Benjamin Mugnier [Wed, 11 Jun 2025 08:48:32 +0000 (10:48 +0200)]
media: i2c: vd55g1: Setup sensor external clock before patching
Proper clock configuration is required to advance through FSM states.
Prior than this having a different clock value than default sensor's
value was used (12 MHz) could prevent the sensor from booting.
Signed-off-by: Benjamin Mugnier <benjamin.mugnier@foss.st.com> Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com> Signed-off-by: Hans Verkuil <hverkuil@xs4all.nl>
Benjamin Mugnier [Wed, 11 Jun 2025 08:48:31 +0000 (10:48 +0200)]
media: i2c: vd55g1: Fix return code in vd55g1_enable_streams error path
Enable stream was returning success even if an error occurred, fix it by
modifying the err_rpm_put return value to -EINVAL.
Signed-off-by: Benjamin Mugnier <benjamin.mugnier@foss.st.com> Fixes: e56616d7b23c ("media: i2c: Add driver for ST VD55G1 camera sensor") Cc: stable@vger.kernel.org Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com> Signed-off-by: Hans Verkuil <hverkuil@xs4all.nl>
Benjamin Mugnier [Wed, 11 Jun 2025 08:48:30 +0000 (10:48 +0200)]
media: i2c: vd55g1: Fix RATE macros not being expressed in bps
As a bit rate is expressed in bps, use MEGA instead of HZ_PER_MHZ.
Signed-off-by: Benjamin Mugnier <benjamin.mugnier@foss.st.com> Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com> Signed-off-by: Hans Verkuil <hverkuil@xs4all.nl>
Matthias Fend [Thu, 12 Jun 2025 06:54:12 +0000 (08:54 +0200)]
media: dw9714: add support for powerdown pin
Add support for the powerdown pin (xSD), which can be used to put the VCM
driver into power down mode. This is useful, for example, if the VCM
driver's power supply cannot be controlled. The use of the powerdown pin is
optional.
Signed-off-by: Matthias Fend <matthias.fend@emfend.at> Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com> Signed-off-by: Hans Verkuil <hverkuil@xs4all.nl>
Use dev_err_probe() when returning -EPROBE_DEFER to register the probe
deferral reason changing the error to:
deferred probe pending: waiting for IVSC to become ready
to help with debugging why drivers are not binding if the iVSC does
not become ready for some reason.
Signed-off-by: Hans de Goede <hdegoede@redhat.com> Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com> Signed-off-by: Hans Verkuil <hverkuil@xs4all.nl>
Use dev_err_probe() when returning -EPROBE_DEFER to register the probe
deferral reason changing the error to:
deferred probe pending: waiting for fwnode graph endpoint
Signed-off-by: Hans de Goede <hdegoede@redhat.com> Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com> Signed-off-by: Hans Verkuil <hverkuil@xs4all.nl>
Use dev_err_probe() when returning -EPROBE_DEFER to register the probe
deferral reason changing the error to:
deferred probe pending: waiting for fwnode graph endpoint
Also update the comment to not refer to the no longer existing cio2-bridge
code.
Signed-off-by: Hans de Goede <hdegoede@redhat.com> Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com> Signed-off-by: Hans Verkuil <hverkuil@xs4all.nl>
Use dev_err_probe() when returning -EPROBE_DEFER to register the probe
deferral reason changing the error to:
deferred probe pending: waiting for fwnode graph endpoint
Also update the comment to not refer to the no longer existing cio2-bridge
code.
Signed-off-by: Hans de Goede <hdegoede@redhat.com> Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com> Signed-off-by: Hans Verkuil <hverkuil@xs4all.nl>
Hans de Goede [Mon, 23 Jun 2025 11:09:51 +0000 (13:09 +0200)]
media: ipu-bridge: Add Onsemi MT9M114 HID to list of supported sensors
Add INT33F0 ACPI HID for the Onsemi MT9M114 sensor to the list of supported
sensors. This sensor is found on the Asus T100TA using this HID.
Tested-by: Hans de Goede <hdegoede@redhat.com> # Asus T100TA with MT9M114 Signed-off-by: Hans de Goede <hdegoede@redhat.com> Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com> Signed-off-by: Hans Verkuil <hverkuil@xs4all.nl>
Hans de Goede [Mon, 23 Jun 2025 11:09:50 +0000 (13:09 +0200)]
media: ipu-bridge: Add Toshiba T4KA3 HID to list of supported sensor
The Xiaomi Mi Pad 2 tablet uses a Toshiba T4KA3 sensor, using
a Xiaomi specific Hardware-ID of "XMMC0003" add this to the sensor-list
of the ipu-bridge code.
Signed-off-by: Hans de Goede <hdegoede@redhat.com> Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com> Signed-off-by: Hans Verkuil <hverkuil@xs4all.nl>
Sakari Ailus [Wed, 27 Mar 2024 11:17:33 +0000 (13:17 +0200)]
media: ov2740: Remove shorthand variables
Remove two variables in ov2740_init_control() that are used as a shorthand
for where the information is really located. Make the code more readable
by removing them.
Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com> Reviewed-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com> Reviewed-by: Jacopo Mondi <jacopo.mondi@ideasonboard.com> Signed-off-by: Hans Verkuil <hverkuil@xs4all.nl>
Hans de Goede [Sat, 21 Jun 2025 14:00:52 +0000 (16:00 +0200)]
media: ivsc: Fix crash at shutdown due to missing mei_cldev_disable() calls
Both the ACE and CSI driver are missing a mei_cldev_disable() call in
their remove() function.
This causes the mei_cl client to stay part of the mei_device->file_list
list even though its memory is freed by mei_cl_bus_dev_release() calling
kfree(cldev->cl).
This leads to a use-after-free when mei_vsc_remove() runs mei_stop()
which first removes all mei bus devices calling mei_ace_remove() and
mei_csi_remove() followed by mei_cl_bus_dev_release() and then calls
mei_cl_all_disconnect() which walks over mei_device->file_list dereferecing
the just freed cldev->cl.
