aboutsummaryrefslogtreecommitdiff
path: root/drivers/media
AgeCommit message (Collapse)AuthorFilesLines
2024-06-28media: vivid: loopback based on 'Connected To' controlsHans Verkuil11-277/+362
Instead of using hardwired video loopback limited to a single vivid instance, use the new 'Connected To' controls to only loopback if an HDMI or S-Video input is connected to another output, which can be in another vivid instance. Effectively this emulates connecting and disconnecting an HDMI/S-Video cable. The Loop Video control is dropped since it has now been replaced by the new 'Connected To' controls. The Display Present has also been dropped since it no longer fits. Signed-off-by: Hans Verkuil <[email protected]> Co-developed-by: Dorcas Anono Litunya <[email protected]> Signed-off-by: Dorcas Anono Litunya <[email protected]>
2024-06-28media: vivid: Add 'Is Connected To' menu controlsDorcas Anono Litunya3-17/+401
The video loopback functionality in vivid is very crude. What we really want is to be able to emulate connecting an HDMI or S-Video input to an HDMI or S-Video output, and the input and output can be in different vivid instances. Effectively this emulates what happens when you physically connect an HDMI or S-Video cable between two devices. In particular, this makes prototyping with vivid much more realistic. This patch creates a menu control for each HDMI or S-Video input. The menu control starts with "Test Pattern Generator" and "None" (i.e. disconnected). After that up to 62 HDMI or S-Video outputs are listed that you can connect the input to. If there are more than 62 HDMI or S-Video outputs, then those will not be included in the menu (currently menucontrols have max 64 entries). If an input is connected to an output, then all other 'Connected To' controls are updated to exclude that output to avoid having multiple inputs connected to the same output. Signed-off-by: Dorcas Anono Litunya <[email protected]> Signed-off-by: Hans Verkuil <[email protected]> [hverkuil: use u8 in loops in vivid_create_controls() to avoid truncate warning]
2024-06-28media: vivid: add instance number to input/output namesHans Verkuil2-12/+12
Add the instance number before the input or output number. So "HDMI 1" becomes "HDMI 000-1". This is helps identifying which input or output belongs to which vivid instance. Signed-off-by: Hans Verkuil <[email protected]>
2024-06-28media: vivid: don't set HDMI TX controls if there are no HDMI outputsHans Verkuil1-4/+8
When setting the EDID it would attempt to update two controls that are only present if there is an HDMI output configured. If there isn't any (e.g. when the vivid module is loaded with node_types=1), then calling VIDIOC_S_EDID would crash. Fix this by first checking if outputs are present. Signed-off-by: Hans Verkuil <[email protected]>
2024-06-28media: vivid: vidioc_g_edid: do not change the original input EDIDHans Verkuil2-4/+22
Returning an EDID for a connected output would modify the original input EDID with the physical address of the output. That causes problems, and it should just update the physical address of the output EDID. Update vivid_hdmi_edid to set the physical address to 0.0.0.0. Signed-off-by: Hans Verkuil <[email protected]>
2024-06-27Revert "media: stm32: dcmipp: correct error handling in dcmipp_create_subdevs"Hans Verkuil1-1/+1
This reverts commit 77d32b7e2a7b2e5389b67363d25371b4b8cad140. This patch is obviously wrong (causes array accesses at index -1), and I caught that just too late.
