl>
[hverkuil: add 'default' case to switch to fix warning with old compiler]
Frank Li [Fri, 11 Apr 2025 21:36:00 +0000 (17:36 -0400)]
dt-bindings: media: convert fsl-vdoa.txt to yaml format
Convert fsl-vdoa.txt to yaml format.
Additional changes:
- Add irq.h and imx6qdl-clock.h in example.
Signed-off-by: Frank Li <Frank.Li@nxp.com> Reviewed-by: Rob Herring (Arm) <robh@kernel.org> Signed-off-by: Nicolas Dufresne <nicolas.dufresne@collabora.com> Signed-off-by: Hans Verkuil <hverkuil@xs4all.nl>
Ming Qian [Wed, 21 May 2025 01:54:07 +0000 (09:54 +0800)]
media: imx-jpeg: Account for data_offset when getting image address
Applications may set data_offset when it refers to an output queue. So
driver need to account for it when getting the start address of input
image in the plane.
Meanwhile the mxc-jpeg codec requires the address (plane address +
data_offset) to be 16-aligned.
Fixes: 2db16c6ed72c ("media: imx-jpeg: Add V4L2 driver for i.MX8 JPEG Encoder/Decoder") Signed-off-by: Ming Qian <ming.qian@oss.nxp.com> Reviewed-by: Frank Li <Frank.Li@nxp.com> Signed-off-by: Nicolas Dufresne <nicolas.dufresne@collabora.com> Signed-off-by: Hans Verkuil <hverkuil@xs4all.nl>
Ming Qian [Mon, 12 May 2025 02:01:36 +0000 (10:01 +0800)]
media: amphion: Add H264 and HEVC profile and level control
For format H264 and HEVC, the firmware can report the parsed profile idc
and level idc to driver, these information may be useful.
Implement the H264 and HEVC profile and level control to report them.
Signed-off-by: Ming Qian <ming.qian@oss.nxp.com> Signed-off-by: Nicolas Dufresne <nicolas.dufresne@collabora.com> Signed-off-by: Hans Verkuil <hverkuil@xs4all.nl>
Frank Li [Thu, 22 May 2025 17:56:48 +0000 (13:56 -0400)]
media: imx8mq-mipi-csi2: Add support for i.MX8QXP
Add support for i.MX8QXP, which has a dedicated control and status register
(CSR) space. Enable obtaining the second register space and initializing
PHY and link settings accordingly.
Reviewed-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com> Signed-off-by: Frank Li <Frank.Li@nxp.com> Link: https://lore.kernel.org/r/20250522-8qxp_camera-v5-10-d4be869fdb7e@nxp.com Signed-off-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com> Signed-off-by: Hans Verkuil <hverkuil@xs4all.nl>
Add compatible strings for i.MX8QM/i.MX8QXP platform. Remove
fsl,mipi-phy-gpr from required properties and add new reg space, since
i.MX8QM and i.MX8QXP use dedicate control and status register(csr) space.
Keep the same restriction for other compatible strings.
Signed-off-by: Robert Chiras <robert.chiras@nxp.com> Reviewed-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com> Reviewed-by: Rob Herring (Arm) <robh@kernel.org> Signed-off-by: Frank Li <Frank.Li@nxp.com> Link: https://lore.kernel.org/r/20250522-8qxp_camera-v5-8-d4be869fdb7e@nxp.com Signed-off-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com> Signed-off-by: Hans Verkuil <hverkuil@xs4all.nl>
Frank Li [Thu, 22 May 2025 17:56:41 +0000 (13:56 -0400)]
media: nxp: imx8-isi: Remove unused offset in mxc_isi_reg and use BIT() macro for mask
Preserve clarity by removing the unused 'offset' field in struct
mxc_isi_reg, as it duplicates information already indicated by the mask
and remains unused.
Improve readability by replacing hex value masks with the BIT() macro.
No functional change.
Reviewed-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com> Signed-off-by: Frank Li <Frank.Li@nxp.com> Link: https://lore.kernel.org/r/20250522-8qxp_camera-v5-3-d4be869fdb7e@nxp.com Signed-off-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com> Signed-off-by: Hans Verkuil <hverkuil@xs4all.nl>
Frank Li [Thu, 22 May 2025 17:56:40 +0000 (13:56 -0400)]
media: nxp: imx8-isi: Allow num_sources to be greater than num_sink
Allow num_sources (drvdata: num_channels) to be greater than num_sink
(drvdata: num_ports + 1).
ISI support stream multiplexing, such as differentiates multiple cameras
from a single 2-lane MIPI input, or duplicates input stream into multiple
outputs. So num_channels may be greater than num_ports at some platform.
