4392 Commits

Author SHA1 Message Date
Linus Torvalds
d7aa60d966 Merge tag 'media/v6.19-1' of git://git.kernel.org/pub/scm/linux/kernel/git/mchehab/linux-media
Pull media updates from Mauro Carvalho Chehab:

 - New drivers:
    - Mali-C55 ISP
    - Rockchip VICAP (RKCIF)
    - RKVDEC HEVC Decoder
    - Renesas RZV2H IVC
    - Sony IMX111 CMOS sensor driver

 - Removed STi C8SECTPFE Driver

 - Added a V4L2 ISP generic framework

 - Usual set of cleanup, fixes and driver improvements

* tag 'media/v6.19-1' of git://git.kernel.org/pub/scm/linux/kernel/git/mchehab/linux-media: (249 commits)
  media: rockchip: rkcif: add support for rk3568 vicap mipi capture
  media: rockchip: rkcif: add support for rk3568 vicap dvp capture
  media: rockchip: rkcif: add support for px30 vip dvp capture
  media: rockchip: rkcif: add abstraction for dma blocks
  media: rockchip: rkcif: add abstraction for interface and crop blocks
  media: rockchip: add driver for the rockchip camera interface
  media: dt-bindings: add rockchip rk3568 vicap
  media: dt-bindings: add rockchip px30 vip
  media: dt-bindings: video-interfaces: add defines for sampling modes
  Documentation: admin-guide: media: add rockchip camera interface
  media: mali-c55: Mark pm handlers as __maybe_unused
  media: mali-c55: Assert ISP blocks size correctness
  media: v4l2-isp: Rename block_info to block_type_info
  MAINTAINERS: Add entry for rzv2h-ivc driver
  media: platform: Add Renesas Input Video Control block driver
  dt-bindings: media: Add bindings for the RZ/V2H(P) IVC block
  Documentation: media: mali-c55: Document the mali-c55 parameter setting
  media: platform: Add mali-c55 parameters video node
  media: uapi: Add parameters structs to mali-c55-config.h
  media: mali-c55: Add image formats for Mali-C55 parameters buffer
  ...
2025-12-04 08:15:19 -08:00
Linus Torvalds
4d38b88fd1 Merge tag 'printk-for-6.19' of git://git.kernel.org/pub/scm/linux/kernel/git/printk/linux
Pull printk updates from Petr Mladek:

 - Allow creaing nbcon console drivers with an unsafe write_atomic()
   callback that can only be called by the final nbcon_atomic_flush_unsafe().
   Otherwise, the driver would rely on the kthread.

   It is going to be used as the-best-effort approach for an
   experimental nbcon netconsole driver, see

     https://lore.kernel.org/r/20251121-nbcon-v1-2-503d17b2b4af@debian.org

   Note that a safe .write_atomic() callback is supposed to work in NMI
   context. But some networking drivers are not safe even in IRQ
   context:

     https://lore.kernel.org/r/oc46gdpmmlly5o44obvmoatfqo5bhpgv7pabpvb6sjuqioymcg@gjsma3ghoz35

   In an ideal world, all networking drivers would be fixed first and
   the atomic flush would be blocked only in NMI context. But it brings
   the question how reliable networking drivers are when the system is
   in a bad state. They might block flushing more reliable serial
   consoles which are more suitable for serious debugging anyway.

 - Allow to use the last 4 bytes of the printk ring buffer.

 - Prevent queuing IRQ work and block printk kthreads when consoles are
   suspended. Otherwise, they create non-necessary churn or even block
   the suspend.

 - Release console_lock() between each record in the kthread used for
   legacy consoles on RT. It might significantly speed up the boot.

 - Release nbcon context between each record in the atomic flush. It
   prevents stalls of the related printk kthread after it has lost the
   ownership in the middle of a record

 - Add support for NBCON consoles into KDB

 - Add %ptsP modifier for printing struct timespec64 and use it where
   possible

 - Misc code clean up

* tag 'printk-for-6.19' of git://git.kernel.org/pub/scm/linux/kernel/git/printk/linux: (48 commits)
  printk: Use console_is_usable on console_unblank
  arch: um: kmsg_dump: Use console_is_usable
  drivers: serial: kgdboc: Drop checks for CON_ENABLED and CON_BOOT
  lib/vsprintf: Unify FORMAT_STATE_NUM handlers
  printk: Avoid irq_work for printk_deferred() on suspend
  printk: Avoid scheduling irq_work on suspend
  printk: Allow printk_trigger_flush() to flush all types
  tracing: Switch to use %ptSp
  scsi: snic: Switch to use %ptSp
  scsi: fnic: Switch to use %ptSp
  s390/dasd: Switch to use %ptSp
  ptp: ocp: Switch to use %ptSp
  pps: Switch to use %ptSp
  PCI: epf-test: Switch to use %ptSp
  net: dsa: sja1105: Switch to use %ptSp
  mmc: mmc_test: Switch to use %ptSp
  media: av7110: Switch to use %ptSp
  ipmi: Switch to use %ptSp
  igb: Switch to use %ptSp
  e1000e: Switch to use %ptSp
  ...
2025-12-03 12:42:36 -08:00
Josh Poimboeuf
2c715c9de2 media: atomisp: gc2235: Fix namespace collision and startup() section placement with -ffunction-sections
When compiled with -ffunction-sections (e.g., for LTO, livepatch, dead
code elimination, AutoFDO, or Propeller), the startup() function gets
compiled into the .text.startup section (or in some cases
.text.startup.constprop.0 or .text.startup.isra.0).