2024-06-27media: imx-mipi-csis: Use v4l2_subdev_enable_streams()Laurent Pinchart1-7/+15
To support sources that implement the .enable_streams() and .disable_streams() operations, replace the manual calls to the subdev .s_stream() operation with the v4l2_subdev_enable_streams() and v4l2_subdev_disable_streams() helpers. The helpers fall back to .s_stream() if the source doesn't implement the new operations, so backward compatibility is preserved. Signed-off-by: Laurent Pinchart <[email protected]> Reviewed-by: Tomi Valkeinen <[email protected]> Reviewed-by: Rui Miguel Silva <[email protected]> Signed-off-by: Sakari Ailus <[email protected]> Signed-off-by: Hans Verkuil <[email protected]>
2024-06-27media: i2c: gc2145: use CCI_REG16_LE for little-endian registersAlain Volmat1-10/+5
Use CCI_REG16_LE macro in order to access little-endian encoded registers of the P3 (CSI) section. Signed-off-by: Alain Volmat <[email protected]> Signed-off-by: Sakari Ailus <[email protected]> Signed-off-by: Hans Verkuil <[email protected]>
2024-06-27media: i2c: gc2145: addition of RAW8 formats supportAlain Volmat1-8/+67
Adds support for RAW8 formats (BGGR/RGGB/RBRG/BRBG). Signed-off-by: Alain Volmat <[email protected]> Signed-off-by: Sakari Ailus <[email protected]> Signed-off-by: Hans Verkuil <[email protected]> [hverkuil: fix typo: colospace -> colorspace]
2024-06-27media: stm32: dcmipp: correct error handling in dcmipp_create_subdevsAlain Volmat1-1/+1
Correct error handling within the dcmipp_create_subdevs by properly decrementing the i counter when releasing the subdeves. Fixes: 28e0f3772296 ("media: stm32-dcmipp: STM32 DCMIPP camera interface driver") Cc: [email protected] Signed-off-by: Alain Volmat <[email protected]> Signed-off-by: Sakari Ailus <[email protected]> Signed-off-by: Hans Verkuil <[email protected]>
2024-06-27media: raspberrypi: Add support for PiSP BENaushir Patuck8-0/+2346
Add support for the Raspberry Pi PiSP Back End. The driver has been upported from the Raspberry Pi kernel at revision f74893f8a0c2 ("drivers: media: pisp_be: Update seqeuence numbers of the buffers"). The ISP documentation is available at: https://datasheets.raspberrypi.com/camera/raspberry-pi-image-signal-processor-specification.pdf Signed-off-by: David Plowman <[email protected]> Signed-off-by: Naushir Patuck <[email protected]> Signed-off-by: Nick Hollinghurst <[email protected]> Signed-off-by: Jacopo Mondi <[email protected]> Signed-off-by: Sakari Ailus <[email protected]> Signed-off-by: Hans Verkuil <[email protected]> [hverkuil: drop dev_err after platform_get_irq to fix a coccinelle check]
2024-06-27media: uapi: Add PiSP Compressed RAW Bayer formatsJacopo Mondi1-0/+10
Add Raspberry Pi compressed RAW Bayer formats. The compression algorithm description is provided by Nick Hollinghurst <[email protected]> from Raspberry Pi. Signed-off-by: Jacopo Mondi <[email protected]> Reviewed-by: Naushir Patuck <[email protected]> Signed-off-by: Sakari Ailus <[email protected]> Signed-off-by: Hans Verkuil <[email protected]>
2024-06-27media: uapi: Add meta pixel format for PiSP BE configJacopo Mondi1-0/+1
Add format description for the PiSP Back End configuration parameter buffer. Signed-off-by: Jacopo Mondi <[email protected]> Reviewed-by: Naushir Patuck <[email protected]> Signed-off-by: Sakari Ailus <[email protected]> Signed-off-by: Hans Verkuil <[email protected]>
2024-06-27media: uapi: Add a pixel format for BGR48 and RGB48Jacopo Mondi2-0/+4
Add BGR48 and RGB48 16-bit per component image formats. Signed-off-by: Jacopo Mondi <[email protected]> Reviewed-by: Kieran Bingham <[email protected]> Reviewed-by: Naushir Patuck <[email protected]> Signed-off-by: Sakari Ailus <[email protected]> Signed-off-by: Hans Verkuil <[email protected]>
2024-06-26media: vivid: fix CREATE_BUFS support in queue_setup()Hans Verkuil4-4/+13