Reviewed-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com> Signed-off-by: Frank Li <Frank.Li@nxp.com> Link: https://lore.kernel.org/r/20250522-8qxp_camera-v5-2-d4be869fdb7e@nxp.com Signed-off-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com> Signed-off-by: Hans Verkuil <hverkuil@xs4all.nl>
Frank Li [Thu, 22 May 2025 17:56:39 +0000 (13:56 -0400)]
media: dt-bindings: Add binding doc for i.MX8QXP and i.MX8QM ISI
Add binding documentation for i.MX8QXP and i.MX8QM ISI. The clock-names,
power-domains, and ports differ significantly from the existing
nxp,imx8-isi.yaml. Create a new file to avoid complex if-else branches.
media: imx-mipi-csis: Use CSI-2 data type macros from mipi-csi2.h
The imx-mipi-csis defines custom macros for the CSI-2 data types,
duplicating the centralized macros defines in mipi-csi2.h. Replace them
with the latter.
Reviewed-by: Rui Miguel Silva <rui.silva@linaro.org> Reviewed-by: Stefan Klug <stefan.klug@ideasonboard.com> Reviewed-by: Frank Li <Frank.Li@nxp.com> Link: https://lore.kernel.org/r/20250606090533.10711-1-laurent.pinchart@ideasonboard.com Signed-off-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com> Signed-off-by: Hans Verkuil <hverkuil@xs4all.nl>
Jai Luthra [Tue, 10 Jun 2025 12:25:27 +0000 (17:55 +0530)]
media: rockchip: rkisp1: Add support for Wide Dynamic Range
RKISP supports a basic Wide Dynamic Range (WDR) module since the first
iteration (v1.0) of the ISP. Add support for enabling and configuring it
using extensible parameters.
Also, to ease programming, switch to using macro variables for defining
the tonemapping curve register addresses.
Reviewed-by: Stefan Klug <stefan.klug@ideasonboard.com> Tested-by: Stefan Klug <stefan.klug@ideasonboard.com> Reviewed-by: Paul Elder <paul.elder@ideasonboard.com> Reviewed-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com> Signed-off-by: Jai Luthra <jai.luthra@ideasonboard.com> Link: https://lore.kernel.org/r/20250610-wdr-latest-v4-1-b69d0ac17ce9@ideasonboard.com Signed-off-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com> Signed-off-by: Hans Verkuil <hverkuil@xs4all.nl>
Stefan Klug [Fri, 23 May 2025 15:14:31 +0000 (17:14 +0200)]
media: rkisp1: Add RKISP1_CID_SUPPORTED_PARAMS_BLOCKS control
Add a RKISP1_CID_SUPPORTED_PARAMS_BLOCKS V4L2 control to be able to
query the parameters blocks supported by the current kernel on the
current hardware from user space.
Signed-off-by: Stefan Klug <stefan.klug@ideasonboard.com> Reviewed-by: Paul Elder <paul.elder@ideasonboard.com> Reviewed-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com> Link: https://lore.kernel.org/r/20250523-supported-params-and-wdr-v3-2-7283b8536694@ideasonboard.com Signed-off-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com> Signed-off-by: Hans Verkuil <hverkuil@xs4all.nl>
Stefan Klug [Fri, 23 May 2025 15:14:30 +0000 (17:14 +0200)]
media: rkisp1: Properly handle result of rkisp1_params_init_vb2_queue()
Properly handle the return of rkisp1_params_init_vb2_queue(). It is very
unlikely that this ever fails without code changes but should be handled
anyways.
While at it rename the error label for easier extension in the upcoming
patch.
media: nxp: imx8-isi: Simplify a couple of error messages
The error messages in the mxc_isi_crossbar_enable_streams() and
mxc_isi_crossbar_disable_streams() functions are similar, with a single
word difference between them. The word is moved out of the format string
to a separate dev_err() argument to try and save memory through string
de-duplication. The total savings are however small, as the .data size
reduction is partly offset by a .text size increase, with a total saving
of 8 bytes in total on an ARM64 platforms. They also come at the cost of
making the error message difficult to grep, which outweights the gains.
Simplify the error messages to make them grep-able.
Signed-off-by: Krzysztof Hałasa <khalasa@piap.pl> Reviewed-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com> Link: https://lore.kernel.org/r/m3plgi9pwu.fsf@t19.piap.pl Signed-off-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com> Signed-off-by: Hans Verkuil <hverkuil@xs4all.nl>
Jacopo Mondi [Tue, 17 Jun 2025 07:23:28 +0000 (09:23 +0200)]
media: vsp1: Add VSPX support
Add support for VSPX, a specialized version of the VSP2 that
transfers data to the ISP. The VSPX is composed of two RPF units
to read data from external memory and an IIF instance that performs
transfer towards the ISP.
The VSPX is supported through a newly introduced vsp1_vspx.c file that
exposes two interfaces: vsp1_vspx interface, declared in vsp1_vspx.h
for the vsp1 core to initialize and cleanup the VSPX, and a vsp1_isp
interface, declared in include/media/vsp1.h for the ISP driver to
control the VSPX operations.
Jacopo Mondi [Mon, 16 Jun 2025 16:30:38 +0000 (18:30 +0200)]
media: vsp1: vsp1_dl: Count display lists
To detect leaks of display lists, store in the display list manager the
number of allocated display lists when the manager is created and verify
that when the display manager is reset the same number of lists is
available in the free list.