And mei_vsc_remove() it self is run at shutdown because of the
platform_device_unregister(tp->pdev) in vsc_tp_shutdown()
When building a kernel with KASAN this leads to the following KASAN report:
[ 106.634504] ==================================================================
[ 106.634623] BUG: KASAN: slab-use-after-free in mei_cl_set_disconnected (drivers/misc/mei/client.c:783) mei
[ 106.634683] Read of size 4 at addr ffff88819cb62018 by task systemd-shutdow/1
[ 106.634729]
[ 106.634767] Tainted: [E]=UNSIGNED_MODULE
[ 106.634770] Hardware name: Dell Inc. XPS 16 9640/09CK4V, BIOS 1.12.0 02/10/2025
[ 106.634773] Call Trace:
[ 106.634777] <TASK>
...
[ 106.634871] kasan_report (mm/kasan/report.c:221 mm/kasan/report.c:636)
[ 106.634901] mei_cl_set_disconnected (drivers/misc/mei/client.c:783) mei
[ 106.634921] mei_cl_all_disconnect (drivers/misc/mei/client.c:2165 (discriminator 4)) mei
[ 106.634941] mei_reset (drivers/misc/mei/init.c:163) mei
...
[ 106.635042] mei_stop (drivers/misc/mei/init.c:348) mei
[ 106.635062] mei_vsc_remove (drivers/misc/mei/mei_dev.h:784 drivers/misc/mei/platform-vsc.c:393) mei_vsc
[ 106.635066] platform_remove (drivers/base/platform.c:1424)
Add the missing mei_cldev_disable() calls so that the mei_cl gets removed
from mei_device->file_list before it is freed to fix this.
Fixes: 78876f71b3e9 ("media: pci: intel: ivsc: Add ACE submodule") Fixes: 29006e196a56 ("media: pci: intel: ivsc: Add CSI submodule") Cc: stable@vger.kernel.org Signed-off-by: Hans de Goede <hansg@kernel.org> Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com> Signed-off-by: Hans Verkuil <hverkuil@xs4all.nl>
Update the IMX258 binding to inherit properties defined in the
video-interface-devices binding.
Acked-by: Rob Herring (Arm) <robh@kernel.org> Signed-off-by: Olivier Benjamin <olivier.benjamin@bootlin.com> Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com> Signed-off-by: Hans Verkuil <hverkuil@xs4all.nl>
Update the OV8858 binding to inherit properties defined in the
video-interface-devices binding.
Acked-by: Rob Herring (Arm) <robh@kernel.org> Signed-off-by: Olivier Benjamin <olivier.benjamin@bootlin.com> Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com> Signed-off-by: Hans Verkuil <hverkuil@xs4all.nl>
Sakari Ailus [Thu, 19 Jun 2025 09:21:51 +0000 (12:21 +0300)]
media: v4l2-ctrls: Return the handler's error in v4l2_ctrl_handler_free()
v4l2_ctrl_handler_free() used to return void but changing this to int,
returning the handler's error code, enables the drivers to simply return
the handler's error in this common error handling pattern:
if (handler->error)
return v4l2_ctrl_handler_free(handler);
Suggested-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com> Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com> Reviewed-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com> Reviewed-by: Hans Verkuil <hverkuil@xs4all.nl> Signed-off-by: Hans Verkuil <hverkuil@xs4all.nl>
Sakari Ailus [Thu, 8 May 2025 15:55:38 +0000 (18:55 +0300)]
media: v4l2-ctrls: Don't reset handler's error in v4l2_ctrl_handler_free()
It's a common pattern in drivers to free the control handler's resources
and then return the handler's error code on drivers' error handling paths.
Alas, the v4l2_ctrl_handler_free() function also zeroes the error field,
effectively indicating successful return to the caller.
There's no apparent need to touch the error field while releasing the
control handler's resources and cleaning up stale pointers. Not touching
the handler's error field is a more certain way to address this problem
than changing all the users, in which case the pattern would be likely to
re-emerge in new drivers.
Do just that, don't touch the control handler's error field in
v4l2_ctrl_handler_free().
Fixes: 0996517cf8ea ("V4L/DVB: v4l2: Add new control handling framework") Cc: stable@vger.kernel.org Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com> Reviewed-by: Hans Verkuil <hverkuil@xs4all.nl> Reviewed-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com> Signed-off-by: Hans Verkuil <hverkuil@xs4all.nl>
Jason Chen [Tue, 3 Jun 2025 04:39:23 +0000 (12:39 +0800)]
media: ipu-bridge: Add support for additional link frequencies
Support two additional frequencies for the ov08x40 sensor using 2 lanes
Signed-off-by: Jason Chen <jason.z.chen@intel.com> Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com> Signed-off-by: Hans Verkuil <hverkuil@xs4all.nl>
Replace storage of the active format in the cio2_queue structure with
usage of V4L2 subdev active state. This simplifies locking in the
driver, and drops usage of the deprecated subdev .open() internal
operation.
Signed-off-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
[Sakari Ailus: keep fmt_default non-static to keep clang happy.] Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com> Signed-off-by: Hans Verkuil <hverkuil@xs4all.nl>
Daniel Scally [Tue, 20 May 2025 13:17:46 +0000 (14:17 +0100)]
media: ipu-bridge: Add _HID for OV5670
The OV5670 is found on Dell 7212 tablets paired with an IPU3 ISP
and needs to be connected by the ipu-bridge. Add it to the list
of supported devices.
Signed-off-by: Daniel Scally <dan.scally@ideasonboard.com> Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com> Signed-off-by: Hans Verkuil <hverkuil@xs4all.nl>
Daniel Scally [Tue, 20 May 2025 13:17:45 +0000 (14:17 +0100)]
platform/x86: int3472: Add board data for Dell 7212
The Dell 7212 Rugged Extreme Tablet pairs an OV5670 sensor with the
Intel IPU3 ISP. The sensor is powered by a TPS68470 PMIC, and so we
need some board data to describe how to configure the GPIOs and
regulators to run the sensor.