While queue_setup was correct for CREATE_BUFS support for video devices, for VBI, SDR and touch devices it was wrong. This was found after adding new v4l2-compliance tests. Signed-off-by: Hans Verkuil <[email protected]>
2024-06-26media: vivid: fix wrong sizeimage value for mplaneHans Verkuil2-9/+12
In several places a division by fmt->vdownsampling[p] was missing in the sizeimage[p] calculation, causing incorrect behavior for multiplanar formats were some planes are smaller than the first plane. Found by new v4l2-compliance tests. Signed-off-by: Hans Verkuil <[email protected]>
2024-06-26media: vimc: scaler: Use subdev active stateLaurent Pinchart1-75/+49
Store the active formats and crop rectangle in the subdevice active state. This simplifies implementation of the format and selection accessors, and allows using the v4l2_subdev_get_fmt() helper to implement the .get_fmt() operation. The active configuration that is used in the .process_frame() handler is still stored in the vimc_scaler_device structure. The driver could instead access the active state in the .process_frame() handler, but the required locking could interfere with the real time constraints of the frame processing. This data would be stored in registers in the .s_stream() handler for real hardware, storing it in dedicated storage thus mimics a real driver. To differentiate them from the rest of the device private data, move the corresponding fields to a sub-structure of vimc_scaler_device named hw. Signed-off-by: Laurent Pinchart <[email protected]> Signed-off-by: Shuah Khan <[email protected]> Signed-off-by: Hans Verkuil <[email protected]>
2024-06-26media: vimc: debayer: Use subdev active stateLaurent Pinchart1-101/+85
Store the active formats and crop rectangle in the subdevice active state. This simplifies implementation of the format and selection accessors, and allows using the v4l2_subdev_get_fmt() helper to implement the .get_fmt() operation. The active configuration that is used in the .process_frame() handler is still stored in the vimc_debayer_device structure. The driver could instead access the active state in the .process_frame() handler, but the required locking could interfere with the real time constraints of the frame processing. This data would be stored in registers in the .s_stream() handler for real hardware, storing it in dedicated storage thus mimics a real driver. To differentiate them from the rest of the device private data, move the corresponding fields to a sub-structure of vimc_debayer_device named hw. Signed-off-by: Laurent Pinchart <[email protected]> Signed-off-by: Shuah Khan <[email protected]> Signed-off-by: Hans Verkuil <[email protected]>
2024-06-26media: vimc: sensor: Use subdev active stateLaurent Pinchart1-58/+50
Store the active formats and crop rectangle in the subdevice active state. This simplifies implementation of the format and selection accessors, and allows using the v4l2_subdev_get_fmt() helper to implement the .get_fmt() operation. The active configuration that is used in the .process_frame() handler is still stored in the vimc_sensor_device structure. The driver could instead access the active state in the .process_frame() handler, but the required locking could interfere with the real time constraints of the frame processing. This data would be stored in registers in the .s_stream() handler for real hardware, storing it in dedicated storage thus mimics a real driver. To differentiate them from the rest of the device private data, move the corresponding fields to a sub-structure of vimc_sensor_device named hw. Signed-off-by: Laurent Pinchart <[email protected]> Signed-off-by: Shuah Khan <[email protected]> Signed-off-by: Hans Verkuil <[email protected]>
2024-06-26media: vimc: Initialize subdev active stateLaurent Pinchart5-1/+26