However, the .text.startup and .text.startup.* sections are also used by
the compiler for __attribute__((constructor)) code.

This naming conflict causes the vmlinux linker script to wrongly place
startup() function code in .init.text, which gets freed during boot.

Some builds have a mix of objects, both with and without
-ffunctions-sections, so it's not possible for the linker script to
disambiguate with #ifdef CONFIG_FUNCTION_SECTIONS or similar.  This
means that "startup" unfortunately needs to be prohibited as a function
name.

Rename startup() to gc2235_startup().

Signed-off-by: Josh Poimboeuf <jpoimboe@kernel.org>
Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
Acked-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Link: https://patch.msgid.link/d28103a6edf7beceb5e3c6fa24e49dbad1350389.1763669451.git.jpoimboe@kernel.org
2025-11-21 10:04:09 +01:00
Andy Shevchenko
5a1df7219d media: av7110: Switch to use %ptSp
Use %ptSp instead of open coded variants to print content of
struct timespec64 in human readable format.

Acked-by: Hans Verkuil <hverkuil+cisco@kernel.org>
Signed-off-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
Link: https://patch.msgid.link/20251113150217.3030010-13-andriy.shevchenko@linux.intel.com
Signed-off-by: Petr Mladek <pmladek@suse.com>
2025-11-19 12:26:06 +01:00
Josh Poimboeuf
56255fa968 media: atomisp: Fix namespace collision and startup() section placement with -ffunction-sections
When compiling the kernel with -ffunction-sections (e.g., for LTO,
livepatch, dead code elimination, AutoFDO, or Propeller), the startup()
function gets compiled into the .text.startup section.  In some cases it
can even be cloned into .text.startup.constprop.0 or
.text.startup.isra.0.

However, the .text.startup and .text.startup.* section names are already
reserved for use by the compiler for __attribute__((constructor)) code.

This naming conflict causes the vmlinux linker script to wrongly place
startup() function code in .init.text, which gets freed during boot.

Fix that by renaming startup() to ov2722_startup().

Fixes: 6568f14cb5 ("vmlinux.lds: Exclude .text.startup and .text.exit from TEXT_MAIN")
Signed-off-by: Josh Poimboeuf <jpoimboe@kernel.org>
Signed-off-by: Ingo Molnar <mingo@kernel.org>
Cc: Peter Zijlstra <peterz@infradead.org>
Cc: live-patching@vger.kernel.org
Cc: Hans de Goede <hansg@kernel.org>
Cc: Mauro Carvalho Chehab <mchehab@kernel.org>
Cc: Linus Torvalds <torvalds@linux-foundation.org>
Link: https://patch.msgid.link/bf8cd823a3f11f64cc82167913be5013c72afa57.1762991150.git.jpoimboe@kernel.org
2025-11-13 08:03:09 +01:00
Laurent Pinchart
ba92a96b1e media: saa7146: Replace saa7146_ext_vv.vbi_fops with write function
The vbi_fops stored in struct saa7146_ext_vv is a full
v4l2_file_operations, but only its .write field is used. Replace it with
a single vbi_write function pointer to save memory.

Signed-off-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
2025-11-03 15:58:42 +01:00
Laurent Pinchart
27aa2085c0 media: staging: ipu7: isys: Drop video_open() function
The video_open() function is just a wrapper around v4l2_fh_open().
Replace it by the latter in the v4l2_file_operations.

Signed-off-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
2025-10-29 14:07:01 +01:00
Laurent Pinchart
5d505becf7 media: ipu3-imgu: Drop struct imgu_device v4l2_file_ops field
The struct imgu_device v4l2_file_ops field is unused. Drop it.

Signed-off-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
2025-10-29 14:07:01 +01:00
Laurent Pinchart
1fdb55ed40 media: v4l2-mem2mem: Don't copy frame flags in v4l2_m2m_buf_copy_metadata()
The v4l2_m2m_buf_copy_metadata() function takes a boolean
copy_frame_flags argument. When true, it causes the function to copy the
V4L2_BUF_FLAG_KEYFRAME, V4L2_BUF_FLAG_BFRAME and V4L2_BUF_FLAG_PFRAME
flags from the output buffer to the capture buffer.

There is no use cases in any upstream driver for copying the flags.
KEY/P/B frames are properties of the bitstream buffer in some formats.
Once decoded, this is no longer a property of the video frame and should
be discarded.

It was considered useful to know if an uncompressed frame was decoded
from a KEY/P/B compressed frame, and to preserve that information if
that same uncompressed frame was passed through another M2M device (e.g.
a scaler). However, the V4L2 documentation makes it clear that the flags
are meant for compressed frames only.

Drop the copy_frame_flags argument from v4l2_m2m_buf_copy_metadata().
The change to drivers was performed with the following Coccinelle
semantic patch:

@@
expression src;
expression dst;
expression flag;
@@
-       v4l2_m2m_buf_copy_metadata(src, dst, flag);
+       v4l2_m2m_buf_copy_metadata(src, dst);

include/media/v4l2-mem2mem.h and drivers/media/v4l2-core/v4l2-mem2mem.c
have been updated manually.