Signed-off-by: Daniel Scally <dan.scally@ideasonboard.com> Acked-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com> Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com> Signed-off-by: Hans Verkuil <hverkuil@xs4all.nl>
Daniel Scally [Tue, 20 May 2025 13:17:44 +0000 (14:17 +0100)]
media: i2c: Defer ov5670_probe() if endpoint not found
The OV5670 is found on a Dell 7212, coupled to Intel's CIO2 CSI-2
receiver. The ACPI tables don't describe the connection properly and
so this is one of the sensors that needs to wait for the ipu-bridge
to set up the graph with software nodes. Defer probe if an endpoint
isn't found to allow time for that.
Signed-off-by: Daniel Scally <dan.scally@ideasonboard.com> Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com> Signed-off-by: Hans Verkuil <hverkuil@xs4all.nl>
Mathis Foerst [Thu, 22 May 2025 14:35:10 +0000 (16:35 +0200)]
media: mt9m114: Fix deadlock in get_frame_interval/set_frame_interval
Getting / Setting the frame interval using the V4L2 subdev pad ops
get_frame_interval/set_frame_interval causes a deadlock, as the
subdev state is locked in the [1] but also in the driver itself.
In [2] it's described that the caller is responsible to acquire and
release the lock in this case. Therefore, acquiring the lock in the
driver is wrong.
Remove the lock acquisitions/releases from mt9m114_ifp_get_frame_interval()
and mt9m114_ifp_set_frame_interval().
[1] drivers/media/v4l2-core/v4l2-subdev.c - line 1129
[2] Documentation/driver-api/media/v4l2-subdev.rst
Fixes: 24d756e914fc ("media: i2c: Add driver for onsemi MT9M114 camera sensor") Cc: stable@vger.kernel.org Signed-off-by: Mathis Foerst <mathis.foerst@mt.com> Reviewed-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com> Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com> Signed-off-by: Hans Verkuil <hverkuil@xs4all.nl>
Mathis Foerst [Thu, 22 May 2025 14:35:07 +0000 (16:35 +0200)]
media: mt9m114: Factor out mt9m114_configure_pa
The function mt9m114_configure writes the configuration registers of both,
the pixel array (pa) and the image flow processor (ifp).
This is undesirable if only the config of the pa should be changed without
affecting the ifp.
Factor out the function mt9m114_configure_pa() that just writes the
pa-configuration.
Signed-off-by: Mathis Foerst <mathis.foerst@mt.com> Reviewed-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com> Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com> Signed-off-by: Hans Verkuil <hverkuil@xs4all.nl>
Mathis Foerst [Thu, 22 May 2025 14:35:06 +0000 (16:35 +0200)]
media: mt9m114: Bypass PLL if required
The MT9M114 sensor has an internal PLL that generates the required SYSCLK
from EXTCLK. It also has the option to bypass the PLL and use EXTCLK
directly as SYSCLK.
The current driver implementation uses a hardcoded PLL configuration that
requires a specific EXTCLK frequency. Depending on the available clocks,
it can be desirable to use a different PLL configuration or to bypass it.
The link-frequency of the output bus (Parallel or MIPI-CSI) is configured
in the device tree.
Check if EXTCLK can be used as SYSCLK to achieve this link-frequency. If
yes, bypass the PLL.
Otherwise, (as before) check if EXTCLK and the default PLL configuration
provide the required SYSCLK to achieve the link-frequency. If yes, use the
PLL. If no, throw an error.
Signed-off-by: Mathis Foerst <mathis.foerst@mt.com> Reviewed-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com> Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com> Signed-off-by: Hans Verkuil <hverkuil@xs4all.nl>
The MT9M114 supports the different slew rates (0 to 7) on the output pads.
At the moment, this is hardcoded to 7 (the fastest rate).
The user might want to change this values due to EMC requirements.
Add the 'slew-rate' property to the MT9M114 DT-bindings for selecting
the desired slew rate.
Signed-off-by: Mathis Foerst <mathis.foerst@mt.com> Reviewed-by: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org> Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com> Signed-off-by: Hans Verkuil <hverkuil@xs4all.nl>
Martin Hecht [Thu, 15 May 2025 14:51:50 +0000 (16:51 +0200)]
MAINTAINERS: Update my email address to gmail.com
Replace my corporate email address by @gmail.com.
Signed-off-by: Martin Hecht <mhecht73@gmail.com> Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com> Signed-off-by: Hans Verkuil <hverkuil@xs4all.nl>
Deprecate the clock-frequency property in favor of assigned-clock-rates.
While at it, re-order properties according to coding style and fix the
link-frequency in the example. See commit acc294519f17 ("media: i2c:
imx214: Fix link frequency validation").
Reviewed-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com> Acked-by: Conor Dooley <conor.dooley@microchip.com> Signed-off-by: André Apitzsch <git@apitzsch.eu> Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com> Signed-off-by: Hans Verkuil <hverkuil@xs4all.nl>
André Apitzsch [Sat, 24 May 2025 09:14:37 +0000 (11:14 +0200)]
media: i2c: imx214: Prepare for variable clock frequency
Move clock frequency related parameters out of the constant register
sequences, such that the hard coded external clock frequency can be
replaced by a variable in the upcoming patches.
Acked-by: Ricardo Ribalda <ribalda@chromium.org> Reviewed-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com> Signed-off-by: André Apitzsch <git@apitzsch.eu> Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com> Signed-off-by: Hans Verkuil <hverkuil@xs4all.nl>
Matthias Fend [Wed, 14 May 2025 10:51:01 +0000 (12:51 +0200)]
media: i2c: imx415: Request the sensor clock without a name
Request the sensor clock without specifying a name so that the driver
behaves as described in the imx415 bindings.
Signed-off-by: Matthias Fend <matthias.fend@emfend.at> Reviewed-by: Jai Luthra <jai.luthra@ideasonboard.com> Reviewed-by: Michael Riesch <michael.riesch@collabora.com> Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com> Signed-off-by: Hans Verkuil <hverkuil@xs4all.nl>
Hans de Goede [Wed, 14 May 2025 16:37:54 +0000 (18:37 +0200)]
media: ipu-bridge: Add link-frequency to the GC0310 entry
Add the missing link-frequency to the ipu_supported_sensors[] array's
Galaxy Core GC0310 entry.