Finalize subdev initialization for all subdevs that provide a .init_state() operation. This creates an active state for all those subdevs, which subsequent patches will use to simplify the implementation of individual vimc entities. Signed-off-by: Laurent Pinchart <[email protected]> Signed-off-by: Shuah Khan <[email protected]> Signed-off-by: Hans Verkuil <[email protected]>
2024-06-26media: vimc: Centralize subdev internal_ops initializationLaurent Pinchart6-10/+10
Initialize the subdev internal_ops field in the vimc_ent_sd_register() function. This handles the internal ops the same way as the subdev ops, and prepares for moving to the V4L2 subdev active state API. Signed-off-by: Laurent Pinchart <[email protected]> Signed-off-by: Shuah Khan <[email protected]> Signed-off-by: Hans Verkuil <[email protected]>
2024-06-26media: vimc: scaler: Rename vic_sca_pad enum to vimc_scaler_padLaurent Pinchart1-1/+1
The vic_sca_pad enum's name has been shortened to the extreme for no good reason. Rename it to vimc_scaler_pad. Signed-off-by: Laurent Pinchart <[email protected]> Signed-off-by: Shuah Khan <[email protected]> Signed-off-by: Hans Verkuil <[email protected]>
2024-06-26media: vimc: Constify the ent_config arrayLaurent Pinchart1-1/+1
The ent_config array contains data that is never modified. Make it const. Signed-off-by: Laurent Pinchart <[email protected]> Signed-off-by: Shuah Khan <[email protected]> Signed-off-by: Hans Verkuil <[email protected]>
2024-06-26media: vimc: Constify vimc_ent_type structuresLaurent Pinchart6-11/+11
The vimc_ent_type structure contains static pointers to functions, and no other information that need to be modified after initialization. Make them const to avoid the risk of arbitrary code execution following an overflow that would overwrite the structure's contents. Signed-off-by: Laurent Pinchart <[email protected]> Signed-off-by: Shuah Khan <[email protected]> Signed-off-by: Hans Verkuil <[email protected]>
2024-06-26media: vimc: Don't iterate over single padLaurent Pinchart2-13/+6
The .init_state() operations of the debayer and sensor entities iterate over the entity's pads. In practice, the iteration covers a single pad only. Access the pad directly and remove the loops. Signed-off-by: Laurent Pinchart <[email protected]> Reviewed-by: Sakari Ailus <[email protected]> Signed-off-by: Shuah Khan <[email protected]> Signed-off-by: Hans Verkuil <[email protected]>
2024-06-26Merge tag 'tags/next-media-20240626' of ↵Hans Verkuil2-0/+4
git://git.kernel.org/pub/scm/linux/kernel/git/pinchartl/linux.git - fix typo in v4l2-subdev.h - imx-pxp bug fix - media i2c Kconfig: add missing FW_UPLOAD select Signed-off-by: Hans Verkuil <[email protected]>
2024-06-26Merge tag 'tags/next-media-renesas-20240619' of ↵Hans Verkuil30-723/+683
git://git.kernel.org/pub/scm/linux/kernel/git/pinchartl/linux.git - Conversion of max9286 and adv748x to V4L2 subdev active state - Cleanups and fixes for the Renesas R-Car VSP and VIN drivers - Miscellaneous cleanups to V4L2 core Signed-off-by: Hans Verkuil <[email protected]>
2024-06-26media: i2c: Kconfig: Fix missing firmware upload config selectKory Maincent1-0/+1
FW_LOADER config only selects the firmware loader API, but we also need the sysfs_upload symbols for firmware_upload_unregister() and firmware_upload_register() to function properly. Fixes: 7a52ab415b43 ("media: i2c: Add driver for THine THP7312") Cc: [email protected] Signed-off-by: Kory Maincent <[email protected]> Reviewed-by: Laurent Pinchart <[email protected]> Reviewed-by: Paul Elder <[email protected]> Link: https://lore.kernel.org/r/[email protected] Signed-off-by: Laurent Pinchart <[email protected]>
2024-06-26media: imx-pxp: Fix ERR_PTR dereference in pxp_probe()Harshit Mogalapalli1-0/+3
devm_regmap_init_mmio() can fail, add a check and bail out in case of error. Fixes: 4e5bd3fdbeb3 ("media: imx-pxp: convert to regmap") Cc: [email protected] Signed-off-by: Harshit Mogalapalli <[email protected]> Reviewed-by: Laurent Pinchart <[email protected]> Link: https://lore.kernel.org/r/[email protected] Signed-off-by: Laurent Pinchart <[email protected]>