Signed-off-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
Reviewed-by: Philipp Zabel <p.zabel@pengutronix.de>
Reviewed-by: Benjamin Gaignard <benjamin.gaignard@collabora.com>
Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
2025-10-17 11:31:16 +02:00
Ricardo Ribalda
d5ddab0cf0 media: staging/ipu7: Use %pe format specifier
The %pe format specifier is designed to print error pointers. It prints
a symbolic error name (eg. -EINVAL) and it makes the code simpler by
omitting PTR_ERR().

This patch fixes this cocci report:
./ipu7/ipu7-isys-csi-phy.c:311:23-30: WARNING: Consider using %pe to print PTR_ERR()
./ipu7/ipu7-isys-csi2.c:59:22-29: WARNING: Consider using %pe to print PTR_ERR()

Signed-off-by: Ricardo Ribalda <ribalda@chromium.org>
Acked-by: Sakari Ailus <sakari.ailus@linux.intel.com>
Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
2025-10-17 11:31:16 +02:00
Ricardo Ribalda
53a5927b44 media: staging: ipu3-imgu: Use %pe format specifier
The %pe format specifier is designed to print error pointers. It prints
a symbolic error name (eg. -EINVAL) and it makes the code simpler by
omitting PTR_ERR().

This patch fixes this cocci report:
./ipu3/ipu3.c:534:5-12: WARNING: Consider using %pe to print PTR_ERR()

Signed-off-by: Ricardo Ribalda <ribalda@chromium.org>
Acked-by: Sakari Ailus <sakari.ailus@linux.intel.com>
Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
2025-10-17 11:31:16 +02:00
Xichao Zhao
801d26487f staging: media: tegra-video: Remove the use of dev_err_probe()
The dev_err_probe() doesn't do anything when error is '-ENOMEM'.
Therefore, remove the useless call to dev_err_probe(), and just
return the value instead.

Signed-off-by: Xichao Zhao <zhao.xichao@vivo.com>
Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
2025-10-14 15:07:36 +02:00
Osama Albahrani
d22063f395 media: av7110: Fix warning 'unsigned' -> 'unsigned int'
Fix the following checkpatch warning:

av7110_ca.c:29: WARNING: Prefer 'unsigned int' to bare use of 'unsigned'

Signed-off-by: Osama Albahrani <osalbahr@gmail.com>
Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
2025-10-14 15:07:36 +02:00
Bingbu Cao
895d3b4b58 media: staging/ipu7: fix isys device runtime PM usage in firmware closing
The PM usage counter of isys was bumped up when start camera stream
(opening firmware) but it was not dropped after stream stop(closing
firmware), it forbids system fail to suspend due to the wrong PM state
of ISYS. This patch drop the PM usage counter in firmware close to fix
it.

Cc: Stable@vger.kernel.org
Fixes: a516d36bdc ("media: staging/ipu7: add IPU7 input system device driver")
Signed-off-by: Bingbu Cao <bingbu.cao@intel.com>
Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
2025-09-10 10:40:53 +02:00
Sakari Ailus
4010eef01d media: staging: ipu7: Don't include linux/version.h
linux/version.h isn't needed by the driver, don't include it.

Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
2025-09-09 15:59:16 +02:00
Colin Ian King
a8513f6a2c media: atomisp: Fix incorrect snprintf format specifiers for signed integers
There are incorrect %u format specifiers being used to for signed integers,
fix this by using %d instead.

Signed-off-by: Colin Ian King <colin.i.king@gmail.com>
Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
2025-08-29 11:04:02 +02:00
A.T. Jefferies
0089913524 staging: media: tegra-video: use BIT() macro instead of shift
Replace two instances of (1 << X) with BIT(X) in tegra20.c to follow
kernel coding style guidelines and improve clarity. The BIT() macro
also ensures proper type handling for larger shifts.

Signed-off-by: A.T. Jefferies <alextjefferies@gmail.com>
Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
2025-08-29 11:04:02 +02:00
Bingbu Cao
01a80b6649 media: staging/ipu7: cleanup the MMU correctly in IPU7 driver release
IPU7 ISYS and PSYS auxiliary devices are released after
ipu7_bus_del_devices(), so driver can not reference the MMU devices
from ISYS and PSYS auxiliary devices, so move the MMUs cleanup before
releasing the auxiliary devices.

Fixes: b7fe4c0019 ("media: staging/ipu7: add Intel IPU7 PCI device driver")
Signed-off-by: Bingbu Cao <bingbu.cao@intel.com>
[Sakari Ailus: Drop extra newline.]
Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
2025-08-25 15:40:43 +02:00
Bingbu Cao
8abb489f9a media: staging/ipu7: Don't set name for IPU7 PCI device
Driver better not dev_set_name() to change the PCI device
name, so remove it.

Fixes: b7fe4c0019 ("media: staging/ipu7: add Intel IPU7 PCI device driver")
Signed-off-by: Bingbu Cao <bingbu.cao@intel.com>
Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
2025-08-25 15:40:43 +02:00
Bingbu Cao
283f7638c2 media: staging/ipu7: convert to use pci_alloc_irq_vectors() API
pci_enable_msi() is a deprecated API, thus switch to use modern
pci_alloc_irq_vectors().