Signed-off-by: Hans de Goede <hdegoede@redhat.com> Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com> Signed-off-by: Hans Verkuil <hverkuil@xs4all.nl>
media: v4l2-common: Reduce warnings about missing V4L2_CID_LINK_FREQ control
When operating a pipeline with a missing V4L2_CID_LINK_FREQ control this
two line warning is printed each time the pipeline is started. Reduce
this excessive logging by only warning once for the missing control.
Signed-off-by: Niklas Söderlund <niklas.soderlund+renesas@ragnatech.se> Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com> Signed-off-by: Hans Verkuil <hverkuil@xs4all.nl>
Sakari Ailus [Fri, 18 Oct 2024 12:20:08 +0000 (15:20 +0300)]
media: dt-bindings: mipi-ccs: Refer to video-interface-devices.yaml
Refer to video-interface-devices.yaml instead of documenting the common
properties here.
Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com> Acked-by: Rob Herring (Arm) <robh@kernel.org> Signed-off-by: Hans Verkuil <hverkuil@xs4all.nl>
Cosmin Tanislav [Fri, 13 Jun 2025 11:21:52 +0000 (14:21 +0300)]
media: rc: ir-spi: constrain carrier frequency
Carrier frequency is currently unconstrained, allowing the SPI transfer
to be allocated and filled only for it to be later rejected by the SPI
controller since the frequency is too large.
Add a check to constrain the carrier frequency inside
ir_spi_set_tx_carrier().
Also, move the number of bits per pulse to a macro since it is not used
in multiple places.
Signed-off-by: Cosmin Tanislav <demonsingur@gmail.com> Signed-off-by: Sean Young <sean@mess.org> Signed-off-by: Hans Verkuil <hverkuil@xs4all.nl>
Cosmin Tanislav [Fri, 13 Jun 2025 11:21:51 +0000 (14:21 +0300)]
media: rc: ir-spi: allocate buffer dynamically
Replace the static transmit buffer with a dynamically allocated one,
removing the limit imposed on the number of pulses to transmit.
Calculate the number of pulses for each duration in the received buffer
ahead of time, while also adding up the total pulses, to be able to
allocate a buffer that perfectly fits the total number of pulses, then
populate it.
Signed-off-by: Cosmin Tanislav <demonsingur@gmail.com> Signed-off-by: Sean Young <sean@mess.org> Signed-off-by: Hans Verkuil <hverkuil@xs4all.nl>
The `separate_colour_plane_flag` element is only present in the SPS if
`chroma_format_idc == 3`, so the corresponding flag should be disabled
whenever that is not the case and not just on profiles where
`chroma_format_idc` is not present.
Fixes: b32e48503df0 ("media: controls: Validate H264 stateless controls") Signed-off-by: James Cowgill <james.cowgill@blaize.com> Signed-off-by: Nicolas Dufresne <nicolas.dufresne@collabora.com> Signed-off-by: Hans Verkuil <hverkuil@xs4all.nl>
Frank Li [Wed, 21 May 2025 17:34:03 +0000 (13:34 -0400)]
media: dt-bindings: nxp,imx8-jpeg: Add compatible strings for IMX95 JPEG
Add compatible strings "nxp,imx95-jpgdec" and "nxp,imx95-jpgenc", which
are backward compatible with "nxp,imx8qxp-jpgdec" and
"nxp,imx8qxp-jpegenc". i.MX95 just need one power domain which combine
wrap and all slots together. Reduce minItems of power-domains to 1 for
i.MX95 and keep the same restriction for others.
Reviewed-by: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org> Signed-off-by: Frank Li <Frank.Li@nxp.com> Signed-off-by: Nicolas Dufresne <nicolas.dufresne@collabora.com> Signed-off-by: Hans Verkuil <hverkuil@xs4all.nl>
Haoxiang Li [Thu, 27 Feb 2025 07:44:51 +0000 (15:44 +0800)]
media: imx: fix a potential memory leak in imx_media_csc_scaler_device_init()
Add video_device_release() in label 'err_m2m' to release the memory
allocated by video_device_alloc() and prevent potential memory leaks.
Remove the reduntant code in label 'err_m2m'.
Fixes: a8ef0488cc59 ("media: imx: add csc/scaler mem2mem device") Cc: stable@vger.kernel.org Signed-off-by: Haoxiang Li <haoxiang_li2024@163.com> Reviewed-by: Dan Carpenter <dan.carpenter@linaro.org> Signed-off-by: Nicolas Dufresne <nicolas.dufresne@collabora.com> Signed-off-by: Hans Verkuil <hverkuil@xs4all.nl>
On errors, the rkvdec chip self resets. This can clear the addresses
programmed in the iommu. This case is signaled by the
RKVDEC_SOFTRESET_RDY status bit.
Since the iommu framework does not have a restore functionality, and
as recommended by the iommu subsystem maintainers, this patch
restores the iommu programming by attaching and detaching an empty
domain, which will clear and restore the default domain.
Suggested-by: Detlev Casanova <detlev.casanova@collabora.com> Tested-by: Detlev Casanova <detlev.casanova@collabora.com> Reviewed-by: Detlev Casanova <detlev.casanova@collabora.com> Signed-off-by: Nicolas Dufresne <nicolas.dufresne@collabora.com> Signed-off-by: Hans Verkuil <hverkuil@xs4all.nl>
Nicolas Dufresne [Mon, 17 Feb 2025 21:46:54 +0000 (16:46 -0500)]
media: verisilicon: Fix AV1 decoder clock frequency
The desired clock frequency was correctly set to 400MHz in the device tree
but was lowered by the driver to 300MHz breaking 4K 60Hz content playback.
Fix the issue by removing the driver call to clk_set_rate(), which reduce
the amount of board specific code.