2024-06-24media: i2c: Add GC05A2 image sensor driverZhi Mao3-0/+1370
Add a V4L2 sub-device driver for Galaxycore GC05A2 image sensor. Reviewed-by: AngeloGioacchino Del Regno <[email protected]> Signed-off-by: Zhi Mao <[email protected]> [Sakari Ailus: Fold in MAINTAINERS change.] Signed-off-by: Sakari Ailus <[email protected]> Signed-off-by: Hans Verkuil <[email protected]>
2024-06-24media: i2c: Add GC08A3 image sensor driverZhi Mao3-0/+1350
Add a V4L2 sub-device driver for Galaxycore GC08A3 image sensor. Reviewed-by: AngeloGioacchino Del Regno <[email protected]> Signed-off-by: Zhi Mao <[email protected]> [Sakari Ailus: Fold in MAINTAINERS change.] Signed-off-by: Sakari Ailus <[email protected]> Signed-off-by: Hans Verkuil <[email protected]>
2024-06-24media: b2c2: flexcop-usb: fix flexcop_usb_memory_reqHans Verkuil1-3/+4
smatch generated this warning: drivers/media/usb/b2c2/flexcop-usb.c:199 flexcop_usb_memory_req() warn: iterator 'i' not incremented and indeed the function is not using i or updating buf. The reason this always worked is that this function is called to write just 6 bytes (a MAC address) to the USB device, and so in practice there is only a single chunk written. If we ever would need to write more than one chunk, this function would fail since each chunk would read from or write to the same buf address. Rewrite the function to properly handle this. Signed-off-by: Hans Verkuil <[email protected]>
2024-06-24media: verisilicon : Use exported tables from v4l2-jpeg for hantro codecDevarsh Thakkar2-116/+14
Use v4l2-jpeg core API to import reference quantization and huffman tables used for JPEG Encoding. Signed-off-by: Devarsh Thakkar <[email protected]> Reviewed-by: Chen-Yu Tsai <[email protected]> Acked-by: Nicolas Dufresne <[email protected]> Signed-off-by: Sebastian Fricke <[email protected]> Signed-off-by: Hans Verkuil <[email protected]>
2024-06-24media: imagination: Use exported tables from v4l2-jpeg coreDevarsh Thakkar2-131/+23
Use exported huffman and quantization tables from v4l2-jpeg core library. Signed-off-by: Devarsh Thakkar <[email protected]> Signed-off-by: Sebastian Fricke <[email protected]> Signed-off-by: Hans Verkuil <[email protected]>
2024-06-24media: v4l2-jpeg: Export reference quantization and huffman tablesDevarsh Thakkar1-0/+116
Export reference quantization and huffman tables as provided in ITU-T.81 so that they can be re-used by other JPEG drivers. These are example tables provided in ITU-T.81 as reference tables and the JPEG encoders are free to use either these or their own proprietary tables. Also add necessary prefixes to be used for huffman tables in global header file. Signed-off-by: Devarsh Thakkar <[email protected]> Reviewed-by: Hans Verkuil <[email protected]> Signed-off-by: Sebastian Fricke <[email protected]> Signed-off-by: Hans Verkuil <[email protected]>
2024-06-24media: imagination: Add E5010 JPEG Encoder driverDevarsh Thakkar10-0/+3131
This adds support for stateful V4L2 M2M based driver for Imagination E5010 JPEG Encoder [1] which supports baseline encoding with two different quantization tables and compression ratio as demanded. Support for both contiguous and non-contiguous YUV420 and YUV422 semiplanar formats is added along with alignment restrictions as required by the hardware. System and runtime PM hooks are added in the driver along with v4l2 crop and selection API support. Minimum resolution supported is 64x64 and Maximum resolution supported is 8192x8192. All v4l2-compliance tests are passing [2] : v4l2-compliance -s -f -a -d /dev/video0 -e /dev/video1 Total for e5010 device /dev/video0: 79, Succeeded: 79, Failed: 0, Warnings: 0 NOTE: video1 here is VIVID test pattern generator Also tests [3] were run