Fixes: b7fe4c0019 ("media: staging/ipu7: add Intel IPU7 PCI device driver")
Signed-off-by: Bingbu Cao <bingbu.cao@intel.com>
Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
2025-08-25 15:40:43 +02:00
Hans de Goede
1e72afb514 media: Move gc0310 sensor drivers to drivers/media/i2c/
The atomisp gc0310 sensor driver has now been fully converted to
a standard v4l2 sensor driver. Move it to drivers/media/i2c/
to reflect this.

Signed-off-by: Hans de Goede <hdegoede@redhat.com>
Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
2025-08-25 15:40:35 +02:00
Laurent Pinchart
8a14120d2a media: staging/ipu7: Use v4l2_ctrl_subdev_subscribe_event()
The ipu7-isys driver uses v4l2_ctrl_subscribe_event() to handle control
event subscription on a subdev. While this works, it is the wrong API.
Use the subdev-specific v4l2_ctrl_subdev_subscribe_event() helper
instead.

Signed-off-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
2025-08-25 15:40:34 +02:00
Laurent Pinchart
6ee42dfc29 media: staging: imx: Drop custom .unsubscribe_event() handler
The csi_unsubscribe_event() function simply calls
v4l2_event_unsubscribe(), forwarding its arguments. Replace it with the
v4l2_event_subdev_unsubscribe() helper that performs exactly the same
operation.

Signed-off-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
2025-08-25 15:40:33 +02:00
Laurent Pinchart
ed1390e5af media: staging: atomisp: Drop custom .unsubscribe_event() handler
The isp_subdev_unsubscribe_event() function simply calls
v4l2_event_unsubscribe(), forwarding its arguments. Replace it with the
v4l2_event_subdev_unsubscribe() helper that performs exactly the same
operation.

Signed-off-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
2025-08-25 15:40:33 +02:00
Laurent Pinchart
49cec2b5a3 media: staging/ipu7: Disallow source multiplexing
The IPU7 ISYS driver can't capture multiple streams on the same video
device. Disallow source multiplexing in the routes of the internal
subdev to reflect that limitation. As a result we can hardcode the
source stream to 0, simplifying the driver.

Signed-off-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
Reviewed-by: Jacopo Mondi <jacopo.mondi@ideasonboard.com>
Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
2025-08-25 15:40:32 +02:00
Nai-Chen Cheng
955c993d27 staging: media: ipu3: use string_choices API instead of ternary operator
Use string_choices API instead of manually determining the output using
ternary operator to improve code readability and consistency.

This also fixes cocci warning.

Signed-off-by: Nai-Chen Cheng <bleach1827@gmail.com>
Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
2025-08-25 15:40:31 +02:00
Laurent Pinchart
078f1a7eb4 media: staging: Rename second ioctl handlers argument to 'void *priv'
The second argument to the ioctl handlers is not a file handle any more.
The standard practice is to name it 'void *priv' in drivers. Many
drivers still name it 'void *fh', and a few use more exotic names.
Replace those more exotic names with 'void *priv' in all media staging
drivers.

Signed-off-by: Laurent Pinchart <laurent.pinchart+renesas@ideasonboard.com>
Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
2025-08-13 08:34:02 +02:00
Jacopo Mondi
d2683099c4 media: staging: imx: Access v4l2_fh from file
The v4l2_fh associated with an open file handle is now guaranteed
to be available in file->private_data, initialised by v4l2_fh_add().

Access the v4l2_fh, and from there the driver-specific structure,
from the file * in all ioctl handlers.

Signed-off-by: Jacopo Mondi <jacopo.mondi@ideasonboard.com>
Co-developed-by: Laurent Pinchart <laurent.pinchart+renesas@ideasonboard.com>
Signed-off-by: Laurent Pinchart <laurent.pinchart+renesas@ideasonboard.com>
Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
2025-08-13 08:33:56 +02:00
Laurent Pinchart
5c17eace98 media: staging: ipu7: isys: Don't set V4L2_FL_USES_V4L2_FH manually
The V4L2_FL_USES_V4L2_FH flag is set by v4l2_fh_init(). It is not meant
to be set manually by drivers. Drop it from the ipu7-isys driver.

Signed-off-by: Laurent Pinchart <laurent.pinchart+renesas@ideasonboard.com>
Reviewed-by: Sakari Ailus <sakari.ailus@linux.intel.com>
Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
2025-08-13 08:33:45 +02:00
Laurent Pinchart
277966749f media: Reset file->private_data to NULL in v4l2_fh_del()
Multiple drivers that use v4l2_fh and call v4l2_fh_del() manually reset
the file->private_data pointer to NULL in their video device .release()
file operation handler. Move the code to the v4l2_fh_del() function to
avoid direct access to file->private_data in drivers. This requires
adding a file pointer argument to the function.