Fixes: 003afda97c65 ("media: verisilicon: Enable AV1 decoder on rk3588") Cc: stable@vger.kernel.org Reviewed-by: Benjamin Gaignard <benjamin.gaignard@collabora.com> Reviewed-by: Philipp Zabel <p.zabel@pengutronix.de> Signed-off-by: Nicolas Dufresne <nicolas.dufresne@collabora.com> Signed-off-by: Hans Verkuil <hverkuil@xs4all.nl>
Jernej Skrabec [Fri, 23 May 2025 15:43:59 +0000 (17:43 +0200)]
media: cedrus: Add support for additional output formats
If VPU supports untiled output, it actually supports several different
YUV 4:2:0 layouts, namely NV12, NV21, YUV420 and YVU420.
Add support for all of them.
Signed-off-by: Jernej Skrabec <jernej.skrabec@siol.net> Reviewed-by: Paul Kocialkowski <paulk@sys-base.io> Signed-off-by: Nicolas Dufresne <nicolas.dufresne@collabora.com> Signed-off-by: Hans Verkuil <hverkuil@xs4all.nl>
[hverkuil: add 'default' case to switch to fix warning with old compiler]
Frank Li [Fri, 11 Apr 2025 21:36:00 +0000 (17:36 -0400)]
dt-bindings: media: convert fsl-vdoa.txt to yaml format
Convert fsl-vdoa.txt to yaml format.
Additional changes:
- Add irq.h and imx6qdl-clock.h in example.
Signed-off-by: Frank Li <Frank.Li@nxp.com> Reviewed-by: Rob Herring (Arm) <robh@kernel.org> Signed-off-by: Nicolas Dufresne <nicolas.dufresne@collabora.com> Signed-off-by: Hans Verkuil <hverkuil@xs4all.nl>
Ming Qian [Wed, 21 May 2025 01:54:07 +0000 (09:54 +0800)]
media: imx-jpeg: Account for data_offset when getting image address
Applications may set data_offset when it refers to an output queue. So
driver need to account for it when getting the start address of input
image in the plane.
Meanwhile the mxc-jpeg codec requires the address (plane address +
data_offset) to be 16-aligned.
Fixes: 2db16c6ed72c ("media: imx-jpeg: Add V4L2 driver for i.MX8 JPEG Encoder/Decoder") Signed-off-by: Ming Qian <ming.qian@oss.nxp.com> Reviewed-by: Frank Li <Frank.Li@nxp.com> Signed-off-by: Nicolas Dufresne <nicolas.dufresne@collabora.com> Signed-off-by: Hans Verkuil <hverkuil@xs4all.nl>
Ming Qian [Mon, 12 May 2025 02:01:36 +0000 (10:01 +0800)]
media: amphion: Add H264 and HEVC profile and level control
For format H264 and HEVC, the firmware can report the parsed profile idc
and level idc to driver, these information may be useful.
Implement the H264 and HEVC profile and level control to report them.
Signed-off-by: Ming Qian <ming.qian@oss.nxp.com> Signed-off-by: Nicolas Dufresne <nicolas.dufresne@collabora.com> Signed-off-by: Hans Verkuil <hverkuil@xs4all.nl>
Frank Li [Thu, 22 May 2025 17:56:48 +0000 (13:56 -0400)]
media: imx8mq-mipi-csi2: Add support for i.MX8QXP
Add support for i.MX8QXP, which has a dedicated control and status register
(CSR) space. Enable obtaining the second register space and initializing
PHY and link settings accordingly.
Reviewed-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com> Signed-off-by: Frank Li <Frank.Li@nxp.com> Link: https://lore.kernel.org/r/20250522-8qxp_camera-v5-10-d4be869fdb7e@nxp.com Signed-off-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com> Signed-off-by: Hans Verkuil <hverkuil@xs4all.nl>
Add compatible strings for i.MX8QM/i.MX8QXP platform. Remove
fsl,mipi-phy-gpr from required properties and add new reg space, since
i.MX8QM and i.MX8QXP use dedicate control and status register(csr) space.
Keep the same restriction for other compatible strings.
Signed-off-by: Robert Chiras <robert.chiras@nxp.com> Reviewed-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com> Reviewed-by: Rob Herring (Arm) <robh@kernel.org> Signed-off-by: Frank Li <Frank.Li@nxp.com> Link: https://lore.kernel.org/r/20250522-8qxp_camera-v5-8-d4be869fdb7e@nxp.com Signed-off-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com> Signed-off-by: Hans Verkuil <hverkuil@xs4all.nl>
Frank Li [Thu, 22 May 2025 17:56:41 +0000 (13:56 -0400)]
media: nxp: imx8-isi: Remove unused offset in mxc_isi_reg and use BIT() macro for mask
Preserve clarity by removing the unused 'offset' field in struct
mxc_isi_reg, as it duplicates information already indicated by the mask
and remains unused.
Improve readability by replacing hex value masks with the BIT() macro.
No functional change.
Reviewed-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com> Signed-off-by: Frank Li <Frank.Li@nxp.com> Link: https://lore.kernel.org/r/20250522-8qxp_camera-v5-3-d4be869fdb7e@nxp.com Signed-off-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com> Signed-off-by: Hans Verkuil <hverkuil@xs4all.nl>
Frank Li [Thu, 22 May 2025 17:56:40 +0000 (13:56 -0400)]
media: nxp: imx8-isi: Allow num_sources to be greater than num_sink
Allow num_sources (drvdata: num_channels) to be greater than num_sink
(drvdata: num_ports + 1).
ISI support stream multiplexing, such as differentiates multiple cameras
from a single 2-lane MIPI input, or duplicates input stream into multiple
outputs. So num_channels may be greater than num_ports at some platform.
Reviewed-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com> Signed-off-by: Frank Li <Frank.Li@nxp.com> Link: https://lore.kernel.org/r/20250522-8qxp_camera-v5-2-d4be869fdb7e@nxp.com Signed-off-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com> Signed-off-by: Hans Verkuil <hverkuil@xs4all.nl>
Frank Li [Thu, 22 May 2025 17:56:39 +0000 (13:56 -0400)]
media: dt-bindings: Add binding doc for i.MX8QXP and i.MX8QM ISI
Add binding documentation for i.MX8QXP and i.MX8QM ISI. The clock-names,
power-domains, and ports differ significantly from the existing
nxp,imx8-isi.yaml. Create a new file to avoid complex if-else branches.
media: imx-mipi-csis: Use CSI-2 data type macros from mipi-csi2.h
The imx-mipi-csis defines custom macros for the CSI-2 data types,
duplicating the centralized macros defines in mipi-csi2.h. Replace them
with the latter.