manually to verify below driver features: - Runtime Power Management - Multi-instance JPEG Encoding - DMABUF import, export support - NV12, NV21, NV16, NV61 video format support - Compression quality S_CTRL - Cropping support using S_SELECTION Existing V4L2 M2M based JPEG drivers namely s5p-jpeg, imx-jpeg and rcar_jpu were referred while making this. TODO: Add MMU and memory tiling support [1]: AM62A TRM (Section 7.6 is for JPEG Encoder) : Link: https://www.ti.com/lit/pdf/spruj16 [2]: v4l2-compliance test : Link: https://gist.github.com/devarsht/1f039c631ca953a57f405cfce1b69e49 [3]: E5010 JPEG Encoder Manual tests : Performance: Link: https://gist.github.com/devarsht/c40672944fd71c9a53ab55adbfd9e28b Functionality: Link: https://gist.github.com/devarsht/8e88fcaabff016bb2bac83d89c9d23ce Compression Quality: Link: https://gist.github.com/devarsht/cbcc7cd97e8c48ba1486caa2b7884655 Multi Instance: Link: https://gist.github.com/devarsht/22c2fca08cd3441fb40f2c7a4cebc95a Crop support: Link: https://gist.github.com/devarsht/de6f5142f678bb1a5338abfd9f814abd Runtime PM: Link: https://gist.github.com/devarsht/70cd95d4440ddc678489d93885ddd4dd Co-developed-by: David Huang <[email protected]> Signed-off-by: David Huang <[email protected]> Signed-off-by: Devarsh Thakkar <[email protected]> Reviewed-by: Benjamin Gaignard <[email protected]> Signed-off-by: Sebastian Fricke <[email protected]> Signed-off-by: Hans Verkuil <[email protected]>
2024-06-21media: chips-media: wave5: support Wave515 decoderIvan Bornyakov10-79/+280
Add initial support for the Wave515 multi-decoder IP. For now it is only able to decode HEVC Main/Main10 profile videos into YUV420. This was tested on FPGA prototype, so wave5_dt_ids[] was not expanded. Users of the real hardware with Wave515 IP will have to * provide firmware specific to their SoC * add struct wave5_match_data like this: static const struct wave5_match_data platform_name_wave515_data = { .flags = WAVE5_IS_DEC, .fw_name = "cnm/wave515_platform_name_fw.bin", .sram_size = (71 * 1024), }; * add item to wave5_dt_ids[] like this: { .compatible = "vendor,soc-wave515", .data = &platform_name_wave515_data, }, * describe new compatible in Documentation/devicetree/bindings/media/cnm,wave521c.yaml Signed-off-by: Ivan Bornyakov <[email protected]> Signed-off-by: Sebastian Fricke <[email protected]> Signed-off-by: Hans Verkuil <[email protected]>
2024-06-21media: chips-media: wave5: drop "sram-size" DT propertyIvan Bornyakov3-22/+72
Move the excessive "sram-size" device-tree property to the device match data. Also change the SRAM memory allocation strategy, instead of allocating exactly sram_size bytes, allocate all available SRAM memory up to sram_size. Add the placeholders wave5_vpu_dec_validate_sec_axi() and wave5_vpu_enc_validate_sec_axi() to validate that the allocated SRAM memory is sufficient to decode/encode bitstream with a given resolution. Signed-off-by: Ivan Bornyakov <[email protected]> Signed-off-by: Sebastian Fricke <[email protected]> Signed-off-by: Hans Verkuil <[email protected]>
2024-06-21media: chips-media: wave5: separate irq setup routineIvan Bornyakov1-29/+24
Implement a separate setup routine for interrupts to reduce code duplication. Also enable interrupts based on vpu_attr->support_encoders and vpu_attr->support_decoders fields to facilitate support for other Wave5xx IPs, because not all of them are both encoders and decoders. Signed-off-by: Ivan Bornyakov <[email protected]> Signed-off-by: Sebastian Fricke <[email protected]> Signed-off-by: Hans Verkuil <[email protected]>
2024-06-21media: chips-media: wave5: support reset linesIvan Bornyakov2-1/+16
Add initial support for optional reset lines. For now, simply deassert resets while probing the driver and assert them back when removing the driver. Signed-off-by: Ivan Bornyakov <[email protected]> Signed-off-by: Sebastian Fricke <[email protected]> Signed-off-by: Hans Verkuil <[email protected]>