Changes to drivers have been generated with the following coccinelle
semantic patch:

@@
expression fh;
identifier filp;
identifier release;
type ret;
@@
ret release(..., struct file *filp, ...)
{
	<...
-	filp->private_data = NULL;
	...
-	v4l2_fh_del(fh);
+	v4l2_fh_del(fh, filp);
	...>
}

@@
expression fh;
identifier filp;
identifier release;
type ret;
@@
ret release(..., struct file *filp, ...)
{
	<...
-	v4l2_fh_del(fh);
+	v4l2_fh_del(fh, filp);
	...
-	filp->private_data = NULL;
	...>
}

@@
expression fh;
identifier filp;
identifier release;
type ret;
@@
ret release(..., struct file *filp, ...)
{
	<...
-	v4l2_fh_del(fh);
+	v4l2_fh_del(fh, filp);
	...>
}

Manual changes have been applied to Documentation/ to update the usage
patterns, to drivers/media/v4l2-core/v4l2-fh.c to update the
v4l2_fh_del() prototype and reset file->private_data, and to
include/media/v4l2-fh.h to update the v4l2_fh_del() function prototype
and its documentation.

Additionally, white space issues have been fixed manually in
drivers/usb/gadget/function/uvc_v4l2.c

Signed-off-by: Laurent Pinchart <laurent.pinchart+renesas@ideasonboard.com>
Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
2025-08-13 08:33:44 +02:00
Laurent Pinchart
47f4b1acb4 media: Set file->private_data in v4l2_fh_add()
All the drivers that use v4l2_fh and call v4l2_fh_add() manually store a
pointer to the v4l2_fh instance in file->private_data in their video
device .open() file operation handler. Move the code to the
v4l2_fh_add() function to avoid direct access to file->private_data in
drivers. This requires adding a file pointer argument to the function.

Changes to drivers have been generated with the following coccinelle
semantic patch:

@@
expression fh;
identifier filp;
identifier open;
type ret;
@@
ret open(..., struct file *filp, ...)
{
	<...
-	filp->private_data = fh;
	...
-	v4l2_fh_add(fh);
+	v4l2_fh_add(fh, filp);
	...>
}

@@
expression fh;
identifier filp;
identifier open;
type ret;
@@
ret open(..., struct file *filp, ...)
{
	<...
-	v4l2_fh_add(fh);
+	v4l2_fh_add(fh, filp);
	...
-	filp->private_data = fh;
	...>
}

Manual changes have been applied to Documentation/ to update the usage
patterns, to drivers/media/v4l2-core/v4l2-fh.c to update the
v4l2_fh_add() prototype set file->private_data, and to
include/media/v4l2-fh.h to update the v4l2_fh_add() function prototype
and its documentation.

Additionally, white space issues have been fixed manually in
drivers/media/platform/nvidia/tegra-vde/v4l2.c,
drivers/media/platform/rockchip/rkvdec/rkvdec.c,
drivers/media/v4l2-core/v4l2-fh.c and
drivers/staging/most/video/video.c.

Signed-off-by: Laurent Pinchart <laurent.pinchart+renesas@ideasonboard.com>
Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
2025-08-13 08:33:39 +02:00
Laurent Pinchart
4416df03dd media: Replace file->private_data access with custom functions
Accessing file->private_data manually to retrieve the v4l2_fh pointer is
error-prone, as the field is a void * and will happily cast implicitly
to any pointer type.

Replace all remaining locations that read the v4l2_fh pointer directly
from file->private_data and cast it to driver-specific file handle
structures with driver-specific functions that use file_to_v4l2_fh() and
perform the same cast.

No functional change is intended, this only paves the way to remove
direct accesses to file->private_data and make V4L2 drivers safer.
Other accesses to the field will be addressed separately.

Signed-off-by: Laurent Pinchart <laurent.pinchart+renesas@ideasonboard.com>
Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
2025-08-13 08:33:30 +02:00
Linus Torvalds
0cdee263bc Merge tag 'media/v6.17-1' of git://git.kernel.org/pub/scm/linux/kernel/git/mchehab/linux-media
Pull media updates from Mauro Carvalho Chehab:

 - v4l2 core:
     - sub-device framework routing improvements
     - NV12M tiled variants added to v4l2_format_info
     - some fixes at control handler freeing logic
     - fixed H264 SEPARATE_COLOUR_PLANE check

 - new staging driver: Intel IPU7 PCI

 - Rockchip video decoder driver got promoted from staging

 - iris: added HEVC/VP9 encoder/decoder support

 - vsp1: driver has gained Renesas VSPX support

 - uvc:
     - switched to vb2 ioctl helpers
     - added MSXU 1.5 metadata support

 - atomisp: GC0310 sensor driver cleanups in preparation for moving it
   out of staging