Jacopo Mondi [Mon, 16 Jun 2025 16:30:37 +0000 (18:30 +0200)]
media: vsp1: vsp1_dl: Detect double list release
In order to detect invalid usage pattern such as double list_put()
calls, add an 'allocated' flag to each display list. Set the flag
whenever a list is get() and clear it when the list is put(). Warn if a
list not marked as allocated is returned to the pool of available
display lists.
Koji Matsuoka [Mon, 16 Jun 2025 12:14:25 +0000 (14:14 +0200)]
media: vsp1: Reset FCP after VSPD
According to the R-Car Gen3 H/W manual v2.40, and R-Car Gen4 H/W manual
v1.20, the FCP must be reset after resetting the VSPD, except for the
VSPDL. Do so.
Jacopo Mondi [Mon, 16 Jun 2025 12:14:24 +0000 (14:14 +0200)]
media: rcar-fcp: Add rcar_fcp_soft_reset()
Add a function to perform soft reset of the FCP.
It is intended to support the correct stop procedure of the VSPX-FCPVX
and VSPD-FCPD pairs according to section "62.3.7.3 Reset Operation" of
the R-Car Hardware Manual at revision 1.20.
Niklas Söderlund [Mon, 16 Jun 2025 18:57:22 +0000 (20:57 +0200)]
media: rcar-vin: Generate FRAME_SYNC events
Enable the VSYNC Rising Edge Detection interrupt and generate a
FRAME_SYNC event form it. The interrupt is available on all supported
models of the VIN (Gen2, Gen3 and Gen4).
Niklas Söderlund [Mon, 16 Jun 2025 18:57:21 +0000 (20:57 +0200)]
media: rcar-vin: Check for correct capture interrupt event
Depending on if the capture session deals with fields or whole frames
interrupts can be generated at an end of field, or end of frame event.
The interrupt mask is setup to generate an interrupt on one of the two
events depending on what is needed when the VIN is started. The end of
field bit is set in both cases so controlling the mask that generates an
interrupt have been enough to control the two use-cases.
Before extending the interrupt handler to deal with other types of
interrupt events it is needs to extended to "capture complete" check for
correct the use-case in operation. Without this the simplification in
the handler can result in corrupted frames when the mask on what type of
events can generate an interrupt generated can no longer be assumed to
only be an "capture complete" event.
Which bit is checked matches which bit is enabled at configuration time
as which event can generate an interrupt for "capture complete". There
is no functional change.
While at it switch to use the BIT() macro to describe the bit positions
for the interrupt functions.
Niklas Söderlund [Mon, 16 Jun 2025 18:57:20 +0000 (20:57 +0200)]
media: rcar-vin: Fold interrupt helpers into only callers
The call sites using the interrupt helper functions have all been
reworked to only one for each. Fold each of them into the only call
sites left.
This fixes a possible interrupt loss in case an interrupt occurs between
reading VNINTS_REG in rvin_get_interrupt_status() and reading it again
in rvin_ack_interrupt().
While at it rename the variable holding the current interrupt status to
make the code easier to read.
Kuan-Wei Chiu [Thu, 15 May 2025 08:11:09 +0000 (16:11 +0800)]
media: saa7115: Replace open-coded parity calculation with parity8()
Refactor parity calculations to use the standard parity8() helper.
This change eliminates redundant implementations.
Co-developed-by: Yu-Chun Lin <eleanor15x@gmail.com> Signed-off-by: Yu-Chun Lin <eleanor15x@gmail.com> Signed-off-by: Kuan-Wei Chiu <visitorckw@gmail.com> Reviewed-by: Hans Verkuil <hverkuil@xs4all.nl> Signed-off-by: Hans Verkuil <hverkuil@xs4all.nl>
Kuan-Wei Chiu [Thu, 15 May 2025 08:09:33 +0000 (16:09 +0800)]
media: pci: cx18-av-vbi: Replace open-coded parity calculation with parity8()
Refactor parity calculations to use the standard parity8() helper.
This change eliminates redundant implementations.
Co-developed-by: Yu-Chun Lin <eleanor15x@gmail.com> Signed-off-by: Yu-Chun Lin <eleanor15x@gmail.com> Signed-off-by: Kuan-Wei Chiu <visitorckw@gmail.com> Reviewed-by: Hans Verkuil <hverkuil@xs4all.nl> Signed-off-by: Hans Verkuil <hverkuil@xs4all.nl>
Kuan-Wei Chiu [Thu, 15 May 2025 08:07:48 +0000 (16:07 +0800)]
media: media/test_drivers: Replace open-coded parity calculation with parity8()
Refactor parity calculations to use the standard parity8() helper.
This change eliminates redundant implementations.
Co-developed-by: Yu-Chun Lin <eleanor15x@gmail.com> Signed-off-by: Yu-Chun Lin <eleanor15x@gmail.com> Signed-off-by: Kuan-Wei Chiu <visitorckw@gmail.com> Reviewed-by: Hans Verkuil <hverkuil@xs4all.nl> Signed-off-by: Hans Verkuil <hverkuil@xs4all.nl>
The driver checks if "vq->max_num_buffers + *nbuffers < 3", but
vq->max_num_buffers is (by default) 32, so the check is never true. Nor
does the check make sense.