2024-06-21media: chips-media: wave5: support decoding HEVC Main10 profileIvan Bornyakov2-13/+18
Add support for decoding HEVC Main10 profile by scaling the FBC buffer stride and size by a factor of (bitdepth / 8). Signed-off-by: Ivan Bornyakov <[email protected]> Signed-off-by: Sebastian Fricke <[email protected]> Signed-off-by: Hans Verkuil <[email protected]>
2024-06-21media: imx-jpeg: Drop initial source change event if capture has been setupMing Qian1-0/+3
In section 4.5.1.5. Initialization, the step 4 may be skipped and continue with the Capture Setup sequence, so if the capture has been setup, there is no need to trigger the initial source change event, just start decoding, and follow the dynamic resolution change flow if the configured values do not match those parsed by the decoder. And it won't fail the gstreamer pipeline. Fixes: b833b178498d ("media: imx-jpeg: notify source chagne event when the first picture parsed") Signed-off-by: Ming Qian <[email protected]> Signed-off-by: Hans Verkuil <[email protected]>
2024-06-21media: imx-jpeg: Remove some redundant error logsMing Qian1-11/+0
If the picture size parsed by decoder is different from those previously established, it's a normal flow of dynamic resolution change, not an error case, the log may mislead that some error occurs in decoding, so remove the error log in this case. Fixes: 2db16c6ed72c ("media: imx-jpeg: Add V4L2 driver for i.MX8 JPEG Encoder/Decoder") Signed-off-by: Ming Qian <[email protected]> Signed-off-by: Hans Verkuil <[email protected]>
2024-06-21media: Convert from tasklet to BH workqueueAllen Pais30-129/+141
The only generic interface to execute asynchronously in the BH context is tasklet; however, it's marked deprecated and has some design flaws. To replace tasklets, BH workqueue support was recently added. A BH workqueue behaves similarly to regular workqueues except that the queued work items are executed in the BH context. This patch converts drivers/media/* from tasklet to BH workqueue. Based on the work done by Tejun Heo <[email protected]> Signed-off-by: Allen Pais <[email protected]> Signed-off-by: Hans Verkuil <[email protected]>
2024-06-21media: cx231xx: Constify struct vb2_opsChristophe JAILLET2-2/+2
"struct vb2_ops" are not modified in this driver. Constifying this structure moves some data to a read-only section, so increase overall security. On a x86_64, with allmodconfig: Before: ====== text data bss dec hex filename 36607 1156 0 37763 9383 drivers/media/usb/cx231xx/cx231xx-417.o After: ===== text data bss dec hex filename 36735 1016 0 37751 9377 drivers/media/usb/cx231xx/cx231xx-417.o Signed-off-by: Christophe JAILLET <[email protected]> Signed-off-by: Hans Verkuil <[email protected]>
2024-06-21media: xc2028: avoid use-after-free in load_firmware_cb()Chi Zhiling1-1/+8
syzkaller reported use-after-free in load_firmware_cb() [1]. The reason is because the module allocated a struct tuner in tuner_probe(), and then the module initialization failed, the struct tuner was released. A worker which created during module initialization accesses this struct tuner later, it caused use-after-free. The process is as follows: task-6504 worker_thread tuner_probe <= alloc dvb_frontend [2] ... request_firmware_nowait <= create a worker ... tuner_remove <= free dvb_frontend ... request_firmware_work_func <= the firmware is ready load_firmware_cb <= but now the dvb_frontend has been freed To fix the issue, check the dvd_frontend in load_firmware_cb(), if it is null, report a warning and just return. [1]: ================================================================== BUG: KASAN: use-after-free in load_firmware_cb+0x1310/0x17a0 Read of size 8 at addr ffff8000d7ca2308 by task kworker/2:3/6504 Call trace: load_firmware_cb+0x1310/0x17a0 request_firmware_work_func+0x128/0x220 