 - Lots of cleanup, fixes and improvements

* tag 'media/v6.17-1' of git://git.kernel.org/pub/scm/linux/kernel/git/mchehab/linux-media: (310 commits)
  media: rkvdec: Unstage the driver
  media: rkvdec: Remove TODO file
  media: dt-bindings: rockchip: Add RK3576 Video Decoder bindings
  media: dt-bindings: rockchip: Document RK3588 Video Decoder bindings
  media: amphion: Support dmabuf and v4l2 buffer without binding
  media: verisilicon: postproc: 4K support
  media: v4l2: Add support for NV12M tiled variants to v4l2_format_info()
  media: uvcvideo: Use a count variable for meta_formats instead of 0 terminating
  media: uvcvideo: Auto-set UVC_QUIRK_MSXU_META
  media: uvcvideo: Introduce V4L2_META_FMT_UVC_MSXU_1_5
  media: uvcvideo: Introduce dev->meta_formats
  media: Documentation: Add note about UVCH length field
  media: uvcvideo: Do not mark valid metadata as invalid
  media: uvcvideo: uvc_v4l2_unlocked_ioctl: Invert PM logic
  media: core: export v4l2_translate_cmd
  media: uvcvideo: Turn on the camera if V4L2_EVENT_SUB_FL_SEND_INITIAL
  media: uvcvideo: Remove stream->is_streaming field
  media: uvcvideo: Split uvc_stop_streaming()
  media: uvcvideo: Handle locks in uvc_queue_return_buffers
  media: uvcvideo: Use vb2 ioctl and fop helpers
  ...
2025-07-31 13:16:09 -07:00
Kees Cook
ee4cf79820 staging: media: atomisp: Fix stack buffer overflow in gmin_get_var_int()
When gmin_get_config_var() calls efi.get_variable() and the EFI variable
is larger than the expected buffer size, two behaviors combine to create
a stack buffer overflow:

1. gmin_get_config_var() does not return the proper error code when
   efi.get_variable() fails. It returns the stale 'ret' value from
   earlier operations instead of indicating the EFI failure.

2. When efi.get_variable() returns EFI_BUFFER_TOO_SMALL, it updates
   *out_len to the required buffer size but writes no data to the output
   buffer. However, due to bug #1, gmin_get_var_int() believes the call
   succeeded.

The caller gmin_get_var_int() then performs:
- Allocates val[CFG_VAR_NAME_MAX + 1] (65 bytes) on stack
- Calls gmin_get_config_var(dev, is_gmin, var, val, &len) with len=64
- If EFI variable is >64 bytes, efi.get_variable() sets len=required_size
- Due to bug #1, thinks call succeeded with len=required_size
- Executes val[len] = 0, writing past end of 65-byte stack buffer

This creates a stack buffer overflow when EFI variables are larger than
64 bytes. Since EFI variables can be controlled by firmware or system
configuration, this could potentially be exploited for code execution.

Fix the bug by returning proper error codes from gmin_get_config_var()
based on EFI status instead of stale 'ret' value.

The gmin_get_var_int() function is called during device initialization
for camera sensor configuration on Intel Bay Trail and Cherry Trail
platforms using the atomisp camera stack.

Reported-by: zepta <z3ptaa@gmail.com>
Closes: https://lore.kernel.org/all/CAPBS6KoQyM7FMdPwOuXteXsOe44X4H3F8Fw+y_qWq6E+OdmxQA@mail.gmail.com
Fixes: 38d4f74bc1 ("media: atomisp_gmin_platform: stop abusing efivar API")
Reviewed-by: Hans de Goede <hansg@kernel.org>
Link: https://lore.kernel.org/r/20250724080756.work.741-kees@kernel.org
Signed-off-by: Kees Cook <kees@kernel.org>
2025-07-28 17:48:41 -07:00
Detlev Casanova
d968e50b5c media: rkvdec: Unstage the driver
The TODO list for unstaging being empty, the driver can now be moved to the
main media folder.

Also add myself as maintainer.

Signed-off-by: Detlev Casanova <detlev.casanova@collabora.com>
Reviewed-by: Nicolas Dufresne <nicolas.dufresne@collabora.com>
Signed-off-by: Nicolas Dufresne <nicolas.dufresne@collabora.com>
Signed-off-by: Hans Verkuil <hverkuil@xs4all.nl>
2025-07-12 08:34:48 +02:00
Detlev Casanova
e165f6eda5 media: rkvdec: Remove TODO file
2 items are present in the TODO file:
 - HEVC support
 - Evaluate adding helper for rkvdec_request_validate

Missing HEVC support is not a reason for a driver to be in staging,
support for different features of the hardware can be added in drivers
in the main tree.

The rkvdec_request_validate function was simplified in
commit 54676d5f56 ("media: rkvdec: Do not require all controls to be present in every request")
by not setting controls that have not changed.
As it now basically just calls vb2_request_validate(), there is no need
for a helper.

Signed-off-by: Detlev Casanova <detlev.casanova@collabora.com>
Reviewed-by: Nicolas Dufresne <nicolas.dufresne@collabora.com>
Signed-off-by: Nicolas Dufresne <nicolas.dufresne@collabora.com>
Signed-off-by: Hans Verkuil <hverkuil@xs4all.nl>
2025-07-12 08:34:48 +02:00
Arnd Bergmann
eb6ab8a997 media: staging/ipu7: add CONFIG_PCI dependency
This driver fails to build when PCI is disabled:

drivers/staging/media/ipu7/ipu7.c: In function 'ipu7_pci_config_setup':
drivers/staging/media/ipu7/ipu7.c:2260:15: error: implicit declaration of function 'pci_enable_msi'; did you mean 'pci_enable_sriov'? [-Wimplicit-function-declaration]
drivers/staging/media/ipu7/ipu7.c:2775:1: error: data definition has no type or storage class [-Werror]
driver(ipu7_pci_driver);
drivers/staging/media/ipu7/ipu7.c:2764:26: error: 'ipu7_pci_driver' defined but not used [-Werror=unused-variable]

Add the required Kconfig dependency.