The original code in the BSP kernel was "vq->num_buffers + *nbuffers <
3", but got mangled along the way to upstream. The intention was to make
sure that at least 3 buffers are allocated.
Fix this by removing the bad lines and setting q->min_reqbufs_allocation
to three.
Signed-off-by: Tomi Valkeinen <tomi.valkeinen@ideasonboard.com> Reviewed-by: Hans Verkuil <hverkuil@xs4all.nl> Signed-off-by: Hans Verkuil <hverkuil@xs4all.nl>
Dave Stevenson [Wed, 11 Jun 2025 18:37:16 +0000 (19:37 +0100)]
media: tc358743: Return an appropriate colorspace from tc358743_set_fmt
When calling tc358743_set_fmt, the code was calling tc358743_get_fmt
to choose a valid format. However that sets the colorspace
based on information read back from the chip, not the colour
format requested.
The result was that if you called try or set format for UYVY
when the current format was RGB3 then you would get told SRGB,
and try RGB3 when current was UYVY and you would get told
SMPTE170M.
The value programmed in the VI_REP register for the colorspace
is always set by this driver, therefore there is no need to read
back the value, and never set to REC709.
Return the colorspace based on the format set/tried instead.
Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com> Signed-off-by: Hans Verkuil <hverkuil@xs4all.nl>
Dave Stevenson [Wed, 11 Jun 2025 18:37:15 +0000 (19:37 +0100)]
media: tc358743: Check I2C succeeded during probe
The probe for the TC358743 reads the CHIPID register from
the device and compares it to the expected value of 0.
If the I2C request fails then that also returns 0, so
the driver loads thinking that the device is there.
Generally I2C communications are reliable so there is
limited need to check the return value on every transfer,
therefore only amend the one read during probe to check
for I2C errors.
Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com> Signed-off-by: Hans Verkuil <hverkuil@xs4all.nl>
Dave Stevenson [Wed, 11 Jun 2025 18:37:14 +0000 (19:37 +0100)]
media: tc358743: Increase FIFO trigger level to 374
The existing fixed value of 16 worked for UYVY 720P60 over
2 lanes at 594MHz, or UYVY 1080P60 over 4 lanes. (RGB888
1080P60 needs 6 lanes at 594MHz).
It doesn't allow for lower resolutions to work as the FIFO
underflows.
374 is required for 1080P24 or 1080P30 UYVY over 2 lanes @
972Mbit/s, but >374 means that the FIFO underflows on 1080P50
UYVY over 2 lanes @ 972Mbit/s.
Whilst it would be nice to compute it, the required information
isn't published by Toshiba.
Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com> Signed-off-by: Hans Verkuil <hverkuil@xs4all.nl>
vpdma_update_dma_addr() was added in 2016 as part of
commit 2f88703a0bfd ("[media] media: ti-vpe: vpdma: Add multi-instance and
multi-client support")
but has remained unused.
Remove it.
I did see that there was a VIP driver submitted in 2020 that
doesn't seem to have got merged which did use this (and a bunch
of other unused functions).
Signed-off-by: Dr. David Alan Gilbert <linux@treblig.org> Signed-off-by: Hans Verkuil <hverkuil@xs4all.nl>
The functions:
vpu_color_get_default()
vpu_color_check_full_range()
vpu_color_check_primaries()
vpu_color_check_transfers()
vpu_color_check_matrix()
have been unused since 2022's
commit 1925665ef403 ("media: amphion: remove redundant check of
colorspace in venc_s_fmt")
The (empty) function vpu_mbox_enable_rx() has been unused since it
was added in 2022 by the
commit 61cbf1c1fa6d ("media: amphion: implement vpu core communication
based on mailbox")
Remove them.
Signed-off-by: Dr. David Alan Gilbert <linux@treblig.org> Signed-off-by: Hans Verkuil <hverkuil@xs4all.nl>
media: exynos4-is: fimc-is: Fully open-code compatible for grepping
It is very useful to find driver implementing compatibles with `git grep
compatible`, so driver should not use defines for that string, even if
this means string will be effectively duplicated.
Signed-off-by: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org> Signed-off-by: Hans Verkuil <hverkuil@xs4all.nl>
Gui-Dong Han [Fri, 6 Jun 2025 03:04:59 +0000 (03:04 +0000)]
media: rainshadow-cec: fix TOCTOU race condition in rain_interrupt()
In the interrupt handler rain_interrupt(), the buffer full check on
rain->buf_len is performed before acquiring rain->buf_lock. This
creates a Time-of-Check to Time-of-Use (TOCTOU) race condition, as
rain->buf_len is concurrently accessed and modified in the work
handler rain_irq_work_handler() under the same lock.
Multiple interrupt invocations can race, with each reading buf_len
before it becomes full and then proceeding. This can lead to both
interrupts attempting to write to the buffer, incrementing buf_len
beyond its capacity (DATA_SIZE) and causing a buffer overflow.
Fix this bug by moving the spin_lock() to before the buffer full
check. This ensures that the check and the subsequent buffer modification
are performed atomically, preventing the race condition. An corresponding
spin_unlock() is added to the overflow path to correctly release the
lock.