process_one_work+0x770/0x1824 worker_thread+0x488/0xea0 kthread+0x300/0x430 ret_from_fork+0x10/0x20 Allocated by task 6504: kzalloc tuner_probe+0xb0/0x1430 i2c_device_probe+0x92c/0xaf0 really_probe+0x678/0xcd0 driver_probe_device+0x280/0x370 __device_attach_driver+0x220/0x330 bus_for_each_drv+0x134/0x1c0 __device_attach+0x1f4/0x410 device_initial_probe+0x20/0x30 bus_probe_device+0x184/0x200 device_add+0x924/0x12c0 device_register+0x24/0x30 i2c_new_device+0x4e0/0xc44 v4l2_i2c_new_subdev_board+0xbc/0x290 v4l2_i2c_new_subdev+0xc8/0x104 em28xx_v4l2_init+0x1dd0/0x3770 Freed by task 6504: kfree+0x238/0x4e4 tuner_remove+0x144/0x1c0 i2c_device_remove+0xc8/0x290 __device_release_driver+0x314/0x5fc device_release_driver+0x30/0x44 bus_remove_device+0x244/0x490 device_del+0x350/0x900 device_unregister+0x28/0xd0 i2c_unregister_device+0x174/0x1d0 v4l2_device_unregister+0x224/0x380 em28xx_v4l2_init+0x1d90/0x3770 The buggy address belongs to the object at ffff8000d7ca2000 which belongs to the cache kmalloc-2k of size 2048 The buggy address is located 776 bytes inside of 2048-byte region [ffff8000d7ca2000, ffff8000d7ca2800) The buggy address belongs to the page: page:ffff7fe00035f280 count:1 mapcount:0 mapping:ffff8000c001f000 index:0x0 flags: 0x7ff800000000100(slab) raw: 07ff800000000100 ffff7fe00049d880 0000000300000003 ffff8000c001f000 raw: 0000000000000000 0000000080100010 00000001ffffffff 0000000000000000 page dumped because: kasan: bad access detected Memory state around the buggy address: ffff8000d7ca2200: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ffff8000d7ca2280: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb >ffff8000d7ca2300: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ^ ffff8000d7ca2380: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ffff8000d7ca2400: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ================================================================== [2] Actually, it is allocated for struct tuner, and dvb_frontend is inside. Signed-off-by: Chi Zhiling <[email protected]> Signed-off-by: Hans Verkuil <[email protected]>
2024-06-20media: platform: mtk-mdp3: Add support for MT8188 MDP3 componentsAngeloGioacchino Del Regno4-0/+285
MT8195 and MT8188 share a similar MDP3 macro-block, with minor differences - as in, the latter supports a subset of the number of components supported by the former, but are otherwise handled in the same way. Add driver data for MT8188, reusing the already present MT8195 data where possible. Signed-off-by: AngeloGioacchino Del Regno <[email protected]> Reviewed-by: Fei Shao <[email protected]> Signed-off-by: Sebastian Fricke <[email protected]> Signed-off-by: Hans Verkuil <[email protected]>
2024-06-20Merge tag 'tags/media-next-uvc-20240617-2' of ↵Hans Verkuil4-271/+261
git://git.kernel.org/pub/scm/linux/kernel/git/pinchartl/linux.git into media_stage uvcvideo fixes and improvements: - add/fix quirks - improve timestamp handling - improve Power Line Frequency handling Signed-off-by: Hans Verkuil <[email protected]>
2024-06-20media: rc: add missing MODULE_DESCRIPTION() macroJeff Johnson1-0/+1
With ARCH=x86, make allmodconfig && make W=1 C=1 reports: WARNING: modpost: missing MODULE_DESCRIPTION() in drivers/media/rc/rc-core.o Add the missing invocation of the MODULE_DESCRIPTION() macro. Signed-off-by: Jeff Johnson <[email protected]> Signed-off-by: Sean Young <[email protected]> Signed-off-by: Hans Verkuil <[email protected]>
2024-06-20media: renesas: vsp1: Initialize control handler after subdevLaurent Pinchart2-16/+16
Some VSP modules initialize their control handler after initializing the subdev, while some initialize it before. This makes the code inconsistent and more error prone. Standardize on control initialization after initializing the subdev. Signed-off-by: Laurent Pinchart <[email protected]> Reviewed-by: Jacopo Mondi <[email protected]>