Signed-off-by: Arnd Bergmann <arnd@arndb.de>
Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
Signed-off-by: Hans Verkuil <hverkuil@xs4all.nl>
2025-07-10 11:32:26 +02:00
Arnd Bergmann
6af7e00a92 media: staging/ipu7: avoid division by 64-bit value
On 32-bit targets, this causes a link failure:

x86_64-linux-ld: drivers/staging/media/ipu7/ipu7-isys-csi-phy.o: in function `ipu7_isys_phy_config':
ipu7-isys-csi-phy.c:(.text+0x1509): undefined reference to `__udivdi3'

Note that this does not divide a 64-bit number by a 32-bit one as usual,
but the other way round, which is something that the compiler should
really be able to figure out but does not (as of gcc-15).

A few lines higher, a similar division is done using the incorrect div_u64()
that truncates the 64-bit divisor to 32 bits.

Change both to use the safe but slow div64_u64() helper.

Fixes: a516d36bdc ("media: staging/ipu7: add IPU7 input system device driver")
Signed-off-by: Arnd Bergmann <arnd@arndb.de>
Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
Signed-off-by: Hans Verkuil <hverkuil@xs4all.nl>
2025-07-10 11:32:26 +02:00
Abdelrahman Fekry
54d32a9754 media: atomisp: Remove custom sysfs attributes from atomisp_drvfs.c
Continue the cleanup of the AtomISP driver, as discussed with Hans and Andy
in [1].

Tackle TODO item: "Remove custom sysfs files created by atomisp_drvfs.c":
- Remove the sysfs attributes `dbglvl`, `dbgfun`, and `dbgopt`.
- Delete their associated show/store handler functions.
- Remove the corresponding attribute group definitions.

Link: https://lore.kernel.org/all/836dc6b6-2821-47fc-8f24-0838f979af76@kernel.org/ [1]
Suggested-by: Hans de Goede <hansg@kernel.org>
Reviewed-by: Andy Shevchenko <andy@kernel.org>
Signed-off-by: Abdelrahman Fekry <abdelrahmanfekry375@gmail.com>
Link: https://lore.kernel.org/r/20250704161051.16733-1-abdelrahmanfekry375@gmail.com
[hansg@kernel.org: Completely remove the now empty atomisp_drvfs files]
Reviewed-by: Hans de Goede <hansg@kernel.org>
Signed-off-by: Hans de Goede <hansg@kernel.org>
Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
2025-07-08 08:43:33 +02:00
Abdelrahman Fekry
bd290dddb0 media: atomisp: Fix premature setting of HMM_BO_DEVICE_INITED flag
The HMM_BO_DEVICE_INITED flag was being set in hmm_bo_device_init()
before key initialization steps like kmem_cache_create(),
kmem_cache_alloc(), and __bo_init().

This means that if any of these steps fail, the flag remains set,
misleading other parts of the driver (e.g. hmm_bo_alloc())
into thinking the device is initialized. This could lead
to undefined behavior or invalid memory use.

Additionally, since __bo_init() is called from inside
hmm_bo_device_init() after the flag was already set, its internal
check for HMM_BO_DEVICE_INITED is redundant.

- Move the flag assignment to the end after all allocations succeed.
- Remove redundant check of the flag inside __bo_init()

See the link [1] below for a backtrace which happens when deliberately
triggering the problem of the flag getting set too early.

Link: https://lore.kernel.org/linux-media/CAGn2d8ONZpOHXex8kjeUDgRPiMqKp8vZ=xhGbEDGphV1t7ZEFw@mail.gmail.com/ [1]
Signed-off-by: Abdelrahman Fekry <abdelrahmanfekry375@gmail.com>
Link: https://lore.kernel.org/r/20250628052536.43737-1-abdelrahmanfekry375@gmail.com
Reviewed-by: Hans de Goede <hansg@kernel.org>
Signed-off-by: Hans de Goede <hansg@kernel.org>
Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
2025-07-08 08:43:33 +02:00
Abdelrahman Fekry
5e2330ef08 media: atomisp: Remove debug sysfs attributes active_bo and free_bo
The sysfs attributes active_bo and free_bo expose internal buffer
state used only for debugging purposes. These are not part of
any standard kernel ABI, and need to be removed before this
driver may be moved out of drivers/staging.

- Remove active_bo and free_bo attributes
- Remove group registration calls form hmm_init() and hmm_cleanup()

Suggested-by: Hans de Goede <hansg@kernel.org>
Signed-off-by: Abdelrahman Fekry <abdelrahmanfekry375@gmail.com>
Reviewed-by: Andy Shevchenko <andriy.shevchenko@intel.com>
Reviewed-by: Dan Carpenter <dan.carpenter@linaro.org>
Link: https://lore.kernel.org/r/20250627100604.29061-1-abdelrahmanfekry375@gmail.com
Reviewed-by: Hans de Goede <hansg@kernel.org>
Signed-off-by: Hans de Goede <hansg@kernel.org>
Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
2025-07-08 08:43:33 +02:00
Andy Shevchenko
379f5e1587 media: atomisp: Remove no more used macros from math_support.h
After recent cleanups the few macros become unused. Remove them.

Signed-off-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
Link: https://lore.kernel.org/r/20250519155028.526453-4-andriy.shevchenko@linux.intel.com
Reviewed-by: Hans de Goede <hansg@kernel.org>
Tested-by: Hans de Goede <hansg@kernel.org>
Signed-off-by: Hans de Goede <hansg@kernel.org>
Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
2025-07-08 08:43:33 +02:00
Andy Shevchenko
782fc724bf media: atomisp: Replace macros from math_support.h
Replace rarely used macros by generic ones from Linux kernel headers.