This possible bug was found by an experimental static analysis tool
developed by our team.
Fixes: 0f314f6c2e77 ("[media] rainshadow-cec: new RainShadow Tech HDMI CEC driver") Cc: stable@vger.kernel.org Signed-off-by: Gui-Dong Han <hanguidong02@gmail.com> Signed-off-by: Hans Verkuil <hverkuil@xs4all.nl>
Martin Tůma [Mon, 2 Jun 2025 09:27:51 +0000 (11:27 +0200)]
media: mgb4: Enumerate only the available timings
Enumerate only the available (as given by the sysfs setup - our "EDID
replacement") timings, not all theoretically possible. This is the video
outputs part of the previous inputs patch that somehow got "lost in
translation".
Signed-off-by: Martin Tůma <martin.tuma@digiteqautomotive.com> Signed-off-by: Hans Verkuil <hverkuil@xs4all.nl>
Dan Carpenter [Wed, 28 May 2025 20:22:14 +0000 (23:22 +0300)]
media: gspca: Add bounds checking to firmware parser
This sd_init() function reads the firmware. The firmware data holds a
series of records and the function reads each record and sends the data
to the device. The request_ihex_firmware() function
calls ihex_validate_fw() which ensures that the total length of all the
records won't read out of bounds of the fw->data[].
However, a potential issue is if there is a single very large
record (larger than PAGE_SIZE) and that would result in memory
corruption. Generally we trust the firmware, but it's always better to
double check.
Fixes: 49b61ec9b5af ("[media] gspca: Add new vicam subdriver") Cc: stable@vger.kernel.org Signed-off-by: Dan Carpenter <dan.carpenter@linaro.org> Signed-off-by: Hans Verkuil <hverkuil@xs4all.nl>
Andy Shevchenko [Wed, 28 May 2025 11:32:04 +0000 (14:32 +0300)]
media: cx18: Replace custom implementation of list_entry_is_head()
Besides list_entry_is_past_end() is the same as list_entry_is_head(),
it's implemented in the list namespace. Fix both of the issue by replacing
the custom version with list_entry_is_head() calls.
Signed-off-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com> Signed-off-by: Hans Verkuil <hverkuil@xs4all.nl>
Wolfram Sang [Thu, 22 May 2025 08:09:55 +0000 (10:09 +0200)]
media: usb: hdpvr: use I2C core to handle only supported messages
The HW can only do write-then-read transactions. This is a common
limitation, so we can add an adapter quirk flag to let the I2C core
enforce the checks instead of open coding them.
Signed-off-by: Wolfram Sang <wsa+renesas@sang-engineering.com> Signed-off-by: Hans Verkuil <hverkuil@xs4all.nl>
This driver passes the length of an i2c_msg directly to
usb_control_msg(). If the message is now a read and of length 0, it
violates the USB protocol and a warning will be printed. Enable the
I2C_AQ_NO_ZERO_LEN_READ quirk for this adapter thus forbidding 0-length
read messages altogether.
Signed-off-by: Wolfram Sang <wsa+renesas@sang-engineering.com> Signed-off-by: Hans Verkuil <hverkuil@xs4all.nl>
Ludwig Disterhof [Mon, 28 Apr 2025 18:16:50 +0000 (20:16 +0200)]
media: usbtv: Lock resolution while streaming
When an program is streaming (ffplay) and another program (qv4l2)
changes the TV standard from NTSC to PAL, the kernel crashes due to trying
to copy to unmapped memory.
Changing from NTSC to PAL increases the resolution in the usbtv struct,
but the video plane buffer isn't adjusted, so it overflows.
Fixes: 0e0fe3958fdd13d ("[media] usbtv: Add support for PAL video source") Cc: stable@vger.kernel.org Signed-off-by: Ludwig Disterhof <ludwig@disterhof.eu> Signed-off-by: Hans Verkuil <hverkuil@xs4all.nl>
[hverkuil: call vb2_is_busy instead of vb2_is_streaming]
'struct i2c_algorithm' is not modified in this driver.
Constifying this structure moves some data to a read-only section, so
increase overall security, especially when the structure holds some
function pointers.
On a x86_64, with allmodconfig, as an example:
Before:
======
text data bss dec hex filename
6645 216 16 6877 1add drivers/media/common/b2c2/flexcop-i2c.o
After:
=====
text data bss dec hex filename
6721 160 16 6897 1af1 drivers/media/common/b2c2/flexcop-i2c.o
Signed-off-by: Christophe JAILLET <christophe.jaillet@wanadoo.fr> Signed-off-by: Hans Verkuil <hverkuil@xs4all.nl>
media: solo6x10: remove unneeded GPIO direction setters
GPIO core already handles missing direction_input/output() callbacks.
The ones in this driver also effectively return magic numbers which is
not optimal either (the number accidentally corresponds with -EPERM which
is different from the number GPIOLIB returns and so inconsistent). Just
remove them.