Reviewed-by: Rui Miguel Silva <rui.silva@linaro.org> Reviewed-by: Stefan Klug <stefan.klug@ideasonboard.com> Reviewed-by: Frank Li <Frank.Li@nxp.com> Link: https://lore.kernel.org/r/20250606090533.10711-1-laurent.pinchart@ideasonboard.com Signed-off-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com> Signed-off-by: Hans Verkuil <hverkuil@xs4all.nl>
Jai Luthra [Tue, 10 Jun 2025 12:25:27 +0000 (17:55 +0530)]
media: rockchip: rkisp1: Add support for Wide Dynamic Range
RKISP supports a basic Wide Dynamic Range (WDR) module since the first
iteration (v1.0) of the ISP. Add support for enabling and configuring it
using extensible parameters.
Also, to ease programming, switch to using macro variables for defining
the tonemapping curve register addresses.
Reviewed-by: Stefan Klug <stefan.klug@ideasonboard.com> Tested-by: Stefan Klug <stefan.klug@ideasonboard.com> Reviewed-by: Paul Elder <paul.elder@ideasonboard.com> Reviewed-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com> Signed-off-by: Jai Luthra <jai.luthra@ideasonboard.com> Link: https://lore.kernel.org/r/20250610-wdr-latest-v4-1-b69d0ac17ce9@ideasonboard.com Signed-off-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com> Signed-off-by: Hans Verkuil <hverkuil@xs4all.nl>
Stefan Klug [Fri, 23 May 2025 15:14:31 +0000 (17:14 +0200)]
media: rkisp1: Add RKISP1_CID_SUPPORTED_PARAMS_BLOCKS control
Add a RKISP1_CID_SUPPORTED_PARAMS_BLOCKS V4L2 control to be able to
query the parameters blocks supported by the current kernel on the
current hardware from user space.
Signed-off-by: Stefan Klug <stefan.klug@ideasonboard.com> Reviewed-by: Paul Elder <paul.elder@ideasonboard.com> Reviewed-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com> Link: https://lore.kernel.org/r/20250523-supported-params-and-wdr-v3-2-7283b8536694@ideasonboard.com Signed-off-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com> Signed-off-by: Hans Verkuil <hverkuil@xs4all.nl>
Stefan Klug [Fri, 23 May 2025 15:14:30 +0000 (17:14 +0200)]
media: rkisp1: Properly handle result of rkisp1_params_init_vb2_queue()
Properly handle the return of rkisp1_params_init_vb2_queue(). It is very
unlikely that this ever fails without code changes but should be handled
anyways.
While at it rename the error label for easier extension in the upcoming
patch.
media: nxp: imx8-isi: Simplify a couple of error messages
The error messages in the mxc_isi_crossbar_enable_streams() and
mxc_isi_crossbar_disable_streams() functions are similar, with a single
word difference between them. The word is moved out of the format string
to a separate dev_err() argument to try and save memory through string
de-duplication. The total savings are however small, as the .data size
reduction is partly offset by a .text size increase, with a total saving
of 8 bytes in total on an ARM64 platforms. They also come at the cost of
making the error message difficult to grep, which outweights the gains.
Simplify the error messages to make them grep-able.
Signed-off-by: Krzysztof Hałasa <khalasa@piap.pl> Reviewed-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com> Link: https://lore.kernel.org/r/m3plgi9pwu.fsf@t19.piap.pl Signed-off-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com> Signed-off-by: Hans Verkuil <hverkuil@xs4all.nl>
Jacopo Mondi [Tue, 17 Jun 2025 07:23:28 +0000 (09:23 +0200)]
media: vsp1: Add VSPX support
Add support for VSPX, a specialized version of the VSP2 that
transfers data to the ISP. The VSPX is composed of two RPF units
to read data from external memory and an IIF instance that performs
transfer towards the ISP.
The VSPX is supported through a newly introduced vsp1_vspx.c file that
exposes two interfaces: vsp1_vspx interface, declared in vsp1_vspx.h
for the vsp1 core to initialize and cleanup the VSPX, and a vsp1_isp
interface, declared in include/media/vsp1.h for the ISP driver to
control the VSPX operations.
Jacopo Mondi [Mon, 16 Jun 2025 16:30:38 +0000 (18:30 +0200)]
media: vsp1: vsp1_dl: Count display lists
To detect leaks of display lists, store in the display list manager the
number of allocated display lists when the manager is created and verify
that when the display manager is reset the same number of lists is
available in the free list.
Jacopo Mondi [Mon, 16 Jun 2025 16:30:37 +0000 (18:30 +0200)]
media: vsp1: vsp1_dl: Detect double list release
In order to detect invalid usage pattern such as double list_put()
calls, add an 'allocated' flag to each display list. Set the flag
whenever a list is get() and clear it when the list is put(). Warn if a
list not marked as allocated is returned to the pool of available
display lists.
Koji Matsuoka [Mon, 16 Jun 2025 12:14:25 +0000 (14:14 +0200)]
media: vsp1: Reset FCP after VSPD
According to the R-Car Gen3 H/W manual v2.40, and R-Car Gen4 H/W manual
v1.20, the FCP must be reset after resetting the VSPD, except for the
VSPDL. Do so.
Jacopo Mondi [Mon, 16 Jun 2025 12:14:24 +0000 (14:14 +0200)]
media: rcar-fcp: Add rcar_fcp_soft_reset()
Add a function to perform soft reset of the FCP.
It is intended to support the correct stop procedure of the VSPX-FCPVX
and VSPD-FCPD pairs according to section "62.3.7.3 Reset Operation" of
the R-Car Hardware Manual at revision 1.20.