Signed-off-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
Link: https://lore.kernel.org/r/20250519155028.526453-3-andriy.shevchenko@linux.intel.com
Reviewed-by: Hans de Goede <hansg@kernel.org>
Tested-by: Hans de Goede <hansg@kernel.org>
Signed-off-by: Hans de Goede <hansg@kernel.org>
Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
2025-07-08 08:43:32 +02:00
Andy Shevchenko
58913d9652 media: atomisp: Remove unused header
There are some unused definitions that are using macros from
math_support.h. In order to have cleaner future changes, remove them first.

Signed-off-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
Link: https://lore.kernel.org/r/20250519155028.526453-2-andriy.shevchenko@linux.intel.com
Reviewed-by: Hans de Goede <hansg@kernel.org>
Tested-by: Hans de Goede <hansg@kernel.org>
Signed-off-by: Hans de Goede <hansg@kernel.org>
Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
2025-07-08 08:43:32 +02:00
Thomas Andreatta
3c92c08cd4 media: atomisp: ov2722: Fix struct definition style
Reorder const qualifier in array declaration.

Signed-off-by: Thomas Andreatta <thomas.andreatta2000@gmail.com>
Link: https://lore.kernel.org/r/20250619084420.146151-4-thomas.andreatta2000@gmail.com
Reviewed-by: Hans de Goede <hansg@kernel.org>
Signed-off-by: Hans de Goede <hansg@kernel.org>
Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
2025-07-08 08:43:32 +02:00
Thomas Andreatta
51c19651a7 media: atomisp: gc2235: Fix struct definition style
Reorder const qualifier in array declaration.

Signed-off-by: Thomas Andreatta <thomas.andreatta2000@gmail.com>
Link: https://lore.kernel.org/r/20250619084420.146151-3-thomas.andreatta2000@gmail.com
Reviewed-by: Hans de Goede <hansg@kernel.org>
Signed-off-by: Hans de Goede <hansg@kernel.org>
Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
2025-07-08 08:43:32 +02:00
Thomas Andreatta
11d3d8dd02 media: atomisp: gc0310: Remove redundant debug message
Checkpatch fix: deleted `dev_dbg()` printing the name of the function.
                ftrace can be used instead.

Signed-off-by: Thomas Andreatta <thomas.andreatta2000@gmail.com>
Link: https://lore.kernel.org/r/20250619084420.146151-2-thomas.andreatta2000@gmail.com
Reviewed-by: Hans de Goede <hansg@kernel.org>
Signed-off-by: Hans de Goede <hansg@kernel.org>
Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
2025-07-08 08:43:32 +02:00
Hans de Goede
4ea35dbdaf media: atomisp: gc0310: Drop gc0310_g_skip_frames()
The g_skip_frames sensor-op is obsolete, drop it.

Signed-off-by: Hans de Goede <hansg@kernel.org>
Reviewed-by: Kieran Bingham <kieran.bingham@ideasonboard.com>
Reviewed-by: Andy Shevchenko <andy@kernel.org>
Link: https://lore.kernel.org/r/20250517114106.43494-23-hansg@kernel.org
Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
2025-07-08 08:43:32 +02:00
Hans de Goede
3c30c8948d media: atomisp: gc0310: Drop gc0310_get_frame_interval()
On raw camera sensors the framerate is controlled through vblank
(and optional) hblank controls.

Having a get_frame_interval makes no sense in this case, drop it.

Signed-off-by: Hans de Goede <hansg@kernel.org>
Reviewed-by: Kieran Bingham <kieran.bingham@ideasonboard.com>
Reviewed-by: Andy Shevchenko <andy@kernel.org>
Link: https://lore.kernel.org/r/20250517114106.43494-22-hansg@kernel.org
Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
2025-07-08 08:43:32 +02:00
Hans de Goede
4aaa74642d media: atomisp: gc0310: runtime-PM fixes
The i2c-client's power-domain has already been powered up when probe()
gets called. So e.g. ACPI resources for regulators and clks have
already been enabled and only the GPIOs need to be set to the on state.

Instead of calling pm_runtime_set_suspended() while the domain is
already powered up and then have detect() do a pm_runtime_get()
to set the GPIOs do the following:

1. Call gc0310_power_on() to only set the GPIOs
2. Set the device's runtime-PM state to active instead of suspended
3. Avoid the device getting suspended as soon as pm_runtime_enable()
   gets called by calling pm_runtime_get() before _enable(), this means
   moving the pm_runtime_get() / _put() from detect() to probe ()

This fixes power_on() not getting called when runtime-PM is not
enabled in the Kconfig and this keeps the sensor powered-up while
registering it avoiding unnecessary power cycles.

Also modify gc0310_remove() to power-off the device if it is in
active state when gc0310_remove() runs.

Signed-off-by: Hans de Goede <hansg@kernel.org>
Reviewed-by: Andy Shevchenko <andy@kernel.org>
Link: https://lore.kernel.org/r/20250517114106.43494-21-hansg@kernel.org
Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
2025-07-08 08:43:31 +02:00