Signed-off-by: Bartosz Golaszewski <bartosz.golaszewski@linaro.org> Signed-off-by: Hans Verkuil <hverkuil@xs4all.nl>
Alex Guo [Mon, 16 Jun 2025 01:32:31 +0000 (21:32 -0400)]
media: dvb-frontends: dib7090p: fix null-ptr-deref in dib7090p_rw_on_apb()
In dib7090p_rw_on_apb, msg is controlled by user. When msg[0].buf is null and
msg[0].len is zero, former checks on msg[0].buf would be passed. If accessing
msg[0].buf[2] without sanity check, null pointer deref would happen. We add
check on msg[0].len to prevent crash. Similar issue occurs when access
msg[1].buf[0] and msg[1].buf[1].
Similar commit: commit 0ed554fd769a ("media: dvb-usb: az6027: fix null-ptr-deref in az6027_i2c_xfer()")
Alex Guo [Mon, 16 Jun 2025 01:33:53 +0000 (21:33 -0400)]
media: dvb-frontends: w7090p: fix null-ptr-deref in w7090p_tuner_write_serpar and w7090p_tuner_read_serpar
In w7090p_tuner_write_serpar, msg is controlled by user. When msg[0].buf is null and msg[0].len is zero, former checks on msg[0].buf would be passed. If accessing msg[0].buf[2] without sanity check, null pointer deref would happen. We add
check on msg[0].len to prevent crash.
Similar commit: commit 0ed554fd769a ("media: dvb-usb: az6027: fix null-ptr-deref in az6027_i2c_xfer()")
Niklas Söderlund [Fri, 13 Jun 2025 15:34:33 +0000 (17:34 +0200)]
media: rcar-vin: Enable media-graph on Gen2
Complete the conversion from soc_camera to a full fledge media
controller enabled devices for all supported generations of the device.
All work is already done as this is already supported on Gen3, and
later.
All that is missing is removing all special cases for the non
media-graph call paths and use the common ones in their place.
The one change that stands out is dropping the doubling of the height in
the Gen2 scaler setup, rvin_scaler_gen2(). In the Gen2 non-MC world the
VIN size was set to match the video source subdevices, and if that was a
TOP/BOTTOM video source it needed to be doubled for the scaler to
function properly. In the MC world this is now handled by user-space
configuration of the pipeline and the adjustment is not needed.
Mark the completion of converting from soc_camera by injecting an
attribution of myself in the header.
Niklas Söderlund [Fri, 13 Jun 2025 15:34:32 +0000 (17:34 +0200)]
media: rcar-vin: Only expose VIN controls
Before moving Gen2 to media controller simplify the creation of controls
by not exposing the sub-device controls on the video device. This could
be done while enabling media controller but doing it separately reduces
the changes needed to do so.
The rework also allows the cleanup and remove paths to be simplified by
folding all special cases into the only remaining call site.
Niklas Söderlund [Fri, 13 Jun 2025 15:34:31 +0000 (17:34 +0200)]
media: rcar-vin: Remove NTSC workaround
On Gen2 where sub-devices where not exposed to user-space the field
TB/BT ordering was controlled by a hack in the VIN driver. Before
converting it to media device model where the subdevice is exposed
remove that hack.
Niklas Söderlund [Fri, 13 Jun 2025 15:34:29 +0000 (17:34 +0200)]
media: rcar-vin: Merge all notifiers
The VIN usage of v4l-async is complex and stems from organic growth of
the driver of supporting both private local subdevices (Gen2, Gen3) and
subdevices shared between all VIN instances (Gen3 and Gen4).
The driver used a separate notifier for each VIN for the private local
ones, and a shared group notifier for the shared ones. This was complex
and lead to subtle bugs when unbinding and later rebinding subdevices in
one of the notifiers having to handle different edge cases depending on
if it also had subdevices in the other notifiers etc.
To simplify this have the Gen2 devices allocate and form a VIN group
too. This way all subdevices on all models can be collect in a
single group notifier. Then there is only a single complete callback for
all where the video devices and subdevice nodes can be registered etc.
Niklas Söderlund [Fri, 13 Jun 2025 15:34:27 +0000 (17:34 +0200)]
media: rcar-vin: Prepare for unifying all v4l-async notifiers
The R-Car VIN driver is needlessly complex and uses more then one
v4l-async notifier to attach to all its subdevices. Prepare for unifying
them by moving rvin_parallel_parse_of() to where it needs to be when
they are unified.
The function is moved verbatim and there is no change in behavior.
Niklas Söderlund [Fri, 13 Jun 2025 15:34:26 +0000 (17:34 +0200)]
media: rcar-vin: Generate a VIN group ID for Gen2
Prepare to move Gen2 and earlier models to media controller by
generating a unique VIN group id for each VIN instance. On Gen3 and Gen4
it is important to have a specific id in the group as media graph routes
depend on this. On Gen2 and earlier models all that will matter is to
have a unique id in the range.
Break out the id generation to a own function keeping the logic for Gen3
and Gen4 while generating a sequential id for Gen2 models.
Niklas Söderlund [Fri, 13 Jun 2025 15:34:24 +0000 (17:34 +0200)]
media: rcar-vin: Change link setup argument
The link setup callback once acted on each VIN instance, and expected to
be called once for each VIN instance. This have changed as the driver
grew support for later hardware generations and the callback is now
expected to setup links for all VIN in the group.