Niklas Söderlund [Mon, 16 Jun 2025 18:57:22 +0000 (20:57 +0200)]
media: rcar-vin: Generate FRAME_SYNC events
Enable the VSYNC Rising Edge Detection interrupt and generate a
FRAME_SYNC event form it. The interrupt is available on all supported
models of the VIN (Gen2, Gen3 and Gen4).
Niklas Söderlund [Mon, 16 Jun 2025 18:57:21 +0000 (20:57 +0200)]
media: rcar-vin: Check for correct capture interrupt event
Depending on if the capture session deals with fields or whole frames
interrupts can be generated at an end of field, or end of frame event.
The interrupt mask is setup to generate an interrupt on one of the two
events depending on what is needed when the VIN is started. The end of
field bit is set in both cases so controlling the mask that generates an
interrupt have been enough to control the two use-cases.
Before extending the interrupt handler to deal with other types of
interrupt events it is needs to extended to "capture complete" check for
correct the use-case in operation. Without this the simplification in
the handler can result in corrupted frames when the mask on what type of
events can generate an interrupt generated can no longer be assumed to
only be an "capture complete" event.
Which bit is checked matches which bit is enabled at configuration time
as which event can generate an interrupt for "capture complete". There
is no functional change.
While at it switch to use the BIT() macro to describe the bit positions
for the interrupt functions.
Niklas Söderlund [Mon, 16 Jun 2025 18:57:20 +0000 (20:57 +0200)]
media: rcar-vin: Fold interrupt helpers into only callers
The call sites using the interrupt helper functions have all been
reworked to only one for each. Fold each of them into the only call
sites left.
This fixes a possible interrupt loss in case an interrupt occurs between
reading VNINTS_REG in rvin_get_interrupt_status() and reading it again
in rvin_ack_interrupt().
While at it rename the variable holding the current interrupt status to
make the code easier to read.
Kuan-Wei Chiu [Thu, 15 May 2025 08:11:09 +0000 (16:11 +0800)]
media: saa7115: Replace open-coded parity calculation with parity8()
Refactor parity calculations to use the standard parity8() helper.
This change eliminates redundant implementations.
Co-developed-by: Yu-Chun Lin <eleanor15x@gmail.com> Signed-off-by: Yu-Chun Lin <eleanor15x@gmail.com> Signed-off-by: Kuan-Wei Chiu <visitorckw@gmail.com> Reviewed-by: Hans Verkuil <hverkuil@xs4all.nl> Signed-off-by: Hans Verkuil <hverkuil@xs4all.nl>
Kuan-Wei Chiu [Thu, 15 May 2025 08:09:33 +0000 (16:09 +0800)]
media: pci: cx18-av-vbi: Replace open-coded parity calculation with parity8()
Refactor parity calculations to use the standard parity8() helper.
This change eliminates redundant implementations.
Co-developed-by: Yu-Chun Lin <eleanor15x@gmail.com> Signed-off-by: Yu-Chun Lin <eleanor15x@gmail.com> Signed-off-by: Kuan-Wei Chiu <visitorckw@gmail.com> Reviewed-by: Hans Verkuil <hverkuil@xs4all.nl> Signed-off-by: Hans Verkuil <hverkuil@xs4all.nl>
Kuan-Wei Chiu [Thu, 15 May 2025 08:07:48 +0000 (16:07 +0800)]
media: media/test_drivers: Replace open-coded parity calculation with parity8()
Refactor parity calculations to use the standard parity8() helper.
This change eliminates redundant implementations.
Co-developed-by: Yu-Chun Lin <eleanor15x@gmail.com> Signed-off-by: Yu-Chun Lin <eleanor15x@gmail.com> Signed-off-by: Kuan-Wei Chiu <visitorckw@gmail.com> Reviewed-by: Hans Verkuil <hverkuil@xs4all.nl> Signed-off-by: Hans Verkuil <hverkuil@xs4all.nl>
The driver checks if "vq->max_num_buffers + *nbuffers < 3", but
vq->max_num_buffers is (by default) 32, so the check is never true. Nor
does the check make sense.
The original code in the BSP kernel was "vq->num_buffers + *nbuffers <
3", but got mangled along the way to upstream. The intention was to make
sure that at least 3 buffers are allocated.
Fix this by removing the bad lines and setting q->min_reqbufs_allocation
to three.
Signed-off-by: Tomi Valkeinen <tomi.valkeinen@ideasonboard.com> Reviewed-by: Hans Verkuil <hverkuil@xs4all.nl> Signed-off-by: Hans Verkuil <hverkuil@xs4all.nl>
Dave Stevenson [Wed, 11 Jun 2025 18:37:16 +0000 (19:37 +0100)]
media: tc358743: Return an appropriate colorspace from tc358743_set_fmt
When calling tc358743_set_fmt, the code was calling tc358743_get_fmt
to choose a valid format. However that sets the colorspace
based on information read back from the chip, not the colour
format requested.
The result was that if you called try or set format for UYVY
when the current format was RGB3 then you would get told SRGB,
and try RGB3 when current was UYVY and you would get told
SMPTE170M.
The value programmed in the VI_REP register for the colorspace
is always set by this driver, therefore there is no need to read
back the value, and never set to REC709.
Return the colorspace based on the format set/tried instead.
Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com> Signed-off-by: Hans Verkuil <hverkuil@xs4all.nl>
Dave Stevenson [Wed, 11 Jun 2025 18:37:15 +0000 (19:37 +0100)]
media: tc358743: Check I2C succeeded during probe
The probe for the TC358743 reads the CHIPID register from
the device and compares it to the expected value of 0.
If the I2C request fails then that also returns 0, so
the driver loads thinking that the device is there.
Generally I2C communications are reliable so there is
limited need to check the return value on every transfer,
therefore only amend the one read during probe to check
for I2C errors.
Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com> Signed-off-by: Hans Verkuil <hverkuil@xs4all.nl>
Dave Stevenson [Wed, 11 Jun 2025 18:37:14 +0000 (19:37 +0100)]
media: tc358743: Increase FIFO trigger level to 374
The existing fixed value of 16 worked for UYVY 720P60 over
2 lanes at 594MHz, or UYVY 1080P60 over 4 lanes. (RGB888
1080P60 needs 6 lanes at 594MHz).