The argument to the callback has however remained a pointer to a single
VIN instance. This pointer was then used to get the group structure. Fix
this and pass the group as the single argument to the link setup
callback making the expectation of the function clear.
Niklas Söderlund [Fri, 13 Jun 2025 15:34:23 +0000 (17:34 +0200)]
media: rcar-vin: Store platform info with group structure
When the transition of Gen2 to use groups are complete the platform
specific information can be retrieved from the group instead of being
duplicated in each VIN's private data structure.
Prepare for this by already adding the information to the group
structure so it can be used without first having to find the group from
a VIN instances private data.
Niklas Söderlund [Fri, 13 Jun 2025 15:34:22 +0000 (17:34 +0200)]
media: rcar-vin: Use correct count of remote subdevices
When extending the driver with Gen4 support the iteration of over
possible remote subdevices changed from being R-Car CSI-2 Rx only to
also cover R-Car CSISP instances. In two loops updating the bounds
variable was missed.
This had no ill effect as the count the two values have always been the
same in the past. Fix it by looking at the array size.
Niklas Söderlund [Thu, 12 Jun 2025 17:59:04 +0000 (19:59 +0200)]
media: rcar-csi2: Add D-PHY support for V4H
Add D-PHY support for V4H in addition to the already supported C-PHY.
The common start-up procedure for C-PHY and D-PHY is shared, only PHY
setup differ. Extend the V4H setup with D-PHY support as documented in
the datasheet (Rev.1.21).
Most of the start-up procedure is only documented as magic values in
tables, there is little documentation to make the settings more clear.
Wherever possible formulas or lookup tables are used as they are
documented in the datasheet.
Niklas Söderlund [Thu, 12 Jun 2025 17:59:03 +0000 (19:59 +0200)]
media: rcar-csi2: Update start procedure for V4H
Prepare for adding D-PHY support to the driver by first updating the
generic startup procedure that covers both C-PHY and D-PHY operations.
The starting procedure where updated in later versions of the datasheet.
Most of the configuration is only documented as tables of magic values
in the documentation. Each step is however marked with a T<n> marker,
inject these markers in the comments to make it easier to map driver to
documentation.
Niklas Söderlund [Thu, 12 Jun 2025 17:59:02 +0000 (19:59 +0200)]
media: rcar-csi2: Rework macros to access AFE lanes
Each AFE lane has a set of control and offset registers. The registers
themself are undocumented but later datasheets program more of them with
magic values. Before exploding the driver with more defines to name them
all rework the AFE ones to be able to address all controls and offsets.
Niklas Söderlund [Thu, 12 Jun 2025 17:59:01 +0000 (19:59 +0200)]
media: rcar-csi2: Clarify usage of mbps and msps
The helper function to deal with calculating the link speed is designed
in such a way that it returns the correct type bps (bits per second) for
D-PHY and sps (symbols per second) for C-PHY. And for historical reasons
the function kept the name mbps.
This is confusing, fix it by having the function only deal with bps
values as this is the most common use-case and convert bps to sps in the
only function where it is needed to configure the C-PHY.
Signed-off-by: Niklas Söderlund <niklas.soderlund+renesas@ragnatech.se> Tested-by: Tomi Valkeinen <tomi.valkeinen+renesas@ideasonboard.com> Reviewed-by: Tomi Valkeinen <tomi.valkeinen+renesas@ideasonboard.com> Reviewed-by: Laurent Pinchart <laurent.pinchart+renesas@ideasonboard.com> Link: https://lore.kernel.org/r/20250612175904.1126717-2-niklas.soderlund+renesas@ragnatech.se Signed-off-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com> Signed-off-by: Hans Verkuil <hverkuil@xs4all.nl>
Youngjun Lee [Tue, 10 Jun 2025 12:41:07 +0000 (21:41 +0900)]
media: uvcvideo: Fix 1-byte out-of-bounds read in uvc_parse_format()
The buffer length check before calling uvc_parse_format() only ensured
that the buffer has at least 3 bytes (buflen > 2), buf the function
accesses buffer[3], requiring at least 4 bytes.
This can lead to an out-of-bounds read if the buffer has exactly 3 bytes.
Fix it by checking that the buffer has at least 4 bytes in
uvc_parse_format().
Signed-off-by: Youngjun Lee <yjjuny.lee@samsung.com> Reviewed-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com> Fixes: c0efd232929c ("V4L/DVB (8145a): USB Video Class driver") Cc: stable@vger.kernel.org Reviewed-by: Ricardo Ribalda <ribalda@chromium.org> Link: https://lore.kernel.org/r/20250610124107.37360-1-yjjuny.lee@samsung.com Signed-off-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com> Signed-off-by: Hans Verkuil <hverkuil@xs4all.nl>
Ricardo Ribalda [Fri, 9 May 2025 18:24:14 +0000 (18:24 +0000)]
media: uvcvideo: Refactor uvc_queue_streamon
Do uvc_pm_get before we call uvc_queue_streamon. Although the current
code is correct, uvc_ioctl_streamon is allways called after uvc_pm_get,
this change makes the code more resiliant to future changes.
Ricardo Ribalda [Fri, 9 May 2025 18:24:13 +0000 (18:24 +0000)]
media: uvcvideo: Refactor uvc_ctrl_set_handle()
Today uvc_ctrl_set_handle() covers two use-uses: setting the handle and
clearing the handle. The only common code between the two cases is the
lockdep_assert_held.
The code looks cleaner if we split these two usecases in two functions.
We also take this opportunity to use pending_async_ctrls from ctrl where
possible.
Ricardo Ribalda [Fri, 2 May 2025 07:48:28 +0000 (07:48 +0000)]
media: uvcvideo: Set V4L2_CTRL_FLAG_DISABLED during queryctrl errors
To implement VIDIOC_QUERYCTRL, we need to know the minimum, maximum,
step and flags of the control. For some of the controls, this involves
querying the actual hardware.
Some non-compliant cameras produce errors when we query them. These
error can be triggered every time, sometimes, or when other controls do
not have the "right value". Right now, we populate that error to userspace.
When an error happens, the v4l2 framework does not copy the v4l2_queryctrl
struct to userspace. Also, userspace apps are not ready to handle any
other error than -EINVAL.
One of the main usecases of VIDIOC_QUERYCTRL is enumerating the controls
of a device. This is done using the V4L2_CTRL_FLAG_NEXT_CTRL flag. In
that usecase, a non-compliant control will make it almost impossible to
enumerate all controls of the device.
A control with an invalid max/min/step/flags is better than non being
able to enumerate the rest of the controls.
This patch:
- Retries for an extra attempt to read the control, to avoid spurious
errors. More attempts do not seem to produce better results in the
tested hardware.
- Makes VIDIOC_QUERYCTRL return 0 for -EIO errors.
- Introduces a warning in dmesg so we can have a trace of what has happened
and sets the V4L2_CTRL_FLAG_DISABLED.
- Makes sure we keep returning V4L2_CTRL_FLAG_DISABLED for all the next
attempts to query that control (other operations have the same
functionality as now).
Reviewed-by: Hans de Goede <hdegoede@redhat.com> Signed-off-by: Ricardo Ribalda <ribalda@chromium.org> Link: https://lore.kernel.org/r/20250502-uvc-eaccess-v8-1-0b8b58ac1142@chromium.org Signed-off-by: Hans de Goede <hansg@kernel.org> Signed-off-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com> Signed-off-by: Hans Verkuil <hverkuil@xs4all.nl>
Linus Torvalds [Sun, 8 Jun 2025 18:33:00 +0000 (11:33 -0700)]
Merge tag 'timers-cleanups-2025-06-08' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip
Pull timer cleanup from Thomas Gleixner:
"The delayed from_timer() API cleanup:
The renaming to the timer_*() namespace was delayed due massive
conflicts against Linux-next. Now that everything is upstream finish
the conversion"
* tag 'timers-cleanups-2025-06-08' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
treewide, timers: Rename from_timer() to timer_container_of()
Linus Torvalds [Sun, 8 Jun 2025 18:27:20 +0000 (11:27 -0700)]
Merge tag 'x86-urgent-2025-06-08' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip
Pull x86 fixes from Thomas Gleixner:
"A small set of x86 fixes:
- Cure IO bitmap inconsistencies
A failed fork cleans up all resources of the newly created thread
via exit_thread(). exit_thread() invokes io_bitmap_exit() which
does the IO bitmap cleanups, which unfortunately assume that the
cleanup is related to the current task, which is obviously bogus.
Make it work correctly
- A lockdep fix in the resctrl code removed the clearing of the
command buffer in two places, which keeps stale error messages
around. Bring them back.
- Remove unused trace events"
* tag 'x86-urgent-2025-06-08' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
fs/resctrl: Restore the rdt_last_cmd_clear() calls after acquiring rdtgroup_mutex
x86/iopl: Cure TIF_IO_BITMAP inconsistencies
x86/fpu: Remove unused trace events
Zhang Rui [Fri, 30 May 2025 00:09:28 +0000 (08:09 +0800)]
tools/power turbostat: Avoid probing the same perf counters
For the RAPL package energy status counter, Intel and AMD share the same
perf_subsys and perf_name, but with different MSR addresses.
Both rapl_counter_arch_infos[0] and rapl_counter_arch_infos[1] are
introduced to describe this counter for different Vendors.
As a result, the perf counter is probed twice, and causes a failure in
in get_rapl_counters() because expected_read_size and actual_read_size
don't match.
Fix the problem by skipping the already probed counter.
Note, this is not a perfect fix. For example, if different
vendors/platforms use the same MSR value for different purpose, the code
can be fooled when it probes a rapl_counter_arch_infos[] entry that does
not belong to the running Vendor/Platform.
In a long run, better to put rapl_counter_arch_infos[] into the
platform_features so that this becomes Vendor/Platform specific.
Signed-off-by: Zhang Rui <rui.zhang@intel.com> Signed-off-by: Len Brown <len.brown@intel.com>
projects / thirdparty / linux.git / log