It doesn't allow for lower resolutions to work as the FIFO
underflows.
374 is required for 1080P24 or 1080P30 UYVY over 2 lanes @
972Mbit/s, but >374 means that the FIFO underflows on 1080P50
UYVY over 2 lanes @ 972Mbit/s.
Whilst it would be nice to compute it, the required information
isn't published by Toshiba.
Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com> Signed-off-by: Hans Verkuil <hverkuil@xs4all.nl>
vpdma_update_dma_addr() was added in 2016 as part of
commit 2f88703a0bfd ("[media] media: ti-vpe: vpdma: Add multi-instance and
multi-client support")
but has remained unused.
Remove it.
I did see that there was a VIP driver submitted in 2020 that
doesn't seem to have got merged which did use this (and a bunch
of other unused functions).
Signed-off-by: Dr. David Alan Gilbert <linux@treblig.org> Signed-off-by: Hans Verkuil <hverkuil@xs4all.nl>
The functions:
vpu_color_get_default()
vpu_color_check_full_range()
vpu_color_check_primaries()
vpu_color_check_transfers()
vpu_color_check_matrix()
have been unused since 2022's
commit 1925665ef403 ("media: amphion: remove redundant check of
colorspace in venc_s_fmt")
The (empty) function vpu_mbox_enable_rx() has been unused since it
was added in 2022 by the
commit 61cbf1c1fa6d ("media: amphion: implement vpu core communication
based on mailbox")
Remove them.
Signed-off-by: Dr. David Alan Gilbert <linux@treblig.org> Signed-off-by: Hans Verkuil <hverkuil@xs4all.nl>
media: exynos4-is: fimc-is: Fully open-code compatible for grepping
It is very useful to find driver implementing compatibles with `git grep
compatible`, so driver should not use defines for that string, even if
this means string will be effectively duplicated.
Signed-off-by: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org> Signed-off-by: Hans Verkuil <hverkuil@xs4all.nl>
Gui-Dong Han [Fri, 6 Jun 2025 03:04:59 +0000 (03:04 +0000)]
media: rainshadow-cec: fix TOCTOU race condition in rain_interrupt()
In the interrupt handler rain_interrupt(), the buffer full check on
rain->buf_len is performed before acquiring rain->buf_lock. This
creates a Time-of-Check to Time-of-Use (TOCTOU) race condition, as
rain->buf_len is concurrently accessed and modified in the work
handler rain_irq_work_handler() under the same lock.
Multiple interrupt invocations can race, with each reading buf_len
before it becomes full and then proceeding. This can lead to both
interrupts attempting to write to the buffer, incrementing buf_len
beyond its capacity (DATA_SIZE) and causing a buffer overflow.
Fix this bug by moving the spin_lock() to before the buffer full
check. This ensures that the check and the subsequent buffer modification
are performed atomically, preventing the race condition. An corresponding
spin_unlock() is added to the overflow path to correctly release the
lock.
This possible bug was found by an experimental static analysis tool
developed by our team.
Fixes: 0f314f6c2e77 ("[media] rainshadow-cec: new RainShadow Tech HDMI CEC driver") Cc: stable@vger.kernel.org Signed-off-by: Gui-Dong Han <hanguidong02@gmail.com> Signed-off-by: Hans Verkuil <hverkuil@xs4all.nl>
Martin Tůma [Mon, 2 Jun 2025 09:27:51 +0000 (11:27 +0200)]
media: mgb4: Enumerate only the available timings
Enumerate only the available (as given by the sysfs setup - our "EDID
replacement") timings, not all theoretically possible. This is the video
outputs part of the previous inputs patch that somehow got "lost in
translation".
Signed-off-by: Martin Tůma <martin.tuma@digiteqautomotive.com> Signed-off-by: Hans Verkuil <hverkuil@xs4all.nl>
Dan Carpenter [Wed, 28 May 2025 20:22:14 +0000 (23:22 +0300)]
media: gspca: Add bounds checking to firmware parser
This sd_init() function reads the firmware. The firmware data holds a
series of records and the function reads each record and sends the data
to the device. The request_ihex_firmware() function
calls ihex_validate_fw() which ensures that the total length of all the
records won't read out of bounds of the fw->data[].
However, a potential issue is if there is a single very large
record (larger than PAGE_SIZE) and that would result in memory
corruption. Generally we trust the firmware, but it's always better to
double check.
Fixes: 49b61ec9b5af ("[media] gspca: Add new vicam subdriver") Cc: stable@vger.kernel.org Signed-off-by: Dan Carpenter <dan.carpenter@linaro.org> Signed-off-by: Hans Verkuil <hverkuil@xs4all.nl>
Andy Shevchenko [Wed, 28 May 2025 11:32:04 +0000 (14:32 +0300)]
media: cx18: Replace custom implementation of list_entry_is_head()
Besides list_entry_is_past_end() is the same as list_entry_is_head(),
it's implemented in the list namespace. Fix both of the issue by replacing
the custom version with list_entry_is_head() calls.
Signed-off-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com> Signed-off-by: Hans Verkuil <hverkuil@xs4all.nl>
Wolfram Sang [Thu, 22 May 2025 08:09:55 +0000 (10:09 +0200)]
media: usb: hdpvr: use I2C core to handle only supported messages
The HW can only do write-then-read transactions. This is a common
limitation, so we can add an adapter quirk flag to let the I2C core
enforce the checks instead of open coding them.
Signed-off-by: Wolfram Sang <wsa+renesas@sang-engineering.com> Signed-off-by: Hans Verkuil <hverkuil@xs4all.nl>
This driver passes the length of an i2c_msg directly to
usb_control_msg(). If the message is now a read and of length 0, it
violates the USB protocol and a warning will be printed. Enable the
I2C_AQ_NO_ZERO_LEN_READ quirk for this adapter thus forbidding 0-length
read messages altogether.
Signed-off-by: Wolfram Sang <wsa+renesas@sang-engineering.com> Signed-off-by: Hans Verkuil <hverkuil@xs4all.nl>
projects / thirdparty / linux.git / log
